fix: remove dead code & save config (#2975)

* feat: add awg3.1 support

* fix: add warning for big native awg qr codes

* fix: show default subnet address if not exist in server config

* fix: use range keep alive only with awg3 params

* chore: update awg go versions in conan

* chore: update awg-go version

.github/workflows/deploy.yml

@@ -745,11 +745,37 @@ jobs:
     needs: Bake-Prebuilts-Android
     if: ${{ always() }}
 
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: 'android9-10'
+            qt_version: '6.10.1'
+            min_sdk: 28
+            max_sdk: 29
+            version_code_offset: 0
+            build_aab: true
+          - label: 'android11+'
+            qt_version: '6.10.3'
+            min_sdk: 30
+            max_sdk: ''
+            version_code_offset: 1
+            build_aab: true
+          - label: 'android9-10-qt610-3'
+            qt_version: '6.10.3'
+            min_sdk: 28
+            max_sdk: 29
+            version_code_offset: 0
+            build_aab: false
+
     env:
-      ANDROID_PLATFORM: android-28
+      ANDROID_PLATFORM: android-${{ matrix.min_sdk }}
       NDK_VERSION: 27.0.11718014
-      QT_VERSION: 6.10.3
+      QT_VERSION: ${{ matrix.qt_version }}
       QT_MODULES: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
+      APP_ANDROID_MIN_SDK: ${{ matrix.min_sdk }}
+      APP_ANDROID_MAX_SDK: ${{ matrix.max_sdk }}
+      APP_ANDROID_VERSION_CODE_OFFSET: ${{ matrix.version_code_offset }}
       PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
       PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
       FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
@@ -857,62 +883,82 @@ jobs:
         QT_ANDROID_KEYSTORE_PATH: ${{ github.workspace }}/android.keystore
         QT_ANDROID_KEYSTORE_ALIAS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_ALIAS }}
         QT_ANDROID_KEYSTORE_STORE_PASS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_PASS }}
+        LABEL: ${{ matrix.label }}
+        BUILD_AAB: ${{ matrix.build_aab }}
       shell: bash
       run: |
-        deploy/build.sh -t android --sign --aab
+        OUT=deploy/artifacts
+        rm -rf $OUT && mkdir -p $OUT
+
+        if [[ "$BUILD_AAB" == "true" ]]; then
+          deploy/build.sh -t android --sign --aab
+        else
+          deploy/build.sh -t android --sign
+        fi
 
         VERSION=$(grep CMAKE_PROJECT_VERSION:STATIC deploy/build/CMakeCache.txt | cut -d= -f2)
 
-        (cd deploy/build/client/android-build && mv AmneziaVPN.apk AmneziaVPN_${VERSION}_android9+_universal.apk)
-        (cd deploy/build/client/android-build/build/outputs/bundle/release && mv android-build-release.aab AmneziaVPN_${VERSION}.aab)
+        mv deploy/build/client/android-build/AmneziaVPN.apk \
+           $OUT/AmneziaVPN_${VERSION}_${LABEL}_universal.apk
+
+        if [[ "$BUILD_AAB" == "true" ]]; then
+          mv deploy/build/client/android-build/build/outputs/bundle/release/android-build-release.aab \
+             $OUT/AmneziaVPN_${VERSION}_${LABEL}.aab
+        fi
 
         for abi in arm64-v8a armeabi-v7a x86 x86_64; do
           deploy/build.sh -t android --sign --abi ${abi} --build ./deploy/build/${abi}
-          (cd deploy/build/${abi}/client/android-build && mv AmneziaVPN.apk AmneziaVPN_${VERSION}_android9+_${abi}.apk)
+          mv deploy/build/${abi}/client/android-build/AmneziaVPN.apk \
+             $OUT/AmneziaVPN_${VERSION}_${LABEL}_${abi}.apk
         done
 
+        ls -l $OUT
+
     - name: 'Upload universal APK'
       uses: actions/upload-artifact@v7
       with:
-        path: deploy/build/client/android-build/*.apk
-        archive: false
-        retention-days: 7
-
-    - name: 'Upload AAB'
-      uses: actions/upload-artifact@v7
-      with:
-        path: deploy/build/client/android-build/build/outputs/bundle/release/*.aab
+        path: deploy/artifacts/*_universal.apk
         archive: false
         retention-days: 7
 
     - name: 'Upload arm64-v8a APK'
       uses: actions/upload-artifact@v7
       with:
-        path: deploy/build/arm64-v8a/client/android-build/*.apk
+        path: deploy/artifacts/*_arm64-v8a.apk
         archive: false
         retention-days: 7
 
     - name: 'Upload armeabi-v7a APK'
       uses: actions/upload-artifact@v7
       with:
-        path: deploy/build/armeabi-v7a/client/android-build/*.apk
+        path: deploy/artifacts/*_armeabi-v7a.apk
         archive: false
         retention-days: 7
 
     - name: 'Upload x86 APK'
       uses: actions/upload-artifact@v7
       with:
-        path: deploy/build/x86/client/android-build/*.apk
+        path: deploy/artifacts/*_x86.apk
         archive: false
         retention-days: 7
 
     - name: 'Upload x86_64 APK'
       uses: actions/upload-artifact@v7
       with:
-        path: deploy/build/x86_64/client/android-build/*.apk
+        path: deploy/artifacts/*_x86_64.apk
         archive: false
         retention-days: 7
 
+    - name: 'Upload AAB'
+      if: ${{ matrix.build_aab }}
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/artifacts/*.aab
+        archive: false
+        retention-days: 7
+
+# ------------------------------------------------------
+
   Extra:
     runs-on: ubuntu-latest
     steps:

CMakeLists.txt

@@ -4,7 +4,7 @@ set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 5.0.1.0)
+set(AMNEZIAVPN_VERSION 5.0.1.1)
 
 set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
 set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
@@ -28,7 +28,12 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")
 
 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2141)
+
+# bump by 2 on every release, because we're releasing two versions on the play store
+set(APP_ANDROID_VERSION_CODE 2148)
+if(DEFINED APP_ANDROID_VERSION_CODE_OFFSET)
+    math(EXPR APP_ANDROID_VERSION_CODE "${APP_ANDROID_VERSION_CODE} + ${APP_ANDROID_VERSION_CODE_OFFSET}")
+endif()
 
 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
     set(MZ_PLATFORM_NAME "linux")

client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/Wireguard.kt

@@ -148,6 +148,10 @@ open class Wireguard : Protocol() {
             ?.let { setKeepaliveTimeout(it) }
         configData.optStringOrNull("MaxHandshakeAttempts")?.trim()?.takeIf { it.isNotEmpty() }
             ?.let { setMaxHandshakeAttempts(it) }
+        configData.optStringOrNull("RandomTrailers")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setRandomTrailers(it) }
+        configData.optStringOrNull("DisableCookies")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setDisableCookies(it) }
     }
 
     private fun start(

client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/WireguardConfig.kt

@@ -38,6 +38,8 @@ open class WireguardConfig protected constructor(
     val rejectAfterTime: String?,
     val keepaliveTimeout: String?,
     val maxHandshakeAttempts: String?,
+    val randomTrailers: String?,
+    val disableCookies: String?,
 ) : ProtocolConfig(protocolConfigBuilder) {
 
     protected constructor(builder: Builder) : this(
@@ -71,6 +73,8 @@ open class WireguardConfig protected constructor(
         builder.rejectAfterTime,
         builder.keepaliveTimeout,
         builder.maxHandshakeAttempts,
+        builder.randomTrailers,
+        builder.disableCookies,
     )
 
     fun toWgUserspaceString(): String = with(StringBuilder()) {
@@ -108,6 +112,8 @@ open class WireguardConfig protected constructor(
         rejectAfterTime?.takeIf { it.isNotEmpty() }?.let { appendLine("reject_after_time=$it") }
         keepaliveTimeout?.takeIf { it.isNotEmpty() }?.let { appendLine("keepalive_timeout=$it") }
         maxHandshakeAttempts?.takeIf { it.isNotEmpty() }?.let { appendLine("max_handshake_attempts=$it") }
+        randomTrailers?.takeIf { it.isNotEmpty() }?.let { appendLine("random_trailers=${it.toUapiBool()}") }
+        disableCookies?.takeIf { it.isNotEmpty() }?.let { appendLine("disable_cookies=${it.toUapiBool()}") }
     }
 
     private fun validateProtocolExtensionParameters() {
@@ -177,6 +183,8 @@ open class WireguardConfig protected constructor(
         internal var rejectAfterTime: String? = null
         internal var keepaliveTimeout: String? = null
         internal var maxHandshakeAttempts: String? = null
+        internal var randomTrailers: String? = null
+        internal var disableCookies: String? = null
 
         fun setEndpoint(endpoint: InetEndpoint) = apply { this.endpoint = endpoint }
 
@@ -213,6 +221,8 @@ open class WireguardConfig protected constructor(
         fun setRejectAfterTime(rejectAfterTime: String) = apply { this.rejectAfterTime = rejectAfterTime }
         fun setKeepaliveTimeout(keepaliveTimeout: String) = apply { this.keepaliveTimeout = keepaliveTimeout }
         fun setMaxHandshakeAttempts(maxHandshakeAttempts: String) = apply { this.maxHandshakeAttempts = maxHandshakeAttempts }
+        fun setRandomTrailers(randomTrailers: String) = apply { this.randomTrailers = randomTrailers }
+        fun setDisableCookies(disableCookies: String) = apply { this.disableCookies = disableCookies }
 
         override fun build(): WireguardConfig = configBuild().run { WireguardConfig(this@Builder) }
     }
@@ -224,3 +234,9 @@ open class WireguardConfig protected constructor(
 
 @OptIn(ExperimentalStdlibApi::class)
 internal fun String.base64ToHex(): String = Base64.decode(this, Base64.DEFAULT).toHexString()
+
+/** Converts awg-quick on/off (and 0/1/true/false) to UAPI 1/0 for amneziawg-go ParseBool. */
+internal fun String.toUapiBool(): String = when (trim().lowercase()) {
+    "on", "1", "true", "t", "yes" -> "1"
+    else -> "0"
+}

client/cmake/android.cmake

@@ -1,6 +1,8 @@
 message("Client android ${CMAKE_ANDROID_ARCH_ABI} build")
 
-set(APP_ANDROID_MIN_SDK 28)
+if(NOT DEFINED APP_ANDROID_MIN_SDK)
+    set(APP_ANDROID_MIN_SDK 28)
+endif()
 set(ANDROID_PLATFORM "android-${APP_ANDROID_MIN_SDK}" CACHE STRING
     "The minimum API level supported by the application or library" FORCE)
 
@@ -13,7 +15,6 @@ set_target_properties(${PROJECT} PROPERTIES
     QT_ANDROID_MIN_SDK_VERSION ${APP_ANDROID_MIN_SDK}
     QT_ANDROID_TARGET_SDK_VERSION 36
     QT_ANDROID_SDK_BUILD_TOOLS_REVISION 36.0.0
-    QT_ANDROID_PACKAGE_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/android
 )
 
 set(QT_ANDROID_MULTI_ABI_FORWARD_VARS "QT_NO_GLOBAL_APK_TARGET_PART_OF_ALL;CMAKE_BUILD_TYPE")
@@ -53,3 +54,27 @@ file(COPY ${AMNEZIA_LIBXRAY_PATH} DESTINATION ${CMAKE_CURRENT_SOURCE_DIR}/androi
 find_package(openvpn-pt-android REQUIRED)
 set(LIBS ${LIBS} amnezia::openvpn-pt-android)
 set_property(TARGET ${PROJECT} APPEND PROPERTY QT_ANDROID_EXTRA_LIBS ${OPENVPN_PT_ANDROID_LIBCK_OVPN_PLUGIN_PATH})
+
+set(APP_ANDROID_PACKAGE_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/android)
+
+if(APP_ANDROID_MAX_SDK)
+    set(APP_ANDROID_PACKAGE_SOURCE_DIR ${CMAKE_CURRENT_BINARY_DIR}/android-package-source)
+    file(REMOVE_RECURSE ${APP_ANDROID_PACKAGE_SOURCE_DIR})
+    file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/android/ DESTINATION ${APP_ANDROID_PACKAGE_SOURCE_DIR})
+
+    set(manifest_path ${APP_ANDROID_PACKAGE_SOURCE_DIR}/AndroidManifest.xml)
+    set(manifest_anchor "android:installLocation=\"auto\">")
+    file(READ ${manifest_path} manifest_contents)
+    string(REPLACE
+        "${manifest_anchor}"
+        "${manifest_anchor}\n\n    <uses-sdk android:maxSdkVersion=\"${APP_ANDROID_MAX_SDK}\" />"
+        patched_contents "${manifest_contents}")
+    if(patched_contents STREQUAL manifest_contents)
+        message(FATAL_ERROR
+            "Failed to set maxSdkVersion=${APP_ANDROID_MAX_SDK}: anchor '${manifest_anchor}' "
+            "not found in ${CMAKE_CURRENT_SOURCE_DIR}/android/AndroidManifest.xml")
+    endif()
+    file(WRITE ${manifest_path} "${patched_contents}")
+endif()
+
+set_property(TARGET ${PROJECT} PROPERTY QT_ANDROID_PACKAGE_SOURCE_DIR ${APP_ANDROID_PACKAGE_SOURCE_DIR})

client/cmake/sources.cmake

@@ -64,6 +64,7 @@ set(HEADERS ${HEADERS}
     ${CLIENT_ROOT_DIR}/../common/crypto/cryptoUtils.h
     ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.h
     ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.h
+    ${CLIENT_ROOT_DIR}/core/utils/api/gatewayPayloadBuilder.h
     ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.h
     ${CLIENT_ROOT_DIR}/core/utils/utilities.h
     ${CLIENT_ROOT_DIR}/core/utils/managementServer.h
@@ -147,6 +148,7 @@ set(SOURCES ${SOURCES}
     ${CLIENT_ROOT_DIR}/../common/crypto/cryptoUtils.cpp
     ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.cpp
     ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.cpp
+    ${CLIENT_ROOT_DIR}/core/utils/api/gatewayPayloadBuilder.cpp
     ${CLIENT_ROOT_DIR}/core/utils/serverConfigUtils.cpp
     ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.cpp
     ${CLIENT_ROOT_DIR}/core/utils/utilities.cpp

client/core/configurators/awgConfigurator.cpp

@@ -106,6 +106,8 @@ ProtocolConfig AwgConfigurator::createConfig(const ServerCredentials &credential
     newClientConfig.rejectAfterTime = configMap.value(configKey::rejectAfterTime);
     newClientConfig.keepaliveTimeout = configMap.value(configKey::keepaliveTimeout);
     newClientConfig.maxHandshakeAttempts = configMap.value(configKey::maxHandshakeAttempts);
+    newClientConfig.randomTrailers = configMap.value(configKey::randomTrailers);
+    newClientConfig.disableCookies = configMap.value(configKey::disableCookies);
 
     protocolConfig.setClientConfig(newClientConfig);
     

client/core/configurators/wireguardConfigurator.cpp

@@ -228,8 +228,6 @@ ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &cred
         }
     }
     
-    const bool isAwg3 = awgServerConfig && awgServerConfig->protocolVersion == protocols::awg::awgV3;
-
     amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
     vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
     QString scriptData = amnezia::scriptData(m_configTemplate, container);
@@ -275,8 +273,9 @@ ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &cred
     clientConfig.presharedKey = connData.pskKey;
     clientConfig.clientId = connData.clientPubKey;
     clientConfig.allowedIps = QStringList { "0.0.0.0/0", "::/0" };
-    clientConfig.persistentKeepAlive = isAwg3 ? protocols::awg::defaultPersistentKeepAlive
-                                              : protocols::wireguard::defaultPersistentKeepAlive;
+    const bool useKeepAliveRange = awgServerConfig && awgServerConfig->hasAwg3Params();
+    clientConfig.persistentKeepAlive = useKeepAliveRange ? protocols::awg::defaultPersistentKeepAlive
+                                                         : protocols::wireguard::defaultPersistentKeepAlive;
     clientConfig.mtu = mtu;
     clientConfig.isObfuscationEnabled = false;
     

client/core/configurators/xrayConfigurator.cpp

@@ -211,33 +211,6 @@ ErrorCode XrayConfigurator::readRealityKeyFiles(const DockerContainer container,
     return readKeyFile(QString::fromLatin1(amnezia::protocols::xray::shortidPath), outShortId);
 }
 
-QJsonObject XrayConfigurator::mergeStreamSettingsForServerInbound(const XrayServerConfig &srv,
-                                                                  const QJsonObject &existingStreamSettings) const
-{
-    QJsonObject streamSettings = buildStreamSettings(srv, QString());
-
-    if (effectiveSecurity(srv) != QLatin1String("reality")) {
-        return streamSettings;
-    }
-
-    const QJsonObject newRs = streamSettings[amnezia::protocols::xray::realitySettings].toObject();
-    QJsonObject oldRs = existingStreamSettings[amnezia::protocols::xray::realitySettings].toObject();
-    QJsonObject merged = oldRs.isEmpty() ? newRs : oldRs;
-
-    const QString siteEff = srv.site.isEmpty() ? QString::fromLatin1(amnezia::protocols::xray::defaultSite) : srv.site;
-    const QString sniEff = srv.sni.isEmpty() ? siteEff : srv.sni;
-
-    if (newRs.contains(amnezia::protocols::xray::fingerprint)) {
-        merged[amnezia::protocols::xray::fingerprint] = newRs[amnezia::protocols::xray::fingerprint];
-    }
-    merged[amnezia::protocols::xray::serverNames] = QJsonArray { sniEff };
-    if (!merged.contains(QStringLiteral("dest"))) {
-        merged[QStringLiteral("dest")] = siteEff + QStringLiteral(":443");
-    }
-
-    streamSettings[amnezia::protocols::xray::realitySettings] = merged;
-    return streamSettings;
-}
 
 ErrorCode XrayConfigurator::applyServerSettingsToRemote(const ServerCredentials &credentials, DockerContainer container,
                                                         ContainerConfig &containerConfig, const DnsSettings &dnsSettings,
@@ -308,13 +281,6 @@ ErrorCode XrayConfigurator::applyServerSettingsToRemote(const ServerCredentials
         return ErrorCode::XrayServerConfigInvalid;
     }
 
-    const QJsonObject existingStream = inbound[amnezia::protocols::xray::streamSettings].toObject();
-    inbound[amnezia::protocols::xray::streamSettings] = mergeStreamSettingsForServerInbound(srv, existingStream);
-
-    if (!srv.port.isEmpty()) {
-        inbound[amnezia::protocols::xray::port] = srv.port.toInt();
-    }
-
     QJsonObject settings = inbound[amnezia::protocols::xray::settings].toObject();
     if (!settings.contains(amnezia::protocols::xray::clients)) {
         settings[amnezia::protocols::xray::clients] = QJsonArray {};

client/core/configurators/xrayConfigurator.h

@@ -60,9 +60,6 @@ private:
                                            QString &outPublicKey,
                                            QString &outShortId) const;
 
-    QJsonObject mergeStreamSettingsForServerInbound(const amnezia::XrayServerConfig &srv,
-                                                    const QJsonObject &existingStreamSettings) const;
-
     QJsonObject buildStreamSettings(const amnezia::XrayServerConfig &srv,
                                     const QString &clientId) const;
 };

client/core/controllers/api/newsController.cpp

@@ -2,6 +2,8 @@
 
 #include "core/controllers/gatewayController.h"
 #include "core/repositories/secureServersRepository.h"
+#include "core/utils/api/apiUtils.h"
+#include "core/utils/api/gatewayPayloadBuilder.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"
 #include <QtConcurrent/QtConcurrent>
@@ -81,15 +83,12 @@ QFuture<QPair<ErrorCode, QJsonArray>> NewsController::fetchNews()
             m_appSettingsRepository->isStrictKillSwitchEnabled(),
             m_appSettingsRepository);
 
-    QJsonObject payload;
-    payload.insert("locale", m_appSettingsRepository->getAppLanguage().name().split("_").first());
-
-    if (services.contains(apiDefs::key::userCountryCode)) {
-        payload.insert(apiDefs::key::userCountryCode, services.value(apiDefs::key::userCountryCode));
-    }
-    if (services.contains(apiDefs::key::serviceType)) {
-        payload.insert(apiDefs::key::serviceType, services.value(apiDefs::key::serviceType));
-    }
+    // both country codes and service types are arrays here, one entry per gateway stack the user has
+    const QJsonObject payload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                        .addField(apiDefs::key::locale, apiUtils::getAppLanguageCode(m_appSettingsRepository))
+                                        .addField(apiDefs::key::userCountryCode, services.value(apiDefs::key::userCountryCode))
+                                        .addField(apiDefs::key::serviceType, services.value(apiDefs::key::serviceType))
+                                        .build();
 
     auto future = gatewayController->postAsync(QString("%1v1/news"), payload);
     return future.then([gatewayController](QPair<ErrorCode, QByteArray> result) -> QPair<ErrorCode, QJsonArray> {

client/core/controllers/api/servicesCatalogController.cpp

@@ -1,7 +1,6 @@
 #include "servicesCatalogController.h"
 
 #include <QJsonDocument>
-#include <QSysInfo>
 #include <QJsonArray>
 #include <QEventLoop>
 #include <QDebug>
@@ -11,6 +10,7 @@
 #include <limits>
 
 #include "core/controllers/gatewayController.h"
+#include "core/utils/api/gatewayPayloadBuilder.h"
 #include "core/utils/serverConfigUtils.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"
@@ -212,11 +212,9 @@ ServicesCatalogController::ServicesCatalogController(SecureAppSettingsRepository
 
 ErrorCode ServicesCatalogController::fillAvailableServices(QJsonObject &servicesData)
 {
-    QJsonObject apiPayload;
-    apiPayload[apiDefs::key::osVersion] = QSysInfo::productType();
-    apiPayload[apiDefs::key::appVersion] = QString(APP_VERSION);
-    apiPayload[apiDefs::key::cliName] = QString(APPLICATION_NAME);
-    apiPayload[apiDefs::key::appLanguage] = m_appSettingsRepository->getAppLanguage().name().split("_").first();
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::cliName, QString(APPLICATION_NAME))
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/services"), apiPayload, responseBody);

client/core/controllers/api/subscriptionController.cpp

@@ -8,7 +8,6 @@
 #include <QJsonObject>
 #include <QPromise>
 #include <QSet>
-#include <QSysInfo>
 #include <QUuid>
 #include <QVariantMap>
 
@@ -21,6 +20,7 @@
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"
 #include "core/utils/api/apiUtils.h"
+#include "core/utils/api/gatewayPayloadBuilder.h"
 #include "core/controllers/gatewayController.h"
 #include "core/utils/protocolEnum.h"
 #include "core/protocols/protocolUtils.h"
@@ -97,39 +97,6 @@ SubscriptionController::SubscriptionController(SecureServersRepository* serversR
 {
 }
 
-QJsonObject SubscriptionController::GatewayRequestData::toJsonObject() const
-{
-    QJsonObject obj;
-    if (!osVersion.isEmpty()) {
-        obj[apiDefs::key::osVersion] = osVersion;
-    }
-    if (!appVersion.isEmpty()) {
-        obj[apiDefs::key::appVersion] = appVersion;
-    }
-    if (!appLanguage.isEmpty()) {
-        obj[apiDefs::key::appLanguage] = appLanguage;
-    }
-    if (!installationUuid.isEmpty()) {
-        obj[apiDefs::key::uuid] = installationUuid;
-    }
-    if (!userCountryCode.isEmpty()) {
-        obj[apiDefs::key::userCountryCode] = userCountryCode;
-    }
-    if (!serverCountryCode.isEmpty()) {
-        obj[apiDefs::key::serverCountryCode] = serverCountryCode;
-    }
-    if (!serviceType.isEmpty()) {
-        obj[apiDefs::key::serviceType] = serviceType;
-    }
-    if (!serviceProtocol.isEmpty()) {
-        obj[apiDefs::key::serviceProtocol] = serviceProtocol;
-    }
-    if (!authData.isEmpty()) {
-        obj[apiDefs::key::authData] = authData;
-    }
-    return obj;
-}
-
 SubscriptionController::ProtocolData SubscriptionController::generateProtocolData(const QString &protocol)
 {
     ProtocolData protocolData;
@@ -144,13 +111,15 @@ SubscriptionController::ProtocolData SubscriptionController::generateProtocolDat
     return protocolData;
 }
 
-void SubscriptionController::appendProtocolDataToApiPayload(const QString &protocol, const ProtocolData &protocolData, QJsonObject &apiPayload)
+QString SubscriptionController::publicKeyForProtocol(const QString &protocol, const ProtocolData &protocolData)
 {
     if (protocol == configKey::awg) {
-        apiPayload[apiDefs::key::publicKey] = protocolData.wireGuardClientPubKey;
-    } else if (protocol == configKey::vless) {
-        apiPayload[apiDefs::key::publicKey] = protocolData.xrayUuid;
+        return protocolData.wireGuardClientPubKey;
     }
+    if (protocol == configKey::vless) {
+        return protocolData.xrayUuid;
+    }
+    return {};
 }
 
 ErrorCode SubscriptionController::extractServerConfigJsonFromResponse(const QByteArray &apiResponseBody, const QString &protocol, 
@@ -240,18 +209,12 @@ ErrorCode SubscriptionController::importServiceFromGateway(const QString &userCo
                                                             const QString &serviceProtocol, const ProtocolData &protocolData,
                                                             CaptchaInfo &captchaInfo)
 {
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            userCountryCode,
-                                            "",
-                                            serviceType,
-                                            serviceProtocol,
-                                            QJsonObject() };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, userCountryCode)
+                                     .addField(apiDefs::key::serviceType, serviceType)
+                                     .addField(apiDefs::key::serviceProtocol, serviceProtocol)
+                                     .addField(apiDefs::key::publicKey, publicKeyForProtocol(serviceProtocol, protocolData))
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody);
@@ -291,20 +254,15 @@ ErrorCode SubscriptionController::importTrialFromGateway(const QString &userCoun
         return ErrorCode::ApiConfigEmptyError;
     }
 
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            userCountryCode,
-                                            "",
-                                            serviceType,
-                                            serviceProtocol,
-                                            QJsonObject() };
-
     ProtocolData protocolData = generateProtocolData(serviceProtocol);
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
-    apiPayload.insert(apiDefs::key::email, trimmedEmail);
+
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, userCountryCode)
+                                     .addField(apiDefs::key::serviceType, serviceType)
+                                     .addField(apiDefs::key::serviceProtocol, serviceProtocol)
+                                     .addField(apiDefs::key::publicKey, publicKeyForProtocol(serviceProtocol, protocolData))
+                                     .addField(apiDefs::key::email, trimmedEmail)
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/trial"), apiPayload, responseBody);
@@ -345,19 +303,13 @@ ErrorCode SubscriptionController::importServiceFromAppStore(const QString &userC
                                                             const QString &transactionId, bool isTestPurchase,
                                                             int *duplicateServerIndex)
 {
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            userCountryCode,
-                                            "",
-                                            serviceType,
-                                            serviceProtocol,
-                                            QJsonObject() };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
-    apiPayload[apiDefs::key::transactionId] = transactionId;
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, userCountryCode)
+                                     .addField(apiDefs::key::serviceType, serviceType)
+                                     .addField(apiDefs::key::serviceProtocol, serviceProtocol)
+                                     .addField(apiDefs::key::publicKey, publicKeyForProtocol(serviceProtocol, protocolData))
+                                     .addField(apiDefs::key::transactionId, transactionId)
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/subscriptions"), apiPayload, responseBody, isTestPurchase);
@@ -451,23 +403,15 @@ ErrorCode SubscriptionController::updateServiceFromGateway(const QString &server
 
     ProtocolData protocolData = generateProtocolData(serviceProtocol);
 
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            newCountryCode,
-                                            apiV2->serviceType(),
-                                            serviceProtocol,
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
-
-    if (isConnectEvent) {
-        apiPayload[apiDefs::key::isConnectEvent] = true;
-    }
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serverCountryCode, newCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::serviceProtocol, serviceProtocol)
+                                     .addField(apiDefs::key::publicKey, publicKeyForProtocol(serviceProtocol, protocolData))
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .addField(apiDefs::key::isConnectEvent, isConnectEvent ? QJsonValue(true) : QJsonValue())
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody, isTestPurchase);
@@ -543,26 +487,17 @@ ErrorCode SubscriptionController::resolveUpdateServiceCaptcha(const QString &ser
     const bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
     QString serviceProtocol = apiV2->serviceProtocol();
 
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            newCountryCode,
-                                            apiV2->serviceType(),
-                                            serviceProtocol,
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
-
-    if (isConnectEvent) {
-        apiPayload[apiDefs::key::isConnectEvent] = true;
-    }
-
-    apiPayload["captcha_id"] = captchaId;
-    apiPayload["captcha_solution"] = normalizeCaptchaSolution(captchaSolution);
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serverCountryCode, newCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::serviceProtocol, serviceProtocol)
+                                     .addField(apiDefs::key::publicKey, publicKeyForProtocol(serviceProtocol, protocolData))
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .addField(apiDefs::key::captchaId, captchaId)
+                                     .addField(apiDefs::key::captchaSolution, normalizeCaptchaSolution(captchaSolution))
+                                     .addField(apiDefs::key::isConnectEvent, isConnectEvent ? QJsonValue(true) : QJsonValue())
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody, isTestPurchase);
@@ -595,18 +530,12 @@ ErrorCode SubscriptionController::deactivateDevice(const QString &serverId)
         return ErrorCode::NoError;
     }
 
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            apiV2->apiConfig.serverCountryCode,
-                                            apiV2->serviceType(),
-                                            "",
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serverCountryCode, apiV2->apiConfig.serverCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .build();
 
     const bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
     QByteArray responseBody;
@@ -632,18 +561,13 @@ ErrorCode SubscriptionController::deactivateExternalDevice(const QString &server
         return ErrorCode::NoError;
     }
 
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            uuid,
-                                            apiV2->apiConfig.userCountryCode,
-                                            serverCountryCode,
-                                            apiV2->serviceType(),
-                                            "",
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::installationUuid, uuid)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serverCountryCode, serverCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .build();
 
     const bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
     QByteArray responseBody;
@@ -671,19 +595,14 @@ ErrorCode SubscriptionController::exportNativeConfig(const QString &serverId, co
     QString protocol = configKey::awg;
     ProtocolData protocolData = generateProtocolData(protocol);
 
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            serverCountryCode,
-                                            apiV2->serviceType(),
-                                            protocol,
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(protocol, protocolData, apiPayload);
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serverCountryCode, serverCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::serviceProtocol, protocol)
+                                     .addField(apiDefs::key::publicKey, publicKeyForProtocol(protocol, protocolData))
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/native_config"), apiPayload, responseBody, isTestPurchase);
@@ -706,18 +625,13 @@ ErrorCode SubscriptionController::revokeNativeConfig(const QString &serverId, co
     const bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
     QString protocol = configKey::awg;
 
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            serverCountryCode,
-                                            apiV2->serviceType(),
-                                            protocol,
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serverCountryCode, serverCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::serviceProtocol, protocol)
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/revoke_native_config"), apiPayload, responseBody, isTestPurchase);
@@ -1024,20 +938,13 @@ ErrorCode SubscriptionController::getAccountInfo(const QString &serverId, QJsonO
     }
     bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
     
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            "",
-                                            apiV2->serviceType(),
-                                            "",
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    apiPayload[apiDefs::key::cliVersion] = QString(APP_VERSION);
-    apiPayload[apiDefs::key::subscriptionStatus] = getSubscriptionStatusForRenewal(apiV2->apiConfig);
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .addField(apiDefs::key::cliVersion, QString(APP_VERSION))
+                                     .addField(apiDefs::key::subscriptionStatus, getSubscriptionStatusForRenewal(apiV2->apiConfig))
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/account_info"), apiPayload, responseBody, isTestPurchase);
@@ -1045,7 +952,8 @@ ErrorCode SubscriptionController::getAccountInfo(const QString &serverId, QJsonO
         return errorCode;
     }
 
-    accountInfo = QJsonDocument::fromJson(responseBody).object();
+    accountInfo = QJsonDocument::fromJson(responseBody).object();    
+
     return ErrorCode::NoError;
 }
 
@@ -1062,20 +970,13 @@ QFuture<QPair<ErrorCode, QString>> SubscriptionController::getRenewalLink(const
     }
 
     bool isTestPurchase = apiV2->apiConfig.isTestPurchase;
-    QJsonObject authDataJson = apiV2->authData.toJson();
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                            m_appSettingsRepository->getInstallationUuid(true),
-                                            apiV2->apiConfig.userCountryCode,
-                                            "",
-                                            apiV2->serviceType(),
-                                            "",
-                                            authDataJson };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    apiPayload[apiDefs::key::cliVersion] = QString(APP_VERSION);
-    apiPayload[apiDefs::key::subscriptionStatus] = getSubscriptionStatusForRenewal(apiV2->apiConfig);
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, apiV2->apiConfig.userCountryCode)
+                                     .addField(apiDefs::key::serviceType, apiV2->serviceType())
+                                     .addField(apiDefs::key::authData, apiV2->authData.toJson())
+                                     .addField(apiDefs::key::cliVersion, QString(APP_VERSION))
+                                     .addField(apiDefs::key::subscriptionStatus, getSubscriptionStatusForRenewal(apiV2->apiConfig))
+                                     .build();
 
     auto gatewayController = QSharedPointer<GatewayController>::create(m_appSettingsRepository->getGatewayEndpoint(isTestPurchase),
                                                                        m_appSettingsRepository->isDevGatewayEnv(isTestPurchase),
@@ -1111,21 +1012,14 @@ ErrorCode SubscriptionController::resolveImportServiceCaptcha(const QString &use
                                                               const QString &captchaSolution,
                                                               CaptchaInfo *retryCaptchaOut)
 {
-    GatewayRequestData gatewayRequestData{QSysInfo::productType(),
-                                          QString(APP_VERSION),
-                                          m_appSettingsRepository->getAppLanguage().name().split("_").first(),
-                                          m_appSettingsRepository->getInstallationUuid(true),
-                                          userCountryCode,
-                                          "",
-                                          serviceType,
-                                          serviceProtocol,
-                                          QJsonObject()};
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
-
-    apiPayload["captcha_id"] = captchaId;
-    apiPayload["captcha_solution"] = normalizeCaptchaSolution(captchaSolution);
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::userCountryCode, userCountryCode)
+                                     .addField(apiDefs::key::serviceType, serviceType)
+                                     .addField(apiDefs::key::serviceProtocol, serviceProtocol)
+                                     .addField(apiDefs::key::publicKey, publicKeyForProtocol(serviceProtocol, protocolData))
+                                     .addField(apiDefs::key::captchaId, captchaId)
+                                     .addField(apiDefs::key::captchaSolution, normalizeCaptchaSolution(captchaSolution))
+                                     .build();
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody);

client/core/controllers/api/subscriptionController.h

@@ -27,21 +27,6 @@ public:
         QString xrayUuid;
     };
 
-    struct GatewayRequestData
-    {
-        QString osVersion;
-        QString appVersion;
-        QString appLanguage;
-        QString installationUuid;
-        QString userCountryCode;
-        QString serverCountryCode;
-        QString serviceType;
-        QString serviceProtocol;
-        QJsonObject authData;
-
-        QJsonObject toJsonObject() const;
-    };
-
     struct CaptchaInfo {
         QString captchaId;
         QString captchaImageBase64;
@@ -53,7 +38,8 @@ public:
                                      SecureAppSettingsRepository* appSettingsRepository);
 
     ProtocolData generateProtocolData(const QString &protocol);
-    void appendProtocolDataToApiPayload(const QString &protocol, const ProtocolData &protocolData, QJsonObject &apiPayload);
+
+    static QString publicKeyForProtocol(const QString &protocol, const ProtocolData &protocolData);
 
     ErrorCode importServiceFromGateway(const QString &userCountryCode, const QString &serviceType,
                                       const QString &serviceProtocol, const ProtocolData &protocolData,

client/core/controllers/ipSplitTunnelingController.cpp

@@ -154,8 +154,13 @@ QString IpSplitTunnelingController::normalizeHostname(const QString &hostname) c
     normalized.replace("https://", "");
     normalized.replace("http://", "");
     normalized.replace("ftp://", "");
-    normalized = normalized.split("/", Qt::SkipEmptyParts).first();
-    return normalized;
+
+    if (NetworkUtilities::ipAddressWithSubnetRegExp().exactMatch(normalized)) {
+        return normalized;
+    }
+
+    const QStringList parts = normalized.split("/", Qt::SkipEmptyParts);
+    return parts.isEmpty() ? QString() : parts.first();
 }
 
 bool IpSplitTunnelingController::validateHostname(const QString &hostname) const

client/core/controllers/selfhosted/exportController.cpp

@@ -220,7 +220,10 @@ ExportController::ExportResult ExportController::generateWireGuardConfig(const Q
         result.config.append(line + "\n");
     }
 
-    result.qrCodes << generateSingleQrCode(result.config.toUtf8());
+    const QString qr = qrCodeUtils::generatePlainQrCodeImage(result.config.toUtf8());
+    if (!qr.isEmpty()) {
+        result.qrCodes << qr;
+    }
     return result;
 }
 
@@ -251,7 +254,10 @@ ExportController::ExportResult ExportController::generateAwgConfig(const QString
         result.config.append(line + "\n");
     }
 
-    result.qrCodes << generateSingleQrCode(result.config.toUtf8());
+    const QString qr = qrCodeUtils::generatePlainQrCodeImage(result.config.toUtf8());
+    if (!qr.isEmpty()) {
+        result.qrCodes << qr;
+    }
     return result;
 }
 
@@ -369,9 +375,3 @@ QList<QString> ExportController::generateQrCodesFromConfig(const QByteArray &dat
 {
     return qrCodeUtils::generateQrCodeImageSeries(data);
 }
-
-QString ExportController::generateSingleQrCode(const QByteArray &data)
-{
-    auto qr = qrCodeUtils::generateQrCode(data);
-    return qrCodeUtils::svgToBase64(QString::fromStdString(toSvgString(qr, 1)));
-}

client/core/controllers/selfhosted/exportController.h

@@ -69,7 +69,6 @@ private:
 
     QString generateVpnUrl(const QByteArray &compressedConfig);
     QList<QString> generateQrCodesFromConfig(const QByteArray &data);
-    QString generateSingleQrCode(const QByteArray &data);
 
     SecureServersRepository* m_serversRepository;
     SecureAppSettingsRepository* m_appSettingsRepository;

client/core/controllers/selfhosted/installController.cpp

@@ -201,9 +201,6 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
     SshSession sshSession;
 
     bool reinstallRequired = isReinstallContainerRequired(container, oldConfig, newConfig);
-    if (container == DockerContainer::Xray || container == DockerContainer::SSXray) {
-        reinstallRequired = true;
-    }
     qDebug() << "InstallController::updateServerConfig for container" << container << "reinstall required is" << reinstallRequired;
 
     ErrorCode errorCode = ErrorCode::NoError;
@@ -216,7 +213,7 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
                 awgConfig->serverConfig.protocolVersion = protocols::awg::awgV3;
             }
         }
-    } else {
+    } else if (container != DockerContainer::Xray && container != DockerContainer::SSXray) {
         errorCode = configureContainerWorker(credentials, container, newConfig, sshSession);
         if (errorCode == ErrorCode::NoError) {
             errorCode = startupContainerWorker(credentials, container, newConfig, sshSession);

client/core/controllers/updateController.cpp

@@ -5,13 +5,13 @@
 #include <QUrl>
 #include <QJsonDocument>
 #include <QJsonObject>
-#include <QSysInfo>
 #include <QTimer>
 
 #include "amneziaApplication.h"
 #include "logger.h"
 #include "version.h"
 #include "core/controllers/gatewayController.h"
+#include "core/utils/api/gatewayPayloadBuilder.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/selfhosted/scriptsRegistry.h"
 
@@ -98,10 +98,9 @@ void UpdateController::fetchGatewayUrl()
                                                                        m_appSettingsRepository->isStrictKillSwitchEnabled(),
                                                                        m_appSettingsRepository);
 
-    QJsonObject apiPayload;
-    apiPayload[apiDefs::key::cliVersion] = QString(APP_VERSION);
-    apiPayload[apiDefs::key::osVersion] = QSysInfo::productType();
-    apiPayload[apiDefs::key::installationUuid] = m_appSettingsRepository->getInstallationUuid(true);
+    QJsonObject apiPayload = GatewayPayloadBuilder(m_appSettingsRepository)
+                                     .addField(apiDefs::key::cliVersion, QString(APP_VERSION))
+                                     .build();
 
     // Workaround: wait before contacting gateway to avoid rate limit triggered by other requests (news etc.)
     QTimer::singleShot(1000, this, [this, gatewayController, apiPayload]() {

client/core/installers/awgInstaller.cpp

@@ -78,6 +78,8 @@ void AwgInstaller::generateAwgParameters(AwgServerConfig &serverConfig)
     serverConfig.rejectAfterTime = protocols::awg::defaultRejectAfterTime;
     serverConfig.keepaliveTimeout = protocols::awg::defaultKeepaliveTimeout;
     serverConfig.maxHandshakeAttempts = protocols::awg::defaultMaxHandshakeAttempts;
+    serverConfig.randomTrailers = protocols::awg::defaultRandomTrailers;
+    serverConfig.disableCookies = protocols::awg::defaultDisableCookies;
 }
 
 ErrorCode AwgInstaller::extractConfigFromContainer(DockerContainer container, const ServerCredentials &credentials,
@@ -144,6 +146,8 @@ ErrorCode AwgInstaller::extractConfigFromContainer(DockerContainer container, co
         awgConfig->serverConfig.rejectAfterTime = serverConfigMap.value(configKey::rejectAfterTime);
         awgConfig->serverConfig.keepaliveTimeout = serverConfigMap.value(configKey::keepaliveTimeout);
         awgConfig->serverConfig.maxHandshakeAttempts = serverConfigMap.value(configKey::maxHandshakeAttempts);
+        awgConfig->serverConfig.randomTrailers = serverConfigMap.value(configKey::randomTrailers);
+        awgConfig->serverConfig.disableCookies = serverConfigMap.value(configKey::disableCookies);
 
         awgConfig->serverConfig.protocolVersion = awgConfig->serverProtocolVersion();
     }

client/core/models/protocols/awgProtocolConfig.cpp

@@ -27,7 +27,8 @@ namespace
         const QStringList awg3Params = { config.headerProtectionKey, config.contentPaddingAddition,
                                          config.rekeyAfterTime,      config.rekeyTimeout,
                                          config.rejectAfterTime,     config.keepaliveTimeout,
-                                         config.maxHandshakeAttempts };
+                                         config.maxHandshakeAttempts, config.randomTrailers,
+                                         config.disableCookies };
         if (std::any_of(awg3Params.begin(), awg3Params.end(), hasValue)) {
             return protocols::awg::awgV3;
         }
@@ -134,6 +135,12 @@ QJsonObject AwgServerConfig::toJson() const
     if (!maxHandshakeAttempts.isEmpty()) {
         obj[configKey::maxHandshakeAttempts] = maxHandshakeAttempts;
     }
+    if (!randomTrailers.isEmpty()) {
+        obj[configKey::randomTrailers] = randomTrailers;
+    }
+    if (!disableCookies.isEmpty()) {
+        obj[configKey::disableCookies] = disableCookies;
+    }
 
     if (isThirdPartyConfig) {
         obj[configKey::isThirdPartyConfig] = isThirdPartyConfig;
@@ -178,6 +185,8 @@ AwgServerConfig AwgServerConfig::fromJson(const QJsonObject& json)
     config.rejectAfterTime = json.value(configKey::rejectAfterTime).toString();
     config.keepaliveTimeout = json.value(configKey::keepaliveTimeout).toString();
     config.maxHandshakeAttempts = json.value(configKey::maxHandshakeAttempts).toString();
+    config.randomTrailers = json.value(configKey::randomTrailers).toString();
+    config.disableCookies = json.value(configKey::disableCookies).toString();
 
     config.isThirdPartyConfig = json.value(configKey::isThirdPartyConfig).toBool(false);
     
@@ -302,6 +311,12 @@ QJsonObject AwgClientConfig::toJson() const
     if (!maxHandshakeAttempts.isEmpty()) {
         obj[configKey::maxHandshakeAttempts] = maxHandshakeAttempts;
     }
+    if (!randomTrailers.isEmpty()) {
+        obj[configKey::randomTrailers] = randomTrailers;
+    }
+    if (!disableCookies.isEmpty()) {
+        obj[configKey::disableCookies] = disableCookies;
+    }
 
     return obj;
 }
@@ -353,6 +368,8 @@ AwgClientConfig AwgClientConfig::fromJson(const QJsonObject& json)
     config.rejectAfterTime = json.value(configKey::rejectAfterTime).toString();
     config.keepaliveTimeout = json.value(configKey::keepaliveTimeout).toString();
     config.maxHandshakeAttempts = json.value(configKey::maxHandshakeAttempts).toString();
+    config.randomTrailers = json.value(configKey::randomTrailers).toString();
+    config.disableCookies = json.value(configKey::disableCookies).toString();
     return config;
 }
 
@@ -397,7 +414,7 @@ QString AwgProtocolConfig::clientProtocolVersion() const
 
 QString AwgProtocolConfig::protocolVersionString(const QString &version)
 {
-    if (version == protocols::awg::awgV3) return QObject::tr(" (version 3)");
+    if (version == protocols::awg::awgV3) return QObject::tr(" (version 3.1)");
     if (version == protocols::awg::awgV2) return QObject::tr(" (version 2)");
     if (version == protocols::awg::awgV1_5) return QObject::tr(" (version 1.5)");
     return "";
@@ -437,13 +454,21 @@ bool AwgServerConfig::hasEqualServerSettings(const AwgServerConfig& other) const
         contentPaddingAddition != other.contentPaddingAddition ||
         rekeyAfterTime != other.rekeyAfterTime || rekeyTimeout != other.rekeyTimeout ||
         rejectAfterTime != other.rejectAfterTime || keepaliveTimeout != other.keepaliveTimeout ||
-        maxHandshakeAttempts != other.maxHandshakeAttempts) {
+        maxHandshakeAttempts != other.maxHandshakeAttempts ||
+        randomTrailers != other.randomTrailers || disableCookies != other.disableCookies) {
         return false;
     }
 
     return true;
 }
 
+bool AwgServerConfig::hasAwg3Params() const
+{
+    return !headerProtectionKey.isEmpty() || !contentPaddingAddition.isEmpty() || !rekeyAfterTime.isEmpty()
+            || !rekeyTimeout.isEmpty() || !rejectAfterTime.isEmpty() || !keepaliveTimeout.isEmpty()
+            || !maxHandshakeAttempts.isEmpty() || !randomTrailers.isEmpty() || !disableCookies.isEmpty();
+}
+
 bool AwgProtocolConfig::isHeadersEqual(const QString &h1, const QString &h2, const QString &h3, const QString &h4)
 {
     QSet<QString> uniqueHeaders;

client/core/models/protocols/awgProtocolConfig.h

@@ -46,12 +46,15 @@ struct AwgServerConfig {
     QString rejectAfterTime;
     QString keepaliveTimeout;
     QString maxHandshakeAttempts;
+    QString randomTrailers;
+    QString disableCookies;
     bool isThirdPartyConfig = false;
     
     QJsonObject toJson() const;
     static AwgServerConfig fromJson(const QJsonObject& json);
-    
+
     bool hasEqualServerSettings(const AwgServerConfig& other) const;
+    bool hasAwg3Params() const;
 };
 
 struct AwgClientConfig {
@@ -90,6 +93,8 @@ struct AwgClientConfig {
     QString rejectAfterTime;
     QString keepaliveTimeout;
     QString maxHandshakeAttempts;
+    QString randomTrailers;
+    QString disableCookies;
     QJsonObject toJson() const;
     static AwgClientConfig fromJson(const QJsonObject& json);
 };

client/core/utils/api/apiUtils.cpp

@@ -1,5 +1,6 @@
 #include "apiUtils.h"
 
+#include "core/repositories/secureAppSettingsRepository.h"
 #include "core/utils/serverConfigUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include <QDateTime>
@@ -48,6 +49,30 @@ namespace
     }
 }
 
+QString apiUtils::getAppLanguageCode(const SecureAppSettingsRepository *appSettingsRepository)
+{
+    if (appSettingsRepository == nullptr) {
+        return {};
+    }
+    return appSettingsRepository->getAppLanguage().name().split("_").first();
+}
+
+QString apiUtils::getDistributionChannel()
+{
+#if defined(Q_OS_ANDROID)
+    return {};
+#elif defined(Q_OS_IOS) || defined(MACOS_NE)
+    return QStringLiteral("appstore");
+#else
+    return QStringLiteral("github");
+#endif
+}
+
+QString apiUtils::getCountryFlagCode(const QString &serverCountryCode)
+{
+    return serverCountryCode.section('-', 0, 0).toUpper();
+}
+
 bool apiUtils::isSubscriptionExpired(const QString &subscriptionEndDate)
 {
     if (subscriptionEndDate.isEmpty()) {

client/core/utils/api/apiUtils.h

@@ -11,8 +11,18 @@
 #include "core/utils/routeModes.h"
 #include "core/utils/commonStructs.h"
 
+class SecureAppSettingsRepository;
+
 namespace apiUtils
 {
+    QString getAppLanguageCode(const SecureAppSettingsRepository *appSettingsRepository);
+    QString getDistributionChannel();
+
+    // The gateway may report a country code with a region suffix, e.g. "us-west", while flag
+    // resources are named after the ISO 3166-1 alpha-2 code alone. Returns the part before the dash
+    // in upper case.
+    QString getCountryFlagCode(const QString &serverCountryCode);
+
     bool isSubscriptionExpired(const QString &subscriptionEndDate);
 
     bool isSubscriptionExpiringSoon(const QString &subscriptionEndDate, int withinDays = 30);

client/core/utils/api/gatewayPayloadBuilder.cpp

@@ -0,0 +1,61 @@
+#include "gatewayPayloadBuilder.h"
+
+#include <QJsonArray>
+#include <QSysInfo>
+
+#include "core/repositories/secureAppSettingsRepository.h"
+#include "core/utils/api/apiUtils.h"
+#include "core/utils/constants/apiKeys.h"
+#include "version.h"
+
+namespace
+{
+    bool isEmptyValue(const QJsonValue &value)
+    {
+        switch (value.type()) {
+        case QJsonValue::Null:
+        case QJsonValue::Undefined:
+            return true;
+        case QJsonValue::String:
+            return value.toString().isEmpty();
+        case QJsonValue::Object:
+            return value.toObject().isEmpty();
+        case QJsonValue::Array:
+            return value.toArray().isEmpty();
+        default:
+            return false;
+        }
+    }
+}
+
+GatewayPayloadBuilder::GatewayPayloadBuilder(const SecureAppSettingsRepository *appSettingsRepository)
+{
+    m_payload[apiDefs::key::osVersion] = QSysInfo::productType();
+    m_payload[apiDefs::key::appVersion] = QString(APP_VERSION);
+
+    const QString distributionChannel = apiUtils::getDistributionChannel();
+    if (!distributionChannel.isEmpty()) {
+        m_payload[apiDefs::key::distribution] = distributionChannel;
+    }
+
+    if (appSettingsRepository == nullptr) {
+        qWarning() << "SecureAppSettingsRepository is null, skip app language and installation uuid";
+        return;
+    }
+
+    m_payload[apiDefs::key::appLanguage] = apiUtils::getAppLanguageCode(appSettingsRepository);
+    m_payload[apiDefs::key::installationUuid] = appSettingsRepository->getInstallationUuid(true);
+}
+
+GatewayPayloadBuilder &GatewayPayloadBuilder::addField(QLatin1String key, const QJsonValue &value)
+{
+    if (!isEmptyValue(value)) {
+        m_payload[key] = value;
+    }
+    return *this;
+}
+
+QJsonObject GatewayPayloadBuilder::build() const
+{
+    return m_payload;
+}

client/core/utils/api/gatewayPayloadBuilder.h

@@ -0,0 +1,22 @@
+#ifndef GATEWAYPAYLOADBUILDER_H
+#define GATEWAYPAYLOADBUILDER_H
+
+#include <QJsonObject>
+#include <QJsonValue>
+#include <QLatin1String>
+
+class SecureAppSettingsRepository;
+
+class GatewayPayloadBuilder
+{
+public:
+    explicit GatewayPayloadBuilder(const SecureAppSettingsRepository *appSettingsRepository);
+
+    GatewayPayloadBuilder &addField(QLatin1String key, const QJsonValue &value);
+    QJsonObject build() const;
+
+private:
+    QJsonObject m_payload;
+};
+
+#endif // GATEWAYPAYLOADBUILDER_H

client/core/utils/constants/apiKeys.h

@@ -23,6 +23,7 @@ namespace apiDefs
         constexpr QLatin1String installationUuid("installation_uuid");
         constexpr QLatin1String uuid("installation_uuid");
         constexpr QLatin1String osVersion("os_version");
+        constexpr QLatin1String distribution("distribution");
         constexpr QLatin1String userCountryCode("user_country_code");
         constexpr QLatin1String serverCountryCode("server_country_code");
         constexpr QLatin1String serverCountryName("server_country_name");
@@ -40,6 +41,10 @@ namespace apiDefs
         constexpr QLatin1String lastDownloaded("last_downloaded");
         constexpr QLatin1String sourceType("source_type");
         constexpr QLatin1String appLanguage("app_language");
+        constexpr QLatin1String locale("locale");
+
+        constexpr QLatin1String captchaId("captcha_id");
+        constexpr QLatin1String captchaSolution("captcha_solution");
 
         constexpr QLatin1String activeDeviceCount("active_device_count");
         constexpr QLatin1String maxDeviceCount("max_device_count");

client/core/utils/constants/configKeys.h

@@ -100,6 +100,8 @@ namespace amnezia
         constexpr QLatin1String rejectAfterTime("RejectAfterTime");
         constexpr QLatin1String keepaliveTimeout("KeepaliveTimeout");
         constexpr QLatin1String maxHandshakeAttempts("MaxHandshakeAttempts");
+        constexpr QLatin1String randomTrailers("RandomTrailers");
+        constexpr QLatin1String disableCookies("DisableCookies");
 
         inline QStringList awgProtocolKeys()
         {
@@ -125,7 +127,9 @@ namespace amnezia
                      rekeyTimeout,
                      rejectAfterTime,
                      keepaliveTimeout,
-                     maxHandshakeAttempts };
+                     maxHandshakeAttempts,
+                     randomTrailers,
+                     disableCookies };
         }
 
         constexpr QLatin1String openvpn("openvpn");

client/core/utils/constants/protocolConstants.h

@@ -204,7 +204,7 @@ namespace amnezia
 
             constexpr char awgV1_5[] = "1.5";
             constexpr char awgV2[] = "2";
-            constexpr char awgV3[] = "3";
+            constexpr char awgV3[] = "3.1";
 
             constexpr char defaultContentPaddingAddition[] = "10-100";
             constexpr char defaultRekeyAfterTime[] = "100-120";
@@ -213,6 +213,10 @@ namespace amnezia
             constexpr char defaultKeepaliveTimeout[] = "5-15";
             constexpr char defaultMaxHandshakeAttempts[] = "15-20";
             constexpr char defaultPersistentKeepAlive[] = "25-35";
+            constexpr char defaultRandomTrailers[] = "on";
+            constexpr char defaultDisableCookies[] = "on";
+            constexpr char awgBoolOn[] = "on";
+            constexpr char awgBoolOff[] = "off";
 
 
         }

client/core/utils/qrCodeUtils.cpp

@@ -1,5 +1,8 @@
 #include "qrCodeUtils.h"
 
+#include <cmath>
+
+#include <QDataStream>
 #include <QIODevice>
 #include <QList>
 
@@ -16,7 +19,7 @@ QList<QString> qrCodeUtils::generateQrCodeImageSeries(const QByteArray &data)
 
         QByteArray ba = chunk.toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals);
 
-        qrcodegen::QrCode qr = qrcodegen::QrCode::encodeText(ba, qrcodegen::QrCode::Ecc::LOW);
+        qrcodegen::QrCode qr = qrcodegen::QrCode::encodeText(ba.constData(), qrcodegen::QrCode::Ecc::LOW);
         QString svg = QString::fromStdString(toSvgString(qr, 1));
         chunks.append(svgToBase64(svg));
     }
@@ -26,9 +29,13 @@ QList<QString> qrCodeUtils::generateQrCodeImageSeries(const QByteArray &data)
 
 QString qrCodeUtils::generatePlainQrCodeImage(const QByteArray &data)
 {
-    qrcodegen::QrCode qr = qrcodegen::QrCode::encodeText(data, qrcodegen::QrCode::Ecc::LOW);
-    QString svg = QString::fromStdString(toSvgString(qr, 1));
-    return svgToBase64(svg);
+    try {
+        qrcodegen::QrCode qr = qrcodegen::QrCode::encodeText(data.constData(), qrcodegen::QrCode::Ecc::LOW);
+        QString svg = QString::fromStdString(toSvgString(qr, 1));
+        return svgToBase64(svg);
+    } catch (const qrcodegen::data_too_long &) {
+        return {};
+    }
 }
 
 QString qrCodeUtils::svgToBase64(const QString &image)
@@ -38,5 +45,5 @@ QString qrCodeUtils::svgToBase64(const QString &image)
 
 qrcodegen::QrCode qrCodeUtils::generateQrCode(const QByteArray &data)
 {
-    return qrcodegen::QrCode::encodeText(data, qrcodegen::QrCode::Ecc::LOW);
+    return qrcodegen::QrCode::encodeText(data.constData(), qrcodegen::QrCode::Ecc::LOW);
 }

client/core/utils/qrCodeUtils.h

@@ -1,6 +1,8 @@
 #ifndef QRCODEUTILS_H
 #define QRCODEUTILS_H
 
+#include <QByteArray>
+#include <QList>
 #include <QString>
 
 #include "qrcodegen.hpp"

client/core/utils/selfhosted/scriptsRegistry.cpp

@@ -255,9 +255,8 @@ amnezia::ScriptVars amnezia::genAwgVars(const ContainerConfig &containerConfig)
         vars.append({ { "$SPECIAL_JUNK_4", config.specialJunk4 } });
         vars.append({ { "$SPECIAL_JUNK_5", config.specialJunk5 } });
 
-        const bool isAwg3 = config.protocolVersion == protocols::awg::awgV3;
-        vars.append({ { "$PERSISTENT_KEEPALIVE", isAwg3 ? QString(protocols::awg::defaultPersistentKeepAlive)
-                                                        : QString(protocols::wireguard::defaultPersistentKeepAlive) } });
+        vars.append({ { "$PERSISTENT_KEEPALIVE", config.hasAwg3Params() ? QString(protocols::awg::defaultPersistentKeepAlive)
+                                                                        : QString(protocols::wireguard::defaultPersistentKeepAlive) } });
 
         vars.append({ { "$HEADER_PROTECTION_KEY", config.headerProtectionKey } });
         vars.append({ { "$CONTENT_PADDING_ADDITION", config.contentPaddingAddition } });
@@ -266,6 +265,8 @@ amnezia::ScriptVars amnezia::genAwgVars(const ContainerConfig &containerConfig)
         vars.append({ { "$REJECT_AFTER_TIME", config.rejectAfterTime } });
         vars.append({ { "$KEEPALIVE_TIMEOUT", config.keepaliveTimeout } });
         vars.append({ { "$MAX_HANDSHAKE_ATTEMPTS", config.maxHandshakeAttempts } });
+        vars.append({ { "$RANDOM_TRAILERS", config.randomTrailers } });
+        vars.append({ { "$DISABLE_COOKIES", config.disableCookies } });
     }
 
     return vars;

client/daemon/daemon.cpp

@@ -464,6 +464,12 @@ bool Daemon::parseConfig(const QJsonObject& obj, InterfaceConfig& config) {
   if (const auto maxHandshakeAttempts = obj.value("MaxHandshakeAttempts"); !maxHandshakeAttempts.isUndefined()) {
     config.m_maxHandshakeAttempts = maxHandshakeAttempts.toString();
   }
+  if (const auto randomTrailers = obj.value("RandomTrailers"); !randomTrailers.isUndefined()) {
+    config.m_randomTrailers = randomTrailers.toString();
+  }
+  if (const auto disableCookies = obj.value("DisableCookies"); !disableCookies.isUndefined()) {
+    config.m_disableCookies = disableCookies.toString();
+  }
 
   return true;
 }
@@ -637,7 +643,7 @@ void Daemon::checkHandshake() {
       pendingHandshakes++;
     }
   }
-  
+
   // Check again if there were connections that haven't completed a handshake.
   if (pendingHandshakes > 0) {
     m_handshakeTimer.start(HANDSHAKE_POLL_MSEC);

client/daemon/interfaceconfig.cpp

@@ -179,6 +179,12 @@ QString InterfaceConfig::toWgConf(const QMap<QString, QString>& extra) const {
   if (!m_maxHandshakeAttempts.isEmpty()) {
     out << "MaxHandshakeAttempts = " << m_maxHandshakeAttempts << "\n";
   }
+  if (!m_randomTrailers.isEmpty()) {
+    out << "RandomTrailers = " << m_randomTrailers << "\n";
+  }
+  if (!m_disableCookies.isEmpty()) {
+    out << "DisableCookies = " << m_disableCookies << "\n";
+  }
 
   // If any extra config was provided, append it now.
   for (const QString& key : extra.keys()) {
@@ -206,3 +212,13 @@ QString InterfaceConfig::toWgConf(const QMap<QString, QString>& extra) const {
 
   return content;
 }
+
+QString InterfaceConfig::awgBoolToUapi(const QString& value) {
+  const QString v = value.trimmed().toLower();
+  if (v == QLatin1String("on") || v == QLatin1String("1") ||
+      v == QLatin1String("true") || v == QLatin1String("t") ||
+      v == QLatin1String("yes")) {
+    return QStringLiteral("1");
+  }
+  return QStringLiteral("0");
+}

client/daemon/interfaceconfig.h

@@ -66,10 +66,16 @@ class InterfaceConfig {
   QString m_rejectAfterTime;
   QString m_keepaliveTimeout;
   QString m_maxHandshakeAttempts;
+  QString m_randomTrailers;
+  QString m_disableCookies;
 
   QJsonObject toJson() const;
   QString toWgConf(
       const QMap<QString, QString>& extra = QMap<QString, QString>()) const;
+
+  // Converts awg-quick on/off (and 0/1/true/false) to UAPI 1/0.
+  // amneziawg-go uses strconv.ParseBool and rejects "on"/"off".
+  static QString awgBoolToUapi(const QString& value);
 };
 
 #endif  // INTERFACECONFIG_H

client/platforms/ios/WGConfig.swift

@@ -8,6 +8,7 @@ struct WGConfig: Decodable {
   let specialJunk1, specialJunk2, specialJunk3, specialJunk4, specialJunk5: String?
   let headerProtectionKey: String?
   let contentPaddingAddition, rekeyAfterTime, rekeyTimeout, rejectAfterTime, keepaliveTimeout, maxHandshakeAttempts: String?
+  let randomTrailers, disableCookies: String?
   let dns1: String
   let dns2: String
   let mtu: String
@@ -33,6 +34,7 @@ struct WGConfig: Decodable {
     case rekeyAfterTime = "RekeyAfterTime", rekeyTimeout = "RekeyTimeout"
     case rejectAfterTime = "RejectAfterTime", keepaliveTimeout = "KeepaliveTimeout"
     case maxHandshakeAttempts = "MaxHandshakeAttempts"
+    case randomTrailers = "RandomTrailers", disableCookies = "DisableCookies"
     case dns1
     case dns2
     case mtu
@@ -128,6 +130,12 @@ struct WGConfig: Decodable {
     if let maxHandshakeAttempts = trimmed(maxHandshakeAttempts) {
       settingsLines.append("MaxHandshakeAttempts = \(maxHandshakeAttempts)")
     }
+    if let randomTrailers = trimmed(randomTrailers) {
+      settingsLines.append("RandomTrailers = \(randomTrailers)")
+    }
+    if let disableCookies = trimmed(disableCookies) {
+      settingsLines.append("DisableCookies = \(disableCookies)")
+    }
 
     return settingsLines.joined(separator: "\n")
   }

client/platforms/linux/daemon/dnsutilslinux.cpp

@@ -7,14 +7,10 @@
 #include <net/if.h>
 
 #include <QDBusVariant>
-#include <QNetworkInterface>
-#include <QTimer>
 #include <QtDBus/QtDBus>
 
-#include "core/utils/networkUtilities.h"
 #include "leakdetector.h"
 #include "logger.h"
-#include "router_linux.h"
 
 constexpr const char* DBUS_RESOLVE_SERVICE = "org.freedesktop.resolve1";
 constexpr const char* DBUS_RESOLVE_PATH = "/org/freedesktop/resolve1";
@@ -31,56 +27,24 @@ DnsUtilsLinux::DnsUtilsLinux(QObject* parent) : DnsUtils(parent) {
   logger.debug() << "DnsUtilsLinux created.";
 
   QDBusConnection conn = QDBusConnection::systemBus();
-  auto* watcher = new QDBusServiceWatcher(
-      DBUS_RESOLVE_SERVICE, conn,
-      QDBusServiceWatcher::WatchForRegistration |
-      QDBusServiceWatcher::WatchForUnregistration, this);
-
-  connect(watcher, &QDBusServiceWatcher::serviceRegistered,
-          this, &DnsUtilsLinux::onResolverRegistered);
-  connect(watcher, &QDBusServiceWatcher::serviceUnregistered,
-          this, &DnsUtilsLinux::onResolverUnregistered);
-
-  if (conn.interface()->isServiceRegistered(DBUS_RESOLVE_SERVICE)) {
-    onResolverRegistered();
-  }
-}
-
-void DnsUtilsLinux::onResolverRegistered() {
-  m_resolver.reset(new QDBusInterface(DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH,
-                                      DBUS_RESOLVE_MANAGER,
-                                      QDBusConnection::systemBus()));
-  logger.debug() << "systemd-resolved available, DNS resolver initialized";
-
-  if (!m_pendingIfname.isEmpty()) {
-    logger.debug() << "Re-applying DNS configuration for" << m_pendingIfname;
-    updateResolvers(m_pendingIfname, m_pendingResolvers);
-  }
-}
-
-void DnsUtilsLinux::onResolverUnregistered() {
-  logger.debug() << "systemd-resolved disappeared, dropping DNS resolver";
-  m_resolver.reset();
+  m_resolver = new QDBusInterface(DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH,
+                                  DBUS_RESOLVE_MANAGER, conn, this);
 }
 
 DnsUtilsLinux::~DnsUtilsLinux() {
   MZ_COUNT_DTOR(DnsUtilsLinux);
 
-  if (m_resolver) {
-    if (m_gatewayIfindex > 0)
-      setLinkDefaultRoute(m_gatewayIfindex, true);
+  for (auto iterator = m_linkDomains.constBegin();
+       iterator != m_linkDomains.constEnd(); ++iterator) {
+    QList<QVariant> argumentList;
+    argumentList << QVariant::fromValue(iterator.key());
+    argumentList << QVariant::fromValue(iterator.value());
+    m_resolver->asyncCallWithArgumentList(QStringLiteral("SetLinkDomains"),
+                                          argumentList);
+  }
 
-    for (auto iterator = m_linkDomains.constBegin();
-         iterator != m_linkDomains.constEnd(); ++iterator) {
-      QList<QVariant> argumentList;
-      argumentList << QVariant::fromValue(iterator.key());
-      argumentList << QVariant::fromValue(iterator.value());
-      m_resolver->asyncCallWithArgumentList(QStringLiteral("SetLinkDomains"),
-                                            argumentList);
-    }
-    if (m_ifindex > 0) {
-      m_resolver->asyncCall(QStringLiteral("RevertLink"), m_ifindex);
-    }
+  if (m_ifindex > 0) {
+    m_resolver->asyncCall(QStringLiteral("RevertLink"), m_ifindex);
   }
 
   logger.debug() << "DnsUtilsLinux destroyed.";
@@ -88,52 +52,19 @@ DnsUtilsLinux::~DnsUtilsLinux() {
 
 bool DnsUtilsLinux::updateResolvers(const QString& ifname,
                                     const QList<QHostAddress>& resolvers) {
-  if (m_gatewayIfindex > 0) {
-    setLinkDefaultRoute(m_gatewayIfindex, true);
-    m_gatewayIfindex = 0;
-  }
-
-  const int previousIfindex = m_ifindex;
   m_ifindex = if_nametoindex(qPrintable(ifname));
   if (m_ifindex <= 0) {
     logger.error() << "Unable to resolve ifindex for" << ifname;
     return false;
   }
 
-  m_pendingIfname = ifname;
-  m_pendingResolvers = resolvers;
-
-  if (!m_resolver) {
-    logger.debug() << "systemd-resolved not ready, queuing DNS configuration";
-    return true;
-  }
-
-  const int gwIdx = NetworkUtilities::getGatewayAndIface().second.index();
-  if (gwIdx > 0 && gwIdx != m_ifindex && gwIdx != m_gatewayIfindex) {
-    m_gatewayIfindex = gwIdx;
-    setLinkDefaultRoute(gwIdx, false);
-  }
-
   setLinkDNS(m_ifindex, resolvers);
   setLinkDefaultRoute(m_ifindex, true);
   updateLinkDomains();
-
-  if (previousIfindex > 0 && previousIfindex != m_ifindex) {
-    m_resolver->callWithArgumentList(QDBus::Block, QStringLiteral("RevertLink"),
-                                     {QVariant::fromValue(previousIfindex)});
-  }
   return true;
 }
 
 bool DnsUtilsLinux::restoreResolvers() {
-  m_pendingIfname.clear();
-  m_pendingResolvers.clear();
-
-  if (m_gatewayIfindex > 0) {
-    setLinkDefaultRoute(m_gatewayIfindex, true);
-    m_gatewayIfindex = 0;
-  }
-
   for (auto iterator = m_linkDomains.constBegin();
        iterator != m_linkDomains.constEnd(); ++iterator) {
     setLinkDomains(iterator.key(), iterator.value());
@@ -141,7 +72,7 @@ bool DnsUtilsLinux::restoreResolvers() {
   m_linkDomains.clear();
 
   /* Revert the VPN interface's DNS configuration */
-  if (m_ifindex > 0 && m_resolver) {
+  if (m_ifindex > 0) {
     QList<QVariant> argumentList = {QVariant::fromValue(m_ifindex)};
     QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
         QStringLiteral("RevertLink"), argumentList);
@@ -159,17 +90,13 @@ bool DnsUtilsLinux::restoreResolvers() {
 void DnsUtilsLinux::dnsCallCompleted(QDBusPendingCallWatcher* call) {
   QDBusPendingReply<> reply = *call;
   if (reply.isError()) {
-    logger.debug() << "DBus call failed (may be transient after systemd-resolved restart)";
-    logger.debug() << "Restarting resolved to clear its query backlog";
-    RouterLinux::Instance().flushDns();
-    scheduleRetry();
+    logger.error() << "Error received from the DBus service";
   }
   delete call;
 }
 
 void DnsUtilsLinux::setLinkDNS(int ifindex,
                                const QList<QHostAddress>& resolvers) {
-  if (!m_resolver) return;
   QList<DnsResolver> resolverList;
   char ifnamebuf[IF_NAMESIZE];
   const char* ifname = if_indextoname(ifindex, ifnamebuf);
@@ -194,7 +121,6 @@ void DnsUtilsLinux::setLinkDNS(int ifindex,
 
 void DnsUtilsLinux::setLinkDomains(int ifindex,
                                    const QList<DnsLinkDomain>& domains) {
-  if (!m_resolver) return;
   char ifnamebuf[IF_NAMESIZE];
   const char* ifname = if_indextoname(ifindex, ifnamebuf);
   if (ifname) {
@@ -218,7 +144,6 @@ void DnsUtilsLinux::setLinkDomains(int ifindex,
 }
 
 void DnsUtilsLinux::setLinkDefaultRoute(int ifindex, bool enable) {
-  if (!m_resolver) return;
   QList<QVariant> argumentList;
   argumentList << QVariant::fromValue(ifindex);
   argumentList << QVariant::fromValue(enable);
@@ -231,7 +156,6 @@ void DnsUtilsLinux::setLinkDefaultRoute(int ifindex, bool enable) {
 }
 
 void DnsUtilsLinux::updateLinkDomains() {
-  if (!m_resolver) return;
   /* Get the list of search domains, and remove any others that might conspire
    * to satisfy DNS resolution. Unfortunately, this is a pain because Qt doesn't
    * seem to be able to demarshall complex property types.
@@ -250,20 +174,11 @@ void DnsUtilsLinux::updateLinkDomains() {
 
 void DnsUtilsLinux::dnsDomainsReceived(QDBusPendingCallWatcher* call) {
   QDBusPendingReply<QVariant> reply = *call;
-  call->deleteLater();
   if (reply.isError()) {
-    // systemd-resolved may still be starting up after a restart — retry a few times
-    if (m_ifindex > 0 && m_domainRetries++ < 5) {
-      logger.debug() << "systemd-resolved not ready yet, retrying DNS setup ("
-                     << m_domainRetries << "/5)";
-      QTimer::singleShot(500, this, &DnsUtilsLinux::updateLinkDomains);
-    } else {
-      logger.warning() << "Failed to configure DNS after 5 retries";
-      m_domainRetries = 0;
-    }
+    logger.error() << "Error retrieving the DNS  domains from the DBus service";
+    delete call;
     return;
   }
-  m_domainRetries = 0;
 
   /* Update the state of the DNS domains */
   m_linkDomains.clear();
@@ -289,30 +204,9 @@ void DnsUtilsLinux::dnsDomainsReceived(QDBusPendingCallWatcher* call) {
   }
 
   /* Add a root search domain for the new interface. */
-  if (m_ifindex > 0) {
-    setLinkDomains(m_ifindex, {root});
-
-    /* Disable DefaultRoute on the physical gateway so systemd-resolved
-     * routes all DNS through the VPN interface. */
-    const int gwIdx = NetworkUtilities::getGatewayAndIface().second.index();
-    if (gwIdx > 0 && gwIdx != m_ifindex && gwIdx != m_gatewayIfindex) {
-      m_gatewayIfindex = gwIdx;
-      setLinkDefaultRoute(gwIdx, false);
-    }
-  }
-}
-
-void DnsUtilsLinux::scheduleRetry() {
-  if (m_pendingIfname.isEmpty() || m_retryPending || m_domainRetries >= 5)
-    return;
-  m_retryPending = true;
-  ++m_domainRetries;
-  logger.debug() << "Retrying full DNS setup (" << m_domainRetries << "/5)";
-  QTimer::singleShot(1000, this, [this]() {
-    m_retryPending = false;
-    if (!m_pendingIfname.isEmpty())
-      updateResolvers(m_pendingIfname, m_pendingResolvers);
-  });
+  QList<DnsLinkDomain> newlist = {root};
+  setLinkDomains(m_ifindex, newlist);
+  delete call;
 }
 
 static DnsMetatypeRegistrationProxy s_dnsMetatypeProxy;

client/platforms/linux/daemon/dnsutilslinux.h

@@ -6,12 +6,7 @@
 #define DNSUTILSLINUX_H
 
 #include <QDBusInterface>
-#include <QScopedPointer>
 #include <QDBusPendingCallWatcher>
-#include <QDBusServiceWatcher>
-#include <QHostAddress>
-#include <QList>
-#include <QString>
 
 #include "daemon/dnsutils.h"
 #include "dbustypeslinux.h"
@@ -34,22 +29,13 @@ class DnsUtilsLinux final : public DnsUtils {
   void updateLinkDomains();
 
  private slots:
-  void onResolverRegistered();
-  void onResolverUnregistered();
   void dnsCallCompleted(QDBusPendingCallWatcher*);
   void dnsDomainsReceived(QDBusPendingCallWatcher*);
 
  private:
-  void scheduleRetry();
-
   int m_ifindex = 0;
-  int m_gatewayIfindex = 0;
-  int m_domainRetries = 0;
-  bool m_retryPending = false;
   QMap<int, DnsLinkDomainList> m_linkDomains;
-  QScopedPointer<QDBusInterface> m_resolver;
-  QString m_pendingIfname;
-  QList<QHostAddress> m_pendingResolvers;
+  QDBusInterface* m_resolver = nullptr;
 };
 
 #endif  // DNSUTILSLINUX_H

client/platforms/linux/daemon/linuxfirewall.cpp

@@ -189,40 +189,6 @@ void LinuxFirewall::uninstallAnchor(LinuxFirewall::IPVersion ip, const QString&
     deleteChain(ip, actualChain, tableName);
 }
 
-QStringList LinuxFirewall::getDNSRules(const QStringList& servers)
-{
-    QStringList result;
-    for (const QString& server : servers)
-    {
-        result << QStringLiteral("-o amn0+ -d %1 -p udp --dport 53 -j ACCEPT").arg(server);
-        result << QStringLiteral("-o amn0+ -d %1 -p tcp --dport 53 -j ACCEPT").arg(server);
-        result << QStringLiteral("-o tun0+ -d %1 -p udp --dport 53 -j ACCEPT").arg(server);
-        result << QStringLiteral("-o tun0+ -d %1 -p tcp --dport 53 -j ACCEPT").arg(server);
-        result << QStringLiteral("-o tun2+ -d %1 -p udp --dport 53 -j ACCEPT").arg(server);
-        result << QStringLiteral("-o tun2+ -d %1 -p tcp --dport 53 -j ACCEPT").arg(server);
-    }
-    return result;
-}
-
-QStringList LinuxFirewall::getAllowRule(const QStringList& servers)
-{
-    QStringList result;
-    for (const QString& server : servers)
-    {
-        result << QStringLiteral("-d %1 -j ACCEPT").arg(server);
-    }
-    return result;
-}
-
-QStringList LinuxFirewall::getBlockRule(const QStringList& servers)
-{
-    QStringList result;
-    for (const QString& server : servers)
-    {
-        result << QStringLiteral("-d %1 -j REJECT").arg(server);
-    }
-    return result;
-}
 
 
 void LinuxFirewall::install()
@@ -292,6 +258,8 @@ void LinuxFirewall::install()
 
     installAnchor(IPv4, QStringLiteral("110.allowNets"), {});
 
+    installAnchor(Both, QStringLiteral("400.allowPIA"), {});
+
     installAnchor(Both, QStringLiteral("100.blockAll"), {
                                                             QStringLiteral("-j REJECT"),
                                                         });
@@ -455,16 +423,33 @@ void LinuxFirewall::updateDNSServers(const QStringList& servers)
     static QStringList existingServers {};
 
     existingServers = servers;
-    execute(QStringLiteral("iptables -F %1.320.allowDNS").arg(kAnchorName));
-    for (const QString& rule : getDNSRules(servers))
-        execute(QStringLiteral("iptables -A %1.320.allowDNS %2").arg(kAnchorName, rule));
+    const QString chain = QStringLiteral("%1.320.allowDNS").arg(kAnchorName);
+    executeIptables(QStringLiteral("iptables"), {QStringLiteral("-F"), chain});
+    const QStringList ifaces = {
+        QStringLiteral("amn0+"), QStringLiteral("tun0+"), QStringLiteral("tun2+")
+    };
+    for (const QString& server : servers) {
+        for (const QString& iface : ifaces) {
+            executeIptables(QStringLiteral("iptables"),
+                {QStringLiteral("-A"), chain, QStringLiteral("-o"), iface,
+                 QStringLiteral("-d"), server, QStringLiteral("-p"), QStringLiteral("udp"),
+                 QStringLiteral("--dport"), QStringLiteral("53"), QStringLiteral("-j"), QStringLiteral("ACCEPT")});
+            executeIptables(QStringLiteral("iptables"),
+                {QStringLiteral("-A"), chain, QStringLiteral("-o"), iface,
+                 QStringLiteral("-d"), server, QStringLiteral("-p"), QStringLiteral("tcp"),
+                 QStringLiteral("--dport"), QStringLiteral("53"), QStringLiteral("-j"), QStringLiteral("ACCEPT")});
+        }
+    }
 }
 
 void LinuxFirewall::updateAllowNets(const QStringList& servers)
 {
-    execute(QStringLiteral("iptables -F %1.110.allowNets").arg(kAnchorName));
-    for (const QString& rule : getAllowRule(servers))
-        execute(QStringLiteral("iptables -A %1.110.allowNets %2").arg(kAnchorName, rule));
+    const QString chain = QStringLiteral("%1.110.allowNets").arg(kAnchorName);
+    executeIptables(QStringLiteral("iptables"), {QStringLiteral("-F"), chain});
+    for (const QString& server : servers)
+        executeIptables(QStringLiteral("iptables"),
+            {QStringLiteral("-A"), chain, QStringLiteral("-d"), server,
+             QStringLiteral("-j"), QStringLiteral("ACCEPT")});
 }
 
 void LinuxFirewall::updateBlockNets(const QStringList& servers)
@@ -472,9 +457,12 @@ void LinuxFirewall::updateBlockNets(const QStringList& servers)
     static QStringList existingServers {};
 
     existingServers = servers;
-    execute(QStringLiteral("iptables -F %1.120.blockNets").arg(kAnchorName));
-    for (const QString& rule : getBlockRule(servers))
-        execute(QStringLiteral("iptables -A %1.120.blockNets %2").arg(kAnchorName, rule));
+    const QString chain = QStringLiteral("%1.120.blockNets").arg(kAnchorName);
+    executeIptables(QStringLiteral("iptables"), {QStringLiteral("-F"), chain});
+    for (const QString& server : servers)
+        executeIptables(QStringLiteral("iptables"),
+            {QStringLiteral("-A"), chain, QStringLiteral("-d"), server,
+             QStringLiteral("-j"), QStringLiteral("REJECT")});
 }
 
 int waitForExitCode(QProcess& process)
@@ -502,7 +490,25 @@ int LinuxFirewall::execute(const QString &command, bool ignoreErrors)
         logger.debug() << "(" << exitCode << ") $ " << command;
     if (!out.isEmpty())
         logger.info() << out;
-    if (!err.isEmpty() && !ignoreErrors)
+    if (!err.isEmpty())
+        logger.warning() << err;
+    return exitCode;
+}
+
+int LinuxFirewall::executeIptables(const QString &program, const QStringList &args, bool ignoreErrors)
+{
+    QProcess p;
+    p.start(program, args, QProcess::ReadOnly);
+    p.closeWriteChannel();
+
+    int exitCode = waitForExitCode(p);
+    auto out = p.readAllStandardOutput().trimmed();
+    auto err = p.readAllStandardError().trimmed();
+    if ((exitCode != 0 || !err.isEmpty()) && !ignoreErrors)
+        logger.warning() << "(" << exitCode << ") $ " << program << args.join(QLatin1Char(' '));
+    if (!out.isEmpty())
+        logger.info() << out;
+    if (!err.isEmpty())
         logger.warning() << err;
     return exitCode;
 }
@@ -514,12 +520,14 @@ void LinuxFirewall::setupTrafficSplitting()
         logger.warning() << "net_cls cgroup v1 not available, traffic splitting disabled";
         return;
     }
+
     execute(QStringLiteral(
         "if ! grep -qE '^[0-9]+[[:space:]]+%1$' /etc/iproute2/rt_tables 2>/dev/null ; then "
         "echo '200 %1' >> /etc/iproute2/rt_tables ; fi"
     ).arg(kRtableName));
+
     auto cGroupDir = "/sys/fs/cgroup/net_cls/" BRAND_CODE "vpnexclusions/";
-    logger.info() << "Should be setting up cgroup in" << cGroupDir << "for traffic splitting";
+    logger.info() << "Setting up cgroup in" << cGroupDir << "for traffic splitting";
     execute(QStringLiteral("if [ ! -d %1 ] ; then mkdir %1 ; sleep 0.1 ; echo %2 > %1/net_cls.classid ; fi").arg(cGroupDir).arg(kCGroupId));
     // Set a rule with priority 100 (lower priority than local but higher than main/default, 0 is highest priority)
     execute(QStringLiteral("if ! ip rule list | grep -q %1 ; then ip rule add from all fwmark %1 lookup %2 pri 100 ; fi").arg(kPacketTag, kRtableName));
@@ -528,8 +536,7 @@ void LinuxFirewall::setupTrafficSplitting()
 void LinuxFirewall::teardownTrafficSplitting()
 {
     logger.info() << "Tearing down cgroup and routing rules";
-    execute(QStringLiteral("if ip rule list | grep -q %1; then ip rule del from all fwmark %1 lookup %2 2> /dev/null ; fi").arg(kPacketTag, kRtableName));
-    execute(QStringLiteral("ip route flush table %1").arg(kRtableName), true);
+    execute(QStringLiteral("if ip rule list | grep -q %1; then ip rule del from all fwmark %1 lookup %2 2>/dev/null ; fi").arg(kPacketTag, kRtableName));
+    execute(QStringLiteral("ip route flush table %1 2>/dev/null || true").arg(kRtableName));
     execute(QStringLiteral("ip route flush cache"));
-    execute(QStringLiteral("sed -i '/%1/d' /etc/iproute2/rt_tables").arg(kRtableName));
 }

client/platforms/linux/daemon/linuxfirewall.h

@@ -79,12 +79,10 @@ private:
     static int unlinkChain(IPVersion ip, const QString& chain, const QString& parent, const QString& tableName = kFilterTable);
     static void installAnchor(IPVersion ip, const QString& anchor, const QStringList& rules, const QString& tableName = kFilterTable, const FilterCallbackFunc& enableFunc = {}, const FilterCallbackFunc& disableFunc = {});
     static void uninstallAnchor(IPVersion ip, const QString& anchor, const QString& tableName = kFilterTable);
-    static QStringList getDNSRules(const QStringList& servers);
-    static QStringList getAllowRule(const QStringList& servers);
-    static QStringList getBlockRule(const QStringList& servers);
     static void setupTrafficSplitting();
     static void teardownTrafficSplitting();
     static int execute(const QString& command, bool ignoreErrors = false);
+    static int executeIptables(const QString& program, const QStringList& args, bool ignoreErrors = false);
 private:
     // Chain names
     static QString kOutputChain, kRootChain, kPostRoutingChain, kPreRoutingChain;

client/platforms/linux/daemon/wireguardutilslinux.cpp

@@ -167,6 +167,12 @@ bool WireguardUtilsLinux::addInterface(const InterfaceConfig& config) {
     if (!config.m_maxHandshakeAttempts.isEmpty()) {
         out << "max_handshake_attempts=" << config.m_maxHandshakeAttempts << "\n";
     }
+    if (!config.m_randomTrailers.isEmpty()) {
+        out << "random_trailers=" << InterfaceConfig::awgBoolToUapi(config.m_randomTrailers) << "\n";
+    }
+    if (!config.m_disableCookies.isEmpty()) {
+        out << "disable_cookies=" << InterfaceConfig::awgBoolToUapi(config.m_disableCookies) << "\n";
+    }
 
     int err = uapiErrno(uapiCommand(message));
     if (err != 0) {
@@ -263,11 +269,7 @@ bool WireguardUtilsLinux::updatePeer(const InterfaceConfig& config) {
     // Exclude the server address, except for multihop exit servers.
     if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
         (m_rtmonitor != nullptr)) {
-        if (!config.m_serverIpv4AddrIn.isEmpty() &&
-            !m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn))) {
-            logger.error() << "No gateway — cannot add server exclusion route";
-            return false;
-        }
+        m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
         m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
     }
 

client/platforms/macos/daemon/wireguardutilsmacos.cpp

@@ -165,6 +165,12 @@ bool WireguardUtilsMacos::addInterface(const InterfaceConfig& config) {
   if (!config.m_maxHandshakeAttempts.isEmpty()) {
     out << "max_handshake_attempts=" << config.m_maxHandshakeAttempts << "\n";
   }
+  if (!config.m_randomTrailers.isEmpty()) {
+    out << "random_trailers=" << InterfaceConfig::awgBoolToUapi(config.m_randomTrailers) << "\n";
+  }
+  if (!config.m_disableCookies.isEmpty()) {
+    out << "disable_cookies=" << InterfaceConfig::awgBoolToUapi(config.m_disableCookies) << "\n";
+  }
 
   int err = uapiErrno(uapiCommand(message));
   if (err != 0) {

client/server_scripts/awg/configure_container.sh

@@ -32,6 +32,8 @@ RekeyTimeout = $REKEY_TIMEOUT
 RejectAfterTime = $REJECT_AFTER_TIME
 KeepaliveTimeout = $KEEPALIVE_TIMEOUT
 MaxHandshakeAttempts = $MAX_HANDSHAKE_ATTEMPTS
+RandomTrailers = $RANDOM_TRAILERS
+DisableCookies = $DISABLE_COOKIES
 # I1 = $SPECIAL_JUNK_1
 # I2 = $SPECIAL_JUNK_2
 # I3 = $SPECIAL_JUNK_3

client/server_scripts/awg/template.conf

@@ -25,6 +25,8 @@ RekeyTimeout = $REKEY_TIMEOUT
 RejectAfterTime = $REJECT_AFTER_TIME
 KeepaliveTimeout = $KEEPALIVE_TIMEOUT
 MaxHandshakeAttempts = $MAX_HANDSHAKE_ATTEMPTS
+RandomTrailers = $RANDOM_TRAILERS
+DisableCookies = $DISABLE_COOKIES
 
 [Peer]
 PublicKey = $WIREGUARD_SERVER_PUBLIC_KEY

client/ui/controllers/api/subscriptionUiController.cpp

@@ -272,7 +272,7 @@ bool SubscriptionUiController::restoreServiceFromAppStore()
         return false;
     }
 
-    emit installServerFromApiFinished(tr("Subscription restored successfully."));
+    emit installServerFromApiFinished(tr("Subscription restored successfully"));
     if (result.duplicateCount > 0) {
         qInfo().noquote() << "[IAP] Skipped" << result.duplicateCount
                           << "duplicate restored transactions for original transaction IDs already processed";
@@ -469,7 +469,7 @@ bool SubscriptionUiController::importTrialFromGateway(const QString &email)
     if (errorCode != ErrorCode::NoError) {
         if (errorCode == ErrorCode::ApiTrialAlreadyUsedError) {
             emit trialEmailError(
-                    tr("This email address has already been used to activate a trial. If you like the service, you can upgrade to Premium"));
+                    tr("This email address has already been used to activate a trial. Like the service? Upgrade to Premium"));
         } else {
             emit errorOccurred(errorCode);
         }
@@ -648,7 +648,7 @@ QStringList SubscriptionUiController::availableProtocols(const QString &serverId
 void SubscriptionUiController::removeApiConfig(const QString &serverId)
 {
     m_subscriptionController->removeApiConfig(serverId);
-    emit apiConfigRemoved(tr("Api config removed"));
+    emit apiConfigRemoved(tr("API config removed"));
 }
 
 void SubscriptionUiController::removeServer(const QString &serverId)

client/ui/controllers/serversUiController.cpp

@@ -1,5 +1,6 @@
 #include "serversUiController.h"
 
+#include "core/utils/api/apiUtils.h"
 #include "core/utils/containerEnum.h"
 #include "core/utils/containers/containerUtils.h"
 #include "core/utils/protocolEnum.h"
@@ -205,10 +206,14 @@ QString ServersUiController::getDefaultServerDescriptionCollapsed() const
 QString ServersUiController::getDefaultServerImagePathCollapsed() const
 {
     const auto &description = serverDescriptionById(getDefaultServerId());
-    if (!description.isApiV2 || description.apiServerCountryCode.isEmpty()) {
+    if (!description.isApiV2) {
         return "";
     }
-    return QString("qrc:/countriesFlags/images/flagKit/%1.svg").arg(description.apiServerCountryCode.toUpper());
+    const QString flagCode = apiUtils::getCountryFlagCode(description.apiServerCountryCode);
+    if (flagCode.isEmpty()) {
+        return "";
+    }
+    return QString("qrc:/countriesFlags/images/flagKit/%1.svg").arg(flagCode);
 }
 
 QString ServersUiController::getDefaultServerDescriptionExpanded() const

client/ui/models/api/apiCountryModel.cpp

@@ -2,6 +2,7 @@
 
 #include <QJsonObject>
 
+#include "core/utils/api/apiUtils.h"
 #include "core/utils/serverConfigUtils.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"
@@ -41,7 +42,7 @@ QVariant ApiCountryModel::data(const QModelIndex &index, int role) const
         return countryInfo.countryName;
     }
     case CountryImageCodeRole: {
-        return countryInfo.countryCode.toUpper();
+        return apiUtils::getCountryFlagCode(countryInfo.countryCode);
     }
     case IsIssuedRole: {
         return isIssued;

client/ui/models/protocols/awgConfigModel.cpp

@@ -50,6 +50,10 @@ bool AwgConfigModel::setData(const QModelIndex &index, const QVariant &value, in
     case Roles::ClientRejectAfterTimeRole: m_protocolConfig.clientConfig->rejectAfterTime = strValue; break;
     case Roles::ClientKeepaliveTimeoutRole: m_protocolConfig.clientConfig->keepaliveTimeout = strValue; break;
     case Roles::ClientMaxHandshakeAttemptsRole: m_protocolConfig.clientConfig->maxHandshakeAttempts = strValue; break;
+    case Roles::ClientDisableCookiesRole:
+        m_protocolConfig.clientConfig->disableCookies =
+                value.toBool() ? QString(protocols::awg::awgBoolOn) : QString(protocols::awg::awgBoolOff);
+        break;
     case Roles::ServerJunkPacketCountRole: m_protocolConfig.serverConfig.junkPacketCount = strValue; break;
     case Roles::ServerJunkPacketMinSizeRole: m_protocolConfig.serverConfig.junkPacketMinSize = strValue; break;
     case Roles::ServerJunkPacketMaxSizeRole: m_protocolConfig.serverConfig.junkPacketMaxSize = strValue; break;
@@ -84,6 +88,14 @@ bool AwgConfigModel::setData(const QModelIndex &index, const QVariant &value, in
         }
         break;
     }
+    case Roles::ServerRandomTrailersRole:
+        m_protocolConfig.serverConfig.randomTrailers =
+                value.toBool() ? QString(protocols::awg::awgBoolOn) : QString(protocols::awg::awgBoolOff);
+        break;
+    case Roles::ServerDisableCookiesRole:
+        m_protocolConfig.serverConfig.disableCookies =
+                value.toBool() ? QString(protocols::awg::awgBoolOn) : QString(protocols::awg::awgBoolOff);
+        break;
     default:
         return false;
     }
@@ -118,6 +130,14 @@ QVariant AwgConfigModel::data(const QModelIndex &index, int role) const
     case Roles::ClientKeepaliveTimeoutRole: return m_protocolConfig.clientConfig->keepaliveTimeout;
     case Roles::ClientMaxHandshakeAttemptsRole: return m_protocolConfig.clientConfig->maxHandshakeAttempts;
     case Roles::ClientHeaderProtectionEnabledRole: return !m_protocolConfig.clientConfig->headerProtectionKey.isEmpty();
+    case Roles::ClientRandomTrailersRole:
+        return m_protocolConfig.clientConfig->randomTrailers.compare(QLatin1String(protocols::awg::awgBoolOn),
+                                                                     Qt::CaseInsensitive)
+                == 0;
+    case Roles::ClientDisableCookiesRole:
+        return m_protocolConfig.clientConfig->disableCookies.compare(QLatin1String(protocols::awg::awgBoolOn),
+                                                                     Qt::CaseInsensitive)
+                == 0;
 
     case Roles::ServerJunkPacketCountRole: return m_protocolConfig.serverConfig.junkPacketCount;
     case Roles::ServerJunkPacketMinSizeRole: return m_protocolConfig.serverConfig.junkPacketMinSize;
@@ -143,6 +163,14 @@ QVariant AwgConfigModel::data(const QModelIndex &index, int role) const
     case Roles::ServerKeepaliveTimeoutRole: return m_protocolConfig.serverConfig.keepaliveTimeout;
     case Roles::ServerMaxHandshakeAttemptsRole: return m_protocolConfig.serverConfig.maxHandshakeAttempts;
     case Roles::ServerHeaderProtectionEnabledRole: return !m_protocolConfig.serverConfig.headerProtectionKey.isEmpty();
+    case Roles::ServerRandomTrailersRole:
+        return m_protocolConfig.serverConfig.randomTrailers.compare(QLatin1String(protocols::awg::awgBoolOn),
+                                                                    Qt::CaseInsensitive)
+                == 0;
+    case Roles::ServerDisableCookiesRole:
+        return m_protocolConfig.serverConfig.disableCookies.compare(QLatin1String(protocols::awg::awgBoolOn),
+                                                                    Qt::CaseInsensitive)
+                == 0;
 
     case Roles::IsAwg2Role: {
         QString version = serverProtocolVersion();
@@ -161,6 +189,8 @@ void AwgConfigModel::updateModel(amnezia::DockerContainer container, const amnez
     
     m_protocolConfig = protocolConfig;
     
+    applyDefaultsToServerConfig(m_protocolConfig.serverConfig);
+
     if (!m_protocolConfig.clientConfig.has_value()) {
         m_protocolConfig.clientConfig = amnezia::AwgClientConfig{};
     }
@@ -176,6 +206,13 @@ QString AwgConfigModel::serverProtocolVersion() const
     return m_protocolConfig.serverConfig.protocolVersion;
 }
 
+void AwgConfigModel::applyDefaultsToServerConfig(amnezia::AwgServerConfig& config)
+{
+    if (config.subnetAddress.isEmpty()) {
+        config.subnetAddress = protocols::wireguard::defaultSubnetAddress;
+    }
+}
+
 void AwgConfigModel::applyDefaultsToClientConfig(amnezia::AwgClientConfig& config)
 {
     if (config.mtu.isEmpty()) {
@@ -232,6 +269,8 @@ QHash<int, QByteArray> AwgConfigModel::roleNames() const
     roles[ClientKeepaliveTimeoutRole] = "clientKeepaliveTimeout";
     roles[ClientMaxHandshakeAttemptsRole] = "clientMaxHandshakeAttempts";
     roles[ClientHeaderProtectionEnabledRole] = "clientHeaderProtectionEnabled";
+    roles[ClientRandomTrailersRole] = "clientRandomTrailers";
+    roles[ClientDisableCookiesRole] = "clientDisableCookies";
 
     roles[ServerJunkPacketCountRole] = "serverJunkPacketCount";
     roles[ServerJunkPacketMinSizeRole] = "serverJunkPacketMinSize";
@@ -258,6 +297,8 @@ QHash<int, QByteArray> AwgConfigModel::roleNames() const
     roles[ServerKeepaliveTimeoutRole] = "serverKeepaliveTimeout";
     roles[ServerMaxHandshakeAttemptsRole] = "serverMaxHandshakeAttempts";
     roles[ServerHeaderProtectionEnabledRole] = "serverHeaderProtectionEnabled";
+    roles[ServerRandomTrailersRole] = "serverRandomTrailers";
+    roles[ServerDisableCookiesRole] = "serverDisableCookies";
 
     roles[IsAwg2Role] = "isAwg2";
     roles[IsAwg3Role] = "isAwg3";

client/ui/models/protocols/awgConfigModel.h

@@ -33,6 +33,8 @@ public:
         ClientKeepaliveTimeoutRole,
         ClientMaxHandshakeAttemptsRole,
         ClientHeaderProtectionEnabledRole,
+        ClientRandomTrailersRole,
+        ClientDisableCookiesRole,
 
         ServerJunkPacketCountRole,
         ServerJunkPacketMinSizeRole,
@@ -59,6 +61,8 @@ public:
         ServerKeepaliveTimeoutRole,
         ServerMaxHandshakeAttemptsRole,
         ServerHeaderProtectionEnabledRole,
+        ServerRandomTrailersRole,
+        ServerDisableCookiesRole,
 
         IsAwg2Role,
         IsAwg3Role
@@ -88,6 +92,7 @@ private:
     amnezia::AwgProtocolConfig m_originalProtocolConfig;
     
     QString serverProtocolVersion() const;
+    void applyDefaultsToServerConfig(amnezia::AwgServerConfig& config);
     void applyDefaultsToClientConfig(amnezia::AwgClientConfig& config);
 };
 

client/ui/models/protocols/wireguardConfigModel.cpp

@@ -71,6 +71,8 @@ void WireGuardConfigModel::updateModel(amnezia::DockerContainer container, const
     
     m_protocolConfig = protocolConfig;
     
+    applyDefaultsToServerConfig(m_protocolConfig.serverConfig);
+
     if (!m_protocolConfig.clientConfig.has_value()) {
         m_protocolConfig.clientConfig = amnezia::WireGuardClientConfig{};
     }
@@ -81,6 +83,13 @@ void WireGuardConfigModel::updateModel(amnezia::DockerContainer container, const
     endResetModel();
 }
 
+void WireGuardConfigModel::applyDefaultsToServerConfig(amnezia::WireGuardServerConfig& config)
+{
+    if (config.subnetAddress.isEmpty()) {
+        config.subnetAddress = protocols::wireguard::defaultSubnetAddress;
+    }
+}
+
 void WireGuardConfigModel::applyDefaultsToClientConfig(amnezia::WireGuardClientConfig& config)
 {
     if (config.mtu.isEmpty()) {

client/ui/models/protocols/wireguardConfigModel.h

@@ -40,6 +40,7 @@ private:
     amnezia::WireGuardProtocolConfig m_protocolConfig;
     amnezia::WireGuardProtocolConfig m_originalProtocolConfig;
     
+    void applyDefaultsToServerConfig(amnezia::WireGuardServerConfig& config);
     void applyDefaultsToClientConfig(amnezia::WireGuardClientConfig& config);
 };
 

client/ui/qml/Controls2/ContextMenuType.qml

@@ -63,8 +63,8 @@ Menu {
     }
     MenuItem {
         text: qsTr("&Paste")
-        // Fix calling paste from clipboard when launching app on android
-        enabled: Qt.platform.os === "android" ? true : textObj.canPaste
+        // Fix calling paste from clipboard when launching app on android/ios
+        enabled: (Qt.platform.os === "android" || Qt.platform.os === "ios") ? true : textObj.canPaste
         onTriggered: textObj.paste()
     }
 

client/ui/qml/Pages2/PageHome.qml

@@ -25,6 +25,8 @@ PageType {
     property string apiCurrentProtocol: ""
 
     readonly property bool isApiProtocolSelectionVisible: ServersUiController.isDefaultServerFromApi && root.apiAvailableProtocols.length > 0
+    readonly property bool isOutdatedAwgWarningVisible: drawer.isCollapsedStateActive()
+                                                        && ServersUiController.defaultServerHasOutdatedAwgContainer
 
     function updateApiProtocolState() {
         if (ServersUiController.isDefaultServerFromApi) {
@@ -299,26 +301,6 @@ PageType {
                         }
                     }
 
-                    ImageButtonType {
-                        id: outdatedContainerWarningIcon
-                        objectName: "outdatedContainerWarningIcon"
-
-                        Layout.rightMargin: 8
-
-                        visible: drawer.isCollapsedStateActive() && ServersUiController.defaultServerHasOutdatedAwgContainer
-
-                        hoverEnabled: false
-                        image: "qrc:/images/controls/alert-circle.svg"
-                        imageColor: AmneziaStyle.color.goldenApricot
-
-                        icon.width: 18
-                        icon.height: 18
-                        backgroundRadius: 16
-                        horizontalPadding: 4
-                        topPadding: 4
-                        bottomPadding: 3
-                    }
-
                     Header1TextType {
                         id: collapsedButtonHeader
                         objectName: "collapsedButtonHeader"
@@ -370,7 +352,9 @@ PageType {
                     objectName: "rowLayoutLabel"
                     Layout.alignment: Qt.AlignHCenter | Qt.AlignVCenter
                     Layout.topMargin: 8
-                    Layout.bottomMargin: root.isApiProtocolSelectionVisible ? 8 : (drawer.isCollapsedStateActive ? 44 : ServersUiController.isDefaultServerFromApi ? 61 : 16)
+                    Layout.bottomMargin: root.isOutdatedAwgWarningVisible
+                                         ? 8
+                                         : (root.isApiProtocolSelectionVisible ? 8 : (drawer.isCollapsedStateActive ? 44 : ServersUiController.isDefaultServerFromApi ? 61 : 16))
                     spacing: 0
 
                     BasicButtonType {
@@ -425,6 +409,23 @@ PageType {
                     }
                 }
 
+                WarningType {
+                    objectName: "outdatedContainerWarning"
+
+                    Layout.fillWidth: true
+                    Layout.leftMargin: 16
+                    Layout.rightMargin: 16
+                    Layout.bottomMargin: 24
+
+                    visible: root.isOutdatedAwgWarningVisible
+
+                    backGroundColor: AmneziaStyle.color.transparent
+                    iconPath: "qrc:/images/controls/alert-circle.svg"
+                    imageColor: AmneziaStyle.color.goldenApricot
+                    textColor: AmneziaStyle.color.goldenApricot
+                    textString: qsTr("AmneziaWG 2.0 is outdated and no longer supported. Continued use requires a fresh installation of the AmneziaWG 3.1 container.")
+                }
+
                 RowLayout {
                     objectName: "protocolRowLayout"
                     Layout.alignment: Qt.AlignHCenter | Qt.AlignVCenter

client/ui/qml/Pages2/PageProtocolAwgClientSettings.qml

@@ -263,6 +263,39 @@ PageType {
                 onEdited: (text) => { clientMaxHandshakeAttempts = text }
             }
 
+            CheckBoxType {
+                id: randomTrailersCheckBox
+
+                Layout.fillWidth: true
+                Layout.topMargin: 16
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+
+                enabled: false
+
+                text: qsTr("RandomTrailers")
+
+                checked: clientRandomTrailers
+            }
+
+            CheckBoxType {
+                id: disableCookiesCheckBox
+
+                Layout.fillWidth: true
+                Layout.topMargin: 16
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+
+                text: qsTr("DisableCookies")
+
+                checked: clientDisableCookies
+                onCheckedChanged: {
+                    if (checked !== clientDisableCookies) {
+                        clientDisableCookies = checked
+                    }
+                }
+            }
+
 
             Header2TextType {
                 Layout.fillWidth: true

client/ui/qml/Pages2/PageProtocolAwgSettings.qml

@@ -395,6 +395,46 @@ PageType {
                 onEdited: (text) => { serverMaxHandshakeAttempts = text }
             }
 
+            CheckBoxType {
+                id: randomTrailersCheckBox
+
+                Layout.fillWidth: true
+                Layout.topMargin: 16
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+
+                visible: isAwg3
+
+                text: qsTr("RandomTrailers")
+
+                checked: serverRandomTrailers
+                onCheckedChanged: {
+                    if (checked !== serverRandomTrailers) {
+                        serverRandomTrailers = checked
+                    }
+                }
+            }
+
+            CheckBoxType {
+                id: disableCookiesCheckBox
+
+                Layout.fillWidth: true
+                Layout.topMargin: 16
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+
+                visible: isAwg3
+
+                text: qsTr("DisableCookies")
+
+                checked: serverDisableCookies
+                onCheckedChanged: {
+                    if (checked !== serverDisableCookies) {
+                        serverDisableCookies = checked
+                    }
+                }
+            }
+
             BasicButtonType {
                 id: saveRestartButton
 

client/ui/qml/Pages2/PageSettingsApiAvailableCountries.qml

@@ -235,7 +235,7 @@ PageType {
                     Layout.rightMargin: 32
                     Layout.alignment: Qt.AlignRight
 
-                    source: "qrc:/countriesFlags/images/flagKit/" + countryImageCode + ".svg"
+                    source: countryImageCode !== "" ? "qrc:/countriesFlags/images/flagKit/" + countryImageCode + ".svg" : ""
                 }
             }
 

client/ui/qml/Pages2/PageSettingsApiNativeConfigs.qml

@@ -74,7 +74,7 @@ PageType {
                 hideDescription: isWorkerExpired ? false : true
                 descriptionColor: AmneziaStyle.color.vibrantRed
 
-                leftImageSource: "qrc:/countriesFlags/images/flagKit/" + countryImageCode + ".svg"
+                leftImageSource: countryImageCode !== "" ? "qrc:/countriesFlags/images/flagKit/" + countryImageCode + ".svg" : ""
                 rightImageSource: isIssued ? "qrc:/images/controls/more-vertical.svg" : "qrc:/images/controls/download.svg"
 
                 clickedFunction: function() {

client/ui/qml/Pages2/PageSettingsServerProtocol.qml

@@ -68,7 +68,7 @@ PageType {
                 iconPath: "qrc:/images/controls/alert-circle.svg"
                 imageColor: AmneziaStyle.color.goldenApricot
                 textColor: AmneziaStyle.color.goldenApricot
-                textString: qsTr("AmneziaWG 2.0 is outdated and does not include the latest security improvements, but it will continue to work. Moving to AmneziaWG 3.0 by deploying a new container on the server is recommended for stronger protocol security")
+                textString: qsTr("AmneziaWG 2.0 is outdated and does not include the latest security improvements, but it will continue to work. Moving to AmneziaWG 3.1 by deploying a new container on the server is recommended for stronger protocol security")
             }
         }
 

client/ui/qml/Pages2/PageShareConnection.qml

@@ -325,6 +325,22 @@ PageType {
                 horizontalAlignment: Text.AlignHCenter
                 text: qsTr("To read the QR code in the Amnezia app, tap + in the main menu → 'QR code'")
             }
+
+            WarningType {
+                Layout.fillWidth: true
+                Layout.topMargin: 24
+                Layout.bottomMargin: 32
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+
+                visible: pageShareConnection.isSelfHostedConfig
+                         && pageShareConnection.configExtension === ".conf"
+                         && !isQrCodeVisible
+                         && ExportController.config !== ""
+
+                iconPath: "qrc:/images/controls/alert-circle.svg"
+                textString: qsTr("This config is too large for a QR code. Share the file or copy the connection settings instead.")
+            }
         }
     }
 }

client/vpnConnection.cpp

@@ -36,21 +36,14 @@
 
 using namespace ProtocolUtils;
 
-namespace {
-    constexpr int RECONNECT_DEBOUNCE_MSEC = 1500;
-}
-
 VpnConnection::VpnConnection(SecureServersRepository* serversRepository, SecureAppSettingsRepository* appSettingsRepository, QObject *parent)
-    : QObject(parent), m_serversRepository(serversRepository), m_appSettingsRepository(appSettingsRepository), m_checkTimer(this), m_reconnectDebounceTimer(this)
+    : QObject(parent), m_serversRepository(serversRepository), m_appSettingsRepository(appSettingsRepository), m_checkTimer(this)
 {
 #if defined(Q_OS_IOS) || defined(MACOS_NE)
     m_checkTimer.setInterval(1000);
     connect(IosController::Instance(), &IosController::connectionStateChanged, this, &VpnConnection::setConnectionState);
     connect(IosController::Instance(), &IosController::bytesChanged, this, &VpnConnection::onBytesChanged);
 #endif
-
-    m_reconnectDebounceTimer.setSingleShot(true);
-    connect(&m_reconnectDebounceTimer, &QTimer::timeout, this, &VpnConnection::reconnectToVpn);
 }
 
 VpnConnection::~VpnConnection()
@@ -388,8 +381,8 @@ void VpnConnection::createProtocolConnections()
 
 #ifdef AMNEZIA_DESKTOP
     IpcClient::withInterface([this](QSharedPointer<IpcInterfaceReplica> rep) {
-        connect(rep.data(), &IpcInterfaceReplica::networkChanged, this, &VpnConnection::requestReconnect, Qt::QueuedConnection);
-        connect(rep.data(), &IpcInterfaceReplica::wakeup, this, &VpnConnection::requestReconnect, Qt::QueuedConnection);
+        connect(rep.data(), &IpcInterfaceReplica::networkChanged, this, &VpnConnection::reconnectToVpn, Qt::QueuedConnection);
+        connect(rep.data(), &IpcInterfaceReplica::wakeup, this, &VpnConnection::reconnectToVpn, Qt::QueuedConnection);
     });
 #endif
 }
@@ -556,11 +549,6 @@ QString VpnConnection::bytesPerSecToText(quint64 bytes)
     return QString("%1 %2").arg(QString::number(mbps, 'f', 2)).arg(tr("Mbps")); // Mbit/s
 }
 
-void VpnConnection::requestReconnect() {
-    qDebug() << "Reconnect requested; debouncing for" << RECONNECT_DEBOUNCE_MSEC << "ms";
-    m_reconnectDebounceTimer.start(RECONNECT_DEBOUNCE_MSEC);
-}
-
 void VpnConnection::reconnectToVpn() {
     if (m_vpnProtocol.isNull())
         return;

client/vpnConnection.h

@@ -51,7 +51,6 @@ public slots:
     void setRepositories(SecureServersRepository* serversRepository, SecureAppSettingsRepository* appSettingsRepository);
     void connectToVpn(const QString &serverId, DockerContainer container, const QJsonObject &vpnConfiguration);
     void reconnectToVpn();
-    void requestReconnect();
     void disconnectFromVpn();
 
     void onKillSwitchModeChanged(bool enabled);
@@ -84,10 +83,6 @@ private:
     // Only for iOS for now, check counters
     QTimer m_checkTimer;
 
-    // Coalesces bursts of wakeup/networkChanged signals (e.g. several Wi-Fi
-    // re-associations right after a sleep resume) into a single reconnect.
-    QTimer m_reconnectDebounceTimer;
-
 #ifdef Q_OS_ANDROID
    AndroidVpnProtocol* androidVpnProtocol = nullptr;
 

cmake/CPack.cmake

@@ -72,6 +72,17 @@ if(WIN32)
         DESTINATION "."
         COMPONENT AmneziaVPN
     )
+
+    set(CMAKE_INSTALL_SYSTEM_RUNTIME_LIBS_SKIP TRUE)
+    include(InstallRequiredSystemLibraries)
+    if(CMAKE_INSTALL_SYSTEM_RUNTIME_LIBS)
+        install(PROGRAMS ${CMAKE_INSTALL_SYSTEM_RUNTIME_LIBS}
+            DESTINATION "."
+            COMPONENT AmneziaVPN
+        )
+    else()
+        message(WARNING "MSVC runtime libraries were not found, packages will not ship them")
+    endif()
 endif()
 
 if (APPLE AND NOT IOS AND NOT MACOS_NE)

conanfile.py

@@ -19,12 +19,12 @@ class AmneziaVPN(ConanFile):
 
         if has_service:
             if os == "Windows":
-                self.requires("awg-windows/3.0.2")
+                self.requires("awg-windows/3.1.20260814")
                 self.requires("tap-windows6/9.27.0")
                 self.requires("win-split-tunnel/1.2.5.0")
                 self.requires("wintun/0.14.1")
             else:
-                self.requires("awg-go/3.0.1")
+                self.requires("awg-go/3.1.20260814")
 
             self.requires("amnezia-xray-bindings/1.3.0")
             self.requires("tun2socks/2.6.0")
@@ -32,13 +32,13 @@ class AmneziaVPN(ConanFile):
             self.requires("v2ray-rules-dat/202603162227")
 
         if has_ne:
-            self.requires("awg-apple/3.0.1")
+            self.requires("awg-apple/3.1.20260814")
             self.requires("hev-socks5-tunnel/2.15.0", options={"as_framework": True})
             self.requires("openvpnadapter/1.0.0")
 
         if os == "Android":
             self.requires("amnezia-libxray/1.0.2")
-            self.requires("awg-android/3.0.1")
+            self.requires("awg-android/3.1.20260814")
             self.requires("openvpn-pt-android/1.0.0")
 
         # expicitly use libssh@amnezia to prevent it from being downloaded from conan-center

deploy/build.sh

@@ -123,7 +123,7 @@ case "$TARGET" in
     android)
         no_installers=1
         : ${CMAKE_GENERATOR:="Ninja"}
-        : ${ANDROID_PLATFORM:="android-28"}
+        : ${ANDROID_PLATFORM:="android-${APP_ANDROID_MIN_SDK:-28}"}
 
         if [[ -n "$SIGN" ]]; then
             QT_ANDROID_SIGN_APK=TRUE
@@ -198,6 +198,9 @@ args=()
 [[ -n "$ANDROID_SDK_ROOT" ]]          && args+=("-DANDROID_SDK_ROOT=$ANDROID_SDK_ROOT")
 [[ -n "$ANDROID_NDK_ROOT" ]]          && args+=("-DANDROID_NDK_ROOT=$ANDROID_NDK_ROOT")
 [[ -n "$ANDROID_PLATFORM" ]]          && args+=("-DANDROID_PLATFORM=$ANDROID_PLATFORM")
+[[ -n "$APP_ANDROID_MIN_SDK" ]]       && args+=("-DAPP_ANDROID_MIN_SDK=$APP_ANDROID_MIN_SDK")
+[[ -n "$APP_ANDROID_MAX_SDK" ]]       && args+=("-DAPP_ANDROID_MAX_SDK=$APP_ANDROID_MAX_SDK")
+[[ -n "$APP_ANDROID_VERSION_CODE_OFFSET" ]] && args+=("-DAPP_ANDROID_VERSION_CODE_OFFSET=$APP_ANDROID_VERSION_CODE_OFFSET")
 [[ -n "$QT_ANDROID_SIGN_APK" ]]       && args+=("-DQT_ANDROID_SIGN_APK=$QT_ANDROID_SIGN_APK")
 [[ -n "$QT_ANDROID_SIGN_AAB" ]]       && args+=("-DQT_ANDROID_SIGN_AAB=$QT_ANDROID_SIGN_AAB")
 [[ -n "$QT_ANDROID_ABIS" ]]           && args+=("-DQT_ANDROID_ABIS=$QT_ANDROID_ABIS")

deploy/deploy_s3.sh

@@ -34,10 +34,6 @@ download_file() {
     echo "Successfully downloaded $filename"
 }
 
-download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_arm64-v8a.apk
-download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_armeabi-v7a.apk
-download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_x86.apk
-download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_android9+_x86_64.apk
 download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_linux_x64.run
 download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_macos_x64.pkg
 download_file https://github.com/amnezia-vpn/amnezia-client/releases/download/${VERSION}/AmneziaVPN_${VERSION}_windows_x64.exe 

deploy/installer/qif/componentscript.js

@@ -73,15 +73,15 @@ Component.prototype.createOperations = function()
                                        "workingDirectory=@TargetDir@", "iconPath=@TargetDir@\\" + appExecutableFileName(), "iconId=0");
 
         if (!vcRuntimeIsInstalled()) {
-			if (systemInfo.currentCpuArchitecture.search("64") < 0) {
-				component.addElevatedOperation("Execute", "@TargetDir@\\" + "vc_redist.x86.exe", "/install", "/quiet", "/norestart", "/log", "vc_redist.log");
-			}
-			else {
-				component.addElevatedOperation("Execute", "@TargetDir@\\" + "vc_redist.x64.exe", "/install", "/quiet", "/norestart", "/log", "vc_redist.log");
-			}
-
+            var vcRedistFileName = (systemInfo.currentCpuArchitecture.search("64") < 0) ? "vc_redist.x86.exe"
+                                                                                       : "vc_redist.x64.exe";
+            if (installer.findPath(vcRedistFileName, [installer.value("TargetDir").replace(/\//g, '\\')]).length !== 0) {
+                component.addElevatedOperation("Execute", "@TargetDir@\\" + vcRedistFileName, "/install", "/quiet", "/norestart", "/log", "vc_redist.log");
+            } else {
+                console.log(vcRedistFileName + " is not bundled, relying on the application-local MSVC runtime");
+            }
         } else {
-            console.log("Microsoft Visual C++ 2017 Redistributable already installed");
+            console.log("Microsoft Visual C++ Redistributable already installed");
         }
 
         let pu_path = installer.value("TargetDir").replace(/\//g, '\\') + "\\"

ipc/ipc.h

@@ -3,6 +3,8 @@
 
 #include <QObject>
 #include <QString>
+#include <QRegularExpression>
+#include <QSet>
 
 #include "../client/core/utils/utilities.h"
 
@@ -15,7 +17,8 @@ enum PermittedProcess {
     OpenVPN,
     Wireguard,
     Tun2Socks,
-    CertUtil
+    CertUtil,
+    PermittedProcessCount
 };
 
 inline QString permittedProcessPath(PermittedProcess pid)
@@ -57,16 +60,27 @@ inline QStringList sanitizeArguments(PermittedProcess proc, const QStringList &a
     QList<Validator> positionalArgs;
 
     switch (proc) {
+    case OpenVPN: {
+        namedArgs["--config"] = [](const QString& v) { return !v.isEmpty(); };
+        namedArgs["--management"] = [](const QString& v) { return !v.isEmpty(); };
+        namedArgs["--management-client"] = nullptr;
+        positionalArgs.append([](const QString& v) {
+            bool ok;
+            int port = v.toInt(&ok);
+            return ok && port > 0 && port <= 65535;
+        });
+        break;
+    }
     case Tun2Socks:
         namedArgs["-device"] = [](const QString& v) { return v.startsWith("tun://"); };
         namedArgs["-proxy"] = [](const QString& v) { return v.startsWith("socks5://"); };
         break;
-    default:
-        //FIXME
+    case CertUtil:
         return args;
+    default:
+        return {};
     }
 
-
     QStringList sanitized;
 
     for (int i = 0, pos = 0; i < args.size(); i++) {

ipc/ipcserverprocess.cpp

@@ -77,6 +77,8 @@ void IpcServerProcess::setProcessChannelMode(QProcess::ProcessChannelMode mode)
 
 void IpcServerProcess::setProgram(int programId)
 {
+    Q_ASSERT(programId > static_cast<int>(amnezia::PermittedProcess::Invalid) &&
+             programId < static_cast<int>(amnezia::PermittedProcess::PermittedProcessCount));
     m_program = static_cast<amnezia::PermittedProcess>(programId);
     m_process->setProgram(amnezia::permittedProcessPath(m_program));
     m_process->setArguments({});

recipes/awg-android/conanfile.py

@@ -9,7 +9,7 @@ import platform
 
 class AwgAndroid(ConanFile):
     name = "awg-android"
-    version = "3.0.1"
+    version = "3.1.20260814"
     settings = "os", "arch", "build_type", "compiler"
 
     def configure(self):

recipes/awg-apple/conanfile.py

@@ -9,7 +9,7 @@ import os
 
 class AwgApple(ConanFile):
     name = "awg-apple"
-    version = "3.0.1"
+    version = "3.1.20260814"
     settings = "os", "arch", "compiler"
 
     @property
@@ -39,7 +39,7 @@ class AwgApple(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-apple/archive/refs/tags/v{self.version}.zip",
-            sha256="8efd086e3c51637270be105336692ca89b396b2ea9b71ea30ce28292c61c76e8", strip_root=True
+            sha256="d5de8aa0a12cd5935cc4f8b157027c85b0779b12279703e0ad3b6e5ac26d228b", strip_root=True
         )
 
     def generate(self):

recipes/awg-go/conanfile.py

@@ -14,7 +14,7 @@ import shlex
 
 class AwgGo(ConanFile):
     name = "awg-go"
-    version = "3.0.1"
+    version = "3.1.20260814"
     package_type = "application"
     settings = "os", "arch"
 
@@ -61,7 +61,7 @@ class AwgGo(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-go/archive/refs/tags/v{self.version}.zip",
-            sha256="3ab9655b894c6fe43dfcba6d1e3cbfff20ca1f1928eae6242875541e82488247", strip_root=True
+            sha256="a95853baa25d438a3e92ea5207bd315e3a45143b5209488ebf7f0b44e2e2bcc3", strip_root=True
         )
 
     def generate(self):

recipes/awg-windows/conanfile.py

@@ -8,7 +8,7 @@ import os
 
 class AwgWindows(ConanFile):
     name = "awg-windows"
-    version = "3.0.2"
+    version = "3.1.20260814"
     settings = "os", "arch"
 
     @property
@@ -63,7 +63,7 @@ class AwgWindows(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-windows/archive/refs/tags/v{self.version}.zip",
-            sha256="e5755ef1e19fd8408881cab49684d37ee4a0822d706960bbabe89770f7c436f1", strip_root=True)
+            sha256="d941861e3c0fada70b6b66b08aad4c77098d612aa11dd41b8ad70dd8afa6c61b", strip_root=True)
         
     def generate(self):
         tc = AutotoolsToolchain(self)

service/server/killswitch.cpp

@@ -3,6 +3,8 @@
 
 #include <QApplication>
 #include <QHostAddress>
+#include <QRegularExpression>
+#include <algorithm>
 
 #include "../client/core/utils/protocolEnum.h"
 #include "../client/core/protocols/protocolUtils.h"
@@ -11,6 +13,24 @@
 #include "qjsonarray.h"
 #include "version.h"
 
+static bool isValidIpOrCidr(const QString &value) {
+    static const QRegularExpression re(
+        QStringLiteral(R"(^(\d{1,3}\.){3}\d{1,3}(/\d{1,2})?$)"));
+    if (!re.match(value).hasMatch()) return false;
+    const QStringList ipParts = value.split(QLatin1Char('/'))[0].split(QLatin1Char('.'));
+    for (const QString &part : ipParts) {
+        bool ok;
+        int octet = part.toInt(&ok);
+        if (!ok || octet < 0 || octet > 255) return false;
+    }
+    if (value.contains(QLatin1Char('/'))) {
+        bool ok;
+        int prefix = value.split(QLatin1Char('/'))[1].toInt(&ok);
+        if (!ok || prefix < 0 || prefix > 32) return false;
+    }
+    return true;
+}
+
 #ifdef Q_OS_WIN
     #include "../client/platforms/windows/daemon/windowsfirewall.h"
     #include "../client/platforms/windows/daemon/windowsdaemon.h"
@@ -166,6 +186,10 @@ bool KillSwitch::disableAllTraffic() {
 
 bool KillSwitch::resetAllowedRange(const QStringList &ranges) {
 
+    if (!std::all_of(ranges.cbegin(), ranges.cend(), isValidIpOrCidr)) {
+        qCritical() << "IPC: invalid IP/CIDR in ranges, rejecting resetAllowedRange";
+        return false;
+    }
     m_allowedRanges = ranges;
 
 #ifdef Q_OS_LINUX
@@ -189,6 +213,10 @@ bool KillSwitch::resetAllowedRange(const QStringList &ranges) {
 }
 
 bool KillSwitch::addAllowedRange(const QStringList &ranges) {
+    if (!std::all_of(ranges.cbegin(), ranges.cend(), isValidIpOrCidr)) {
+        qCritical() << "IPC: invalid IP/CIDR in ranges, rejecting addAllowedRange";
+        return false;
+    }
     for (const QString &range : ranges) {
         if (!range.isEmpty() && !m_allowedRanges.contains(range)) {
             m_allowedRanges.append(range);
@@ -286,6 +314,27 @@ bool KillSwitch::enableKillSwitch(const QJsonObject &configStr, int vpnAdapterIn
     bool allowMarkedXray = 0;
     QStringList allownets;
     QStringList blocknets;
+    QStringList allowedDnsServers;
+
+    const QString dns1 = configStr.value(amnezia::configKey::dns1).toString();
+    // We don't use secondary DNS if primary DNS is AmneziaDNS
+    const QString dns2 = dns1.contains(amnezia::protocols::dns::amneziaDnsIp)
+            ? QString()
+            : configStr.value(amnezia::configKey::dns2).toString();
+
+    if ((!dns1.isEmpty() && !isValidIpOrCidr(dns1)) || (!dns2.isEmpty() && !isValidIpOrCidr(dns2))) {
+        qCritical() << "IPC: invalid dns1/dns2, rejecting enableKillSwitch";
+        return false;
+    }
+
+    for (const QJsonValue &dns : configStr.value(amnezia::configKey::allowedDnsServers).toArray()) {
+        if (!dns.isString()) break;
+        const QString dnsStr = dns.toString();
+        if (isValidIpOrCidr(dnsStr))
+            allowedDnsServers.append(dnsStr);
+        else if (!dnsStr.isEmpty())
+            qWarning() << "IPC: rejected invalid allowedDnsServer:" << dnsStr;
+    }
 
     if (splitTunnelType == 0) {
         blockAll = true;
@@ -306,6 +355,12 @@ bool KillSwitch::enableKillSwitch(const QJsonObject &configStr, int vpnAdapterIn
             allownets.append(v.toString());
         }
     }
+
+    if (!std::all_of(allownets.cbegin(), allownets.cend(), isValidIpOrCidr) ||
+        !std::all_of(blocknets.cbegin(), blocknets.cend(), isValidIpOrCidr)) {
+        qCritical() << "IPC: invalid IP/CIDR in allownets/blocknets, rejecting enableKillSwitch";
+        return false;
+    }
 #endif
 
 #ifdef Q_OS_LINUX
@@ -328,23 +383,15 @@ bool KillSwitch::enableKillSwitch(const QJsonObject &configStr, int vpnAdapterIn
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("310.blockDNS"), true);
     QStringList dnsServers;
 
-    dnsServers.append(configStr.value(amnezia::configKey::dns1).toString());
-
-    // We don't use secondary DNS if primary DNS is AmneziaDNS
-    if (!configStr.value(amnezia::configKey::dns1).toString().contains(amnezia::protocols::dns::amneziaDnsIp)) {
-        dnsServers.append(configStr.value(amnezia::configKey::dns2).toString());
-    }
+    if (!dns1.isEmpty())
+        dnsServers.append(dns1);
+    if (!dns2.isEmpty())
+        dnsServers.append(dns2);
 
     dnsServers.append("127.0.0.1");
     dnsServers.append("127.0.0.53");
-    
-    for (auto dns : configStr.value(amnezia::configKey::allowedDnsServers).toArray()) {
-        if (!dns.isString()) {
-            break;
-        }
-        dnsServers.append(dns.toString());
-    }
-    
+    dnsServers.append(allowedDnsServers);
+
     LinuxFirewall::updateDNSServers(dnsServers);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("320.allowDNS"), true);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("400.allowPIA"), true);
@@ -370,20 +417,13 @@ bool KillSwitch::enableKillSwitch(const QJsonObject &configStr, int vpnAdapterIn
     MacOSFirewall::setAnchorEnabled(QStringLiteral("300.allowLAN"), true);
 
     QStringList dnsServers;
-    dnsServers.append(configStr.value(amnezia::configKey::dns1).toString());
+    if (!dns1.isEmpty())
+        dnsServers.append(dns1);
+    if (!dns2.isEmpty())
+        dnsServers.append(dns2);
+
+    dnsServers.append(allowedDnsServers);
 
-    // We don't use secondary DNS if primary DNS is AmneziaDNS
-    if (!configStr.value(amnezia::configKey::dns1).toString().contains(amnezia::protocols::dns::amneziaDnsIp)) {
-        dnsServers.append(configStr.value(amnezia::configKey::dns2).toString());
-    }
-    
-    for (auto dns : configStr.value(amnezia::configKey::allowedDnsServers).toArray()) {
-        if (!dns.isString()) {
-            break;
-        }
-        dnsServers.append(dns.toString());
-    }
-    
     MacOSFirewall::setAnchorEnabled(QStringLiteral("310.blockDNS"), true);
     MacOSFirewall::setAnchorTable(QStringLiteral("310.blockDNS"), true, QStringLiteral("dnsaddr"), dnsServers);
     MacOSFirewall::setAnchorEnabled(QStringLiteral("400.allowPIA"), true);

service/server/router_linux.cpp

@@ -178,16 +178,11 @@ bool RouterLinux::flushDns()
     }
 
     p.waitForFinished();
-    QByteArray output = p.readAll();
-    if ((p.exitStatus() != QProcess::NormalExit) || (p.exitCode() != 0)) {
-        qDebug().noquote() << "Failed to flush DNS: " + output;
-        return false;
-    }
-
+    QByteArray output(p.readAll());
     if (output.isEmpty())
         qDebug().noquote() << "Flush dns completed";
     else
-        qDebug().noquote() << "OUTPUT systemctl restart: " + output;
+        qDebug().noquote() << "OUTPUT systemctl restart nscd/systemd-resolved: " + output;
 
     return true;
 }