fix: add core skippltgormController

client/cmake/3rdparty.cmake

@@ -2,7 +2,7 @@ set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)
 
 set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/Modules;${CMAKE_MODULE_PATH}")
 
-add_subdirectory(${CLIENT_ROOT_DIR}/3rd/SortFilterProxyModel)
+add_subdirectory(${CLIENT_ROOT_DIR}/3rd/SortFilterProxyModel ${CMAKE_BINARY_DIR}/3rd/SortFilterProxyModel)
 set(LIBS ${LIBS} SortFilterProxyModel)
 include(${CLIENT_ROOT_DIR}/cmake/QSimpleCrypto.cmake)
 
@@ -12,20 +12,20 @@ add_compile_definitions(_WINSOCKAPI_)
 
 set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 set(BUILD_WITH_QT6 ON)
-add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain EXCLUDE_FROM_ALL)
+add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain ${CMAKE_BINARY_DIR}/3rd/qtkeychain EXCLUDE_FROM_ALL)
 
 if(ANDROID)
     # Use qtgamepad from amnezia-vpn/qtgamepad repository
     # Only if Qt6CorePrivate is available (required by qtgamepad)
     find_package(Qt6CorePrivate CONFIG QUIET)
     if(Qt6CorePrivate_FOUND)
-        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad)
+        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad ${CMAKE_BINARY_DIR}/3rd/qtgamepad)
         # Link both the C++ module and QML plugin
         if(TARGET GamepadLegacy)
-            target_link_libraries(${PROJECT} PRIVATE GamepadLegacy)
+            list(APPEND LIBS GamepadLegacy)
         endif()
         if(TARGET GamepadLegacyQuickPrivate)
-            target_link_libraries(${PROJECT} PRIVATE GamepadLegacyQuickPrivate)
+            list(APPEND LIBS GamepadLegacyQuickPrivate)
         endif()
         message(STATUS "Gamepad support enabled for Android")
     else()

client/core/controllers/coreController.cpp

@@ -22,7 +22,8 @@
 #endif
 
 CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
-                               QQmlApplicationEngine *engine, QObject *parent)
+                               QQmlApplicationEngine *engine, QObject *parent,
+                               bool skipPlatformControllerInit)
     : QObject(parent), m_vpnConnection(vpnConnection), m_settings(settings), m_engine(engine)
 {
     initRepositories();
@@ -31,8 +32,10 @@ CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnectio
     initControllers();
     initSignalHandlers();
 
-    initAndroidController();
-    initAppleController();
+    if (!skipPlatformControllerInit) {
+        initAndroidController();
+        initAppleController();
+    }
     initLogging();
 
     m_translator = new QTranslator(this);

client/core/controllers/coreController.h

@@ -90,7 +90,8 @@ class CoreController : public QObject
 
 public:
     explicit CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
-                            QQmlApplicationEngine *engine, QObject *parent = nullptr);
+                            QQmlApplicationEngine *engine, QObject *parent = nullptr,
+                            bool skipPlatformControllerInit = false);
 
     PageController* pageController() const;
     void setQmlRoot();

client/core/utils/networkUtilities.cpp

@@ -286,7 +286,7 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
     return { resGateway, QNetworkInterface::interfaceFromIndex(resIndex) };
 #endif
 #ifdef Q_OS_LINUX
-    constexpr int BUFFER_SIZE = 8192;
+    constexpr int BUFFER_SIZE = 100;
     int     received_bytes = 0, msg_len = 0, route_attribute_len = 0;
     int     sock = -1, msgseq = 0;
     struct  nlmsghdr *nlh, *nlmsg;
@@ -294,7 +294,7 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
     // This struct contain route attributes (route type)
     struct  rtattr *route_attribute;
     char    gateway_address[INET_ADDRSTRLEN], interface[IF_NAMESIZE];
-    char    msgbuf[100], buffer[BUFFER_SIZE];
+    char    msgbuf[BUFFER_SIZE], buffer[BUFFER_SIZE];
     char    *ptr = buffer;
     struct timeval tv;
 
@@ -339,8 +339,8 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         nlh = (struct nlmsghdr *) ptr;
 
         /* Check if the header is valid */
-        if((NLMSG_OK(nlh, received_bytes) == 0) ||
-            (nlh->nlmsg_type == NLMSG_ERROR))
+        if((NLMSG_OK(nlmsg, received_bytes) == 0) ||
+            (nlmsg->nlmsg_type == NLMSG_ERROR))
         {
             perror("Error in received packet");
             return {};
@@ -355,15 +355,13 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         }
 
         /* Break if its not a multi part message */
-        if ((nlh->nlmsg_flags & NLM_F_MULTI) == 0)
+        if ((nlmsg->nlmsg_flags & NLM_F_MULTI) == 0)
             break;
     }
-    while ((nlh->nlmsg_seq != msgseq) || (nlh->nlmsg_pid != getpid()));
+    while ((nlmsg->nlmsg_seq != msgseq) || (nlmsg->nlmsg_pid != getpid()));
 
     /* parse response */
-    int remaining = msg_len + received_bytes;
-    nlh = (struct nlmsghdr *) buffer;
-    for ( ; NLMSG_OK(nlh, remaining); nlh = NLMSG_NEXT(nlh, remaining))
+    for ( ; NLMSG_OK(nlh, received_bytes); nlh = NLMSG_NEXT(nlh, received_bytes))
     {
         /* Get the route data */
         route_entry = (struct rtmsg *) NLMSG_DATA(nlh);
@@ -372,10 +370,6 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         if (route_entry->rtm_table != RT_TABLE_MAIN)
             continue;
 
-        /* Reset per-route to avoid cross-route state pollution */
-        memset(gateway_address, 0, sizeof(gateway_address));
-        memset(interface, 0, sizeof(interface));
-
         route_attribute = (struct rtattr *) RTM_RTA(route_entry);
         route_attribute_len = RTM_PAYLOAD(nlh);
 
@@ -401,8 +395,6 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
             break;
         }
     }
-    if (!(*gateway_address) || !(*interface))
-        qDebug() << "getGatewayAndIface: no gateway found";
     close(sock);
     return { gateway_address, QNetworkInterface::interfaceFromName(interface) };
 #endif

client/daemon/daemon.cpp

@@ -78,6 +78,14 @@ bool Daemon::activate(const InterfaceConfig& config) {
         return false;
       }
 
+      if (!dnsutils()->restoreResolvers()) {
+        return false;
+      }
+
+      if (!maybeUpdateResolvers(config)) {
+        return false;
+      }
+
       bool status = run(Switch, config);
       logger.debug() << "Connection status:" << status;
       if (status) {
@@ -134,6 +142,10 @@ bool Daemon::activate(const InterfaceConfig& config) {
     return false;
   }
 
+  if (!maybeUpdateResolvers(config)) {
+    return false;
+  }
+
   // set routing
   for (const IPAddress& ip : config.m_allowedIPAddressRanges) {
     if (!wgutils()->updateRoutePrefix(ip)) {
@@ -142,12 +154,6 @@ bool Daemon::activate(const InterfaceConfig& config) {
     }
   }
 
-#ifndef Q_OS_LINUX
-  if (!maybeUpdateResolvers(config)) {
-    return false;
-  }
-#endif
-
   bool status = run(Up, config);
   logger.debug() << "Connection status:" << status;
   if (status) {
@@ -162,20 +168,15 @@ bool Daemon::activate(const InterfaceConfig& config) {
 bool Daemon::maybeUpdateResolvers(const InterfaceConfig& config) {
   if ((config.m_hopType == InterfaceConfig::MultiHopExit) ||
       (config.m_hopType == InterfaceConfig::SingleHop)) {
-    if (!dnsutils()) {
-      logger.error() << "dnsutils is null, cannot update resolvers";
-      return false;
-    }
-
     QList<QHostAddress> resolvers;
     resolvers.append(QHostAddress(config.m_primaryDnsServer));
     if (!config.m_secondaryDnsServer.isEmpty()) {
         resolvers.append(QHostAddress(config.m_secondaryDnsServer));
     }
 
-    // If the DNS is the Gateway, also add IPv6 gateway (only if non-empty)
-    if (config.m_primaryDnsServer == config.m_serverIpv4Gateway &&
-        !config.m_serverIpv6Gateway.isEmpty()) {
+    // If the DNS is not the Gateway, it's a user defined DNS
+    // thus, not add any other :)
+    if (config.m_primaryDnsServer == config.m_serverIpv4Gateway) {
       resolvers.append(QHostAddress(config.m_serverIpv6Gateway));
     }
 
@@ -612,7 +613,7 @@ void Daemon::checkHandshake() {
       pendingHandshakes++;
     }
   }
-  
+
   // Check again if there were connections that haven't completed a handshake.
   if (pendingHandshakes > 0) {
     m_handshakeTimer.start(HANDSHAKE_POLL_MSEC);

client/platforms/linux/daemon/dnsutilslinux.cpp

@@ -7,11 +7,8 @@
 #include <net/if.h>
 
 #include <QDBusVariant>
-#include <QNetworkInterface>
-#include <QTimer>
 #include <QtDBus/QtDBus>
 
-#include "core/utils/networkUtilities.h"
 #include "leakdetector.h"
 #include "logger.h"
 
@@ -30,78 +27,24 @@ DnsUtilsLinux::DnsUtilsLinux(QObject* parent) : DnsUtils(parent) {
   logger.debug() << "DnsUtilsLinux created.";
 
   QDBusConnection conn = QDBusConnection::systemBus();
-  auto* watcher = new QDBusServiceWatcher(
-      DBUS_RESOLVE_SERVICE, conn,
-      QDBusServiceWatcher::WatchForRegistration |
-      QDBusServiceWatcher::WatchForUnregistration, this);
-
-  connect(watcher, &QDBusServiceWatcher::serviceRegistered,
-          this, &DnsUtilsLinux::onResolverRegistered);
-  connect(watcher, &QDBusServiceWatcher::serviceUnregistered,
-          this, &DnsUtilsLinux::onResolverUnregistered);
-
-  if (conn.interface()->isServiceRegistered(DBUS_RESOLVE_SERVICE)) {
-    onResolverRegistered();
-  }
-}
-
-void DnsUtilsLinux::onResolverRegistered() {
-  m_resolver.reset(new QDBusInterface(DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH,
-                                      DBUS_RESOLVE_MANAGER,
-                                      QDBusConnection::systemBus()));
-  logger.debug() << "systemd-resolved available, DNS resolver initialized";
-
-  if (m_revertAfterRegister > 0) {
-    logger.debug() << "Calling RevertLink after restart for ifindex" << m_revertAfterRegister;
-    QDBusMessage msg = QDBusMessage::createMethodCall(
-        DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "RevertLink");
-    msg.setArguments({QVariant::fromValue(m_revertAfterRegister)});
-    QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
-    int savedIdx = m_revertAfterRegister;
-    m_revertAfterRegister = 0;
-    QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
-    QObject::connect(watcher, &QDBusPendingCallWatcher::finished, this,
-                     [this, savedIdx](QDBusPendingCallWatcher* w) {
-                       QDBusPendingReply<> r = *w;
-                       if (r.isError()) {
-                         logger.debug() << "RevertLink after restart failed for ifindex" << savedIdx
-                                        << ":" << r.error().message();
-                       } else {
-                         logger.debug() << "RevertLink after restart succeeded for ifindex" << savedIdx;
-                       }
-                       w->deleteLater();
-                     });
-  }
-
-  if (!m_pendingIfname.isEmpty()) {
-    logger.debug() << "Re-applying DNS configuration for" << m_pendingIfname;
-    updateResolvers(m_pendingIfname, m_pendingResolvers);
-  }
-}
-
-void DnsUtilsLinux::onResolverUnregistered() {
-  logger.debug() << "systemd-resolved disappeared, dropping DNS resolver";
-  m_resolver.reset();
+  m_resolver = new QDBusInterface(DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH,
+                                  DBUS_RESOLVE_MANAGER, conn, this);
 }
 
 DnsUtilsLinux::~DnsUtilsLinux() {
   MZ_COUNT_DTOR(DnsUtilsLinux);
 
-  if (m_revertOnDestroy && m_resolver) {
-    if (m_gatewayIfindex > 0)
-      setLinkDefaultRoute(m_gatewayIfindex, true);
+  for (auto iterator = m_linkDomains.constBegin();
+       iterator != m_linkDomains.constEnd(); ++iterator) {
+    QList<QVariant> argumentList;
+    argumentList << QVariant::fromValue(iterator.key());
+    argumentList << QVariant::fromValue(iterator.value());
+    m_resolver->asyncCallWithArgumentList(QStringLiteral("SetLinkDomains"),
+                                          argumentList);
+  }
 
-    for (auto iterator = m_linkDomains.constBegin();
-         iterator != m_linkDomains.constEnd(); ++iterator) {
-      QList<QVariant> argumentList;
-      argumentList << QVariant::fromValue(iterator.key());
-      argumentList << QVariant::fromValue(iterator.value());
-      m_resolver->asyncCallWithArgumentList(QStringLiteral("SetLinkDomains"),
-                                            argumentList);
-    }
-    if (m_ifindex > 0) {
-      m_resolver->asyncCall(QStringLiteral("RevertLink"), m_ifindex);
-    }
+  if (m_ifindex > 0) {
+    m_resolver->asyncCall(QStringLiteral("RevertLink"), m_ifindex);
   }
 
   logger.debug() << "DnsUtilsLinux destroyed.";
@@ -109,37 +52,12 @@ DnsUtilsLinux::~DnsUtilsLinux() {
 
 bool DnsUtilsLinux::updateResolvers(const QString& ifname,
                                     const QList<QHostAddress>& resolvers) {
-  m_revertAfterRegister = 0;
-
-  if (m_gatewayIfindex > 0) {
-    setLinkDefaultRoute(m_gatewayIfindex, true);
-    m_gatewayIfindex = 0;
-  }
-
   m_ifindex = if_nametoindex(qPrintable(ifname));
   if (m_ifindex <= 0) {
     logger.error() << "Unable to resolve ifindex for" << ifname;
     return false;
   }
 
-  // Reset retry counter only when called externally (not from scheduleRetry)
-  if (ifname != m_pendingIfname || resolvers != m_pendingResolvers)
-    m_domainRetries = 0;
-
-  m_pendingIfname = ifname;
-  m_pendingResolvers = resolvers;
-
-  if (!m_resolver) {
-    logger.debug() << "systemd-resolved not ready, queuing DNS configuration";
-    return true;
-  }
-
-  const int gwIdx = NetworkUtilities::getGatewayAndIface().second.index();
-  if (gwIdx > 0 && gwIdx != m_ifindex && gwIdx != m_gatewayIfindex) {
-    m_gatewayIfindex = gwIdx;
-    setLinkDefaultRoute(gwIdx, false);
-  }
-
   setLinkDNS(m_ifindex, resolvers);
   setLinkDefaultRoute(m_ifindex, true);
   updateLinkDomains();
@@ -147,54 +65,38 @@ bool DnsUtilsLinux::updateResolvers(const QString& ifname,
 }
 
 bool DnsUtilsLinux::restoreResolvers() {
-  m_revertOnDestroy = true;
-  m_pendingIfname.clear();
-  m_pendingResolvers.clear();
-
-  if (m_gatewayIfindex > 0) {
-    setLinkDefaultRoute(m_gatewayIfindex, true);
-    m_gatewayIfindex = 0;
-  }
-
   for (auto iterator = m_linkDomains.constBegin();
        iterator != m_linkDomains.constEnd(); ++iterator) {
     setLinkDomains(iterator.key(), iterator.value());
   }
   m_linkDomains.clear();
 
+  /* Revert the VPN interface's DNS configuration */
   if (m_ifindex > 0) {
-    m_revertAfterRegister = m_ifindex;
+    QList<QVariant> argumentList = {QVariant::fromValue(m_ifindex)};
+    QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
+        QStringLiteral("RevertLink"), argumentList);
+
+    QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
+    QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
+                     SLOT(dnsCallCompleted(QDBusPendingCallWatcher*)));
+
     m_ifindex = 0;
   }
 
   return true;
 }
 
-void DnsUtilsLinux::scheduleRetry() {
-  if (m_pendingIfname.isEmpty() || m_retryPending || m_domainRetries >= 5)
-    return;
-  m_retryPending = true;
-  ++m_domainRetries;
-  logger.debug() << "Retrying full DNS setup (" << m_domainRetries << "/5)";
-  QTimer::singleShot(1000, this, [this]() {
-    m_retryPending = false;
-    if (!m_pendingIfname.isEmpty())
-      updateResolvers(m_pendingIfname, m_pendingResolvers);
-  });
-}
-
 void DnsUtilsLinux::dnsCallCompleted(QDBusPendingCallWatcher* call) {
   QDBusPendingReply<> reply = *call;
   if (reply.isError()) {
-    logger.debug() << "DBus call failed (may be transient after systemd-resolved restart)";
-    scheduleRetry();
+    logger.error() << "Error received from the DBus service";
   }
   delete call;
 }
 
 void DnsUtilsLinux::setLinkDNS(int ifindex,
                                const QList<QHostAddress>& resolvers) {
-  if (!m_resolver) return;
   QList<DnsResolver> resolverList;
   char ifnamebuf[IF_NAMESIZE];
   const char* ifname = if_indextoname(ifindex, ifnamebuf);
@@ -209,10 +111,8 @@ void DnsUtilsLinux::setLinkDNS(int ifindex,
   QList<QVariant> argumentList;
   argumentList << QVariant::fromValue(ifindex);
   argumentList << QVariant::fromValue(resolverList);
-  QDBusMessage msg = QDBusMessage::createMethodCall(
-      DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "SetLinkDNS");
-  msg.setArguments(argumentList);
-  QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
+  QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
+      QStringLiteral("SetLinkDNS"), argumentList);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -221,7 +121,6 @@ void DnsUtilsLinux::setLinkDNS(int ifindex,
 
 void DnsUtilsLinux::setLinkDomains(int ifindex,
                                    const QList<DnsLinkDomain>& domains) {
-  if (!m_resolver) return;
   char ifnamebuf[IF_NAMESIZE];
   const char* ifname = if_indextoname(ifindex, ifnamebuf);
   if (ifname) {
@@ -236,10 +135,8 @@ void DnsUtilsLinux::setLinkDomains(int ifindex,
   QList<QVariant> argumentList;
   argumentList << QVariant::fromValue(ifindex);
   argumentList << QVariant::fromValue(domains);
-  QDBusMessage msg = QDBusMessage::createMethodCall(
-      DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "SetLinkDomains");
-  msg.setArguments(argumentList);
-  QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
+  QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
+      QStringLiteral("SetLinkDomains"), argumentList);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -247,14 +144,11 @@ void DnsUtilsLinux::setLinkDomains(int ifindex,
 }
 
 void DnsUtilsLinux::setLinkDefaultRoute(int ifindex, bool enable) {
-  if (!m_resolver) return;
   QList<QVariant> argumentList;
   argumentList << QVariant::fromValue(ifindex);
   argumentList << QVariant::fromValue(enable);
-  QDBusMessage msg = QDBusMessage::createMethodCall(
-      DBUS_RESOLVE_SERVICE, DBUS_RESOLVE_PATH, DBUS_RESOLVE_MANAGER, "SetLinkDefaultRoute");
-  msg.setArguments(argumentList);
-  QDBusPendingReply<> reply = QDBusConnection::systemBus().asyncCall(msg, 5000);
+  QDBusPendingReply<> reply = m_resolver->asyncCallWithArgumentList(
+      QStringLiteral("SetLinkDefaultRoute"), argumentList);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -262,7 +156,6 @@ void DnsUtilsLinux::setLinkDefaultRoute(int ifindex, bool enable) {
 }
 
 void DnsUtilsLinux::updateLinkDomains() {
-  if (!m_resolver) return;
   /* Get the list of search domains, and remove any others that might conspire
    * to satisfy DNS resolution. Unfortunately, this is a pain because Qt doesn't
    * seem to be able to demarshall complex property types.
@@ -272,7 +165,7 @@ void DnsUtilsLinux::updateLinkDomains() {
   message << QString(DBUS_RESOLVE_MANAGER);
   message << QString("Domains");
   QDBusPendingReply<QVariant> reply =
-      m_resolver->connection().asyncCall(message, 5000);
+      m_resolver->connection().asyncCall(message);
 
   QDBusPendingCallWatcher* watcher = new QDBusPendingCallWatcher(reply, this);
   QObject::connect(watcher, SIGNAL(finished(QDBusPendingCallWatcher*)), this,
@@ -281,13 +174,11 @@ void DnsUtilsLinux::updateLinkDomains() {
 
 void DnsUtilsLinux::dnsDomainsReceived(QDBusPendingCallWatcher* call) {
   QDBusPendingReply<QVariant> reply = *call;
-  call->deleteLater();
   if (reply.isError()) {
-    logger.debug() << "DBus Domains call failed (may be transient after systemd-resolved restart)";
-    scheduleRetry();
+    logger.error() << "Error retrieving the DNS  domains from the DBus service";
+    delete call;
     return;
   }
-  m_domainRetries = 0;
 
   /* Update the state of the DNS domains */
   m_linkDomains.clear();
@@ -313,17 +204,9 @@ void DnsUtilsLinux::dnsDomainsReceived(QDBusPendingCallWatcher* call) {
   }
 
   /* Add a root search domain for the new interface. */
-  if (m_ifindex > 0) {
-    setLinkDomains(m_ifindex, {root});
-
-    /* Disable DefaultRoute on the physical gateway so systemd-resolved
-     * routes all DNS through the VPN interface. */
-    const int gwIdx = NetworkUtilities::getGatewayAndIface().second.index();
-    if (gwIdx > 0 && gwIdx != m_ifindex && gwIdx != m_gatewayIfindex) {
-      m_gatewayIfindex = gwIdx;
-      setLinkDefaultRoute(gwIdx, false);
-    }
-  }
+  QList<DnsLinkDomain> newlist = {root};
+  setLinkDomains(m_ifindex, newlist);
+  delete call;
 }
 
 static DnsMetatypeRegistrationProxy s_dnsMetatypeProxy;

client/platforms/linux/daemon/dnsutilslinux.h

@@ -6,12 +6,7 @@
 #define DNSUTILSLINUX_H
 
 #include <QDBusInterface>
-#include <QScopedPointer>
 #include <QDBusPendingCallWatcher>
-#include <QDBusServiceWatcher>
-#include <QHostAddress>
-#include <QList>
-#include <QString>
 
 #include "daemon/dnsutils.h"
 #include "dbustypeslinux.h"
@@ -34,25 +29,13 @@ class DnsUtilsLinux final : public DnsUtils {
   void updateLinkDomains();
 
  private slots:
-  void onResolverRegistered();
-  void onResolverUnregistered();
   void dnsCallCompleted(QDBusPendingCallWatcher*);
   void dnsDomainsReceived(QDBusPendingCallWatcher*);
 
- private:
-  void scheduleRetry();
-
  private:
   int m_ifindex = 0;
-  int m_gatewayIfindex = 0;
-  int m_domainRetries = 0;
-  bool m_revertOnDestroy = false;
-  bool m_retryPending = false;
-  int m_revertAfterRegister = 0;
   QMap<int, DnsLinkDomainList> m_linkDomains;
-  QScopedPointer<QDBusInterface> m_resolver;
-  QString m_pendingIfname;
-  QList<QHostAddress> m_pendingResolvers;
+  QDBusInterface* m_resolver = nullptr;
 };
 
 #endif  // DNSUTILSLINUX_H

client/platforms/linux/daemon/linuxfirewall.cpp

@@ -33,7 +33,6 @@
 #include "linuxfirewall.h"
 #include "logger.h"
 #include "xray_defs.h"
-#include <QFileInfo>
 #include <QProcess>
 
 #define BRAND_CODE "amn"
@@ -103,7 +102,14 @@ int LinuxFirewall::linkChain(LinuxFirewall::IPVersion ip, const QString& chain,
     const QString cmd = getCommand(ip);
     if (mustBeFirst)
     {
-        return execute(QStringLiteral("if ! %1 -L %2 -n --line-numbers -t %4 2> /dev/null | awk 'int($1) == 1 && $2 == \"%3\" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then %1 -I %2 -j %3 -t %4 && %1 -L %2 -n --line-numbers -t %4 2> /dev/null | awk 'int($1) > 1 && $2 == \"%3\" { print $1; exit }' | xargs -r %1 -t %4 -D %2 ; fi").arg(cmd, parent, chain, tableName));
+        // This monster shell script does the following:
+        // 1. Check if a rule with the appropriate target exists at the top of the parent chain
+        // 2. If not, insert a jump rule at the top of the parent chain
+        // 3. Look for and delete a single rule with the designated target at an index > 1
+        //    (we can't safely delete all rules at once since rule numbers change)
+        // TODO: occasionally this script results in warnings in logs "Bad rule (does a matching rule exist in the chain?)" - this happens when
+        // the e.g OUTPUT chain is empty but this script attempts to delete things from it anyway. It doesn't cause any problems, but we should still fix at some point..
+        return execute(QStringLiteral("if ! %1 -L %2 -n --line-numbers -t %4 2> /dev/null | awk 'int($1) == 1 && $2 == \"%3\" { found=1 } END { if(found==1) { exit 0 } else { exit 1 } }' ; then %1 -I %2 -j %3 -t %4 && %1 -L %2 -n --line-numbers -t %4 2> /dev/null | awk 'int($1) > 1 && $2 == \"%3\" { print $1; exit }' | xargs %1 -t %4 -D %2 ; fi").arg(cmd, parent, chain, tableName));
     }
     else
         return execute(QStringLiteral("if ! %1 -C %2 -j %3 -t %4 2> /dev/null ; then %1 -A %2 -j %3 -t %4; fi").arg(cmd, parent, chain, tableName));
@@ -285,8 +291,6 @@ void LinuxFirewall::install()
 
     installAnchor(IPv4, QStringLiteral("110.allowNets"), {});
 
-    installAnchor(Both, QStringLiteral("400.allowPIA"), {});
-
     installAnchor(Both, QStringLiteral("100.blockAll"), {
                                                             QStringLiteral("-j REJECT"),
                                                         });
@@ -450,33 +454,16 @@ void LinuxFirewall::updateDNSServers(const QStringList& servers)
     static QStringList existingServers {};
 
     existingServers = servers;
-    const QString chain = QStringLiteral("%1.320.allowDNS").arg(kAnchorName);
-    executeIptables(QStringLiteral("iptables"), {QStringLiteral("-F"), chain});
-    const QStringList ifaces = {
-        QStringLiteral("amn0+"), QStringLiteral("tun0+"), QStringLiteral("tun2+")
-    };
-    for (const QString& server : servers) {
-        for (const QString& iface : ifaces) {
-            executeIptables(QStringLiteral("iptables"),
-                {QStringLiteral("-A"), chain, QStringLiteral("-o"), iface,
-                 QStringLiteral("-d"), server, QStringLiteral("-p"), QStringLiteral("udp"),
-                 QStringLiteral("--dport"), QStringLiteral("53"), QStringLiteral("-j"), QStringLiteral("ACCEPT")});
-            executeIptables(QStringLiteral("iptables"),
-                {QStringLiteral("-A"), chain, QStringLiteral("-o"), iface,
-                 QStringLiteral("-d"), server, QStringLiteral("-p"), QStringLiteral("tcp"),
-                 QStringLiteral("--dport"), QStringLiteral("53"), QStringLiteral("-j"), QStringLiteral("ACCEPT")});
-        }
-    }
+    execute(QStringLiteral("iptables -F %1.320.allowDNS").arg(kAnchorName));
+    for (const QString& rule : getDNSRules(servers))
+        execute(QStringLiteral("iptables -A %1.320.allowDNS %2").arg(kAnchorName, rule));
 }
 
 void LinuxFirewall::updateAllowNets(const QStringList& servers)
 {
-    const QString chain = QStringLiteral("%1.110.allowNets").arg(kAnchorName);
-    executeIptables(QStringLiteral("iptables"), {QStringLiteral("-F"), chain});
-    for (const QString& server : servers)
-        executeIptables(QStringLiteral("iptables"),
-            {QStringLiteral("-A"), chain, QStringLiteral("-d"), server,
-             QStringLiteral("-j"), QStringLiteral("ACCEPT")});
+    execute(QStringLiteral("iptables -F %1.110.allowNets").arg(kAnchorName));
+    for (const QString& rule : getAllowRule(servers))
+        execute(QStringLiteral("iptables -A %1.110.allowNets %2").arg(kAnchorName, rule));
 }
 
 void LinuxFirewall::updateBlockNets(const QStringList& servers)
@@ -484,12 +471,9 @@ void LinuxFirewall::updateBlockNets(const QStringList& servers)
     static QStringList existingServers {};
 
     existingServers = servers;
-    const QString chain = QStringLiteral("%1.120.blockNets").arg(kAnchorName);
-    executeIptables(QStringLiteral("iptables"), {QStringLiteral("-F"), chain});
-    for (const QString& server : servers)
-        executeIptables(QStringLiteral("iptables"),
-            {QStringLiteral("-A"), chain, QStringLiteral("-d"), server,
-             QStringLiteral("-j"), QStringLiteral("REJECT")});
+    execute(QStringLiteral("iptables -F %1.120.blockNets").arg(kAnchorName));
+    for (const QString& rule : getBlockRule(servers))
+        execute(QStringLiteral("iptables -A %1.120.blockNets %2").arg(kAnchorName, rule));
 }
 
 int waitForExitCode(QProcess& process)
@@ -522,39 +506,10 @@ int LinuxFirewall::execute(const QString &command, bool ignoreErrors)
     return exitCode;
 }
 
-int LinuxFirewall::executeIptables(const QString &program, const QStringList &args, bool ignoreErrors)
-{
-    QProcess p;
-    p.start(program, args, QProcess::ReadOnly);
-    p.closeWriteChannel();
-
-    int exitCode = waitForExitCode(p);
-    auto out = p.readAllStandardOutput().trimmed();
-    auto err = p.readAllStandardError().trimmed();
-    if ((exitCode != 0 || !err.isEmpty()) && !ignoreErrors)
-        logger.warning() << "(" << exitCode << ") $ " << program << args.join(QLatin1Char(' '));
-    if (!out.isEmpty())
-        logger.info() << out;
-    if (!err.isEmpty())
-        logger.warning() << err;
-    return exitCode;
-}
-
 void LinuxFirewall::setupTrafficSplitting()
 {
-    const QString cgroupBase = QStringLiteral("/sys/fs/cgroup/net_cls");
-    if (!QFileInfo::exists(cgroupBase)) {
-        logger.warning() << "net_cls cgroup v1 not available, traffic splitting disabled";
-        return;
-    }
-
-    execute(QStringLiteral(
-        "if ! grep -qE '^[0-9]+[[:space:]]+%1$' /etc/iproute2/rt_tables 2>/dev/null ; then "
-        "echo '200 %1' >> /etc/iproute2/rt_tables ; fi"
-    ).arg(kRtableName));
-
     auto cGroupDir = "/sys/fs/cgroup/net_cls/" BRAND_CODE "vpnexclusions/";
-    logger.info() << "Setting up cgroup in" << cGroupDir << "for traffic splitting";
+    logger.info() << "Should be setting up cgroup in" << cGroupDir << "for traffic splitting";
     execute(QStringLiteral("if [ ! -d %1 ] ; then mkdir %1 ; sleep 0.1 ; echo %2 > %1/net_cls.classid ; fi").arg(cGroupDir).arg(kCGroupId));
     // Set a rule with priority 100 (lower priority than local but higher than main/default, 0 is highest priority)
     execute(QStringLiteral("if ! ip rule list | grep -q %1 ; then ip rule add from all fwmark %1 lookup %2 pri 100 ; fi").arg(kPacketTag, kRtableName));
@@ -563,7 +518,7 @@ void LinuxFirewall::setupTrafficSplitting()
 void LinuxFirewall::teardownTrafficSplitting()
 {
     logger.info() << "Tearing down cgroup and routing rules";
-    execute(QStringLiteral("if ip rule list | grep -q %1; then ip rule del from all fwmark %1 lookup %2 2>/dev/null ; fi").arg(kPacketTag, kRtableName));
-    execute(QStringLiteral("ip route flush table %1 2>/dev/null || true").arg(kRtableName));
+    execute(QStringLiteral("if ip rule list | grep -q %1; then ip rule del from all fwmark %1 lookup %2 2> /dev/null ; fi").arg(kPacketTag, kRtableName));
+    execute(QStringLiteral("ip route flush table %1").arg(kRtableName));
     execute(QStringLiteral("ip route flush cache"));
 }

client/platforms/linux/daemon/linuxfirewall.h

@@ -85,7 +85,6 @@ private:
     static void setupTrafficSplitting();
     static void teardownTrafficSplitting();
     static int execute(const QString& command, bool ignoreErrors = false);
-    static int executeIptables(const QString& program, const QStringList& args, bool ignoreErrors = false);
 private:
     // Chain names
     static QString kOutputChain, kRootChain, kPostRoutingChain, kPreRoutingChain;

client/platforms/linux/daemon/wireguardutilslinux.cpp

@@ -237,11 +237,7 @@ bool WireguardUtilsLinux::updatePeer(const InterfaceConfig& config) {
     // Exclude the server address, except for multihop exit servers.
     if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
         (m_rtmonitor != nullptr)) {
-        if (!config.m_serverIpv4AddrIn.isEmpty() &&
-            !m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn))) {
-            logger.error() << "No gateway — cannot add server exclusion route";
-            return false;
-        }
+        m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
         m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
     }
 

client/vpnConnection.cpp

@@ -17,7 +17,6 @@
 #ifdef AMNEZIA_DESKTOP
     #include "core/utils/ipcClient.h"
     #include <core/protocols/wireGuardProtocol.h>
-    #include "daemon/wireguardutils.h"
 #endif
 
 #ifdef Q_OS_ANDROID
@@ -128,23 +127,6 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
                 else
                     qWarning() << "VpnConnection::onConnectionStateChanged: Failed to flush DNS";
 
-#ifdef Q_OS_LINUX
-                if (ContainerUtils::isAwgContainer(container) || container == DockerContainer::WireGuard) {
-                    QString dns1 = m_vpnConfiguration.value(configKey::dns1).toString();
-                    QString dns2 = m_vpnConfiguration.value(configKey::dns2).toString();
-                    QList<QHostAddress> resolvers;
-                    if (!dns1.isEmpty()) resolvers << QHostAddress(dns1);
-                    if (!dns2.isEmpty()) resolvers << QHostAddress(dns2);
-                    if (!resolvers.isEmpty()) {
-                        auto r = iface->updateResolvers(WG_INTERFACE, resolvers);
-                        if (r.waitForFinished() && r.returnValue())
-                            qDebug() << "VpnConnection: DNS resolvers set via systemd-resolved";
-                        else
-                            qWarning() << "VpnConnection: Failed to set DNS resolvers";
-                    }
-                }
-#endif
-
                 if (!ContainerUtils::isAwgContainer(container) && container != DockerContainer::WireGuard) {
                     QString dns1 = m_vpnConfiguration.value(configKey::dns1).toString();
                     QString dns2 = m_vpnConfiguration.value(configKey::dns2).toString();
@@ -178,11 +160,6 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
             } break;
             case Vpn::ConnectionState::Disconnected:
             case Vpn::ConnectionState::Error: {
-#ifdef Q_OS_LINUX
-                if (ContainerUtils::isAwgContainer(container) || container == DockerContainer::WireGuard) {
-                    iface->restoreResolvers();
-                }
-#endif
                 auto flushDns = iface->flushDns();
                 if (flushDns.waitForFinished() && flushDns.returnValue())
                     qDebug() << "VpnConnection::onConnectionStateChanged: Successfully flushed DNS";

ipc/ipc.h

@@ -3,8 +3,6 @@
 
 #include <QObject>
 #include <QString>
-#include <QRegularExpression>
-#include <QSet>
 
 #include "../client/core/utils/utilities.h"
 
@@ -17,8 +15,7 @@ enum PermittedProcess {
     OpenVPN,
     Wireguard,
     Tun2Socks,
-    CertUtil,
-    _Count
+    CertUtil
 };
 
 inline QString permittedProcessPath(PermittedProcess pid)
@@ -60,56 +57,16 @@ inline QStringList sanitizeArguments(PermittedProcess proc, const QStringList &a
     QList<Validator> positionalArgs;
 
     switch (proc) {
-    case OpenVPN: {
-        static const QSet<QString> blocked = {
-            QStringLiteral("--script-security"),
-            QStringLiteral("--up"),
-            QStringLiteral("--down"),
-            QStringLiteral("--route-up"),
-            QStringLiteral("--ipchange"),
-            QStringLiteral("--tls-verify"),
-            QStringLiteral("--plugin"),
-            QStringLiteral("--auth-user-pass-verify"),
-            QStringLiteral("--learn-address"),
-            QStringLiteral("--client-connect"),
-            QStringLiteral("--client-disconnect"),
-            QStringLiteral("--management"),
-            QStringLiteral("--management-external-key")
-        };
-        QStringList out;
-        for (int i = 0; i < args.size(); ++i) {
-            if (blocked.contains(args[i])) {
-                qWarning() << "IPC: blocked OpenVPN argument:" << args[i];
-                ++i; // skip following value
-                continue;
-            }
-            out << args[i];
-        }
-        return out;
-    }
-    case Wireguard: {
-        static const QRegularExpression hookRe(
-            QStringLiteral(R"((?i)(PostUp|PreUp|PostDown|PreDown)\s*=)"));
-        QStringList out;
-        for (const QString& a : args) {
-            if (hookRe.match(a).hasMatch()) {
-                qWarning() << "IPC: blocked WireGuard hook argument:" << a;
-                continue;
-            }
-            out << a;
-        }
-        return out;
-    }
     case Tun2Socks:
         namedArgs["-device"] = [](const QString& v) { return v.startsWith("tun://"); };
         namedArgs["-proxy"] = [](const QString& v) { return v.startsWith("socks5://"); };
         break;
-    case CertUtil:
-        return args;
     default:
-        return {};
+        //FIXME
+        return args;
     }
 
+
     QStringList sanitized;
 
     for (int i = 0, pos = 0; i < args.size(); i++) {

ipc/ipcserver.cpp

@@ -22,27 +22,6 @@
     #include "tapcontroller_win.h"
 #endif
 
-#ifdef Q_OS_LINUX
-#include <sys/socket.h>
-#include <sys/types.h>
-
-extern uid_t g_allowedUid;
-extern bool g_allowedUidSet;
-
-static bool checkPrivPeerCredentials(QLocalSocket *socket) {
-    struct ucred cred{};
-    socklen_t len = sizeof(cred);
-    if (getsockopt(socket->socketDescriptor(), SOL_SOCKET, SO_PEERCRED, &cred, &len) != 0) {
-        qWarning() << "IpcServer: SO_PEERCRED failed, rejecting privileged process connection";
-        return false;
-    }
-    if (cred.uid == 0) return true;
-    if (g_allowedUidSet && cred.uid == g_allowedUid) return true;
-    qWarning() << "IpcServer: rejected privileged process connection from unauthorized UID" << cred.uid;
-    return false;
-}
-#endif
-
 
 IpcServer::IpcServer(QObject *parent) : IpcInterfaceSource(parent)
 {
@@ -69,16 +48,8 @@ int IpcServer::createPrivilegedProcess()
     // Make sure any connections are handed to QtRO
     QObject::connect(pd.localServer.data(), &QLocalServer::newConnection, this, [pd]() {
         qDebug() << "IpcServer new connection";
-        QLocalSocket *conn = pd.localServer->nextPendingConnection();
-#ifdef Q_OS_LINUX
-        if (!checkPrivPeerCredentials(conn)) {
-            conn->close();
-            conn->deleteLater();
-            return;
-        }
-#endif
         if (pd.serverNode) {
-            pd.serverNode->addHostSideConnection(conn);
+            pd.serverNode->addHostSideConnection(pd.localServer->nextPendingConnection());
             pd.serverNode->enableRemoting(pd.ipcProcess.data());
         }
     });

ipc/ipcserverprocess.cpp

@@ -77,11 +77,6 @@ void IpcServerProcess::setProcessChannelMode(QProcess::ProcessChannelMode mode)
 
 void IpcServerProcess::setProgram(int programId)
 {
-    if (programId <= static_cast<int>(amnezia::PermittedProcess::Invalid) ||
-        programId >= static_cast<int>(amnezia::PermittedProcess::_Count)) {
-        qWarning() << "IPC: invalid programId" << programId << ", ignoring";
-        return;
-    }
     m_program = static_cast<amnezia::PermittedProcess>(programId);
     m_process->setProgram(amnezia::permittedProcessPath(m_program));
     m_process->setArguments({});

service/server/killswitch.cpp

@@ -3,7 +3,6 @@
 
 #include <QApplication>
 #include <QHostAddress>
-#include <QRegularExpression>
 
 #include "../client/core/utils/protocolEnum.h"
 #include "../client/core/protocols/protocolUtils.h"
@@ -12,37 +11,6 @@
 #include "qjsonarray.h"
 #include "version.h"
 
-#if defined(Q_OS_LINUX) || defined(Q_OS_MACOS)
-static bool isValidIpOrCidr(const QString &value) {
-    static const QRegularExpression re(
-        QStringLiteral(R"(^(\d{1,3}\.){3}\d{1,3}(/\d{1,2})?$)"));
-    if (!re.match(value).hasMatch()) return false;
-    const QStringList ipParts = value.split(QLatin1Char('/'))[0].split(QLatin1Char('.'));
-    for (const QString &part : ipParts) {
-        bool ok;
-        int octet = part.toInt(&ok);
-        if (!ok || octet < 0 || octet > 255) return false;
-    }
-    if (value.contains(QLatin1Char('/'))) {
-        bool ok;
-        int prefix = value.split(QLatin1Char('/'))[1].toInt(&ok);
-        if (!ok || prefix < 0 || prefix > 32) return false;
-    }
-    return true;
-}
-
-static QStringList filterIpList(const QStringList &values) {
-    QStringList safe;
-    for (const QString &v : values) {
-        if (isValidIpOrCidr(v))
-            safe << v;
-        else
-            qWarning() << "IPC: rejected invalid IP/CIDR value:" << v;
-    }
-    return safe;
-}
-#endif
-
 #ifdef Q_OS_WIN
     #include "../client/platforms/windows/daemon/windowsfirewall.h"
     #include "../client/platforms/windows/daemon/windowsdaemon.h"
@@ -198,11 +166,7 @@ bool KillSwitch::disableAllTraffic() {
 
 bool KillSwitch::resetAllowedRange(const QStringList &ranges) {
 
-#ifdef Q_OS_LINUX
-    m_allowedRanges = filterIpList(ranges);
-#else
     m_allowedRanges = ranges;
-#endif
 
 #ifdef Q_OS_LINUX
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("110.allowNets"), true);
@@ -225,12 +189,7 @@ bool KillSwitch::resetAllowedRange(const QStringList &ranges) {
 }
 
 bool KillSwitch::addAllowedRange(const QStringList &ranges) {
-#ifdef Q_OS_LINUX
-    const QStringList safeRanges = filterIpList(ranges);
-#else
-    const QStringList &safeRanges = ranges;
-#endif
-    for (const QString &range : safeRanges) {
+    for (const QString &range : ranges) {
         if (!range.isEmpty() && !m_allowedRanges.contains(range)) {
             m_allowedRanges.append(range);
         }
@@ -358,9 +317,9 @@ bool KillSwitch::enableKillSwitch(const QJsonObject &configStr, int vpnAdapterIn
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("000.allowLoopback"), true);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("100.blockAll"), blockAll);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("110.allowNets"), allowNets);
-    LinuxFirewall::updateAllowNets(filterIpList(allownets));
+    LinuxFirewall::updateAllowNets(allownets);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("120.blockNets"), blockAll);
-    LinuxFirewall::updateBlockNets(filterIpList(blocknets));
+    LinuxFirewall::updateBlockNets(blocknets);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("130.allowMarkedXray"), true);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("200.allowVPN"), true);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv6, QStringLiteral("250.blockIPv6"), true);
@@ -369,36 +328,23 @@ bool KillSwitch::enableKillSwitch(const QJsonObject &configStr, int vpnAdapterIn
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("310.blockDNS"), true);
     QStringList dnsServers;
 
-    const QString dns1 = configStr.value(amnezia::configKey::dns1).toString();
-    if (isValidIpOrCidr(dns1))
-        dnsServers.append(dns1);
-    else if (!dns1.isEmpty())
-        qWarning() << "IPC: rejected invalid dns1:" << dns1;
+    dnsServers.append(configStr.value(amnezia::configKey::dns1).toString());
 
     // We don't use secondary DNS if primary DNS is AmneziaDNS
-    if (!dns1.contains(amnezia::protocols::dns::amneziaDnsIp)) {
-        const QString dns2 = configStr.value(amnezia::configKey::dns2).toString();
-        if (isValidIpOrCidr(dns2))
-            dnsServers.append(dns2);
-        else if (!dns2.isEmpty())
-            qWarning() << "IPC: rejected invalid dns2:" << dns2;
+    if (!configStr.value(amnezia::configKey::dns1).toString().contains(amnezia::protocols::dns::amneziaDnsIp)) {
+        dnsServers.append(configStr.value(amnezia::configKey::dns2).toString());
     }
 
     dnsServers.append("127.0.0.1");
     dnsServers.append("127.0.0.53");
-
-
+    
     for (auto dns : configStr.value(amnezia::configKey::allowedDnsServers).toArray()) {
         if (!dns.isString()) {
             break;
         }
-        const QString dnsStr = dns.toString();
-        if (isValidIpOrCidr(dnsStr))
-            dnsServers.append(dnsStr);
-        else if (!dnsStr.isEmpty())
-            qWarning() << "IPC: rejected invalid allowedDnsServer:" << dnsStr;
+        dnsServers.append(dns.toString());
     }
-
+    
     LinuxFirewall::updateDNSServers(dnsServers);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("320.allowDNS"), true);
     LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("400.allowPIA"), true);
@@ -414,40 +360,28 @@ bool KillSwitch::enableKillSwitch(const QJsonObject &configStr, int vpnAdapterIn
     MacOSFirewall::setAnchorEnabled(QStringLiteral("000.allowLoopback"), true);
     MacOSFirewall::setAnchorEnabled(QStringLiteral("100.blockAll"), blockAll);
     MacOSFirewall::setAnchorEnabled(QStringLiteral("110.allowNets"), allowNets);
-    MacOSFirewall::setAnchorTable(QStringLiteral("110.allowNets"), allowNets, QStringLiteral("allownets"), filterIpList(allownets));
+    MacOSFirewall::setAnchorTable(QStringLiteral("110.allowNets"), allowNets, QStringLiteral("allownets"), allownets);
 
     MacOSFirewall::setAnchorEnabled(QStringLiteral("120.blockNets"), blockNets);
-    MacOSFirewall::setAnchorTable(QStringLiteral("120.blockNets"), blockNets, QStringLiteral("blocknets"), filterIpList(blocknets));
+    MacOSFirewall::setAnchorTable(QStringLiteral("120.blockNets"), blockNets, QStringLiteral("blocknets"), blocknets);
     MacOSFirewall::setAnchorEnabled(QStringLiteral("200.allowVPN"), true);
     MacOSFirewall::setAnchorEnabled(QStringLiteral("250.blockIPv6"), true);
     MacOSFirewall::setAnchorEnabled(QStringLiteral("290.allowDHCP"), true);
     MacOSFirewall::setAnchorEnabled(QStringLiteral("300.allowLAN"), true);
 
     QStringList dnsServers;
-    const QString dns1 = configStr.value(amnezia::configKey::dns1).toString();
-    if (isValidIpOrCidr(dns1))
-        dnsServers.append(dns1);
-    else if (!dns1.isEmpty())
-        qWarning() << "IPC: rejected invalid dns1:" << dns1;
+    dnsServers.append(configStr.value(amnezia::configKey::dns1).toString());
 
     // We don't use secondary DNS if primary DNS is AmneziaDNS
-    if (!dns1.contains(amnezia::protocols::dns::amneziaDnsIp)) {
-        const QString dns2 = configStr.value(amnezia::configKey::dns2).toString();
-        if (isValidIpOrCidr(dns2))
-            dnsServers.append(dns2);
-        else if (!dns2.isEmpty())
-            qWarning() << "IPC: rejected invalid dns2:" << dns2;
+    if (!configStr.value(amnezia::configKey::dns1).toString().contains(amnezia::protocols::dns::amneziaDnsIp)) {
+        dnsServers.append(configStr.value(amnezia::configKey::dns2).toString());
     }
-
+    
     for (auto dns : configStr.value(amnezia::configKey::allowedDnsServers).toArray()) {
         if (!dns.isString()) {
             break;
         }
-        const QString dnsStr = dns.toString();
-        if (isValidIpOrCidr(dnsStr))
-            dnsServers.append(dnsStr);
-        else if (!dnsStr.isEmpty())
-            qWarning() << "IPC: rejected invalid allowedDnsServer:" << dnsStr;
+        dnsServers.append(dns.toString());
     }
     
     MacOSFirewall::setAnchorEnabled(QStringLiteral("310.blockDNS"), true);

service/server/localserver.cpp

@@ -17,35 +17,6 @@
     #include "tapcontroller_win.h"
 #endif
 
-#ifdef Q_OS_LINUX
-#include <sys/socket.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-uid_t g_allowedUid = static_cast<uid_t>(-1);
-bool g_allowedUidSet = false;
-
-static bool checkPeerCredentials(QLocalSocket *socket) {
-    struct ucred cred{};
-    socklen_t len = sizeof(cred);
-    if (getsockopt(socket->socketDescriptor(), SOL_SOCKET, SO_PEERCRED, &cred, &len) != 0) {
-        qWarning() << "LocalServer: SO_PEERCRED failed, rejecting connection";
-        return false;
-    }
-    if (cred.uid == 0) return true;
-    if (!g_allowedUidSet) {
-        g_allowedUid = cred.uid;
-        g_allowedUidSet = true;
-        qDebug() << "LocalServer: registered session UID" << g_allowedUid;
-    }
-    if (cred.uid != g_allowedUid) {
-        qWarning() << "LocalServer: rejected connection from unauthorized UID" << cred.uid;
-        return false;
-    }
-    return true;
-}
-#endif
-
 namespace {
 Logger logger("WgDaemonServer");
 }
@@ -64,15 +35,7 @@ LocalServer::LocalServer(QObject *parent) : QObject(parent),
 
     QObject::connect(m_server.data(), &QLocalServer::newConnection, this, [this]() {
         qDebug() << "LocalServer new connection";
-        QLocalSocket *conn = m_server->nextPendingConnection();
-#ifdef Q_OS_LINUX
-        if (!checkPeerCredentials(conn)) {
-            conn->close();
-            conn->deleteLater();
-            return;
-        }
-#endif
-        m_serverNode.addHostSideConnection(conn);
+        m_serverNode.addHostSideConnection(m_server->nextPendingConnection());
 
         if (!m_isRemotingEnabled) {
             m_isRemotingEnabled = true;

service/server/router_linux.cpp

@@ -182,7 +182,7 @@ bool RouterLinux::flushDns()
     if (output.isEmpty())
         qDebug().noquote() << "Flush dns completed";
     else
-        qDebug().noquote() << "OUTPUT systemctl restart: " + output;
+        qDebug().noquote() << "OUTPUT systemctl restart nscd/systemd-resolved: " + output;
 
     return true;
 }