Refactor of config export to a single flow.
Always assume SAF is not available on Android TV as it can be falsely reported to be supported. Fallback to legacy downloads export.
closes#902
Changes to 1.1.0 add Amnezia 3.0 support to the config parser. UI has also been updated to support Amnezia 3.0 values.
closes#1408
Additional fixes:
- Fixes race during tunnel bootstrap that could leave an orphaned tunnel
closes#1407
- Fixes bug where initial tunnel state could be lost due to a tunnel handle mapping race
closes#1404
Seamless recovery was far to aggressive in doing full tunnel bounces in the old implementation. The feature has now been integrated into a more broad recovery job with decoupled individual recovery paths that respect a recovery hierarchy of DDNS recovery first (if enabled), IPv4 fallback second (if ipv6 preferred and active), and only full bounce when all else fails. The feature is now also gated to only work when the device is interactive/not asleep to prevent false positives.
Additionally, the first implementation of seamless recovery was very crude. It performed fresh DNS request for tunnel endpoints because it didn't have a caching mechanism. The same for IPv4/Ipv6 fallback and recovery. This has been fixed by reintroducing the user setting for tagging a tunnel as a DDNS tunnel (BREAKING CHANGE for DDNS users). For the seamless recovery path, we now only make a fresh DNS request if the user has flagged the tunnel as a DDNS tunnel. IPv6 and IPv4 fallback and recovery still respect the cache in all scenarios.
Seamless recovery now properly only fires after 30 seconds of persistent handshake failures while the phone is interactive.
closes#1373
Before, seamless recovery would fire if we detect any network. It should really only be triggering if we detect a usable network that has internet connectivity.
Certain OEMs fail to fire any wifi network change callbacks while a VPN is active. To get around this, we query all networks for these devices on defaultNetwork change to see if there is a Wifi network available and fallback to legacy mode if we are in default mode as the all networks capabilities won't have location restricted details
Fixes bug where exclude lan was not private DNS aware. This caused private IP DNS servers to be excluded from the tunnel and break or leak DNS
closes#799
Adds a new dependency on our core library for a tunnel wrapper that allows split dns and encrypted tunnel dns
Fixes a bug in network monitor where the active underlying network was incorrectly set on VPN toggles, cause issues with auto tunneling and other features
Fixes a bug with lockdown mode where the tunnel's DNS servers were not being used and a kill switch default DNS server was being used
closes#572closes#1128closes#1370closes#1341#1363
Fixes race specifically with Wi-Fi networks where vpn starts could overwrite our SSID and BSSID values with android defaults
Make underlying/active network detail caching logic more robust for all detection modes
Add seamless recovery events and also detect seamless recovery DDNS and IPv4 events so we can notify user of these events like before
Improve snackbar queuing to fix sonner ordering issues
Copy strings with strdup to prevent go from seeing MTE tagged memory
Switch to async callback for native resolver to prevent go garbage collection issues with JVM thread + MTE
#1262
DDNS, IPv4 recovery and seamless roaming have all been merged into the new seamless recovery feature. There were a lot of overlaps and edge cases that were best solved by the nuclear seamless recovery feature
Kotlin side now maintains ownership of the vpn service interface fd, preventing the closure of the interface while the seamless recovery feature closes and recreates the wireguard tunnel device, allowing maintained protection from leaks throughout the bounce process
This feature solves various network and tunnel issues including DDNS changes, network migration issues, NAT issues, Amnezia mimic packet issues, etc that were traditionally solved by a full vpn interface and tunnel destruction
closes#1295closes#1036
There are issues where binding network seems counterproductive in certain recovery cases and unreliable. Instead, we now just refresh the tunnel bind on major network transitions to scope the feature more towards Wi-Fi AP migrations and airplane mode migrations while letting wireguard's roaming handling do the rest
Added a small delay before bind refresh to make sure network as stabilized first
Prevent issues where users try to start legacy Amenzia 1.5 configs with only mimicking values set by applying Amnezia 2.0 required properties at tunnel run
Minor bugfix on config ui when applying mimic settings
Improved logger to reuse existing files to prevent a bunch of small files created on short lived app starts
Added more log sanitizing for noisy logs
Improved the log delete and export flow with success messages
Added version and flavor to log file name and log file header
Auto tunnel now properly handles conflicts with ssids, bssid, and wildcards by picking the first most specific match
Added logic to prevent duplicate mappings from being added to multiple tunnels
Auto tunnel now has specificity, prioritizing extact BSSID -> exact SSID -> BSSID wildcard (most precise one) -> SSID wildcard (most precise one) and then fallback back to the default or first tunnel if there are no matches.
closes#1317
The new DnsResolver api can return loopback sometimes. To avoid, we stick with the old API for making network bound requests.
Add safety to prevent double bracketing of ipv6 addresses
#1330
Added support for auto tunneling based on BSSID. On conflict with SSID, BSSID takes precedence.
Added support for root shell and shizuku to also query BSSID along with SSID.
Added wildcard support and tunnel mapping for BSSIDs.
Various small UI/UX improvements to auto tunnel Wi-Fi settings and tunnel mapping.
closes#115
zaneschepke