Seamless recovery can now be tuned two various delay intervals by users.
Fixes:
This core version fixes a bug where valid Amnezia packet signatures would fail parser validation.
Fixes a bug where IPv6 endpoint recovery would not fire in situations where network is a valid candidate for upgrade but tunnel was repaired by IPv4 fallback. IPv6 now always tries once and only once on networks that support IPv6 if the peer endpoints are currently IPv4.
Fixes DNS resolution bug for IPv6 only endpoints.
Uses the new core logging level configuration.
Fixes a bug where stats and live config state was not updating properly with tunnel monitoring interval.
Fixes ipv6 recovery bug where recovery was not properly triggering.
Fixes a bug where changes to lockdown settings while a tunnel is active could break the kill switch tunnel bridge.
Fixes a bug where plain dns in our dns hijack (during lockdown or split dns w/plain) would cause DNS resolution loops, preventing resolution.
Fixes a bug where IPv6 tunnel DNS in plain DNS hijack would fail due to missing bracketing.
Refactor of config export to a single flow.
Always assume SAF is not available on Android TV as it can be falsely reported to be supported. Fallback to legacy downloads export.
closes#902
Changes to 1.1.0 add Amnezia 3.0 support to the config parser. UI has also been updated to support Amnezia 3.0 values.
closes#1408
Additional fixes:
- Fixes race during tunnel bootstrap that could leave an orphaned tunnel
closes#1407
- Fixes bug where initial tunnel state could be lost due to a tunnel handle mapping race
closes#1404
Seamless recovery was far to aggressive in doing full tunnel bounces in the old implementation. The feature has now been integrated into a more broad recovery job with decoupled individual recovery paths that respect a recovery hierarchy of DDNS recovery first (if enabled), IPv4 fallback second (if ipv6 preferred and active), and only full bounce when all else fails. The feature is now also gated to only work when the device is interactive/not asleep to prevent false positives.
Additionally, the first implementation of seamless recovery was very crude. It performed fresh DNS request for tunnel endpoints because it didn't have a caching mechanism. The same for IPv4/Ipv6 fallback and recovery. This has been fixed by reintroducing the user setting for tagging a tunnel as a DDNS tunnel (BREAKING CHANGE for DDNS users). For the seamless recovery path, we now only make a fresh DNS request if the user has flagged the tunnel as a DDNS tunnel. IPv6 and IPv4 fallback and recovery still respect the cache in all scenarios.
Seamless recovery now properly only fires after 30 seconds of persistent handshake failures while the phone is interactive.
closes#1373
Before, seamless recovery would fire if we detect any network. It should really only be triggering if we detect a usable network that has internet connectivity.
Certain OEMs fail to fire any wifi network change callbacks while a VPN is active. To get around this, we query all networks for these devices on defaultNetwork change to see if there is a Wifi network available and fallback to legacy mode if we are in default mode as the all networks capabilities won't have location restricted details
Fixes bug where exclude lan was not private DNS aware. This caused private IP DNS servers to be excluded from the tunnel and break or leak DNS
closes#799
Adds a new dependency on our core library for a tunnel wrapper that allows split dns and encrypted tunnel dns
Fixes a bug in network monitor where the active underlying network was incorrectly set on VPN toggles, cause issues with auto tunneling and other features
Fixes a bug with lockdown mode where the tunnel's DNS servers were not being used and a kill switch default DNS server was being used
closes#572closes#1128closes#1370closes#1341#1363
Fixes race specifically with Wi-Fi networks where vpn starts could overwrite our SSID and BSSID values with android defaults
Make underlying/active network detail caching logic more robust for all detection modes
Add seamless recovery events and also detect seamless recovery DDNS and IPv4 events so we can notify user of these events like before
Improve snackbar queuing to fix sonner ordering issues
Copy strings with strdup to prevent go from seeing MTE tagged memory
Switch to async callback for native resolver to prevent go garbage collection issues with JVM thread + MTE
#1262
DDNS, IPv4 recovery and seamless roaming have all been merged into the new seamless recovery feature. There were a lot of overlaps and edge cases that were best solved by the nuclear seamless recovery feature
Kotlin side now maintains ownership of the vpn service interface fd, preventing the closure of the interface while the seamless recovery feature closes and recreates the wireguard tunnel device, allowing maintained protection from leaks throughout the bounce process
This feature solves various network and tunnel issues including DDNS changes, network migration issues, NAT issues, Amnezia mimic packet issues, etc that were traditionally solved by a full vpn interface and tunnel destruction
closes#1295closes#1036
Zane Schepke