remove old code & & ref code

.github/workflows/deploy.yml

@@ -157,7 +157,7 @@ jobs:
       run: pip install "conan==2.28.0"
 
     - name: 'Build dependencies'
-      run: cmake -S . -B build -DPREBUILTS_ONLY=1
+      run: cmake -S . -B build -G "Visual Studio 17 2022" -DPREBUILTS_ONLY=1
     
     - name: 'Authorize in remote'
       if: github.ref == 'refs/heads/dev'

CMakeLists.txt

@@ -4,7 +4,7 @@ set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 4.9.0.3)
+set(AMNEZIAVPN_VERSION 4.9.0.2)
 
 set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
 set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
@@ -28,7 +28,7 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")
 
 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2126)
+set(APP_ANDROID_VERSION_CODE 2123)
 
 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
     set(MZ_PLATFORM_NAME "linux")

client/amneziaApplication.cpp

@@ -119,13 +119,7 @@ void AmneziaApplication::init()
                 win->setPersistentSceneGraph(true);
                 win->setPersistentGraphics(true);
 #endif
-#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
                 win->show();
-#else
-                if (!m_coreController || !m_coreController->pageController()->shouldStartMinimized()) {
-                    win->show();
-                }
-#endif
             }
         },
         Qt::QueuedConnection);

client/android/res/drawable/ic_launcher_background.xml

@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<shape xmlns:android="http://schemas.android.com/apk/res/android"
-    android:shape="rectangle">
-    <gradient
-        android:type="linear"
-        android:angle="135"
-        android:startColor="#2A2A2E"
-        android:centerColor="#17171A"
-        android:endColor="#0E0E11" />
-</shape>

client/android/res/drawable/ic_launcher_monochrome.xml

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<inset xmlns:android="http://schemas.android.com/apk/res/android"
-    android:drawable="@drawable/ic_amnezia_round"
-    android:insetLeft="19.5%"
-    android:insetTop="19.5%"
-    android:insetRight="19.5%"
-    android:insetBottom="19.5%" />

client/android/res/mipmap-anydpi-v26/icon.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background" />
-    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
-    <monochrome android:drawable="@drawable/ic_launcher_monochrome" />
-</adaptive-icon>

client/android/res/mipmap-anydpi-v26/icon_round.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background" />
-    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
-    <monochrome android:drawable="@drawable/ic_launcher_monochrome" />
-</adaptive-icon>

client/android/res/values-v31/styles.xml

@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <style name="NoActionBar">
-        <item name="android:windowBackground">@color/black</item>
-        <item name="android:colorBackground">@color/black</item>
-        <item name="android:windowActionBar">false</item>
-        <item name="android:windowNoTitle">true</item>
-        <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
-        <item name="android:enforceNavigationBarContrast">false</item>
-        <item name="android:enforceStatusBarContrast">false</item>
-
-        <item name="android:windowSplashScreenBackground">@color/ic_launcher_background</item>
-        <item name="android:windowSplashScreenIconBackgroundColor">@color/ic_launcher_background</item>
-        <item name="android:windowSplashScreenAnimatedIcon">@mipmap/icon</item>
-    </style>
-</resources>

client/android/res/values/colors.xml

@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <color name="ic_launcher_background">#0E0E11</color>
-</resources>

client/cmake/macos_ne.cmake

@@ -152,5 +152,5 @@ message(${QtCore_location})
 get_filename_component(QT_BIN_DIR_DETECTED "${QtCore_location}/../../../../../bin" ABSOLUTE)
 
 add_custom_command(TARGET ${PROJECT} POST_BUILD
-    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR} -no-codesign
+    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR}
 )

client/core/configurators/xrayConfigurator.cpp

@@ -244,7 +244,11 @@ ErrorCode XrayConfigurator::applyServerSettingsToRemote(const ServerCredentials
                     << "container=" << static_cast<int>(container) << "host=" << credentials.hostName
                     << "transport=" << srv.transport << "security=" << srv.security << "port=" << srv.port
                     << "appendClient=" << appendNewClient;
-    const QString flowValue = srv.flow;
+    QString flowValue = srv.flow;
+    if (flowValue.isEmpty() && srv.security == QLatin1String("reality")) {
+        flowValue = QStringLiteral("xtls-rprx-vision");
+    }
+
     QString realityPublicKey;
     QString realityShortId;
     if (srv.security == QLatin1String("reality")) {
@@ -559,12 +563,9 @@ QJsonObject XrayConfigurator::buildStreamSettings(const XrayServerConfig &srv, c
         if (pad.obfsMode) {
             if (!pad.bytesMin.isEmpty() || !pad.bytesMax.isEmpty()) {
                 QJsonObject br;
-                const int fromV = pad.bytesMin.isEmpty() ? 1 : pad.bytesMin.toInt();
-                int toV = pad.bytesMax.isEmpty() ? 256 : pad.bytesMax.toInt();
-                if (toV < fromV)
-                    toV = fromV;
-                br[QStringLiteral("from")] = fromV;
-                br[QStringLiteral("to")] = toV;
+                br[QStringLiteral("from")] = pad.bytesMin.isEmpty() ? 1 : pad.bytesMin.toInt();
+                br[QStringLiteral("to")] = pad.bytesMax.isEmpty() ? (pad.bytesMin.isEmpty() ? 256 : pad.bytesMin.toInt())
+                                                                  : pad.bytesMax.toInt();
                 xo[QStringLiteral("xPaddingBytes")] = br;
             }
             xo[QStringLiteral("xPaddingKey")] = pad.key.isEmpty() ? QStringLiteral("x_padding") : pad.key;

client/core/controllers/connectionController.cpp

@@ -106,8 +106,7 @@ ErrorCode ConnectionController::isConnectionSupported(const QString &serverId) c
         return ErrorCode::AmneziaServiceNotRunning;
     }
 
-    const serverConfigUtils::ConfigType kind = m_serversRepository->serverKind(serverId);
-    if (serverConfigUtils::isLegacyApiSubscription(kind)) {
+    if (serverConfigUtils::isLegacyApiSubscription(m_serversRepository->serverKind(serverId))) {
         return ErrorCode::LegacyApiV1NotSupportedError;
     }
 
@@ -118,9 +117,6 @@ ErrorCode ConnectionController::isConnectionSupported(const QString &serverId) c
     }
 
     if (container == DockerContainer::None) {
-        if (serverConfigUtils::isApiV2Subscription(kind)) {
-            return ErrorCode::NoError;
-        }
         return ErrorCode::NoInstalledContainersError;
     }
 

client/core/controllers/coreSignalHandlers.cpp

@@ -1,7 +1,6 @@
 #include "coreSignalHandlers.h"
 
 #include <QTimer>
-#include <QtConcurrent>
 
 #include "core/utils/selfhosted/sshSession.h"
 #include "core/utils/errorCodes.h"
@@ -145,9 +144,7 @@ void CoreSignalHandlers::initExportControllerHandler()
             });
     connect(m_coreController->m_exportController, &ExportController::revokeClientRequested, this,
             [this](const QString &serverId, int row, DockerContainer container) {
-                QtConcurrent::run([this, serverId, row, container]() {
-                    m_coreController->m_usersController->revokeClient(serverId, row, container);
-                });
+                m_coreController->m_usersController->revokeClient(serverId, row, container);
             });
     connect(m_coreController->m_exportController, &ExportController::renameClientRequested, this,
             [this](const QString &serverId, int row, const QString &clientName, DockerContainer container) {
@@ -205,15 +202,13 @@ void CoreSignalHandlers::initAdminConfigRevokedHandler()
 {
     connect(m_coreController->m_installController, &InstallController::clientRevocationRequested, this,
             [this](const QString &serverId, const ContainerConfig &containerConfig, DockerContainer container) {
-                QtConcurrent::run([this, serverId, containerConfig, container]() {
-                    m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
-                });
+                m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
             });
 
     connect(m_coreController->m_installController, &InstallController::clientAppendRequested, this,
             [this](const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container) {
                 m_coreController->m_usersController->appendClient(serverId, clientId, clientName, container);
-            }, Qt::DirectConnection);
+            });
 
     connect(m_coreController->m_usersController, &UsersController::adminConfigRevoked, m_coreController->m_installController,
             &InstallController::clearCachedProfile);
@@ -290,8 +285,6 @@ void CoreSignalHandlers::initClientManagementModelUpdateHandler()
             m_coreController->m_clientManagementModel, &ClientManagementModel::updateModel);
     connect(m_coreController->m_usersController, &UsersController::clientRenamed,
             m_coreController->m_clientManagementModel, &ClientManagementModel::updateClientName);
-    connect(m_coreController->m_usersController, &UsersController::revokeFinished,
-            m_coreController->m_exportController, &ExportController::revokeFinished);
 }
 
 void CoreSignalHandlers::initSitesModelUpdateHandler()

client/core/controllers/selfhosted/exportController.h

@@ -48,7 +48,6 @@ signals:
     void appendClientRequested(const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container);
     void updateClientsRequested(const QString &serverId, DockerContainer container);
     void revokeClientRequested(const QString &serverId, int row, DockerContainer container);
-    void revokeFinished(ErrorCode errorCode);
     void renameClientRequested(const QString &serverId, int row, const QString &clientName, DockerContainer container);
 
 public slots:

client/core/controllers/selfhosted/installController.cpp

@@ -103,7 +103,7 @@ ErrorCode InstallController::setupContainer(const ServerCredentials &credentials
                                             bool isUpdate)
 {
     qDebug().noquote() << "InstallController::setupContainer" << ContainerUtils::containerToString(container);
-    SshSession sshSession(this);
+    SshSession sshSession;
     ErrorCode e = ErrorCode::NoError;
 
     e = isUserInSudo(credentials, sshSession);
@@ -168,11 +168,11 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
         }
         if (container == DockerContainer::MtProxy) {
             ServerCredentials credentials = adminConfig->credentials();
-            SshSession sshSession(this);
+            SshSession sshSession;
             MtProxyInstaller::uploadClientSettingsSnapshot(sshSession, credentials, container, newConfig);
         } else if (container == DockerContainer::Telemt) {
             ServerCredentials credentials = adminConfig->credentials();
-            SshSession sshSession(this);
+            SshSession sshSession;
             TelemtInstaller::uploadClientSettingsSnapshot(sshSession, credentials, container, newConfig);
         }
         adminConfig->updateContainerConfig(container, newConfig);
@@ -188,7 +188,7 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession(this);
+    SshSession sshSession;
 
     bool reinstallRequired = isReinstallContainerRequired(container, oldConfig, newConfig);
     qDebug() << "InstallController::updateServerConfig for container" << container << "reinstall required is" << reinstallRequired;
@@ -211,6 +211,12 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
         if (errorCode == ErrorCode::NoError) {
             errorCode = startupContainerWorker(credentials, container, newConfig, sshSession);
         }
+
+        if (errorCode == ErrorCode::NoError
+            && (container == DockerContainer::MtProxy || container == DockerContainer::Telemt)) {
+            const QString containerName = ContainerUtils::containerToString(container);
+            errorCode = sshSession.runScript(credentials, "sudo docker restart " + containerName);
+        }
     }
 
     const bool skipXrayInboundSync =
@@ -234,9 +240,7 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
         } else if (container == DockerContainer::Telemt) {
             TelemtInstaller::uploadClientSettingsSnapshot(sshSession, credentials, container, newConfig);
         }
-        if (reinstallRequired) {
-            clearCachedProfile(serverId, container);
-        }
+        clearCachedProfile(serverId, container);
         adminConfig->updateContainerConfig(container, newConfig);
         m_serversRepository->editServer(serverId, adminConfig->toJson(), serverConfigUtils::ConfigType::SelfHostedAdmin);
     }
@@ -739,18 +743,6 @@ bool InstallController::isReinstallContainerRequired(DockerContainer container,
             if (oldPort != newPort) {
                 return true;
             }
-            const QString oldTransport = oldMt->transportMode.isEmpty() ? QString(
-                    protocols::mtProxy::transportModeStandard)
-                                                                        : oldMt->transportMode;
-            const QString newTransport = newMt->transportMode.isEmpty() ? QString(
-                    protocols::mtProxy::transportModeStandard)
-                                                                        : newMt->transportMode;
-            if (oldTransport != newTransport) {
-                return true;
-            }
-            if (oldMt->tlsDomain != newMt->tlsDomain) {
-                return true;
-            }
         }
     }
 
@@ -765,39 +757,6 @@ bool InstallController::isReinstallContainerRequired(DockerContainer container,
             if (oldPort != newPort) {
                 return true;
             }
-            const QString oldTransport = oldT->transportMode.isEmpty()
-                    ? QString(protocols::telemt::transportModeStandard)
-                    : oldT->transportMode;
-            const QString newTransport = newT->transportMode.isEmpty()
-                    ? QString(protocols::telemt::transportModeStandard)
-                    : newT->transportMode;
-            if (oldTransport != newTransport) {
-                return true;
-            }
-            if (oldT->tlsDomain != newT->tlsDomain) {
-                return true;
-            }
-            if (oldT->maskEnabled != newT->maskEnabled) {
-                return true;
-            }
-            if (oldT->tlsEmulation != newT->tlsEmulation) {
-                return true;
-            }
-            if (oldT->useMiddleProxy != newT->useMiddleProxy) {
-                return true;
-            }
-            if (oldT->tag != newT->tag) {
-                return true;
-            }
-            const QString oldUser = oldT->userName.isEmpty()
-                    ? QString::fromUtf8(protocols::telemt::defaultUserName)
-                    : oldT->userName;
-            const QString newUser = newT->userName.isEmpty()
-                    ? QString::fromUtf8(protocols::telemt::defaultUserName)
-                    : newT->userName;
-            if (oldUser != newUser) {
-                return true;
-            }
         }
     }
 
@@ -837,9 +796,23 @@ ErrorCode InstallController::installDockerWorker(const ServerCredentials &creden
 
     qDebug().noquote() << "InstallController::installDockerWorker" << stdOut;
 
+    if (container == DockerContainer::MtProxy || container == DockerContainer::Telemt) {
+        QString conntrackOut;
+        auto cbConntrack = [&](const QString &data, libssh::Client &) {
+            conntrackOut += data + "\n";
+            return ErrorCode::NoError;
+        };
+        sshSession.runScript(
+                credentials,
+                sshSession.replaceVars(amnezia::scriptData(SharedScriptType::install_conntrack),
+                                       amnezia::genBaseVars(credentials, DockerContainer::None, QString(), QString())),
+                cbConntrack, cbConntrack);
+        qDebug().noquote() << "InstallController::installDockerWorker install_conntrack:" << conntrackOut;
+    }
+
     if (container == DockerContainer::Awg2) {
-        QRegularExpression kernelVersionRegex(R"(Linux\s+(\d+)\.(\d+)[^\d]*)");
-        QRegularExpressionMatch match = kernelVersionRegex.match(stdOut);
+        QRegularExpression regex(R"(Linux\s+(\d+)\.(\d+)[^\d]*)");
+        QRegularExpressionMatch match = regex.match(stdOut);
         if (match.hasMatch()) {
             int majorVersion = match.captured(1).toInt();
             int minorVersion = match.captured(2).toInt();
@@ -852,19 +825,8 @@ ErrorCode InstallController::installDockerWorker(const ServerCredentials &creden
 
     if (stdOut.contains("lock"))
         return ErrorCode::ServerPacketManagerError;
-    if (stdOut.contains("Container runtime is not supported"))
-        return ErrorCode::ServerContainerRuntimeNotSupported;
-    
-    QRegularExpression notFoundRegex(
-        R"(^.*(?:sudo:|docker:).*not found.*$)",
-        QRegularExpression::MultilineOption);
-
-    if (notFoundRegex.match(stdOut).hasMatch()) {
+    if (stdOut.contains("command not found"))
         return ErrorCode::ServerDockerFailedError;
-    }
-    
-    if (stdOut.contains("Container runtime service not running"))
-        return ErrorCode::ContainerRuntimeServiceNotRunning;
 
     return error;
 }
@@ -901,7 +863,7 @@ ErrorCode InstallController::isUserInSudo(const ServerCredentials &credentials,
         return ErrorCode::ServerUserNotInSudo;
     if (stdOut.contains("can't cd to") || stdOut.contains("Permission denied") || stdOut.contains("No such file or directory"))
         return ErrorCode::ServerUserDirectoryNotAccessible;
-    if (stdOut.contains(QRegularExpression(R"(\bsudoers\b)")) || stdOut.contains("is not allowed to") || stdOut.contains("can't do that"))
+    if (stdOut.contains("sudoers") || stdOut.contains("is not allowed to run sudo on"))
         return ErrorCode::ServerUserNotAllowedInSudoers;
     if (stdOut.contains("password is required") || stdOut.contains("authentication is required"))
         return ErrorCode::ServerUserPasswordRequired;
@@ -983,7 +945,7 @@ ErrorCode InstallController::rebootServer(const QString &serverId)
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession(this);
+    SshSession sshSession;
 
     QString script = QString("sudo reboot");
 
@@ -1011,7 +973,7 @@ ErrorCode InstallController::removeAllContainers(const QString &serverId)
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession(this);
+    SshSession sshSession;
     ErrorCode errorCode = sshSession.runScript(credentials, amnezia::scriptData(SharedScriptType::remove_all_containers));
 
     if (errorCode == ErrorCode::NoError) {
@@ -1033,7 +995,7 @@ ErrorCode InstallController::removeContainer(const QString &serverId, DockerCont
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession(this);
+    SshSession sshSession;
     const amnezia::ScriptVars removeContainerVars =
             amnezia::genBaseVars(credentials, container, QString(), QString());
     const bool removeDataVolume = (container == DockerContainer::MtProxy || container == DockerContainer::Telemt);
@@ -1142,7 +1104,7 @@ ErrorCode InstallController::scanServerForInstalledContainers(const QString &ser
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession(this);
+    SshSession sshSession;
 
     QMap<DockerContainer, ContainerConfig> installedContainers;
     ErrorCode errorCode = getAlreadyInstalledContainers(credentials, installedContainers, sshSession);
@@ -1185,7 +1147,7 @@ ErrorCode InstallController::scanServerForInstalledContainers(const QString &ser
 ErrorCode InstallController::installServer(const ServerCredentials &credentials, DockerContainer container, int port,
                                            TransportProto transportProto, bool &wasContainerInstalled)
 {
-    SshSession sshSession(this);
+    SshSession sshSession;
     QMap<DockerContainer, ContainerConfig> installedContainers;
     ErrorCode errorCode = getAlreadyInstalledContainers(credentials, installedContainers, sshSession);
     if (errorCode) {
@@ -1254,7 +1216,7 @@ ErrorCode InstallController::installContainer(const QString &serverId, DockerCon
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession(this);
+    SshSession sshSession;
     
     QMap<DockerContainer, ContainerConfig> installedContainers;
     ErrorCode errorCode = getAlreadyInstalledContainers(credentials, installedContainers, sshSession);
@@ -1296,7 +1258,7 @@ ErrorCode InstallController::installContainer(const QString &serverId, DockerCon
 ErrorCode InstallController::checkSshConnection(ServerCredentials &credentials, QString &output,
                                                 std::function<QString()> passphraseCallback)
 {
-    SshSession sshSession(this);
+    SshSession sshSession;
     ErrorCode errorCode = ErrorCode::NoError;
 
     if (credentials.secretData.contains("BEGIN") && credentials.secretData.contains("PRIVATE KEY")) {
@@ -1577,7 +1539,7 @@ ErrorCode InstallController::setDockerContainerEnabledState(const QString &serve
         return ErrorCode::InternalError;
     }
     const QString containerName = ContainerUtils::containerToString(container);
-    SshSession sshSession(this);
+    SshSession sshSession;
     const QString script = enabled ? QStringLiteral("sudo docker start %1").arg(containerName)
                                    : QStringLiteral("sudo docker stop %1").arg(containerName);
     const ErrorCode runError = sshSession.runScript(credentials, script);
@@ -1617,7 +1579,7 @@ ErrorCode InstallController::queryDockerContainerStatus(const QString &serverId,
         stdOut += data;
         return ErrorCode::NoError;
     };
-    SshSession sshSession(this);
+    SshSession sshSession;
     const QString script = QStringLiteral(
             "sudo docker inspect --format '{{.State.Status}}' %1 2>/dev/null || echo 'not_found'")
             .arg(containerName);
@@ -1651,7 +1613,7 @@ ErrorCode InstallController::queryMtProxyDiagnostics(const QString &serverId, Do
     if (!credentials.isValid()) {
         return ErrorCode::InternalError;
     }
-    SshSession sshSession(this);
+    SshSession sshSession;
     return MtProxyInstaller::queryDiagnostics(sshSession, credentials, container, listenPort, out);
 }
 
@@ -1674,7 +1636,7 @@ QString InstallController::fetchDockerContainerSecret(const QString &serverId, D
         stdOut += data;
         return ErrorCode::NoError;
     };
-    SshSession sshSession(this);
+    SshSession sshSession;
     const QString path = QStringLiteral("/data/secret");
     const QString cmd = QStringLiteral("sudo docker exec %1 cat %2").arg(containerName, path);
     const ErrorCode errorCode = sshSession.runScript(credentials, cmd, cbReadStdOut);

client/core/controllers/selfhosted/usersController.cpp

@@ -698,7 +698,7 @@ ErrorCode UsersController::revokeXray(const int row,
 
     QString restartScript = QString("sudo docker restart $CONTAINER_NAME");
     error = sshSession->runScript(
-        credentials,
+        credentials, 
         sshSession->replaceVars(restartScript, amnezia::genBaseVars(credentials, container, QString(), QString()))
     );
     if (error != ErrorCode::NoError) {
@@ -758,17 +758,14 @@ ErrorCode UsersController::revokeClient(const QString &serverId, const int index
         ContainerConfig containerCfg = adminConfig->containerConfig(container);
         QString containerClientId = containerCfg.protocolConfig.clientId();
 
-        const bool isAdminMatch = !clientId.isEmpty() && !containerClientId.isEmpty() && containerClientId.contains(clientId);
-        if (isAdminMatch) {
+        if (!clientId.isEmpty() && !containerClientId.isEmpty() && containerClientId.contains(clientId)) {
             emit adminConfigRevoked(serverId, container);
         }
 
         emit clientRevoked(index);
+        emit clientsUpdated(m_clientsTable);
     }
 
-    emit clientsUpdated(m_clientsTable);
-    emit revokeFinished(errorCode);
-
     return errorCode;
 }
 

client/core/controllers/selfhosted/usersController.h

@@ -37,7 +37,6 @@ signals:
     void clientAdded(const QJsonObject &client);
     void clientRenamed(int row, const QString &newName);
     void clientRevoked(int row);
-    void revokeFinished(ErrorCode errorCode);
     void adminConfigRevoked(const QString &serverId, DockerContainer container);
 
 public slots:

client/core/installers/mtProxyInstaller.cpp

@@ -71,48 +71,62 @@ ErrorCode MtProxyInstaller::queryDiagnostics(SshSession &sshSession, const Serve
                                              DockerContainer container, int listenPort,
                                              MtProxyContainerDiagnostics &out)
 {
-    out = {};
-    if (container != DockerContainer::MtProxy && container != DockerContainer::Telemt) {
-        return ErrorCode::InternalError;
-    }
-    const QString containerName = ContainerUtils::containerToString(container);
-    const QString script =
-            QStringLiteral(
-                    "PORT_OK=$(sudo docker exec %1 sh -c 'ss -tlnp 2>/dev/null | grep -q :%2 && echo yes || echo no' 2>/dev/null || echo no); "
-                    "TG_OK=$(curl -s --max-time 5 -o /dev/null -w '%%{http_code}' https://core.telegram.org/getProxySecret 2>/dev/null | grep -q '200' && echo yes || echo no); "
-                    "CLIENTS=$(sudo docker exec amnezia-mtproxy sh -c 'curl -s --max-time 3 http://localhost:2398/stats 2>/dev/null | grep -o \"total_special_connections:[0-9]*\" | cut -d: -f2' 2>/dev/null); "
-                    "CONF_TIME=$(sudo docker exec amnezia-mtproxy sh -c 'stat -c \"%%y\" /data/proxy-multi.conf 2>/dev/null | cut -d. -f1' 2>/dev/null || echo unknown); "
-                    "echo \"PORT_OK=${PORT_OK}\"; "
-                    "echo \"TG_OK=${TG_OK}\"; "
-                    "echo \"CLIENTS=${CLIENTS:-0}\"; "
-                    "echo \"CONF_TIME=${CONF_TIME}\"; "
-                    "echo \"STATS=http://localhost:2398/stats\";")
-                    .arg(containerName)
-                    .arg(listenPort);
+    out = { };
+    if (container == DockerContainer::MtProxy || container == DockerContainer::Telemt) {
+        const QString containerName = ContainerUtils::containerToString(container);
+        const bool isTelemt = container == DockerContainer::Telemt;
 
-    QString stdOut;
-    auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
-        stdOut += data;
-        return ErrorCode::NoError;
-    };
-    const ErrorCode errorCode = sshSession.runScript(credentials, script, cbReadStdOut);
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-    for (const QString &line : stdOut.split('\n', Qt::SkipEmptyParts)) {
-        if (line.startsWith(QLatin1String("PORT_OK="))) {
-            out.portReachable = line.mid(8).trimmed() == QLatin1String("yes");
-        } else if (line.startsWith(QLatin1String("TG_OK="))) {
-            out.upstreamReachable = line.mid(6).trimmed() == QLatin1String("yes");
-        } else if (line.startsWith(QLatin1String("CLIENTS="))) {
-            out.clientsConnected = line.mid(8).trimmed().toInt();
-        } else if (line.startsWith(QLatin1String("CONF_TIME="))) {
-            out.lastConfigRefresh = line.mid(10).trimmed();
-        } else if (line.startsWith(QLatin1String("STATS="))) {
-            out.statsEndpoint = line.mid(6).trimmed();
+        const QString sportFilter = QString::number(listenPort);
+        const QString peersCmd = QStringLiteral("sudo conntrack -L -p tcp --dport ") + sportFilter
+                + QStringLiteral(" 2>/dev/null | grep ESTABLISHED | awk '{for(i=1;i<=NF;i++) if($i ~ /^src=/){print "
+                                 "substr($i,5); break}}'");
+        const QString publicFilter = QStringLiteral(" | grep -vE "
+                                                    "'^(10\\.|127\\.|169\\.254\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3["
+                                                    "01])\\.|::1$|fe80:|f[cd][0-9a-f][0-9a-f]:)'");
+        const QString clientsCmd =
+                QStringLiteral("CLIENTS=$(") + peersCmd + publicFilter + QStringLiteral(" | sort -u | grep -c .); ");
+        const QString confFile =
+                isTelemt ? QStringLiteral("/data/config.toml") : QStringLiteral("/data/proxy-multi.conf");
+        const QString statsUrl = QString();
+
+        const QString script = QStringLiteral("CN=") + containerName + QStringLiteral("; ")
+                + QStringLiteral("PORT_OK=$(sudo ss -tlnp 2>/dev/null | grep -q :") + QString::number(listenPort)
+                + QStringLiteral(" && echo yes || echo no); ")
+                + QStringLiteral("TG_OK=$(curl -s --max-time 5 -o /dev/null -w '%{http_code}' "
+                                 "https://core.telegram.org/getProxySecret 2>/dev/null | grep -q '200' && echo yes || "
+                                 "echo no); ")
+                + clientsCmd + QStringLiteral("CONF_TIME=$(sudo docker exec \"$CN\" sh -c 'stat -c \"%y\" ") + confFile
+                + QStringLiteral(" 2>/dev/null | cut -d. -f1' 2>/dev/null || echo unknown); ")
+                + QStringLiteral("echo \"PORT_OK=${PORT_OK}\"; ") + QStringLiteral("echo \"TG_OK=${TG_OK}\"; ")
+                + QStringLiteral("echo \"CLIENTS=${CLIENTS:-0}\"; ") + QStringLiteral("echo \"CONF_TIME=${CONF_TIME}\"; ")
+                + QStringLiteral("echo \"STATS=") + statsUrl + QStringLiteral("\";");
+
+        QString stdOut;
+        auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
+            stdOut += data;
+            return ErrorCode::NoError;
+        };
+        const ErrorCode errorCode = sshSession.runScript(credentials, script, cbReadStdOut);
+        if (errorCode != ErrorCode::NoError) {
+            return errorCode;
         }
+        for (const QString &line : stdOut.split('\n', Qt::SkipEmptyParts)) {
+            if (line.startsWith(QLatin1String("PORT_OK="))) {
+                out.portReachable = line.mid(8).trimmed() == QLatin1String("yes");
+            } else if (line.startsWith(QLatin1String("TG_OK="))) {
+                out.upstreamReachable = line.mid(6).trimmed() == QLatin1String("yes");
+            } else if (line.startsWith(QLatin1String("CLIENTS="))) {
+                out.clientsConnected = line.mid(8).trimmed().toInt();
+            } else if (line.startsWith(QLatin1String("CONF_TIME="))) {
+                out.lastConfigRefresh = line.mid(10).trimmed();
+            } else if (line.startsWith(QLatin1String("STATS="))) {
+                out.statsEndpoint = line.mid(6).trimmed();
+            }
+        }
+        return ErrorCode::NoError;
     }
-    return ErrorCode::NoError;
+
+    return ErrorCode::InternalError;
 }
 
 void MtProxyInstaller::uploadClientSettingsSnapshot(SshSession &sshSession, const ServerCredentials &credentials,

client/core/models/protocols/xrayProtocolConfig.cpp

@@ -32,7 +32,7 @@ XrayXPaddingConfig XrayXPaddingConfig::fromJson(const QJsonObject &json)
     c.bytesMin  = json.value(configKey::xPaddingBytesMin).toString();
     c.bytesMax  = json.value(configKey::xPaddingBytesMax).toString();
     c.obfsMode  = json.value(configKey::xPaddingObfsMode).toBool(true);
-    c.key       = json.value(configKey::xPaddingKey).toString();
+    c.key       = json.value(configKey::xPaddingKey).toString(protocols::xray::defaultSite);
     c.header    = json.value(configKey::xPaddingHeader).toString();
     c.placement = json.value(configKey::xPaddingPlacement).toString(protocols::xray::defaultXPaddingPlacement);
     c.method    = json.value(configKey::xPaddingMethod).toString(protocols::xray::defaultXPaddingMethod);
@@ -365,8 +365,6 @@ XrayServerConfig XrayServerConfig::fromJson(const QJsonObject &json)
 bool XrayServerConfig::hasEqualServerSettings(const XrayServerConfig &other) const
 {
     return port == other.port
-           && transportProto == other.transportProto
-           && subnetAddress == other.subnetAddress
            && site == other.site
            && security == other.security
            && flow == other.flow
@@ -468,17 +466,6 @@ XrayProtocolConfig XrayProtocolConfig::fromJson(const QJsonObject &json)
                         }
                     }
                 }
-                const QJsonArray outbounds = parsed.value(protocols::xray::outbounds).toArray();
-                if (!outbounds.isEmpty()) {
-                    const QJsonObject settings = outbounds[0].toObject().value(protocols::xray::settings).toObject();
-                    const QJsonArray vnext = settings.value(protocols::xray::vnext).toArray();
-                    if (!vnext.isEmpty()) {
-                        const QJsonArray users = vnext[0].toObject().value(protocols::xray::users).toArray();
-                        if (!users.isEmpty()) {
-                            clientCfg.id = users[0].toObject().value(protocols::xray::id).toString();
-                        }
-                    }
-                }
                 c.clientConfig = clientCfg;
             } else {
                 c.clientConfig = XrayClientConfig::fromJson(parsed);

client/core/repositories/secureServersRepository.cpp

@@ -208,8 +208,8 @@ QString SecureServersRepository::nextAvailableServerName() const
     int i = 0;
     QString candidate;
     do {
-        ++i;
-        candidate = tr("Server") + QLatin1Char(' ') + QString::number(i);
+        i++;
+        candidate = QStringLiteral("Server %1").arg(i);
     } while (usedNames.contains(candidate));
 
     return candidate;

client/core/utils/constants/protocolConstants.h

@@ -271,6 +271,7 @@ namespace amnezia
             constexpr char workersModeAuto[]       = "auto";
             constexpr char workersModeManual[]     = "manual";
             constexpr int  maxWorkers              = 32;
+            constexpr int  botTagHexLength         = 32;
         }
 
     } // namespace protocols

client/core/utils/errorCodes.h

@@ -38,8 +38,6 @@ namespace amnezia
         XrayServerConfigInvalid = 215,
         XrayServerNoVlessClients = 216,
         XrayRealityKeysReadFailed = 217,
-        ServerContainerRuntimeNotSupported = 218,
-        ContainerRuntimeServiceNotRunning = 219,
 
         // Ssh connection errors
         SshRequestDeniedError = 300,
@@ -126,3 +124,5 @@ namespace amnezia
 Q_DECLARE_METATYPE(amnezia::ErrorCode)
 
 #endif // ERRORCODES_H
+
+

client/core/utils/errorStrings.cpp

@@ -39,8 +39,6 @@ QString errorString(ErrorCode code) {
     case(ErrorCode::XrayRealityKeysReadFailed):
         errorMessage = QObject::tr("Server error: failed to read XRay Reality keys from the server");
         break;
-    case(ErrorCode::ServerContainerRuntimeNotSupported): errorMessage = QObject::tr("Server error: The default container runtime available for installation on this server is not supported.\n Install Docker Engine on the server manually and try again."); break;
-    case(ErrorCode::ContainerRuntimeServiceNotRunning): errorMessage = QObject::tr("Container runtime error: The container runtime service is not running.\n Check the container runtime service on the server, or wait about a minute and try again."); break;
 
     // Libssh errors
     case(ErrorCode::SshRequestDeniedError): errorMessage = QObject::tr("SSH request was denied"); break;

client/core/utils/selfhosted/scriptsRegistry.cpp

@@ -50,6 +50,7 @@ QString amnezia::scriptName(SharedScriptType type)
     switch (type) {
     case SharedScriptType::prepare_host: return QLatin1String("prepare_host.sh");
     case SharedScriptType::install_docker: return QLatin1String("install_docker.sh");
+    case SharedScriptType::install_conntrack: return QLatin1String("install_conntrack.sh");
     case SharedScriptType::build_container: return QLatin1String("build_container.sh");
     case SharedScriptType::remove_container: return QLatin1String("remove_container.sh");
     case SharedScriptType::remove_all_containers: return QLatin1String("remove_all_containers.sh");
@@ -366,6 +367,14 @@ amnezia::ScriptVars amnezia::genTelemtVars(const ContainerConfig &containerConfi
         vars.append({ { "$TELEMT_USE_MIDDLE_PROXY", c.useMiddleProxy ? QLatin1String("true") : QLatin1String("false") } });
         vars.append({ { "$TELEMT_MASK", c.maskEnabled ? QLatin1String("true") : QLatin1String("false") } });
         vars.append({ { "$TELEMT_TLS_EMULATION", c.tlsEmulation ? QLatin1String("true") : QLatin1String("false") } });
+
+        QStringList additionalList;
+        for (const QString &s : c.additionalSecrets) {
+            if (!s.isEmpty()) {
+                additionalList << s;
+            }
+        }
+        vars.append({ { "$TELEMT_ADDITIONAL_SECRETS", additionalList.join(QLatin1Char(',')) } });
     }
 
     return vars;

client/core/utils/selfhosted/scriptsRegistry.h

@@ -21,6 +21,7 @@ enum SharedScriptType {
     // General scripts
     prepare_host,
     install_docker,
+    install_conntrack,
     build_container,
     remove_container,
     remove_all_containers,

client/macos/networkextension/CMakeLists.txt

@@ -25,8 +25,6 @@ set_target_properties(AmneziaVPNNetworkExtension PROPERTIES
 
     XCODE_ATTRIBUTE_INFOPLIST_FILE ${CMAKE_CURRENT_SOURCE_DIR}/Info.plist.in
     XCODE_ATTRIBUTE_LD_RUNPATH_SEARCH_PATHS "@executable_path/../../../../Frameworks @loader_path/../../../../Frameworks"
-
-    XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
 )
 
 if(DEPLOY)
@@ -120,20 +118,10 @@ target_include_directories(AmneziaVPNNetworkExtension PRIVATE ${CLIENT_ROOT_DIR}
 target_include_directories(AmneziaVPNNetworkExtension PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
 
 find_package(openvpnadapter REQUIRED)
-# FIXME(ygurov): https://github.com/conan-io/conan/issues/20034
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS MINSIZEREL)
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS RELWITHDEBINFO)
 target_link_libraries(AmneziaVPNNetworkExtension PRIVATE amnezia::openvpnadapter)
 
 find_package(awg-apple REQUIRED)
 target_link_libraries(AmneziaVPNNetworkExtension PRIVATE amnezia::awg-apple)
 
 find_package(hev-socks5-tunnel REQUIRED)
-# FIXME(ygurov): https://github.com/conan-io/conan/issues/20034
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS MINSIZEREL)
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS RELWITHDEBINFO)
 target_link_libraries(AmneziaVPNNetworkExtension PRIVATE heiher::hev-socks5-tunnel)

client/platforms/windows/daemon/windowsdaemon.cpp

@@ -62,29 +62,12 @@ void WindowsDaemon::prepareActivation(const InterfaceConfig& config, int inetAda
 }
 
 void WindowsDaemon::activateSplitTunnel(const InterfaceConfig& config, int vpnAdapterIndex) {
-    if (m_splitTunnelManager == nullptr) {
-        if (config.m_vpnDisabledApps.length() > 0) {
-            logger.error() << "Split tunnel manager is not initialized";
-            emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_INIT_FAILURE);
-        }
+    if (m_splitTunnelManager == nullptr)
         return;
-    }
 
   if (config.m_vpnDisabledApps.length() > 0) {
-      if (!m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex)) {
-          logger.error() << "Failed to start split tunnel";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-          return;
-      }
-      if (!m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps)) {
-          logger.error() << "Failed to apply split tunnel app exclusions";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_EXCLUDE_FAILURE);
-          return;
-      }
-      if (!m_splitTunnelManager->isRunning()) {
-          logger.error() << "Split tunnel did not reach running state";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      }
+      m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex);
+      m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps);
   } else {
       m_splitTunnelManager->stop();
   }
@@ -96,9 +79,7 @@ bool WindowsDaemon::run(Op op, const InterfaceConfig& config) {
       // The Client has sent us a list of disabled apps, but we failed
       // to init the the split tunnel driver.
       // So let the client know this was not possible
-      logger.error() << "Split tunnel manager is not initialized";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_INIT_FAILURE);
-      return false;
     }
     return true;
   }
@@ -109,20 +90,14 @@ bool WindowsDaemon::run(Op op, const InterfaceConfig& config) {
   }
   if (config.m_vpnDisabledApps.length() > 0) {
     if (!m_splitTunnelManager->start(m_inetAdapterIndex)) {
-      logger.error() << "Split tunnel start failed";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      return false;
     };
     if (!m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps)) {
-      logger.error() << "Split tunnel app exclusion failed";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_EXCLUDE_FAILURE);
-      return false;
     };
     // Now the driver should be running (State == 4)
     if (!m_splitTunnelManager->isRunning()) {
-      logger.error() << "Split tunnel did not reach running state";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      return false;
     }
     return true;
   }

client/platforms/windows/daemon/windowsfirewall.cpp

@@ -36,8 +36,6 @@
 // ID for the Firewall Sublayer
 DEFINE_GUID(ST_FW_WINFW_BASELINE_SUBLAYER_KEY, 0xc78056ff, 0x2bc1, 0x4211, 0xaa,
             0xdd, 0x7f, 0x35, 0x8d, 0xef, 0x20, 0x2d);
-DEFINE_GUID(ST_FW_WINFW_DNS_SUBLAYER_KEY, 0x60090787, 0xcca1, 0x4937, 0xaa,
-            0xce, 0x51, 0x25, 0x6e, 0xf4, 0x81, 0xf3);
 // ID for the Mullvad Split-Tunnel Sublayer Provider
 DEFINE_GUID(ST_FW_PROVIDER_KEY, 0xe2c114ee, 0xf32a, 0x4264, 0xa6, 0xcb, 0x3f,
             0xa7, 0x99, 0x63, 0x56, 0xd9);
@@ -51,53 +49,6 @@ constexpr uint8_t LOW_WEIGHT = 0;
 constexpr uint8_t MED_WEIGHT = 7;
 constexpr uint8_t HIGH_WEIGHT = 13;
 constexpr uint8_t MAX_WEIGHT = 15;
-
-bool ensureSublayer(HANDLE wfp, const GUID& key, const wchar_t* name,
-                    const wchar_t* description) {
-  FWPM_SUBLAYER0* maybeLayer = nullptr;
-  DWORD result = FwpmSubLayerGetByKey0(wfp, &key, &maybeLayer);
-  if (result == ERROR_SUCCESS) {
-    logger.debug() << "The Sublayer Already Exists:"
-                   << QString::fromWCharArray(name);
-    FwpmFreeMemory0(reinterpret_cast<void**>(&maybeLayer));
-    return true;
-  }
-  if (result != FWP_E_SUBLAYER_NOT_FOUND) {
-    logger.error() << "FwpmSubLayerGetByKey0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-
-  result = FwpmTransactionBegin(wfp, NULL);
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionBegin0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-
-  FWPM_SUBLAYER0 subLayer;
-  memset(&subLayer, 0, sizeof(subLayer));
-  subLayer.subLayerKey = key;
-  subLayer.displayData.name = const_cast<PWSTR>(name);
-  subLayer.displayData.description = const_cast<PWSTR>(description);
-  subLayer.weight = 0xFFFF;
-
-  result = FwpmSubLayerAdd0(wfp, &subLayer, NULL);
-  if (result != ERROR_SUCCESS) {
-    FwpmTransactionAbort0(wfp);
-    logger.error() << "FwpmSubLayerAdd0 failed. Return value:.\n" << result;
-    return false;
-  }
-
-  result = FwpmTransactionCommit0(wfp);
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionCommit0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-  logger.debug() << "Initialised Sublayer:" << QString::fromWCharArray(name);
-  return true;
-}
 }  // namespace
 
 WindowsFirewall* WindowsFirewall::create(QObject* parent) {
@@ -165,12 +116,47 @@ bool WindowsFirewall::initSublayer() {
   }
   auto cleanup = qScopeGuard([&] { FwpmEngineClose0(wfp); });
 
-  return ensureSublayer(wfp, ST_FW_WINFW_BASELINE_SUBLAYER_KEY,
-                        L"Amnezia-SplitTunnel-Sublayer",
-                        L"Filters that enforce a good baseline") &&
-         ensureSublayer(wfp, ST_FW_WINFW_DNS_SUBLAYER_KEY,
-                        L"Amnezia-SplitTunnel-DNS-Sublayer",
-                        L"DNS filters for split tunneling");
+  // Check if the Layer Already Exists
+  FWPM_SUBLAYER0* maybeLayer;
+  result = FwpmSubLayerGetByKey0(wfp, &ST_FW_WINFW_BASELINE_SUBLAYER_KEY,
+                                 &maybeLayer);
+  if (result == ERROR_SUCCESS) {
+    logger.debug() << "The Sublayer Already Exists!";
+    FwpmFreeMemory0((void**)&maybeLayer);
+    return true;
+  }
+
+  // Step 1: Start Transaction
+  result = FwpmTransactionBegin(wfp, NULL);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionBegin0 failed. Return value:.\n"
+                   << result;
+    return false;
+  }
+
+  // Step 3: Add Sublayer
+  FWPM_SUBLAYER0 subLayer;
+  memset(&subLayer, 0, sizeof(subLayer));
+  subLayer.subLayerKey = ST_FW_WINFW_BASELINE_SUBLAYER_KEY;
+  subLayer.displayData.name = (PWSTR)L"Amnezia-SplitTunnel-Sublayer";
+  subLayer.displayData.description =
+      (PWSTR)L"Filters that enforce a good baseline";
+  subLayer.weight = 0xFFFF;
+
+  result = FwpmSubLayerAdd0(wfp, &subLayer, NULL);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmSubLayerAdd0 failed. Return value:.\n" << result;
+    return false;
+  }
+  // Step 4: Commit!
+  result = FwpmTransactionCommit0(wfp);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionCommit0 failed. Return value:.\n"
+                   << result;
+    return false;
+  }
+  logger.debug() << "Initialised Sublayer";
+  return true;
 }
 
 bool WindowsFirewall::enableInterface(int vpnAdapterIndex) {

client/platforms/windows/daemon/windowssplittunnel.cpp

@@ -24,7 +24,6 @@
 #include <QFileInfo>
 #include <QNetworkInterface>
 #include <QScopeGuard>
-#include <QUrl>
 
 #pragma region
 
@@ -149,18 +148,6 @@ ProcessInfo getProcessInfo(HANDLE process, const PROCESSENTRY32W& processMeta) {
   return pi;
 }
 
-QString normalizeExecutablePath(const QString& path) {
-  QString normalized = path.trimmed();
-  if (normalized.startsWith("file:", Qt::CaseInsensitive)) {
-    const QString localPath = QUrl(normalized).toLocalFile();
-    if (!localPath.isEmpty()) {
-      normalized = localPath;
-    }
-  }
-  normalized.replace('/', '\\');
-  return normalized;
-}
-
 }  // namespace
 
 std::unique_ptr<WindowsSplitTunnel> WindowsSplitTunnel::create(
@@ -300,10 +287,6 @@ bool WindowsSplitTunnel::excludeApps(const QStringList& appPaths) {
 
   logger.debug() << "Pushing new Ruleset for Split-Tunnel " << state;
   auto config = generateAppConfiguration(appPaths);
-  if (config.empty()) {
-    logger.error() << "No valid split-tunnel application rules generated";
-    return false;
-  }
 
   DWORD bytesReturned;
   auto ok = DeviceIoControl(m_driver, IOCTL_SET_CONFIGURATION, &config[0],
@@ -331,7 +314,7 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
     auto ok = DeviceIoControl(m_driver, IOCTL_INITIALIZE, nullptr, 0, nullptr,
                               0, &bytesReturned, nullptr);
     if (!ok) {
-      logger.error() << "Driver init failed. Error:" << GetLastError();
+      logger.error() << "Driver init failed";
       return false;
     }
   }
@@ -340,16 +323,11 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
   if (getState() == STATE_INITIALIZED) {
     logger.debug() << "State is Init, requires process config";
     auto config = generateProcessBlob();
-    if (config.empty()) {
-      logger.error() << "Process configuration blob is empty";
-      return false;
-    }
     auto ok = DeviceIoControl(m_driver, IOCTL_REGISTER_PROCESSES, &config[0],
                               (DWORD)config.size(), nullptr, 0, &bytesReturned,
                               nullptr);
     if (!ok) {
-      logger.error() << "Failed to set Process Config. Error:"
-                     << GetLastError();
+      logger.error() << "Failed to set Process Config";
       return false;
     }
     logger.debug() << "Set Process Config ok || new State:" << stateString();
@@ -362,16 +340,11 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
   logger.debug() << "Driver is  ready || new State:" << stateString();
 
   auto config = generateIPConfiguration(inetAdapterIndex, vpnAdapterIndex);
-  if (config.empty()) {
-    logger.error() << "Network configuration blob is empty. Internet adapter:"
-                   << inetAdapterIndex << "VPN adapter:" << vpnAdapterIndex;
-    return false;
-  }
   auto ok = DeviceIoControl(m_driver, IOCTL_REGISTER_IP_ADDRESSES, &config[0],
                             (DWORD)config.size(), nullptr, 0, &bytesReturned,
                             nullptr);
   if (!ok) {
-    logger.error() << "Failed to set Network Config. Error:" << GetLastError();
+    logger.error() << "Failed to set Network Config";
     return false;
   }
   logger.debug() << "New Network Config Applied || new State:" << stateString();
@@ -431,22 +404,13 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
   size_t cummulated_string_size = 0;
   QStringList dosPaths;
   for (auto const& path : appPaths) {
-    const QString normalizedPath = normalizeExecutablePath(path);
-    auto dosPath = convertPath(normalizedPath);
-    if (dosPath.isEmpty()) {
-      logger.error() << "Rejecting split-tunnel app path with empty device "
-                        "conversion:"
-                     << normalizedPath;
-      continue;
-    }
+    auto dosPath = convertPath(path);
     dosPaths.append(dosPath);
     cummulated_string_size += dosPath.toStdWString().size() * sizeof(wchar_t);
-  }
-  if (dosPaths.isEmpty()) {
-    return {};
+    logger.debug() << dosPath;
   }
   size_t bufferSize = sizeof(CONFIGURATION_HEADER) +
-                      (sizeof(CONFIGURATION_ENTRY) * dosPaths.size()) +
+                      (sizeof(CONFIGURATION_ENTRY) * appPaths.size()) +
                       cummulated_string_size;
   std::vector<uint8_t> outBuffer(bufferSize);
 
@@ -454,7 +418,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
   auto entry = (CONFIGURATION_ENTRY*)(header + 1);
 
   auto stringDest = &outBuffer[0] + sizeof(CONFIGURATION_HEADER) +
-                    (sizeof(CONFIGURATION_ENTRY) * dosPaths.size());
+                    (sizeof(CONFIGURATION_ENTRY) * appPaths.size());
 
   SIZE_T stringOffset = 0;
 
@@ -473,7 +437,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
     stringOffset += stringLength;
   }
 
-  header->NumEntries = dosPaths.length();
+  header->NumEntries = appPaths.length();
   header->TotalLength = bufferSize;
 
   return outBuffer;
@@ -485,7 +449,9 @@ std::vector<std::byte> WindowsSplitTunnel::generateIPConfiguration(
 
   auto config = reinterpret_cast<IP_ADDRESSES_CONFIG*>(&out[0]);
 
-  if (vpnAdapterIndex == 0) {
+  auto ifaces = QNetworkInterface::allInterfaces();
+
+    if (vpnAdapterIndex == 0) {
     vpnAdapterIndex = WindowsCommons::VPNAdapterIndex();
   }
   // Always the VPN
@@ -554,7 +520,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateProcessBlob() {
     auto process_handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE,
                                       currentProcess.th32ProcessID);
 
-    if (process_handle == nullptr) {
+    if (process_handle == INVALID_HANDLE_VALUE) {
       continue;
     }
     ProcessInfo info = getProcessInfo(process_handle, currentProcess);
@@ -674,48 +640,23 @@ bool WindowsSplitTunnel::isInstalled() {
 }
 
 QString WindowsSplitTunnel::convertPath(const QString& path) {
-  const QString normalizedPath = normalizeExecutablePath(path);
-  if (normalizedPath.isEmpty()) {
-    logger.error() << "Empty executable path for DOS device conversion";
-    return "";
-  }
-  auto parts = normalizedPath.split("\\", Qt::SkipEmptyParts);
-  if (parts.isEmpty()) {
-    logger.error() << "Invalid executable path for DOS device conversion:"
-                   << normalizedPath;
-    return "";
-  }
+  auto parts = path.split("/");
   QString driveLetter = parts.takeFirst();
   if (!driveLetter.contains(":") || parts.size() == 0) {
     // device should contain : for e.g C:
-    logger.error() << "Invalid executable path for DOS device conversion:"
-                   << normalizedPath;
     return "";
   }
-  QByteArray buffer(2048 * sizeof(wchar_t), 0);
-  DWORD ok = 0;
-  DWORD err = ERROR_SUCCESS;
-  for (int attempt = 0; attempt < 4; ++attempt) {
-    ok = QueryDosDeviceW(reinterpret_cast<LPCWSTR>(driveLetter.utf16()),
-                         reinterpret_cast<LPWSTR>(buffer.data()),
-                         buffer.size() / sizeof(wchar_t));
-    if (ok != 0) {
-      break;
-    }
-    err = GetLastError();
-    if (err != ERROR_INSUFFICIENT_BUFFER) {
-      WindowsUtils::windowsLog("Err fetching dos path");
-      logger.error() << "QueryDosDeviceW failed for" << driveLetter
-                     << "error:" << err;
-      return "";
-    }
+  QByteArray buffer(2048, 0xFFu);
+  auto ok = QueryDosDeviceW(qUtf16Printable(driveLetter),
+                            (wchar_t*)buffer.data(), buffer.size() / 2);
+
+  if (ok == ERROR_INSUFFICIENT_BUFFER) {
     buffer.resize(buffer.size() * 2);
-    buffer.fill(0);
+    ok = QueryDosDeviceW(qUtf16Printable(driveLetter), (wchar_t*)buffer.data(),
+                         buffer.size() / 2);
   }
   if (ok == 0) {
     WindowsUtils::windowsLog("Err fetching dos path");
-    logger.error() << "QueryDosDeviceW failed after buffer growth for"
-                   << driveLetter << "error:" << err;
     return "";
   }
   QString deviceName;

client/server_scripts/check_server_is_busy.sh

@@ -1,8 +1,7 @@
-if which apt-get > /dev/null 2>&1 || command -v apt-get > /dev/null 2>&1; then LOCK_CMD="fuser"; LOCK_FILE="/var/lib/dpkg/lock-frontend";\
-elif which dnf > /dev/null 2>&1 || command -v dnf > /dev/null 2>&1; then LOCK_CMD="fuser"; LOCK_FILE="/var/cache/dnf/* /var/run/dnf/* /var/lib/dnf/* /var/lib/rpm/*";\
-elif which yum > /dev/null 2>&1 || command -v yum > /dev/null 2>&1; then LOCK_CMD="cat"; LOCK_FILE="/var/run/yum.pid";\
-elif which zypper > /dev/null 2>&1 || command -v zypper > /dev/null 2>&1; then LOCK_CMD="cat"; LOCK_FILE="/var/run/zypp.pid";\
-elif which pacman > /dev/null 2>&1 || command -v pacman > /dev/null 2>&1; then LOCK_CMD="fuser"; LOCK_FILE="/var/lib/pacman/db.lck";\
-else echo "Packet manager not found"; echo "Internal error"; exit 1;\
-fi;\
-if sudo -n which $LOCK_CMD > /dev/null 2>&1 || command -v $LOCK_CMD > /dev/null 2>&1; then sudo -n $LOCK_CMD $LOCK_FILE 2>/dev/null; else echo "$LOCK_CMD not installed"; fi
+if which apt-get > /dev/null 2>&1; then LOCK_CMD="fuser"; LOCK_FILE="/var/lib/dpkg/lock-frontend";\
+elif which dnf > /dev/null 2>&1; then LOCK_CMD="fuser"; LOCK_FILE="/var/cache/dnf/* /var/run/dnf/* /var/lib/dnf/* /var/lib/rpm/*";\
+elif which yum > /dev/null 2>&1; then LOCK_CMD="cat"; LOCK_FILE="/var/run/yum.pid";\
+elif which zypper > /dev/null 2>&1; then LOCK_CMD="cat"; LOCK_FILE="/var/run/zypp.pid";\
+elif which pacman > /dev/null 2>&1; then LOCK_CMD="fuser"; LOCK_FILE="/var/lib/pacman/db.lck";\
+else echo "Packet manager not found"; echo "Internal error"; exit 1; fi;\
+if command -v $LOCK_CMD > /dev/null 2>&1; then sudo $LOCK_CMD $LOCK_FILE 2>/dev/null; else echo "$LOCK_CMD not installed"; fi

client/server_scripts/check_user_in_sudo.sh

@@ -1,8 +1,8 @@
-if pm=$(which apt-get 2>/dev/null || command -v apt-get 2>/dev/null); then opt="--version";\
-elif pm=$(which dnf 2>/dev/null || command -v dnf 2>/dev/null); then opt="--version";\
-elif pm=$(which yum 2>/dev/null || command -v yum 2>/dev/null); then opt="--version";\
-elif pm=$(which zypper 2>/dev/null || command -v zypper 2>/dev/null); then opt="--version";\
-elif pm=$(which pacman 2>/dev/null || command -v pacman 2>/dev/null); then opt="--version";\
+if which apt-get > /dev/null 2>&1; then pm=$(which apt-get); opt="--version";\
+elif which dnf > /dev/null 2>&1; then pm=$(which dnf); opt="--version";\
+elif which yum > /dev/null 2>&1; then pm=$(which yum); opt="--version";\
+elif which zypper > /dev/null 2>&1; then pm=$(which zypper); opt="--version";\
+elif which pacman > /dev/null 2>&1; then pm=$(which pacman); opt="--version";\
 else pm="uname"; opt="-a";\
 fi;\
 CUR_USER=$(whoami 2>/dev/null || echo $HOME | sed 's/.*\///');\

client/server_scripts/install_conntrack.sh

@@ -0,0 +1,10 @@
+if command -v conntrack > /dev/null 2>&1; then echo "conntrack already installed"; exit 0; fi;\
+if which apt-get > /dev/null 2>&1; then pm=$(which apt-get); silent_inst="-yq install --install-recommends"; check_pkgs="-yq update"; conntrack_pkg="conntrack"; dist="debian";\
+elif which dnf > /dev/null 2>&1; then pm=$(which dnf); silent_inst="-yq install"; check_pkgs="-yq check-update"; conntrack_pkg="conntrack-tools"; dist="fedora";\
+elif which yum > /dev/null 2>&1; then pm=$(which yum); silent_inst="-y -q install"; check_pkgs="-y -q check-update"; conntrack_pkg="conntrack-tools"; dist="centos";\
+elif which zypper > /dev/null 2>&1; then pm=$(which zypper); silent_inst="-nq install"; check_pkgs="-nq refresh"; conntrack_pkg="conntrack-tools"; dist="opensuse";\
+elif which pacman > /dev/null 2>&1; then pm=$(which pacman); silent_inst="-S --noconfirm --noprogressbar --quiet"; check_pkgs="-Sup"; conntrack_pkg="conntrack-tools"; dist="archlinux";\
+else echo "Packet manager not found"; exit 0; fi;\
+if [ "$dist" = "debian" ]; then export DEBIAN_FRONTEND=noninteractive; fi;\
+sudo $pm $check_pkgs; sudo $pm $silent_inst $conntrack_pkg;\
+command -v conntrack > /dev/null 2>&1 && echo "conntrack installed" || echo "conntrack install failed"

client/server_scripts/install_docker.sh

@@ -1,34 +1,25 @@
-if pm=$(which apt-get 2>/dev/null || command -v apt-get 2>/dev/null); then silent_inst="-yq install --install-recommends"; what_pkg="-s install"; check_pkgs="-yq update"; docker_pkg="docker.io"; dist="debian";\
-elif pm=$(which dnf 2>/dev/null || command -v dnf 2>/dev/null); then silent_inst="-yq install"; what_pkg="--assumeno install --setopt=tsflags=test"; check_pkgs="-yq check-update"; docker_pkg="docker"; dist="fedora";\
-elif pm=$(which yum 2>/dev/null || command -v yum 2>/dev/null); then silent_inst="-y -q install"; what_pkg="--assumeno install --setopt=tsflags=test"; check_pkgs="-y -q check-update"; docker_pkg="docker"; dist="centos";\
-elif pm=$(which zypper 2>/dev/null || command -v zypper 2>/dev/null); then silent_inst="-nq install"; what_pkg="--dry-run install"; check_pkgs="-nq refresh"; docker_pkg="docker"; dist="suse";\
-elif pm=$(which pacman 2>/dev/null || command -v pacman 2>/dev/null); then silent_inst="-S --noconfirm --noprogressbar --quiet"; what_pkg="-Sp"; check_pkgs="-Sup"; docker_pkg="docker"; dist="archlinux";\
-fi;\
-echo "Dist: $dist, Packet manager: $pm, Install command: $silent_inst, What pkg command: $what_pkg, Check pkgs command: $check_pkgs, Docker pkg: $docker_pkg, Language: $LANG";\
-echo $LANG | grep -qE '^(en_US.UTF-8|C.UTF-8|C)$' || export LC_ALL=C;\
+if which apt-get > /dev/null 2>&1; then pm=$(which apt-get); silent_inst="-yq install --install-recommends"; check_pkgs="-yq update"; docker_pkg="docker.io"; dist="debian";\
+elif which dnf > /dev/null 2>&1; then pm=$(which dnf); silent_inst="-yq install"; check_pkgs="-yq check-update"; docker_pkg="docker"; dist="fedora";\
+elif which yum > /dev/null 2>&1; then pm=$(which yum); silent_inst="-y -q install"; check_pkgs="-y -q check-update"; docker_pkg="docker"; dist="centos";\
+elif which zypper > /dev/null 2>&1; then pm=$(which zypper); silent_inst="-nq install"; check_pkgs="-nq refresh"; docker_pkg="docker"; dist="opensuse";\
+elif which pacman > /dev/null 2>&1; then pm=$(which pacman); silent_inst="-S --noconfirm --noprogressbar --quiet"; check_pkgs="-Sup"; docker_pkg="docker"; dist="archlinux";\
+else echo "Packet manager not found"; exit 1; fi;\
+echo "Dist: $dist, Packet manager: $pm, Install command: $silent_inst, Check pkgs command: $check_pkgs, Docker pkg: $docker_pkg";\
 if [ "$dist" = "debian" ]; then export DEBIAN_FRONTEND=noninteractive; fi;\
 if ! command -v sudo > /dev/null 2>&1; then $pm $check_pkgs; $pm $silent_inst sudo; fi;\
-if ! sudo -n sh -c 'command -v which > /dev/null 2>&1'; then sudo -n $pm $check_pkgs; sudo -n $pm $silent_inst which; fi;\
-if ! sudo -n sh -c 'command -v fuser > /dev/null 2>&1'; then sudo -n $pm $check_pkgs; sudo -n $pm $silent_inst psmisc; fi;\
-if ! sudo -n sh -c 'command -v lsof > /dev/null 2>&1'; then sudo -n $pm $check_pkgs; sudo -n $pm $silent_inst lsof; fi;\
-if ! sudo -n sh -c 'command -v docker > /dev/null 2>&1'; then \
-  sudo -n $pm $check_pkgs;\
-  if ! sudo -n $pm $what_pkg $docker_pkg 2>/dev/null | grep -qi podman; then \
-    sudo -n $pm $silent_inst $docker_pkg;\
-    sleep 5; sudo -n systemctl enable --now docker; sleep 5;\
-  else \
-    echo "Container runtime is not supported";\
-    exit 1;\
-  fi;\
+if ! command -v fuser > /dev/null 2>&1; then sudo $pm $check_pkgs; sudo $pm $silent_inst psmisc; fi;\
+if ! command -v lsof > /dev/null 2>&1; then sudo $pm $check_pkgs; sudo $pm $silent_inst lsof; fi;\
+if ! command -v docker > /dev/null 2>&1; then \
+  sudo $pm $check_pkgs; sudo $pm $silent_inst $docker_pkg;\
+  sleep 5; sudo systemctl enable --now docker; sleep 5;\
 fi;\
-if [ "$(sudo -n cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = "Y" ]; then \
-  if ! sudo -n sh -c 'command -v apparmor_parser > /dev/null 2>&1'; then \
-    sudo -n $pm $check_pkgs; sudo -n $pm $silent_inst apparmor;\
-  fi;\
+if [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = "Y" ]; then \
+  if ! command -v apparmor_parser > /dev/null 2>&1; then sudo $pm $check_pkgs; sudo $pm $silent_inst apparmor; fi;\
 fi;\
-if [ "$(sudo -n systemctl is-active docker)" != "active" ]; then \
-  sleep 5; sudo -n systemctl start docker; sleep 5;\
-  if [ "$(sudo -n systemctl is-active docker)" != "active" ]; then echo "Container runtime service not running"; fi;\
+if [ "$(systemctl is-active docker)" != "active" ]; then \
+  sudo $pm $check_pkgs; sudo $pm $silent_inst $docker_pkg;\
+  sleep 5; sudo systemctl start docker; sleep 5;\
 fi;\
-sudo -n docker --version || docker --version;\
+if ! command -v sudo > /dev/null 2>&1; then echo "Failed to install sudo, command not found"; exit 1; fi;\
+docker --version;\
 uname -sr

client/server_scripts/serverScripts.qrc

@@ -18,6 +18,7 @@
         <file>dns/Dockerfile</file>
         <file>dns/run_container.sh</file>
         <file>install_docker.sh</file>
+        <file>install_conntrack.sh</file>
         <file>ipsec/configure_container.sh</file>
         <file>ipsec/Dockerfile</file>
         <file>ipsec/mobileconfig.plist</file>

client/server_scripts/telemt/configure_container.sh

@@ -61,6 +61,12 @@ rm -f /data/config.toml
     echo ""
     echo "[access.users]"
     echo "$TELEMT_USER_NAME = \"$SECRET\""
+    i=1
+    for EXTRA in $(echo "$TELEMT_ADDITIONAL_SECRETS" | tr ',' ' '); do
+        echo "$EXTRA" | grep -qE '^[0-9a-fA-F]{32}$' || continue
+        echo "extra_$i = \"$EXTRA\""
+        i=$((i + 1))
+    done
 } > /data/config.toml
 
 echo "$SECRET" > /data/secret

client/ui/controllers/qml/pageController.cpp

@@ -128,11 +128,6 @@ void PageController::showOnStartup()
     }
 }
 
-bool PageController::shouldStartMinimized() const
-{
-    return m_settingsController->isStartMinimizedEnabled();
-}
-
 bool PageController::isTriggeredByConnectButton()
 {
     return m_isTriggeredByConnectButton;

client/ui/controllers/qml/pageController.h

@@ -123,7 +123,6 @@ public slots:
     void updateNavigationBarColor(const int color);
 
     void showOnStartup();
-    bool shouldStartMinimized() const;
 
     bool isTriggeredByConnectButton();
     void setTriggeredByConnectButton(bool trigger);

client/ui/controllers/selfhosted/exportUiController.cpp

@@ -9,13 +9,6 @@ ExportUiController::ExportUiController(ExportController* exportController, QObje
     : QObject(parent),
       m_exportController(exportController)
 {
-    connect(m_exportController, &ExportController::revokeFinished, this, [this](ErrorCode errorCode) {
-        if (errorCode == ErrorCode::NoError) {
-            emit revokeConfigFinished();
-        } else {
-            emit exportErrorOccurred(errorCode);
-        }
-    });
 }
 
 void ExportUiController::generateFullAccessConfig(const QString &serverId)
@@ -99,6 +92,7 @@ void ExportUiController::updateClientManagementModel(const QString &serverId, in
 void ExportUiController::revokeConfig(int row, const QString &serverId, int containerIndex)
 {
     m_exportController->revokeConfig(row, serverId, containerIndex);
+    emit revokeConfigFinished();
 }
 
 void ExportUiController::renameClient(int row, const QString &clientName, const QString &serverId, int containerIndex)

client/ui/controllers/selfhosted/installUiController.cpp

@@ -9,6 +9,7 @@
 #include <QStandardPaths>
 #include <QFutureWatcher>
 #include <QtConcurrent>
+#include <utility>
 
 #include "core/utils/api/apiUtils.h"
 #include "core/controllers/selfhosted/installController.h"
@@ -306,17 +307,14 @@ void InstallUiController::updateServerConfig(const QString &serverId, int contai
             || container == DockerContainer::Xray || container == DockerContainer::SSXray;
 
     if (asyncUpdate) {
-        const bool emitBusy = container == DockerContainer::MtProxy || container == DockerContainer::Telemt;
-        if (emitBusy)
-            emit serverIsBusy(true);
+        emit serverIsBusy(true);
         auto *watcher = new QFutureWatcher<ErrorCode>(this);
         const Proto protocolTypeCopy = protocolType;
         QObject::connect(watcher, &QFutureWatcher<ErrorCode>::finished, this,
-                         [this, watcher, serverId, container, closePage, protocolTypeCopy, emitBusy]() {
+                         [this, watcher, serverId, container, closePage, protocolTypeCopy]() {
                              const ErrorCode errorCode = watcher->result();
                              watcher->deleteLater();
-                             if (emitBusy)
-                                 emit serverIsBusy(false);
+                             emit serverIsBusy(false);
 
                              if (errorCode == ErrorCode::NoError) {
                                  const ContainerConfig updatedConfig =
@@ -362,17 +360,27 @@ void InstallUiController::setContainerEnabled(const QString &serverId, int conta
     }
 
     emit serverIsBusy(true);
-    const ErrorCode errorCode = m_installController->setDockerContainerEnabledState(serverId, container, enabled);
-    emit serverIsBusy(false);
 
-    if (errorCode == ErrorCode::NoError) {
-        const ContainerConfig currentConfig = m_serversController->getContainerConfig(serverId, container);
-        m_protocolModel->updateModel(currentConfig);
-        emit setContainerEnabledFinished(enabled);
-        return;
-    }
+    InstallController *installController = m_installController;
+    auto *watcher = new QFutureWatcher<ErrorCode>(this);
+    QObject::connect(watcher, &QFutureWatcher<ErrorCode>::finished, this,
+                     [this, watcher, serverId, container, enabled]() {
+                         const ErrorCode errorCode = watcher->result();
+                         watcher->deleteLater();
+                         emit serverIsBusy(false);
 
-    emit installationErrorOccurred(errorCode);
+                         if (errorCode == ErrorCode::NoError) {
+                             const ContainerConfig currentConfig = m_serversController->getContainerConfig(serverId, container);
+                             m_protocolModel->updateModel(currentConfig);
+                             emit setContainerEnabledFinished(enabled);
+                             return;
+                         }
+                         emit installationErrorOccurred(errorCode);
+                     });
+    QFuture<ErrorCode> future = QtConcurrent::run([installController, serverId, container, enabled]() -> ErrorCode {
+        return installController->setDockerContainerEnabledState(serverId, container, enabled);
+    });
+    watcher->setFuture(future);
 }
 
 void InstallUiController::refreshContainerStatus(const QString &serverId, int containerIndex)
@@ -382,13 +390,23 @@ void InstallUiController::refreshContainerStatus(const QString &serverId, int co
         return;
     }
 
-    int status = 3;
-    const ErrorCode errorCode = m_installController->queryDockerContainerStatus(serverId, container, status);
-    if (errorCode != ErrorCode::NoError) {
-        emit containerStatusRefreshed(3);
-        return;
-    }
-    emit containerStatusRefreshed(status);
+    using StatusResult = std::pair<int, int>; // {status, errorCode}
+    InstallController *installController = m_installController;
+    auto *watcher = new QFutureWatcher<StatusResult>(this);
+    QObject::connect(watcher, &QFutureWatcher<StatusResult>::finished, this, [this, watcher]() {
+        const StatusResult result = watcher->result();
+        watcher->deleteLater();
+        emit containerStatusRefreshed(result.first, result.second);
+    });
+    QFuture<StatusResult> future = QtConcurrent::run([installController, serverId, container]() -> StatusResult {
+        int status = 3;
+        const ErrorCode errorCode = installController->queryDockerContainerStatus(serverId, container, status);
+        if (errorCode != ErrorCode::NoError) {
+            return { 3, static_cast<int>(errorCode) };
+        }
+        return { status, static_cast<int>(ErrorCode::NoError) };
+    });
+    watcher->setFuture(future);
 }
 
 void InstallUiController::refreshContainerDiagnostics(const QString &serverId, int containerIndex, int port)
@@ -398,14 +416,27 @@ void InstallUiController::refreshContainerDiagnostics(const QString &serverId, i
         return;
     }
 
-    MtProxyContainerDiagnostics diag;
-    const ErrorCode errorCode = m_installController->queryMtProxyDiagnostics(serverId, container, port, diag);
-    if (errorCode != ErrorCode::NoError) {
-        emit containerDiagnosticsRefreshed(false, false, -1, QString(), QString());
-        return;
-    }
-    emit containerDiagnosticsRefreshed(diag.portReachable, diag.upstreamReachable, diag.clientsConnected,
-                                       diag.lastConfigRefresh, diag.statsEndpoint);
+    using DiagResult = std::pair<bool, MtProxyContainerDiagnostics>;
+    InstallController *installController = m_installController;
+    auto *watcher = new QFutureWatcher<DiagResult>(this);
+    QObject::connect(watcher, &QFutureWatcher<DiagResult>::finished, this, [this, watcher]() {
+        const DiagResult result = watcher->result();
+        watcher->deleteLater();
+        if (!result.first) {
+            emit containerDiagnosticsRefreshed(false, false, -1, QString(), QString());
+            return;
+        }
+        const MtProxyContainerDiagnostics &diag = result.second;
+        emit containerDiagnosticsRefreshed(diag.portReachable, diag.upstreamReachable, diag.clientsConnected,
+                                           diag.lastConfigRefresh, diag.statsEndpoint);
+    });
+    QFuture<DiagResult> future =
+            QtConcurrent::run([installController, serverId, container, port]() -> DiagResult {
+                MtProxyContainerDiagnostics diag;
+                const ErrorCode errorCode = installController->queryMtProxyDiagnostics(serverId, container, port, diag);
+                return { errorCode == ErrorCode::NoError, diag };
+            });
+    watcher->setFuture(future);
 }
 
 void InstallUiController::fetchContainerSecret(const QString &serverId, int containerIndex)
@@ -415,8 +446,17 @@ void InstallUiController::fetchContainerSecret(const QString &serverId, int cont
         return;
     }
 
-    const QString secret = m_installController->fetchDockerContainerSecret(serverId, container);
-    emit containerSecretFetched(secret);
+    InstallController *installController = m_installController;
+    auto *watcher = new QFutureWatcher<QString>(this);
+    QObject::connect(watcher, &QFutureWatcher<QString>::finished, this, [this, watcher]() {
+        const QString secret = watcher->result();
+        watcher->deleteLater();
+        emit containerSecretFetched(secret);
+    });
+    QFuture<QString> future = QtConcurrent::run([installController, serverId, container]() -> QString {
+        return installController->fetchDockerContainerSecret(serverId, container);
+    });
+    watcher->setFuture(future);
 }
 
 void InstallUiController::rebootServer(const QString &serverId)

client/ui/controllers/selfhosted/installUiController.h

@@ -114,7 +114,7 @@ signals:
     void removeAllContainersFinished(const QString &finishedMessage);
     void removeContainerFinished(const QString &finishedMessage);
     void setContainerEnabledFinished(bool enabled);
-    void containerStatusRefreshed(int status);
+    void containerStatusRefreshed(int status, int errorCode);
     void containerDiagnosticsRefreshed(bool portReachable, bool upstreamReachable, int clientsConnected,
                                        const QString &lastConfigRefresh, const QString &statsEndpoint);
     void containerSecretFetched(const QString &secret);

client/ui/models/protocols/xrayConfigModel.cpp

@@ -4,10 +4,6 @@
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
-#include "core/utils/networkUtilities.h"
-
-#include <QHostAddress>
-#include <QRegularExpression>
 
 using namespace amnezia;
 using namespace ProtocolUtils;
@@ -276,7 +272,7 @@ void XrayConfigModel::updateModel(amnezia::DockerContainer container, const amne
     }
 
     if (!m_protocolConfig.serverConfig.isThirdPartyConfig) {
-        applyDefaultsToServerConfig(m_protocolConfig.serverConfig, false);
+        applyDefaultsToServerConfig(m_protocolConfig.serverConfig);
     }
 
     m_originalProtocolConfig = m_protocolConfig;
@@ -287,7 +283,7 @@ void XrayConfigModel::updateModel(amnezia::DockerContainer container, const amne
     }
 }
 
-void XrayConfigModel::applyDefaultsToServerConfig(amnezia::XrayServerConfig &config, bool fillFlowDefault)
+void XrayConfigModel::applyDefaultsToServerConfig(amnezia::XrayServerConfig &config)
 {
     if (config.port.isEmpty()) {
         config.port = protocols::xray::defaultPort;
@@ -310,7 +306,7 @@ void XrayConfigModel::applyDefaultsToServerConfig(amnezia::XrayServerConfig &con
         config.security = protocols::xray::defaultSecurity;
     }
 
-    if (fillFlowDefault && config.flow.isEmpty()) {
+    if (config.flow.isEmpty()) {
         config.flow = protocols::xray::defaultFlow;
     }
 
@@ -589,87 +585,3 @@ QString XrayConfigModel::mkcpDefaultWriteBufferSize()
 {
     return QString::fromLatin1(protocols::xray::defaultMkcpWriteBufferSize);
 }
-
-namespace {
-    bool isValidSingleHost(const QString &t)
-    {
-        if (t.isEmpty() || t.length() > 253) {
-            return false;
-        }
-        QHostAddress a(t);
-        if (a.protocol() == QHostAddress::IPv4Protocol) {
-            return NetworkUtilities::checkIPv4Format(t);
-        }
-        if (a.protocol() == QHostAddress::IPv6Protocol) {
-            return true;
-        }
-        static const QRegularExpression onlyDigits(QStringLiteral(R"(^\d+$)"));
-        if (onlyDigits.match(t).hasMatch()) {
-            return false;
-        }
-        QRegExp re = NetworkUtilities::domainRegExp();
-        re.setCaseSensitivity(Qt::CaseInsensitive);
-        return re.exactMatch(t);
-    }
-}
-
-bool XrayConfigModel::isValidHost(const QString &host)
-{
-    const QString t = host.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    return isValidSingleHost(t);
-}
-
-bool XrayConfigModel::isValidSni(const QString &sni)
-{
-    const QString t = sni.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    if (t.startsWith(QLatin1String("*."))) {
-        return isValidSingleHost(t.mid(2));
-    }
-    return isValidSingleHost(t);
-}
-
-bool XrayConfigModel::isValidPath(const QString &path)
-{
-    const QString t = path.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    return t.startsWith(QLatin1Char('/'));
-}
-
-QStringList XrayConfigModel::validationErrors() const
-{
-    QStringList errs;
-    const auto &srv = m_protocolConfig.serverConfig;
-
-    if (!srv.port.isEmpty()) {
-        bool ok = false;
-        const int p = srv.port.toInt(&ok);
-        if (!ok || p < 1 || p > 65535) {
-            errs << tr("Port must be in the range of 1 to 65535");
-        }
-    }
-
-    if (srv.security == QLatin1String("tls") || srv.security == QLatin1String("reality")) {
-        if (!isValidSni(srv.sni)) {
-            errs << tr("SNI: enter a valid IP address or domain name");
-        }
-    }
-
-    if (srv.transport == QLatin1String("xhttp")) {
-        if (!isValidHost(srv.xhttp.host)) {
-            errs << tr("Host: enter a valid IP address or domain name");
-        }
-        if (!isValidPath(srv.xhttp.path)) {
-            errs << tr("Path must start with \"/\"");
-        }
-    }
-
-    return errs;
-}

client/ui/models/protocols/xrayConfigModel.h

@@ -118,11 +118,6 @@ public:
     Q_INVOKABLE static QString mkcpDefaultReadBufferSize();
     Q_INVOKABLE static QString mkcpDefaultWriteBufferSize();
 
-    Q_INVOKABLE static bool isValidHost(const QString &host);
-    Q_INVOKABLE static bool isValidSni(const QString &sni);
-    Q_INVOKABLE static bool isValidPath(const QString &path);
-    Q_INVOKABLE QStringList validationErrors() const;
-
 public slots:
     void updateModel(amnezia::DockerContainer container, const amnezia::XrayProtocolConfig& protocolConfig);
     amnezia::XrayProtocolConfig getProtocolConfig();
@@ -142,7 +137,7 @@ private:
     amnezia::XrayProtocolConfig m_protocolConfig;
     amnezia::XrayProtocolConfig m_originalProtocolConfig;
 
-    void applyDefaultsToServerConfig(amnezia::XrayServerConfig& config, bool fillFlowDefault = true);
+    void applyDefaultsToServerConfig(amnezia::XrayServerConfig& config);
 };
 
 #endif // XRAYCONFIGMODEL_H

client/ui/models/services/mtProxyConfigModel.cpp

@@ -8,8 +8,6 @@
 #include "core/utils/constants/configKeys.h"
 #include "qrcodegen.hpp"
 
-#include <QClipboard>
-#include <QGuiApplication>
 #include <QHostAddress>
 #include <QRegExp>
 #include <QRegularExpression>
@@ -332,7 +330,7 @@ void MtProxyConfigModel::removeAdditionalSecret(int idx) {
 QVariantList MtProxyConfigModel::additionalSecretsList() const {
     QVariantList out;
     out.reserve(m_protocolConfig.additionalSecrets.size());
-    for (const auto &s: m_protocolConfig.additionalSecrets) {
+    for (const auto &s : m_protocolConfig.additionalSecrets) {
         if (!s.isEmpty()) {
             out.append(s);
         }
@@ -398,6 +396,9 @@ bool MtProxyConfigModel::isValidPublicHost(const QString &host) const {
         return NetworkUtilities::checkIPv4Format(t);
     }
     if (a.protocol() == QHostAddress::IPv6Protocol) {
+        if (a.isNull() || a.isLoopback() || a == QHostAddress(QHostAddress::AnyIPv6)) {
+            return false;
+        }
         return true;
     }
     static const QRegularExpression onlyAsciiDigits(QStringLiteral(R"(^\d+$)"));
@@ -504,20 +505,12 @@ bool MtProxyConfigModel::isValidFakeTlsDomain(const QString &domain) const {
     if (!re.exactMatch(t)) {
         return false;
     }
-    // ee + 32 hex (base secret) + hex(UTF-8 domain); keep headroom under typical client limits.
     if (t.toUtf8().size() > 111) {
         return false;
     }
     return true;
 }
 
-QString MtProxyConfigModel::clipboardText() const {
-    if (QClipboard *c = QGuiApplication::clipboard()) {
-        return c->text();
-    }
-    return QString();
-}
-
 QString MtProxyConfigModel::sanitizeFakeTlsDomainFieldText(const QString &input) const {
     const QString t = normalizeFakeTlsDomainInput(input);
     QString out;
@@ -578,7 +571,6 @@ QString MtProxyConfigModel::sanitizeMtProxyTagFieldText(const QString &input) co
     if (trimmed.startsWith(QLatin1String("0x"), Qt::CaseInsensitive)) {
         trimmed = trimmed.mid(2).trimmed();
     }
-    // Prefer a contiguous 32-hex run (paste from bot message with extra text).
     static const QRegularExpression runHex(QStringLiteral(R"(([0-9a-fA-F]{32}))"));
     const QRegularExpressionMatch m = runHex.match(trimmed);
     if (m.hasMatch()) {
@@ -599,18 +591,6 @@ QString MtProxyConfigModel::sanitizeMtProxyTagFieldText(const QString &input) co
     return out;
 }
 
-QString MtProxyConfigModel::sanitizeWorkersFieldText(const QString &input) const {
-    QString out;
-    out.reserve(qMin(input.size(), 3));
-    for (const QChar &c: input) {
-        const ushort u = c.unicode();
-        if (u >= '0' && u <= '9' && out.size() < 3) {
-            out.append(c);
-        }
-    }
-    return out;
-}
-
 QString MtProxyConfigModel::sanitizeOptionalIpv4FieldText(const QString &input) const {
     QString out;
     out.reserve(qMin(input.size(), 15));

client/ui/models/services/mtProxyConfigModel.h

@@ -128,16 +128,12 @@ public slots:
 
     Q_INVOKABLE bool isFakeTlsDomainInputAllowed(const QString &text) const;
 
-    Q_INVOKABLE QString clipboardText() const;
-
     Q_INVOKABLE QString sanitizePublicHostFieldText(const QString &input) const;
 
     Q_INVOKABLE QString sanitizePortFieldText(const QString &input) const;
 
     Q_INVOKABLE QString sanitizeMtProxyTagFieldText(const QString &input) const;
 
-    Q_INVOKABLE QString sanitizeWorkersFieldText(const QString &input) const;
-
     Q_INVOKABLE QString sanitizeOptionalIpv4FieldText(const QString &input) const;
 
     Q_INVOKABLE bool isFakeTlsDomainTypingIncomplete(const QString &text) const;

client/ui/models/services/telemtConfigModel.cpp

@@ -1,7 +1,13 @@
 #include "telemtConfigModel.h"
 
-#include <QRegularExpression>
+#include "ui/models/utils/mtproxy_public_host_input.h"
 
+#include <QHostAddress>
+#include <QRegExp>
+#include <QRegularExpression>
+#include <qqml.h>
+
+#include "core/utils/networkUtilities.h"
 #include "core/utils/qrCodeUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
@@ -9,7 +15,9 @@
 
 using namespace amnezia;
 
-TelemtConfigModel::TelemtConfigModel(QObject *parent) : QAbstractListModel(parent) {}
+TelemtConfigModel::TelemtConfigModel(QObject *parent) : QAbstractListModel(parent) {
+    qmlRegisterType<PublicHostInputValidator>("TelemtConfig", 1, 0, "PublicHostInputValidator");
+}
 
 void TelemtConfigModel::applyDefaults(TelemtProtocolConfig &c) {
     if (c.port.isEmpty()) {
@@ -49,7 +57,11 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::TagRole: {
-            m_protocolConfig.tag = value.toString();
+            const QString tag = sanitizeMtProxyTagFieldText(value.toString());
+            if (!isValidMtProxyTag(tag)) {
+                return false;
+            }
+            m_protocolConfig.tag = tag;
             break;
         }
         case Roles::IsEnabledRole: {
@@ -57,7 +69,11 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::PublicHostRole: {
-            m_protocolConfig.publicHost = value.toString();
+            const QString h = value.toString().trimmed();
+            if (!isValidPublicHost(h)) {
+                return false;
+            }
+            m_protocolConfig.publicHost = h;
             break;
         }
         case Roles::TransportModeRole: {
@@ -65,7 +81,11 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::TlsDomainRole: {
-            m_protocolConfig.tlsDomain = value.toString();
+            const QString d = value.toString().trimmed();
+            if (!isValidFakeTlsDomain(d)) {
+                return false;
+            }
+            m_protocolConfig.tlsDomain = d;
             break;
         }
         case Roles::AdditionalSecretsRole: {
@@ -85,11 +105,19 @@ bool TelemtConfigModel::setData(const QModelIndex &index, const QVariant &value,
             break;
         }
         case Roles::NatInternalIpRole: {
-            m_protocolConfig.natInternalIp = value.toString();
+            const QString ip = value.toString().trimmed();
+            if (!isValidOptionalIpv4(ip)) {
+                return false;
+            }
+            m_protocolConfig.natInternalIp = ip;
             break;
         }
         case Roles::NatExternalIpRole: {
-            m_protocolConfig.natExternalIp = value.toString();
+            const QString ip = value.toString().trimmed();
+            if (!isValidOptionalIpv4(ip)) {
+                return false;
+            }
+            m_protocolConfig.natExternalIp = ip;
             break;
         }
         case Roles::MaskEnabledRole: {
@@ -238,7 +266,7 @@ void TelemtConfigModel::setSecret(const QString &secret) {
 }
 
 bool TelemtConfigModel::validateAndSetSecret(const QString &rawSecret) {
-    if (!QRegularExpression(QStringLiteral("^[0-9a-fA-F]{32}$")).match(rawSecret).hasMatch()) {
+    if (!QRegularExpression("^[0-9a-fA-F]{32}$").match(rawSecret).hasMatch()) {
         return false;
     }
     setData(index(0), rawSecret, SecretRole);
@@ -254,7 +282,11 @@ void TelemtConfigModel::setTag(const QString &tag) {
 }
 
 void TelemtConfigModel::setPublicHost(const QString &host) {
-    setData(index(0), host, PublicHostRole);
+    const QString t = host.trimmed();
+    if (!isValidPublicHost(t)) {
+        return;
+    }
+    setData(index(0), t, PublicHostRole);
 }
 
 void TelemtConfigModel::setTransportMode(const QString &mode) {
@@ -262,13 +294,15 @@ void TelemtConfigModel::setTransportMode(const QString &mode) {
 }
 
 QString TelemtConfigModel::getTransportMode() const {
-    return m_protocolConfig.transportMode.isEmpty() ? QString::fromUtf8(protocols::telemt::transportModeStandard)
-                                                    : m_protocolConfig.transportMode;
+    return m_protocolConfig.transportMode.isEmpty()
+           ? QString(protocols::telemt::transportModeStandard)
+           : m_protocolConfig.transportMode;
 }
 
 QString TelemtConfigModel::getTlsDomain() const {
-    return m_protocolConfig.tlsDomain.isEmpty() ? QString::fromUtf8(protocols::telemt::defaultTlsDomain)
-                                                : m_protocolConfig.tlsDomain;
+    return m_protocolConfig.tlsDomain.isEmpty()
+           ? QString(protocols::telemt::defaultTlsDomain)
+           : m_protocolConfig.tlsDomain;
 }
 
 QString TelemtConfigModel::getPublicHost() const {
@@ -276,7 +310,11 @@ QString TelemtConfigModel::getPublicHost() const {
 }
 
 void TelemtConfigModel::setTlsDomain(const QString &domain) {
-    setData(index(0), domain, TlsDomainRole);
+    const QString t = domain.trimmed();
+    if (!isValidFakeTlsDomain(t)) {
+        return;
+    }
+    setData(index(0), t, TlsDomainRole);
 }
 
 void TelemtConfigModel::setWorkersMode(const QString &mode) {
@@ -292,11 +330,19 @@ void TelemtConfigModel::setNatEnabled(bool enabled) {
 }
 
 void TelemtConfigModel::setNatInternalIp(const QString &ip) {
-    setData(index(0), ip, NatInternalIpRole);
+    const QString t = ip.trimmed();
+    if (!isValidOptionalIpv4(t)) {
+        return;
+    }
+    setData(index(0), t, NatInternalIpRole);
 }
 
 void TelemtConfigModel::setNatExternalIp(const QString &ip) {
-    setData(index(0), ip, NatExternalIpRole);
+    const QString t = ip.trimmed();
+    if (!isValidOptionalIpv4(t)) {
+        return;
+    }
+    setData(index(0), t, NatExternalIpRole);
 }
 
 void TelemtConfigModel::setMaskEnabled(bool enabled) {
@@ -334,6 +380,17 @@ void TelemtConfigModel::removeAdditionalSecret(int idx) {
     emit dataChanged(index(0), index(0), QList<int>{AdditionalSecretsRole});
 }
 
+QVariantList TelemtConfigModel::additionalSecretsList() const {
+    QVariantList out;
+    out.reserve(m_protocolConfig.additionalSecrets.size());
+    for (const auto &s : m_protocolConfig.additionalSecrets) {
+        if (!s.isEmpty()) {
+            out.append(s);
+        }
+    }
+    return out;
+}
+
 void TelemtConfigModel::setEnabled(bool enabled) {
     m_protocolConfig.isEnabled = enabled;
     emit dataChanged(index(0), index(0), QList<int>{IsEnabledRole});
@@ -348,15 +405,15 @@ QString TelemtConfigModel::generateQrCode(const QString &text) {
 }
 
 QString TelemtConfigModel::defaultTlsDomain() const {
-    return QString::fromUtf8(protocols::telemt::defaultTlsDomain);
+    return protocols::telemt::defaultTlsDomain;
 }
 
 QString TelemtConfigModel::defaultPort() const {
-    return QString::fromUtf8(protocols::telemt::defaultPort);
+    return protocols::telemt::defaultPort;
 }
 
 QString TelemtConfigModel::defaultWorkers() const {
-    return QString::fromUtf8(protocols::telemt::defaultWorkers);
+    return protocols::telemt::defaultWorkers;
 }
 
 int TelemtConfigModel::maxWorkers() const {
@@ -364,19 +421,303 @@ int TelemtConfigModel::maxWorkers() const {
 }
 
 QString TelemtConfigModel::transportModeStandard() const {
-    return QString::fromUtf8(protocols::telemt::transportModeStandard);
+    return protocols::telemt::transportModeStandard;
 }
 
 QString TelemtConfigModel::transportModeFakeTLS() const {
-    return QString::fromUtf8(protocols::telemt::transportModeFakeTLS);
+    return protocols::telemt::transportModeFakeTLS;
 }
 
 QString TelemtConfigModel::workersModeAuto() const {
-    return QString::fromUtf8(protocols::telemt::workersModeAuto);
+    return protocols::telemt::workersModeAuto;
 }
 
 QString TelemtConfigModel::workersModeManual() const {
-    return QString::fromUtf8(protocols::telemt::workersModeManual);
+    return protocols::telemt::workersModeManual;
+}
+
+bool TelemtConfigModel::isValidPublicHost(const QString &host) const {
+    const QString t = host.trimmed();
+    if (t.isEmpty()) {
+        return true;
+    }
+    if (t.length() > 253) {
+        return false;
+    }
+    QHostAddress a(t);
+    if (a.protocol() == QHostAddress::IPv4Protocol) {
+        return NetworkUtilities::checkIPv4Format(t);
+    }
+    if (a.protocol() == QHostAddress::IPv6Protocol) {
+        if (a.isNull() || a.isLoopback() || a == QHostAddress(QHostAddress::AnyIPv6)) {
+            return false;
+        }
+        return true;
+    }
+    static const QRegularExpression onlyAsciiDigits(QStringLiteral(R"(^\d+$)"));
+    if (onlyAsciiDigits.match(t).hasMatch()) {
+        return false;
+    }
+    return NetworkUtilities::domainRegExp().exactMatch(t);
+}
+
+bool TelemtConfigModel::isPublicHostInputAllowed(const QString &text) const {
+    return mtproxyPublicHostInputAllowed(text);
+}
+
+bool TelemtConfigModel::isPublicHostTypingIncomplete(const QString &text) const {
+    const QString t = text.trimmed();
+    if (isValidPublicHost(t)) {
+        return false;
+    }
+
+    static const QRegularExpression onlyDigitDot(QStringLiteral(R"(^[0-9.]+$)"));
+    if (onlyDigitDot.match(t).hasMatch()) {
+        if (t.endsWith(QLatin1Char('.'))) {
+            return true;
+        }
+        const QStringList parts = t.split(QLatin1Char('.'), Qt::KeepEmptyParts);
+        if (parts.size() < 4) {
+            return true;
+        }
+        for (const QString &part: parts) {
+            if (part.isEmpty()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    if (t.contains(QLatin1Char(':'))) {
+        if (t.contains(QLatin1String(":::"))) {
+            return false;
+        }
+        if (t.endsWith(QLatin1Char(':'))) {
+            return true;
+        }
+        QHostAddress a(t);
+        if (a.protocol() == QHostAddress::IPv6Protocol) {
+            return false;
+        }
+        if (!t.contains(QLatin1String("::")) && t.count(QLatin1Char(':')) < 7 && !t.contains(QLatin1Char('.'))) {
+            return true;
+        }
+        return false;
+    }
+
+    if (!t.contains(QLatin1Char('.'))) {
+        return true;
+    }
+
+    return false;
+}
+
+bool TelemtConfigModel::isValidMtProxyTag(const QString &tag) const {
+    if (tag.isEmpty()) {
+        return true;
+    }
+    static const QRegularExpression re(
+            QStringLiteral("^([0-9a-fA-F]{%1})$").arg(protocols::telemt::botTagHexLength));
+    return re.match(tag).hasMatch();
+}
+
+bool TelemtConfigModel::isMtProxyTagTypingIncomplete(const QString &text) const {
+    const QString t = text.trimmed();
+    if (t.isEmpty()) {
+        return true;
+    }
+    static const QRegularExpression hexOnly(QStringLiteral(R"(^[0-9a-fA-F]*$)"));
+    if (!hexOnly.match(t).hasMatch()) {
+        return false;
+    }
+    return t.size() < protocols::telemt::botTagHexLength;
+}
+
+int TelemtConfigModel::mtProxyBotTagHexLength() const {
+    return protocols::telemt::botTagHexLength;
+}
+
+bool TelemtConfigModel::isValidFakeTlsDomain(const QString &domain) const {
+    const QString t = domain.trimmed();
+    if (t.isEmpty()) {
+        return true;
+    }
+    if (t.length() > 253) {
+        return false;
+    }
+    QHostAddress addr;
+    if (addr.setAddress(t)) {
+        return false;
+    }
+    static const QRegularExpression onlyAsciiDigits(QStringLiteral(R"(^\d+$)"));
+    if (onlyAsciiDigits.match(t).hasMatch()) {
+        return false;
+    }
+    QRegExp re(NetworkUtilities::domainRegExp());
+    re.setCaseSensitivity(Qt::CaseInsensitive);
+    if (!re.exactMatch(t)) {
+        return false;
+    }
+    if (t.toUtf8().size() > 111) {
+        return false;
+    }
+    return true;
+}
+
+QString TelemtConfigModel::normalizeFakeTlsDomainInput(const QString &input) const {
+    QString t = input.trimmed();
+    if (t.startsWith(QLatin1String("https://"), Qt::CaseInsensitive)) {
+        t = t.mid(8);
+    } else if (t.startsWith(QLatin1String("http://"), Qt::CaseInsensitive)) {
+        t = t.mid(7);
+    }
+    if (const int slash = t.indexOf(QLatin1Char('/')); slash >= 0) {
+        t = t.left(slash);
+    }
+    if (const int at = t.indexOf(QLatin1Char('@')); at >= 0) {
+        t = t.mid(at + 1);
+    }
+    if (const int colon = t.indexOf(QLatin1Char(':')); colon >= 0) {
+        t = t.left(colon);
+    }
+    if (t.startsWith(QLatin1String("www."), Qt::CaseInsensitive)) {
+        const QString rest = t.mid(4);
+        if (rest.contains(QLatin1Char('.'))) {
+            t = rest;
+        }
+    }
+    return t.trimmed();
+}
+
+bool TelemtConfigModel::isFakeTlsDomainTypingIncomplete(const QString &text) const {
+    const QString t = text.trimmed();
+    if (t.isEmpty()) {
+        return true;
+    }
+    if (isValidFakeTlsDomain(t)) {
+        return false;
+    }
+    if (t.contains(QLatin1Char('/')) || t.contains(QLatin1Char(':')) || t.contains(QLatin1Char('@'))
+        || t.contains(QLatin1Char(' '))) {
+        return false;
+    }
+    if (t.contains(QLatin1String(".."))) {
+        return false;
+    }
+    if (!t.contains(QLatin1Char('.'))) {
+        return true;
+    }
+    if (t.endsWith(QLatin1Char('.'))) {
+        return true;
+    }
+    static const QRegularExpression legalPartial(QStringLiteral(R"(^[a-zA-Z0-9.-]*$)"));
+    if (!legalPartial.match(t).hasMatch()) {
+        return false;
+    }
+    return true;
+}
+
+bool TelemtConfigModel::isFakeTlsDomainInputAllowed(const QString &text) const {
+    if (text.length() > 253) {
+        return false;
+    }
+    static const QRegularExpression re(QStringLiteral(R"(^[a-zA-Z0-9.-]*$)"));
+    return re.match(text).hasMatch();
+}
+
+QString TelemtConfigModel::sanitizeFakeTlsDomainFieldText(const QString &input) const {
+    const QString t = normalizeFakeTlsDomainInput(input);
+    QString out;
+    out.reserve(t.size());
+    for (const QChar &c: t) {
+        const ushort u = c.unicode();
+        const bool letter = (u >= 'a' && u <= 'z') || (u >= 'A' && u <= 'Z');
+        const bool digit = (u >= '0' && u <= '9');
+        if (letter || digit || u == '.' || u == '-') {
+            out.append(c);
+        }
+    }
+    if (out.size() > 253) {
+        out.truncate(253);
+    }
+    return out;
+}
+
+QString TelemtConfigModel::sanitizePublicHostFieldText(const QString &input) const {
+    QString out;
+    const int cap = qMin(input.size(), 253);
+    out.reserve(cap);
+    for (const QChar &c: input) {
+        if (out.size() >= 253) {
+            break;
+        }
+        const ushort u = c.unicode();
+        if ((u >= 'a' && u <= 'z') || (u >= 'A' && u <= 'Z') || (u >= '0' && u <= '9') || u == '.' || u == ':' ||
+            u == '-') {
+            out.append(c);
+        }
+    }
+    return out;
+}
+
+QString TelemtConfigModel::sanitizePortFieldText(const QString &input) const {
+    QString out;
+    out.reserve(qMin(input.size(), 5));
+    for (const QChar &c: input) {
+        const ushort u = c.unicode();
+        if (u >= '0' && u <= '9' && out.size() < 5) {
+            out.append(c);
+        }
+    }
+    return out;
+}
+
+QString TelemtConfigModel::sanitizeMtProxyTagFieldText(const QString &input) const {
+    QString trimmed = input.trimmed();
+    if (trimmed.startsWith(QLatin1String("0x"), Qt::CaseInsensitive)) {
+        trimmed = trimmed.mid(2).trimmed();
+    }
+    static const QRegularExpression runHex(QStringLiteral(R"(([0-9a-fA-F]{32}))"));
+    const QRegularExpressionMatch m = runHex.match(trimmed);
+    if (m.hasMatch()) {
+        return m.captured(1);
+    }
+    const int cap = protocols::telemt::botTagHexLength;
+    QString out;
+    out.reserve(qMin(trimmed.size(), cap));
+    for (const QChar &c: trimmed) {
+        if (out.size() >= cap) {
+            break;
+        }
+        const ushort u = c.unicode();
+        if ((u >= '0' && u <= '9') || (u >= 'a' && u <= 'f') || (u >= 'A' && u <= 'F')) {
+            out.append(c);
+        }
+    }
+    return out;
+}
+
+QString TelemtConfigModel::sanitizeOptionalIpv4FieldText(const QString &input) const {
+    QString out;
+    out.reserve(qMin(input.size(), 15));
+    for (const QChar &c: input) {
+        if (out.size() >= 15) {
+            break;
+        }
+        const ushort u = c.unicode();
+        if ((u >= '0' && u <= '9') || u == '.') {
+            out.append(c);
+        }
+    }
+    return out;
+}
+
+bool TelemtConfigModel::isValidOptionalIpv4(const QString &ip) const {
+    const QString t = ip.trimmed();
+    if (t.isEmpty()) {
+        return true;
+    }
+    return NetworkUtilities::checkIPv4Format(t);
 }
 
 QHash<int, QByteArray> TelemtConfigModel::roleNames() const {

client/ui/models/services/telemtConfigModel.h

@@ -88,6 +88,8 @@ public slots:
 
     Q_INVOKABLE void removeAdditionalSecret(int idx);
 
+    Q_INVOKABLE QVariantList additionalSecretsList() const;
+
     Q_INVOKABLE QString generateQrCode(const QString &text);
 
     Q_INVOKABLE void setEnabled(bool enabled);
@@ -116,12 +118,44 @@ public slots:
 
     Q_INVOKABLE QString workersModeManual() const;
 
+    Q_INVOKABLE bool isValidPublicHost(const QString &host) const;
+
+    Q_INVOKABLE bool isPublicHostInputAllowed(const QString &text) const;
+
+    Q_INVOKABLE bool isPublicHostTypingIncomplete(const QString &text) const;
+
+    Q_INVOKABLE bool isValidMtProxyTag(const QString &tag) const;
+
+    Q_INVOKABLE bool isMtProxyTagTypingIncomplete(const QString &text) const;
+
+    Q_INVOKABLE int mtProxyBotTagHexLength() const;
+
+    Q_INVOKABLE bool isValidFakeTlsDomain(const QString &domain) const;
+
+    Q_INVOKABLE bool isFakeTlsDomainTypingIncomplete(const QString &text) const;
+
+    Q_INVOKABLE bool isFakeTlsDomainInputAllowed(const QString &text) const;
+
+    Q_INVOKABLE QString sanitizeFakeTlsDomainFieldText(const QString &input) const;
+
+    Q_INVOKABLE QString sanitizePublicHostFieldText(const QString &input) const;
+
+    Q_INVOKABLE QString sanitizePortFieldText(const QString &input) const;
+
+    Q_INVOKABLE QString sanitizeMtProxyTagFieldText(const QString &input) const;
+
+    Q_INVOKABLE QString sanitizeOptionalIpv4FieldText(const QString &input) const;
+
+    Q_INVOKABLE bool isValidOptionalIpv4(const QString &ip) const;
+
 protected:
     QHash<int, QByteArray> roleNames() const override;
 
 private:
     static void applyDefaults(amnezia::TelemtProtocolConfig &c);
 
+    QString normalizeFakeTlsDomainInput(const QString &input) const;
+
     amnezia::DockerContainer m_container = amnezia::DockerContainer::None;
     QJsonObject m_fullConfig;
     amnezia::TelemtProtocolConfig m_protocolConfig;

client/ui/qml/Controls2/DropDownType.qml

@@ -42,7 +42,6 @@ Item {
     property int rootButtonTextBottomMargin: 16
 
     property real drawerHeight: 0.9
-    property bool fitContent: false
     property Item drawerParent
     property Component listView
 
@@ -220,20 +219,12 @@ Item {
         parent: drawerParent
 
         anchors.fill: parent
-        property real measuredContentHeight: 0
-        expandedHeight: (root.fitContent && measuredContentHeight > 0)
-            ? Math.min(measuredContentHeight, drawerParent.height * root.drawerHeight)
-            : drawerParent.height * root.drawerHeight
+        expandedHeight: drawerParent.height * drawerHeight
 
         expandedStateContent: Item {
             id: container
             implicitHeight: menu.expandedHeight
 
-            property real fitHeight: backButton.implicitHeight + titleLabel.implicitHeight
-                                     + (listViewLoader.item ? listViewLoader.item.contentHeight : 0) + 48
-            onFitHeightChanged: menu.measuredContentHeight = fitHeight
-            Component.onCompleted: menu.measuredContentHeight = fitHeight
-
             ColumnLayout {
                 id: header
 
@@ -247,7 +238,6 @@ Item {
                 }
 
                 Header2Type {
-                    id: titleLabel
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.bottomMargin: 16

client/ui/qml/Controls2/MinMaxRowType.qml

@@ -12,8 +12,8 @@ import "../Controls2/TextTypes"
 //   MinMaxRowType {
 //       minValue: "0"
 //       maxValue: "0"
-//       onMinChanged: function(val) { someProperty = val }
-//       onMaxChanged: function(val) { someProperty = val }
+//       onMinChanged: someProperty = val
+//       onMaxChanged: someProperty = val
 //   }
 Item {
     id: root
@@ -21,128 +21,41 @@ Item {
     property string minValue: "0"
     property string maxValue: "0"
 
-    property int minLimit: 0
-    property int maxLimit: 2147483647
-
-    property string hintText: root.minLimit > 0
-                              ? (root.minLimit + "–" + root.maxLimit)
-                              : ("≤ " + root.maxLimit)
-
     signal minChanged(string val)
     signal maxChanged(string val)
-    signal edited()
 
-    implicitHeight: col.implicitHeight
-    implicitWidth: col.implicitWidth
+    implicitHeight: row.implicitHeight
+    implicitWidth: row.implicitWidth
 
-    function clampValue(text) {
-        if (text === "")
-            return ""
-        var n = parseInt(text, 10)
-        if (isNaN(n))
-            return ""
-        if (n < root.minLimit)
-            n = root.minLimit
-        if (n > root.maxLimit)
-            n = root.maxLimit
-        return String(n)
-    }
-
-    function capEdit(tf, holder) {
-        if (tf.text !== "" && parseInt(tf.text, 10) > root.maxLimit) {
-            tf.text = holder.lastValid
-            tf.cursorPosition = tf.text.length
-        } else {
-            holder.lastValid = tf.text
-        }
-    }
-
-    ColumnLayout {
-        id: col
+    RowLayout {
+        id: row
         anchors.fill: parent
-        spacing: 4
+        spacing: 10
 
-        RowLayout {
-            id: row
+        // Min field
+        TextFieldWithHeaderType {
             Layout.fillWidth: true
-            spacing: 10
-
-            // Min field
-            TextFieldWithHeaderType {
-                id: minField
-                property string lastValid: ""
-                Layout.fillWidth: true
-                headerText: qsTr("Min")
-                textField.maximumLength: 10
-                textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                textField.onActiveFocusChanged: {
-                    if (minField.textField.activeFocus)
-                        minField.lastValid = minField.textField.text
-                }
-                textField.onTextEdited: { root.capEdit(minField.textField, minField); root.edited() }
-                textField.onEditingFinished: {
-                    var v = root.clampValue(minField.textField.text)
-                    if (v !== "" && root.maxValue !== "") {
-                        var mx = parseInt(root.maxValue, 10)
-                        if (!isNaN(mx) && parseInt(v, 10) > mx)
-                            root.maxChanged(v)
-                    }
-                    if (v !== root.minValue)
-                        root.minChanged(v)
-                    else if (minField.textField.text !== v)
-                        minField.textField.text = v
-                }
-
-                Binding {
-                    target: minField.textField
-                    property: "text"
-                    value: root.minValue
-                    when: !minField.textField.activeFocus
-                    restoreMode: Binding.RestoreNone
-                }
-            }
-
-            // Max field
-            TextFieldWithHeaderType {
-                id: maxField
-                property string lastValid: ""
-                Layout.fillWidth: true
-                headerText: qsTr("Max")
-                textField.maximumLength: 10
-                textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                textField.onActiveFocusChanged: {
-                    if (maxField.textField.activeFocus)
-                        maxField.lastValid = maxField.textField.text
-                }
-                textField.onTextEdited: { root.capEdit(maxField.textField, maxField); root.edited() }
-                textField.onEditingFinished: {
-                    var v = root.clampValue(maxField.textField.text)
-                    if (v !== "" && root.minValue !== "") {
-                        var mn = parseInt(root.minValue, 10)
-                        if (!isNaN(mn) && parseInt(v, 10) < mn)
-                            v = String(mn)
-                    }
-                    if (v !== root.maxValue)
-                        root.maxChanged(v)
-                    else if (maxField.textField.text !== v)
-                        maxField.textField.text = v
-                }
-
-                Binding {
-                    target: maxField.textField
-                    property: "text"
-                    value: root.maxValue
-                    when: !maxField.textField.activeFocus
-                    restoreMode: Binding.RestoreNone
+            headerText: qsTr("Min")
+            textField.text: root.minValue
+            textField.validator: IntValidator { bottom: 0 }
+            textField.onEditingFinished: {
+                if (textField.text !== root.minValue) {
+                    root.minChanged(textField.text)
                 }
             }
         }
 
-        SmallTextType {
-            visible: root.hintText !== ""
-            text: root.hintText
-            color: AmneziaStyle.color.mutedGray
+        // Max field
+        TextFieldWithHeaderType {
             Layout.fillWidth: true
+            headerText: qsTr("Max")
+            textField.text: root.maxValue
+            textField.validator: IntValidator { bottom: 0 }
+            textField.onEditingFinished: {
+                if (textField.text !== root.maxValue) {
+                    root.maxChanged(textField.text)
+                }
+            }
         }
     }
 }

client/ui/qml/Pages2/PageProtocolXraySecuritySettings.qml

@@ -15,8 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -92,7 +90,6 @@ PageType {
 
                 DropDownType {
                     id: tlsAlpnDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 16
                     Layout.leftMargin: 16
@@ -136,7 +133,6 @@ PageType {
 
                 DropDownType {
                     id: tlsFingerprintDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -179,21 +175,14 @@ PageType {
                 }
 
                 TextFieldWithHeaderType {
-                    id: sniFieldTls
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Server Name (SNI)")
                     textField.text: sni
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9.*_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== sni)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== sni) sni = v
-                        else if (textField.text !== v) textField.text = v
-                        sniFieldTls.errorText = XrayConfigModel.isValidSni(v) ? "" : qsTr("Enter a valid IP address or domain name")
-                        root.editDirty = false
+                        if (textField.text !== sni) sni = textField.text
                     }
                 }
             }
@@ -206,7 +195,6 @@ PageType {
 
                 DropDownType {
                     id: realityFingerprintDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 16
                     Layout.leftMargin: 16
@@ -249,21 +237,14 @@ PageType {
                 }
 
                 TextFieldWithHeaderType {
-                    id: sniFieldReality
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Server Name (SNI)")
                     textField.text: sni
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9.*_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== sni)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== sni) sni = v
-                        else if (textField.text !== v) textField.text = v
-                        sniFieldReality.errorText = XrayConfigModel.isValidSni(v) ? "" : qsTr("Enter a valid IP address or domain name")
-                        root.editDirty = false
+                        if (textField.text !== sni) sni = textField.text
                     }
                 }
             }
@@ -284,15 +265,10 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {
-            var errs = XrayConfigModel.validationErrors()
-            if (errs.length > 0) {
-                PageController.showErrorMessage(errs.join("\n"))
-                return
-            }
             var headerText = qsTr("Save settings?")
             var descriptionText = qsTr("All users with whom you shared a connection with will no longer be able to connect to it.")
             var yesButtonText = qsTr("Continue")

client/ui/qml/Pages2/PageProtocolXraySettings.qml

@@ -109,7 +109,6 @@ PageType {
                 Layout.rightMargin: 16
                 enabled: listView.enabled
                 headerText: qsTr("Port")
-                subtitleText: qsTr("1–65535")
 
                 Binding {
                     target: textFieldWithHeaderType.textField
@@ -120,8 +119,8 @@ PageType {
                 }
 
                 textField.maximumLength: 5
-                textField.validator: RegularExpressionValidator {
-                    regularExpression: /^(|\d{1,4}|[1-5]\d{4}|6[0-4]\d{3}|65[0-4]\d{2}|655[0-2]\d|6553[0-5])$/
+                textField.validator: IntValidator {
+                    bottom: 1; top: 65535
                 }
                 textField.onActiveFocusChanged: {
                     if (textField.activeFocus && textField.text === "" && port !== "") {
@@ -132,19 +131,9 @@ PageType {
                     root.portDirty = (textField.text !== port)
                 }
                 textField.onEditingFinished: {
-                    var v = textFieldWithHeaderType.textField.text
-                    if (v !== "") {
-                        var n = parseInt(v, 10)
-                        if (isNaN(n) || n < 1)
-                            n = 1
-                        if (n > 65535)
-                            n = 65535
-                        v = String(n)
-                        if (textFieldWithHeaderType.textField.text !== v)
-                            textFieldWithHeaderType.textField.text = v
+                    if (textField.text !== port) {
+                        port = textField.text
                     }
-                    if (v !== port)
-                        port = v
                     root.portDirty = false
                 }
                 checkEmptyText: true
@@ -209,11 +198,6 @@ PageType {
                 text: qsTr("Save")
                 onClicked: function() {
                     forceActiveFocus()
-                    var errs = XrayConfigModel.validationErrors()
-                    if (errs.length > 0) {
-                        PageController.showErrorMessage(errs.join("\n"))
-                        return
-                    }
                     var headerText = qsTr("Save settings?")
                     var descriptionText = qsTr("All users with whom you shared a connection with will no longer be able to connect to it.")
                     var yesButtonText = qsTr("Continue")

client/ui/qml/Pages2/PageProtocolXrayTransportSettings.qml

@@ -15,21 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
-    function clampInt(text, lo, hi) {
-        if (text === "")
-            return ""
-        var n = parseInt(text, 10)
-        if (isNaN(n))
-            return ""
-        if (n < lo)
-            n = lo
-        if (n > hi)
-            n = hi
-        return String(n)
-    }
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -123,16 +108,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("TTI")
-                    subtitleText: qsTr("Range 10–100, default %1 ms", "mKCP TTI").arg(XrayConfigModel.mkcpDefaultTti())
+                    subtitleText: qsTr("Default: %1 ms", "mKCP TTI").arg(XrayConfigModel.mkcpDefaultTti())
                     textField.text: mkcpTti
-                    textField.maximumLength: 3
-                    textField.validator: RegularExpressionValidator { regularExpression: /^(|\d{1,2}|100)$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpTti)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 10, 100)
-                        if (v !== mkcpTti) mkcpTti = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpTti) mkcpTti = textField.text
                     }
                 }
 
@@ -142,16 +121,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("uplinkCapacity")
-                    subtitleText: qsTr("≥ 0, default %1 MB/s", "mKCP uplink").arg(XrayConfigModel.mkcpDefaultUplinkCapacity())
+                    subtitleText: qsTr("Default: %1 Mbit/s", "mKCP uplink").arg(XrayConfigModel.mkcpDefaultUplinkCapacity())
                     textField.text: mkcpUplinkCapacity
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpUplinkCapacity)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== mkcpUplinkCapacity) mkcpUplinkCapacity = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpUplinkCapacity) mkcpUplinkCapacity = textField.text
                     }
                 }
 
@@ -161,16 +134,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("downlinkCapacity")
-                    subtitleText: qsTr("≥ 0, default %1 MB/s", "mKCP downlink").arg(XrayConfigModel.mkcpDefaultDownlinkCapacity())
+                    subtitleText: qsTr("Default: %1 Mbit/s", "mKCP downlink").arg(XrayConfigModel.mkcpDefaultDownlinkCapacity())
                     textField.text: mkcpDownlinkCapacity
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpDownlinkCapacity)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== mkcpDownlinkCapacity) mkcpDownlinkCapacity = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpDownlinkCapacity) mkcpDownlinkCapacity = textField.text
                     }
                 }
 
@@ -180,16 +147,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("readBufferSize")
-                    subtitleText: qsTr("≥ 1, default %1 MB").arg(XrayConfigModel.mkcpDefaultReadBufferSize())
+                    subtitleText: qsTr("Default: %1 MiB").arg(XrayConfigModel.mkcpDefaultReadBufferSize())
                     textField.text: mkcpReadBufferSize
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpReadBufferSize)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 1, 2147483647)
-                        if (v !== mkcpReadBufferSize) mkcpReadBufferSize = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpReadBufferSize) mkcpReadBufferSize = textField.text
                     }
                 }
 
@@ -199,16 +160,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("writeBufferSize")
-                    subtitleText: qsTr("≥ 1, default %1 MB").arg(XrayConfigModel.mkcpDefaultWriteBufferSize())
+                    subtitleText: qsTr("Default: %1 MiB").arg(XrayConfigModel.mkcpDefaultWriteBufferSize())
                     textField.text: mkcpWriteBufferSize
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpWriteBufferSize)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 1, 2147483647)
-                        if (v !== mkcpWriteBufferSize) mkcpWriteBufferSize = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpWriteBufferSize) mkcpWriteBufferSize = textField.text
                     }
                 }
 
@@ -232,7 +187,6 @@ PageType {
 
                 DropDownType {
                     id: modeDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 16
                     Layout.leftMargin: 16
@@ -285,46 +239,31 @@ PageType {
                 }
 
                 TextFieldWithHeaderType {
-                    id: hostField
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Host")
                     textField.text: xhttpHost
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9._:,-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpHost)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpHost) xhttpHost = v
-                        else if (textField.text !== v) textField.text = v
-                        hostField.errorText = XrayConfigModel.isValidHost(v) ? "" : qsTr("Enter a valid IP address or domain name")
-                        root.editDirty = false
+                        if (textField.text !== xhttpHost) xhttpHost = textField.text
                     }
                 }
 
                 TextFieldWithHeaderType {
-                    id: pathField
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Path")
                     textField.text: xhttpPath
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9\-._~:\/?#\[\]@!$&'()*+,;=%]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpPath)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpPath) xhttpPath = v
-                        else if (textField.text !== v) textField.text = v
-                        pathField.errorText = XrayConfigModel.isValidPath(v) ? "" : qsTr("Path must start with \"/\"")
-                        root.editDirty = false
+                        if (textField.text !== xhttpPath) xhttpPath = textField.text
                     }
                 }
 
                 DropDownType {
                     id: headersDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -368,7 +307,6 @@ PageType {
 
                 DropDownType {
                     id: uplinkMethodDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -448,7 +386,6 @@ PageType {
 
                 DropDownType {
                     id: sessionPlacementDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -492,7 +429,6 @@ PageType {
 
                 DropDownType {
                     id: sessionKeyDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -536,7 +472,6 @@ PageType {
 
                 DropDownType {
                     id: seqPlacementDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -585,19 +520,13 @@ PageType {
                     Layout.topMargin: 8
                     headerText: qsTr("SeqKey")
                     textField.text: xhttpSeqKey
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpSeqKey)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpSeqKey) xhttpSeqKey = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpSeqKey) xhttpSeqKey = textField.text
                     }
                 }
 
                 DropDownType {
                     id: uplinkDataPlacementDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -646,13 +575,8 @@ PageType {
                     Layout.topMargin: 8
                     headerText: qsTr("UplinkDataKey")
                     textField.text: xhttpUplinkDataKey
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpUplinkDataKey)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpUplinkDataKey) xhttpUplinkDataKey = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpUplinkDataKey) xhttpUplinkDataKey = textField.text
                     }
                 }
 
@@ -673,16 +597,12 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("UplinkChunkSize")
-                    subtitleText: qsTr("≥ 0 (0 = off)")
                     textField.text: xhttpUplinkChunkSize
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpUplinkChunkSize)
+                    textField.validator: IntValidator {
+                        bottom: 0
+                    }
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== xhttpUplinkChunkSize) xhttpUplinkChunkSize = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpUplinkChunkSize) xhttpUplinkChunkSize = textField.text
                     }
                 }
 
@@ -692,16 +612,9 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("scMaxBufferedPosts")
-                    subtitleText: qsTr("≥ 0")
                     textField.text: xhttpScMaxBufferedPosts
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpScMaxBufferedPosts)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== xhttpScMaxBufferedPosts) xhttpScMaxBufferedPosts = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpScMaxBufferedPosts) xhttpScMaxBufferedPosts = textField.text
                     }
                 }
 
@@ -720,9 +633,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xhttpScMaxEachPostBytesMin
                     maxValue: xhttpScMaxEachPostBytesMax
-                    onMinChanged: function(val) { xhttpScMaxEachPostBytesMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xhttpScMaxEachPostBytesMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xhttpScMaxEachPostBytesMin = val
+                    onMaxChanged: xhttpScMaxEachPostBytesMax = val
                 }
 
                 CaptionTextType {
@@ -740,9 +652,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xhttpScStreamUpServerSecsMin
                     maxValue: xhttpScStreamUpServerSecsMax
-                    onMinChanged: function(val) { xhttpScStreamUpServerSecsMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xhttpScStreamUpServerSecsMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xhttpScStreamUpServerSecsMin = val
+                    onMaxChanged: xhttpScStreamUpServerSecsMax = val
                 }
 
                 CaptionTextType {
@@ -760,9 +671,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xhttpScMinPostsIntervalMsMin
                     maxValue: xhttpScMinPostsIntervalMsMax
-                    onMinChanged: function(val) { xhttpScMinPostsIntervalMsMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xhttpScMinPostsIntervalMsMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xhttpScMinPostsIntervalMsMin = val
+                    onMaxChanged: xhttpScMinPostsIntervalMsMax = val
                 }
 
                 // ── Padding and multiplexing ──────────────────────────
@@ -818,15 +728,10 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {
-            var errs = XrayConfigModel.validationErrors()
-            if (errs.length > 0) {
-                PageController.showErrorMessage(errs.join("\n"))
-                return
-            }
             var headerText = qsTr("Save settings?")
             var descriptionText = qsTr("All users with whom you shared a connection with will no longer be able to connect to it.")
             var yesButtonText = qsTr("Continue")

client/ui/qml/Pages2/PageProtocolXrayXPaddingBytesSettings.qml

@@ -15,8 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -63,9 +61,8 @@ PageType {
                 Layout.rightMargin: 16
                 minValue: xPaddingBytesMin
                 maxValue: xPaddingBytesMax
-                onMinChanged: function(val) { xPaddingBytesMin = val; root.editDirty = false }
-                onMaxChanged: function(val) { xPaddingBytesMax = val; root.editDirty = false }
-                onEdited: root.editDirty = true
+                onMinChanged: xPaddingBytesMin = val
+                onMaxChanged: xPaddingBytesMax = val
             }
 
             Item {
@@ -84,7 +81,7 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {

client/ui/qml/Pages2/PageProtocolXrayXPaddingSettings.qml

@@ -15,8 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -80,13 +78,8 @@ PageType {
                 Layout.topMargin: 16
                 headerText: qsTr("xPaddingKey")
                 textField.text: xPaddingKey
-                textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                textField.onTextEdited: root.editDirty = (textField.text !== xPaddingKey)
                 textField.onEditingFinished: {
-                    var v = textField.text.trim()
-                    if (v !== xPaddingKey) xPaddingKey = v
-                    else if (textField.text !== v) textField.text = v
-                    root.editDirty = false
+                    if (textField.text !== xPaddingKey) xPaddingKey = textField.text
                 }
             }
 
@@ -97,19 +90,13 @@ PageType {
                 Layout.topMargin: 8
                 headerText: qsTr("xPaddingHeader")
                 textField.text: xPaddingHeader
-                textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                textField.onTextEdited: root.editDirty = (textField.text !== xPaddingHeader)
                 textField.onEditingFinished: {
-                    var v = textField.text.trim()
-                    if (v !== xPaddingHeader) xPaddingHeader = v
-                    else if (textField.text !== v) textField.text = v
-                    root.editDirty = false
+                    if (textField.text !== xPaddingHeader) xPaddingHeader = textField.text
                 }
             }
 
             DropDownType {
                 id: placementDropDown
-                fitContent: true
                 Layout.fillWidth: true
                 Layout.topMargin: 8
                 Layout.leftMargin: 16
@@ -153,7 +140,6 @@ PageType {
 
             DropDownType {
                 id: methodDropDown
-                fitContent: true
                 Layout.fillWidth: true
                 Layout.topMargin: 8
                 Layout.leftMargin: 16
@@ -211,7 +197,7 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {

client/ui/qml/Pages2/PageProtocolXrayXmuxSettings.qml

@@ -15,21 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
-    function clampSigned(text) {
-        if (text === "" || text === "-")
-            return ""
-        var n = parseInt(text, 10)
-        if (isNaN(n))
-            return ""
-        if (n > 2147483647)
-            n = 2147483647
-        if (n < -2147483648)
-            n = -2147483648
-        return String(n)
-    }
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -93,9 +78,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xmuxMaxConcurrencyMin
                     maxValue: xmuxMaxConcurrencyMax
-                    onMinChanged: function(val) { xmuxMaxConcurrencyMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xmuxMaxConcurrencyMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xmuxMaxConcurrencyMin = val
+                    onMaxChanged: xmuxMaxConcurrencyMax = val
                 }
 
                 // maxConnections
@@ -114,9 +98,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xmuxMaxConnectionsMin
                     maxValue: xmuxMaxConnectionsMax
-                    onMinChanged: function(val) { xmuxMaxConnectionsMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xmuxMaxConnectionsMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xmuxMaxConnectionsMin = val
+                    onMaxChanged: xmuxMaxConnectionsMax = val
                 }
 
                 // cMaxReuseTimes
@@ -135,9 +118,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xmuxCMaxReuseTimesMin
                     maxValue: xmuxCMaxReuseTimesMax
-                    onMinChanged: function(val) { xmuxCMaxReuseTimesMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xmuxCMaxReuseTimesMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xmuxCMaxReuseTimesMin = val
+                    onMaxChanged: xmuxCMaxReuseTimesMax = val
                 }
 
                 // hMaxRequestTimes
@@ -156,9 +138,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xmuxHMaxRequestTimesMin
                     maxValue: xmuxHMaxRequestTimesMax
-                    onMinChanged: function(val) { xmuxHMaxRequestTimesMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xmuxHMaxRequestTimesMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xmuxHMaxRequestTimesMin = val
+                    onMaxChanged: xmuxHMaxRequestTimesMax = val
                 }
 
                 // hMaxReusableSecs
@@ -177,9 +158,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xmuxHMaxReusableSecsMin
                     maxValue: xmuxHMaxReusableSecsMax
-                    onMinChanged: function(val) { xmuxHMaxReusableSecsMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xmuxHMaxReusableSecsMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xmuxHMaxReusableSecsMin = val
+                    onMaxChanged: xmuxHMaxReusableSecsMax = val
                 }
 
                 TextFieldWithHeaderType {
@@ -188,16 +168,12 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 16
                     headerText: qsTr("hKeepAlivePeriod")
-                    subtitleText: qsTr("Integer, may be negative")
                     textField.text: xmuxHKeepAlivePeriod
-                    textField.maximumLength: 11
-                    textField.validator: RegularExpressionValidator { regularExpression: /^-?\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xmuxHKeepAlivePeriod)
+                    textField.validator: IntValidator {
+                        bottom: 0
+                    }
                     textField.onEditingFinished: {
-                        var v = root.clampSigned(textField.text)
-                        if (v !== xmuxHKeepAlivePeriod) xmuxHKeepAlivePeriod = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xmuxHKeepAlivePeriod) xmuxHKeepAlivePeriod = textField.text
                     }
                 }
             }
@@ -218,7 +194,7 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {

client/ui/qml/Pages2/PageShare.qml

@@ -91,7 +91,6 @@ PageType {
         }
 
         function onExportErrorOccurred(error) {
-            PageController.showBusyIndicator(false)
             PageController.showErrorMessage(error)
         }
     }

client/ui/qml/Pages2/PageShareConnection.qml

@@ -320,7 +320,7 @@ PageType {
                 Layout.rightMargin: 16
                 visible: isQrCodeVisible
                 horizontalAlignment: Text.AlignHCenter
-                text: qsTr("To read the QR code in the Amnezia app, select \"Add server\" → \"I have data to connect\" → \"QR code, key or settings file\"")
+                text: qsTr("To read the QR code in the Amnezia app, tap + in the main menu → 'QR code'")
             }
         }
     }

client/ui/qml/main2.qml

@@ -53,7 +53,7 @@ Window  {
         }
     }
 
-    visible: !GC.isDesktop()
+    visible: true
     width: GC.screenWidth
     height: GC.screenHeight
     minimumWidth: GC.isDesktop() ? 360 : 0

conanfile.py

@@ -19,12 +19,12 @@ class AmneziaVPN(ConanFile):
 
         if has_service:
             if os == "Windows":
-                self.requires("awg-windows/0.1.9")
+                self.requires("awg-windows/0.1.8")
                 self.requires("tap-windows6/9.27.0")
                 self.requires("win-split-tunnel/1.2.5.0")
                 self.requires("wintun/0.14.1")
             else:
-                self.requires("awg-go/0.2.18")
+                self.requires("awg-go/0.2.16")
 
             self.requires("amnezia-xray-bindings/1.1.0")
             self.requires("tun2socks/2.6.0")
@@ -32,13 +32,13 @@ class AmneziaVPN(ConanFile):
             self.requires("v2ray-rules-dat/202603162227")
 
         if has_ne:
-            self.requires("awg-apple/2.0.2")
+            self.requires("awg-apple/2.0.1")
             self.requires("hev-socks5-tunnel/2.15.0", options={"as_framework": True})
             self.requires("openvpnadapter/1.0.0")
 
         if os == "Android":
             self.requires("amnezia-libxray/1.0.0")
-            self.requires("awg-android/2.0.1")
+            self.requires("awg-android/1.1.7")
             self.requires("openvpn-pt-android/1.0.0")
 
         # expicitly use libssh@amnezia to prevent it from being downloaded from conan-center

recipes/awg-android/conanfile.py

@@ -9,7 +9,7 @@ import platform
 
 class AwgAndroid(ConanFile):
     name = "awg-android"
-    version = "2.0.1"
+    version = "1.1.7"
     settings = "os", "arch", "build_type", "compiler"
 
     def configure(self):

recipes/awg-apple/conanfile.py

@@ -9,7 +9,7 @@ import os
 
 class AwgApple(ConanFile):
     name = "awg-apple"
-    version = "2.0.2"
+    version = "2.0.1"
     settings = "os", "arch", "compiler"
 
     @property
@@ -39,7 +39,7 @@ class AwgApple(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-apple/archive/refs/tags/v{self.version}.zip",
-            sha256="a04f49eac9f82bbf5dd9031bab188d44de2b3482efde1b6e970821de1d5a3c5d", strip_root=True
+            sha256="9fe4f8cfbb6a751558b54b7979db3a5ea46e49731912aae99f093e84a1433e97", strip_root=True
         )
 
     def generate(self):

recipes/awg-go/conanfile.py

@@ -8,7 +8,7 @@ import os
 
 class AwgGo(ConanFile):
     name = "awg-go"
-    version = "0.2.18"
+    version = "0.2.16"
     package_type = "application"
     settings = "os", "arch"
 
@@ -42,7 +42,7 @@ class AwgGo(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-go/archive/refs/tags/v{self.version}.zip",
-            sha256="58eefbd012e79bd1525f0e02d748979e9480acc1a339df8ceb3b9ffafcedb1ba", strip_root=True
+            sha256="34da7d4189f215f3930de441548bc2a0c89d54d347a4fb85cb9c715fce6413aa", strip_root=True
         )
 
     def generate(self):

recipes/awg-windows/conanfile.py

@@ -8,7 +8,7 @@ import os
 
 class AwgWindows(ConanFile):
     name = "awg-windows"
-    version = "0.1.9"
+    version = "0.1.8"
     settings = "os", "arch"
 
     @property
@@ -63,7 +63,7 @@ class AwgWindows(ConanFile):
 
     def source(self):
         get(self, f"https://github.com/amnezia-vpn/amneziawg-windows/archive/refs/tags/v{self.version}.zip",
-            sha256="5c29a75cb2beae291cc51b64840a39f838da5f300b9e956f7964813a687ec74c", strip_root=True)
+            sha256="1de472832b332515c96cdf14ea887edde42ed7ad173675280c51baa9a3ef62f2", strip_root=True)
         
     def generate(self):
         tc = AutotoolsToolchain(self)

recipes/openssl/conanfile.py

@@ -650,9 +650,6 @@ class OpenSSLConan(ConanFile):
         if self._use_nmake:
             self.cpp_info.components["ssl"].libs = ["libssl"]
             self.cpp_info.components["crypto"].libs = ["libcrypto"]
-        elif self.settings.os == "Android" and self.options.shared:
-            self.cpp_info.components["ssl"].libs = ["ssl_3"]
-            self.cpp_info.components["crypto"].libs = ["crypto_3"]
         else:
             self.cpp_info.components["ssl"].libs = ["ssl"]
             self.cpp_info.components["crypto"].libs = ["crypto"]

recipes/openvpn/conanfile.py

@@ -28,7 +28,7 @@ class Openvpn(ConanFile):
 
     def build_requirements(self):
         if self._is_windows:
-            self.tool_requires("cmake/[>=4.2]")
+            self.tool_requires("cmake/[>=3.14 <4]")
         else:
             self.tool_requires("libtool/2.4.7")
             self.tool_requires("automake/1.16.5")