fix: detect physical default gateway on Windows for OpenVPN blacklist split tunneling

CMakeLists.txt

@@ -4,7 +4,7 @@ set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 4.9.0.3)
+set(AMNEZIAVPN_VERSION 4.9.0.2)
 
 set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
 set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
@@ -28,7 +28,7 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")
 
 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2126)
+set(APP_ANDROID_VERSION_CODE 2123)
 
 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
     set(MZ_PLATFORM_NAME "linux")

client/amneziaApplication.cpp

@@ -119,13 +119,7 @@ void AmneziaApplication::init()
                 win->setPersistentSceneGraph(true);
                 win->setPersistentGraphics(true);
 #endif
-#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
                 win->show();
-#else
-                if (!m_coreController || !m_coreController->pageController()->shouldStartMinimized()) {
-                    win->show();
-                }
-#endif
             }
         },
         Qt::QueuedConnection);

client/android/res/drawable/ic_launcher_background.xml

@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<shape xmlns:android="http://schemas.android.com/apk/res/android"
-    android:shape="rectangle">
-    <gradient
-        android:type="linear"
-        android:angle="135"
-        android:startColor="#2A2A2E"
-        android:centerColor="#17171A"
-        android:endColor="#0E0E11" />
-</shape>

client/android/res/drawable/ic_launcher_monochrome.xml

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<inset xmlns:android="http://schemas.android.com/apk/res/android"
-    android:drawable="@drawable/ic_amnezia_round"
-    android:insetLeft="19.5%"
-    android:insetTop="19.5%"
-    android:insetRight="19.5%"
-    android:insetBottom="19.5%" />

client/android/res/mipmap-anydpi-v26/icon.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background" />
-    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
-    <monochrome android:drawable="@drawable/ic_launcher_monochrome" />
-</adaptive-icon>

client/android/res/mipmap-anydpi-v26/icon_round.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background" />
-    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
-    <monochrome android:drawable="@drawable/ic_launcher_monochrome" />
-</adaptive-icon>

client/android/res/values-v31/styles.xml

@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <style name="NoActionBar">
-        <item name="android:windowBackground">@color/black</item>
-        <item name="android:colorBackground">@color/black</item>
-        <item name="android:windowActionBar">false</item>
-        <item name="android:windowNoTitle">true</item>
-        <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
-        <item name="android:enforceNavigationBarContrast">false</item>
-        <item name="android:enforceStatusBarContrast">false</item>
-
-        <item name="android:windowSplashScreenBackground">@color/ic_launcher_background</item>
-        <item name="android:windowSplashScreenIconBackgroundColor">@color/ic_launcher_background</item>
-        <item name="android:windowSplashScreenAnimatedIcon">@mipmap/icon</item>
-    </style>
-</resources>

client/android/res/values/colors.xml

@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <color name="ic_launcher_background">#0E0E11</color>
-</resources>

client/cmake/macos_ne.cmake

@@ -152,5 +152,5 @@ message(${QtCore_location})
 get_filename_component(QT_BIN_DIR_DETECTED "${QtCore_location}/../../../../../bin" ABSOLUTE)
 
 add_custom_command(TARGET ${PROJECT} POST_BUILD
-    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR} -no-codesign
+    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR}
 )

client/cmake/sources.cmake

@@ -65,6 +65,8 @@ set(HEADERS ${HEADERS}
     ${CLIENT_ROOT_DIR}/core/utils/utilities.h
     ${CLIENT_ROOT_DIR}/core/utils/managementServer.h
     ${CLIENT_ROOT_DIR}/core/utils/constants.h
+    ${CLIENT_ROOT_DIR}/core/vpnTrafficGuard.h
+    ${CLIENT_ROOT_DIR}/core/tunnel.h
 )
 
 # Mozilla headres
@@ -145,6 +147,8 @@ set(SOURCES ${SOURCES}
     ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.cpp
     ${CLIENT_ROOT_DIR}/core/utils/utilities.cpp
     ${CLIENT_ROOT_DIR}/core/utils/managementServer.cpp
+    ${CLIENT_ROOT_DIR}/core/vpnTrafficGuard.cpp
+    ${CLIENT_ROOT_DIR}/core/tunnel.cpp
 )
 
 # Mozilla sources

client/core/configurators/xrayConfigurator.cpp

@@ -244,7 +244,11 @@ ErrorCode XrayConfigurator::applyServerSettingsToRemote(const ServerCredentials
                     << "container=" << static_cast<int>(container) << "host=" << credentials.hostName
                     << "transport=" << srv.transport << "security=" << srv.security << "port=" << srv.port
                     << "appendClient=" << appendNewClient;
-    const QString flowValue = srv.flow;
+    QString flowValue = srv.flow;
+    if (flowValue.isEmpty() && srv.security == QLatin1String("reality")) {
+        flowValue = QStringLiteral("xtls-rprx-vision");
+    }
+
     QString realityPublicKey;
     QString realityShortId;
     if (srv.security == QLatin1String("reality")) {
@@ -559,12 +563,9 @@ QJsonObject XrayConfigurator::buildStreamSettings(const XrayServerConfig &srv, c
         if (pad.obfsMode) {
             if (!pad.bytesMin.isEmpty() || !pad.bytesMax.isEmpty()) {
                 QJsonObject br;
-                const int fromV = pad.bytesMin.isEmpty() ? 1 : pad.bytesMin.toInt();
-                int toV = pad.bytesMax.isEmpty() ? 256 : pad.bytesMax.toInt();
-                if (toV < fromV)
-                    toV = fromV;
-                br[QStringLiteral("from")] = fromV;
-                br[QStringLiteral("to")] = toV;
+                br[QStringLiteral("from")] = pad.bytesMin.isEmpty() ? 1 : pad.bytesMin.toInt();
+                br[QStringLiteral("to")] = pad.bytesMax.isEmpty() ? (pad.bytesMin.isEmpty() ? 256 : pad.bytesMin.toInt())
+                                                                  : pad.bytesMax.toInt();
                 xo[QStringLiteral("xPaddingBytes")] = br;
             }
             xo[QStringLiteral("xPaddingKey")] = pad.key.isEmpty() ? QStringLiteral("x_padding") : pad.key;

client/core/controllers/api/subscriptionController.cpp

@@ -484,6 +484,12 @@ ErrorCode SubscriptionController::updateServiceFromGateway(const QString &server
     return ErrorCode::NoError;
 }
 
+void SubscriptionController::restoreApiV2Config(const QString &serverId, const ApiV2ServerConfig &config)
+{
+    const QJsonObject json = config.toJson();
+    m_serversRepository->editServer(serverId, json, serverConfigUtils::configTypeFromJson(json));
+}
+
 ErrorCode SubscriptionController::deactivateDevice(const QString &serverId)
 {
     auto apiV2 = m_serversRepository->apiV2Config(serverId);

client/core/controllers/api/subscriptionController.h

@@ -68,6 +68,8 @@ public:
 
     ErrorCode updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, bool isConnectEvent);
 
+    void restoreApiV2Config(const QString &serverId, const ApiV2ServerConfig &config);
+
     ErrorCode deactivateDevice(const QString &serverId);
 
     ErrorCode deactivateExternalDevice(const QString &serverId, const QString &uuid, const QString &serverCountryCode);

client/core/controllers/connectionController.cpp

@@ -28,6 +28,7 @@ ConnectionController::ConnectionController(SecureServersRepository* serversRepos
       m_vpnConnection(vpnConnection)
 {
     connect(m_vpnConnection, &VpnConnection::connectionStateChanged, this, &ConnectionController::connectionStateChanged);
+    connect(m_vpnConnection, &VpnConnection::serverSwitchFailed, this, &ConnectionController::serverSwitchFailed);
     connect(this, &ConnectionController::openConnectionRequested, m_vpnConnection, &VpnConnection::connectToVpn, Qt::QueuedConnection);
     connect(this, &ConnectionController::closeConnectionRequested, m_vpnConnection, &VpnConnection::disconnectFromVpn, Qt::QueuedConnection);
     connect(this, &ConnectionController::setConnectionStateRequested, m_vpnConnection, &VpnConnection::setConnectionState, Qt::QueuedConnection);
@@ -106,8 +107,7 @@ ErrorCode ConnectionController::isConnectionSupported(const QString &serverId) c
         return ErrorCode::AmneziaServiceNotRunning;
     }
 
-    const serverConfigUtils::ConfigType kind = m_serversRepository->serverKind(serverId);
-    if (serverConfigUtils::isLegacyApiSubscription(kind)) {
+    if (serverConfigUtils::isLegacyApiSubscription(m_serversRepository->serverKind(serverId))) {
         return ErrorCode::LegacyApiV1NotSupportedError;
     }
 
@@ -118,9 +118,6 @@ ErrorCode ConnectionController::isConnectionSupported(const QString &serverId) c
     }
 
     if (container == DockerContainer::None) {
-        if (serverConfigUtils::isApiV2Subscription(kind)) {
-            return ErrorCode::NoError;
-        }
         return ErrorCode::NoInstalledContainersError;
     }
 

client/core/controllers/connectionController.h

@@ -69,6 +69,7 @@ signals:
     void closeConnectionRequested();
     void setConnectionStateRequested(Vpn::ConnectionState state);
     void killSwitchModeChangedRequested(bool enabled);
+    void serverSwitchFailed();
 
 #ifdef Q_OS_ANDROID
     void restoreConnectionRequested();

client/core/controllers/coreSignalHandlers.cpp

@@ -1,7 +1,6 @@
 #include "coreSignalHandlers.h"
 
 #include <QTimer>
-#include <QtConcurrent>
 
 #include "core/utils/selfhosted/sshSession.h"
 #include "core/utils/errorCodes.h"
@@ -95,6 +94,12 @@ void CoreSignalHandlers::initErrorMessagesHandler()
         m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
     });
 
+    connect(m_coreController->m_connectionUiController, &ConnectionUiController::serverSwitchFailed, this, [this]() {
+        m_coreController->m_subscriptionUiController->revertLastCountryChange();
+        emit m_coreController->m_pageController->showNotificationMessage(
+            tr("Failed to switch server. Existing connection maintained."));
+    });
+
     connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::errorOccurred, m_coreController->m_pageController,
             qOverload<ErrorCode>(&PageController::showErrorMessage));
 
@@ -145,9 +150,7 @@ void CoreSignalHandlers::initExportControllerHandler()
             });
     connect(m_coreController->m_exportController, &ExportController::revokeClientRequested, this,
             [this](const QString &serverId, int row, DockerContainer container) {
-                QtConcurrent::run([this, serverId, row, container]() {
-                    m_coreController->m_usersController->revokeClient(serverId, row, container);
-                });
+                m_coreController->m_usersController->revokeClient(serverId, row, container);
             });
     connect(m_coreController->m_exportController, &ExportController::renameClientRequested, this,
             [this](const QString &serverId, int row, const QString &clientName, DockerContainer container) {
@@ -205,15 +208,13 @@ void CoreSignalHandlers::initAdminConfigRevokedHandler()
 {
     connect(m_coreController->m_installController, &InstallController::clientRevocationRequested, this,
             [this](const QString &serverId, const ContainerConfig &containerConfig, DockerContainer container) {
-                QtConcurrent::run([this, serverId, containerConfig, container]() {
-                    m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
-                });
+                m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
             });
 
     connect(m_coreController->m_installController, &InstallController::clientAppendRequested, this,
             [this](const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container) {
                 m_coreController->m_usersController->appendClient(serverId, clientId, clientName, container);
-            }, Qt::DirectConnection);
+            });
 
     connect(m_coreController->m_usersController, &UsersController::adminConfigRevoked, m_coreController->m_installController,
             &InstallController::clearCachedProfile);
@@ -290,8 +291,6 @@ void CoreSignalHandlers::initClientManagementModelUpdateHandler()
             m_coreController->m_clientManagementModel, &ClientManagementModel::updateModel);
     connect(m_coreController->m_usersController, &UsersController::clientRenamed,
             m_coreController->m_clientManagementModel, &ClientManagementModel::updateClientName);
-    connect(m_coreController->m_usersController, &UsersController::revokeFinished,
-            m_coreController->m_exportController, &ExportController::revokeFinished);
 }
 
 void CoreSignalHandlers::initSitesModelUpdateHandler()

client/core/controllers/gatewayController.cpp

@@ -79,7 +79,7 @@ GatewayController::EncryptedRequestData GatewayController::prepareRequest(const
         QString ip = NetworkUtilities::getIPAddress(host);
         if (!ip.isEmpty()) {
             IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-                QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(QStringList { ip });
+                QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(QString(), QStringList { ip });
                 if (!reply.waitForFinished(1000) || !reply.returnValue())
                     qWarning() << "GatewayController::prepareRequest(): Failed to execute remote addKillSwitchAllowedRange call";
             });

client/core/controllers/selfhosted/exportController.h

@@ -48,7 +48,6 @@ signals:
     void appendClientRequested(const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container);
     void updateClientsRequested(const QString &serverId, DockerContainer container);
     void revokeClientRequested(const QString &serverId, int row, DockerContainer container);
-    void revokeFinished(ErrorCode errorCode);
     void renameClientRequested(const QString &serverId, int row, const QString &clientName, DockerContainer container);
 
 public slots:

client/core/controllers/selfhosted/installController.cpp

@@ -234,9 +234,7 @@ ErrorCode InstallController::updateServerConfig(const QString &serverId, DockerC
         } else if (container == DockerContainer::Telemt) {
             TelemtInstaller::uploadClientSettingsSnapshot(sshSession, credentials, container, newConfig);
         }
-        if (reinstallRequired) {
-            clearCachedProfile(serverId, container);
-        }
+        clearCachedProfile(serverId, container);
         adminConfig->updateContainerConfig(container, newConfig);
         m_serversRepository->editServer(serverId, adminConfig->toJson(), serverConfigUtils::ConfigType::SelfHostedAdmin);
     }

client/core/controllers/selfhosted/usersController.cpp

@@ -698,7 +698,7 @@ ErrorCode UsersController::revokeXray(const int row,
 
     QString restartScript = QString("sudo docker restart $CONTAINER_NAME");
     error = sshSession->runScript(
-        credentials,
+        credentials, 
         sshSession->replaceVars(restartScript, amnezia::genBaseVars(credentials, container, QString(), QString()))
     );
     if (error != ErrorCode::NoError) {
@@ -758,17 +758,14 @@ ErrorCode UsersController::revokeClient(const QString &serverId, const int index
         ContainerConfig containerCfg = adminConfig->containerConfig(container);
         QString containerClientId = containerCfg.protocolConfig.clientId();
 
-        const bool isAdminMatch = !clientId.isEmpty() && !containerClientId.isEmpty() && containerClientId.contains(clientId);
-        if (isAdminMatch) {
+        if (!clientId.isEmpty() && !containerClientId.isEmpty() && containerClientId.contains(clientId)) {
             emit adminConfigRevoked(serverId, container);
         }
 
         emit clientRevoked(index);
+        emit clientsUpdated(m_clientsTable);
     }
 
-    emit clientsUpdated(m_clientsTable);
-    emit revokeFinished(errorCode);
-
     return errorCode;
 }
 

client/core/controllers/selfhosted/usersController.h

@@ -37,7 +37,6 @@ signals:
     void clientAdded(const QJsonObject &client);
     void clientRenamed(int row, const QString &newName);
     void clientRevoked(int row);
-    void revokeFinished(ErrorCode errorCode);
     void adminConfigRevoked(const QString &serverId, DockerContainer container);
 
 public slots:

client/core/controllers/updateController.cpp

@@ -7,6 +7,8 @@
 #include <QJsonObject>
 #include <QSysInfo>
 #include <QTimer>
+#include <QStandardPaths>
+#include <QTemporaryDir>
 
 #include "amneziaApplication.h"
 #include "logger.h"

client/core/models/protocols/xrayProtocolConfig.cpp

@@ -32,7 +32,7 @@ XrayXPaddingConfig XrayXPaddingConfig::fromJson(const QJsonObject &json)
     c.bytesMin  = json.value(configKey::xPaddingBytesMin).toString();
     c.bytesMax  = json.value(configKey::xPaddingBytesMax).toString();
     c.obfsMode  = json.value(configKey::xPaddingObfsMode).toBool(true);
-    c.key       = json.value(configKey::xPaddingKey).toString();
+    c.key       = json.value(configKey::xPaddingKey).toString(protocols::xray::defaultSite);
     c.header    = json.value(configKey::xPaddingHeader).toString();
     c.placement = json.value(configKey::xPaddingPlacement).toString(protocols::xray::defaultXPaddingPlacement);
     c.method    = json.value(configKey::xPaddingMethod).toString(protocols::xray::defaultXPaddingMethod);
@@ -365,8 +365,6 @@ XrayServerConfig XrayServerConfig::fromJson(const QJsonObject &json)
 bool XrayServerConfig::hasEqualServerSettings(const XrayServerConfig &other) const
 {
     return port == other.port
-           && transportProto == other.transportProto
-           && subnetAddress == other.subnetAddress
            && site == other.site
            && security == other.security
            && flow == other.flow
@@ -468,17 +466,6 @@ XrayProtocolConfig XrayProtocolConfig::fromJson(const QJsonObject &json)
                         }
                     }
                 }
-                const QJsonArray outbounds = parsed.value(protocols::xray::outbounds).toArray();
-                if (!outbounds.isEmpty()) {
-                    const QJsonObject settings = outbounds[0].toObject().value(protocols::xray::settings).toObject();
-                    const QJsonArray vnext = settings.value(protocols::xray::vnext).toArray();
-                    if (!vnext.isEmpty()) {
-                        const QJsonArray users = vnext[0].toObject().value(protocols::xray::users).toArray();
-                        if (!users.isEmpty()) {
-                            clientCfg.id = users[0].toObject().value(protocols::xray::id).toString();
-                        }
-                    }
-                }
                 c.clientConfig = clientCfg;
             } else {
                 c.clientConfig = XrayClientConfig::fromJson(parsed);

client/core/protocols/openVpnProtocol.cpp

@@ -48,15 +48,6 @@ void OpenVpnProtocol::cleanupResources()
         QThread::msleep(10);
     }
     m_managementServer.stop();
-
-#if defined(Q_OS_WIN) || defined(Q_OS_LINUX) || defined(Q_OS_MACOS)
-    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
-        QRemoteObjectPendingReply<bool> reply = iface->disableKillSwitch();
-        if (!reply.waitForFinished(1000) && !reply.returnValue()) {
-            qWarning() << "OpenVpnProtocol::cleanupResources(): Failed to disable killswitch";
-        }
-    });
-#endif
 }
 
 void OpenVpnProtocol::stop()
@@ -186,20 +177,6 @@ ErrorCode OpenVpnProtocol::start()
         return lastError();
     }
 
-#ifdef AMNEZIA_DESKTOP
-    const ErrorCode res = IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-        QString ip = NetworkUtilities::getIPAddress(m_configData.value(amnezia::configKey::hostName).toString());
-        QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(QStringList(ip));
-        if (!reply.waitForFinished(1000) || !reply.returnValue()) {
-            return ErrorCode::AmneziaServiceConnectionFailed;
-        }
-        return ErrorCode::NoError;
-    });
-    if (res != ErrorCode::NoError) {
-        return res;
-    }
-#endif
-
     // Detect default gateway
 #ifdef Q_OS_MAC
     QProcess p;
@@ -222,6 +199,18 @@ ErrorCode OpenVpnProtocol::start()
     }
 #endif
 
+#ifdef Q_OS_WIN
+    if (m_routeGateway.isEmpty()) {
+        const QString gw = NetworkUtilities::getGatewayAndIface().first;
+        if (!gw.isEmpty()) {
+            m_routeGateway = gw;
+            qDebug() << "Set VPN route gateway" << m_routeGateway;
+        } else {
+            qWarning() << "Unable to set VPN route gateway";
+        }
+    }
+#endif
+
     uint mgmtPort = selectMgmtPort();
     qDebug() << "OpenVpnProtocol::start mgmt port selected:" << mgmtPort;
 
@@ -354,38 +343,9 @@ void OpenVpnProtocol::updateVpnGateway(const QString &line)
                 m_vpnGateway = l.split(" ").at(2);
 #ifdef Q_OS_WIN
                 QThread::msleep(300);
-                IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-                    QList<QNetworkInterface> netInterfaces = QNetworkInterface::allInterfaces();
-                    for (int i = 0; i < netInterfaces.size(); i++) {
-                        for (int j=0; j < netInterfaces.at(i).addressEntries().size(); j++)
-                        {
-                            // killSwitch toggle
-                            if (m_vpnLocalAddress == netInterfaces.at(i).addressEntries().at(j).ip().toString()) {
-                                if (QVariant(m_configData.value(configKey::killSwitchOption).toString()).toBool()) {
-                                    iface->enableKillSwitch(m_configData, netInterfaces.at(i).index());
-                                }
-                                m_configData.insert("vpnAdapterIndex", netInterfaces.at(i).index());
-                                m_configData.insert("vpnGateway", m_vpnGateway);
-                                m_configData.insert("vpnServer",
-                                                    NetworkUtilities::getIPAddress(m_configData.value(amnezia::configKey::hostName).toString()));
-                                iface->enablePeerTraffic(m_configData);
-                            }
-                        }
-                    }
-                });
 #endif
-#if defined(Q_OS_LINUX) || defined(Q_OS_MACOS)
-                // killSwitch toggle
-                if (QVariant(m_configData.value(configKey::killSwitchOption).toString()).toBool()) {
-                    m_configData.insert("vpnServer",
-                                        NetworkUtilities::getIPAddress(m_configData.value(amnezia::configKey::hostName).toString()));
-                    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-                        QRemoteObjectPendingReply<bool> reply = iface->enableKillSwitch(m_configData, 0);
-                        if (!reply.waitForFinished(1000) || !reply.returnValue()) {
-                            qWarning() << "OpenVpnProtocol::updateVpnGateway(): Failed to enable killswitch";
-                        }
-                    });
-                }
+#if defined(Q_OS_WIN) || defined(Q_OS_LINUX) || defined(Q_OS_MACOS)
+                emit tunnelAddressesUpdated(m_vpnGateway, m_vpnLocalAddress);
 #endif
                 qDebug() << QString("Set vpn local address %1, gw %2").arg(m_vpnLocalAddress).arg(vpnGateway());
             }

client/core/protocols/vpnProtocol.cpp

@@ -106,6 +106,19 @@ QString VpnProtocol::vpnLocalAddress() const
     return m_vpnLocalAddress;
 }
 
+bool VpnProtocol::isWireGuardBased(amnezia::DockerContainer container)
+{
+    return container == amnezia::DockerContainer::Awg
+        || container == amnezia::DockerContainer::Awg2
+        || container == amnezia::DockerContainer::WireGuard;
+}
+
+bool VpnProtocol::isXrayBased(amnezia::DockerContainer container)
+{
+    return container == amnezia::DockerContainer::Xray
+        || container == amnezia::DockerContainer::SSXray;
+}
+
 VpnProtocol *VpnProtocol::factory(DockerContainer container, const QJsonObject &configuration)
 {
     switch (container) {
@@ -124,6 +137,14 @@ VpnProtocol *VpnProtocol::factory(DockerContainer container, const QJsonObject &
     }
 }
 
+void VpnProtocol::setPrimary(const QJsonObject &config)
+{
+    Q_UNUSED(config)
+    QMetaObject::invokeMethod(this, [this]() {
+        emit primaryReady();
+    }, Qt::QueuedConnection);
+}
+
 QString VpnProtocol::routeGateway() const
 {
     return m_routeGateway;
@@ -137,6 +158,7 @@ QString VpnProtocol::textConnectionState(Vpn::ConnectionState connectionState)
     case Vpn::ConnectionState::Preparing: return tr("Preparing");
     case Vpn::ConnectionState::Connecting: return tr("Connecting...");
     case Vpn::ConnectionState::Connected: return tr("Connected");
+    case Vpn::ConnectionState::Switching: return tr("Switching...");
     case Vpn::ConnectionState::Disconnecting: return tr("Disconnecting...");
     case Vpn::ConnectionState::Reconnecting: return tr("Reconnecting...");
     case Vpn::ConnectionState::Error: return tr("Error");

client/core/protocols/vpnProtocol.h

@@ -27,6 +27,7 @@ namespace Vpn
         Preparing,
         Connecting,
         Connected,
+        Switching,
         Disconnecting,
         Reconnecting,
         Error
@@ -60,6 +61,7 @@ public:
     virtual bool isDisconnected() const;
     virtual ErrorCode start() = 0;
     virtual void stop() = 0;
+    virtual void setPrimary(const QJsonObject& config);
 
     Vpn::ConnectionState connectionState() const;
     ErrorCode lastError() const;
@@ -71,6 +73,8 @@ public:
     QString vpnLocalAddress() const;
 
     static VpnProtocol* factory(amnezia::DockerContainer container, const QJsonObject &configuration);
+    static bool isWireGuardBased(amnezia::DockerContainer container);
+    static bool isXrayBased(amnezia::DockerContainer container);
 
 signals:
     void bytesChanged(quint64 receivedBytes, quint64 sentBytes);
@@ -78,6 +82,8 @@ signals:
     void timeoutTimerEvent();
     void protocolError(amnezia::ErrorCode e);
     void tunnelAddressesUpdated(const QString& gateway, const QString& localAddress);
+    void primaryReady();
+    void primaryFailed();
 
 public slots:
     virtual void onTimeout(); // todo: remove?

client/core/protocols/wireGuardProtocol.cpp

@@ -12,9 +12,11 @@
 WireguardProtocol::WireguardProtocol(const QJsonObject &configuration, QObject *parent)
     : VpnProtocol(configuration, parent)
 {
-    m_impl.reset(new LocalSocketController());
+    const QString ifname = configuration.value("ifname").toString();
+    m_impl.reset(new LocalSocketController(ifname));
     connect(m_impl.get(), &ControllerImpl::connected, this,
-            [this](const QString &pubkey, const QDateTime &connectionTimestamp) {
+            [this](const QString& pubkey, const QDateTime&) {
+                Q_UNUSED(pubkey)
                 setConnectionState(Vpn::ConnectionState::Connected);
             });
     connect(m_impl.get(), &ControllerImpl::statusUpdated, this,
@@ -33,12 +35,18 @@ WireguardProtocol::WireguardProtocol(const QJsonObject &configuration, QObject *
 
                 if ((!m_vpnGateway.isEmpty() && m_vpnGateway != previousGateway) ||
                     (!m_vpnLocalAddress.isEmpty() && m_vpnLocalAddress != previousLocal)) {
-                    emit tunnelAddressesUpdated(m_vpnGateway, m_vpnLocalAddress);
-                }
+                        if (m_connectionState == Vpn::ConnectionState::Connected) {
+                            emit tunnelAddressesUpdated(m_vpnGateway, m_vpnLocalAddress);
+                        }
+                    }
             });
 
     connect(m_impl.get(), &ControllerImpl::disconnected, this,
             [this]() { setConnectionState(Vpn::ConnectionState::Disconnected); });
+    connect(m_impl.get(), &ControllerImpl::primaryReady,
+            this, &WireguardProtocol::primaryReady);
+    connect(m_impl.get(), &ControllerImpl::primaryFailed,
+            this, &WireguardProtocol::primaryFailed);
     m_impl->initialize(nullptr, nullptr);
 }
 
@@ -48,13 +56,7 @@ WireguardProtocol::~WireguardProtocol()
     QThread::msleep(200);
 }
 
-void WireguardProtocol::stop()
-{
-    stopMzImpl();
-    return;
-}
-
-ErrorCode WireguardProtocol::startMzImpl()
+ErrorCode WireguardProtocol::start()
 {
     QString protocolName = m_rawConfig.value("protocol").toString();
     QJsonObject vpnConfigData = m_rawConfig.value(protocolName + "_config_data").toObject();
@@ -62,18 +64,19 @@ ErrorCode WireguardProtocol::startMzImpl()
     m_rawConfig.insert(protocolName + "_config_data", vpnConfigData);
     m_rawConfig[configKey::hostName] = NetworkUtilities::getIPAddress(m_rawConfig[configKey::hostName].toString());
 
+    m_stopped = false;
     m_impl->activate(m_rawConfig);
     return ErrorCode::NoError;
 }
 
-ErrorCode WireguardProtocol::stopMzImpl()
+void WireguardProtocol::stop()
 {
+    if (m_stopped) return;
+    m_stopped = true;
     m_impl->deactivate();
-    return ErrorCode::NoError;
 }
 
-
-ErrorCode WireguardProtocol::start()
+void WireguardProtocol::setPrimary(const QJsonObject& config)
 {
-    return startMzImpl();
+    m_impl->setPrimary(config);
 }

client/core/protocols/wireGuardProtocol.h

@@ -21,11 +21,10 @@ public:
 
     ErrorCode start() override;
     void stop() override;
-
-    ErrorCode startMzImpl();
-    ErrorCode stopMzImpl();
+    void setPrimary(const QJsonObject& config) override;
 
 private:
+    bool m_stopped = false;
 
     QScopedPointer<ControllerImpl> m_impl;
 };

client/core/protocols/xrayProtocol.cpp

@@ -19,12 +19,6 @@
 
 #include <exception>
 
-#ifdef Q_OS_MACOS
-static const QString tunName = "utun22";
-#else
-static const QString tunName = "tun2";
-#endif
-
 XrayProtocol::XrayProtocol(const QJsonObject &configuration, QObject *parent) : VpnProtocol(configuration, parent)
 {
     m_vpnGateway = amnezia::protocols::xray::defaultLocalAddr;
@@ -34,11 +28,16 @@ XrayProtocol::XrayProtocol(const QJsonObject &configuration, QObject *parent) :
     m_routeMode = static_cast<amnezia::RouteMode>(configuration.value(amnezia::configKey::splitTunnelType).toInt());
     m_remoteAddress = NetworkUtilities::getIPAddress(m_rawConfig.value(amnezia::configKey::hostName).toString());
 
-    const QString primaryDns = configuration.value(amnezia::configKey::dns1).toString();
-    m_dnsServers.push_back(QHostAddress(primaryDns));
-    if (primaryDns != amnezia::protocols::dns::amneziaDnsIp) {
-        const QString secondaryDns = configuration.value(amnezia::configKey::dns2).toString();
-        m_dnsServers.push_back(QHostAddress(secondaryDns));
+    m_tunName = configuration.value("tunName").toString();
+    if (m_tunName.isEmpty()) {
+        m_tunName = configuration.value("ifname").toString();
+    }
+    if (m_tunName.isEmpty()) {
+#ifdef Q_OS_MACOS
+        m_tunName = QStringLiteral("utun22");
+#else
+        m_tunName = QStringLiteral("tun2");
+#endif
     }
 
     QJsonObject xrayConfiguration = configuration.value(ProtocolUtils::key_proto_config_data(Proto::Xray)).toObject();
@@ -68,6 +67,8 @@ ErrorCode XrayProtocol::start()
 {
     qDebug() << "XrayProtocol::start()";
 
+    m_phase = Phase::Active;
+
     // Inject SOCKS5 auth into the inbound before starting xray.
     // Re-uses existing credentials if the config already has them (e.g. imported config).
     amnezia::serialization::inbounds::InboundCredentials creds;
@@ -106,7 +107,7 @@ ErrorCode XrayProtocol::start()
 
     return IpcClient::withInterface(
             [&](QSharedPointer<IpcInterfaceReplica> iface) {
-                auto xrayStart = iface->xrayStart(xrayConfigStr);
+                auto xrayStart = iface->xrayStart(m_tunName, xrayConfigStr);
                 if (!xrayStart.waitForFinished() || !xrayStart.returnValue()) {
                     qCritical() << "Failed to start xray";
                     return ErrorCode::XrayExecutableCrashed;
@@ -120,24 +121,17 @@ void XrayProtocol::stop()
 {
     qDebug() << "XrayProtocol::stop()";
 
-    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
-        auto disableKillSwitch = iface->disableKillSwitch();
-        if (!disableKillSwitch.waitForFinished() || !disableKillSwitch.returnValue())
-            qWarning() << "Failed to disable killswitch";
+    if (m_phase != Phase::Active) {
+        return;
+    }
+    m_phase = Phase::Stopping;
 
-        auto StartRoutingIpv6 = iface->StartRoutingIpv6();
-        if (!StartRoutingIpv6.waitForFinished() || !StartRoutingIpv6.returnValue())
-            qWarning() << "Failed to start routing ipv6";
-
-        auto restoreResolvers = iface->restoreResolvers();
-        if (!restoreResolvers.waitForFinished() || !restoreResolvers.returnValue())
-            qWarning() << "Failed to restore resolvers";
-
-        auto deleteTun = iface->deleteTun(tunName);
+    IpcClient::withInterface([this](QSharedPointer<IpcInterfaceReplica> iface) {
+        auto deleteTun = iface->deleteTun(m_tunName);
         if (!deleteTun.waitForFinished() || !deleteTun.returnValue())
             qWarning() << "Failed to delete tun";
 
-        auto xrayStop = iface->xrayStop();
+        auto xrayStop = iface->xrayStop(m_tunName);
         if (!xrayStop.waitForFinished() || !xrayStop.returnValue())
             qWarning() << "Failed to stop xray";
     });
@@ -162,9 +156,18 @@ void XrayProtocol::stop()
         m_tun2socksProcess.reset();
     }
 
+    m_phase = Phase::Inactive;
     setConnectionState(Vpn::ConnectionState::Disconnected);
 }
 
+void XrayProtocol::setPrimary(const QJsonObject &config)
+{
+    Q_UNUSED(config)
+    QMetaObject::invokeMethod(this, [this]() {
+        emit primaryReady();
+    }, Qt::QueuedConnection);
+}
+
 ErrorCode XrayProtocol::startTun2Socks()
 {
     m_tun2socksProcess = IpcClient::CreatePrivilegedProcess();
@@ -175,10 +178,23 @@ ErrorCode XrayProtocol::startTun2Socks()
     const QString proxyUrl = QString("socks5://%1:%2@127.0.0.1:%3").arg(m_socksUser, m_socksPassword, QString::number(m_socksPort));
 
     m_tun2socksProcess->setProgram(PermittedProcess::Tun2Socks);
-    m_tun2socksProcess->setArguments({ "-device", QString("tun://%1").arg(tunName), "-proxy", proxyUrl });
+    m_tun2socksProcess->setArguments({ "-device", QString("tun://%1").arg(m_tunName), "-proxy", proxyUrl });
 
     connect(
-            m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::readyReadStandardError, this, 
+            m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::errorOccurred, this,
+            [this](QProcess::ProcessError error) {
+                if (error != QProcess::FailedToStart) {
+                    // Other errors are reported via the finished signal or are transient.
+                    return;
+                }
+                qCritical() << "Tun2socks failed to start";
+                stop();
+                setLastError(ErrorCode::Tun2SockExecutableMissing);
+            },
+            Qt::QueuedConnection);
+
+    connect(
+            m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::readyReadStandardError, this,
             [this]() {
                 auto readAllStandardError = m_tun2socksProcess->readAllStandardError();
                 if (!readAllStandardError.waitForFinished()) {
@@ -217,13 +233,17 @@ ErrorCode XrayProtocol::startTun2Socks()
                     }
                 }
 
-                if (resourceBusy && m_tun2socksRetryCount < maxTun2SocksRetries) {
+                if (m_phase == Phase::Active && resourceBusy
+                    && m_tun2socksRetryCount < maxTun2SocksRetries) {
                     m_tun2socksRetryCount++;
                     qWarning() << QString("Tun2socks: TUN resource busy, retrying (%1/%2) in %3ms...")
                                       .arg(m_tun2socksRetryCount)
                                       .arg(maxTun2SocksRetries)
                                       .arg(tun2socksRetryDelayMs);
                     QTimer::singleShot(tun2socksRetryDelayMs, this, [this]() {
+                        if (m_phase != Phase::Active) {
+                            return;
+                        }
                         if (ErrorCode err = startTun2Socks(); err != ErrorCode::NoError) {
                             stop();
                             setLastError(err);
@@ -252,81 +272,17 @@ ErrorCode XrayProtocol::setupRouting()
 {
     return IpcClient::withInterface(
             [this](QSharedPointer<IpcInterfaceReplica> iface) -> ErrorCode {
-#ifdef Q_OS_WIN
-                const int inetAdapterIndex = NetworkUtilities::AdapterIndexTo(QHostAddress(m_remoteAddress));
-#endif
-                auto createTun = iface->createTun(tunName, amnezia::protocols::xray::defaultLocalAddr);
+#ifndef Q_OS_WIN
+                auto createTun = iface->createTun(m_tunName, amnezia::protocols::xray::defaultLocalAddr);
                 if (!createTun.waitForFinished() || !createTun.returnValue()) {
                     qCritical() << "Failed to assign IP address for TUN";
                     return ErrorCode::InternalError;
                 }
-
-                auto updateResolvers = iface->updateResolvers(tunName, m_dnsServers);
-                if (!updateResolvers.waitForFinished() || !updateResolvers.returnValue()) {
-                    qCritical() << "Failed to set DNS resolvers for TUN";
-                    return ErrorCode::InternalError;
-                }
-
-#ifdef Q_OS_WIN
-                int vpnAdapterIndex = -1;
-                QList<QNetworkInterface> netInterfaces = QNetworkInterface::allInterfaces();
-                for (auto &netInterface : netInterfaces) {
-                    for (auto &address : netInterface.addressEntries()) {
-                        if (m_vpnLocalAddress == address.ip().toString())
-                            vpnAdapterIndex = netInterface.index();
-                    }
-                }
 #else
-                static const int vpnAdapterIndex = 0;
+                Q_UNUSED(iface)
 #endif
-                const bool killSwitchEnabled = QVariant(m_rawConfig.value(configKey::killSwitchOption).toString()).toBool();
-                if (killSwitchEnabled) {
-                    if (vpnAdapterIndex != -1) {
-                        QJsonObject config = m_rawConfig;
-                        config.insert("vpnServer", m_remoteAddress);
 
-                        auto enableKillSwitch = IpcClient::Interface()->enableKillSwitch(config, vpnAdapterIndex);
-                        if (!enableKillSwitch.waitForFinished() || !enableKillSwitch.returnValue()) {
-                            qCritical() << "Failed to enable killswitch";
-                            return ErrorCode::InternalError;
-                        }
-                    } else
-                        qWarning() << "Failed to get vpnAdapterIndex. Killswitch disabled";
-                }
-
-                if (m_routeMode == amnezia::RouteMode::VpnAllSites) {
-                    static const QStringList subnets = { "1.0.0.0/8",  "2.0.0.0/7",  "4.0.0.0/6",  "8.0.0.0/5",
-                                                         "16.0.0.0/4", "32.0.0.0/3", "64.0.0.0/2", "128.0.0.0/1" };
-
-                    auto routeAddList = iface->routeAddList(m_vpnGateway, subnets);
-                    if (!routeAddList.waitForFinished() || routeAddList.returnValue() != subnets.count()) {
-                        qCritical() << "Failed to set routes for TUN";
-                        return ErrorCode::InternalError;
-                    }
-                }
-
-                auto StopRoutingIpv6 = iface->StopRoutingIpv6();
-                if (!StopRoutingIpv6.waitForFinished() || !StopRoutingIpv6.returnValue()) {
-                    qCritical() << "Failed to disable IPv6 routing";
-                    return ErrorCode::InternalError;
-                }
-
-#ifdef Q_OS_WIN
-                if (inetAdapterIndex != -1 && vpnAdapterIndex != -1) {
-                    QJsonObject config = m_rawConfig;
-                    config.insert("inetAdapterIndex", inetAdapterIndex);
-                    config.insert("vpnAdapterIndex", vpnAdapterIndex);
-                    config.insert("vpnGateway", m_vpnGateway);
-                    config.insert("vpnServer", m_remoteAddress);
-
-                    auto enablePeerTraffic = iface->enablePeerTraffic(config);
-                    if (!enablePeerTraffic.waitForFinished() || !enablePeerTraffic.returnValue()) {
-                        qCritical() << "Failed to enable peer traffic";
-                        return ErrorCode::InternalError;
-                    }
-                } else
-                    qWarning() << "Failed to get adapter indexes. Split-tunneling disabled";
-#endif
+                emit tunnelAddressesUpdated(m_vpnGateway, m_vpnLocalAddress);
                 return ErrorCode::NoError;
             },
             []() { return ErrorCode::AmneziaServiceConnectionFailed; });

client/core/protocols/xrayProtocol.h

@@ -20,14 +20,20 @@ public:
 
     ErrorCode start() override;
     void stop() override;
+    void setPrimary(const QJsonObject &config) override;
 
 private:
+    enum class Phase {
+        Inactive,
+        Active,
+        Stopping,
+    };
+
     ErrorCode setupRouting();
     ErrorCode startTun2Socks();
 
     QJsonObject m_xrayConfig;
     amnezia::RouteMode m_routeMode;
-    QList<QHostAddress> m_dnsServers;
     QString m_remoteAddress;
 
     QString m_socksUser;
@@ -38,6 +44,9 @@ private:
     int m_tun2socksRetryCount = 0;
     static constexpr int maxTun2SocksRetries = 5;
     static constexpr int tun2socksRetryDelayMs = 400;
+
+    QString m_tunName;
+    Phase m_phase = Phase::Inactive;
 };
 
 #endif // XRAYPROTOCOL_H

client/core/repositories/secureServersRepository.cpp

@@ -208,8 +208,8 @@ QString SecureServersRepository::nextAvailableServerName() const
     int i = 0;
     QString candidate;
     do {
-        ++i;
-        candidate = tr("Server") + QLatin1Char(' ') + QString::number(i);
+        i++;
+        candidate = QStringLiteral("Server %1").arg(i);
     } while (usedNames.contains(candidate));
 
     return candidate;

client/core/tunnel.cpp

@@ -0,0 +1,157 @@
+#include "tunnel.h"
+
+#include <QTimer>
+
+#include "daemon/interfaceconfig.h"
+
+Tunnel::Tunnel(QString ifname,
+               amnezia::DockerContainer container,
+               QJsonObject config,
+               QString remoteAddress,
+               QObject* parent)
+    : QObject(parent),
+      m_ifname(std::move(ifname)),
+      m_remoteAddress(std::move(remoteAddress)),
+      m_container(container),
+      m_config(std::move(config)) {}
+
+Tunnel::~Tunnel() = default;
+
+void Tunnel::prepare() {
+    if (m_state != State::Idle) {
+        return;
+    }
+
+    setState(State::Preparing);
+
+    m_config.insert("ifname", m_ifname);
+    m_protocol.reset(VpnProtocol::factory(m_container, m_config));
+    if (!m_protocol) {
+        setState(State::Failed);
+        emit failed(amnezia::ErrorCode::InternalError);
+        return;
+    }
+
+    connect(m_protocol.data(), &VpnProtocol::connectionStateChanged,
+            this, &Tunnel::onProtocolStateChanged);
+    connect(m_protocol.data(), &VpnProtocol::bytesChanged,
+            this, &Tunnel::bytesChanged);
+    connect(m_protocol.data(), &VpnProtocol::tunnelAddressesUpdated,
+            this, &Tunnel::addressesUpdated);
+    connect(m_protocol.data(), &VpnProtocol::primaryReady,
+            this, &Tunnel::onPrimaryReady);
+    connect(m_protocol.data(), &VpnProtocol::primaryFailed,
+            this, &Tunnel::onPrimaryFailed);
+
+    const amnezia::ErrorCode prepareErr = m_protocol->prepare();
+    if (prepareErr != amnezia::ErrorCode::NoError) {
+        setState(State::Failed);
+        emit failed(prepareErr);
+        return;
+    }
+
+    startActivationDeadline(ACTIVATION_TIMEOUT_MSEC);
+
+    const amnezia::ErrorCode err = m_protocol->start();
+    if (err != amnezia::ErrorCode::NoError) {
+        cancelActivationDeadline();
+        setState(State::Failed);
+        emit failed(err);
+    }
+}
+
+void Tunnel::commit() {
+    if (m_state != State::Prepared) {
+        return;
+    }
+    setState(State::Committing);
+    startActivationDeadline(ACTIVATION_TIMEOUT_MSEC);
+    if (m_protocol) {
+        m_protocol->setPrimary(m_config);
+    }
+}
+
+void Tunnel::onPrimaryReady() {
+    if (m_state != State::Committing) {
+        return;
+    }
+    cancelActivationDeadline();
+    setState(State::Active);
+    emit activated();
+}
+
+void Tunnel::onPrimaryFailed() {
+    if (m_state != State::Committing) {
+        return;
+    }
+    cancelActivationDeadline();
+    setState(State::Failed);
+    emit failed(m_protocol ? m_protocol->lastError() : amnezia::ErrorCode::InternalError);
+}
+
+void Tunnel::deactivate() {
+    if (m_state == State::Gone || m_state == State::Idle) {
+        return;
+    }
+    cancelActivationDeadline();
+    setState(State::Gone);
+    if (m_protocol) {
+        m_protocol->stop();
+    }
+}
+
+void Tunnel::restart() {
+    deactivate();
+    setState(State::Idle);
+    prepare();
+}
+
+void Tunnel::setState(State next) {
+    if (m_state == next) {
+        return;
+    }
+    m_state = next;
+    emit stateChanged(m_state);
+}
+
+void Tunnel::startActivationDeadline(int msec) {
+    if (!m_deadline) {
+        m_deadline = new QTimer(this);
+        m_deadline->setSingleShot(true);
+        connect(m_deadline, &QTimer::timeout, this, [this]() {
+            if (m_state != State::Preparing && m_state != State::Committing) {
+                return;
+            }
+            setState(State::Failed);
+            emit failed(amnezia::ErrorCode::InternalError);
+        });
+    }
+    m_deadline->start(msec);
+}
+
+void Tunnel::cancelActivationDeadline() {
+    if (m_deadline) {
+        m_deadline->stop();
+    }
+}
+
+void Tunnel::onProtocolStateChanged(Vpn::ConnectionState state) {
+    if (m_state == State::Preparing && state == Vpn::ConnectionState::Connected) {
+        cancelActivationDeadline();
+        setState(State::Prepared);
+        emit prepared();
+        return;
+    }
+
+    const bool inLiveState = m_state == State::Preparing
+                          || m_state == State::Prepared
+                          || m_state == State::Committing
+                          || m_state == State::Active;
+    const bool isFailureSignal = state == Vpn::ConnectionState::Disconnected
+                              || state == Vpn::ConnectionState::Error;
+    if (inLiveState && isFailureSignal) {
+        cancelActivationDeadline();
+        setState(State::Failed);
+        emit failed(m_protocol ? m_protocol->lastError() : amnezia::ErrorCode::InternalError);
+    }
+}

client/core/tunnel.h

@@ -0,0 +1,82 @@
+#ifndef TUNNEL_H
+#define TUNNEL_H
+
+#include <QJsonObject>
+#include <QObject>
+#include <QSharedPointer>
+#include <QString>
+
+#include "core/protocols/vpnProtocol.h"
+#include "core/utils/containerEnum.h"
+#include "core/utils/errorCodes.h"
+
+class QTimer;
+
+class Tunnel : public QObject {
+    Q_OBJECT
+
+public:
+    enum class State {
+        Idle,
+        Preparing,
+        Prepared,
+        Committing,
+        Active,
+        Gone,
+        Failed,
+    };
+    Q_ENUM(State)
+
+    Tunnel(QString ifname,
+           amnezia::DockerContainer container,
+           QJsonObject config,
+           QString remoteAddress,
+           QObject* parent = nullptr);
+    ~Tunnel() override;
+
+    const QString& ifname() const { return m_ifname; }
+    const QString& remoteAddress() const { return m_remoteAddress; }
+    amnezia::DockerContainer container() const { return m_container; }
+    const QJsonObject& config() const { return m_config; }
+    State state() const { return m_state; }
+    QSharedPointer<VpnProtocol> protocol() const { return m_protocol; }
+
+    const QString& handoverIfname() const { return m_handoverIfname; }
+    void setHandoverIfname(const QString& ifname) { m_handoverIfname = ifname; }
+    void clearHandoverIfname() { m_handoverIfname.clear(); }
+
+    virtual void prepare();
+    virtual void commit();
+    virtual void deactivate();
+    virtual void restart();
+
+signals:
+    void prepared();
+    void activated();
+    void failed(amnezia::ErrorCode);
+    void stateChanged(Tunnel::State);
+    void bytesChanged(quint64 rxBytes, quint64 txBytes);
+    void addressesUpdated(const QString& gateway, const QString& localAddress);
+
+protected:
+    void setState(State);
+    void startActivationDeadline(int msec);
+    void cancelActivationDeadline();
+
+    QString m_ifname;
+    QString m_remoteAddress;
+    QString m_handoverIfname;
+    amnezia::DockerContainer m_container;
+    QJsonObject m_config;
+    QSharedPointer<VpnProtocol> m_protocol;
+
+private:
+    void onProtocolStateChanged(Vpn::ConnectionState state);
+    void onPrimaryReady();
+    void onPrimaryFailed();
+
+    State m_state = State::Idle;
+    QTimer* m_deadline = nullptr;
+};
+
+#endif  // TUNNEL_H

client/core/utils/networkUtilities.cpp

@@ -286,7 +286,7 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
     return { resGateway, QNetworkInterface::interfaceFromIndex(resIndex) };
 #endif
 #ifdef Q_OS_LINUX
-    constexpr int BUFFER_SIZE = 100;
+    constexpr int BUFFER_SIZE = 8192;
     int     received_bytes = 0, msg_len = 0, route_attribute_len = 0;
     int     sock = -1, msgseq = 0;
     struct  nlmsghdr *nlh, *nlmsg;
@@ -294,7 +294,7 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
     // This struct contain route attributes (route type)
     struct  rtattr *route_attribute;
     char    gateway_address[INET_ADDRSTRLEN], interface[IF_NAMESIZE];
-    char    msgbuf[BUFFER_SIZE], buffer[BUFFER_SIZE];
+    char    msgbuf[100], buffer[BUFFER_SIZE];
     char    *ptr = buffer;
     struct timeval tv;
 
@@ -339,8 +339,8 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         nlh = (struct nlmsghdr *) ptr;
 
         /* Check if the header is valid */
-        if((NLMSG_OK(nlmsg, received_bytes) == 0) ||
-            (nlmsg->nlmsg_type == NLMSG_ERROR))
+        if((NLMSG_OK(nlh, received_bytes) == 0) ||
+            (nlh->nlmsg_type == NLMSG_ERROR))
         {
             perror("Error in received packet");
             return {};
@@ -355,13 +355,15 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         }
 
         /* Break if its not a multi part message */
-        if ((nlmsg->nlmsg_flags & NLM_F_MULTI) == 0)
+        if ((nlh->nlmsg_flags & NLM_F_MULTI) == 0)
             break;
     }
-    while ((nlmsg->nlmsg_seq != msgseq) || (nlmsg->nlmsg_pid != getpid()));
+    while ((nlh->nlmsg_seq != msgseq) || (nlh->nlmsg_pid != getpid()));
 
     /* parse response */
-    for ( ; NLMSG_OK(nlh, received_bytes); nlh = NLMSG_NEXT(nlh, received_bytes))
+    int remaining = msg_len + received_bytes;
+    nlh = (struct nlmsghdr *) buffer;
+    for ( ; NLMSG_OK(nlh, remaining); nlh = NLMSG_NEXT(nlh, remaining))
     {
         /* Get the route data */
         route_entry = (struct rtmsg *) NLMSG_DATA(nlh);
@@ -370,6 +372,10 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         if (route_entry->rtm_table != RT_TABLE_MAIN)
             continue;
 
+        /* Reset per-route to avoid cross-route state pollution */
+        memset(gateway_address, 0, sizeof(gateway_address));
+        memset(interface, 0, sizeof(interface));
+
         route_attribute = (struct rtattr *) RTM_RTA(route_entry);
         route_attribute_len = RTM_PAYLOAD(nlh);
 
@@ -391,10 +397,15 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
         }
 
         if ((*gateway_address) && (*interface)) {
+            if (QString::fromUtf8(interface).startsWith("amn")) {
+                continue;
+            }
             qDebug() << "Gateway " << gateway_address << " for interface " << interface;
             break;
         }
     }
+    if (!(*gateway_address) || !(*interface))
+        qDebug() << "getGatewayAndIface: no gateway found";
     close(sock);
     return { gateway_address, QNetworkInterface::interfaceFromName(interface) };
 #endif
@@ -449,10 +460,15 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
                 sa_tab[RTAX_DST]->sa_family == afinet_type[ip_type] &&
                 sa_tab[RTAX_GATEWAY]->sa_family == afinet_type[ip_type])
             {
+                char ifname[IF_NAMESIZE] = {0};
+                const bool isTun = if_indextoname(rt->rtm_index, ifname)
+                                && QString::fromUtf8(ifname).startsWith("utun");
+
                 if (afinet_type[ip_type] == AF_INET)
                 {
                     if ((reinterpret_cast<struct sockaddr_in*>(sa_tab[RTAX_DST]))->sin_addr.s_addr == 0)
                     {
+                        if (isTun) continue;
                         char dstStr4[INET_ADDRSTRLEN];
                         char srcStr4[INET_ADDRSTRLEN];
                         memcpy(srcStr4,
@@ -470,6 +486,7 @@ QPair<QString, QNetworkInterface> NetworkUtilities::getGatewayAndIface()
                 {
                     if ((reinterpret_cast<struct sockaddr_in*>(sa_tab[RTAX_DST]))->sin_addr.s_addr == 0)
                     {
+                        if (isTun) continue;
                         char dstStr6[INET6_ADDRSTRLEN];
                         char srcStr6[INET6_ADDRSTRLEN];
                         memcpy(srcStr6,

client/core/vpnTrafficGuard.cpp

@@ -0,0 +1,633 @@
+#include "vpnTrafficGuard.h"
+
+#include <QDebug>
+#include <QEventLoop>
+#include <QHostInfo>
+#include <QNetworkInterface>
+#include <QPointer>
+#include <QStringList>
+#include <QTimer>
+#include <QJsonObject>
+
+#ifdef AMNEZIA_DESKTOP
+    #include "core/utils/ipcClient.h"
+#endif
+
+#include "core/utils/networkUtilities.h"
+#include "core/utils/constants/protocolConstants.h"
+#include "core/tunnel.h"
+#include "mozilla/localsocketcontroller.h"
+
+namespace {
+QStringList allowedIpPrefixesFor(const QJsonObject& activateJson)
+{
+    QStringList prefixes;
+    const QJsonArray ranges = activateJson.value("allowedIPAddressRanges").toArray();
+    for (const QJsonValue& v : ranges) {
+        const QJsonObject r = v.toObject();
+        const QString addr = r.value("address").toString();
+        if (addr.isEmpty()) continue;
+        prefixes.append(QStringLiteral("%1/%2").arg(addr).arg(r.value("range").toInt()));
+    }
+    return prefixes;
+}
+
+QStringList excludedAddressesFor(const QJsonObject& activateJson)
+{
+    QStringList addrs;
+    const QJsonArray excluded = activateJson.value("excludedAddresses").toArray();
+    for (const QJsonValue& v : excluded) {
+        const QString s = v.toString();
+        if (!s.isEmpty()) addrs.append(s);
+    }
+    return addrs;
+}
+
+QStringList resolversFor(const QJsonObject& activateJson)
+{
+    QStringList dns;
+    const QString primary = activateJson.value("primaryDnsServer").toString();
+    if (!primary.isEmpty()) dns.append(primary);
+    const QString secondary = activateJson.value("secondaryDnsServer").toString();
+    if (!secondary.isEmpty()) dns.append(secondary);
+    return dns;
+}
+
+QString interfaceNameForAddress(const QString& address)
+{
+    if (address.isEmpty()) return QString();
+    const QHostAddress target(address);
+    for (const QNetworkInterface& iface : QNetworkInterface::allInterfaces()) {
+        for (const QNetworkAddressEntry& entry : iface.addressEntries()) {
+            if (entry.ip() == target) {
+                return iface.name();
+            }
+        }
+    }
+    return QString();
+}
+}
+
+VpnTrafficGuard::VpnTrafficGuard(SecureAppSettingsRepository* appSettings, QObject *parent)
+    : QObject(parent), m_appSettingsRepository(appSettings)
+{
+
+}
+
+VpnTrafficGuard::~VpnTrafficGuard()
+{
+}
+
+void VpnTrafficGuard::setConfig(const QJsonObject &config)
+{
+    m_config = config;
+}
+
+bool VpnTrafficGuard::allowEndpoint(const QString &remoteAddress, const QString &ifname)
+{
+#ifdef AMNEZIA_DESKTOP
+    if (remoteAddress.isEmpty()) {
+        return false;
+    }
+    if (m_allowedEndpoints.contains(remoteAddress)) {
+        return true;
+    }
+    m_allowedEndpoints.append(remoteAddress);
+    return IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(ifname, QStringList(remoteAddress));
+        return reply.waitForFinished(1000) && reply.returnValue();
+    });
+#else
+    Q_UNUSED(remoteAddress)
+    Q_UNUSED(ifname)
+    return true;
+#endif
+}
+
+void VpnTrafficGuard::setupRoutes(const QJsonObject &vpnConfiguration, const QSharedPointer<VpnProtocol> &protocol, const QString &remoteAddress)
+{
+#ifdef AMNEZIA_DESKTOP
+    if (!m_appSettingsRepository) {
+        qCritical() << "VpnTrafficGuard::setupRoutes: repositories not initialized";
+        return;
+    }
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        iface->resetIpStack();
+        auto flushDns = iface->flushDns();
+        if (flushDns.waitForFinished() && flushDns.returnValue())
+            qDebug() << "VpnTrafficGuard::setupRoutes: Successfully flushed DNS";
+        else
+            qWarning() << "VpnTrafficGuard::setupRoutes: Failed to flush DNS";
+
+        const QString proto = vpnConfiguration.value(configKey::vpnProto).toString();
+        const bool isWgBased = (proto == ProtocolUtils::protoToString(Proto::Awg) ||
+                                proto == ProtocolUtils::protoToString(Proto::WireGuard));
+        if (!isWgBased) {
+            if (!protocol) {
+                qWarning() << "VpnTrafficGuard::setupRoutes: protocol is null";
+                return;
+            }
+            QString dns1 = vpnConfiguration.value(configKey::dns1).toString();
+            QString dns2 = vpnConfiguration.value(configKey::dns2).toString();
+            const bool isXrayBased = (proto == ProtocolUtils::protoToString(Proto::Xray) ||
+                                      proto == ProtocolUtils::protoToString(Proto::SSXray));
+            const QString tunIfname = isXrayBased
+                ? vpnConfiguration.value("ifname").toString()
+                : interfaceNameForAddress(protocol->vpnLocalAddress());
+#ifdef Q_OS_LINUX
+            const QString tunGw = isXrayBased ? protocol->vpnGateway() : QString();
+#else
+            const QString tunGw = protocol->vpnGateway();
+#endif
+#ifdef Q_OS_MACOS
+            if (!m_appSettingsRepository->isSitesSplitTunnelingEnabled() || m_appSettingsRepository->routeMode() != amnezia::RouteMode::VpnAllExceptSites) {
+                iface->routeAddListVia(tunIfname, tunGw, QStringList() << dns1 << dns2);
+            }
+#else
+            iface->routeAddListVia(tunIfname, tunGw, QStringList() << dns1 << dns2);
+#endif
+
+            if (m_appSettingsRepository->isSitesSplitTunnelingEnabled()) {
+                iface->routeDeleteList(protocol->vpnGateway(), QStringList() << "0.0.0.0");
+                if (m_appSettingsRepository->routeMode() == amnezia::route_mode_ns::VpnOnlyForwardSites) {
+                    QPointer<VpnProtocol> protocolPtr(protocol.data());
+                    QTimer::singleShot(1000, protocol.data(),
+                                        [this, protocolPtr]() {
+                                                if (!protocolPtr) {
+                                                    return;
+                                                }
+                                                addSplitTunnelRoutes(protocolPtr->vpnGateway(), m_appSettingsRepository->routeMode());
+                                            });
+                } else if (m_appSettingsRepository->routeMode() == amnezia::route_mode_ns::VpnAllExceptSites) {
+                    iface->routeAddListVia(tunIfname, tunGw, QStringList() << "0.0.0.0/1" << "128.0.0.0/1");
+
+                    iface->routeAddList(protocol->routeGateway(), QStringList() << remoteAddress);
+#ifdef Q_OS_MACOS
+                    iface->routeAddList(protocol->routeGateway(), QStringList() << dns1 << dns2);
+#endif
+                    addSplitTunnelRoutes(protocol->routeGateway(), m_appSettingsRepository->routeMode());
+                }
+            }
+        }
+    });
+#endif
+}
+
+void VpnTrafficGuard::addSplitTunnelRoutes(const QString &gw, amnezia::RouteMode mode)
+{
+#ifdef AMNEZIA_DESKTOP
+    if (!m_appSettingsRepository) {
+        qCritical() << "VpnTrafficGuard::addSplitTunnelRoutes: repositories not initialized";
+        return;
+    }
+
+    QStringList ips;
+    QStringList sites;
+    const QVariantMap &m = m_appSettingsRepository->vpnSites(mode);
+    for (auto i = m.constBegin(); i != m.constEnd(); ++i) {
+        if (NetworkUtilities::checkIpSubnetFormat(i.key())) {
+            ips.append(i.key());
+        } else {
+            if (NetworkUtilities::checkIpSubnetFormat(i.value().toString())) {
+                ips.append(i.value().toString());
+            }
+            sites.append(i.key());
+        }
+    }
+    ips.removeDuplicates();
+
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        iface->routeAddList(gw, ips);
+    });
+
+    for (const QString &site : sites) {
+        const auto &cbResolv = [this, site, gw, mode, ips](const QHostInfo &hostInfo) {
+            for (const QHostAddress &addr : hostInfo.addresses()) {
+                if (addr.protocol() == QAbstractSocket::NetworkLayerProtocol::IPv4Protocol) {
+                    const QString &ip = addr.toString();
+                    if (!ips.contains(ip)) {
+                        IpcClient::withInterface([gw, ip](QSharedPointer<IpcInterfaceReplica> iface) {
+                            iface->routeAddList(gw, QStringList() << ip);
+                        });
+                        m_appSettingsRepository->addVpnSite(mode, site, ip);
+                    }
+                    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
+                        auto reply = iface->flushDns();
+                        if (!reply.waitForFinished() || !reply.returnValue())
+                            qWarning() << "VpnTrafficGuard::addSplitTunnelRoutes: Failed to flush DNS";
+                    });
+                    break;
+                }
+            }
+        };
+        QHostInfo::lookupHost(site, this, cbResolv);
+    }
+#endif
+}
+
+void VpnTrafficGuard::finishFirewallHandover(Tunnel* tunnel)
+{
+#if defined(AMNEZIA_DESKTOP) && defined(Q_OS_WIN)
+    if (!tunnel) return;
+    const QString handoverIfname = tunnel->handoverIfname();
+    if (handoverIfname.isEmpty() || handoverIfname == tunnel->ifname()) {
+        tunnel->clearHandoverIfname();
+        return;
+    }
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        iface->disableKillSwitchForTunnel(handoverIfname, QStringList());
+    });
+    tunnel->clearHandoverIfname();
+#else
+    Q_UNUSED(tunnel)
+#endif
+}
+
+void VpnTrafficGuard::applyKillSwitch(Tunnel* tunnel, const QString &gateway, const QString &localAddress)
+{
+#ifdef AMNEZIA_DESKTOP
+    finishFirewallHandover(tunnel);
+
+    QJsonObject updatedConfig = m_config;
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+#ifdef Q_OS_WIN
+        const bool engineNamedInterface = VpnProtocol::isWireGuardBased(tunnel->container())
+            || VpnProtocol::isXrayBased(tunnel->container());
+        const QString ifname = engineNamedInterface ? updatedConfig.value("ifname").toString() : QString();
+        if (!ifname.isEmpty()) {
+            updatedConfig.insert("vpnGateway", gateway);
+            updatedConfig.insert("vpnServer", NetworkUtilities::getIPAddress(updatedConfig.value(configKey::hostName).toString()));
+            if (QVariant(updatedConfig.value(configKey::killSwitchOption).toString()).toBool()) {
+                iface->enableKillSwitch(updatedConfig, 0);
+            }
+            iface->enablePeerTraffic(updatedConfig);
+        } else {
+            QList<QNetworkInterface> netInterfaces = QNetworkInterface::allInterfaces();
+            for (int i = 0; i < netInterfaces.size(); i++) {
+                for (int j=0; j < netInterfaces.at(i).addressEntries().size(); j++)
+                {
+                    if (localAddress == netInterfaces.at(i).addressEntries().at(j).ip().toString()) {
+                        updatedConfig.insert("vpnAdapterIndex", netInterfaces.at(i).index());
+                        updatedConfig.insert("vpnGateway", gateway);
+                        updatedConfig.insert("vpnServer", NetworkUtilities::getIPAddress(updatedConfig.value(configKey::hostName).toString()));
+                        if (QVariant(updatedConfig.value(configKey::killSwitchOption).toString()).toBool()) {
+                            iface->enableKillSwitch(updatedConfig, netInterfaces.at(i).index());
+                        }
+                        iface->enablePeerTraffic(updatedConfig);
+                    }
+                }
+            }
+        }
+#endif
+#if defined(Q_OS_LINUX) || defined(Q_OS_MACOS)
+        if (QVariant(updatedConfig.value(configKey::killSwitchOption).toString()).toBool()) {
+            updatedConfig.insert("vpnServer",
+                                NetworkUtilities::getIPAddress(updatedConfig.value(amnezia::configKey::hostName).toString()));
+            QRemoteObjectPendingReply<bool> reply = iface->enableKillSwitch(updatedConfig, 0);
+            //TODO: why it takes so long?
+            if (!reply.waitForFinished(1000) || !reply.returnValue()) {
+                qWarning() << "VpnTrafficGuard::applyKillSwitch: Failed to enable killswitch";
+            } else {
+                qDebug() << "VpnTrafficGuard::applyKillSwitch: Successfully enabled killswitch";
+            }
+        }
+#endif
+        const QString proto = updatedConfig.value(configKey::vpnProto).toString();
+        const bool isXrayBased = (proto == ProtocolUtils::protoToString(Proto::Xray) ||
+                                  proto == ProtocolUtils::protoToString(Proto::SSXray));
+        if (isXrayBased) {
+            if (updatedConfig.value(configKey::splitTunnelType).toInt() == amnezia::route_mode_ns::VpnAllSites) {
+                static const QStringList subnets = { "1.0.0.0/8", "2.0.0.0/7", "4.0.0.0/6", "8.0.0.0/5", "16.0.0.0/4", "32.0.0.0/3", "64.0.0.0/2", "128.0.0.0/1" };
+                const QString xrayIfname = tunnel->ifname();
+                auto routeAddList = iface->routeAddListVia(xrayIfname, gateway, subnets);
+                if (!routeAddList.waitForFinished() || routeAddList.returnValue() != subnets.count()) {
+                    qCritical() << "Failed to set routes for TUN";
+                }
+            }
+            auto StopRoutingIpv6 = iface->StopRoutingIpv6();
+            if (!StopRoutingIpv6.waitForFinished() || !StopRoutingIpv6.returnValue()) {
+                qCritical() << "Failed to disable IPv6 routing";
+            } else {
+                m_ipv6RoutingStopped = true;
+            }
+        }
+    });
+#endif
+}
+
+void VpnTrafficGuard::flushAll()
+{
+#ifdef AMNEZIA_DESKTOP
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        iface->restoreTunnelResolvers();
+        QRemoteObjectPendingReply<bool> reply = iface->disableKillSwitch();
+        m_allowedEndpoints.clear();
+        //TODO: why it takes so long?
+        if (!reply.waitForFinished(1000) || !reply.returnValue()) {
+            qWarning() << "VpnTrafficGuard::flushAll: Failed to disable killswitch";
+        } else {
+            qDebug() << "VpnTrafficGuard::flushAll: Successfully disabled killswitch";
+        }
+        auto flushDns = iface->flushDns();
+        if (flushDns.waitForFinished() && flushDns.returnValue())
+            qDebug() << "VpnTrafficGuard::flushAll: Successfully flushed DNS";
+        else
+            qWarning() << "VpnTrafficGuard::flushAll: Failed to flush DNS";
+
+        auto clearSavedRoutes = iface->clearSavedRoutes();
+        if (clearSavedRoutes.waitForFinished() && clearSavedRoutes.returnValue())
+            qDebug() << "VpnTrafficGuard::flushAll: Successfully cleared saved routes";
+        else
+            qWarning() << "VpnTrafficGuard::flushAll: Failed to clear saved routes";
+        if (m_ipv6RoutingStopped) {
+            auto StartRoutingIpv6 = iface->StartRoutingIpv6();
+            if (!StartRoutingIpv6.waitForFinished() || !StartRoutingIpv6.returnValue()) {
+                qCritical() << "Failed to enable IPv6 routing";
+            } else {
+                m_ipv6RoutingStopped = false;
+            }
+        }
+    });
+#endif
+}
+
+void VpnTrafficGuard::reserve(Tunnel* tunnel)
+{
+    if (!tunnel) return;
+#ifdef AMNEZIA_DESKTOP
+    const bool engineNamedInterface = VpnProtocol::isWireGuardBased(tunnel->container())
+                                   || VpnProtocol::isXrayBased(tunnel->container());
+    allowEndpoint(tunnel->remoteAddress(), engineNamedInterface ? tunnel->ifname() : QString());
+#else
+    Q_UNUSED(tunnel)
+#endif
+}
+
+void VpnTrafficGuard::release(Tunnel* tunnel)
+{
+    if (!tunnel) return;
+    disconnect(tunnel, nullptr, this, nullptr);
+#ifdef AMNEZIA_DESKTOP
+    const bool engineNamedInterface = VpnProtocol::isWireGuardBased(tunnel->container())
+                                   || VpnProtocol::isXrayBased(tunnel->container());
+    m_allowedEndpoints.removeAll(tunnel->remoteAddress());
+    IpcClient::withInterface([this, &tunnel, engineNamedInterface](QSharedPointer<IpcInterfaceReplica> iface) {
+        iface->disableKillSwitchForTunnel(engineNamedInterface ? tunnel->ifname() : QString(), m_allowedEndpoints);
+    });
+#else
+    Q_UNUSED(tunnel)
+#endif
+}
+
+void VpnTrafficGuard::applyPolicy(Tunnel* tunnel)
+{
+    if (!tunnel) return;
+#ifdef AMNEZIA_DESKTOP
+    const QString ifname = tunnel->ifname();
+
+    if (VpnProtocol::isXrayBased(tunnel->container())) {
+        const QJsonObject cfg = tunnel->config();
+        const QString primary = cfg.value(amnezia::configKey::dns1).toString();
+        const QString secondary = cfg.value(amnezia::configKey::dns2).toString();
+        QList<QHostAddress> dns;
+        if (!primary.isEmpty()) dns.append(QHostAddress(primary));
+        if (!secondary.isEmpty() && secondary != primary) dns.append(QHostAddress(secondary));
+
+        IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+            auto updateRes = iface->updateResolvers(ifname, dns);
+            if (!updateRes.waitForFinished() || !updateRes.returnValue()) {
+                qWarning() << "VpnTrafficGuard::applyPolicy: updateResolvers failed for" << ifname;
+            }
+#ifdef Q_OS_MAC
+            const auto gw = NetworkUtilities::getGatewayAndIface();
+            const QString uplinkIface = gw.second.name();
+            const QString uplinkGateway = gw.first;
+            if (!uplinkIface.isEmpty() && !uplinkGateway.isEmpty()) {
+                auto add = iface->xrayAddUplinkRoutes(uplinkIface, uplinkGateway);
+                if (!add.waitForFinished() || !add.returnValue()) {
+                    qWarning() << "VpnTrafficGuard::applyPolicy: xrayAddUplinkRoutes failed on" << uplinkIface;
+                }
+            }
+#endif
+        });
+        return;
+    }
+
+    if (!VpnProtocol::isWireGuardBased(tunnel->container())) {
+#ifdef Q_OS_LINUX
+        const auto protocol = tunnel->protocol();
+        const QString realIfname = protocol ? interfaceNameForAddress(protocol->vpnLocalAddress()) : QString();
+        if (realIfname.isEmpty()) {
+            qWarning() << "VpnTrafficGuard::applyPolicy: could not resolve interface for tunnel DNS";
+            return;
+        }
+        const QJsonObject cfg = tunnel->config();
+        const QString primary = cfg.value(amnezia::configKey::dns1).toString();
+        const QString secondary = cfg.value(amnezia::configKey::dns2).toString();
+        QList<QHostAddress> dnsResolvers;
+        if (!primary.isEmpty()) dnsResolvers.append(QHostAddress(primary));
+        if (!secondary.isEmpty() && secondary != primary) dnsResolvers.append(QHostAddress(secondary));
+        if (!dnsResolvers.isEmpty()) {
+            IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+                auto updateRes = iface->updateResolvers(realIfname, dnsResolvers);
+                if (!updateRes.waitForFinished() || !updateRes.returnValue()) {
+                    qWarning() << "VpnTrafficGuard::applyPolicy: updateResolvers failed for" << realIfname;
+                }
+            });
+        }
+#endif
+        return;
+    }
+
+    const QJsonObject activate = LocalSocketController::buildActivateJson(tunnel->config(), tunnel->ifname());
+    const QStringList prefixes = allowedIpPrefixesFor(activate);
+    const QStringList excluded = excludedAddressesFor(activate);
+    const QStringList dns = resolversFor(activate);
+    const QString peer = tunnel->remoteAddress();
+
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        if (!peer.isEmpty()) iface->addExclusionRoute(ifname, peer);
+        for (const QString& addr : excluded) {
+            iface->addExclusionRoute(ifname, addr);
+        }
+        for (const QString& prefix : prefixes) {
+            iface->addAllowedIp(ifname, prefix);
+        }
+        iface->setTunnelResolvers(ifname, dns);
+        iface->flushDns();
+    });
+#else
+    Q_UNUSED(tunnel)
+#endif
+}
+
+void VpnTrafficGuard::revokePolicy(Tunnel* tunnel)
+{
+    if (!tunnel) return;
+#ifdef AMNEZIA_DESKTOP
+    const QString ifname = tunnel->ifname();
+
+    if (VpnProtocol::isXrayBased(tunnel->container())) {
+        IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+            iface->restoreResolvers();
+#ifdef Q_OS_MAC
+            const auto gw = NetworkUtilities::getGatewayAndIface();
+            const QString uplinkIface = gw.second.name();
+            const QString uplinkGateway = gw.first;
+            if (!uplinkIface.isEmpty()) {
+                iface->xrayRemoveUplinkRoutes(uplinkIface, uplinkGateway);
+            }
+#endif
+        });
+        return;
+    }
+
+    if (!VpnProtocol::isWireGuardBased(tunnel->container())) {
+#ifdef Q_OS_LINUX
+        IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+            iface->restoreResolvers();
+        });
+#endif
+        return;
+    }
+
+    const QJsonObject activate = LocalSocketController::buildActivateJson(tunnel->config(), tunnel->ifname());
+    const QStringList prefixes = allowedIpPrefixesFor(activate);
+    const QStringList excluded = excludedAddressesFor(activate);
+    const QString peer = tunnel->remoteAddress();
+
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        for (const QString& prefix : prefixes) {
+            iface->delAllowedIp(ifname, prefix);
+        }
+        for (const QString& addr : excluded) {
+            iface->delExclusionRoute(ifname, addr);
+        }
+        if (!peer.isEmpty()) iface->delExclusionRoute(ifname, peer);
+    });
+#else
+    Q_UNUSED(tunnel)
+#endif
+}
+
+void VpnTrafficGuard::bringUp(Tunnel* tunnel)
+{
+    if (!tunnel) return;
+    reserve(tunnel);
+    tunnel->prepare();
+}
+
+void VpnTrafficGuard::commit(Tunnel* tunnel)
+{
+    if (!tunnel) return;
+
+#ifdef Q_OS_WIN
+    const QString ipv4 = tunnel->config().value(QStringLiteral("deviceIpv4Address")).toString();
+    const QString ipv6 = tunnel->config().value(QStringLiteral("deviceIpv6Address")).toString();
+    if (!ipv4.isEmpty() || !ipv6.isEmpty()) {
+        IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+            auto ap = iface->applyAdapterAddress(tunnel->ifname(), ipv4, ipv6);
+            if (!ap.waitForFinished(15000) || !ap.returnValue()) {
+                qWarning() << "VpnTrafficGuard::commit: applyAdapterAddress failed for"
+                           << tunnel->ifname();
+            }
+        });
+    }
+#endif
+
+    applyPolicy(tunnel);
+    connect(tunnel, &Tunnel::activated, this, [this, tunnel] {
+        if (auto p = tunnel->protocol()) {
+            applyKillSwitch(tunnel, p->vpnGateway(), p->vpnLocalAddress());
+        }
+    });
+#ifdef Q_OS_WIN
+    connect(tunnel, &Tunnel::addressesUpdated, this,
+            [this, tunnel](const QString& gw, const QString& la) {
+        applyKillSwitch(tunnel, gw, la);
+    });
+#endif
+    tunnel->commit();
+}
+
+void VpnTrafficGuard::tearDown(Tunnel* tunnel)
+{
+    if (!tunnel) return;
+    revokePolicy(tunnel);
+    release(tunnel);
+    tunnel->deactivate();
+}
+
+void VpnTrafficGuard::swap(Tunnel* from, Tunnel* to)
+{
+    if (!to) return;
+    if (from) {
+        to->setHandoverIfname(from->ifname());
+    }
+
+#ifdef Q_OS_WIN
+    if (from) {
+        const QString fromIpv4 = from->config().value(QStringLiteral("deviceIpv4Address")).toString();
+        const QString fromIpv6 = from->config().value(QStringLiteral("deviceIpv6Address")).toString();
+        if (!fromIpv4.isEmpty() || !fromIpv6.isEmpty()) {
+            IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+                auto rm = iface->removeAdapterAddress(from->ifname(), fromIpv4, fromIpv6);
+                if (!rm.waitForFinished(2000) || !rm.returnValue()) {
+                    qWarning() << "VpnTrafficGuard::swap: removeAdapterAddress failed for"
+                               << from->ifname();
+                }
+            });
+        }
+    }
+#endif
+
+    QEventLoop loop;
+    QTimer guard;
+    guard.setSingleShot(true);
+    const auto activatedConn = connect(to, &Tunnel::activated, &loop, &QEventLoop::quit);
+    const auto failedConn = connect(to, &Tunnel::failed, &loop, [&loop](amnezia::ErrorCode) { loop.quit(); });
+    const auto timeoutConn = connect(&guard, &QTimer::timeout, &loop, [&loop]() {
+        qWarning() << "VpnTrafficGuard::swap: timed out waiting for new tunnel activation";
+        loop.quit();
+    });
+
+    commit(to);
+
+    guard.start(5000);
+    loop.exec();
+    guard.stop();
+
+    disconnect(activatedConn);
+    disconnect(failedConn);
+    disconnect(timeoutConn);
+
+    // Service IPCs are processed in order on a single connection. Wait on a trailing
+    // sync request so the killswitch enable from the activation handlers is fully
+    // applied before we deactivate the previous tunnel.
+    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
+        auto reply = iface->flushDns();
+        if (!reply.waitForFinished(5000) || !reply.returnValue()) {
+            qWarning() << "VpnTrafficGuard::swap: trailing sync IPC timed out or failed";
+        }
+    });
+
+    if (from) {
+        m_allowedEndpoints.removeAll(from->remoteAddress());
+#ifndef Q_OS_WIN
+        IpcClient::withInterface([this](QSharedPointer<IpcInterfaceReplica> iface) {
+            iface->resetKillSwitchAllowedRange(m_allowedEndpoints);
+        });
+#endif
+        revokePolicy(from);
+        from->deactivate();
+
+#ifdef Q_OS_MAC
+        if (VpnProtocol::isXrayBased(to->container())) {
+            if (auto p = to->protocol()) {
+                applyKillSwitch(to, p->vpnGateway(), p->vpnLocalAddress());
+                setupRoutes(to->config(), p, to->remoteAddress());
+            }
+        }
+#endif
+    }
+}

client/core/vpnTrafficGuard.h

@@ -0,0 +1,45 @@
+#ifndef VPNTRAFFICGUARD_H
+#define VPNTRAFFICGUARD_H
+
+#include <qobject.h>
+#include "core/repositories/secureAppSettingsRepository.h"
+#include "protocols/vpnProtocol.h"
+
+class Tunnel;
+
+class VpnTrafficGuard : public QObject
+{
+    Q_OBJECT
+
+public:
+    explicit VpnTrafficGuard(SecureAppSettingsRepository* appSettings, QObject* parent = nullptr);
+    ~VpnTrafficGuard() override;
+    void setConfig(const QJsonObject &config);
+    void setupRoutes(const QJsonObject &vpnConfiguration,
+                                 const QSharedPointer<VpnProtocol> &protocol,
+                                 const QString &remoteAddress);
+
+    void flushAll();
+    bool allowEndpoint(const QString &remoteAddress, const QString &ifname = QString());
+    void applyKillSwitch(Tunnel* tunnel, const QString &vpnGateway, const QString &vpnLocalAddress);
+
+    void reserve(Tunnel* tunnel);
+    void release(Tunnel* tunnel);
+    void applyPolicy(Tunnel* tunnel);
+    void revokePolicy(Tunnel* tunnel);
+
+    void bringUp(Tunnel* tunnel);
+    void commit(Tunnel* tunnel);
+    void tearDown(Tunnel* tunnel);
+    void swap(Tunnel* from, Tunnel* to);
+
+private:
+    void addSplitTunnelRoutes(const QString &gateway, amnezia::RouteMode mode);
+    void finishFirewallHandover(Tunnel* tunnel);
+    SecureAppSettingsRepository* m_appSettingsRepository;
+    QJsonObject m_config;
+    bool m_ipv6RoutingStopped = false;
+    QStringList m_allowedEndpoints;
+};
+
+#endif // VPNTRAFFICGUARD_H

client/daemon/daemon.cpp

@@ -34,8 +34,8 @@ Daemon::Daemon(QObject* parent) : QObject(parent) {
   Q_ASSERT(s_daemon == nullptr);
   s_daemon = this;
 
-  m_handshakeTimer.setSingleShot(true);
-  connect(&m_handshakeTimer, &QTimer::timeout, this, &Daemon::checkHandshake);
+  m_activationTimer.setSingleShot(false);
+  connect(&m_activationTimer, &QTimer::timeout, this, &Daemon::checkActivations);
 }
 
 Daemon::~Daemon() {
@@ -43,6 +43,9 @@ Daemon::~Daemon() {
 
   logger.debug() << "Daemon released";
 
+  qDeleteAll(m_tunnels);
+  m_tunnels.clear();
+
   Q_ASSERT(s_daemon == this);
   s_daemon = nullptr;
 }
@@ -53,69 +56,38 @@ Daemon* Daemon::instance() {
   return s_daemon;
 }
 
-bool Daemon::activate(const InterfaceConfig& config) {
-  Q_ASSERT(wgutils() != nullptr);
+bool Daemon::activate(const QString& ifname, const InterfaceConfig& config) {
+  logger.debug() << "Activating tunnel";
 
-  // There are 3 possible scenarios in which this method is called:
-  //
-  // 1. the VPN is off: the method tries to enable the VPN.
-  // 2. the VPN is on and the platform doesn't support the server-switching:
-  //    this method calls deactivate() and then it continues as 1.
-  // 3. the VPN is on and the platform supports the server-switching: this
-  //    method calls switchServer().
-  //
-  // At the end, if the activation succeds, the `connected` signal is emitted.
-  // If the activation abort's for any reason `the `activationFailure` signal is
-  // emitted.
-  logger.debug() << "Activating interface";
-  auto emit_failure_guard = qScopeGuard([this] { emit activationFailure(); });
-
-  if (m_connections.contains(config.m_hopType)) {
-    if (supportServerSwitching(config)) {
-      logger.debug() << "Already connected. Server switching supported.";
-
-      if (!switchServer(config)) {
-        return false;
-      }
-
-      if (!dnsutils()->restoreResolvers()) {
-        return false;
-      }
-
-      if (!maybeUpdateResolvers(config)) {
-        return false;
-      }
-
-      bool status = run(Switch, config);
-      logger.debug() << "Connection status:" << status;
-      if (status) {
-        m_connections[config.m_hopType] = ConnectionState(config);
-        m_handshakeTimer.start(HANDSHAKE_POLL_MSEC);
-        emit_failure_guard.dismiss();
-        return true;
-      }
+  WireguardUtils* wg = m_tunnels.value(ifname);
+  if (!wg) {
+    wg = createWgUtils();
+    if (!wg) {
+      logger.error() << "Failed to create wireguard utils.";
       return false;
     }
-
-    logger.warning() << "Already connected. Server switching not supported.";
-    if (!deactivate(false)) {
-      return false;
-    }
-
-    Q_ASSERT(!m_connections.contains(config.m_hopType));
-    if (activate(config)) {
-      emit_failure_guard.dismiss();
-      return true;
-    }
-    return false;
+    m_tunnels.insert(ifname, wg);
   }
+  if (m_primaryIfname.isEmpty()) {
+    m_primaryIfname = ifname;
+  }
+
+  ConnectionState& cs = m_connections[ifname];
+  cs.m_config = config;
+  cs.m_date = QDateTime();
+  cs.m_deadline = QDateTime::currentDateTime().addMSecs(ACTIVATION_TIMEOUT_MSEC);
+
+  auto failure_guard = qScopeGuard([this, ifname] {
+    deactivateTunnel(ifname);
+  });
 
   prepareActivation(config);
 
   // Bring up the wireguard interface if not already done.
-  if (!wgutils()->interfaceExists()) {
-    // Create the interface.
-    if (!wgutils()->addInterface(config)) {
+  if (!wg->interfaceExists()) {
+    InterfaceConfig bringupConfig = config;
+    bringupConfig.m_deferAddressSetup = (m_primaryIfname != ifname);
+    if (!wg->addInterface(bringupConfig)) {
       logger.error() << "Interface creation failed.";
       return false;
     }
@@ -131,60 +103,71 @@ bool Daemon::activate(const InterfaceConfig& config) {
     }
   }
 
-  // Configure routing for excluded addresses.
-  for (const QString& i : config.m_excludedAddresses) {
-    addExclusionRoute(IPAddress(i));
-  }
-
   // Add the peer to this interface.
-  if (!wgutils()->updatePeer(config)) {
+  if (!wg->updatePeer(config)) {
     logger.error() << "Peer creation failed.";
     return false;
   }
 
-  if (!maybeUpdateResolvers(config)) {
+  if (!m_activationTimer.isActive()) {
+    m_activationTimer.start(HANDSHAKE_POLL_MSEC);
+  }
+
+  failure_guard.dismiss();
+  return true;
+}
+
+bool Daemon::setPrimary(const QString& ifname, const InterfaceConfig& config) {
+  WireguardUtils* wg = m_tunnels.value(ifname);
+  if (!wg) {
+    logger.error() << "setPrimary: no tunnel for" << ifname;
+    return false;
+  }
+  logger.debug() << "setPrimary" << wg->interfaceName();
+
+  const QString priorPrimary = m_primaryIfname;
+  m_primaryIfname = ifname;
+
+  auto failure_guard = qScopeGuard([this, ifname, priorPrimary] {
+    deactivateTunnel(ifname);
+    m_primaryIfname = priorPrimary;
+  });
+
+  if (!run(Up, config)) {
     return false;
   }
 
-  // set routing
-  for (const IPAddress& ip : config.m_allowedIPAddressRanges) {
-    if (!wgutils()->updateRoutePrefix(ip)) {
-      logger.debug() << "Routing configuration failed for" << ip.toString();
-      return false;
-    }
-  }
+  m_connections[ifname].m_config = config;
 
-  bool status = run(Up, config);
-  logger.debug() << "Connection status:" << status;
-  if (status) {
-    m_connections[config.m_hopType] = ConnectionState(config);
-    m_handshakeTimer.start(HANDSHAKE_POLL_MSEC);
-    emit_failure_guard.dismiss();
-    return true;
-  }
-  return false;
+  failure_guard.dismiss();
+  return true;
 }
 
-bool Daemon::maybeUpdateResolvers(const InterfaceConfig& config) {
-  if ((config.m_hopType == InterfaceConfig::MultiHopExit) ||
-      (config.m_hopType == InterfaceConfig::SingleHop)) {
-    QList<QHostAddress> resolvers;
-    resolvers.append(QHostAddress(config.m_primaryDnsServer));
-    if (!config.m_secondaryDnsServer.isEmpty()) {
-        resolvers.append(QHostAddress(config.m_secondaryDnsServer));
-    }
+bool Daemon::deactivateTunnel(const QString& ifname) {
+  WireguardUtils* wg = m_tunnels.value(ifname);
+  const ConnectionState cs = m_connections.value(ifname);
+  const InterfaceConfig& config = cs.m_config;
+  const bool wasPrimary = (ifname == m_primaryIfname);
+  const bool isLastTunnel = wg && m_tunnels.size() == 1;
 
-    // If the DNS is not the Gateway, it's a user defined DNS
-    // thus, not add any other :)
-    if (config.m_primaryDnsServer == config.m_serverIpv4Gateway) {
-      resolvers.append(QHostAddress(config.m_serverIpv6Gateway));
-    }
-
-    if (!dnsutils()->updateResolvers(wgutils()->interfaceName(), resolvers)) {
-      return false;
+  if (wg) {
+    logger.debug() << "deactivateTunnel" << wg->interfaceName();
+    if (isLastTunnel) {
+      for (const IPAddress& prefix : m_excludedAddrSet.keys()) {
+        wg->deleteExclusionRoute(prefix);
+      }
+      m_excludedAddrSet.clear();
     }
+    wg->deletePeer(config);
+    wg->deleteInterface();
+    m_tunnels.remove(ifname);
+    delete wg;
   }
 
+  m_connections.remove(ifname);
+  if (wasPrimary) {
+    m_primaryIfname.clear();
+  }
   return true;
 }
 
@@ -209,26 +192,60 @@ bool Daemon::parseStringList(const QJsonObject& obj, const QString& name,
   return true;
 }
 
-bool Daemon::addExclusionRoute(const IPAddress& prefix) {
+bool Daemon::addExclusionRoute(const QString &ifname, const QString &addr) {
+  IPAddress prefix(addr);
   if (m_excludedAddrSet.contains(prefix)) {
     m_excludedAddrSet[prefix]++;
     return true;
   }
-  if (!wgutils()->addExclusionRoute(prefix)) {
+  WireguardUtils* wg = wgutilsFor(ifname);
+  if (!wg) wg = primaryWgutils();
+  if (!wg || !wg->addExclusionRoute(prefix)) {
     return false;
   }
   m_excludedAddrSet[prefix] = 1;
   return true;
 }
 
-bool Daemon::delExclusionRoute(const IPAddress& prefix) {
-  Q_ASSERT(m_excludedAddrSet.contains(prefix));
+bool Daemon::delExclusionRoute(const QString &ifname, const QString &addr) {
+  IPAddress prefix(addr);
+  if (!m_excludedAddrSet.contains(prefix)) {
+    return false;
+  }
   if (m_excludedAddrSet[prefix] > 1) {
     m_excludedAddrSet[prefix]--;
     return true;
   }
   m_excludedAddrSet.remove(prefix);
-  return wgutils()->deleteExclusionRoute(prefix);
+  WireguardUtils* wg = wgutilsFor(ifname);
+  if (!wg) wg = primaryWgutils();
+  return wg && wg->deleteExclusionRoute(prefix);
+}
+
+bool Daemon::addAllowedIp(const QString &ifname, const QString &prefix) {
+  WireguardUtils* wg = wgutilsFor(ifname);
+  return wg && wg->updateRoutePrefix(IPAddress(prefix));
+}
+
+bool Daemon::delAllowedIp(const QString &ifname, const QString &prefix) {
+  WireguardUtils* wg = wgutilsFor(ifname);
+  return wg && wg->deleteRoutePrefix(IPAddress(prefix));
+}
+
+bool Daemon::setTunnelResolvers(const QString &ifname, const QStringList &resolvers) {
+  WireguardUtils* wg = wgutilsFor(ifname);
+  if (!wg || !dnsutils()) {
+    return false;
+  }
+  QList<QHostAddress> hostAddrs;
+  for (const QString& r : resolvers) {
+    hostAddrs.append(QHostAddress(r));
+  }
+  return dnsutils()->updateResolvers(wg->interfaceName(), hostAddrs);
+}
+
+bool Daemon::restoreTunnelResolvers() {
+  return dnsutils() && dnsutils()->restoreResolvers();
 }
 
 // static
@@ -440,17 +457,16 @@ bool Daemon::parseConfig(const QJsonObject& obj, InterfaceConfig& config) {
   if (!obj.value("I5").isNull()) {
     config.m_specialJunk["I5"] = obj.value("I5").toString();
   }
+  config.m_ifname = obj.value("ifname").toString();
 
   return true;
 }
 
 bool Daemon::deactivate(bool emitSignals) {
-  Q_ASSERT(wgutils() != nullptr);
+  const QString primary = m_primaryIfname;
 
-  // Deactivate the main interface.
-  if (!m_connections.isEmpty()) {
-    const ConnectionState& state = m_connections.first();
-    if (!run(Down, state.m_config)) {
+  if (m_connections.contains(primary)) {
+    if (!run(Down, m_connections.value(primary).m_config)) {
       return false;
     }
   }
@@ -459,31 +475,26 @@ bool Daemon::deactivate(bool emitSignals) {
     emit disconnected();
   }
 
-  // Cleanup DNS
-  if (!dnsutils()->restoreResolvers()) {
-    logger.warning() << "Failed to restore DNS resolvers.";
-  }
-
-  // Cleanup peers and routing
-  for (const ConnectionState& state : m_connections) {
-    const InterfaceConfig& config = state.m_config;
-    logger.debug() << "Deleting routes for" << config.m_hopType;
-    for (const IPAddress& ip : config.m_allowedIPAddressRanges) {
-      wgutils()->deleteRoutePrefix(ip);
+  const QStringList ifnames = m_tunnels.keys();
+  for (const QString& ifname : ifnames) {
+    if (ifname != primary) {
+      deactivateTunnel(ifname);
     }
-    wgutils()->deletePeer(config);
   }
 
-  // Cleanup routing for excluded addresses.
-  for (auto iterator = m_excludedAddrSet.constBegin();
-       iterator != m_excludedAddrSet.constEnd(); ++iterator) {
-    wgutils()->deleteExclusionRoute(iterator.key());
+  if (auto* wg = primaryWgutils()) {
+    for (const IPAddress& prefix : m_excludedAddrSet.keys()) {
+      wg->deleteExclusionRoute(prefix);
+    }
   }
   m_excludedAddrSet.clear();
 
-  m_connections.clear();
-  // Delete the interface
-  return wgutils()->deleteInterface();
+  if (m_tunnels.contains(primary)) {
+    deactivateTunnel(primary);
+  }
+
+  m_activationTimer.stop();
+  return true;
 }
 
 QString Daemon::logs() {
@@ -492,79 +503,18 @@ QString Daemon::logs() {
 
 void Daemon::cleanLogs() { }
 
-bool Daemon::supportServerSwitching(const InterfaceConfig& config) const {
-  if (!m_connections.contains(config.m_hopType)) {
-    return false;
-  }
-  const InterfaceConfig& current =
-      m_connections.value(config.m_hopType).m_config;
-
-  return current.m_privateKey == config.m_privateKey &&
-         current.m_deviceIpv4Address == config.m_deviceIpv4Address &&
-         current.m_deviceIpv6Address == config.m_deviceIpv6Address &&
-         current.m_serverIpv4Gateway == config.m_serverIpv4Gateway &&
-         current.m_serverIpv6Gateway == config.m_serverIpv6Gateway;
-}
-
-bool Daemon::switchServer(const InterfaceConfig& config) {
-  Q_ASSERT(wgutils() != nullptr);
-
-  logger.debug() << "Switching server for" << config.m_hopType;
-
-  Q_ASSERT(m_connections.contains(config.m_hopType));
-  const InterfaceConfig& lastConfig =
-      m_connections.value(config.m_hopType).m_config;
-
-  // Configure routing for new excluded addresses.
-  for (const QString& i : config.m_excludedAddresses) {
-    addExclusionRoute(IPAddress(i));
-  }
-
-  // Activate the new peer and its routes.
-  if (!wgutils()->updatePeer(config)) {
-    logger.error() << "Server switch failed to update the wireguard interface";
-    return false;
-  }
-  for (const IPAddress& ip : config.m_allowedIPAddressRanges) {
-    if (!wgutils()->updateRoutePrefix(ip)) {
-      logger.error() << "Server switch failed to update the routing table";
-      break;
-    }
-  }
-
-  // Remove routing entries for the old peer.
-  for (const QString& i : lastConfig.m_excludedAddresses) {
-    delExclusionRoute(QHostAddress(i));
-  }
-  for (const IPAddress& ip : lastConfig.m_allowedIPAddressRanges) {
-    if (!config.m_allowedIPAddressRanges.contains(ip)) {
-      wgutils()->deleteRoutePrefix(ip);
-    }
-  }
-
-  // Remove the old peer if it is no longer necessary.
-  if (config.m_serverPublicKey != lastConfig.m_serverPublicKey) {
-    if (!wgutils()->deletePeer(lastConfig)) {
-      return false;
-    }
-  }
-
-  m_connections[config.m_hopType] = ConnectionState(config);
-  return true;
-}
-
 QJsonObject Daemon::getStatus() {
-  Q_ASSERT(wgutils() != nullptr);
   QJsonObject json;
   logger.debug() << "Status request";
 
-  if (!wgutils()->interfaceExists() || m_connections.isEmpty()) {
+  WireguardUtils* wg = primaryWgutils();
+  if (!wg || !wg->interfaceExists() || !m_connections.contains(m_primaryIfname)) {
     json.insert("connected", QJsonValue(false));
     return json;
   }
 
-  const ConnectionState& connection = m_connections.first();
-  QList<WireguardUtils::PeerStatus> peers = wgutils()->getPeerStatus();
+  const ConnectionState& connection = m_connections.value(m_primaryIfname);
+  QList<WireguardUtils::PeerStatus> peers = wg->getPeerStatus();
   for (const WireguardUtils::PeerStatus& status : peers) {
     if (status.m_pubkey != connection.m_config.m_serverPublicKey) {
       continue;
@@ -584,38 +534,50 @@ QJsonObject Daemon::getStatus() {
   return json;
 }
 
-void Daemon::checkHandshake() {
-  Q_ASSERT(wgutils() != nullptr);
+void Daemon::checkActivations() {
+  const QDateTime now = QDateTime::currentDateTime();
+  QStringList timedOut;
+  bool anyPending = false;
 
-  logger.debug() << "Checking for handshake...";
+  for (auto it = m_connections.begin(); it != m_connections.end(); ++it) {
+    const QString& ifname = it.key();
+    ConnectionState& cs = it.value();
+    if (cs.m_date.isValid()) {
+      continue;  // already handshaked
+    }
+    logger.debug() << "awaiting" << cs.m_config.m_serverPublicKey;
 
-  int pendingHandshakes = 0;
-  QList<WireguardUtils::PeerStatus> peers = wgutils()->getPeerStatus();
-  for (ConnectionState& connection : m_connections) {
-    const InterfaceConfig& config = connection.m_config;
-    if (connection.m_date.isValid()) {
+    WireguardUtils* wg = m_tunnels.value(ifname);
+    bool handshaked = false;
+    if (wg) {
+      for (const WireguardUtils::PeerStatus& status : wg->getPeerStatus()) {
+        if (status.m_pubkey != cs.m_config.m_serverPublicKey) {
+          continue;
+        }
+        if (status.m_handshake != 0) {
+          cs.m_date.setMSecsSinceEpoch(status.m_handshake);
+          emit tunnelConnected(ifname, status.m_pubkey);
+          handshaked = true;
+        }
+      }
+    }
+    if (handshaked) {
       continue;
     }
-    logger.debug() << "awaiting" << config.m_serverPublicKey;
-
-    // Check if the handshake has completed.
-    for (const WireguardUtils::PeerStatus& status : peers) {
-      if (config.m_serverPublicKey != status.m_pubkey) {
-        continue;
-      }
-      if (status.m_handshake != 0) {
-        connection.m_date.setMSecsSinceEpoch(status.m_handshake);
-        emit connected(status.m_pubkey);
-      }
-    }
-
-    if (!connection.m_date.isValid()) {
-      pendingHandshakes++;
+    if (cs.m_deadline.isValid() && now > cs.m_deadline) {
+      timedOut.append(ifname);
+    } else {
+      anyPending = true;
     }
   }
 
-  // Check again if there were connections that haven't completed a handshake.
-  if (pendingHandshakes > 0) {
-    m_handshakeTimer.start(HANDSHAKE_POLL_MSEC);
+  for (const QString& ifname : timedOut) {
+    logger.warning() << "Tunnel handshake timed out:" << m_tunnels.value(ifname)->interfaceName();
+    emit tunnelHandshakeFailed(ifname);
+    deactivateTunnel(ifname);
+  }
+
+  if (!anyPending) {
+    m_activationTimer.stop();
   }
 }

client/daemon/daemon.h

@@ -22,7 +22,6 @@ class Daemon : public QObject {
   enum Op {
     Up,
     Down,
-    Switch,
   };
 
   explicit Daemon(QObject* parent);
@@ -32,10 +31,22 @@ class Daemon : public QObject {
 
   static bool parseConfig(const QJsonObject& obj, InterfaceConfig& config);
 
-  virtual bool activate(const InterfaceConfig& config);
+  bool activate(const QString& ifname, const InterfaceConfig& config);
+  bool setPrimary(const QString& ifname, const InterfaceConfig& config);
+  bool deactivateTunnel(const QString& ifname);
   virtual bool deactivate(bool emitSignals = true);
   virtual QJsonObject getStatus();
 
+  bool addExclusionRoute(const QString &ifname, const QString &addr);
+  bool delExclusionRoute(const QString &ifname, const QString &addr);
+  bool addAllowedIp(const QString &ifname, const QString &prefix);
+  bool delAllowedIp(const QString &ifname, const QString &prefix);
+  bool setTunnelResolvers(const QString &ifname, const QStringList &resolvers);
+  bool restoreTunnelResolvers();
+
+  const QString& primaryIfname() const { return m_primaryIfname; }
+  WireguardUtils* wgutilsFor(const QString& ifname) const { return m_tunnels.value(ifname); }
+
   // Callback before any Activating measure is done
   virtual void prepareActivation(const InterfaceConfig& config, int inetAdapterIndex = 0) {
       Q_UNUSED(config)  };
@@ -46,19 +57,15 @@ class Daemon : public QObject {
   void cleanLogs();
 
  signals:
-  void connected(const QString& pubkey);
-  /**
-   * Can be fired if a call to activate() was unsucessfull
-   * and connected systems should rollback
-   */
-  void activationFailure();
+  void tunnelConnected(const QString& ifname, const QString& pubkey);
+  void tunnelHandshakeFailed(const QString& ifname);
   void disconnected();
   void backendFailure(DaemonError reason = DaemonError::ERROR_FATAL);
 
  private:
-  bool maybeUpdateResolvers(const InterfaceConfig& config);
-  bool addExclusionRoute(const IPAddress& address);
-  bool delExclusionRoute(const IPAddress& address);
+  void checkActivations();
+  WireguardUtils* primaryWgutils() const { return m_tunnels.value(m_primaryIfname); }
+  QTimer m_activationTimer;
 
  protected:
   virtual bool run(Op op, const InterfaceConfig& config) {
@@ -66,9 +73,11 @@ class Daemon : public QObject {
     Q_UNUSED(config);
     return true;
   }
-  virtual bool supportServerSwitching(const InterfaceConfig& config) const;
-  virtual bool switchServer(const InterfaceConfig& config);
-  virtual WireguardUtils* wgutils() const = 0;
+  virtual WireguardUtils* createWgUtils() = 0;
+
+  QMap<QString, WireguardUtils*> m_tunnels;
+  QString m_primaryIfname;
+
   virtual bool supportIPUtils() const { return false; }
   virtual IPUtils* iputils() { return nullptr; }
   virtual DnsUtils* dnsutils() { return nullptr; }
@@ -76,18 +85,16 @@ class Daemon : public QObject {
   static bool parseStringList(const QJsonObject& obj, const QString& name,
                               QStringList& list);
 
-  void checkHandshake();
-
   class ConnectionState {
    public:
     ConnectionState(){};
     ConnectionState(const InterfaceConfig& config) { m_config = config; }
     QDateTime m_date;
+    QDateTime m_deadline;
     InterfaceConfig m_config;
   };
-  QMap<InterfaceConfig::HopType, ConnectionState> m_connections;
+  QMap<QString, ConnectionState> m_connections;
   QHash<IPAddress, int> m_excludedAddrSet;
-  QTimer m_handshakeTimer;
 };
 
 #endif  // DAEMON_H

client/daemon/daemonlocalserverconnection.cpp

@@ -31,8 +31,10 @@ DaemonLocalServerConnection::DaemonLocalServerConnection(QObject* parent,
           &DaemonLocalServerConnection::readData);
 
   Daemon* daemon = Daemon::instance();
-  connect(daemon, &Daemon::connected, this,
-          &DaemonLocalServerConnection::connected);
+  connect(daemon, &Daemon::tunnelConnected,
+          this, &DaemonLocalServerConnection::onTunnelConnected);
+  connect(daemon, &Daemon::tunnelHandshakeFailed,
+          this, &DaemonLocalServerConnection::onTunnelHandshakeFailed);
   connect(daemon, &Daemon::disconnected, this,
           &DaemonLocalServerConnection::disconnected);
   connect(daemon, &Daemon::backendFailure, this,
@@ -107,19 +109,44 @@ void DaemonLocalServerConnection::parseCommand(const QByteArray& data) {
     InterfaceConfig config;
     if (!Daemon::parseConfig(obj, config)) {
       logger.error() << "Invalid configuration";
-      emit disconnected();
+      disconnected();
       return;
     }
-
-    if (!Daemon::instance()->activate(config)) {
+    if (!Daemon::instance()->activate(config.m_ifname, config)) {
       logger.error() << "Failed to activate the interface";
-      emit disconnected();
+      disconnected();
     }
     return;
   }
 
   if (type == "deactivate") {
-    Daemon::instance()->deactivate(true);
+    const QString ifname = obj.value("ifname").toString();
+    if (!ifname.isEmpty()) {
+      Daemon::instance()->deactivateTunnel(ifname);
+    } else {
+      Daemon::instance()->deactivate(true);
+    }
+    return;
+  }
+
+  if (type == "setPrimary") {
+    InterfaceConfig config;
+    if (!Daemon::parseConfig(obj, config)) {
+      logger.error() << "setPrimary: invalid configuration";
+      return;
+    }
+    if (!Daemon::instance()->setPrimary(config.m_ifname, config)) {
+      logger.error() << "setPrimary failed";
+      QJsonObject reply;
+      reply.insert("type", "primaryFailed");
+      reply.insert("ifname", config.m_ifname);
+      write(reply);
+      return;
+    }
+    QJsonObject reply;
+    reply.insert("type", "primaryReady");
+    reply.insert("ifname", config.m_ifname);
+    write(reply);
     return;
   }
 
@@ -146,10 +173,19 @@ void DaemonLocalServerConnection::parseCommand(const QByteArray& data) {
   logger.warning() << "Invalid command:" << type;
 }
 
-void DaemonLocalServerConnection::connected(const QString& pubkey) {
+void DaemonLocalServerConnection::onTunnelConnected(const QString& ifname,
+                                                    const QString& pubkey) {
   QJsonObject obj;
   obj.insert("type", "connected");
-  obj.insert("pubkey", QJsonValue(pubkey));
+  obj.insert("ifname", ifname);
+  obj.insert("pubkey", pubkey);
+  write(obj);
+}
+
+void DaemonLocalServerConnection::onTunnelHandshakeFailed(const QString& ifname) {
+  QJsonObject obj;
+  obj.insert("type", "disconnected");
+  obj.insert("ifname", ifname);
   write(obj);
 }
 

client/daemon/daemonlocalserverconnection.h

@@ -6,6 +6,7 @@
 #define DAEMONLOCALSERVERCONNECTION_H
 
 #include <QObject>
+#include <QString>
 
 #include "daemonerrors.h"
 
@@ -23,7 +24,8 @@ class DaemonLocalServerConnection final : public QObject {
 
   void parseCommand(const QByteArray& json);
 
-  void connected(const QString& pubkey);
+  void onTunnelConnected(const QString& ifname, const QString& pubkey);
+  void onTunnelHandshakeFailed(const QString& ifname);
   void disconnected();
   void backendFailure(DaemonError err);
 

client/daemon/interfaceconfig.cpp

@@ -62,6 +62,8 @@ QJsonObject InterfaceConfig::toJson() const {
   }
   json.insert("vpnDisabledApps", disabledApps);
 
+  json.insert("ifname", m_ifname);
+
   return json;
 }
 

client/daemon/interfaceconfig.h

@@ -13,6 +13,8 @@
 
 class QJsonObject;
 
+constexpr int ACTIVATION_TIMEOUT_MSEC = 30000;
+
 class InterfaceConfig {
   Q_GADGET
 
@@ -57,6 +59,8 @@ class InterfaceConfig {
   QString m_underloadPacketMagicHeader;
   QString m_transportPacketMagicHeader;
   QMap<QString, QString> m_specialJunk;
+  QString m_ifname;
+  bool m_deferAddressSetup = false;
 
   QJsonObject toJson() const;
   QString toWgConf(

client/daemon/wireguardutils.h

@@ -14,8 +14,6 @@
 
 #include "interfaceconfig.h"
 
-constexpr const char* WG_INTERFACE = "amn0";
-
 constexpr uint16_t WG_KEEPALIVE_PERIOD = 60;
 
 class WireguardUtils : public QObject {
@@ -35,7 +33,7 @@ class WireguardUtils : public QObject {
   virtual ~WireguardUtils() = default;
 
   virtual bool interfaceExists() = 0;
-  virtual QString interfaceName() { return WG_INTERFACE; }
+  virtual QString interfaceName() = 0;
   virtual bool addInterface(const InterfaceConfig& config) = 0;
   virtual bool deleteInterface() = 0;
 

client/macos/networkextension/CMakeLists.txt

@@ -25,8 +25,6 @@ set_target_properties(AmneziaVPNNetworkExtension PROPERTIES
 
     XCODE_ATTRIBUTE_INFOPLIST_FILE ${CMAKE_CURRENT_SOURCE_DIR}/Info.plist.in
     XCODE_ATTRIBUTE_LD_RUNPATH_SEARCH_PATHS "@executable_path/../../../../Frameworks @loader_path/../../../../Frameworks"
-
-    XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
 )
 
 if(DEPLOY)
@@ -120,20 +118,10 @@ target_include_directories(AmneziaVPNNetworkExtension PRIVATE ${CLIENT_ROOT_DIR}
 target_include_directories(AmneziaVPNNetworkExtension PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
 
 find_package(openvpnadapter REQUIRED)
-# FIXME(ygurov): https://github.com/conan-io/conan/issues/20034
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS MINSIZEREL)
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
-set_property(TARGET amnezia::openvpnadapter APPEND PROPERTY IMPORTED_CONFIGURATIONS RELWITHDEBINFO)
 target_link_libraries(AmneziaVPNNetworkExtension PRIVATE amnezia::openvpnadapter)
 
 find_package(awg-apple REQUIRED)
 target_link_libraries(AmneziaVPNNetworkExtension PRIVATE amnezia::awg-apple)
 
 find_package(hev-socks5-tunnel REQUIRED)
-# FIXME(ygurov): https://github.com/conan-io/conan/issues/20034
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS MINSIZEREL)
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
-set_property(TARGET heiher::hev-socks5-tunnel APPEND PROPERTY IMPORTED_CONFIGURATIONS RELWITHDEBINFO)
 target_link_libraries(AmneziaVPNNetworkExtension PRIVATE heiher::hev-socks5-tunnel)

client/main.cpp

@@ -1,5 +1,6 @@
 #include <QDebug>
 #include <QTimer>
+#include <QLocalSocket>
 #include <libssh/libssh.h>
 
 #include "amneziaApplication.h"

client/mozilla/controllerimpl.h

@@ -44,6 +44,8 @@ class ControllerImpl : public QObject {
   // "disconnecting" state until the "disconnected" signal is received.
   virtual void deactivate() = 0;
 
+  virtual void setPrimary(const QJsonObject& config) { Q_UNUSED(config) }
+
   // This method is used to retrieve the VPN tunnel status (mainly the number
   // of bytes sent and received). It's called always when the VPN tunnel is
   // active.
@@ -71,11 +73,13 @@ class ControllerImpl : public QObject {
   void initialized(bool status, bool connected,
                    const QDateTime& connectionDate);
 
-  // These 2 signals can be dispatched at any time.
   void connected(const QString& pubkey,
                  const QDateTime& connectionTimestamp = QDateTime());
   void disconnected();
 
+  void primaryReady();
+  void primaryFailed();
+
   // This method should be emitted after a checkStatus() call.
   // "serverIpv4Gateway" is the current VPN tunnel gateway.
   // "deviceIpv4Address" is the address of the VPN client.

client/mozilla/localsocketcontroller.cpp

@@ -39,7 +39,8 @@ namespace {
 Logger logger("LocalSocketController");
 }
 
-LocalSocketController::LocalSocketController() {
+LocalSocketController::LocalSocketController(const QString& ifname)
+    : m_ifname(ifname) {
   MZ_COUNT_CTOR(LocalSocketController);
 
   m_socket = new QLocalSocket(this);
@@ -121,7 +122,8 @@ void LocalSocketController::daemonConnected() {
   checkStatus();
 }
 
-void LocalSocketController::activate(const QJsonObject &rawConfig) {
+QJsonObject LocalSocketController::buildActivateJson(const QJsonObject& rawConfig,
+                                                     const QString& ifname) {
   QString protocolName = rawConfig.value("protocol").toString();
 
   int splitTunnelType = rawConfig.value("splitTunnelType").toInt();
@@ -134,11 +136,9 @@ void LocalSocketController::activate(const QJsonObject &rawConfig) {
   QJsonObject wgConfig = rawConfig.value(protocolName + "_config_data").toObject();
 
   QJsonObject json;
-  json.insert("type", "activate");
   //  json.insert("hopindex", QJsonValue((double)hop.m_hopindex));
   json.insert("privateKey", wgConfig.value(amnezia::configKey::clientPrivKey));
   json.insert("deviceIpv4Address", wgConfig.value(amnezia::configKey::clientIp));
-  m_deviceIpv4 = wgConfig.value(amnezia::configKey::clientIp).toString();
 
   // set up IPv6 unique-local-address, ULA, with "fd00::/8" prefix, not globally routable.
   // this will be default IPv6 gateway, OS recognizes that IPv6 link is local and switches to IPv4.
@@ -230,7 +230,6 @@ void LocalSocketController::activate(const QJsonObject &rawConfig) {
   json.insert("allowedIPAddressRanges", jsAllowedIPAddesses);
 
   QJsonArray jsExcludedAddresses;
-  jsExcludedAddresses.append(wgConfig.value(amnezia::configKey::hostName));
   if (splitTunnelType == 2) {
     for (auto v : splitTunnelSites) {
           QString ipRange = v.toString();
@@ -292,6 +291,23 @@ void LocalSocketController::activate(const QJsonObject &rawConfig) {
     json.insert(amnezia::configKey::specialJunk5, wgConfig.value(amnezia::configKey::specialJunk5));
   }
 
+  json.insert("ifname", ifname);
+  return json;
+}
+
+void LocalSocketController::activate(const QJsonObject& rawConfig) {
+  const QString protocolName = rawConfig.value("protocol").toString();
+  const QJsonObject wgConfig = rawConfig.value(protocolName + "_config_data").toObject();
+  m_deviceIpv4 = wgConfig.value(amnezia::configKey::clientIp).toString();
+
+  QJsonObject json = buildActivateJson(rawConfig, m_ifname);
+  json.insert("type", "activate");
+  write(json);
+}
+
+void LocalSocketController::setPrimary(const QJsonObject& rawConfig) {
+  QJsonObject json = buildActivateJson(rawConfig, m_ifname);
+  json.insert("type", "setPrimary");
   write(json);
 }
 
@@ -306,6 +322,7 @@ void LocalSocketController::deactivate() {
 
   QJsonObject json;
   json.insert("type", "deactivate");
+  json.insert("ifname", m_ifname);
   write(json);
   emit disconnected();
 }
@@ -471,12 +488,20 @@ void LocalSocketController::parseCommand(const QByteArray& command) {
     return;
   }
 
+  auto belongsToThisTunnel = [this, &obj]() {
+    const QJsonValue val = obj.value("ifname");
+    return !val.isString() || val.toString() == m_ifname;
+  };
+
   if (type == "disconnected") {
+    if (!belongsToThisTunnel()) return;
     disconnectInternal();
     return;
   }
 
   if (type == "connected") {
+    if (!belongsToThisTunnel()) return;
+
     QJsonValue pubkey = obj.value("pubkey");
     if (!pubkey.isString()) {
       logger.error() << "Unexpected pubkey value";
@@ -494,6 +519,18 @@ void LocalSocketController::parseCommand(const QByteArray& command) {
     return;
   }
 
+  if (type == "primaryReady") {
+    if (!belongsToThisTunnel()) return;
+    emit primaryReady();
+    return;
+  }
+
+  if (type == "primaryFailed") {
+    if (!belongsToThisTunnel()) return;
+    emit primaryFailed();
+    return;
+  }
+
   if (type == "backendFailure") {
     if (!obj.contains("errorCode")) {
       // report a generic error if we dont know what it is.

client/mozilla/localsocketcontroller.h

@@ -19,7 +19,7 @@ class LocalSocketController final : public ControllerImpl {
   Q_DISABLE_COPY_MOVE(LocalSocketController)
 
  public:
-  LocalSocketController();
+  explicit LocalSocketController(const QString& ifname);
   ~LocalSocketController();
 
   void initialize(const Device* device, const Keys* keys) override;
@@ -28,6 +28,8 @@ class LocalSocketController final : public ControllerImpl {
 
   void deactivate() override;
 
+  void setPrimary(const QJsonObject& rawConfig) override;
+
   void checkStatus() override;
 
   void getBackendLogs(std::function<void(const QString&)>&& callback) override;
@@ -36,6 +38,10 @@ class LocalSocketController final : public ControllerImpl {
 
   bool multihopSupported() override { return true; }
 
+ public:
+  static QJsonObject buildActivateJson(const QJsonObject& rawConfig,
+                                       const QString& ifname);
+
  private:
   void initializeInternal();
   void disconnectInternal();
@@ -59,6 +65,7 @@ class LocalSocketController final : public ControllerImpl {
 
   QByteArray m_buffer;
 
+  QString m_ifname;
   QString m_deviceIpv4;
   std::function<void(const QString&)> m_logCallback = nullptr;
 

client/platforms/linux/daemon/iputilslinux.cpp

@@ -47,7 +47,7 @@ bool IPUtilsLinux::setMTUAndUp(const InterfaceConfig& config) {
 
   // Setup the interface to interact with
   struct ifreq ifr;
-  strncpy(ifr.ifr_name, WG_INTERFACE, IFNAMSIZ);
+  strncpy(ifr.ifr_name, config.m_ifname.toUtf8().constData(), IFNAMSIZ);
 
   // MTU
   // FIXME: We need to know how many layers deep this particular
@@ -76,7 +76,7 @@ bool IPUtilsLinux::addIP4AddressToDevice(const InterfaceConfig& config) {
   struct sockaddr_in* ifrAddr = (struct sockaddr_in*)&ifr.ifr_addr;
 
   // Name the interface and set family
-  strncpy(ifr.ifr_name, WG_INTERFACE, IFNAMSIZ);
+  strncpy(ifr.ifr_name, config.m_ifname.toUtf8().constData(), IFNAMSIZ);
   ifr.ifr_addr.sa_family = AF_INET;
 
   // Get the device address to add to interface
@@ -126,7 +126,7 @@ bool IPUtilsLinux::addIP6AddressToDevice(const InterfaceConfig& config) {
 
   // Get the index of named ifr and link with ifr6
   struct ifreq ifr;
-  strncpy(ifr.ifr_name, WG_INTERFACE, IFNAMSIZ);
+  strncpy(ifr.ifr_name, config.m_ifname.toUtf8().constData(), IFNAMSIZ);
   ifr.ifr_addr.sa_family = AF_INET6;
   int ret = ioctl(sockfd, SIOGIFINDEX, &ifr);
   if (ret) {

client/platforms/linux/daemon/linuxdaemon.cpp

@@ -28,7 +28,6 @@ LinuxDaemon::LinuxDaemon() : Daemon(nullptr) {
 
     logger.debug() << "Daemon created";
 
-    m_wgutils = new WireguardUtilsLinux(this);
     m_dnsutils = new DnsUtilsLinux(this);
     m_iputils = new IPUtilsLinux(this);
 
@@ -50,3 +49,4 @@ LinuxDaemon* LinuxDaemon::instance() {
     Q_ASSERT(s_daemon);
     return s_daemon;
 }
+

client/platforms/linux/daemon/linuxdaemon.h

@@ -12,8 +12,6 @@
 #include "wireguardutilslinux.h"
 
 class LinuxDaemon final : public Daemon {
-  friend class IPUtilsMacos;
-
  public:
   LinuxDaemon();
   ~LinuxDaemon();
@@ -21,13 +19,15 @@ class LinuxDaemon final : public Daemon {
   static LinuxDaemon* instance();
 
  protected:
-  WireguardUtils* wgutils() const override { return m_wgutils; }
   DnsUtils* dnsutils() override { return m_dnsutils; }
   bool supportIPUtils() const override { return true; }
   IPUtils* iputils() override { return m_iputils; }
 
+  WireguardUtils* createWgUtils() override {
+    return new WireguardUtilsLinux(this);
+  }
+
  private:
-  WireguardUtilsLinux* m_wgutils = nullptr;
   DnsUtilsLinux* m_dnsutils = nullptr;
   IPUtilsLinux* m_iputils = nullptr;
 };

client/platforms/linux/daemon/linuxfirewall.cpp

@@ -193,8 +193,8 @@ QStringList LinuxFirewall::getDNSRules(const QStringList& servers)
     QStringList result;
     for (const QString& server : servers)
     {
-        result << QStringLiteral("-o amn0+ -d %1 -p udp --dport 53 -j ACCEPT").arg(server);
-        result << QStringLiteral("-o amn0+ -d %1 -p tcp --dport 53 -j ACCEPT").arg(server);
+        result << QStringLiteral("-o amn+ -d %1 -p udp --dport 53 -j ACCEPT").arg(server);
+        result << QStringLiteral("-o amn+ -d %1 -p tcp --dport 53 -j ACCEPT").arg(server);
         result << QStringLiteral("-o tun0+ -d %1 -p udp --dport 53 -j ACCEPT").arg(server);
         result << QStringLiteral("-o tun0+ -d %1 -p tcp --dport 53 -j ACCEPT").arg(server);
         result << QStringLiteral("-o tun2+ -d %1 -p udp --dport 53 -j ACCEPT").arg(server);
@@ -278,7 +278,7 @@ void LinuxFirewall::install()
                                                          });
 
     installAnchor(Both, QStringLiteral("200.allowVPN"), {
-                                                            QStringLiteral("-o amn0+ -j ACCEPT"),
+                                                            QStringLiteral("-o amn+ -j ACCEPT"),
                                                             QStringLiteral("-o tun0+ -j ACCEPT"),
                                                             QStringLiteral("-o tun2+ -j ACCEPT"),
                                                         });

client/platforms/linux/daemon/linuxfirewall.h

@@ -37,33 +37,6 @@
 #include <QString>
 #include <QStringList>
 
-// Descriptor for a set of firewall rules to be appled.
-//
-struct FirewallParams
-{
-    QStringList dnsServers;
-    QVector<QString> excludeApps; // Apps to exclude if VPN exemptions are enabled
-    QStringList allowAddrs;
-    QStringList blockAddrs;
-    // The follow flags indicate which general rulesets are needed. Note that
-    // this is after some sanity filtering, i.e. an allow rule may be listed
-    // as not needed if there were no block rules preceding it. The rulesets
-    // should be thought of as in last-match order.
-
-    bool blockAll;      // Block all traffic by default
-    bool allowVPN;      // Exempt traffic through VPN tunnel
-    bool allowDHCP;     // Exempt DHCP traffic
-    bool blockIPv6;     // Block all IPv6 traffic
-    bool allowLAN;      // Exempt LAN traffic, including IPv6 LAN traffic
-    bool blockDNS;      // Block all DNS traffic except specified DNS servers
-    bool allowPIA;      // Exempt PIA executables
-    bool allowLoopback; // Exempt loopback traffic
-    bool allowHnsd;     // Exempt Handshake DNS traffic
-    bool allowVpnExemptions; // Exempt specified traffic from the tunnel (route it over the physical uplink instead)
-    bool allowNets;
-    bool blockNets;
-};
-
 class LinuxFirewall
 {
 public:

client/platforms/linux/daemon/linuxroutemonitor.cpp

@@ -39,8 +39,6 @@ typedef struct wg_allowedip {
     struct wg_allowedip *next_allowedip;
 } wg_allowedip;
 
-constexpr const char* WG_INTERFACE = "amn0";
-
 static void nlmsg_append_attr(struct nlmsghdr* nlmsg, size_t maxlen,
                               int attrtype, const void* attrdata,
                               size_t attrlen);
@@ -55,6 +53,8 @@ LinuxRouteMonitor::LinuxRouteMonitor(const QString& ifname, QObject* parent)
   MZ_COUNT_CTOR(LinuxRouteMonitor);
   logger.debug() << "LinuxRouteMonitor created.";
 
+  m_physicalGateway = NetworkUtilities::getGatewayAndIface().first;
+
   m_nlsock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE);
   if (m_nlsock < 0) {
       logger.warning() << "Failed to create netlink socket:" << strerror(errno);
@@ -63,7 +63,7 @@ LinuxRouteMonitor::LinuxRouteMonitor(const QString& ifname, QObject* parent)
   struct sockaddr_nl nladdr;
   memset(&nladdr, 0, sizeof(nladdr));
   nladdr.nl_family = AF_NETLINK;
-  nladdr.nl_pid = getpid();
+  nladdr.nl_pid = 0;
   if (bind(m_nlsock, (struct sockaddr*)&nladdr, sizeof(nladdr)) != 0) {
       logger.warning() << "Failed to bind netlink socket:" << strerror(errno);
   }
@@ -153,7 +153,7 @@ bool LinuxRouteMonitor::rtmSendRoute(int action, int flags, int type,
     }
 
     if (rtm->rtm_type == RTN_UNICAST) {
-    int index = if_nametoindex(WG_INTERFACE);
+    int index = if_nametoindex(m_ifname.toUtf8().constData());
 
     if (index <= 0) {
         logger.error() << "if_nametoindex() failed:" << strerror(errno);
@@ -164,14 +164,15 @@ bool LinuxRouteMonitor::rtmSendRoute(int action, int flags, int type,
     }
 
     if (rtm->rtm_type == RTN_THROW) {
-    QString gateway = NetworkUtilities::getGatewayAndIface().first;
-    if (gateway.isEmpty()) {
-        logger.warning() << "No default gateway available, skipping exclusion route";
-        return false;
+    if (action == RTM_NEWROUTE) {
+        if (m_physicalGateway.isEmpty()) {
+            logger.warning() << "No physical gateway available, skipping exclusion route";
+            return false;
+        }
+        struct in_addr ip4;
+        inet_pton(AF_INET, m_physicalGateway.toUtf8(), &ip4);
+        nlmsg_append_attr(nlmsg, sizeof(buf), RTA_GATEWAY, &ip4, sizeof(ip4));
     }
-    struct in_addr ip4;
-    inet_pton(AF_INET, gateway.toUtf8(), &ip4);
-    nlmsg_append_attr(nlmsg, sizeof(buf), RTA_GATEWAY, &ip4, sizeof(ip4));
     nlmsg_append_attr32(nlmsg, sizeof(buf), RTA_PRIORITY, 0);
     rtm->rtm_type = RTN_UNICAST;
     }

client/platforms/linux/daemon/linuxroutemonitor.h

@@ -32,6 +32,7 @@ class LinuxRouteMonitor final : public QObject {
   bool rtmSendRoute(int action, int flags, int type,
                     const IPAddress& prefix);
   QString m_ifname;
+  QString m_physicalGateway;
   unsigned int m_ifindex = 0;
   int m_nlsock = -1;
   int m_nlseq = 0;

client/platforms/linux/daemon/wireguardutilslinux.cpp

@@ -8,17 +8,15 @@
 
 #include <QByteArray>
 #include <QDir>
+#include <QElapsedTimer>
 #include <QFile>
 #include <QLocalSocket>
 #include <QTimer>
 #include <QThread>
 
-#include "linuxfirewall.h"
 #include "leakdetector.h"
 #include "logger.h"
 
-#include "killswitch.h"
-
 constexpr const int WG_TUN_PROC_TIMEOUT = 5000;
 constexpr const char* WG_RUNTIME_DIR = "/var/run/amneziawg";
 
@@ -59,19 +57,20 @@ void WireguardUtilsLinux::tunnelErrorOccurred(QProcess::ProcessError error) {
 }
 
 bool WireguardUtilsLinux::addInterface(const InterfaceConfig& config) {
-    Q_UNUSED(config);
     if (m_tunnel.state() != QProcess::NotRunning) {
         logger.warning() << "Unable to start: tunnel process already running";
         return false;
     }
 
+    const QString ifname = config.m_ifname;
+
     QDir wgRuntimeDir(WG_RUNTIME_DIR);
     if (!wgRuntimeDir.exists()) {
         wgRuntimeDir.mkpath(".");
     }
 
     QProcessEnvironment pe = QProcessEnvironment::systemEnvironment();
-    QString wgNameFile = wgRuntimeDir.filePath(QString(WG_INTERFACE) + ".sock");
+    QString wgNameFile = wgRuntimeDir.filePath(ifname + ".sock");
     pe.insert("WG_TUN_NAME_FILE", wgNameFile);
 #ifdef MZ_DEBUG
     pe.insert("LOG_LEVEL", "debug");
@@ -79,7 +78,7 @@ bool WireguardUtilsLinux::addInterface(const InterfaceConfig& config) {
     m_tunnel.setProcessEnvironment(pe);
 
     QDir appPath(QCoreApplication::applicationDirPath());
-    QStringList wgArgs = {"-f", "amn0"};
+    QStringList wgArgs = {"-f", ifname};
     m_tunnel.start(appPath.filePath("amneziawg-go"), wgArgs);
     if (!m_tunnel.waitForStarted(WG_TUN_PROC_TIMEOUT)) {
         logger.error() << "Unable to start tunnel process due to timeout";
@@ -147,29 +146,6 @@ bool WireguardUtilsLinux::addInterface(const InterfaceConfig& config) {
     int err = uapiErrno(uapiCommand(message));
     if (err != 0) {
         logger.error() << "Interface configuration failed:" << strerror(err);
-    } else {
-        if (config.m_killSwitchEnabled) {
-            FirewallParams params { };
-            params.dnsServers.append(config.m_primaryDnsServer);
-            if (!config.m_secondaryDnsServer.isEmpty()) {
-                params.dnsServers.append(config.m_secondaryDnsServer);
-            }
-            if (config.m_allowedIPAddressRanges.contains(IPAddress("0.0.0.0/0"))) {
-                params.blockAll = true;
-                if (config.m_excludedAddresses.size()) {
-                    params.allowNets = true;
-                    foreach (auto net, config.m_excludedAddresses) {
-                        params.allowAddrs.append(net.toUtf8());
-                    }
-                }
-            } else {
-                params.blockNets = true;
-                foreach (auto net, config.m_allowedIPAddressRanges) {
-                    params.blockAddrs.append(net.toString());
-                }
-            }
-            applyFirewallRules(params);
-        }
     }
 
     return (err == 0);
@@ -194,10 +170,8 @@ bool WireguardUtilsLinux::deleteInterface() {
 
     // Garbage collect.
     QDir wgRuntimeDir(WG_RUNTIME_DIR);
-    QFile::remove(wgRuntimeDir.filePath(QString(WG_INTERFACE) + ".name"));
+    QFile::remove(wgRuntimeDir.filePath(m_ifname + ".name"));
 
-    // double-check + ensure our firewall is installed and enabled
-    KillSwitch::instance()->disableKillSwitch();
     return true;
 }
 
@@ -234,13 +208,6 @@ bool WireguardUtilsLinux::updatePeer(const InterfaceConfig& config) {
         out << "allowed_ip=" << ip.toString() << "\n";
     }
 
-    // Exclude the server address, except for multihop exit servers.
-    if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
-        (m_rtmonitor != nullptr)) {
-        m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
-        m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
-    }
-
     int err = uapiErrno(uapiCommand(message));
     if (err != 0) {
         logger.error() << "Peer configuration failed:" << strerror(err);
@@ -252,13 +219,6 @@ bool WireguardUtilsLinux::deletePeer(const InterfaceConfig& config) {
     QByteArray publicKey =
         QByteArray::fromBase64(qPrintable(config.m_serverPublicKey));
 
-    // Clear exclustion routes for this peer.
-    if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
-        (m_rtmonitor != nullptr)) {
-        m_rtmonitor->deleteExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
-        m_rtmonitor->deleteExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
-    }
-
     QString message;
     QTextStream out(&message);
     out << "set=1\n";
@@ -338,7 +298,7 @@ bool WireguardUtilsLinux::deleteRoutePrefix(const IPAddress& prefix) {
         return false;
     }
     if (prefix.prefixLength() > 0) {
-        return m_rtmonitor->insertRoute(prefix);
+        return m_rtmonitor->deleteRoute(prefix);
     }
 
     // Ensure that we do not replace the default route.
@@ -389,13 +349,9 @@ bool WireguardUtilsLinux::excludeLocalNetworks(const QList<IPAddress>& routes) {
 
 QString WireguardUtilsLinux::uapiCommand(const QString& command) {
     QLocalSocket socket;
-    QTimer uapiTimeout;
     QDir wgRuntimeDir(WG_RUNTIME_DIR);
     QString wgSocketFile = wgRuntimeDir.filePath(m_ifname + ".sock");
 
-    uapiTimeout.setSingleShot(true);
-    uapiTimeout.start(WG_TUN_PROC_TIMEOUT);
-
     socket.connectToServer(wgSocketFile, QIODevice::ReadWrite);
     if (!socket.waitForConnected(WG_TUN_PROC_TIMEOUT)) {
         logger.error() << "QLocalSocket::waitForConnected() failed:"
@@ -410,13 +366,15 @@ QString WireguardUtilsLinux::uapiCommand(const QString& command) {
     }
     socket.write(message);
 
+    QElapsedTimer elapsed;
+    elapsed.start();
     QByteArray reply;
     while (!reply.contains("\n\n")) {
-        if (!uapiTimeout.isActive()) {
+        const qint64 remaining = WG_TUN_PROC_TIMEOUT - elapsed.elapsed();
+        if (remaining <= 0 || !socket.waitForReadyRead(static_cast<int>(remaining))) {
             logger.error() << "UAPI command timed out";
             return QString();
         }
-        QCoreApplication::processEvents(QEventLoop::AllEvents, 100);
         reply.append(socket.readAll());
     }
 
@@ -442,45 +400,15 @@ QString WireguardUtilsLinux::waitForTunnelName(const QString& filename) {
     timeout.setSingleShot(true);
     timeout.start(WG_TUN_PROC_TIMEOUT);
 
-    QFile file(filename);
-
     while ((m_tunnel.state() == QProcess::Running) && timeout.isActive()) {
         QCoreApplication::processEvents(QEventLoop::AllEvents, 100);
-        QString ifname = "amn0";
 
-        // Test-connect to the UAPI socket.
         QLocalSocket sock;
-        QDir wgRuntimeDir(WG_RUNTIME_DIR);
-        QString sockName = wgRuntimeDir.filePath(ifname + ".sock");
-        sock.connectToServer(sockName, QIODevice::ReadWrite);
+        sock.connectToServer(filename, QIODevice::ReadWrite);
         if (sock.waitForConnected(100)) {
-            return ifname;
+            return QFileInfo(filename).baseName();
         }
     }
 
     return QString();
 }
-
-void WireguardUtilsLinux::applyFirewallRules(FirewallParams& params)
-{
-    // double-check + ensure our firewall is installed and enabled
-    if (!LinuxFirewall::isInstalled()) LinuxFirewall::install();
-
-    // Note: rule precedence is handled inside IpTablesFirewall
-    LinuxFirewall::ensureRootAnchorPriority();
-
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("000.allowLoopback"), true);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("100.blockAll"), params.blockAll);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("110.allowNets"), params.allowNets);
-    LinuxFirewall::updateAllowNets(params.allowAddrs);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("120.blockNets"), params.blockNets);
-    LinuxFirewall::updateBlockNets(params.blockAddrs);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("200.allowVPN"), true);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv6, QStringLiteral("250.blockIPv6"), true);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("290.allowDHCP"), true);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("300.allowLAN"), true);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("310.blockDNS"), true);
-    LinuxFirewall::updateDNSServers(params.dnsServers);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::IPv4, QStringLiteral("320.allowDNS"), true);
-    LinuxFirewall::setAnchorEnabled(LinuxFirewall::Both, QStringLiteral("400.allowPIA"), true);
-}

client/platforms/linux/daemon/wireguardutilslinux.h

@@ -11,7 +11,6 @@
 
 #include "daemon/wireguardutils.h"
 #include "linuxroutemonitor.h"
-#include "linuxfirewall.h"
 
 
 class WireguardUtilsLinux final : public WireguardUtils {
@@ -40,7 +39,6 @@ public:
 
     bool excludeLocalNetworks(const QList<IPAddress>& lanAddressRanges) override;
 
-    void applyFirewallRules(FirewallParams& params);
 signals:
     void backendFailure();
 

client/platforms/macos/daemon/dnsutilsmacos.cpp

@@ -185,6 +185,9 @@ bool DnsUtilsMacos::restoreResolvers() {
 }
 
 void DnsUtilsMacos::backupService(const QString& uuid) {
+  if (m_prevServices.contains(uuid)) {
+    return;
+  }
   DnsBackup backup;
   CFStringRef path = CFStringCreateWithFormat(
       kCFAllocatorSystemDefault, nullptr,

client/platforms/macos/daemon/iputilsmacos.cpp

@@ -39,8 +39,12 @@ bool IPUtilsMacos::addInterfaceIPs(const InterfaceConfig& config) {
 }
 
 bool IPUtilsMacos::setMTUAndUp(const InterfaceConfig& config) {
-  Q_UNUSED(config);
-  QString ifname = MacOSDaemon::instance()->m_wgutils->interfaceName();
+  WireguardUtils* wg = MacOSDaemon::instance()->wgutilsFor(config.m_ifname);
+  if (!wg) {
+    logger.error() << "No wireguard interface for" << config.m_ifname;
+    return false;
+  }
+  QString ifname = wg->interfaceName();
   struct ifreq ifr;
 
   // Create socket file descriptor to perform the ioctl operations on
@@ -80,8 +84,12 @@ bool IPUtilsMacos::setMTUAndUp(const InterfaceConfig& config) {
 }
 
 bool IPUtilsMacos::addIP4AddressToDevice(const InterfaceConfig& config) {
-  Q_UNUSED(config);
-  QString ifname = MacOSDaemon::instance()->m_wgutils->interfaceName();
+  WireguardUtils* wg = MacOSDaemon::instance()->wgutilsFor(config.m_ifname);
+  if (!wg) {
+    logger.error() << "No wireguard interface for" << config.m_ifname;
+    return false;
+  }
+  QString ifname = wg->interfaceName();
   struct ifaliasreq ifr;
   struct sockaddr_in* ifrAddr = (struct sockaddr_in*)&ifr.ifra_addr;
   struct sockaddr_in* ifrMask = (struct sockaddr_in*)&ifr.ifra_mask;
@@ -130,8 +138,12 @@ bool IPUtilsMacos::addIP4AddressToDevice(const InterfaceConfig& config) {
 }
 
 bool IPUtilsMacos::addIP6AddressToDevice(const InterfaceConfig& config) {
-  Q_UNUSED(config);
-  QString ifname = MacOSDaemon::instance()->m_wgutils->interfaceName();
+  WireguardUtils* wg = MacOSDaemon::instance()->wgutilsFor(config.m_ifname);
+  if (!wg) {
+    logger.error() << "No wireguard interface for" << config.m_ifname;
+    return false;
+  }
+  QString ifname = wg->interfaceName();
   struct in6_aliasreq ifr6;
 
   // Name the interface and set family

client/platforms/macos/daemon/macosdaemon.cpp

@@ -28,7 +28,6 @@ MacOSDaemon::MacOSDaemon() : Daemon(nullptr) {
 
   logger.debug() << "Daemon created";
 
-  m_wgutils = new WireguardUtilsMacos(this);
   m_dnsutils = new DnsUtilsMacos(this);
   m_iputils = new IPUtilsMacos(this);
 
@@ -50,3 +49,4 @@ MacOSDaemon* MacOSDaemon::instance() {
   Q_ASSERT(s_daemon);
   return s_daemon;
 }
+

client/platforms/macos/daemon/macosdaemon.h

@@ -11,8 +11,6 @@
 #include "wireguardutilsmacos.h"
 
 class MacOSDaemon final : public Daemon {
-  friend class IPUtilsMacos;
-
  public:
   MacOSDaemon();
   ~MacOSDaemon();
@@ -20,13 +18,15 @@ class MacOSDaemon final : public Daemon {
   static MacOSDaemon* instance();
 
  protected:
-  WireguardUtils* wgutils() const override { return m_wgutils; }
   DnsUtils* dnsutils() override { return m_dnsutils; }
   bool supportIPUtils() const override { return true; }
   IPUtils* iputils() override { return m_iputils; }
 
+  WireguardUtils* createWgUtils() override {
+    return new WireguardUtilsMacos(this);
+  }
+
  private:
-  WireguardUtilsMacos* m_wgutils = nullptr;
   DnsUtilsMacos* m_dnsutils = nullptr;
   IPUtilsMacos* m_iputils = nullptr;
 };

client/platforms/macos/daemon/macosfirewall.h

@@ -36,35 +36,6 @@
 #include <QString>
 #include <QStringList>
 
-// Descriptor for a set of firewall rules to be appled.
-//
-struct FirewallParams
-{
-    QStringList dnsServers;
-    QVector<QString> excludeApps; // Apps to exclude if VPN exemptions are enabled
-
-    QStringList allowAddrs;
-    QStringList blockAddrs;
-
-    // The follow flags indicate which general rulesets are needed. Note that
-    // this is after some sanity filtering, i.e. an allow rule may be listed
-    // as not needed if there were no block rules preceding it. The rulesets
-    // should be thought of as in last-match order.
-
-    bool blockAll;      // Block all traffic by default
-    bool blockNets;
-    bool allowNets;
-    bool allowVPN;      // Exempt traffic through VPN tunnel
-    bool allowDHCP;     // Exempt DHCP traffic
-    bool blockIPv6;     // Block all IPv6 traffic
-    bool allowLAN;      // Exempt LAN traffic, including IPv6 LAN traffic
-    bool blockDNS;      // Block all DNS traffic except specified DNS servers
-    bool allowPIA;      // Exempt PIA executables
-    bool allowLoopback; // Exempt loopback traffic
-    bool allowHnsd;     // Exempt Handshake DNS traffic
-    bool allowVpnExemptions; // Exempt specified traffic from the tunnel (route it over the physical uplink instead)
-};
-
 class MacOSFirewall
 {
 

client/platforms/macos/daemon/macosroutemonitor.cpp

@@ -51,7 +51,6 @@ MacosRouteMonitor::MacosRouteMonitor(const QString& ifname, QObject* parent)
 
 MacosRouteMonitor::~MacosRouteMonitor() {
   MZ_COUNT_DTOR(MacosRouteMonitor);
-  flushExclusionRoutes();
   if (m_rtsock >= 0) {
     close(m_rtsock);
   }
@@ -436,7 +435,15 @@ bool MacosRouteMonitor::rtmSendRoute(int action, const IPAddress& prefix,
     return true;
   }
   if ((action == RTM_ADD) && (errno == EEXIST)) {
-    return true;
+    rtm->rtm_type = RTM_DELETE;
+    rtm->rtm_seq = m_rtseq++;
+    write(m_rtsock, rtm, rtm->rtm_msglen);
+    rtm->rtm_type = RTM_ADD;
+    rtm->rtm_seq = m_rtseq++;
+    len = write(m_rtsock, rtm, rtm->rtm_msglen);
+    if (len == rtm->rtm_msglen) {
+      return true;
+    }
   }
   if ((action == RTM_DELETE) && (errno == ESRCH)) {
     return true;

client/platforms/macos/daemon/wireguardutilsmacos.cpp

@@ -9,6 +9,7 @@
 
 #include <QByteArray>
 #include <QDir>
+#include <QElapsedTimer>
 #include <QFile>
 #include <QLocalSocket>
 #include <QTimer>
@@ -16,8 +17,6 @@
 #include "leakdetector.h"
 #include "logger.h"
 
-#include "killswitch.h"
-
 constexpr const int WG_TUN_PROC_TIMEOUT = 5000;
 constexpr const char* WG_RUNTIME_DIR = "/var/run/amneziawg";
 
@@ -58,19 +57,20 @@ void WireguardUtilsMacos::tunnelErrorOccurred(QProcess::ProcessError error) {
 }
 
 bool WireguardUtilsMacos::addInterface(const InterfaceConfig& config) {
-  Q_UNUSED(config);
   if (m_tunnel.state() != QProcess::NotRunning) {
     logger.warning() << "Unable to start: tunnel process already running";
     return false;
   }
 
+  const QString ifname = config.m_ifname;
+
   QDir wgRuntimeDir(WG_RUNTIME_DIR);
   if (!wgRuntimeDir.exists()) {
     wgRuntimeDir.mkpath(".");
   }
 
   QProcessEnvironment pe = QProcessEnvironment::systemEnvironment();
-  QString wgNameFile = wgRuntimeDir.filePath(QString(WG_INTERFACE) + ".name");
+  QString wgNameFile = wgRuntimeDir.filePath(ifname + ".name");
   pe.insert("WG_TUN_NAME_FILE", wgNameFile);
 #ifdef MZ_DEBUG
   pe.insert("LOG_LEVEL", "debug");
@@ -92,6 +92,7 @@ bool WireguardUtilsMacos::addInterface(const InterfaceConfig& config) {
     m_tunnel.kill();
     return false;
   }
+  QFile::remove(wgNameFile);
   logger.debug() << "Created wireguard interface" << m_ifname;
 
   // Start the routing table monitor.
@@ -145,30 +146,6 @@ bool WireguardUtilsMacos::addInterface(const InterfaceConfig& config) {
   int err = uapiErrno(uapiCommand(message));
   if (err != 0) {
     logger.error() << "Interface configuration failed:" << strerror(err);
-  } else {
-    if (config.m_killSwitchEnabled) {
-      FirewallParams params { };
-      params.dnsServers.append(config.m_primaryDnsServer);
-      if (!config.m_secondaryDnsServer.isEmpty()) {
-          params.dnsServers.append(config.m_secondaryDnsServer);
-      }
-
-      if (config.m_allowedIPAddressRanges.contains(IPAddress("0.0.0.0/0"))) {
-          params.blockAll = true;
-          if (config.m_excludedAddresses.size()) {
-              params.allowNets = true;
-              foreach (auto net, config.m_excludedAddresses) {
-                  params.allowAddrs.append(net.toUtf8());
-              }
-          }
-      } else {
-          params.blockNets = true;
-          foreach (auto net, config.m_allowedIPAddressRanges) {
-              params.blockAddrs.append(net.toString());
-          }
-      }
-      applyFirewallRules(params);
-    }
   }
   return (err == 0);
 }
@@ -190,13 +167,6 @@ bool WireguardUtilsMacos::deleteInterface() {
     m_tunnel.waitForFinished(WG_TUN_PROC_TIMEOUT);
   }
 
-  // Garbage collect.
-  QDir wgRuntimeDir(WG_RUNTIME_DIR);
-  QFile::remove(wgRuntimeDir.filePath(QString(WG_INTERFACE) + ".name"));
-
-  // double-check + ensure our firewall is installed and enabled
-  KillSwitch::instance()->disableKillSwitch();
-
   return true;
 }
 
@@ -234,13 +204,6 @@ bool WireguardUtilsMacos::updatePeer(const InterfaceConfig& config) {
     out << "allowed_ip=" << ip.toString() << "\n";
   }
 
-  // Exclude the server address, except for multihop exit servers.
-  if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
-      (m_rtmonitor != nullptr)) {
-    m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
-    m_rtmonitor->addExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
-  }
-
   int err = uapiErrno(uapiCommand(message));
   if (err != 0) {
     logger.error() << "Peer configuration failed:" << strerror(err);
@@ -252,13 +215,6 @@ bool WireguardUtilsMacos::deletePeer(const InterfaceConfig& config) {
   QByteArray publicKey =
       QByteArray::fromBase64(qPrintable(config.m_serverPublicKey));
 
-  // Clear exclustion routes for this peer.
-  if ((config.m_hopType != InterfaceConfig::MultiHopExit) &&
-      (m_rtmonitor != nullptr)) {
-    m_rtmonitor->deleteExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
-    m_rtmonitor->deleteExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
-  }
-
   QString message;
   QTextStream out(&message);
   out << "set=1\n";
@@ -389,13 +345,9 @@ bool WireguardUtilsMacos::excludeLocalNetworks(const QList<IPAddress>& routes) {
 
 QString WireguardUtilsMacos::uapiCommand(const QString& command) {
   QLocalSocket socket;
-  QTimer uapiTimeout;
   QDir wgRuntimeDir(WG_RUNTIME_DIR);
   QString wgSocketFile = wgRuntimeDir.filePath(m_ifname + ".sock");
 
-  uapiTimeout.setSingleShot(true);
-  uapiTimeout.start(WG_TUN_PROC_TIMEOUT);
-
   socket.connectToServer(wgSocketFile, QIODevice::ReadWrite);
   if (!socket.waitForConnected(WG_TUN_PROC_TIMEOUT)) {
     logger.error() << "QLocalSocket::waitForConnected() failed:"
@@ -410,13 +362,15 @@ QString WireguardUtilsMacos::uapiCommand(const QString& command) {
   }
   socket.write(message);
 
+  QElapsedTimer elapsed;
+  elapsed.start();
   QByteArray reply;
   while (!reply.contains("\n\n")) {
-    if (!uapiTimeout.isActive()) {
+    const qint64 remaining = WG_TUN_PROC_TIMEOUT - elapsed.elapsed();
+    if (remaining <= 0 || !socket.waitForReadyRead(static_cast<int>(remaining))) {
       logger.error() << "UAPI command timed out";
       return QString();
     }
-    QCoreApplication::processEvents(QEventLoop::AllEvents, 100);
     reply.append(socket.readAll());
   }
 
@@ -463,28 +417,3 @@ QString WireguardUtilsMacos::waitForTunnelName(const QString& filename) {
 
   return QString();
 }
-
-void WireguardUtilsMacos::applyFirewallRules(FirewallParams& params)
-{
-  // double-check + ensure our firewall is installed and enabled. This is necessary as
-  // other software may disable pfctl before re-enabling with their own rules (e.g other VPNs)
-  if (!MacOSFirewall::isInstalled()) MacOSFirewall::install();
-
-  MacOSFirewall::ensureRootAnchorPriority();
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("000.allowLoopback"), true);
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("100.blockAll"), params.blockAll);
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("110.allowNets"), params.allowNets);
-  MacOSFirewall::setAnchorTable(QStringLiteral("110.allowNets"), params.allowNets,
-                                QStringLiteral("allownets"), params.allowAddrs);
-
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("120.blockNets"), params.blockNets);
-  MacOSFirewall::setAnchorTable(QStringLiteral("120.blockNets"), params.blockNets,
-                                QStringLiteral("blocknets"), params.blockAddrs);
-
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("200.allowVPN"), true);
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("250.blockIPv6"), true);
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("290.allowDHCP"), true);
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("300.allowLAN"), true);
-  MacOSFirewall::setAnchorEnabled(QStringLiteral("310.blockDNS"), true);
-  MacOSFirewall::setAnchorTable(QStringLiteral("310.blockDNS"), true, QStringLiteral("dnsaddr"), params.dnsServers);
-}

client/platforms/macos/daemon/wireguardutilsmacos.h

@@ -10,7 +10,6 @@
 
 #include "daemon/wireguardutils.h"
 #include "macosroutemonitor.h"
-#include "macosfirewall.h"
 
 class WireguardUtilsMacos final : public WireguardUtils {
   Q_OBJECT
@@ -38,8 +37,6 @@ class WireguardUtilsMacos final : public WireguardUtils {
 
   bool excludeLocalNetworks(const QList<IPAddress>& lanAddressRanges) override;
 
-  void applyFirewallRules(FirewallParams& params);
-
  signals:
   void backendFailure();
 

client/platforms/windows/daemon/windowsdaemon.cpp

@@ -35,14 +35,8 @@ WindowsDaemon::WindowsDaemon() : Daemon(nullptr) {
   m_firewallManager = WindowsFirewall::create(this);
   Q_ASSERT(m_firewallManager != nullptr);
 
-  m_wgutils = WireguardUtilsWindows::create(m_firewallManager, this);
   m_dnsutils = new DnsUtilsWindows(this);
   m_splitTunnelManager = WindowsSplitTunnel::create(m_firewallManager);
-
-  connect(m_wgutils.get(), &WireguardUtilsWindows::backendFailure, this,
-          &WindowsDaemon::monitorBackendFailure);
-  connect(this, &WindowsDaemon::activationFailure,
-          [this]() { m_firewallManager->disableKillSwitch(); });
 }
 
 WindowsDaemon::~WindowsDaemon() {
@@ -62,29 +56,12 @@ void WindowsDaemon::prepareActivation(const InterfaceConfig& config, int inetAda
 }
 
 void WindowsDaemon::activateSplitTunnel(const InterfaceConfig& config, int vpnAdapterIndex) {
-    if (m_splitTunnelManager == nullptr) {
-        if (config.m_vpnDisabledApps.length() > 0) {
-            logger.error() << "Split tunnel manager is not initialized";
-            emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_INIT_FAILURE);
-        }
+    if (m_splitTunnelManager == nullptr)
         return;
-    }
 
   if (config.m_vpnDisabledApps.length() > 0) {
-      if (!m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex)) {
-          logger.error() << "Failed to start split tunnel";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-          return;
-      }
-      if (!m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps)) {
-          logger.error() << "Failed to apply split tunnel app exclusions";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_EXCLUDE_FAILURE);
-          return;
-      }
-      if (!m_splitTunnelManager->isRunning()) {
-          logger.error() << "Split tunnel did not reach running state";
-          emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      }
+      m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex);
+      m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps);
   } else {
       m_splitTunnelManager->stop();
   }
@@ -96,9 +73,7 @@ bool WindowsDaemon::run(Op op, const InterfaceConfig& config) {
       // The Client has sent us a list of disabled apps, but we failed
       // to init the the split tunnel driver.
       // So let the client know this was not possible
-      logger.error() << "Split tunnel manager is not initialized";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_INIT_FAILURE);
-      return false;
     }
     return true;
   }
@@ -109,20 +84,14 @@ bool WindowsDaemon::run(Op op, const InterfaceConfig& config) {
   }
   if (config.m_vpnDisabledApps.length() > 0) {
     if (!m_splitTunnelManager->start(m_inetAdapterIndex)) {
-      logger.error() << "Split tunnel start failed";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      return false;
     };
     if (!m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps)) {
-      logger.error() << "Split tunnel app exclusion failed";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_EXCLUDE_FAILURE);
-      return false;
     };
     // Now the driver should be running (State == 4)
     if (!m_splitTunnelManager->isRunning()) {
-      logger.error() << "Split tunnel did not reach running state";
       emit backendFailure(DaemonError::ERROR_SPLIT_TUNNEL_START_FAILURE);
-      return false;
     }
     return true;
   }
@@ -137,3 +106,11 @@ void WindowsDaemon::monitorBackendFailure() {
   emit backendFailure();
   deactivate();
 }
+
+WireguardUtils* WindowsDaemon::createWgUtils() {
+  auto utils = WireguardUtilsWindows::create(m_firewallManager, this);
+  if (!utils) return nullptr;
+  connect(utils.get(), &WireguardUtilsWindows::backendFailure, this,
+          &WindowsDaemon::monitorBackendFailure);
+  return utils.release();
+}

client/platforms/windows/daemon/windowsdaemon.h

@@ -28,8 +28,8 @@ class WindowsDaemon final : public Daemon {
 
  protected:
   bool run(Op op, const InterfaceConfig& config) override;
-  WireguardUtils* wgutils() const override { return m_wgutils.get(); }
   DnsUtils* dnsutils() override { return m_dnsutils; }
+  WireguardUtils* createWgUtils() override;
 
  private:
   void monitorBackendFailure();
@@ -42,7 +42,6 @@ class WindowsDaemon final : public Daemon {
 
   int m_inetAdapterIndex = -1;
 
-  std::unique_ptr<WireguardUtilsWindows> m_wgutils;
   DnsUtilsWindows* m_dnsutils = nullptr;
   std::unique_ptr<WindowsSplitTunnel> m_splitTunnelManager;
   QPointer<WindowsFirewall> m_firewallManager;

client/platforms/windows/daemon/windowsdaemontunnel.cpp

@@ -37,11 +37,14 @@ int WindowsDaemonTunnel::run(QStringList& tokens) {
   QCoreApplication::setApplicationName("Amnezia VPN Tunnel");
   QCoreApplication::setApplicationVersion(Constants::versionString());
 
-  if (tokens.length() != 2) {
-    logger.error() << "Expected 1 parameter only: the config file.";
+  if (tokens.length() < 2 || tokens.length() > 3) {
+    logger.error() << "Expected: <config> [<ifname>]";
     return 1;
   }
   QString maybeConfig = tokens.at(1);
+  QString name = tokens.length() == 3 && !tokens.at(2).isEmpty()
+                     ? tokens.at(2)
+                     : WireguardUtilsWindows::s_defaultInterfaceName();
 
   if (!maybeConfig.startsWith("[Interface]")) {
     logger.error() << "parameter Does not seem to be a config";
@@ -64,7 +67,6 @@ int WindowsDaemonTunnel::run(QStringList& tokens) {
     WindowsUtils::windowsLog("Failed to get WireGuardTunnelService function");
     return 1;
   }
-  auto name = WireguardUtilsWindows::s_interfaceName();
   if (!tunnelProc(maybeConfig.utf16(), name.utf16())) {
     logger.error() << "Failed to activate the tunnel service";
     return 1;

client/platforms/windows/daemon/windowsfirewall.cpp

@@ -36,8 +36,6 @@
 // ID for the Firewall Sublayer
 DEFINE_GUID(ST_FW_WINFW_BASELINE_SUBLAYER_KEY, 0xc78056ff, 0x2bc1, 0x4211, 0xaa,
             0xdd, 0x7f, 0x35, 0x8d, 0xef, 0x20, 0x2d);
-DEFINE_GUID(ST_FW_WINFW_DNS_SUBLAYER_KEY, 0x60090787, 0xcca1, 0x4937, 0xaa,
-            0xce, 0x51, 0x25, 0x6e, 0xf4, 0x81, 0xf3);
 // ID for the Mullvad Split-Tunnel Sublayer Provider
 DEFINE_GUID(ST_FW_PROVIDER_KEY, 0xe2c114ee, 0xf32a, 0x4264, 0xa6, 0xcb, 0x3f,
             0xa7, 0x99, 0x63, 0x56, 0xd9);
@@ -51,53 +49,6 @@ constexpr uint8_t LOW_WEIGHT = 0;
 constexpr uint8_t MED_WEIGHT = 7;
 constexpr uint8_t HIGH_WEIGHT = 13;
 constexpr uint8_t MAX_WEIGHT = 15;
-
-bool ensureSublayer(HANDLE wfp, const GUID& key, const wchar_t* name,
-                    const wchar_t* description) {
-  FWPM_SUBLAYER0* maybeLayer = nullptr;
-  DWORD result = FwpmSubLayerGetByKey0(wfp, &key, &maybeLayer);
-  if (result == ERROR_SUCCESS) {
-    logger.debug() << "The Sublayer Already Exists:"
-                   << QString::fromWCharArray(name);
-    FwpmFreeMemory0(reinterpret_cast<void**>(&maybeLayer));
-    return true;
-  }
-  if (result != FWP_E_SUBLAYER_NOT_FOUND) {
-    logger.error() << "FwpmSubLayerGetByKey0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-
-  result = FwpmTransactionBegin(wfp, NULL);
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionBegin0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-
-  FWPM_SUBLAYER0 subLayer;
-  memset(&subLayer, 0, sizeof(subLayer));
-  subLayer.subLayerKey = key;
-  subLayer.displayData.name = const_cast<PWSTR>(name);
-  subLayer.displayData.description = const_cast<PWSTR>(description);
-  subLayer.weight = 0xFFFF;
-
-  result = FwpmSubLayerAdd0(wfp, &subLayer, NULL);
-  if (result != ERROR_SUCCESS) {
-    FwpmTransactionAbort0(wfp);
-    logger.error() << "FwpmSubLayerAdd0 failed. Return value:.\n" << result;
-    return false;
-  }
-
-  result = FwpmTransactionCommit0(wfp);
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionCommit0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-  logger.debug() << "Initialised Sublayer:" << QString::fromWCharArray(name);
-  return true;
-}
 }  // namespace
 
 WindowsFirewall* WindowsFirewall::create(QObject* parent) {
@@ -165,15 +116,50 @@ bool WindowsFirewall::initSublayer() {
   }
   auto cleanup = qScopeGuard([&] { FwpmEngineClose0(wfp); });
 
-  return ensureSublayer(wfp, ST_FW_WINFW_BASELINE_SUBLAYER_KEY,
-                        L"Amnezia-SplitTunnel-Sublayer",
-                        L"Filters that enforce a good baseline") &&
-         ensureSublayer(wfp, ST_FW_WINFW_DNS_SUBLAYER_KEY,
-                        L"Amnezia-SplitTunnel-DNS-Sublayer",
-                        L"DNS filters for split tunneling");
+  // Check if the Layer Already Exists
+  FWPM_SUBLAYER0* maybeLayer;
+  result = FwpmSubLayerGetByKey0(wfp, &ST_FW_WINFW_BASELINE_SUBLAYER_KEY,
+                                 &maybeLayer);
+  if (result == ERROR_SUCCESS) {
+    logger.debug() << "The Sublayer Already Exists!";
+    FwpmFreeMemory0((void**)&maybeLayer);
+    return true;
+  }
+
+  // Step 1: Start Transaction
+  result = FwpmTransactionBegin(wfp, NULL);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionBegin0 failed. Return value:.\n"
+                   << result;
+    return false;
+  }
+
+  // Step 3: Add Sublayer
+  FWPM_SUBLAYER0 subLayer;
+  memset(&subLayer, 0, sizeof(subLayer));
+  subLayer.subLayerKey = ST_FW_WINFW_BASELINE_SUBLAYER_KEY;
+  subLayer.displayData.name = (PWSTR)L"Amnezia-SplitTunnel-Sublayer";
+  subLayer.displayData.description =
+      (PWSTR)L"Filters that enforce a good baseline";
+  subLayer.weight = 0xFFFF;
+
+  result = FwpmSubLayerAdd0(wfp, &subLayer, NULL);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmSubLayerAdd0 failed. Return value:.\n" << result;
+    return false;
+  }
+  // Step 4: Commit!
+  result = FwpmTransactionCommit0(wfp);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionCommit0 failed. Return value:.\n"
+                   << result;
+    return false;
+  }
+  logger.debug() << "Initialised Sublayer";
+  return true;
 }
 
-bool WindowsFirewall::enableInterface(int vpnAdapterIndex) {
+bool WindowsFirewall::enableInterface(int vpnAdapterIndex, const QString& ifname) {
 // Checks if the FW_Rule was enabled succesfully,
 // disables the whole killswitch and returns false if not.
 #define FW_OK(rule)                                                       \
@@ -196,31 +182,39 @@ bool WindowsFirewall::enableInterface(int vpnAdapterIndex) {
     }                                                                     \
   }
 
-  logger.info() << "Enabling Killswitch Using Adapter:" << vpnAdapterIndex;
-  if (vpnAdapterIndex < 0)
-  {
+  logger.info() << "Enabling Killswitch Using Adapter:" << vpnAdapterIndex
+                << "ifname:" << ifname;
+
+  QList<uint64_t>& perTunnel = ifname.isEmpty() ? m_globalRules
+                                                : m_tunnelRules[ifname];
+  if (vpnAdapterIndex < 0) {
     IPAddress allv4("0.0.0.0/0");
-    if (!blockTrafficTo(allv4, MED_WEIGHT,
-                        "Block Internet", "killswitch")) {
-        return false;
-    }
-    IPAddress allv6("::/0");
-    if (!blockTrafficTo(allv6, MED_WEIGHT,
-                        "Block Internet", "killswitch")) {
+    if (!blockTrafficTo(allv4, MED_WEIGHT, "Block Internet", perTunnel)) {
       return false;
     }
-  } else
-  FW_OK(allowTrafficOfAdapter(vpnAdapterIndex, MED_WEIGHT,
-                                  "Allow usage of VPN Adapter"));
-  FW_OK(allowDHCPTraffic(MED_WEIGHT, "Allow DHCP Traffic"));
-  FW_OK(allowHyperVTraffic(MAX_WEIGHT, "Allow Hyper-V Traffic"));
-  FW_OK(allowTrafficForAppOnAll(getCurrentPath(), MAX_WEIGHT,
-                                "Allow all for AmneziaVPN.exe"));
-  FW_OK(blockTrafficOnPort(53, MED_WEIGHT, "Block all DNS"));
-  FW_OK(allowLoopbackTraffic(MED_WEIGHT,
-                             "Allow Loopback traffic on device %1"));
+    IPAddress allv6("::/0");
+    if (!blockTrafficTo(allv6, MED_WEIGHT, "Block Internet", perTunnel)) {
+      return false;
+    }
+  } else {
+    FW_OK(allowTrafficOfAdapter(vpnAdapterIndex, MED_WEIGHT,
+                                "Allow usage of VPN Adapter", perTunnel));
+  }
 
-  logger.debug() << "Killswitch on! Rules:" << m_activeRules.length();
+  if (m_globalRules.isEmpty()) {
+    FW_OK(allowDHCPTraffic(MED_WEIGHT, "Allow DHCP Traffic", m_globalRules));
+    FW_OK(allowHyperVTraffic(MAX_WEIGHT, "Allow Hyper-V Traffic", m_globalRules));
+    FW_OK(allowTrafficForAppOnAll(getCurrentPath(), MAX_WEIGHT,
+                                  "Allow all for AmneziaVPN.exe", m_globalRules));
+    FW_OK(blockTrafficOnPort(53, MED_WEIGHT, "Block all DNS", m_globalRules));
+    FW_OK(allowLoopbackTraffic(MED_WEIGHT,
+                               "Allow Loopback traffic on device %1",
+                               m_globalRules));
+  }
+
+  logger.debug() << "Killswitch on! Globals:" << m_globalRules.length()
+                 << "Tunnel[" << ifname
+                 << "]:" << m_tunnelRules.value(ifname).length();
   return true;
 #undef FW_OK
 }
@@ -240,7 +234,8 @@ bool WindowsFirewall::enableLanBypass(const QList<IPAddress>& ranges) {
 
   // Blocking unprotected traffic
   for (const IPAddress& prefix : ranges) {
-    if (!allowTrafficTo(prefix, LOW_WEIGHT + 1, "Allow LAN bypass traffic")) {
+    if (!allowTrafficTo(prefix, LOW_WEIGHT + 1, "Allow LAN bypass traffic",
+                        m_globalRules)) {
       return false;
     }
   }
@@ -256,7 +251,10 @@ bool WindowsFirewall::enableLanBypass(const QList<IPAddress>& ranges) {
 }
 
 // Allow unprotected traffic sent to the following address ranges.
-bool WindowsFirewall::allowTrafficRange(const QStringList& ranges) {
+bool WindowsFirewall::allowTrafficRange(const QStringList& ranges, const QString& ifname) {
+  QList<uint64_t>& target = ifname.isEmpty() ? m_globalRules
+                                             : m_tunnelRules[ifname];
+
   // Start the firewall transaction
   auto result = FwpmTransactionBegin(m_sessionHandle, NULL);
   if (result != ERROR_SUCCESS) {
@@ -269,8 +267,9 @@ bool WindowsFirewall::allowTrafficRange(const QStringList& ranges) {
   });
 
   for (const QString& addr : ranges) {
-    logger.debug() << "Allow killswitch exclude: " << addr;
-    if (!allowTrafficTo(QHostAddress(addr), HIGH_WEIGHT, "Allow killswitch bypass traffic")) {
+    logger.debug() << "Allow killswitch exclude: " << addr << "ifname:" << ifname;
+    if (!allowTrafficTo(QHostAddress(addr), HIGH_WEIGHT,
+                        "Allow killswitch bypass traffic", target)) {
       return false;
     }
   }
@@ -287,6 +286,10 @@ bool WindowsFirewall::allowTrafficRange(const QStringList& ranges) {
 
 
 bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
+  QList<uint64_t>& target = config.m_ifname.isEmpty()
+                              ? m_globalRules
+                              : m_tunnelRules[config.m_ifname];
+
   // Start the firewall transaction
   auto result = FwpmTransactionBegin(m_sessionHandle, NULL);
   if (result != ERROR_SUCCESS) {
@@ -302,12 +305,12 @@ bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
   logger.info() << "Enabling traffic for peer"
                 << config.m_serverPublicKey;
   if (!blockTrafficTo(config.m_allowedIPAddressRanges, LOW_WEIGHT,
-                      "Block Internet", config.m_serverPublicKey)) {
+                      "Block Internet", target)) {
     return false;
   }
   if (!config.m_primaryDnsServer.isEmpty()) {
     if (!allowTrafficTo(QHostAddress(config.m_primaryDnsServer), 53, HIGH_WEIGHT,
-                        "Allow DNS-Server", config.m_serverPublicKey)) {
+                        "Allow DNS-Server", target)) {
       return false;
     }
     // In some cases, we might configure a 2nd DNS server for IPv6, however
@@ -316,7 +319,7 @@ bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
     if (config.m_primaryDnsServer == config.m_serverIpv4Gateway) {
       if (!allowTrafficTo(QHostAddress(config.m_serverIpv6Gateway), 53,
                           HIGH_WEIGHT, "Allow extra IPv6 DNS-Server",
-                          config.m_serverPublicKey)) {
+                          target)) {
         return false;
       }
     }
@@ -324,7 +327,7 @@ bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
 
   if (!config.m_secondaryDnsServer.isEmpty()) {
     if (!allowTrafficTo(QHostAddress(config.m_secondaryDnsServer), 53, HIGH_WEIGHT,
-                        "Allow DNS-Server", config.m_serverPublicKey)) {
+                        "Allow DNS-Server", target)) {
       return false;
     }
     // In some cases, we might configure a 2nd DNS server for IPv6, however
@@ -333,7 +336,7 @@ bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
     if (config.m_secondaryDnsServer == config.m_serverIpv4Gateway) {
       if (!allowTrafficTo(QHostAddress(config.m_serverIpv6Gateway), 53,
                           HIGH_WEIGHT, "Allow extra IPv6 DNS-Server",
-                          config.m_serverPublicKey)) {
+                          target)) {
         return false;
       }
     }
@@ -342,7 +345,7 @@ bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
   for (const QString& dns : config.m_allowedDnsServers) {
     logger.debug() << "Allow DNS: " << dns;
     if (!allowTrafficTo(QHostAddress(dns), 53, HIGH_WEIGHT,
-                        "Allow DNS-Server", config.m_serverPublicKey)) {
+                        "Allow DNS-Server", target)) {
       return false;
     }
   }
@@ -352,7 +355,7 @@ bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
       logger.debug() << "excludedAddresses range: " << i;
 
       if (!allowTrafficTo(i, HIGH_WEIGHT,
-                          "Allow Ecxlude route", config.m_serverPublicKey)) {
+                          "Allow Ecxlude route", target)) {
         return false;
       }
     }
@@ -368,35 +371,6 @@ bool WindowsFirewall::enablePeerTraffic(const InterfaceConfig& config) {
   return true;
 }
 
-bool WindowsFirewall::disablePeerTraffic(const QString& pubkey) {
-  auto result = FwpmTransactionBegin(m_sessionHandle, NULL);
-  auto cleanup = qScopeGuard([&] {
-    if (result != ERROR_SUCCESS) {
-      FwpmTransactionAbort0(m_sessionHandle);
-    }
-  });
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionBegin0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-
-  logger.info() << "Disabling traffic for peer" << pubkey;
-  for (const auto& filterID : m_peerRules.values(pubkey)) {
-    FwpmFilterDeleteById0(m_sessionHandle, filterID);
-    m_peerRules.remove(pubkey, filterID);
-  }
-
-  // Commit!
-  result = FwpmTransactionCommit0(m_sessionHandle);
-  if (result != ERROR_SUCCESS) {
-    logger.error() << "FwpmTransactionCommit0 failed. Return value:.\n"
-                   << result;
-    return false;
-  }
-  return true;
-}
-
 bool WindowsFirewall::disableKillSwitch() {
   return KillSwitch::instance()->disableKillSwitch();
 }
@@ -414,11 +388,13 @@ bool WindowsFirewall::allowAllTraffic() {
       return false;
     }
 
-    for (const auto& filterID : m_peerRules.values()) {
-      FwpmFilterDeleteById0(m_sessionHandle, filterID);
+    for (const auto& bucket : qAsConst(m_tunnelRules)) {
+      for (const auto& filterID : bucket) {
+        FwpmFilterDeleteById0(m_sessionHandle, filterID);
+      }
     }
 
-    for (const auto& filterID : qAsConst(m_activeRules)) {
+    for (const auto& filterID : qAsConst(m_globalRules)) {
       FwpmFilterDeleteById0(m_sessionHandle, filterID);
     }
 
@@ -429,15 +405,42 @@ bool WindowsFirewall::allowAllTraffic() {
                      << result;
       return false;
     }
-    m_peerRules.clear();
-    m_activeRules.clear();
+    m_tunnelRules.clear();
+    m_globalRules.clear();
     logger.debug() << "Firewall Disabled!";
     return true;
 }
 
+bool WindowsFirewall::disableKillSwitchForTunnel(const QString& ifname) {
+  if (ifname.isEmpty() || !m_tunnelRules.contains(ifname)) {
+    return true;
+  }
+
+  auto result = FwpmTransactionBegin(m_sessionHandle, NULL);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionBegin0 failed. Return value:" << result;
+    return false;
+  }
+
+  const QList<uint64_t> filters = m_tunnelRules.take(ifname);
+  logger.info() << "Disabling killswitch filters for tunnel" << ifname
+                << "count:" << filters.length();
+  for (const auto& filterID : filters) {
+    FwpmFilterDeleteById0(m_sessionHandle, filterID);
+  }
+
+  result = FwpmTransactionCommit0(m_sessionHandle);
+  if (result != ERROR_SUCCESS) {
+    logger.error() << "FwpmTransactionCommit0 failed. Return value:" << result;
+    return false;
+  }
+  return true;
+}
+
 bool WindowsFirewall::allowTrafficForAppOnAll(const QString& exePath,
                                               int weight,
-                                              const QString& title) {
+                                              const QString& title,
+                                              QList<uint64_t>& target) {
   DWORD result = ERROR_SUCCESS;
   Q_ASSERT(weight <= 15);
 
@@ -474,7 +477,7 @@ bool WindowsFirewall::allowTrafficForAppOnAll(const QString& exePath,
   {
     QString desc("Permit (out) IPv4 Traffic of: " + appName);
     filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
-    if (!enableFilter(&filter, title, desc)) {
+    if (!enableFilter(&filter, title, desc, target)) {
       return false;
     }
   }
@@ -482,7 +485,7 @@ bool WindowsFirewall::allowTrafficForAppOnAll(const QString& exePath,
   {
     QString desc("Permit (in) IPv4 Traffic of: " + appName);
     filter.layerKey = FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4;
-    if (!enableFilter(&filter, title, desc)) {
+    if (!enableFilter(&filter, title, desc, target)) {
       return false;
     }
   }
@@ -490,7 +493,8 @@ bool WindowsFirewall::allowTrafficForAppOnAll(const QString& exePath,
 }
 
 bool WindowsFirewall::allowTrafficOfAdapter(int networkAdapter, uint8_t weight,
-                                            const QString& title) {
+                                            const QString& title,
+                                            QList<uint64_t>& target) {
   FWPM_FILTER_CONDITION0 conds;
   // Condition: Request must be targeting the TUN interface
   conds.fieldKey = FWPM_CONDITION_INTERFACE_INDEX;
@@ -512,25 +516,25 @@ bool WindowsFirewall::allowTrafficOfAdapter(int networkAdapter, uint8_t weight,
   // #1 Permit outbound IPv4 traffic.
   filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
   if (!enableFilter(&filter, title,
-                    description.arg("out").arg(networkAdapter))) {
+                    description.arg("out").arg(networkAdapter), target)) {
     return false;
   }
   // #2 Permit inbound IPv4 traffic.
   filter.layerKey = FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4;
   if (!enableFilter(&filter, title,
-                    description.arg("in").arg(networkAdapter))) {
+                    description.arg("in").arg(networkAdapter), target)) {
     return false;
   }
   // #3 Permit outbound IPv6 traffic.
   filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
   if (!enableFilter(&filter, title,
-                    description.arg("out").arg(networkAdapter))) {
+                    description.arg("out").arg(networkAdapter), target)) {
     return false;
   }
   // #4 Permit inbound IPv6 traffic.
   filter.layerKey = FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6;
   if (!enableFilter(&filter, title,
-                    description.arg("in").arg(networkAdapter))) {
+                    description.arg("in").arg(networkAdapter), target)) {
     return false;
   }
   return true;
@@ -538,7 +542,7 @@ bool WindowsFirewall::allowTrafficOfAdapter(int networkAdapter, uint8_t weight,
 
 bool WindowsFirewall::allowTrafficTo(const IPAddress& addr, int weight,
                                      const QString& title,
-                                     const QString& peer) {
+                                     QList<uint64_t>& target) {
   GUID layerKeyOut;
   GUID layerKeyIn;
   if (addr.type() == QAbstractSocket::IPv4Protocol) {
@@ -576,11 +580,11 @@ bool WindowsFirewall::allowTrafficTo(const IPAddress& addr, int weight,
   // Send the filters down to the firewall.
   QString description = "Permit traffic %1 " + addr.toString();
   filter.layerKey = layerKeyOut;
-  if (!enableFilter(&filter, title, description.arg("to"), peer)) {
+  if (!enableFilter(&filter, title, description.arg("to"), target)) {
     return false;
   }
   filter.layerKey = layerKeyIn;
-  if (!enableFilter(&filter, title, description.arg("from"), peer)) {
+  if (!enableFilter(&filter, title, description.arg("from"), target)) {
     return false;
   }
   return true;
@@ -588,7 +592,7 @@ bool WindowsFirewall::allowTrafficTo(const IPAddress& addr, int weight,
 
 bool WindowsFirewall::allowTrafficTo(const QHostAddress& targetIP, uint port,
                                      int weight, const QString& title,
-                                     const QString& peer) {
+                                     QList<uint64_t>& target) {
   bool isIPv4 = targetIP.protocol() == QAbstractSocket::IPv4Protocol;
   GUID layerOut =
       isIPv4 ? FWPM_LAYER_ALE_AUTH_CONNECT_V4 : FWPM_LAYER_ALE_AUTH_CONNECT_V6;
@@ -637,19 +641,20 @@ bool WindowsFirewall::allowTrafficTo(const QHostAddress& targetIP, uint port,
   filter.layerKey = layerOut;
   if (!enableFilter(&filter, title,
                     description.arg("to").arg(targetIP.toString()).arg(port),
-                    peer)) {
+                    target)) {
     return false;
   }
   filter.layerKey = layerIn;
   if (!enableFilter(&filter, title,
                     description.arg("from").arg(targetIP.toString()).arg(port),
-                    peer)) {
+                    target)) {
     return false;
   }
   return true;
 }
 
-bool WindowsFirewall::allowDHCPTraffic(uint8_t weight, const QString& title) {
+bool WindowsFirewall::allowDHCPTraffic(uint8_t weight, const QString& title,
+                                       QList<uint64_t>& target) {
   // Allow outbound DHCPv4
   {
     FWPM_FILTER_CONDITION0 conds[4];
@@ -686,7 +691,7 @@ bool WindowsFirewall::allowDHCPTraffic(uint8_t weight, const QString& title) {
 
     filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
 
-    if (!enableFilter(&filter, title, "Allow Outbound DHCP")) {
+    if (!enableFilter(&filter, title, "Allow Outbound DHCP", target)) {
       return false;
     }
   }
@@ -719,7 +724,7 @@ bool WindowsFirewall::allowDHCPTraffic(uint8_t weight, const QString& title) {
     filter.subLayerKey = ST_FW_WINFW_BASELINE_SUBLAYER_KEY;
     filter.layerKey = FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4;
 
-    if (!enableFilter(&filter, title, "Allow inbound DHCP")) {
+    if (!enableFilter(&filter, title, "Allow inbound DHCP", target)) {
       return false;
     }
   }
@@ -754,7 +759,7 @@ bool WindowsFirewall::allowDHCPTraffic(uint8_t weight, const QString& title) {
     filter.subLayerKey = ST_FW_WINFW_BASELINE_SUBLAYER_KEY;
     filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
 
-    if (!enableFilter(&filter, title, "Allow outbound DHCPv6")) {
+    if (!enableFilter(&filter, title, "Allow outbound DHCPv6", target)) {
       return false;
     }
   }
@@ -787,7 +792,7 @@ bool WindowsFirewall::allowDHCPTraffic(uint8_t weight, const QString& title) {
     filter.weight.uint8 = weight;
     filter.subLayerKey = ST_FW_WINFW_BASELINE_SUBLAYER_KEY;
     filter.layerKey = FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6;
-    if (!enableFilter(&filter, title, "Allow inbound DHCPv6")) {
+    if (!enableFilter(&filter, title, "Allow inbound DHCPv6", target)) {
       return false;
     }
   }
@@ -795,7 +800,8 @@ bool WindowsFirewall::allowDHCPTraffic(uint8_t weight, const QString& title) {
 }
 
 // Allows the internal Hyper-V Switches to work.
-bool WindowsFirewall::allowHyperVTraffic(uint8_t weight, const QString& title) {
+bool WindowsFirewall::allowHyperVTraffic(uint8_t weight, const QString& title,
+                                         QList<uint64_t>& target) {
   FWPM_FILTER_CONDITION0 cond;
   // Condition: Request must be targeting the TUN interface
   cond.fieldKey = FWPM_CONDITION_L2_FLAGS;
@@ -815,12 +821,12 @@ bool WindowsFirewall::allowHyperVTraffic(uint8_t weight, const QString& title) {
 
   // #1 Permit Hyper-V => Hyper-V outbound.
   filter.layerKey = FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE;
-  if (!enableFilter(&filter, title, "Permit Hyper-V => Hyper-V outbound")) {
+  if (!enableFilter(&filter, title, "Permit Hyper-V => Hyper-V outbound", target)) {
     return false;
   }
   // #2 Permit Hyper-V => Hyper-V inbound.
   filter.layerKey = FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE;
-  if (!enableFilter(&filter, title, "Permit Hyper-V => Hyper-V inbound")) {
+  if (!enableFilter(&filter, title, "Permit Hyper-V => Hyper-V inbound", target)) {
     return false;
   }
   return true;
@@ -828,7 +834,7 @@ bool WindowsFirewall::allowHyperVTraffic(uint8_t weight, const QString& title) {
 
 bool WindowsFirewall::blockTrafficTo(const IPAddress& addr, uint8_t weight,
                                      const QString& title,
-                                     const QString& peer) {
+                                     QList<uint64_t>& target) {
   QString description("Block traffic %1 %2 ");
 
   auto lower = addr.address();
@@ -866,12 +872,12 @@ bool WindowsFirewall::blockTrafficTo(const IPAddress& addr, uint8_t weight,
 
   filter.layerKey = layerKeyOut;
   if (!enableFilter(&filter, title, description.arg("to").arg(addr.toString()),
-                    peer)) {
+                    target)) {
     return false;
   }
   filter.layerKey = layerKeyIn;
   if (!enableFilter(&filter, title,
-                    description.arg("from").arg(addr.toString()), peer)) {
+                    description.arg("from").arg(addr.toString()), target)) {
     return false;
   }
   return true;
@@ -879,9 +885,9 @@ bool WindowsFirewall::blockTrafficTo(const IPAddress& addr, uint8_t weight,
 
 bool WindowsFirewall::blockTrafficTo(const QList<IPAddress>& rangeList,
                                      uint8_t weight, const QString& title,
-                                     const QString& peer) {
+                                     QList<uint64_t>& target) {
   for (auto range : rangeList) {
-    if (!blockTrafficTo(range, weight, title, peer)) {
+    if (!blockTrafficTo(range, weight, title, target)) {
       logger.info() << "Setting Range of" << range.toString() << "failed";
       return false;
     }
@@ -937,7 +943,8 @@ void WindowsFirewall::importAddress(const QHostAddress& addr,
 }
 
 bool WindowsFirewall::blockTrafficOnPort(uint port, uint8_t weight,
-                                         const QString& title) {
+                                         const QString& title,
+                                         QList<uint64_t>& target) {
   // Allow Traffic to IP with PORT using any protocol
   FWPM_FILTER_CONDITION0 conds[3];
   conds[0].fieldKey = FWPM_CONDITION_IP_PROTOCOL;
@@ -967,20 +974,20 @@ bool WindowsFirewall::blockTrafficOnPort(uint port, uint8_t weight,
 
   QString description("Block %1 on Port %2");
   filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
-  if (!enableFilter(&filter, title, description.arg("outgoing v6").arg(port))) {
+  if (!enableFilter(&filter, title, description.arg("outgoing v6").arg(port), target)) {
     return false;
   }
   filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
-  if (!enableFilter(&filter, title, description.arg("outgoing v4").arg(port))) {
+  if (!enableFilter(&filter, title, description.arg("outgoing v4").arg(port), target)) {
     return false;
   }
 
   filter.layerKey = FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4;
-  if (!enableFilter(&filter, title, description.arg("incoming v4").arg(port))) {
+  if (!enableFilter(&filter, title, description.arg("incoming v4").arg(port), target)) {
     return false;
   }
   filter.layerKey = FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6;
-  if (!enableFilter(&filter, title, description.arg("incoming v6").arg(port))) {
+  if (!enableFilter(&filter, title, description.arg("incoming v6").arg(port), target)) {
     return false;
   }
   return true;
@@ -988,7 +995,7 @@ bool WindowsFirewall::blockTrafficOnPort(uint port, uint8_t weight,
 
 bool WindowsFirewall::enableFilter(FWPM_FILTER0* filter, const QString& title,
                                    const QString& description,
-                                   const QString& peer) {
+                                   QList<uint64_t>& target) {
   uint64_t filterID = 0;
   auto name = title.toStdWString();
   auto desc = description.toStdWString();
@@ -1001,16 +1008,12 @@ bool WindowsFirewall::enableFilter(FWPM_FILTER0* filter, const QString& title,
     return false;
   }
   logger.info() << "Filter added: " << title << ":" << description;
-  if (peer.isEmpty()) {
-    m_activeRules.append(filterID);
-  } else {
-    m_peerRules.insert(peer, filterID);
-  }
+  target.append(filterID);
   return true;
 }
 
-bool WindowsFirewall::allowLoopbackTraffic(uint8_t weight,
-                                           const QString& title) {
+bool WindowsFirewall::allowLoopbackTraffic(uint8_t weight, const QString& title,
+                                           QList<uint64_t>& target) {
   QList<QNetworkInterface> networkInterfaces =
       QNetworkInterface::allInterfaces();
   for (const auto& iface : networkInterfaces) {
@@ -1018,7 +1021,7 @@ bool WindowsFirewall::allowLoopbackTraffic(uint8_t weight,
       continue;
     }
     if (!allowTrafficOfAdapter(iface.index(), weight,
-                               title.arg(iface.name()))) {
+                               title.arg(iface.name()), target)) {
       return false;
     }
   }

client/platforms/windows/daemon/windowsfirewall.h

@@ -15,6 +15,7 @@
 
 #include <QByteArray>
 #include <QHostAddress>
+#include <QMap>
 #include <QObject>
 #include <QString>
 
@@ -38,38 +39,42 @@ class WindowsFirewall final : public QObject {
   static WindowsFirewall* create(QObject* parent);
   ~WindowsFirewall() override;
 
-  bool enableInterface(int vpnAdapterIndex);
+  bool enableInterface(int vpnAdapterIndex, const QString& ifname = QString());
   bool enableLanBypass(const QList<IPAddress>& ranges);
   bool enablePeerTraffic(const InterfaceConfig& config);
-  bool disablePeerTraffic(const QString& pubkey);
   bool disableKillSwitch();
+  bool disableKillSwitchForTunnel(const QString& ifname);
   bool allowAllTraffic();
-  bool allowTrafficRange(const QStringList& ranges);
+  bool allowTrafficRange(const QStringList& ranges, const QString& ifname = QString());
 
  private:
   static bool initSublayer();
   WindowsFirewall(HANDLE session, QObject* parent);
   HANDLE m_sessionHandle;
   bool m_init = false;
-  QList<uint64_t> m_activeRules;
-  QMultiMap<QString, uint64_t> m_peerRules;
+  QList<uint64_t> m_globalRules;
+  QMap<QString, QList<uint64_t>> m_tunnelRules;
 
   bool allowTrafficForAppOnAll(const QString& exePath, int weight,
-                               const QString& title);
+                               const QString& title, QList<uint64_t>& target);
   bool blockTrafficTo(const QList<IPAddress>& range, uint8_t weight,
-                      const QString& title, const QString& peer = QString());
+                      const QString& title, QList<uint64_t>& target);
   bool blockTrafficTo(const IPAddress& addr, uint8_t weight,
-                      const QString& title, const QString& peer = QString());
-  bool blockTrafficOnPort(uint port, uint8_t weight, const QString& title);
+                      const QString& title, QList<uint64_t>& target);
+  bool blockTrafficOnPort(uint port, uint8_t weight, const QString& title,
+                          QList<uint64_t>& target);
   bool allowTrafficTo(const IPAddress& addr, int weight, const QString& title,
-                      const QString& peer = QString());
+                      QList<uint64_t>& target);
   bool allowTrafficTo(const QHostAddress& targetIP, uint port, int weight,
-                      const QString& title, const QString& peer = QString());
+                      const QString& title, QList<uint64_t>& target);
   bool allowTrafficOfAdapter(int networkAdapter, uint8_t weight,
-                             const QString& title);
-  bool allowDHCPTraffic(uint8_t weight, const QString& title);
-  bool allowHyperVTraffic(uint8_t weight, const QString& title);
-  bool allowLoopbackTraffic(uint8_t weight, const QString& title);
+                             const QString& title, QList<uint64_t>& target);
+  bool allowDHCPTraffic(uint8_t weight, const QString& title,
+                        QList<uint64_t>& target);
+  bool allowHyperVTraffic(uint8_t weight, const QString& title,
+                          QList<uint64_t>& target);
+  bool allowLoopbackTraffic(uint8_t weight, const QString& title,
+                            QList<uint64_t>& target);
 
   // Utils
   QString getCurrentPath();
@@ -78,8 +83,7 @@ class WindowsFirewall final : public QObject {
   void importAddress(const QHostAddress& addr, OUT FWP_CONDITION_VALUE0_& value,
                      OUT QByteArray* v6DataBuffer);
   bool enableFilter(FWPM_FILTER0* filter, const QString& title,
-                    const QString& description,
-                    const QString& peer = QString());
+                    const QString& description, QList<uint64_t>& target);
 };
 
 #endif  // WINDOWSFIREWALL_H

client/platforms/windows/daemon/windowsroutemonitor.cpp

@@ -58,9 +58,12 @@ static int prefixcmp(const void* a, const void* b, size_t bits) {
   return 0;
 }
 
+QSet<quint64> WindowsRouteMonitor::s_vpnLuids;
+
 WindowsRouteMonitor::WindowsRouteMonitor(quint64 luid, QObject* parent)
     : QObject(parent), m_luid(luid) {
   MZ_COUNT_CTOR(WindowsRouteMonitor);
+  s_vpnLuids.insert(luid);
   logger.debug() << "WindowsRouteMonitor created.";
 
   NotifyRouteChange2(AF_INET, routeChangeCallback, this, FALSE, &m_routeHandle);
@@ -69,8 +72,8 @@ WindowsRouteMonitor::WindowsRouteMonitor(quint64 luid, QObject* parent)
 WindowsRouteMonitor::~WindowsRouteMonitor() {
   MZ_COUNT_DTOR(WindowsRouteMonitor);
   CancelMibChangeNotify2(m_routeHandle);
+  s_vpnLuids.remove(m_luid);
 
-  flushRouteTable(m_exclusionRoutes);
   flushRouteTable(m_clonedRoutes);
   logger.debug() << "WindowsRouteMonitor destroyed.";
 }
@@ -95,7 +98,8 @@ void WindowsRouteMonitor::updateInterfaceMetrics(int family) {
   // Rebuild the list of interfaces that are valid for routing.
   for (ULONG i = 0; i < table->NumEntries; i++) {
     MIB_IPINTERFACE_ROW* row = &table->Table[i];
-    if (row->InterfaceLuid.Value == m_luid) {
+    // Skip any VPN wintun (own or sibling) so exclusion routes never pick one.
+    if (s_vpnLuids.contains(row->InterfaceLuid.Value)) {
       continue;
     }
     if (!row->Connected) {
@@ -126,8 +130,8 @@ void WindowsRouteMonitor::updateExclusionRoute(MIB_IPFORWARD_ROW2* data,
   nexthop.si_family = data->DestinationPrefix.Prefix.si_family;
   for (ULONG i = 0; i < table->NumEntries; i++) {
     MIB_IPFORWARD_ROW2* row = &table->Table[i];
-    // Ignore routes into the VPN interface.
-    if (row->InterfaceLuid.Value == m_luid) {
+    // Skip any VPN wintun (own or sibling).
+    if (s_vpnLuids.contains(row->InterfaceLuid.Value)) {
       continue;
     }
     if (row->DestinationPrefix.PrefixLength < bestMatch) {
@@ -239,14 +243,16 @@ QHostAddress WindowsRouteMonitor::prefixToAddress(
   }
 }
 
-bool WindowsRouteMonitor::isRouteExcluded(const IP_ADDRESS_PREFIX* dest) const {
-  auto i = m_exclusionRoutes.constBegin();
-  while (i != m_exclusionRoutes.constEnd()) {
-    const MIB_IPFORWARD_ROW2* row = i.value();
+bool WindowsRouteMonitor::isRouteExcluded(void* ptable,
+                                          const IP_ADDRESS_PREFIX* dest) const {
+  PMIB_IPFORWARD_TABLE2 table = reinterpret_cast<PMIB_IPFORWARD_TABLE2>(ptable);
+  for (ULONG i = 0; i < table->NumEntries; i++) {
+    const MIB_IPFORWARD_ROW2* row = &table->Table[i];
+    if (row->Protocol != MIB_IPPROTO_NETMGMT) continue;
+    if (row->Metric != EXCLUSION_ROUTE_METRIC) continue;
     if (routeContainsDest(&row->DestinationPrefix, dest)) {
       return true;
     }
-    i++;
   }
   return false;
 }
@@ -272,8 +278,8 @@ void WindowsRouteMonitor::updateCapturedRoutes(int family, void* ptable) {
 
   for (ULONG i = 0; i < table->NumEntries; i++) {
     MIB_IPFORWARD_ROW2* row = &table->Table[i];
-    // Ignore routes into the VPN interface.
-    if (row->InterfaceLuid.Value == m_luid) {
+    // Skip any VPN wintun (own or sibling).
+    if (s_vpnLuids.contains(row->InterfaceLuid.Value)) {
       continue;
     }
     // Ignore the default route
@@ -286,7 +292,7 @@ void WindowsRouteMonitor::updateCapturedRoutes(int family, void* ptable) {
       continue;
     }
     // Ignore routes which should be excluded.
-    if (isRouteExcluded(&row->DestinationPrefix)) {
+    if (isRouteExcluded(table, &row->DestinationPrefix)) {
       continue;
     }
     QHostAddress destination = prefixToAddress(&row->DestinationPrefix);
@@ -375,11 +381,6 @@ bool WindowsRouteMonitor::addExclusionRoute(const IPAddress& prefix) {
     return true;
   }
 
-  if (m_exclusionRoutes.contains(prefix)) {
-    logger.warning() << "Exclusion route already exists";
-    return false;
-  }
-
   // Allocate and initialize the MIB routing table row.
   MIB_IPFORWARD_ROW2* data = new MIB_IPFORWARD_ROW2;
   InitializeIpForwardEntry(data);
@@ -427,8 +428,8 @@ bool WindowsRouteMonitor::addExclusionRoute(const IPAddress& prefix) {
   updateCapturedRoutes(family, table);
   updateExclusionRoute(data, table);
   FreeMibTable(table);
-
-  m_exclusionRoutes[prefix] = data;
+  delete data;
+  m_ownedExclusionRoutes.insert(prefix);
   return true;
 }
 
@@ -436,23 +437,39 @@ bool WindowsRouteMonitor::deleteExclusionRoute(const IPAddress& prefix) {
   logger.debug() << "Deleting exclusion route for"
                  << prefix.address().toString();
 
-  MIB_IPFORWARD_ROW2* data = m_exclusionRoutes.take(prefix);
-  if (data == nullptr) {
-    return true;
+  m_ownedExclusionRoutes.remove(prefix);
+
+  PMIB_IPFORWARD_TABLE2 table;
+  DWORD result = GetIpForwardTable2(AF_UNSPEC, &table);
+  if (result != NO_ERROR) {
+    logger.error() << "Failed to fetch routing table:" << result;
+    return false;
   }
 
-  DWORD result = DeleteIpForwardEntry2(data);
-  if ((result != ERROR_NOT_FOUND) && (result != NO_ERROR)) {
-    logger.error() << "Failed to delete route to"
-                   << prefix.toString()
-                   << "result:" << result;
+  const bool isV4 = prefix.address().protocol() == QAbstractSocket::IPv4Protocol;
+  const ADDRESS_FAMILY addrFamily =
+      isV4 ? static_cast<ADDRESS_FAMILY>(AF_INET)
+           : static_cast<ADDRESS_FAMILY>(AF_INET6);
+  bool deleted = false;
+  for (ULONG i = 0; i < table->NumEntries; i++) {
+    MIB_IPFORWARD_ROW2* row = &table->Table[i];
+    if (row->Protocol != MIB_IPPROTO_NETMGMT) continue;
+    if (row->Metric != EXCLUSION_ROUTE_METRIC) continue;
+    if (row->DestinationPrefix.Prefix.si_family != addrFamily) continue;
+    if (row->DestinationPrefix.PrefixLength != prefix.prefixLength()) continue;
+    if (prefixToAddress(&row->DestinationPrefix) != prefix.address()) continue;
+    DWORD r = DeleteIpForwardEntry2(row);
+    if (r == NO_ERROR || r == ERROR_NOT_FOUND) {
+      deleted = true;
+    } else {
+      logger.error() << "Failed to delete route to" << prefix.toString()
+                     << "result:" << r;
+    }
+    break;
   }
-
-  // Captured routes might have changed.
-  updateCapturedRoutes(data->DestinationPrefix.Prefix.si_family);
-
-  delete data;
-  return true;
+  FreeMibTable(table);
+  updateCapturedRoutes(addrFamily);
+  return deleted;
 }
 
 void WindowsRouteMonitor::flushRouteTable(
@@ -492,8 +509,24 @@ void WindowsRouteMonitor::routeChanged() {
 
   updateInterfaceMetrics(AF_UNSPEC);
   updateCapturedRoutes(AF_UNSPEC, table);
-  for (MIB_IPFORWARD_ROW2* data : m_exclusionRoutes) {
-    updateExclusionRoute(data, table);
+
+  for (const IPAddress& prefix : m_ownedExclusionRoutes) {
+    const bool isV4 =
+        prefix.address().protocol() == QAbstractSocket::IPv4Protocol;
+    const ADDRESS_FAMILY addrFamily =
+        isV4 ? static_cast<ADDRESS_FAMILY>(AF_INET)
+             : static_cast<ADDRESS_FAMILY>(AF_INET6);
+    for (ULONG i = 0; i < table->NumEntries; i++) {
+      MIB_IPFORWARD_ROW2* row = &table->Table[i];
+      if (row->Protocol != MIB_IPPROTO_NETMGMT) continue;
+      if (row->Metric != EXCLUSION_ROUTE_METRIC) continue;
+      if (row->DestinationPrefix.Prefix.si_family != addrFamily) continue;
+      if (row->DestinationPrefix.PrefixLength != prefix.prefixLength()) continue;
+      if (prefixToAddress(&row->DestinationPrefix) != prefix.address()) continue;
+      MIB_IPFORWARD_ROW2 copy = *row;
+      updateExclusionRoute(&copy, table);
+      break;
+    }
   }
 
   FreeMibTable(table);

client/platforms/windows/daemon/windowsroutemonitor.h

@@ -14,6 +14,7 @@
 #include <QHash>
 #include <QMap>
 #include <QObject>
+#include <QSet>
 
 #include "ipaddress.h"
 
@@ -28,7 +29,6 @@ class WindowsRouteMonitor final : public QObject {
 
   bool addExclusionRoute(const IPAddress& prefix);
   bool deleteExclusionRoute(const IPAddress& prefix);
-  void flushExclusionRoutes() { return flushRouteTable(m_exclusionRoutes); };
 
   quint64 getLuid() const { return m_luid; }
 
@@ -36,7 +36,7 @@ class WindowsRouteMonitor final : public QObject {
   void routeChanged();
 
  private:
-  bool isRouteExcluded(const IP_ADDRESS_PREFIX* dest) const;
+  bool isRouteExcluded(void* table, const IP_ADDRESS_PREFIX* dest) const;
   static bool routeContainsDest(const IP_ADDRESS_PREFIX* route,
                                 const IP_ADDRESS_PREFIX* dest);
   static QHostAddress prefixToAddress(const IP_ADDRESS_PREFIX* dest);
@@ -47,7 +47,7 @@ class WindowsRouteMonitor final : public QObject {
   void updateCapturedRoutes(int family);
   void updateCapturedRoutes(int family, void* table);
 
-  QHash<IPAddress, MIB_IPFORWARD_ROW2*> m_exclusionRoutes;
+  QSet<IPAddress> m_ownedExclusionRoutes;
   QMap<quint64, ULONG> m_interfaceMetricsIpv4;
   QMap<quint64, ULONG> m_interfaceMetricsIpv6;
 
@@ -57,6 +57,8 @@ class WindowsRouteMonitor final : public QObject {
 
   const quint64 m_luid = 0;
   HANDLE m_routeHandle = INVALID_HANDLE_VALUE;
+
+  static QSet<quint64> s_vpnLuids;
 };
 
 #endif /* WINDOWSROUTEMONITOR_H */

client/platforms/windows/daemon/windowssplittunnel.cpp

@@ -24,7 +24,6 @@
 #include <QFileInfo>
 #include <QNetworkInterface>
 #include <QScopeGuard>
-#include <QUrl>
 
 #pragma region
 
@@ -149,18 +148,6 @@ ProcessInfo getProcessInfo(HANDLE process, const PROCESSENTRY32W& processMeta) {
   return pi;
 }
 
-QString normalizeExecutablePath(const QString& path) {
-  QString normalized = path.trimmed();
-  if (normalized.startsWith("file:", Qt::CaseInsensitive)) {
-    const QString localPath = QUrl(normalized).toLocalFile();
-    if (!localPath.isEmpty()) {
-      normalized = localPath;
-    }
-  }
-  normalized.replace('/', '\\');
-  return normalized;
-}
-
 }  // namespace
 
 std::unique_ptr<WindowsSplitTunnel> WindowsSplitTunnel::create(
@@ -300,10 +287,6 @@ bool WindowsSplitTunnel::excludeApps(const QStringList& appPaths) {
 
   logger.debug() << "Pushing new Ruleset for Split-Tunnel " << state;
   auto config = generateAppConfiguration(appPaths);
-  if (config.empty()) {
-    logger.error() << "No valid split-tunnel application rules generated";
-    return false;
-  }
 
   DWORD bytesReturned;
   auto ok = DeviceIoControl(m_driver, IOCTL_SET_CONFIGURATION, &config[0],
@@ -331,7 +314,7 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
     auto ok = DeviceIoControl(m_driver, IOCTL_INITIALIZE, nullptr, 0, nullptr,
                               0, &bytesReturned, nullptr);
     if (!ok) {
-      logger.error() << "Driver init failed. Error:" << GetLastError();
+      logger.error() << "Driver init failed";
       return false;
     }
   }
@@ -340,16 +323,11 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
   if (getState() == STATE_INITIALIZED) {
     logger.debug() << "State is Init, requires process config";
     auto config = generateProcessBlob();
-    if (config.empty()) {
-      logger.error() << "Process configuration blob is empty";
-      return false;
-    }
     auto ok = DeviceIoControl(m_driver, IOCTL_REGISTER_PROCESSES, &config[0],
                               (DWORD)config.size(), nullptr, 0, &bytesReturned,
                               nullptr);
     if (!ok) {
-      logger.error() << "Failed to set Process Config. Error:"
-                     << GetLastError();
+      logger.error() << "Failed to set Process Config";
       return false;
     }
     logger.debug() << "Set Process Config ok || new State:" << stateString();
@@ -362,16 +340,11 @@ bool WindowsSplitTunnel::start(int inetAdapterIndex, int vpnAdapterIndex) {
   logger.debug() << "Driver is  ready || new State:" << stateString();
 
   auto config = generateIPConfiguration(inetAdapterIndex, vpnAdapterIndex);
-  if (config.empty()) {
-    logger.error() << "Network configuration blob is empty. Internet adapter:"
-                   << inetAdapterIndex << "VPN adapter:" << vpnAdapterIndex;
-    return false;
-  }
   auto ok = DeviceIoControl(m_driver, IOCTL_REGISTER_IP_ADDRESSES, &config[0],
                             (DWORD)config.size(), nullptr, 0, &bytesReturned,
                             nullptr);
   if (!ok) {
-    logger.error() << "Failed to set Network Config. Error:" << GetLastError();
+    logger.error() << "Failed to set Network Config";
     return false;
   }
   logger.debug() << "New Network Config Applied || new State:" << stateString();
@@ -431,22 +404,13 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
   size_t cummulated_string_size = 0;
   QStringList dosPaths;
   for (auto const& path : appPaths) {
-    const QString normalizedPath = normalizeExecutablePath(path);
-    auto dosPath = convertPath(normalizedPath);
-    if (dosPath.isEmpty()) {
-      logger.error() << "Rejecting split-tunnel app path with empty device "
-                        "conversion:"
-                     << normalizedPath;
-      continue;
-    }
+    auto dosPath = convertPath(path);
     dosPaths.append(dosPath);
     cummulated_string_size += dosPath.toStdWString().size() * sizeof(wchar_t);
-  }
-  if (dosPaths.isEmpty()) {
-    return {};
+    logger.debug() << dosPath;
   }
   size_t bufferSize = sizeof(CONFIGURATION_HEADER) +
-                      (sizeof(CONFIGURATION_ENTRY) * dosPaths.size()) +
+                      (sizeof(CONFIGURATION_ENTRY) * appPaths.size()) +
                       cummulated_string_size;
   std::vector<uint8_t> outBuffer(bufferSize);
 
@@ -454,7 +418,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
   auto entry = (CONFIGURATION_ENTRY*)(header + 1);
 
   auto stringDest = &outBuffer[0] + sizeof(CONFIGURATION_HEADER) +
-                    (sizeof(CONFIGURATION_ENTRY) * dosPaths.size());
+                    (sizeof(CONFIGURATION_ENTRY) * appPaths.size());
 
   SIZE_T stringOffset = 0;
 
@@ -473,7 +437,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateAppConfiguration(
     stringOffset += stringLength;
   }
 
-  header->NumEntries = dosPaths.length();
+  header->NumEntries = appPaths.length();
   header->TotalLength = bufferSize;
 
   return outBuffer;
@@ -485,7 +449,9 @@ std::vector<std::byte> WindowsSplitTunnel::generateIPConfiguration(
 
   auto config = reinterpret_cast<IP_ADDRESSES_CONFIG*>(&out[0]);
 
-  if (vpnAdapterIndex == 0) {
+  auto ifaces = QNetworkInterface::allInterfaces();
+
+    if (vpnAdapterIndex == 0) {
     vpnAdapterIndex = WindowsCommons::VPNAdapterIndex();
   }
   // Always the VPN
@@ -554,7 +520,7 @@ std::vector<uint8_t> WindowsSplitTunnel::generateProcessBlob() {
     auto process_handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE,
                                       currentProcess.th32ProcessID);
 
-    if (process_handle == nullptr) {
+    if (process_handle == INVALID_HANDLE_VALUE) {
       continue;
     }
     ProcessInfo info = getProcessInfo(process_handle, currentProcess);
@@ -674,48 +640,23 @@ bool WindowsSplitTunnel::isInstalled() {
 }
 
 QString WindowsSplitTunnel::convertPath(const QString& path) {
-  const QString normalizedPath = normalizeExecutablePath(path);
-  if (normalizedPath.isEmpty()) {
-    logger.error() << "Empty executable path for DOS device conversion";
-    return "";
-  }
-  auto parts = normalizedPath.split("\\", Qt::SkipEmptyParts);
-  if (parts.isEmpty()) {
-    logger.error() << "Invalid executable path for DOS device conversion:"
-                   << normalizedPath;
-    return "";
-  }
+  auto parts = path.split("/");
   QString driveLetter = parts.takeFirst();
   if (!driveLetter.contains(":") || parts.size() == 0) {
     // device should contain : for e.g C:
-    logger.error() << "Invalid executable path for DOS device conversion:"
-                   << normalizedPath;
     return "";
   }
-  QByteArray buffer(2048 * sizeof(wchar_t), 0);
-  DWORD ok = 0;
-  DWORD err = ERROR_SUCCESS;
-  for (int attempt = 0; attempt < 4; ++attempt) {
-    ok = QueryDosDeviceW(reinterpret_cast<LPCWSTR>(driveLetter.utf16()),
-                         reinterpret_cast<LPWSTR>(buffer.data()),
-                         buffer.size() / sizeof(wchar_t));
-    if (ok != 0) {
-      break;
-    }
-    err = GetLastError();
-    if (err != ERROR_INSUFFICIENT_BUFFER) {
-      WindowsUtils::windowsLog("Err fetching dos path");
-      logger.error() << "QueryDosDeviceW failed for" << driveLetter
-                     << "error:" << err;
-      return "";
-    }
+  QByteArray buffer(2048, 0xFFu);
+  auto ok = QueryDosDeviceW(qUtf16Printable(driveLetter),
+                            (wchar_t*)buffer.data(), buffer.size() / 2);
+
+  if (ok == ERROR_INSUFFICIENT_BUFFER) {
     buffer.resize(buffer.size() * 2);
-    buffer.fill(0);
+    ok = QueryDosDeviceW(qUtf16Printable(driveLetter), (wchar_t*)buffer.data(),
+                         buffer.size() / 2);
   }
   if (ok == 0) {
     WindowsUtils::windowsLog("Err fetching dos path");
-    logger.error() << "QueryDosDeviceW failed after buffer growth for"
-                   << driveLetter << "error:" << err;
     return "";
   }
   QString deviceName;

client/platforms/windows/daemon/windowstunnelservice.cpp

@@ -15,9 +15,8 @@
 #include "platforms/windows/windowsutils.h"
 #include "windowsdaemon.h"
 
-#define TUNNEL_NAMED_PIPE \
-  "\\\\."                 \
-  "\\pipe\\ProtectedPrefix\\Administrators\\AmneziaWG\\AmneziaVPN"
+#define TUNNEL_NAMED_PIPE_PREFIX \
+  "\\\\.\\pipe\\ProtectedPrefix\\Administrators\\AmneziaWG\\"
 
 constexpr uint32_t WINDOWS_TUNNEL_MONITOR_TIMEOUT_MSEC = 2000;
 
@@ -28,6 +27,10 @@ Logger logger("WindowsTunnelService");
 static bool stopAndDeleteTunnelService(SC_HANDLE service);
 static bool waitForServiceStatus(SC_HANDLE service, DWORD expectedStatus);
 
+std::wstring WindowsTunnelService::serviceNameForIfname(const QString& ifname) {
+  return (QStringLiteral("AmneziaWGTunnel$") + ifname).toStdWString();
+}
+
 WindowsTunnelService::WindowsTunnelService(QObject* parent) : QObject(parent) {
   MZ_COUNT_CTOR(WindowsTunnelService);
   logger.debug() << "WindowsTunnelService created.";
@@ -37,7 +40,7 @@ WindowsTunnelService::WindowsTunnelService(QObject* parent) : QObject(parent) {
     WindowsUtils::windowsLog("Failed to open SCManager");
   }
 
-  // Is the service already running? Terminate it.
+  // Is the legacy single-tunnel service still around? Terminate it.
   SC_HANDLE service =
       OpenService((SC_HANDLE)m_scm, TUNNEL_SERVICE_NAME, SERVICE_ALL_ACCESS);
   if (service != nullptr) {
@@ -108,8 +111,11 @@ void WindowsTunnelService::timeout() {
   emit backendFailure();
 }
 
-bool WindowsTunnelService::start(const QString& configData) {
-  logger.debug() << "Starting the tunnel service";
+bool WindowsTunnelService::start(const QString& configData, const QString& ifname) {
+  logger.debug() << "Starting the tunnel service for" << ifname;
+
+  m_ifname = ifname;
+  const std::wstring serviceName = serviceNameForIfname(ifname);
 
   m_logworker = new WindowsTunnelLogger(WindowsCommons::tunnelLogFile());
   m_logworker->moveToThread(&m_logthread);
@@ -128,10 +134,9 @@ bool WindowsTunnelService::start(const QString& configData) {
     m_logworker = nullptr;
   });
 
-  // Let's see if we have to delete a previous instance.
-  service = OpenService(scm, TUNNEL_SERVICE_NAME, SERVICE_ALL_ACCESS);
+  service = OpenService(scm, serviceName.c_str(), SERVICE_ALL_ACCESS);
   if (service) {
-    logger.debug() << "An existing service has been detected. Let's close it.";
+    logger.debug() << "A stale service was detected. Cleaning it up.";
     if (!stopAndDeleteTunnelService(service)) {
       return false;
     }
@@ -143,12 +148,12 @@ bool WindowsTunnelService::start(const QString& configData) {
   {
     QTextStream out(&serviceCmdline);
     out << "\"" << qApp->applicationFilePath() << "\" tunneldaemon \""
-        << configData << "\"";
+        << configData << "\" \"" << ifname << "\"";
   }
 
   logger.debug() << "Service:" << qApp->applicationFilePath();
 
-  service = CreateService(scm, TUNNEL_SERVICE_NAME, L"Amnezia VPN (tunnel)",
+  service = CreateService(scm, serviceName.c_str(), L"Amnezia VPN (tunnel)",
                           SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS,
                           SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
                           (const wchar_t*)serviceCmdline.utf16(), nullptr, 0,
@@ -236,8 +241,9 @@ static bool stopAndDeleteTunnelService(SC_HANDLE service) {
 }
 
 QString WindowsTunnelService::uapiCommand(const QString& command) {
-  // Create a pipe to the tunnel service.
-  LPTSTR tunnelName = (LPTSTR)TEXT(TUNNEL_NAMED_PIPE);
+  const std::wstring pipeName = std::wstring(TEXT(TUNNEL_NAMED_PIPE_PREFIX))
+                              + m_ifname.toStdWString();
+  LPCWSTR tunnelName = pipeName.c_str();
   HANDLE pipe = CreateFile(tunnelName, GENERIC_READ | GENERIC_WRITE, 0, nullptr,
                            OPEN_EXISTING, 0, nullptr);
   if (pipe == INVALID_HANDLE_VALUE) {

client/platforms/windows/daemon/windowstunnelservice.h

@@ -9,6 +9,7 @@
 #include <QObject>
 #include <QThread>
 #include <QTimer>
+#include <string>
 
 #include "windowstunnellogger.h"
 
@@ -20,11 +21,13 @@ class WindowsTunnelService final : public QObject {
   WindowsTunnelService(QObject* parent = nullptr);
   ~WindowsTunnelService();
 
-  bool start(const QString& configData);
+  bool start(const QString& configData, const QString& ifname);
   void stop();
   bool isRunning();
   QString uapiCommand(const QString& command);
 
+  static std::wstring serviceNameForIfname(const QString& ifname);
+
  signals:
   void backendFailure();
 
@@ -36,6 +39,7 @@ class WindowsTunnelService final : public QObject {
   QTimer m_timer;
   QThread m_logthread;
   WindowsTunnelLogger* m_logworker = nullptr;
+  QString m_ifname;
 
   // These are really SC_HANDLEs in disguise.
   void* m_scm = nullptr;

client/platforms/windows/daemon/wireguardutilswindows.cpp

@@ -102,23 +102,36 @@ bool WireguardUtilsWindows::addInterface(const InterfaceConfig& config) {
     return false;
   }
 
-  // We don't want to pass a peer just yet, that will happen later with
-  // a UAPI command in WireguardUtilsWindows::updatePeer(), so truncate
-  // the config file to remove the [Peer] section.
   qsizetype peerStart = configString.indexOf("[Peer]", 0, Qt::CaseSensitive);
   if (peerStart >= 0) {
     configString.truncate(peerStart);
   }
 
-  if (!m_tunnel.start(configString)) {
+  auto stripLine = [&](const QString& key) {
+    qsizetype start = configString.startsWith(key + " = ")
+                          ? 0
+                          : configString.indexOf("\n" + key + " = ");
+    if (start < 0) return;
+    if (start != 0) start += 1;
+    qsizetype end = configString.indexOf('\n', start);
+    if (end < 0) return;
+    configString.remove(start, end - start + 1);
+  };
+
+  stripLine("DNS");
+  if (config.m_deferAddressSetup) {
+    // Wintun rejects duplicate IPv4; daemon will assign at swap time.
+    stripLine("Address");
+  }
+
+  m_ifname = config.m_ifname.isEmpty() ? s_defaultInterfaceName() : config.m_ifname;
+  if (!m_tunnel.start(configString, m_ifname)) {
     logger.error() << "Failed to activate the tunnel service";
     return false;
   }
 
-  // Determine the interface LUID
   NET_LUID luid;
-  QString ifAlias = interfaceName();
-  DWORD result = ConvertInterfaceAliasToLuid((wchar_t*)ifAlias.utf16(), &luid);
+  DWORD result = ConvertInterfaceAliasToLuid((wchar_t*)m_ifname.utf16(), &luid);
   if (result != 0) {
     logger.error() << "Failed to lookup LUID:" << result;
     return false;
@@ -126,14 +139,6 @@ bool WireguardUtilsWindows::addInterface(const InterfaceConfig& config) {
   m_luid = luid.Value;
   m_routeMonitor = new WindowsRouteMonitor(luid.Value, this);
 
-  if (config.m_killSwitchEnabled) {
-    // Enable the windows firewall
-    NET_IFINDEX ifindex;
-    ConvertInterfaceLuidToIndex(&luid, &ifindex);
-    m_firewall->allowAllTraffic();
-    m_firewall->enableInterface(ifindex);
-  }
-
   logger.debug() << "Registration completed";
   return true;
 }
@@ -143,7 +148,6 @@ bool WireguardUtilsWindows::deleteInterface() {
     m_routeMonitor->deleteLater();
   }
 
-  m_firewall->disableKillSwitch();
   m_tunnel.stop();
   return true;
 }
@@ -154,10 +158,6 @@ bool WireguardUtilsWindows::updatePeer(const InterfaceConfig& config) {
   QByteArray pskKey =
       QByteArray::fromBase64(qPrintable(config.m_serverPskKey));
 
-  if (config.m_killSwitchEnabled) {
-    // Enable the windows firewall for this peer.
-    m_firewall->enablePeerTraffic(config);
-  }
   logger.debug() << "Configuring peer" << publicKey.toHex()
                  << "via" << config.m_serverIpv4AddrIn;
 
@@ -185,12 +185,6 @@ bool WireguardUtilsWindows::updatePeer(const InterfaceConfig& config) {
     out << "allowed_ip=" << ip.toString() << "\n";
   }
 
-  // Exclude the server address, except for multihop exit servers.
-  if (m_routeMonitor && config.m_hopType != InterfaceConfig::MultiHopExit) {
-    m_routeMonitor->addExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
-    m_routeMonitor->addExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
-  }
-
   QString reply = m_tunnel.uapiCommand(message);
   logger.debug() << "DATA:" << reply;
   return true;
@@ -200,15 +194,6 @@ bool WireguardUtilsWindows::deletePeer(const InterfaceConfig& config) {
   QByteArray publicKey =
       QByteArray::fromBase64(qPrintable(config.m_serverPublicKey));
 
-  // Clear exclustion routes for this peer.
-  if (m_routeMonitor && config.m_hopType != InterfaceConfig::MultiHopExit) {
-    m_routeMonitor->deleteExclusionRoute(IPAddress(config.m_serverIpv4AddrIn));
-    m_routeMonitor->deleteExclusionRoute(IPAddress(config.m_serverIpv6AddrIn));
-  }
-
-  // Disable the windows firewall for this peer.
-  m_firewall->disablePeerTraffic(config.m_serverPublicKey);
-
   QString message;
   QTextStream out(&message);
   out << "set=1\n";

client/platforms/windows/daemon/wireguardutilswindows.h

@@ -27,10 +27,8 @@ class WireguardUtilsWindows final : public WireguardUtils {
   ~WireguardUtilsWindows();
 
   bool interfaceExists() override { return m_tunnel.isRunning(); }
-  QString interfaceName() override {
-    return WireguardUtilsWindows::s_interfaceName();
-  }
-  static const QString s_interfaceName() { return "AmneziaVPN"; }
+  QString interfaceName() override { return m_ifname; }
+  static const QString s_defaultInterfaceName() { return "AmneziaVPN"; }
   bool addInterface(const InterfaceConfig& config) override;
   bool deleteInterface() override;
 
@@ -54,6 +52,7 @@ class WireguardUtilsWindows final : public WireguardUtils {
   void buildMibForwardRow(const IPAddress& prefix, void* row);
 
   quint64 m_luid = 0;
+  QString m_ifname;
   WindowsTunnelService m_tunnel;
   QPointer<WindowsRouteMonitor> m_routeMonitor;
   QPointer<WindowsFirewall> m_firewall;

client/ui/controllers/api/subscriptionUiController.cpp

@@ -418,7 +418,8 @@ bool SubscriptionUiController::updateServiceFromGateway(const QString &serverId,
 {
     bool isConnectEvent = newCountryCode.isEmpty() && newCountryName.isEmpty() && !reloadServiceConfig;
     bool wasSubscriptionExpired = false;
-    if (const auto oldApiV2 = m_serversController->apiV2Config(serverId)) {
+    const auto oldApiV2 = m_serversController->apiV2Config(serverId);
+    if (oldApiV2) {
         wasSubscriptionExpired = oldApiV2->apiConfig.subscriptionExpiredByServer
                 || oldApiV2->apiConfig.isSubscriptionExpired();
     }
@@ -426,6 +427,10 @@ bool SubscriptionUiController::updateServiceFromGateway(const QString &serverId,
     ErrorCode errorCode = m_subscriptionController->updateServiceFromGateway(serverId, newCountryCode, isConnectEvent);
 
     if (errorCode == ErrorCode::NoError) {
+        if (!newCountryCode.isEmpty() && oldApiV2) {
+            m_previousCountryServerId = serverId;
+            m_previousApiV2Config = oldApiV2;
+        }
         if (wasSubscriptionExpired) {
             emit subscriptionRefreshNeeded();
         }
@@ -447,6 +452,20 @@ bool SubscriptionUiController::updateServiceFromGateway(const QString &serverId,
     }
 }
 
+void SubscriptionUiController::revertLastCountryChange()
+{
+    if (m_previousCountryServerId.isEmpty() || !m_previousApiV2Config) {
+        return;
+    }
+    const QString serverId = m_previousCountryServerId;
+    const ApiV2ServerConfig cfg = *m_previousApiV2Config;
+    m_previousCountryServerId.clear();
+    m_previousApiV2Config.reset();
+
+    m_subscriptionController->restoreApiV2Config(serverId, cfg);
+    m_apiCountryModel->updateModel(cfg.apiConfig.availableCountries,
+                                   cfg.apiConfig.serverCountryCode);
+}
 
 bool SubscriptionUiController::deactivateDevice(const QString &serverId)
 {

client/ui/controllers/api/subscriptionUiController.h

@@ -50,6 +50,7 @@ public slots:
     bool importTrialFromGateway(const QString &email);
     bool updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, const QString &newCountryName,
                                   bool reloadServiceConfig = false);
+    void revertLastCountryChange();
     bool deactivateDevice(const QString &serverId);
     bool deactivateExternalDevice(const QString &serverId, const QString &uuid, const QString &serverCountryCode);
 
@@ -125,6 +126,9 @@ private:
     ApiDevicesModel* m_apiDevicesModel;
     SettingsController* m_settingsController;
     ConnectionController* m_connectionController;
+
+    QString m_previousCountryServerId;
+    std::optional<ApiV2ServerConfig> m_previousApiV2Config;
 };
 
 #endif // SUBSCRIPTIONUICONTROLLER_H

client/ui/controllers/connectionUiController.cpp

@@ -19,6 +19,7 @@ ConnectionUiController::ConnectionUiController(ConnectionController* connectionC
       m_serversController(serversController)
 {
     connect(m_connectionController, &ConnectionController::connectionStateChanged, this, &ConnectionUiController::onConnectionStateChanged);
+    connect(m_connectionController, &ConnectionController::serverSwitchFailed, this, &ConnectionUiController::serverSwitchFailed);
 
     connect(this, &ConnectionUiController::connectButtonClicked, this, &ConnectionUiController::toggleConnection, Qt::QueuedConnection);
 
@@ -65,6 +66,12 @@ void ConnectionUiController::onConnectionStateChanged(Vpn::ConnectionState state
         m_connectionStateText = tr("Connected");
         break;
     }
+    case Vpn::ConnectionState::Switching: {
+        m_isConnectionInProgress = true;
+        m_isConnected = true;
+        m_connectionStateText = tr("Switching...");
+        break;
+    }
     case Vpn::ConnectionState::Connecting: {
         m_isConnectionInProgress = true;
         break;

client/ui/controllers/connectionUiController.h

@@ -52,6 +52,7 @@ signals:
     void prepareConfig();
     void unsupportedConnectDrawerRequested();
     void noInstalledContainers();
+    void serverSwitchFailed();
 
 private:
     Vpn::ConnectionState getCurrentConnectionState();

client/ui/controllers/qml/pageController.cpp

@@ -128,11 +128,6 @@ void PageController::showOnStartup()
     }
 }
 
-bool PageController::shouldStartMinimized() const
-{
-    return m_settingsController->isStartMinimizedEnabled();
-}
-
 bool PageController::isTriggeredByConnectButton()
 {
     return m_isTriggeredByConnectButton;

client/ui/controllers/qml/pageController.h

@@ -123,7 +123,6 @@ public slots:
     void updateNavigationBarColor(const int color);
 
     void showOnStartup();
-    bool shouldStartMinimized() const;
 
     bool isTriggeredByConnectButton();
     void setTriggeredByConnectButton(bool trigger);

client/ui/controllers/selfhosted/exportUiController.cpp

@@ -9,13 +9,6 @@ ExportUiController::ExportUiController(ExportController* exportController, QObje
     : QObject(parent),
       m_exportController(exportController)
 {
-    connect(m_exportController, &ExportController::revokeFinished, this, [this](ErrorCode errorCode) {
-        if (errorCode == ErrorCode::NoError) {
-            emit revokeConfigFinished();
-        } else {
-            emit exportErrorOccurred(errorCode);
-        }
-    });
 }
 
 void ExportUiController::generateFullAccessConfig(const QString &serverId)
@@ -99,6 +92,7 @@ void ExportUiController::updateClientManagementModel(const QString &serverId, in
 void ExportUiController::revokeConfig(int row, const QString &serverId, int containerIndex)
 {
     m_exportController->revokeConfig(row, serverId, containerIndex);
+    emit revokeConfigFinished();
 }
 
 void ExportUiController::renameClient(int row, const QString &clientName, const QString &serverId, int containerIndex)

client/ui/controllers/selfhosted/installUiController.cpp

@@ -306,17 +306,14 @@ void InstallUiController::updateServerConfig(const QString &serverId, int contai
             || container == DockerContainer::Xray || container == DockerContainer::SSXray;
 
     if (asyncUpdate) {
-        const bool emitBusy = container == DockerContainer::MtProxy || container == DockerContainer::Telemt;
-        if (emitBusy)
-            emit serverIsBusy(true);
+        emit serverIsBusy(true);
         auto *watcher = new QFutureWatcher<ErrorCode>(this);
         const Proto protocolTypeCopy = protocolType;
         QObject::connect(watcher, &QFutureWatcher<ErrorCode>::finished, this,
-                         [this, watcher, serverId, container, closePage, protocolTypeCopy, emitBusy]() {
+                         [this, watcher, serverId, container, closePage, protocolTypeCopy]() {
                              const ErrorCode errorCode = watcher->result();
                              watcher->deleteLater();
-                             if (emitBusy)
-                                 emit serverIsBusy(false);
+                             emit serverIsBusy(false);
 
                              if (errorCode == ErrorCode::NoError) {
                                  const ContainerConfig updatedConfig =

client/ui/models/protocols/xrayConfigModel.cpp

@@ -4,10 +4,6 @@
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
-#include "core/utils/networkUtilities.h"
-
-#include <QHostAddress>
-#include <QRegularExpression>
 
 using namespace amnezia;
 using namespace ProtocolUtils;
@@ -276,7 +272,7 @@ void XrayConfigModel::updateModel(amnezia::DockerContainer container, const amne
     }
 
     if (!m_protocolConfig.serverConfig.isThirdPartyConfig) {
-        applyDefaultsToServerConfig(m_protocolConfig.serverConfig, false);
+        applyDefaultsToServerConfig(m_protocolConfig.serverConfig);
     }
 
     m_originalProtocolConfig = m_protocolConfig;
@@ -287,7 +283,7 @@ void XrayConfigModel::updateModel(amnezia::DockerContainer container, const amne
     }
 }
 
-void XrayConfigModel::applyDefaultsToServerConfig(amnezia::XrayServerConfig &config, bool fillFlowDefault)
+void XrayConfigModel::applyDefaultsToServerConfig(amnezia::XrayServerConfig &config)
 {
     if (config.port.isEmpty()) {
         config.port = protocols::xray::defaultPort;
@@ -310,7 +306,7 @@ void XrayConfigModel::applyDefaultsToServerConfig(amnezia::XrayServerConfig &con
         config.security = protocols::xray::defaultSecurity;
     }
 
-    if (fillFlowDefault && config.flow.isEmpty()) {
+    if (config.flow.isEmpty()) {
         config.flow = protocols::xray::defaultFlow;
     }
 
@@ -589,87 +585,3 @@ QString XrayConfigModel::mkcpDefaultWriteBufferSize()
 {
     return QString::fromLatin1(protocols::xray::defaultMkcpWriteBufferSize);
 }
-
-namespace {
-    bool isValidSingleHost(const QString &t)
-    {
-        if (t.isEmpty() || t.length() > 253) {
-            return false;
-        }
-        QHostAddress a(t);
-        if (a.protocol() == QHostAddress::IPv4Protocol) {
-            return NetworkUtilities::checkIPv4Format(t);
-        }
-        if (a.protocol() == QHostAddress::IPv6Protocol) {
-            return true;
-        }
-        static const QRegularExpression onlyDigits(QStringLiteral(R"(^\d+$)"));
-        if (onlyDigits.match(t).hasMatch()) {
-            return false;
-        }
-        QRegExp re = NetworkUtilities::domainRegExp();
-        re.setCaseSensitivity(Qt::CaseInsensitive);
-        return re.exactMatch(t);
-    }
-}
-
-bool XrayConfigModel::isValidHost(const QString &host)
-{
-    const QString t = host.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    return isValidSingleHost(t);
-}
-
-bool XrayConfigModel::isValidSni(const QString &sni)
-{
-    const QString t = sni.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    if (t.startsWith(QLatin1String("*."))) {
-        return isValidSingleHost(t.mid(2));
-    }
-    return isValidSingleHost(t);
-}
-
-bool XrayConfigModel::isValidPath(const QString &path)
-{
-    const QString t = path.trimmed();
-    if (t.isEmpty()) {
-        return true;
-    }
-    return t.startsWith(QLatin1Char('/'));
-}
-
-QStringList XrayConfigModel::validationErrors() const
-{
-    QStringList errs;
-    const auto &srv = m_protocolConfig.serverConfig;
-
-    if (!srv.port.isEmpty()) {
-        bool ok = false;
-        const int p = srv.port.toInt(&ok);
-        if (!ok || p < 1 || p > 65535) {
-            errs << tr("Port must be in the range of 1 to 65535");
-        }
-    }
-
-    if (srv.security == QLatin1String("tls") || srv.security == QLatin1String("reality")) {
-        if (!isValidSni(srv.sni)) {
-            errs << tr("SNI: enter a valid IP address or domain name");
-        }
-    }
-
-    if (srv.transport == QLatin1String("xhttp")) {
-        if (!isValidHost(srv.xhttp.host)) {
-            errs << tr("Host: enter a valid IP address or domain name");
-        }
-        if (!isValidPath(srv.xhttp.path)) {
-            errs << tr("Path must start with \"/\"");
-        }
-    }
-
-    return errs;
-}

client/ui/models/protocols/xrayConfigModel.h

@@ -118,11 +118,6 @@ public:
     Q_INVOKABLE static QString mkcpDefaultReadBufferSize();
     Q_INVOKABLE static QString mkcpDefaultWriteBufferSize();
 
-    Q_INVOKABLE static bool isValidHost(const QString &host);
-    Q_INVOKABLE static bool isValidSni(const QString &sni);
-    Q_INVOKABLE static bool isValidPath(const QString &path);
-    Q_INVOKABLE QStringList validationErrors() const;
-
 public slots:
     void updateModel(amnezia::DockerContainer container, const amnezia::XrayProtocolConfig& protocolConfig);
     amnezia::XrayProtocolConfig getProtocolConfig();
@@ -142,7 +137,7 @@ private:
     amnezia::XrayProtocolConfig m_protocolConfig;
     amnezia::XrayProtocolConfig m_originalProtocolConfig;
 
-    void applyDefaultsToServerConfig(amnezia::XrayServerConfig& config, bool fillFlowDefault = true);
+    void applyDefaultsToServerConfig(amnezia::XrayServerConfig& config);
 };
 
 #endif // XRAYCONFIGMODEL_H

client/ui/qml/Components/ServersListView.qml

@@ -74,19 +74,22 @@ ListViewType {
                         : AmneziaStyle.color.mutedGray
 
                     checked: index === root.selectedIndex
-                    checkable: !ConnectionController.isConnected
+                    checkable: !ConnectionController.isConnectionInProgress
 
                     ButtonGroup.group: serversRadioButtonGroup
 
                     onClicked: {
-                        if (ConnectionController.isConnected) {
-                            PageController.showNotificationMessage(qsTr("Unable change server while there is an active connection"))
+                        if (ConnectionController.isConnectionInProgress) {
+                            PageController.showNotificationMessage(qsTr("Unable to change server while connection is in progress"))
                             return
                         }
 
                         root.selectedIndex = index
-
                         ServersUiController.setDefaultServerAtIndex(index)
+
+                        if (ConnectionController.isConnected) {
+                            ConnectionController.openConnection()
+                        }
                     }
 
                     Keys.onEnterPressed: serverRadioButton.clicked()

client/ui/qml/Controls2/DropDownType.qml

@@ -42,7 +42,6 @@ Item {
     property int rootButtonTextBottomMargin: 16
 
     property real drawerHeight: 0.9
-    property bool fitContent: false
     property Item drawerParent
     property Component listView
 
@@ -220,20 +219,12 @@ Item {
         parent: drawerParent
 
         anchors.fill: parent
-        property real measuredContentHeight: 0
-        expandedHeight: (root.fitContent && measuredContentHeight > 0)
-            ? Math.min(measuredContentHeight, drawerParent.height * root.drawerHeight)
-            : drawerParent.height * root.drawerHeight
+        expandedHeight: drawerParent.height * drawerHeight
 
         expandedStateContent: Item {
             id: container
             implicitHeight: menu.expandedHeight
 
-            property real fitHeight: backButton.implicitHeight + titleLabel.implicitHeight
-                                     + (listViewLoader.item ? listViewLoader.item.contentHeight : 0) + 48
-            onFitHeightChanged: menu.measuredContentHeight = fitHeight
-            Component.onCompleted: menu.measuredContentHeight = fitHeight
-
             ColumnLayout {
                 id: header
 
@@ -247,7 +238,6 @@ Item {
                 }
 
                 Header2Type {
-                    id: titleLabel
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.bottomMargin: 16

client/ui/qml/Controls2/MinMaxRowType.qml

@@ -12,8 +12,8 @@ import "../Controls2/TextTypes"
 //   MinMaxRowType {
 //       minValue: "0"
 //       maxValue: "0"
-//       onMinChanged: function(val) { someProperty = val }
-//       onMaxChanged: function(val) { someProperty = val }
+//       onMinChanged: someProperty = val
+//       onMaxChanged: someProperty = val
 //   }
 Item {
     id: root
@@ -21,128 +21,41 @@ Item {
     property string minValue: "0"
     property string maxValue: "0"
 
-    property int minLimit: 0
-    property int maxLimit: 2147483647
-
-    property string hintText: root.minLimit > 0
-                              ? (root.minLimit + "–" + root.maxLimit)
-                              : ("≤ " + root.maxLimit)
-
     signal minChanged(string val)
     signal maxChanged(string val)
-    signal edited()
 
-    implicitHeight: col.implicitHeight
-    implicitWidth: col.implicitWidth
+    implicitHeight: row.implicitHeight
+    implicitWidth: row.implicitWidth
 
-    function clampValue(text) {
-        if (text === "")
-            return ""
-        var n = parseInt(text, 10)
-        if (isNaN(n))
-            return ""
-        if (n < root.minLimit)
-            n = root.minLimit
-        if (n > root.maxLimit)
-            n = root.maxLimit
-        return String(n)
-    }
-
-    function capEdit(tf, holder) {
-        if (tf.text !== "" && parseInt(tf.text, 10) > root.maxLimit) {
-            tf.text = holder.lastValid
-            tf.cursorPosition = tf.text.length
-        } else {
-            holder.lastValid = tf.text
-        }
-    }
-
-    ColumnLayout {
-        id: col
+    RowLayout {
+        id: row
         anchors.fill: parent
-        spacing: 4
+        spacing: 10
 
-        RowLayout {
-            id: row
+        // Min field
+        TextFieldWithHeaderType {
             Layout.fillWidth: true
-            spacing: 10
-
-            // Min field
-            TextFieldWithHeaderType {
-                id: minField
-                property string lastValid: ""
-                Layout.fillWidth: true
-                headerText: qsTr("Min")
-                textField.maximumLength: 10
-                textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                textField.onActiveFocusChanged: {
-                    if (minField.textField.activeFocus)
-                        minField.lastValid = minField.textField.text
-                }
-                textField.onTextEdited: { root.capEdit(minField.textField, minField); root.edited() }
-                textField.onEditingFinished: {
-                    var v = root.clampValue(minField.textField.text)
-                    if (v !== "" && root.maxValue !== "") {
-                        var mx = parseInt(root.maxValue, 10)
-                        if (!isNaN(mx) && parseInt(v, 10) > mx)
-                            root.maxChanged(v)
-                    }
-                    if (v !== root.minValue)
-                        root.minChanged(v)
-                    else if (minField.textField.text !== v)
-                        minField.textField.text = v
-                }
-
-                Binding {
-                    target: minField.textField
-                    property: "text"
-                    value: root.minValue
-                    when: !minField.textField.activeFocus
-                    restoreMode: Binding.RestoreNone
-                }
-            }
-
-            // Max field
-            TextFieldWithHeaderType {
-                id: maxField
-                property string lastValid: ""
-                Layout.fillWidth: true
-                headerText: qsTr("Max")
-                textField.maximumLength: 10
-                textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                textField.onActiveFocusChanged: {
-                    if (maxField.textField.activeFocus)
-                        maxField.lastValid = maxField.textField.text
-                }
-                textField.onTextEdited: { root.capEdit(maxField.textField, maxField); root.edited() }
-                textField.onEditingFinished: {
-                    var v = root.clampValue(maxField.textField.text)
-                    if (v !== "" && root.minValue !== "") {
-                        var mn = parseInt(root.minValue, 10)
-                        if (!isNaN(mn) && parseInt(v, 10) < mn)
-                            v = String(mn)
-                    }
-                    if (v !== root.maxValue)
-                        root.maxChanged(v)
-                    else if (maxField.textField.text !== v)
-                        maxField.textField.text = v
-                }
-
-                Binding {
-                    target: maxField.textField
-                    property: "text"
-                    value: root.maxValue
-                    when: !maxField.textField.activeFocus
-                    restoreMode: Binding.RestoreNone
+            headerText: qsTr("Min")
+            textField.text: root.minValue
+            textField.validator: IntValidator { bottom: 0 }
+            textField.onEditingFinished: {
+                if (textField.text !== root.minValue) {
+                    root.minChanged(textField.text)
                 }
             }
         }
 
-        SmallTextType {
-            visible: root.hintText !== ""
-            text: root.hintText
-            color: AmneziaStyle.color.mutedGray
+        // Max field
+        TextFieldWithHeaderType {
             Layout.fillWidth: true
+            headerText: qsTr("Max")
+            textField.text: root.maxValue
+            textField.validator: IntValidator { bottom: 0 }
+            textField.onEditingFinished: {
+                if (textField.text !== root.maxValue) {
+                    root.maxChanged(textField.text)
+                }
+            }
         }
     }
 }

client/ui/qml/Pages2/PageProtocolXraySecuritySettings.qml

@@ -15,8 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -92,7 +90,6 @@ PageType {
 
                 DropDownType {
                     id: tlsAlpnDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 16
                     Layout.leftMargin: 16
@@ -136,7 +133,6 @@ PageType {
 
                 DropDownType {
                     id: tlsFingerprintDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -179,21 +175,14 @@ PageType {
                 }
 
                 TextFieldWithHeaderType {
-                    id: sniFieldTls
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Server Name (SNI)")
                     textField.text: sni
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9.*_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== sni)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== sni) sni = v
-                        else if (textField.text !== v) textField.text = v
-                        sniFieldTls.errorText = XrayConfigModel.isValidSni(v) ? "" : qsTr("Enter a valid IP address or domain name")
-                        root.editDirty = false
+                        if (textField.text !== sni) sni = textField.text
                     }
                 }
             }
@@ -206,7 +195,6 @@ PageType {
 
                 DropDownType {
                     id: realityFingerprintDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 16
                     Layout.leftMargin: 16
@@ -249,21 +237,14 @@ PageType {
                 }
 
                 TextFieldWithHeaderType {
-                    id: sniFieldReality
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Server Name (SNI)")
                     textField.text: sni
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9.*_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== sni)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== sni) sni = v
-                        else if (textField.text !== v) textField.text = v
-                        sniFieldReality.errorText = XrayConfigModel.isValidSni(v) ? "" : qsTr("Enter a valid IP address or domain name")
-                        root.editDirty = false
+                        if (textField.text !== sni) sni = textField.text
                     }
                 }
             }
@@ -284,15 +265,10 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {
-            var errs = XrayConfigModel.validationErrors()
-            if (errs.length > 0) {
-                PageController.showErrorMessage(errs.join("\n"))
-                return
-            }
             var headerText = qsTr("Save settings?")
             var descriptionText = qsTr("All users with whom you shared a connection with will no longer be able to connect to it.")
             var yesButtonText = qsTr("Continue")

client/ui/qml/Pages2/PageProtocolXraySettings.qml

@@ -109,7 +109,6 @@ PageType {
                 Layout.rightMargin: 16
                 enabled: listView.enabled
                 headerText: qsTr("Port")
-                subtitleText: qsTr("1–65535")
 
                 Binding {
                     target: textFieldWithHeaderType.textField
@@ -120,8 +119,8 @@ PageType {
                 }
 
                 textField.maximumLength: 5
-                textField.validator: RegularExpressionValidator {
-                    regularExpression: /^(|\d{1,4}|[1-5]\d{4}|6[0-4]\d{3}|65[0-4]\d{2}|655[0-2]\d|6553[0-5])$/
+                textField.validator: IntValidator {
+                    bottom: 1; top: 65535
                 }
                 textField.onActiveFocusChanged: {
                     if (textField.activeFocus && textField.text === "" && port !== "") {
@@ -132,19 +131,9 @@ PageType {
                     root.portDirty = (textField.text !== port)
                 }
                 textField.onEditingFinished: {
-                    var v = textFieldWithHeaderType.textField.text
-                    if (v !== "") {
-                        var n = parseInt(v, 10)
-                        if (isNaN(n) || n < 1)
-                            n = 1
-                        if (n > 65535)
-                            n = 65535
-                        v = String(n)
-                        if (textFieldWithHeaderType.textField.text !== v)
-                            textFieldWithHeaderType.textField.text = v
+                    if (textField.text !== port) {
+                        port = textField.text
                     }
-                    if (v !== port)
-                        port = v
                     root.portDirty = false
                 }
                 checkEmptyText: true
@@ -209,11 +198,6 @@ PageType {
                 text: qsTr("Save")
                 onClicked: function() {
                     forceActiveFocus()
-                    var errs = XrayConfigModel.validationErrors()
-                    if (errs.length > 0) {
-                        PageController.showErrorMessage(errs.join("\n"))
-                        return
-                    }
                     var headerText = qsTr("Save settings?")
                     var descriptionText = qsTr("All users with whom you shared a connection with will no longer be able to connect to it.")
                     var yesButtonText = qsTr("Continue")

client/ui/qml/Pages2/PageProtocolXrayTransportSettings.qml

@@ -15,21 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
-    function clampInt(text, lo, hi) {
-        if (text === "")
-            return ""
-        var n = parseInt(text, 10)
-        if (isNaN(n))
-            return ""
-        if (n < lo)
-            n = lo
-        if (n > hi)
-            n = hi
-        return String(n)
-    }
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -123,16 +108,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("TTI")
-                    subtitleText: qsTr("Range 10–100, default %1 ms", "mKCP TTI").arg(XrayConfigModel.mkcpDefaultTti())
+                    subtitleText: qsTr("Default: %1 ms", "mKCP TTI").arg(XrayConfigModel.mkcpDefaultTti())
                     textField.text: mkcpTti
-                    textField.maximumLength: 3
-                    textField.validator: RegularExpressionValidator { regularExpression: /^(|\d{1,2}|100)$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpTti)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 10, 100)
-                        if (v !== mkcpTti) mkcpTti = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpTti) mkcpTti = textField.text
                     }
                 }
 
@@ -142,16 +121,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("uplinkCapacity")
-                    subtitleText: qsTr("≥ 0, default %1 MB/s", "mKCP uplink").arg(XrayConfigModel.mkcpDefaultUplinkCapacity())
+                    subtitleText: qsTr("Default: %1 Mbit/s", "mKCP uplink").arg(XrayConfigModel.mkcpDefaultUplinkCapacity())
                     textField.text: mkcpUplinkCapacity
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpUplinkCapacity)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== mkcpUplinkCapacity) mkcpUplinkCapacity = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpUplinkCapacity) mkcpUplinkCapacity = textField.text
                     }
                 }
 
@@ -161,16 +134,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("downlinkCapacity")
-                    subtitleText: qsTr("≥ 0, default %1 MB/s", "mKCP downlink").arg(XrayConfigModel.mkcpDefaultDownlinkCapacity())
+                    subtitleText: qsTr("Default: %1 Mbit/s", "mKCP downlink").arg(XrayConfigModel.mkcpDefaultDownlinkCapacity())
                     textField.text: mkcpDownlinkCapacity
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpDownlinkCapacity)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== mkcpDownlinkCapacity) mkcpDownlinkCapacity = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpDownlinkCapacity) mkcpDownlinkCapacity = textField.text
                     }
                 }
 
@@ -180,16 +147,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("readBufferSize")
-                    subtitleText: qsTr("≥ 1, default %1 MB").arg(XrayConfigModel.mkcpDefaultReadBufferSize())
+                    subtitleText: qsTr("Default: %1 MiB").arg(XrayConfigModel.mkcpDefaultReadBufferSize())
                     textField.text: mkcpReadBufferSize
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpReadBufferSize)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 1, 2147483647)
-                        if (v !== mkcpReadBufferSize) mkcpReadBufferSize = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpReadBufferSize) mkcpReadBufferSize = textField.text
                     }
                 }
 
@@ -199,16 +160,10 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("writeBufferSize")
-                    subtitleText: qsTr("≥ 1, default %1 MB").arg(XrayConfigModel.mkcpDefaultWriteBufferSize())
+                    subtitleText: qsTr("Default: %1 MiB").arg(XrayConfigModel.mkcpDefaultWriteBufferSize())
                     textField.text: mkcpWriteBufferSize
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== mkcpWriteBufferSize)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 1, 2147483647)
-                        if (v !== mkcpWriteBufferSize) mkcpWriteBufferSize = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== mkcpWriteBufferSize) mkcpWriteBufferSize = textField.text
                     }
                 }
 
@@ -232,7 +187,6 @@ PageType {
 
                 DropDownType {
                     id: modeDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 16
                     Layout.leftMargin: 16
@@ -285,46 +239,31 @@ PageType {
                 }
 
                 TextFieldWithHeaderType {
-                    id: hostField
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Host")
                     textField.text: xhttpHost
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9._:,-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpHost)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpHost) xhttpHost = v
-                        else if (textField.text !== v) textField.text = v
-                        hostField.errorText = XrayConfigModel.isValidHost(v) ? "" : qsTr("Enter a valid IP address or domain name")
-                        root.editDirty = false
+                        if (textField.text !== xhttpHost) xhttpHost = textField.text
                     }
                 }
 
                 TextFieldWithHeaderType {
-                    id: pathField
                     Layout.fillWidth: true
                     Layout.leftMargin: 16
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("Path")
                     textField.text: xhttpPath
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9\-._~:\/?#\[\]@!$&'()*+,;=%]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpPath)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpPath) xhttpPath = v
-                        else if (textField.text !== v) textField.text = v
-                        pathField.errorText = XrayConfigModel.isValidPath(v) ? "" : qsTr("Path must start with \"/\"")
-                        root.editDirty = false
+                        if (textField.text !== xhttpPath) xhttpPath = textField.text
                     }
                 }
 
                 DropDownType {
                     id: headersDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -368,7 +307,6 @@ PageType {
 
                 DropDownType {
                     id: uplinkMethodDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -448,7 +386,6 @@ PageType {
 
                 DropDownType {
                     id: sessionPlacementDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -492,7 +429,6 @@ PageType {
 
                 DropDownType {
                     id: sessionKeyDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -536,7 +472,6 @@ PageType {
 
                 DropDownType {
                     id: seqPlacementDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -585,19 +520,13 @@ PageType {
                     Layout.topMargin: 8
                     headerText: qsTr("SeqKey")
                     textField.text: xhttpSeqKey
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpSeqKey)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpSeqKey) xhttpSeqKey = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpSeqKey) xhttpSeqKey = textField.text
                     }
                 }
 
                 DropDownType {
                     id: uplinkDataPlacementDropDown
-                    fitContent: true
                     Layout.fillWidth: true
                     Layout.topMargin: 8
                     Layout.leftMargin: 16
@@ -646,13 +575,8 @@ PageType {
                     Layout.topMargin: 8
                     headerText: qsTr("UplinkDataKey")
                     textField.text: xhttpUplinkDataKey
-                    textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpUplinkDataKey)
                     textField.onEditingFinished: {
-                        var v = textField.text.trim()
-                        if (v !== xhttpUplinkDataKey) xhttpUplinkDataKey = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpUplinkDataKey) xhttpUplinkDataKey = textField.text
                     }
                 }
 
@@ -673,16 +597,12 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("UplinkChunkSize")
-                    subtitleText: qsTr("≥ 0 (0 = off)")
                     textField.text: xhttpUplinkChunkSize
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpUplinkChunkSize)
+                    textField.validator: IntValidator {
+                        bottom: 0
+                    }
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== xhttpUplinkChunkSize) xhttpUplinkChunkSize = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpUplinkChunkSize) xhttpUplinkChunkSize = textField.text
                     }
                 }
 
@@ -692,16 +612,9 @@ PageType {
                     Layout.rightMargin: 16
                     Layout.topMargin: 8
                     headerText: qsTr("scMaxBufferedPosts")
-                    subtitleText: qsTr("≥ 0")
                     textField.text: xhttpScMaxBufferedPosts
-                    textField.maximumLength: 10
-                    textField.validator: RegularExpressionValidator { regularExpression: /^\d*$/ }
-                    textField.onTextEdited: root.editDirty = (textField.text !== xhttpScMaxBufferedPosts)
                     textField.onEditingFinished: {
-                        var v = root.clampInt(textField.text, 0, 2147483647)
-                        if (v !== xhttpScMaxBufferedPosts) xhttpScMaxBufferedPosts = v
-                        else if (textField.text !== v) textField.text = v
-                        root.editDirty = false
+                        if (textField.text !== xhttpScMaxBufferedPosts) xhttpScMaxBufferedPosts = textField.text
                     }
                 }
 
@@ -720,9 +633,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xhttpScMaxEachPostBytesMin
                     maxValue: xhttpScMaxEachPostBytesMax
-                    onMinChanged: function(val) { xhttpScMaxEachPostBytesMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xhttpScMaxEachPostBytesMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xhttpScMaxEachPostBytesMin = val
+                    onMaxChanged: xhttpScMaxEachPostBytesMax = val
                 }
 
                 CaptionTextType {
@@ -740,9 +652,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xhttpScStreamUpServerSecsMin
                     maxValue: xhttpScStreamUpServerSecsMax
-                    onMinChanged: function(val) { xhttpScStreamUpServerSecsMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xhttpScStreamUpServerSecsMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xhttpScStreamUpServerSecsMin = val
+                    onMaxChanged: xhttpScStreamUpServerSecsMax = val
                 }
 
                 CaptionTextType {
@@ -760,9 +671,8 @@ PageType {
                     Layout.rightMargin: 16
                     minValue: xhttpScMinPostsIntervalMsMin
                     maxValue: xhttpScMinPostsIntervalMsMax
-                    onMinChanged: function(val) { xhttpScMinPostsIntervalMsMin = val; root.editDirty = false }
-                    onMaxChanged: function(val) { xhttpScMinPostsIntervalMsMax = val; root.editDirty = false }
-                    onEdited: root.editDirty = true
+                    onMinChanged: xhttpScMinPostsIntervalMsMin = val
+                    onMaxChanged: xhttpScMinPostsIntervalMsMax = val
                 }
 
                 // ── Padding and multiplexing ──────────────────────────
@@ -818,15 +728,10 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {
-            var errs = XrayConfigModel.validationErrors()
-            if (errs.length > 0) {
-                PageController.showErrorMessage(errs.join("\n"))
-                return
-            }
             var headerText = qsTr("Save settings?")
             var descriptionText = qsTr("All users with whom you shared a connection with will no longer be able to connect to it.")
             var yesButtonText = qsTr("Continue")

client/ui/qml/Pages2/PageProtocolXrayXPaddingBytesSettings.qml

@@ -15,8 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -63,9 +61,8 @@ PageType {
                 Layout.rightMargin: 16
                 minValue: xPaddingBytesMin
                 maxValue: xPaddingBytesMax
-                onMinChanged: function(val) { xPaddingBytesMin = val; root.editDirty = false }
-                onMaxChanged: function(val) { xPaddingBytesMax = val; root.editDirty = false }
-                onEdited: root.editDirty = true
+                onMinChanged: xPaddingBytesMin = val
+                onMaxChanged: xPaddingBytesMax = val
             }
 
             Item {
@@ -84,7 +81,7 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {

client/ui/qml/Pages2/PageProtocolXrayXPaddingSettings.qml

@@ -15,8 +15,6 @@ import "../Components"
 PageType {
     id: root
 
-    property bool editDirty: false
-
     BackButtonType {
         id: backButton
         anchors.top: parent.top
@@ -80,13 +78,8 @@ PageType {
                 Layout.topMargin: 16
                 headerText: qsTr("xPaddingKey")
                 textField.text: xPaddingKey
-                textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                textField.onTextEdited: root.editDirty = (textField.text !== xPaddingKey)
                 textField.onEditingFinished: {
-                    var v = textField.text.trim()
-                    if (v !== xPaddingKey) xPaddingKey = v
-                    else if (textField.text !== v) textField.text = v
-                    root.editDirty = false
+                    if (textField.text !== xPaddingKey) xPaddingKey = textField.text
                 }
             }
 
@@ -97,19 +90,13 @@ PageType {
                 Layout.topMargin: 8
                 headerText: qsTr("xPaddingHeader")
                 textField.text: xPaddingHeader
-                textField.validator: RegularExpressionValidator { regularExpression: /^[A-Za-z0-9_-]*$/ }
-                textField.onTextEdited: root.editDirty = (textField.text !== xPaddingHeader)
                 textField.onEditingFinished: {
-                    var v = textField.text.trim()
-                    if (v !== xPaddingHeader) xPaddingHeader = v
-                    else if (textField.text !== v) textField.text = v
-                    root.editDirty = false
+                    if (textField.text !== xPaddingHeader) xPaddingHeader = textField.text
                 }
             }
 
             DropDownType {
                 id: placementDropDown
-                fitContent: true
                 Layout.fillWidth: true
                 Layout.topMargin: 8
                 Layout.leftMargin: 16
@@ -153,7 +140,6 @@ PageType {
 
             DropDownType {
                 id: methodDropDown
-                fitContent: true
                 Layout.fillWidth: true
                 Layout.topMargin: 8
                 Layout.leftMargin: 16
@@ -211,7 +197,7 @@ PageType {
         anchors.rightMargin: 16
         anchors.bottomMargin: 16 + PageController.safeAreaBottomMargin
 
-        visible: listView.enabled && (XrayConfigModel.hasUnsavedChanges || root.editDirty)
+        visible: listView.enabled && XrayConfigModel.hasUnsavedChanges
         enabled: visible
         text: qsTr("Save")
         clickedFunc: function () {