cleanup

.github/workflows/deploy.yml

@@ -10,10 +10,10 @@ env:
 
 jobs:
   Build-Linux-Ubuntu:
-    runs-on: android-runner
+    runs-on: 4-core
 
     env:
-      QT_VERSION: 6.10.1
+      QT_VERSION: 6.8.3
       QIF_VERSION: 4.7
       PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
       PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
@@ -58,7 +58,7 @@ jobs:
 
     - name: 'Build project'
       run: |
-        sudo apt-get install libxkbcommon-x11-0 libsecret-1-dev
+        sudo apt-get install libxkbcommon-x11-0
         export QT_BIN_DIR=${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/gcc_64/bin
         export QIF_BIN_DIR=${{ runner.temp }}/Qt/Tools/QtInstallerFramework/${{ env.QIF_VERSION }}/bin
         bash deploy/build_linux.sh
@@ -537,7 +537,7 @@ jobs:
 # ------------------------------------------------------
 
   Build-Android:
-    runs-on: android-runner
+    runs-on: 4-core
 
     env:
       ANDROID_BUILD_PLATFORM: android-36
@@ -660,57 +660,15 @@ jobs:
         ANDROID_KEYSTORE_KEY_ALIAS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_ALIAS }}
         ANDROID_KEYSTORE_KEY_PASS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_PASS }}
       shell: bash
-      run: ./deploy/build_android.sh --aab --play --apk all --build-platform ${{ env.ANDROID_BUILD_PLATFORM }}
-
-    - name: 'Build OSS AAB (in-app purchase)'
-      env:
-        ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
-        QT_HOST_PATH: ${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/gcc_64
-        ANDROID_KEYSTORE_PATH: ${{ github.workspace }}/android.keystore
-        ANDROID_KEYSTORE_KEY_ALIAS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_ALIAS }}
-        ANDROID_KEYSTORE_KEY_PASS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_PASS }}
-      shell: bash
-      run: ./deploy/build_android.sh --aab --build-platform ${{ env.ANDROID_BUILD_PLATFORM }}
-
-    - name: 'Upload OSS x86_64 apk'
-      uses: actions/upload-artifact@v4
-      with:
-        name: AmneziaVPN-android-x86_64
-        path: deploy/build/AmneziaVPN-oss-x86_64-release.apk
-        compression-level: 0
-        retention-days: 7
-
-    - name: 'Upload OSS x86 apk'
-      uses: actions/upload-artifact@v4
-      with:
-        name: AmneziaVPN-android-x86
-        path: deploy/build/AmneziaVPN-oss-x86-release.apk
-        compression-level: 0
-        retention-days: 7
-
-    - name: 'Upload OSS arm64-v8a apk'
-      uses: actions/upload-artifact@v4
-      with:
-        name: AmneziaVPN-android-arm64-v8a
-        path: deploy/build/AmneziaVPN-oss-arm64-v8a-release.apk
-        compression-level: 0
-        retention-days: 7
-
-    - name: 'Upload OSS armeabi-v7a apk'
-      uses: actions/upload-artifact@v4
-      with:
-        name: AmneziaVPN-android-armeabi-v7a
-        path: deploy/build/AmneziaVPN-oss-armeabi-v7a-release.apk
-        compression-level: 0
-        retention-days: 7
+      run: ./deploy/build_android.sh --aab --apk all --build-platform ${{ env.ANDROID_BUILD_PLATFORM }}
 
     - name: 'Rename Android APKs'
       run: |
         cd deploy/build
-        mv AmneziaVPN-oss-x86_64-release.apk AmneziaVPN_${VERSION}_android9+_x86_64.apk
-        mv AmneziaVPN-oss-x86-release.apk AmneziaVPN_${VERSION}_android9+_x86.apk
-        mv AmneziaVPN-oss-arm64-v8a-release.apk AmneziaVPN_${VERSION}_android9+_arm64-v8a.apk
-        mv AmneziaVPN-oss-armeabi-v7a-release.apk AmneziaVPN_${VERSION}_android9+_armeabi-v7a.apk
+        mv AmneziaVPN-x86_64-release.apk AmneziaVPN_${VERSION}_android9+_x86_64.apk
+        mv AmneziaVPN-x86-release.apk AmneziaVPN_${VERSION}_android9+_x86.apk
+        mv AmneziaVPN-arm64-v8a-release.apk AmneziaVPN_${VERSION}_android9+_arm64-v8a.apk
+        mv AmneziaVPN-armeabi-v7a-release.apk AmneziaVPN_${VERSION}_android9+_armeabi-v7a.apk
         cd ../..
 
     - name: 'Upload x86_64 apk'
@@ -745,19 +703,11 @@ jobs:
         compression-level: 0
         retention-days: 7
 
-    - name: 'Upload Play AAB'
+    - name: 'Upload aab'
       uses: actions/upload-artifact@v4
       with:
         name: AmneziaVPN-android
-        path: deploy/build/AmneziaVPN-play-release.aab
-        compression-level: 0
-        retention-days: 7
-
-    - name: 'Upload OSS AAB (in-app purchase)'
-      uses: actions/upload-artifact@v4
-      with:
-        name: AmneziaVPN-android-oss-aab
-        path: deploy/build/AmneziaVPN-oss-release.aab
+        path: deploy/build/AmneziaVPN-release.aab
         compression-level: 0
         retention-days: 7
 

.github/workflows/tag-upload.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Verify git tag
         run: |
           TAG_NAME=${{ inputs.RELEASE_VERSION }}
-          CMAKE_TAG=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/')
+          CMAKE_TAG=$(grep 'project.*VERSION' CMakeLists.txt | sed -E 's/.* ([0-9]+.[0-9]+.[0-9]+.[0-9]+)$/\1/')
           if [[ "$TAG_NAME" == "$CMAKE_TAG" ]]; then
             echo "Git tag ($TAG_NAME) matches CMakeLists.txt version ($CMAKE_TAG)."
           else

.gitignore

@@ -1,5 +1,9 @@
 # User settings
 *.user
+
+# Gateway configs (contains sensitive endpoints)
+gateway.json
+client/gateway.json
 macOSPackage/
 AmneziaVPN.dmg
 AmneziaVPN.exe
@@ -140,6 +144,3 @@ ios-ne-build.sh
 macos-ne-build.sh
 macos-signed-build.sh
 macos-with-sign-build.sh
-DeveloperIdApplicationCertificate.p12
-DeveloperIdInstallerCertificate.p12
-

.gitmodules

@@ -14,7 +14,3 @@
 [submodule "client/3rd/QSimpleCrypto"]
 	path = client/3rd/QSimpleCrypto
 	url = https://github.com/amnezia-vpn/QSimpleCrypto.git
-[submodule "client/3rd/qtgamepad"]
-	path = client/3rd/qtgamepad
-	url = https://github.com/amnezia-vpn/qtgamepad.git
-	branch = 6.6

CMakeLists.txt

@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)
 
 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 4.8.13.1)
+set(AMNEZIAVPN_VERSION 4.8.12.8)
 
 project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION}
         DESCRIPTION "AmneziaVPN"
@@ -12,9 +12,7 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")
 
 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-
-set(APP_ANDROID_VERSION_CODE 2107)
-
+set(APP_ANDROID_VERSION_CODE 2104)
 
 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
     set(MZ_PLATFORM_NAME "linux")
@@ -63,7 +61,6 @@ if(WIN32 AND NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
     set(CPACK_PACKAGE_VENDOR "AmneziaVPN")
     set(CPACK_PACKAGE_VERSION ${AMNEZIAVPN_VERSION})
     set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "AmneziaVPN client")
-    set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_SOURCE_DIR}/LICENSE")
     set(CPACK_PACKAGE_INSTALL_DIRECTORY "AmneziaVPN")
     set(CPACK_PACKAGE_DIRECTORY "${CMAKE_BINARY_DIR}")
     set(CPACK_PACKAGE_EXECUTABLES "AmneziaVPN" "AmneziaVPN")

client/CMakeLists.txt

@@ -33,6 +33,21 @@ add_definitions(-DDEV_S3_ENDPOINT="$ENV{DEV_S3_ENDPOINT}")
 add_definitions(-DFREE_V2_ENDPOINT="$ENV{FREE_V2_ENDPOINT}")
 add_definitions(-DPREM_V1_ENDPOINT="$ENV{PREM_V1_ENDPOINT}")
 
+add_definitions(-DAGW_DNS_SERVER="$ENV{AGW_DNS_SERVER}")
+add_definitions(-DAGW_DNS_DOMAIN="$ENV{AGW_DNS_DOMAIN}")
+add_definitions(-DAGW_DNS_PRIMARY="$ENV{AGW_DNS_PRIMARY}")
+add_definitions(-DAGW_DNS_PORT_UDP="$ENV{AGW_DNS_PORT_UDP}")
+add_definitions(-DAGW_DNS_PORT_DOT="$ENV{AGW_DNS_PORT_DOT}")
+add_definitions(-DAGW_DNS_PORT_DOH="$ENV{AGW_DNS_PORT_DOH}")
+add_definitions(-DAGW_DNS_PORT_DOQ="$ENV{AGW_DNS_PORT_DOQ}")
+add_definitions(-DAGW_DNS_DOH_PATH="$ENV{AGW_DNS_DOH_PATH}")
+add_definitions(-DAGW_DNS_RETRY_COUNT="$ENV{AGW_DNS_RETRY_COUNT}")
+add_definitions(-DAGW_DNS_TIMEOUT_MS="$ENV{AGW_DNS_TIMEOUT_MS}")
+
+if(DEFINED ENV{AGW_INSECURE_SSL} AND NOT "$ENV{AGW_INSECURE_SSL}" STREQUAL "" AND NOT "$ENV{AGW_INSECURE_SSL}" STREQUAL "0")
+    add_definitions(-DAGW_INSECURE_SSL=1)
+endif()
+
 if(WIN32 OR (APPLE AND NOT IOS) OR (LINUX AND NOT ANDROID))
     set(PACKAGES ${PACKAGES} Widgets)
 endif()
@@ -59,6 +74,7 @@ target_include_directories(${PROJECT} PUBLIC
 if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
     qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_interface.rep)
     qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_interface.rep)
+    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_tun2socks.rep)
 endif()
 
 qt6_add_resources(QRC ${QRC} ${CMAKE_CURRENT_LIST_DIR}/resources.qrc)
@@ -227,13 +243,10 @@ if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
 endif()
 
 target_sources(${PROJECT} PRIVATE ${SOURCES} ${HEADERS} ${RESOURCES} ${QRC} ${I18NQRC})
+qt_finalize_target(${PROJECT})
 
-# Finalize the executable so Qt can gather/deploy QML modules and plugins correctly (Android needs this).
-if(COMMAND qt_import_qml_plugins)
-    qt_import_qml_plugins(${PROJECT})
-endif()
-if(COMMAND qt_finalize_executable)
-    qt_finalize_executable(${PROJECT})
-else()
-    qt_finalize_target(${PROJECT})
+option(BUILD_TESTS "Build transport integration tests" OFF)
+if(BUILD_TESTS)
+    enable_testing()
+    add_subdirectory(tests)
 endif()

client/android/billing/build.gradle.kts

@@ -1,19 +0,0 @@
-plugins {
-    id(libs.plugins.android.library.get().pluginId)
-    id(libs.plugins.kotlin.android.get().pluginId)
-}
-
-kotlin {
-    jvmToolchain(17)
-}
-
-android {
-    namespace = "org.amnezia.vpn.billing"
-}
-
-dependencies {
-    compileOnly(project(":utils"))
-    implementation(libs.androidx.core)
-    implementation(libs.kotlinx.coroutines)
-    implementation(libs.android.billing)
-}

client/android/billing/src/main/kotlin/BillingException.kt

@@ -1,65 +0,0 @@
-import com.android.billingclient.api.BillingClient.BillingResponseCode.BILLING_UNAVAILABLE
-import com.android.billingclient.api.BillingClient.BillingResponseCode.DEVELOPER_ERROR
-import com.android.billingclient.api.BillingClient.BillingResponseCode.ERROR
-import com.android.billingclient.api.BillingClient.BillingResponseCode.FEATURE_NOT_SUPPORTED
-import com.android.billingclient.api.BillingClient.BillingResponseCode.ITEM_ALREADY_OWNED
-import com.android.billingclient.api.BillingClient.BillingResponseCode.ITEM_NOT_OWNED
-import com.android.billingclient.api.BillingClient.BillingResponseCode.ITEM_UNAVAILABLE
-import com.android.billingclient.api.BillingClient.BillingResponseCode.NETWORK_ERROR
-import com.android.billingclient.api.BillingClient.BillingResponseCode.SERVICE_DISCONNECTED
-import com.android.billingclient.api.BillingClient.BillingResponseCode.SERVICE_UNAVAILABLE
-import com.android.billingclient.api.BillingClient.BillingResponseCode.USER_CANCELED
-import com.android.billingclient.api.BillingResult
-import org.amnezia.vpn.util.ErrorCode
-
-internal class BillingException(
-    billingResult: BillingResult,
-    retryable: Boolean = false
-) : Exception(billingResult.toString()) {
-
-    constructor(msg: String) : this(BillingResult.newBuilder()
-        .setResponseCode(DEVELOPER_ERROR)
-        .setDebugMessage(msg)
-        .build())
-
-    val errorCode: Int
-    val isCanceled = billingResult.responseCode == USER_CANCELED
-    val isRetryable = retryable || billingResult.responseCode in setOf(
-        NETWORK_ERROR,
-        SERVICE_DISCONNECTED,
-        SERVICE_UNAVAILABLE,
-        ERROR
-    )
-
-    init {
-        when (billingResult.responseCode) {
-            ERROR -> {
-                errorCode = ErrorCode.BillingGooglePlayError
-            }
-
-            BILLING_UNAVAILABLE, SERVICE_DISCONNECTED, SERVICE_UNAVAILABLE -> {
-                errorCode = ErrorCode.BillingUnavailable
-            }
-
-            DEVELOPER_ERROR, FEATURE_NOT_SUPPORTED, ITEM_NOT_OWNED -> {
-                errorCode = ErrorCode.BillingError
-            }
-
-            ITEM_ALREADY_OWNED -> {
-                errorCode = ErrorCode.SubscriptionAlreadyOwned
-            }
-
-            ITEM_UNAVAILABLE -> {
-                errorCode = ErrorCode.SubscriptionUnavailable
-            }
-
-            NETWORK_ERROR -> {
-                errorCode = ErrorCode.BillingNetworkError
-            }
-
-            else -> {
-                errorCode = ErrorCode.BillingError
-            }
-        }
-    }
-}

client/android/billing/src/main/kotlin/BillingProvider.kt

@@ -1,320 +0,0 @@
-import android.app.Activity
-import android.content.Context
-import com.android.billingclient.api.AcknowledgePurchaseParams
-import com.android.billingclient.api.BillingClient
-import com.android.billingclient.api.BillingClient.BillingResponseCode
-import com.android.billingclient.api.BillingClient.ProductType
-import com.android.billingclient.api.BillingClientStateListener
-import com.android.billingclient.api.BillingFlowParams
-import com.android.billingclient.api.BillingFlowParams.SubscriptionUpdateParams.ReplacementMode
-import com.android.billingclient.api.BillingResult
-import com.android.billingclient.api.GetBillingConfigParams
-import com.android.billingclient.api.PendingPurchasesParams
-import com.android.billingclient.api.ProductDetails
-import com.android.billingclient.api.Purchase
-import com.android.billingclient.api.PurchasesUpdatedListener
-import com.android.billingclient.api.QueryProductDetailsParams
-import com.android.billingclient.api.QueryProductDetailsParams.Product
-import com.android.billingclient.api.QueryPurchasesParams
-import com.android.billingclient.api.acknowledgePurchase
-import com.android.billingclient.api.queryProductDetails
-import com.android.billingclient.api.queryPurchasesAsync
-import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.CompletableDeferred
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.firstOrNull
-import kotlinx.coroutines.withContext
-import org.amnezia.vpn.util.ErrorCode
-import org.amnezia.vpn.util.Log
-import org.json.JSONArray
-import org.json.JSONObject
-
-private const val TAG = "BillingProvider"
-private const val PRODUCT_ID = "premium"
-
-class BillingProvider(context: Context) : AutoCloseable {
-
-    private var billingClient: BillingClient
-    private var subscriptionPurchases = MutableStateFlow<Pair<BillingResult, List<Purchase>?>?>(null)
-
-    private val purchasesUpdatedListeners = PurchasesUpdatedListener { billingResult, purchases ->
-        Log.v(TAG, "Purchases updated: $billingResult")
-        subscriptionPurchases.value = billingResult to purchases
-    }
-
-    init {
-        billingClient = BillingClient.newBuilder(context)
-            .setListener(purchasesUpdatedListeners)
-            .enablePendingPurchases(PendingPurchasesParams.newBuilder().enableOneTimeProducts().build())
-            .build()
-    }
-
-    private suspend fun connect() {
-        if (billingClient.isReady) return
-
-        Log.v(TAG, "Billing client connection")
-        val connection = CompletableDeferred<Unit>()
-        withContext(Dispatchers.IO) {
-            billingClient.startConnection(object : BillingClientStateListener {
-                override fun onBillingSetupFinished(billingResult: BillingResult) {
-                    Log.v(TAG, "Billing setup finished: $billingResult")
-                    if (billingResult.isOk) {
-                        connection.complete(Unit)
-                    } else {
-                        Log.e(TAG, "Billing setup failed: $billingResult")
-                        connection.completeExceptionally(BillingException(billingResult))
-                    }
-                }
-
-                override fun onBillingServiceDisconnected() {
-                    Log.w(TAG, "Billing service disconnected")
-                }
-            })
-        }
-        connection.await()
-    }
-
-    private suspend fun handleBillingApiCall(block: suspend () -> JSONObject): JSONObject {
-        val numberAttempts = 3
-        var attemptCount = 0
-        while (true) {
-            try {
-                return block()
-            } catch (e: BillingException) {
-                if (e.isCanceled) {
-                    Log.w(TAG, "Billing canceled")
-                    return JSONObject().put("responseCode", ErrorCode.BillingCanceled)
-                } else if (e.isRetryable && attemptCount < numberAttempts) {
-                    Log.d(TAG, "Retryable error: $e")
-                    ++attemptCount
-                    delay(1000)
-                } else {
-                    Log.e(TAG, "Billing error: $e")
-                    return JSONObject().put("responseCode", e.errorCode)
-                }
-            } catch (_: CancellationException) {
-                Log.w(TAG, "Billing coroutine canceled")
-                return JSONObject().put("responseCode", ErrorCode.BillingCanceled)
-            }
-        }
-    }
-
-    suspend fun getSubscriptionPlans(): JSONObject {
-        Log.v(TAG, "Get subscription plans")
-
-        val productDetailsList = getProductDetails()
-        val resultJson = JSONObject().put("responseCode", ErrorCode.NoError)
-        val productArray = JSONArray().also { resultJson.put("products", it) }
-        productDetailsList?.forEach { productDetails ->
-            val product = JSONObject().also { productArray.put(it) }
-                .put("productId", productDetails.productId)
-                .put("name", productDetails.name)
-            val offers = JSONArray().also { product.put("offers", it) }
-            productDetails.subscriptionOfferDetails?.forEach { offerDetails ->
-                val offer = JSONObject().also { offers.put(it) }
-                    .put("basePlanId", offerDetails.basePlanId)
-                    .put("offerId", offerDetails.offerId)
-                    .put("offerToken", offerDetails.offerToken)
-                val pricingPhases = JSONArray().also { offer.put("pricingPhases", it) }
-                offerDetails.pricingPhases.pricingPhaseList.forEach { phase ->
-                    JSONObject().also { pricingPhases.put(it) }
-                        .put("billingCycleCount", phase.billingCycleCount)
-                        .put("billingPeriod", phase.billingPeriod)
-                        .put("formatedPrice", phase.formattedPrice)
-                        .put("recurrenceMode", phase.recurrenceMode)
-                }
-            }
-        }
-        return resultJson
-    }
-
-    private suspend fun getProductDetails(): List<ProductDetails>? {
-        Log.v(TAG, "Get product details")
-
-        val productDetailsParams = Product.newBuilder()
-            .setProductId(PRODUCT_ID)
-            .setProductType(ProductType.SUBS)
-            .build()
-
-        val queryProductDetailsParams = QueryProductDetailsParams.newBuilder()
-            .setProductList(listOf(productDetailsParams))
-            .build()
-
-        val result = withContext(Dispatchers.IO) {
-            billingClient.queryProductDetails(queryProductDetailsParams)
-        }
-
-        Log.v(TAG, "Query product details result: ${result.billingResult}")
-
-        if (!result.billingResult.isOk) {
-            Log.e(TAG, "Failed to get product details: ${result.billingResult}")
-            throw BillingException(result.billingResult)
-        }
-
-        return result.productDetailsList
-    }
-
-    suspend fun getCustomerCountryCode(): JSONObject {
-        Log.v(TAG, "Get customer country code")
-
-        val deferred = CompletableDeferred<String>()
-        withContext(Dispatchers.IO) {
-            billingClient.getBillingConfigAsync(GetBillingConfigParams.newBuilder().build(),
-                { billingResult, billingConfig ->
-                    Log.v(TAG, "Billing config: $billingResult, ${billingConfig?.countryCode}")
-                    if (billingResult.isOk) {
-                        deferred.complete(billingConfig?.countryCode ?: "")
-                    } else {
-                        deferred.completeExceptionally(BillingException(billingResult))
-                    }
-                })
-        }
-        val countryCode = deferred.await()
-
-        return JSONObject()
-            .put("responseCode", ErrorCode.NoError)
-            .put("countryCode", countryCode)
-    }
-
-    suspend fun purchaseSubscription(
-        activity: Activity,
-        offerToken: String,
-        oldPurchaseToken: String? = null
-    ): JSONObject {
-        Log.v(TAG, "Purchase subscription")
-        Log.v(TAG, "Offer token: $offerToken")
-        oldPurchaseToken?.let { Log.v(TAG, "Old purchase token: $it") }
-
-        if (offerToken.isBlank()) throw BillingException("offerToken can not be empty")
-
-        val productDetails = getProductDetails()?.let {
-            it.filter { it.productId == PRODUCT_ID }
-        }?.firstOrNull() ?: throw BillingException("Product details not found")
-
-        Log.v(TAG, "Filtered product details:\n$productDetails")
-
-        val productDetail = BillingFlowParams.ProductDetailsParams.newBuilder()
-            .setProductDetails(productDetails)
-            .setOfferToken(offerToken)
-            .build()
-
-        val subscriptionUpdateParams = oldPurchaseToken?.let {
-            BillingFlowParams.SubscriptionUpdateParams.newBuilder()
-                .setOldPurchaseToken(oldPurchaseToken)
-                .setSubscriptionReplacementMode(ReplacementMode.WITHOUT_PRORATION)
-                .build()
-        }
-
-        val billingResult = billingClient.launchBillingFlow(activity, BillingFlowParams.newBuilder()
-            .setProductDetailsParamsList(listOf(productDetail))
-            .apply { subscriptionUpdateParams?.let { setSubscriptionUpdateParams(it) } }
-            .build())
-
-        Log.v(TAG, "Start billing flow result: $billingResult")
-
-        if (billingResult.responseCode == BillingResponseCode.ITEM_ALREADY_OWNED) {
-            Log.w(TAG, "Attempting to purchase already owned product")
-            val purchases = queryPurchases()
-            if (purchases.any { PRODUCT_ID in it.products }) throw BillingException(billingResult)
-            else throw BillingException(billingResult, retryable = true)
-        } else if (billingResult.responseCode == BillingResponseCode.ITEM_NOT_OWNED) {
-            Log.w(TAG, "Attempting to replace not owned product")
-            val purchases = queryPurchases()
-            if (purchases.all { PRODUCT_ID !in it.products }) throw BillingException(billingResult)
-            else throw BillingException(billingResult, retryable = true)
-        } else if (!billingResult.isOk) throw BillingException(billingResult)
-
-        subscriptionPurchases.firstOrNull { it != null }?.let { (billingResult, purchases) ->
-            if (!billingResult.isOk) throw BillingException(billingResult)
-            return JSONObject()
-                .put("responseCode", ErrorCode.NoError)
-                .put("purchases", processPurchases(purchases))
-        } ?: throw BillingException("Purchase failed")
-    }
-
-    private fun processPurchases(purchases: List<Purchase>?): JSONArray {
-        val purchaseArray = JSONArray()
-        purchases?.forEach { purchase ->
-            /* val purchaseJson = */ JSONObject().also { purchaseArray.put(it) }
-                .put("purchaseToken", purchase.purchaseToken)
-                .put("purchaseTime", purchase.purchaseTime)
-                .put("purchaseState", purchase.purchaseState)
-                .put("isAcknowledged", purchase.isAcknowledged)
-                .put("isAutoRenewing", purchase.isAutoRenewing)
-                .put("orderId", purchase.orderId)
-                // .put("productIds", JSONArray(purchase.products))
-
-            /* purchase.pendingPurchaseUpdate?.let { purchaseUpdate ->
-                JSONObject()
-                    .put("purchaseToken", purchaseUpdate.purchaseToken)
-                    // .put("productIds", JSONArray(purchaseUpdate.products))
-            }.also { purchaseJson.put("pendingPurchaseUpdate", it) } */
-        }
-        return purchaseArray
-    }
-
-    suspend fun acknowledge(purchaseToken: String): JSONObject {
-        Log.v(TAG, "Acknowledge purchase: $purchaseToken")
-
-        val result = withContext(Dispatchers.IO) {
-            billingClient.acknowledgePurchase(
-                AcknowledgePurchaseParams.newBuilder()
-                    .setPurchaseToken(purchaseToken)
-                    .build()
-            )
-        }
-
-        Log.v(TAG, "Acknowledge purchase result: $result")
-
-        if (result.responseCode == BillingResponseCode.ITEM_NOT_OWNED) {
-            Log.w(TAG, "Attempting to acknowledge not owned product")
-            val purchases = queryPurchases()
-            if (purchases.all { PRODUCT_ID !in it.products }) throw BillingException(result)
-            else throw BillingException(result, retryable = true)
-        } else if (!result.isOk && result.responseCode != BillingResponseCode.ITEM_ALREADY_OWNED) {
-            throw BillingException(result)
-        }
-
-        return JSONObject().put("responseCode", ErrorCode.NoError)
-    }
-
-    suspend fun getPurchases(): JSONObject {
-        Log.v(TAG, "Get purchases")
-        val purchases = queryPurchases()
-        return JSONObject()
-            .put("responseCode", ErrorCode.NoError)
-            .put("purchases", processPurchases(purchases))
-    }
-
-    private suspend fun queryPurchases(): List<Purchase> {
-        Log.v(TAG, "Query purchases")
-        val result = withContext(Dispatchers.IO) {
-            billingClient.queryPurchasesAsync(
-                QueryPurchasesParams.newBuilder().setProductType(ProductType.SUBS).build()
-            )
-        }
-        Log.v(TAG, "Query purchases result: ${result.billingResult}")
-        if (!result.billingResult.isOk) throw BillingException(result.billingResult)
-        return result.purchasesList
-    }
-
-    override fun close() {
-        Log.v(TAG, "Close billing client connection")
-        billingClient.endConnection()
-    }
-
-    companion object {
-        suspend fun withBillingProvider(context: Context, block: suspend BillingProvider.() -> JSONObject): String =
-            BillingProvider(context).use { bp ->
-                bp.handleBillingApiCall {
-                    bp.connect()
-                    bp.block()
-                }.toString()
-            }
-    }
-}
-
-internal val BillingResult.isOk: Boolean
-    get() = responseCode == BillingResponseCode.OK

client/android/build.gradle.kts

@@ -20,7 +20,6 @@ android {
     namespace = "org.amnezia.vpn"
 
     buildFeatures {
-        buildConfig = true
         viewBinding = true
     }
 
@@ -42,6 +41,17 @@ android {
         resourceConfigurations += listOf("en", "ru", "b+zh+Hans")
     }
 
+    sourceSets {
+        getByName("main") {
+            manifest.srcFile("AndroidManifest.xml")
+            java.setSrcDirs(listOf("src"))
+            res.setSrcDirs(listOf("res"))
+            // androyddeployqt creates the folders below
+            assets.setSrcDirs(listOf("assets"))
+            jniLibs.setSrcDirs(listOf("libs"))
+        }
+    }
+
     signingConfigs {
         register("release") {
             storeFile = providers.environmentVariable("ANDROID_KEYSTORE_PATH").orNull?.let { file(it) }
@@ -67,36 +77,6 @@ android {
         }
     }
 
-    flavorDimensions += "billing"
-
-    productFlavors {
-        create("oss") {
-            dimension = "billing"
-        }
-        create("play") {
-            dimension = "billing"
-        }
-    }
-
-    sourceSets {
-        getByName("main") {
-            manifest.srcFile("AndroidManifest.xml")
-            java.setSrcDirs(listOf("src"))
-            res.setSrcDirs(listOf("res"))
-            // androyddeployqt creates the folders below
-            assets.setSrcDirs(listOf("assets"))
-            jniLibs.setSrcDirs(listOf("libs"))
-        }
-
-        getByName("oss") {
-            java.setSrcDirs(listOf("oss"))
-        }
-
-        getByName("play") {
-            java.setSrcDirs(listOf("play"))
-        }
-    }
-
     splits {
         abi {
             isEnable = true
@@ -142,9 +122,4 @@ dependencies {
     implementation(libs.google.mlkit)
     implementation(libs.androidx.datastore)
     implementation(libs.androidx.biometric)
-
-    playImplementation(project(":billing"))
 }
-
-fun DependencyHandler.playImplementation(dependency: Any): Dependency? =
-    add("playImplementation", dependency)

client/android/gradle/libs.versions.toml

@@ -1,7 +1,6 @@
 [versions]
 agp = "8.5.2"
 kotlin = "1.9.24"
-android-billing = "7.0.0"
 androidx-core = "1.13.1"
 androidx-activity = "1.9.1"
 androidx-annotation = "1.8.2"
@@ -15,7 +14,6 @@ kotlinx-serialization = "1.6.3"
 google-mlkit = "17.3.0"
 
 [libraries]
-android-billing = { module = "com.android.billingclient:billing-ktx", version.ref = "android-billing" }
 androidx-core = { module = "androidx.core:core-ktx", version.ref = "androidx-core" }
 androidx-activity = { module = "androidx.activity:activity-ktx", version.ref = "androidx-activity" }
 androidx-annotation = { module = "androidx.annotation:annotation", version.ref = "androidx-annotation" }

client/android/oss/org/amnezia/vpn/BillingPaymentRepository.kt

@@ -1,13 +0,0 @@
-package org.amnezia.vpn
-
-import android.app.Activity
-import android.content.Context
-
-class BillingPaymentRepository(@Suppress("UNUSED_PARAMETER") context: Context) : BillingRepository {
-    override suspend fun getCountryCode(): String = ""
-    override suspend fun getSubscriptionPlans(): String = ""
-    override suspend fun purchaseSubscription(activity: Activity, offerToken: String): String = ""
-    override suspend fun upgradeSubscription(activity: Activity, offerToken: String, oldPurchaseToken: String): String = ""
-    override suspend fun acknowledge(purchaseToken: String): String = ""
-    override suspend fun queryPurchases(): String = ""
-}

client/android/play/org/amnezia/vpn/BillingPaymentRepository.kt

@@ -1,34 +0,0 @@
-package org.amnezia.vpn
-
-import android.app.Activity
-import android.content.Context
-import BillingProvider.Companion.withBillingProvider
-
-class BillingPaymentRepository(private val context: Context) : BillingRepository {
-
-    override suspend fun getCountryCode(): String = withBillingProvider(context) {
-        getCustomerCountryCode()
-    }
-
-    override suspend fun getSubscriptionPlans(): String = withBillingProvider(context) {
-        getSubscriptionPlans()
-    }
-
-    override suspend fun purchaseSubscription(activity: Activity, offerToken: String): String =
-        withBillingProvider(context) {
-            purchaseSubscription(activity, offerToken)
-    }
-
-    override suspend fun upgradeSubscription(activity: Activity, offerToken: String, oldPurchaseToken: String): String =
-        withBillingProvider(context) {
-            purchaseSubscription(activity, offerToken, oldPurchaseToken)
-        }
-
-    override suspend fun acknowledge(purchaseToken: String): String = withBillingProvider(context) {
-        acknowledge(purchaseToken)
-    }
-
-    override suspend fun queryPurchases(): String = withBillingProvider(context) {
-        getPurchases()
-    }
-}

client/android/settings.gradle.kts

@@ -31,7 +31,6 @@ rootProject.buildFileName = "build.gradle.kts"
 
 include(":qt")
 include(":utils")
-include(":billing")
 include(":protocolApi")
 include(":wireguard")
 include(":awg")

client/android/src/org/amnezia/vpn/AmneziaActivity.kt

@@ -26,8 +26,6 @@ import android.os.ParcelFileDescriptor
 import android.os.SystemClock
 import android.provider.OpenableColumns
 import android.provider.Settings
-import android.view.InputDevice
-import android.view.KeyEvent
 import android.view.MotionEvent
 import android.view.View
 import android.view.ViewGroup
@@ -55,6 +53,7 @@ import kotlinx.coroutines.async
 import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withContext
 import org.amnezia.vpn.protocol.getStatistics
 import org.amnezia.vpn.protocol.getStatus
 import org.amnezia.vpn.qt.QtAndroidController
@@ -86,14 +85,9 @@ class AmneziaActivity : QtActivity() {
     private var notificationStateReceiver: BroadcastReceiver? = null
     private lateinit var vpnServiceMessenger: IpcMessenger
     private var pfd: ParcelFileDescriptor? = null
-    private lateinit var billingRepository: BillingRepository
 
     private val actionResultHandlers = mutableMapOf<Int, ActivityResultHandler>()
     private val permissionRequestHandlers = mutableMapOf<Int, PermissionRequestHandler>()
-    
-    private var isActivityResumed = false
-    private var hasWindowFocus = false
-    private val resumeHandler = Handler(Looper.getMainLooper())
 
     private val vpnServiceEventHandler: Handler by lazy(NONE) {
         object : Handler(Looper.getMainLooper()) {
@@ -199,7 +193,6 @@ class AmneziaActivity : QtActivity() {
         registerBroadcastReceivers()
         intent?.let(::processIntent)
         runBlocking { vpnProto = proto.await() }
-        billingRepository = BillingPaymentRepository(applicationContext)
     }
 
     private fun loadLibs() {
@@ -267,10 +260,6 @@ class AmneziaActivity : QtActivity() {
     }
 
     override fun onStop() {
-        isActivityResumed = false
-        hasWindowFocus = false
-        // Cancel all pending operations when activity stops
-        resumeHandler.removeCallbacksAndMessages(null)
         Log.d(TAG, "Stop Amnezia activity")
         doUnbindService()
         mainScope.launch {
@@ -282,91 +271,35 @@ class AmneziaActivity : QtActivity() {
 
     override fun onWindowFocusChanged(hasFocus: Boolean) {
         super.onWindowFocusChanged(hasFocus)
-        hasWindowFocus = hasFocus
         Log.d(TAG, "Window focus changed: hasFocus=$hasFocus")
-        
-        // Cancel pending operations if window loses focus
-        if (!hasFocus) {
-            resumeHandler.removeCallbacksAndMessages(null)
-        }
     }
 
-    override fun dispatchKeyEvent(event: KeyEvent): Boolean {
-        val deviceId = event.deviceId
-        val keyCode = event.keyCode
-        val pressed = event.action == KeyEvent.ACTION_DOWN
-        val source = event.source
-
-        if (deviceId < 0 && pressed) {
-            when (keyCode) {
-                KeyEvent.KEYCODE_BUTTON_A,
-                KeyEvent.KEYCODE_BUTTON_B,
-                KeyEvent.KEYCODE_BUTTON_X,
-                KeyEvent.KEYCODE_BUTTON_Y,
-                KeyEvent.KEYCODE_BUTTON_START,
-                KeyEvent.KEYCODE_BUTTON_SELECT,
-                KeyEvent.KEYCODE_DPAD_CENTER -> {
-                    nativeGamepadKeyEvent(0, keyCode, true)
-                    nativeGamepadKeyEvent(0, keyCode, false)
-                    return true
-                }
-            }
-        }
-
-        // Real gamepad events (deviceId >= 0)
-        if (deviceId >= 0) {
-            val isGamepad = (source and InputDevice.SOURCE_GAMEPAD) == InputDevice.SOURCE_GAMEPAD
-            val isJoystick = (source and InputDevice.SOURCE_JOYSTICK) == InputDevice.SOURCE_JOYSTICK
-            val isDpad = (source and InputDevice.SOURCE_DPAD) == InputDevice.SOURCE_DPAD
-            if (isGamepad || isJoystick || isDpad) {
-                nativeGamepadKeyEvent(deviceId, keyCode, pressed)
-                return true
-            }
-        }
-
-        return super.dispatchKeyEvent(event)
-    }
-
-    private external fun nativeGamepadKeyEvent(deviceId: Int, keyCode: Int, pressed: Boolean)
-
     override fun onPause() {
         super.onPause()
-        isActivityResumed = false
-        // Cancel all pending operations when activity pauses
-        resumeHandler.removeCallbacksAndMessages(null)
         Log.d(TAG, "Pause Amnezia activity")
     }
 
     override fun onResume() {
         super.onResume()
-        isActivityResumed = true
-        Log.d(TAG, "Resume Amnezia activity")
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+       /* if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
             window.decorView.apply {
                 invalidate()
 
-                resumeHandler.postDelayed({
-                    // Check if activity is still resumed and has focus before executing
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(1f, 1f)
-                    }
+                postDelayed({
+                    sendTouch(1f, 1f)
                 }, 100)
                 
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(2f, 2f)
-                    }
+                postDelayed({
+                    sendTouch(2f, 2f)
                 }, 200)
                 
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        requestLayout()
-                        invalidate()
-                    }
+                postDelayed({
+                    requestLayout()
+                    invalidate()
                 }, 250)
             }
-        }
+        }  */      
+        Log.d(TAG, "Resume Amnezia activity")
     }
 
     private fun configureWindowForEdgeToEdge() {
@@ -429,10 +362,6 @@ class AmneziaActivity : QtActivity() {
     }
 
     override fun onDestroy() {
-        isActivityResumed = false
-        hasWindowFocus = false
-        // Cancel all pending operations when activity is destroyed
-        resumeHandler.removeCallbacksAndMessages(null)
         Log.d(TAG, "Destroy Amnezia activity")
         unregisterBroadcastReceiver(notificationStateReceiver)
         notificationStateReceiver = null
@@ -933,9 +862,15 @@ class AmneziaActivity : QtActivity() {
     @Suppress("unused")
     fun getAppList(): String {
         Log.v(TAG, "Get app list")
-        return blockingCall(Dispatchers.IO) {
-            AppListProvider.getAppList(packageManager, packageName)
+        var appList = ""
+        runBlocking {
+            mainScope.launch {
+                withContext(Dispatchers.IO) {
+                    appList = AppListProvider.getAppList(packageManager, packageName)
+                }
+            }.join()
         }
+        return appList
     }
 
     @Suppress("unused")
@@ -1106,59 +1041,11 @@ class AmneziaActivity : QtActivity() {
         return super.dispatchTrackballEvent(ev)
     }
 
-    @Suppress("unused")
-    fun isPlay(): Boolean = BuildConfig.FLAVOR == "play"
-
-    @Suppress("unused")
-    fun isTestPurchaseEnvironment(): Boolean {
-        if (BuildConfig.DEBUG) return true
-        val appInfo = packageManager.getApplicationInfo(packageName, 0)
-        return (appInfo.flags and android.content.pm.ApplicationInfo.FLAG_DEBUGGABLE) != 0
-    }
-
-    @Suppress("unused")
-    fun getCountryCode(): String {
-        Log.v(TAG, "Get country code")
-        return blockingCall { billingRepository.getCountryCode() }
-    }
-
-    @Suppress("unused")
-    fun getSubscriptionPlans(): String {
-        Log.v(TAG, "Get subscription plans")
-        return blockingCall { billingRepository.getSubscriptionPlans() }
-    }
-
-    @Suppress("unused")
-    fun purchaseSubscription(offerToken: String): String {
-        Log.v(TAG, "Purchase subscription")
-        return blockingCall { billingRepository.purchaseSubscription(this@AmneziaActivity, offerToken) }
-    }
-
-    @Suppress("unused")
-    fun upgradeSubscription(offerToken: String, oldPurchaseToken: String): String {
-        Log.v(TAG, "Upgrade subscription")
-        return blockingCall {
-            billingRepository.upgradeSubscription(this@AmneziaActivity, offerToken, oldPurchaseToken)
-        }
-    }
-
-    @Suppress("unused")
-    fun acknowledgePurchase(purchaseToken: String): String {
-        Log.v(TAG, "Acknowledge purchase")
-        return blockingCall { billingRepository.acknowledge(purchaseToken) }
-    }
-
-    @Suppress("unused")
-    fun queryPurchases(): String {
-        Log.v(TAG, "Query purchases")
-        return blockingCall { billingRepository.queryPurchases() }
-    }
-
     /**
      * Utils methods
      */
     private fun <T> blockingCall(
-        context: CoroutineContext = Dispatchers.Default,
+        context: CoroutineContext = Dispatchers.Main.immediate,
         block: suspend () -> T
     ) = runBlocking {
         mainScope.async(context) { block() }.await()

client/android/src/org/amnezia/vpn/AmneziaApplication.kt

@@ -1,6 +1,5 @@
 package org.amnezia.vpn
 
-import android.system.Os
 import androidx.camera.camera2.Camera2Config
 import androidx.camera.core.CameraSelector
 import androidx.camera.core.CameraXConfig
@@ -13,9 +12,6 @@ private const val TAG = "AmneziaApplication"
 class AmneziaApplication : QtApplication(), CameraXConfig.Provider {
 
     override fun onCreate() {
-        if (BuildConfig.DEBUG) {
-            Os.setenv("QT_ANDROID_DEBUGGER_MAIN_THREAD_SLEEP_MS", "0", true)
-        }
         super.onCreate()
         Prefs.init(this)
         Log.init(this)

client/android/src/org/amnezia/vpn/BillingRepository.kt

@@ -1,12 +0,0 @@
-package org.amnezia.vpn
-
-import android.app.Activity
-
-interface BillingRepository {
-    suspend fun getCountryCode(): String
-    suspend fun getSubscriptionPlans(): String
-    suspend fun purchaseSubscription(activity: Activity, offerToken: String): String
-    suspend fun upgradeSubscription(activity: Activity, offerToken: String, oldPurchaseToken: String): String
-    suspend fun acknowledge(purchaseToken: String): String
-    suspend fun queryPurchases(): String
-}

client/android/src/org/amnezia/vpn/TvFilePicker.kt

@@ -1,10 +1,7 @@
 package org.amnezia.vpn
 
 import android.content.ActivityNotFoundException
-import android.content.Context
 import android.content.Intent
-import android.content.pm.PackageManager
-import android.os.Build
 import android.os.Bundle
 import androidx.activity.ComponentActivity
 import androidx.activity.result.contract.ActivityResultContracts
@@ -14,25 +11,7 @@ private const val TAG = "TvFilePicker"
 
 class TvFilePicker : ComponentActivity() {
 
-    private val fileChooseResultLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
-        override fun createIntent(context: Context, input: Array<String>): Intent {
-            val intent = super.createIntent(context, input)
-
-            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-                context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
-            } else {
-                @Suppress("DEPRECATION")
-                context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
-            }
-            if (activitiesToResolveIntent.all {
-                    val name = it.activityInfo.packageName
-                    name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
-                }) {
-                throw ActivityNotFoundException()
-            }
-            return intent
-        }
-    }) {
+    private val fileChooseResultLauncher = registerForActivityResult(ActivityResultContracts.GetContent()) {
         setResult(RESULT_OK, Intent().apply { data = it })
         finish()
     }
@@ -52,7 +31,7 @@ class TvFilePicker : ComponentActivity() {
     private fun getFile() {
         try {
             Log.v(TAG, "getFile")
-            fileChooseResultLauncher.launch(arrayOf("*/*"))
+            fileChooseResultLauncher.launch("*/*")
         } catch (_: ActivityNotFoundException) {
             Log.w(TAG, "Activity not found")
             setResult(RESULT_CANCELED, Intent().apply { putExtra("activityNotFound", true) })

client/android/utils/src/main/kotlin/ErrorCode.kt

@@ -1,14 +0,0 @@
-package org.amnezia.vpn.util
-
-// keep synchronized with client/core/defs.h error_code_ns::ErrorCode
-object ErrorCode {
-    const val NoError = 0
-
-    const val BillingCanceled = 1300
-    const val BillingError = 1301
-    const val BillingGooglePlayError = 1302
-    const val BillingUnavailable = 1303
-    const val SubscriptionAlreadyOwned = 1304
-    const val SubscriptionUnavailable = 1305
-    const val BillingNetworkError = 1306
-}

client/cmake/3rdparty.cmake

@@ -83,26 +83,6 @@ add_compile_definitions(_WINSOCKAPI_)
 set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 set(BUILD_WITH_QT6 ON)
 add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain)
-
-if(ANDROID)
-    # Use qtgamepad from amnezia-vpn/qtgamepad repository
-    # Only if Qt6CorePrivate is available (required by qtgamepad)
-    find_package(Qt6CorePrivate CONFIG QUIET)
-    if(Qt6CorePrivate_FOUND)
-        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad)
-        # Link both the C++ module and QML plugin
-        if(TARGET GamepadLegacy)
-            target_link_libraries(${PROJECT} PRIVATE GamepadLegacy)
-        endif()
-        if(TARGET GamepadLegacyQuickPrivate)
-            target_link_libraries(${PROJECT} PRIVATE GamepadLegacyQuickPrivate)
-        endif()
-        message(STATUS "Gamepad support enabled for Android")
-    else()
-        message(STATUS "Qt6CorePrivate not found. Gamepad support disabled for Android.")
-    endif()
-endif()
-
 set(LIBS ${LIBS} qt6keychain)
 
 include_directories(

client/cmake/android.cmake

@@ -1,9 +1,5 @@
 message("Client android ${CMAKE_ANDROID_ARCH_ABI} build")
 
-# Option to build Play variant (with Google Play Billing) instead of OSS
-# When ON, adds target android_play_apk: cmake --build . --target android_play_apk
-option(ANDROID_BUILD_PLAY "Add android_play_apk target for Google Play Billing build" OFF)
-
 set(APP_ANDROID_MIN_SDK 28)
 set(ANDROID_PLATFORM "android-${APP_ANDROID_MIN_SDK}" CACHE STRING
     "The minimum API level supported by the application or library" FORCE)
@@ -61,22 +57,3 @@ endforeach()
 
 file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/xray/android/libxray.aar
         DESTINATION ${CMAKE_CURRENT_SOURCE_DIR}/android/xray/libXray)
-
-# Custom target to build Play variant (with Google Play Billing)
-# Enable with: cmake -DANDROID_BUILD_PLAY=ON ...
-# Then run: cmake --build <build_dir> --target android_play_apk
-# Note: Do a normal build first so androiddeployqt creates the android-build folder
-if(ANDROID_BUILD_PLAY)
-    if(CMAKE_BUILD_TYPE STREQUAL "Debug")
-        set(_gradle_suffix "Debug")
-    else()
-        set(_gradle_suffix "Release")
-    endif()
-    set(_android_build_dir "${CMAKE_CURRENT_BINARY_DIR}/android-build-${PROJECT}")
-    add_custom_target(android_play_apk
-        COMMAND ./gradlew assemblePlay${_gradle_suffix} -DexplicitRun=1
-        WORKING_DIRECTORY "${_android_build_dir}"
-        COMMENT "Building Android Play variant (assemblePlay${_gradle_suffix})"
-        DEPENDS ${PROJECT}
-    )
-endif()

client/cmake/sources.cmake

@@ -23,6 +23,12 @@ set(HEADERS ${HEADERS}
     ${CMAKE_CURRENT_BINARY_DIR}/version.h
     ${CLIENT_ROOT_DIR}/core/sshclient.h
     ${CLIENT_ROOT_DIR}/core/networkUtilities.h
+    ${CLIENT_ROOT_DIR}/core/transport/igatewaytransport.h
+    ${CLIENT_ROOT_DIR}/core/transport/httpGatewayTransport.h
+    ${CLIENT_ROOT_DIR}/core/transport/dnsGatewayTransport.h
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsResolver.h
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsTunnel.h
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsPacket_p.h
     ${CLIENT_ROOT_DIR}/core/serialization/serialization.h
     ${CLIENT_ROOT_DIR}/core/serialization/transfer.h
     ${CLIENT_ROOT_DIR}/../common/logger/logger.h
@@ -68,6 +74,11 @@ set(SOURCES ${SOURCES}
     ${CLIENT_ROOT_DIR}/protocols/vpnprotocol.cpp
     ${CLIENT_ROOT_DIR}/core/sshclient.cpp
     ${CLIENT_ROOT_DIR}/core/networkUtilities.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/httpGatewayTransport.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/dnsGatewayTransport.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsResolver.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsTunnel.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsPacket.cpp
     ${CLIENT_ROOT_DIR}/core/serialization/outbound.cpp
     ${CLIENT_ROOT_DIR}/core/serialization/inbound.cpp
     ${CLIENT_ROOT_DIR}/core/serialization/ss.cpp
@@ -181,6 +192,7 @@ if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
 
     set(HEADERS ${HEADERS}
         ${CLIENT_ROOT_DIR}/core/ipcclient.h
+        ${CLIENT_ROOT_DIR}/core/privileged_process.h
         ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.h
         ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.h
         ${CLIENT_ROOT_DIR}/protocols/openvpnovercloakprotocol.h
@@ -193,6 +205,7 @@ if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
 
     set(SOURCES ${SOURCES}
         ${CLIENT_ROOT_DIR}/core/ipcclient.cpp
+        ${CLIENT_ROOT_DIR}/core/privileged_process.cpp
         ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.cpp
         ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.cpp
         ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.cpp

client/core/api/apiDefs.h

@@ -79,7 +79,7 @@ namespace apiDefs
         constexpr QLatin1String adEndpoint("ad_endpoint");
     }
 
-    const int requestTimeoutMsecs = 12 * 1000; // 12 secs
+    const int requestTimeoutMsecs = 30 * 1000; // 30 secs (increased for DNS transport testing)
 }
 
 #endif // APIDEFS_H

client/core/controllers/gatewayController.cpp

@@ -1,29 +1,22 @@
 #include "gatewayController.h"
 
-#include <algorithm>
-#include <functional>
-#include <random>
-
-#include <QCryptographicHash>
+#include <QDebug>
 #include <QJsonArray>
 #include <QJsonDocument>
 #include <QJsonObject>
-#include <QNetworkReply>
-#include <QPromise>
-#include <QUrl>
+#include <QMutexLocker>
+#include <QSharedPointer>
+#include <QThread>
+#include <QtConcurrent>
 
 #include "QBlockCipher.h"
 #include "QRsa.h"
 
 #include "amnezia_application.h"
-#include "core/api/apiUtils.h"
-#include "core/networkUtilities.h"
+#include "core/transport/dnsGatewayTransport.h"
+#include "core/transport/httpGatewayTransport.h"
 #include "utilities.h"
 
-#ifdef AMNEZIA_DESKTOP
-    #include "core/ipcclient.h"
-#endif
-
 namespace
 {
     namespace configKey
@@ -36,630 +29,330 @@ namespace
         constexpr char keyPayload[] = "key_payload";
     }
 
-    constexpr QLatin1String errorResponsePattern1("No active configuration found for");
-    constexpr QLatin1String errorResponsePattern2("No non-revoked public key found for");
-    constexpr QLatin1String errorResponsePattern3("Account not found.");
-
-    constexpr QLatin1String updateRequestResponsePattern("client version update is required");
-
-    constexpr int httpStatusCodeNotFound = 404;
-    constexpr int httpStatusCodeConflict = 409;
-
-    constexpr int httpStatusCodeNotImplemented = 501;
-}
-
-GatewayController::GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
-                                     const bool isStrictKillSwitchEnabled, QObject *parent)
-    : QObject(parent),
-      m_gatewayEndpoint(gatewayEndpoint),
-      m_isDevEnvironment(isDevEnvironment),
-      m_requestTimeoutMsecs(requestTimeoutMsecs),
-      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled)
-{
-}
-
-GatewayController::EncryptedRequestData GatewayController::prepareRequest(const QString &endpoint, const QJsonObject &apiPayload)
-{
-    EncryptedRequestData encRequestData;
-    encRequestData.errorCode = ErrorCode::NoError;
-
-#ifdef Q_OS_IOS
-    IosController::Instance()->requestInetAccess();
-    QThread::msleep(10);
-#endif
-
-    encRequestData.request.setTransferTimeout(m_requestTimeoutMsecs);
-    encRequestData.request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
-    encRequestData.request.setRawHeader(QString("X-Client-Request-ID").toUtf8(), QUuid::createUuid().toString(QUuid::WithoutBraces).toUtf8());
-    encRequestData.request.setUrl(endpoint.arg(m_proxyUrl.isEmpty() ? m_gatewayEndpoint : m_proxyUrl));
-
-    // bypass killSwitch exceptions for API-gateway
-#ifdef AMNEZIA_DESKTOP
-    if (m_isStrictKillSwitchEnabled) {
-        QString host = QUrl(encRequestData.request.url()).host();
-        QString ip = NetworkUtilities::getIPAddress(host);
-        if (!ip.isEmpty()) {
-            IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-                QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(QStringList { ip });
-                if (!reply.waitForFinished(1000) || !reply.returnValue())
-                    qWarning() << "GatewayController::prepareRequest(): Failed to execute remote addKillSwitchAllowedRange call";
-            });
+    amnezia::transport::dns::DnsProtocol dnsProtocolFromPrimary(PrimaryTransport p)
+    {
+        switch (p) {
+        case PrimaryTransport::DnsUdp: return amnezia::transport::dns::DnsProtocol::Udp;
+        case PrimaryTransport::DnsTcp: return amnezia::transport::dns::DnsProtocol::Tcp;
+        case PrimaryTransport::DnsDot: return amnezia::transport::dns::DnsProtocol::Tls;
+        case PrimaryTransport::DnsDoh: return amnezia::transport::dns::DnsProtocol::Https;
+        case PrimaryTransport::DnsDoq: return amnezia::transport::dns::DnsProtocol::Quic;
+        default: return amnezia::transport::dns::DnsProtocol::Udp;
         }
     }
-#endif
+} // namespace
+
+TransportsConfig TransportsConfig::fromJson(const QJsonObject &json)
+{
+    using amnezia::transport::dns::DnsProtocol;
+
+    TransportsConfig config;
+
+    QString primaryStr = json.value("primary").toString("http").toLower();
+    if (primaryStr == "http") {
+        config.primary = PrimaryTransport::Http;
+    } else if (primaryStr == "dns_udp" || primaryStr == "udp") {
+        config.primary = PrimaryTransport::DnsUdp;
+    } else if (primaryStr == "dns_tcp" || primaryStr == "tcp") {
+        config.primary = PrimaryTransport::DnsTcp;
+    } else if (primaryStr == "dns_dot" || primaryStr == "dot") {
+        config.primary = PrimaryTransport::DnsDot;
+    } else if (primaryStr == "dns_doh" || primaryStr == "doh") {
+        config.primary = PrimaryTransport::DnsDoh;
+    } else if (primaryStr == "dns_doq" || primaryStr == "doq") {
+        config.primary = PrimaryTransport::DnsDoq;
+    }
+
+    config.retryCount = json.value("retry_count").toInt(3);
+    config.timeoutMs = json.value("timeout_ms").toInt(10000);
+
+    if (json.contains("http")) {
+        QJsonObject httpObj = json["http"].toObject();
+        config.httpEnabled = httpObj.value("enabled").toBool(true);
+        config.httpEndpoint = httpObj.value("endpoint").toString();
+    }
+
+    if (json.contains("dns_transports")) {
+        QJsonArray transportsArray = json["dns_transports"].toArray();
+        for (const auto &transportVal : transportsArray) {
+            QJsonObject transportObj = transportVal.toObject();
+            DnsTransportEntry entry;
+
+            entry.server = transportObj.value("server").toString();
+            entry.domain = transportObj.value("domain").toString();
+            entry.port = static_cast<quint16>(transportObj.value("port").toInt(15353));
+            entry.dohPath = transportObj.value("path").toString("/dns-query");
+
+            QString typeStr = transportObj.value("type").toString().toLower();
+            if (typeStr == "udp") {
+                entry.type = DnsProtocol::Udp;
+            } else if (typeStr == "tcp") {
+                entry.type = DnsProtocol::Tcp;
+            } else if (typeStr == "dot" || typeStr == "tls") {
+                entry.type = DnsProtocol::Tls;
+                if (!transportObj.contains("port")) entry.port = 8853;
+            } else if (typeStr == "doh" || typeStr == "https") {
+                entry.type = DnsProtocol::Https;
+                if (!transportObj.contains("port")) entry.port = 443;
+            } else if (typeStr == "doq" || typeStr == "quic") {
+                entry.type = DnsProtocol::Quic;
+                if (!transportObj.contains("port")) entry.port = 8853;
+            } else {
+                continue;
+            }
+
+            if (entry.isValid()) {
+                config.dnsTransports.append(entry);
+            }
+        }
+    }
+
+    return config;
+}
+
+GatewayController::GatewayController(const QString &gatewayEndpoint,
+                                     const bool isDevEnvironment,
+                                     const int requestTimeoutMsecs,
+                                     const bool isStrictKillSwitchEnabled,
+                                     QObject *parent)
+    : QObject(parent),
+      m_requestTimeoutMsecs(requestTimeoutMsecs),
+      m_gatewayEndpoint(gatewayEndpoint),
+      m_isDevEnvironment(isDevEnvironment),
+      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled)
+{
+    auto httpTransport = std::make_shared<amnezia::transport::HttpGatewayTransport>(
+            m_gatewayEndpoint, m_isDevEnvironment, m_requestTimeoutMsecs, m_isStrictKillSwitchEnabled);
+    {
+        QMutexLocker lock(&m_transportMutex);
+        m_transport = std::move(httpTransport);
+    }
+}
+
+std::shared_ptr<amnezia::transport::IGatewayTransport> GatewayController::buildTransport(
+        const TransportsConfig &config, int requestTimeoutMsecs, bool isDevEnvironment, bool isStrictKillSwitchEnabled)
+{
+    using namespace amnezia::transport;
+
+    auto makeHttp = [&](const QString &httpEndpoint) {
+        return std::make_shared<HttpGatewayTransport>(
+                httpEndpoint, isDevEnvironment, requestTimeoutMsecs, isStrictKillSwitchEnabled);
+    };
+
+    if (config.primary == PrimaryTransport::Http) {
+        return makeHttp(config.httpEndpoint);
+    }
+
+    const auto wantedProtocol = dnsProtocolFromPrimary(config.primary);
+    for (const auto &entry : config.dnsTransports) {
+        if (entry.type == wantedProtocol && entry.isValid()) {
+            return std::make_shared<DnsGatewayTransport>(
+                    entry.type, entry.server, entry.domain, entry.port,
+                    requestTimeoutMsecs, isStrictKillSwitchEnabled, entry.dohPath);
+        }
+    }
+
+    return makeHttp(config.httpEndpoint);
+}
+
+void GatewayController::setTransportsConfig(const TransportsConfig &config)
+{
+    if (config.timeoutMs > 0) {
+        m_requestTimeoutMsecs = config.timeoutMs;
+    }
+    if (!config.httpEndpoint.isEmpty()) {
+        m_gatewayEndpoint = config.httpEndpoint;
+    }
+
+    TransportsConfig effective = config;
+    if (effective.httpEndpoint.isEmpty()) {
+        effective.httpEndpoint = m_gatewayEndpoint;
+    }
+
+    auto newTransport = buildTransport(effective, m_requestTimeoutMsecs, m_isDevEnvironment, m_isStrictKillSwitchEnabled);
+    QString activeName;
+    {
+        QMutexLocker lock(&m_transportMutex);
+        m_transport = std::move(newTransport);
+        activeName = m_transport ? m_transport->name() : QStringLiteral("none");
+    }
+
+    qDebug() << "[Transport] Active transport set to" << activeName;
+}
+
+TransportsConfig GatewayController::buildTransportsConfig()
+{
+    using amnezia::transport::dns::DnsProtocol;
+
+    TransportsConfig config;
+
+    QString server = QString(AGW_DNS_SERVER).trimmed();
+    QString domain = QString(AGW_DNS_DOMAIN).trimmed();
+
+    if (server.isEmpty() || domain.isEmpty()) {
+        qDebug() << "[Transport] DNS server/domain not configured, HTTP only";
+        return config;
+    }
+
+    QString primaryStr = QString(AGW_DNS_PRIMARY).trimmed().toLower();
+    if (primaryStr == "udp" || primaryStr == "dns_udp") {
+        config.primary = PrimaryTransport::DnsUdp;
+    } else if (primaryStr == "tcp" || primaryStr == "dns_tcp") {
+        config.primary = PrimaryTransport::DnsTcp;
+    } else if (primaryStr == "dot" || primaryStr == "dns_dot") {
+        config.primary = PrimaryTransport::DnsDot;
+    } else if (primaryStr == "doh" || primaryStr == "dns_doh") {
+        config.primary = PrimaryTransport::DnsDoh;
+    } else if (primaryStr == "doq" || primaryStr == "dns_doq") {
+        config.primary = PrimaryTransport::DnsDoq;
+    } else {
+        config.primary = PrimaryTransport::Http;
+    }
+
+    int retryCount = QString(AGW_DNS_RETRY_COUNT).trimmed().toInt();
+    config.retryCount = (retryCount > 0) ? retryCount : 3;
+
+    int timeoutMs = QString(AGW_DNS_TIMEOUT_MS).trimmed().toInt();
+    config.timeoutMs = (timeoutMs > 0) ? timeoutMs : 10000;
+
+    config.httpEnabled = true;
+
+    auto addTransport = [&](DnsProtocol type, const char *portDefine, quint16 defaultPort,
+                            const QString &dohPath = QString()) {
+        DnsTransportEntry entry;
+        entry.type = type;
+        entry.server = server;
+        entry.domain = domain;
+        quint16 port = QString(portDefine).trimmed().toUShort();
+        entry.port = (port > 0) ? port : defaultPort;
+        if (!dohPath.isEmpty()) entry.dohPath = dohPath;
+        config.dnsTransports.append(entry);
+    };
+
+    addTransport(DnsProtocol::Udp, AGW_DNS_PORT_UDP, 5353);
+    addTransport(DnsProtocol::Tcp, AGW_DNS_PORT_UDP, 5353);
+    addTransport(DnsProtocol::Tls, AGW_DNS_PORT_DOT, 853);
+
+    QString dohPath = QString(AGW_DNS_DOH_PATH).trimmed();
+    if (dohPath.isEmpty()) dohPath = "/dns-query";
+    addTransport(DnsProtocol::Https, AGW_DNS_PORT_DOH, 443, dohPath);
+
+    addTransport(DnsProtocol::Quic, AGW_DNS_PORT_DOQ, 8853);
+
+    qDebug() << "[Transport] Built config from env: server=" << server << "domain=" << domain
+             << "transports=" << config.dnsTransports.size() << "primary=" << static_cast<int>(config.primary);
+
+    return config;
+}
+
+GatewayController::EncryptedRequest GatewayController::encryptRequest(const QJsonObject &apiPayload)
+{
+    EncryptedRequest result;
+    result.errorCode = amnezia::ErrorCode::NoError;
 
     QSimpleCrypto::QBlockCipher blockCipher;
-    encRequestData.key = blockCipher.generatePrivateSalt(32);
-    encRequestData.iv = blockCipher.generatePrivateSalt(32);
-    encRequestData.salt = blockCipher.generatePrivateSalt(8);
+    result.key = blockCipher.generatePrivateSalt(32);
+    result.iv = blockCipher.generatePrivateSalt(16);
+    result.salt = blockCipher.generatePrivateSalt(8);
 
     QJsonObject keyPayload;
-    keyPayload[configKey::aesKey] = QString(encRequestData.key.toBase64());
-    keyPayload[configKey::aesIv] = QString(encRequestData.iv.toBase64());
-    keyPayload[configKey::aesSalt] = QString(encRequestData.salt.toBase64());
+    keyPayload[configKey::aesKey] = QString(result.key.toBase64());
+    keyPayload[configKey::aesIv] = QString(result.iv.toBase64());
+    keyPayload[configKey::aesSalt] = QString(result.salt.toBase64());
 
     QByteArray encryptedKeyPayload;
     QByteArray encryptedApiPayload;
     try {
         QSimpleCrypto::QRsa rsa;
-
         EVP_PKEY *publicKey = nullptr;
         try {
             QByteArray rsaKey = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-            QSimpleCrypto::QRsa rsa;
+            rsaKey = rsaKey.trimmed();
+            rsaKey.replace("\\n", "\n");
             publicKey = rsa.getPublicKeyFromByteArray(rsaKey);
         } catch (...) {
             Utils::logException();
             qCritical() << "error loading public key from environment variables";
-            encRequestData.errorCode = ErrorCode::ApiMissingAgwPublicKey;
-            return encRequestData;
+            result.errorCode = amnezia::ErrorCode::ApiMissingAgwPublicKey;
+            return result;
         }
 
-        encryptedKeyPayload = rsa.encrypt(QJsonDocument(keyPayload).toJson(), publicKey, RSA_PKCS1_PADDING);
+        encryptedKeyPayload = rsa.encrypt(QJsonDocument(keyPayload).toJson(QJsonDocument::Compact),
+                                          publicKey, RSA_PKCS1_PADDING);
         EVP_PKEY_free(publicKey);
 
-        encryptedApiPayload = blockCipher.encryptAesBlockCipher(QJsonDocument(apiPayload).toJson(), encRequestData.key, encRequestData.iv,
-                                                                "", encRequestData.salt);
+        encryptedApiPayload = blockCipher.encryptAesBlockCipher(QJsonDocument(apiPayload).toJson(QJsonDocument::Compact),
+                                                                result.key, result.iv, "", result.salt);
     } catch (...) {
         Utils::logException();
         qCritical() << "error when encrypting the request body";
-        encRequestData.errorCode = ErrorCode::ApiConfigDecryptionError;
-        return encRequestData;
+        result.errorCode = amnezia::ErrorCode::ApiConfigDecryptionError;
+        return result;
     }
 
     QJsonObject requestBody;
     requestBody[configKey::keyPayload] = QString(encryptedKeyPayload.toBase64());
     requestBody[configKey::apiPayload] = QString(encryptedApiPayload.toBase64());
 
-    encRequestData.requestBody = QJsonDocument(requestBody).toJson();
-    return encRequestData;
+    result.body = QJsonDocument(requestBody).toJson(QJsonDocument::Compact);
+    return result;
 }
 
-GatewayController::DecryptionResult GatewayController::tryDecryptResponseBody(const QByteArray &encryptedResponseBody,
-                                                                              QNetworkReply::NetworkError replyError, const QByteArray &key,
-                                                                              const QByteArray &iv, const QByteArray &salt)
+amnezia::transport::DecryptionResult GatewayController::decryptResponse(const QByteArray &encryptedResponseBody,
+                                                                         const QByteArray &key,
+                                                                         const QByteArray &iv,
+                                                                         const QByteArray &salt) const
 {
-    DecryptionResult result;
-    result.decryptedBody = encryptedResponseBody;
-    result.isDecryptionSuccessful = false;
+    amnezia::transport::DecryptionResult result;
+    result.decrypted = encryptedResponseBody;
+    result.isOk = false;
+
+    if (encryptedResponseBody.isEmpty()) {
+        return result;
+    }
 
     try {
         QSimpleCrypto::QBlockCipher blockCipher;
-        result.decryptedBody = blockCipher.decryptAesBlockCipher(encryptedResponseBody, key, iv, "", salt);
-        result.isDecryptionSuccessful = true;
+        result.decrypted = blockCipher.decryptAesBlockCipher(encryptedResponseBody, key, iv, "", salt);
+        result.isOk = true;
     } catch (...) {
-        result.decryptedBody = encryptedResponseBody;
-        result.isDecryptionSuccessful = false;
+        result.decrypted = encryptedResponseBody;
+        result.isOk = false;
     }
 
     return result;
 }
 
-ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody)
+std::shared_ptr<amnezia::transport::IGatewayTransport> GatewayController::currentTransport() const
 {
-    EncryptedRequestData encRequestData = prepareRequest(endpoint, apiPayload);
-    if (encRequestData.errorCode != ErrorCode::NoError) {
-        return encRequestData.errorCode;
-    }
-
-    QNetworkReply *reply = amnApp->networkManager()->post(encRequestData.request, encRequestData.requestBody);
-
-    QEventLoop wait;
-    connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
-
-    QList<QSslError> sslErrors;
-    connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-    wait.exec(QEventLoop::ExcludeUserInputEvents);
-
-    QByteArray encryptedResponseBody = reply->readAll();
-    QString replyErrorString = reply->errorString();
-    auto replyError = reply->error();
-    int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
-    reply->deleteLater();
-
-    auto decryptionResult =
-            tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);
-
-    if (sslErrors.isEmpty() && shouldBypassProxy(replyError, decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful)) {
-        auto requestFunction = [&encRequestData, &encryptedResponseBody](const QString &url) {
-            encRequestData.request.setUrl(url);
-            return amnApp->networkManager()->post(encRequestData.request, encRequestData.requestBody);
-        };
-
-        auto replyProcessingFunction = [&encryptedResponseBody, &replyErrorString, &replyError, &httpStatusCode, &sslErrors, &encRequestData,
-                                        &decryptionResult, this](QNetworkReply *reply, const QList<QSslError> &nestedSslErrors) {
-            encryptedResponseBody = reply->readAll();
-            replyErrorString = reply->errorString();
-            replyError = reply->error();
-            httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
-            decryptionResult =
-                    tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);
-
-            if (!sslErrors.isEmpty()
-                || shouldBypassProxy(replyError, decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful)) {
-                sslErrors = nestedSslErrors;
-                return false;
-            }
-            return true;
-        };
-
-        auto serviceType = apiPayload.value(apiDefs::key::serviceType).toString("");
-        auto userCountryCode = apiPayload.value(apiDefs::key::userCountryCode).toString("");
-        bypassProxy(endpoint, serviceType, userCountryCode, requestFunction, replyProcessingFunction);
-    }
-
-    auto errorCode =
-            apiUtils::checkNetworkReplyErrors(sslErrors, replyErrorString, replyError, httpStatusCode, decryptionResult.decryptedBody);
-    if (errorCode) {
-        return errorCode;
-    }
-
-    if (!decryptionResult.isDecryptionSuccessful) {
-        qCritical() << "error when decrypting the request body";
-        return ErrorCode::ApiConfigDecryptionError;
-    }
-
-    responseBody = decryptionResult.decryptedBody;
-    return ErrorCode::NoError;
+    QMutexLocker lock(&m_transportMutex);
+    return m_transport;
 }
 
-QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString &endpoint, const QJsonObject apiPayload)
+amnezia::ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody)
 {
-    auto promise = QSharedPointer<QPromise<QPair<ErrorCode, QByteArray>>>::create();
-    promise->start();
-
-    EncryptedRequestData encRequestData = prepareRequest(endpoint, apiPayload);
-    if (encRequestData.errorCode != ErrorCode::NoError) {
-        promise->addResult(qMakePair(encRequestData.errorCode, QByteArray()));
-        promise->finish();
-        return promise->future();
+    EncryptedRequest enc = encryptRequest(apiPayload);
+    if (enc.errorCode != amnezia::ErrorCode::NoError) {
+        return enc.errorCode;
     }
 
-    QNetworkReply *reply = amnApp->networkManager()->post(encRequestData.request, encRequestData.requestBody);
-
-    auto sslErrors = QSharedPointer<QList<QSslError>>::create();
-
-    connect(reply, &QNetworkReply::sslErrors, [sslErrors](const QList<QSslError> &errors) { *sslErrors = errors; });
-
-    connect(reply, &QNetworkReply::finished, reply, [promise, sslErrors, encRequestData, endpoint, apiPayload, reply, this]() mutable {
-        QByteArray encryptedResponseBody = reply->readAll();
-        QString replyErrorString = reply->errorString();
-        auto replyError = reply->error();
-        int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
-        reply->deleteLater();
-
-        auto decryptionResult =
-                tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);
-
-        auto processResponse = [promise, encRequestData](const GatewayController::DecryptionResult &decryptionResult,
-                                                         const QList<QSslError> &sslErrors, QNetworkReply::NetworkError replyError,
-                                                         const QString &replyErrorString, int httpStatusCode) {
-            auto errorCode = apiUtils::checkNetworkReplyErrors(sslErrors, replyErrorString, replyError, httpStatusCode,
-                                                               decryptionResult.decryptedBody);
-            if (errorCode) {
-                promise->addResult(qMakePair(errorCode, QByteArray()));
-                promise->finish();
-                return;
-            }
-
-            if (!decryptionResult.isDecryptionSuccessful) {
-                Utils::logException();
-                qCritical() << "error when decrypting the request body";
-                promise->addResult(qMakePair(ErrorCode::ApiConfigDecryptionError, QByteArray()));
-                promise->finish();
-                return;
-            }
-
-            promise->addResult(qMakePair(ErrorCode::NoError, decryptionResult.decryptedBody));
-            promise->finish();
-        };
-
-        if (sslErrors->isEmpty() && shouldBypassProxy(replyError, decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful)) {
-            auto serviceType = apiPayload.value(apiDefs::key::serviceType).toString("");
-            auto userCountryCode = apiPayload.value(apiDefs::key::userCountryCode).toString("");
-
-            QStringList baseUrls;
-            if (m_isDevEnvironment) {
-                baseUrls = QString(DEV_S3_ENDPOINT).split(", ");
-            } else {
-                baseUrls = QString(PROD_S3_ENDPOINT).split(", ");
-            }
-
-            QStringList proxyStorageUrls;
-            if (!serviceType.isEmpty()) {
-                for (const auto &baseUrl : baseUrls) {
-                    QByteArray path = ("endpoints-" + serviceType + "-" + userCountryCode).toUtf8();
-                    proxyStorageUrls.push_back(baseUrl + path.toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals)
-                                               + ".json");
-                }
-            }
-            for (const auto &baseUrl : baseUrls)
-                proxyStorageUrls.push_back(baseUrl + "endpoints.json");
-
-            getProxyUrlsAsync(proxyStorageUrls, 0, [this, encRequestData, endpoint, processResponse](const QStringList &proxyUrls) {
-                getProxyUrlAsync(proxyUrls, 0, [this, encRequestData, endpoint, processResponse](const QString &proxyUrl) {
-                    bypassProxyAsync(endpoint, proxyUrl, encRequestData,
-                                     [processResponse, this](const QByteArray &decryptedBody, bool isDecryptionSuccessful,
-                                                             const QList<QSslError> &sslErrors, QNetworkReply::NetworkError replyError,
-                                                             const QString &replyErrorString, int httpStatusCode) {
-                                         GatewayController::DecryptionResult result;
-                                         result.decryptedBody = decryptedBody;
-                                         result.isDecryptionSuccessful = isDecryptionSuccessful;
-                                         processResponse(result, sslErrors, replyError, replyErrorString, httpStatusCode);
-                                     });
-                });
-            });
-
-        } else {
-            processResponse(decryptionResult, *sslErrors, replyError, replyErrorString, httpStatusCode);
-        }
-    });
-
-    return promise->future();
-}
-
-QStringList GatewayController::getProxyUrls(const QString &serviceType, const QString &userCountryCode)
-{
-    QNetworkRequest request;
-    request.setTransferTimeout(m_requestTimeoutMsecs);
-    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
-
-    QEventLoop wait;
-    QList<QSslError> sslErrors;
-    QNetworkReply *reply;
-
-    QStringList baseUrls;
-    if (m_isDevEnvironment) {
-        baseUrls = QString(DEV_S3_ENDPOINT).split(", ");
-    } else {
-        baseUrls = QString(PROD_S3_ENDPOINT).split(", ");
+    auto transport = currentTransport();
+    if (!transport) {
+        return amnezia::ErrorCode::AmneziaServiceConnectionFailed;
     }
 
-    QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-
-    QStringList proxyStorageUrls;
-    if (!serviceType.isEmpty()) {
-        for (const auto &baseUrl : baseUrls) {
-            QByteArray path = ("endpoints-" + serviceType + "-" + userCountryCode).toUtf8();
-            proxyStorageUrls.push_back(baseUrl + path.toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals) + ".json");
-        }
-    }
-    for (const auto &baseUrl : baseUrls) {
-        proxyStorageUrls.push_back(baseUrl + "endpoints.json");
-    }
-
-    for (const auto &proxyStorageUrl : proxyStorageUrls) {
-        request.setUrl(proxyStorageUrl);
-        reply = amnApp->networkManager()->get(request);
-
-        connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
-        connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-        wait.exec(QEventLoop::ExcludeUserInputEvents);
-
-        if (reply->error() == QNetworkReply::NetworkError::NoError) {
-            auto encryptedResponseBody = reply->readAll();
-            reply->deleteLater();
-
-            EVP_PKEY *privateKey = nullptr;
-            QByteArray responseBody;
-            try {
-                if (!m_isDevEnvironment) {
-                    QCryptographicHash hash(QCryptographicHash::Sha512);
-                    hash.addData(key);
-                    QByteArray hashResult = hash.result().toHex();
-
-                    QByteArray key = QByteArray::fromHex(hashResult.left(64));
-                    QByteArray iv = QByteArray::fromHex(hashResult.mid(64, 32));
-
-                    QByteArray ba = QByteArray::fromBase64(encryptedResponseBody);
-
-                    QSimpleCrypto::QBlockCipher blockCipher;
-                    responseBody = blockCipher.decryptAesBlockCipher(ba, key, iv);
-                } else {
-                    responseBody = encryptedResponseBody;
-                }
-            } catch (...) {
-                Utils::logException();
-                qCritical() << "error loading private key from environment variables or decrypting payload" << encryptedResponseBody;
-                continue;
-            }
-
-            auto endpointsArray = QJsonDocument::fromJson(responseBody).array();
-
-            QStringList endpoints;
-            for (const auto &endpoint : endpointsArray) {
-                endpoints.push_back(endpoint.toString());
-            }
-            return endpoints;
-        } else {
-            auto replyError = reply->error();
-            int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-            qDebug() << replyError;
-            qDebug() << httpStatusCode;
-            qDebug() << "go to the next storage endpoint";
-
-            reply->deleteLater();
-        }
-    }
-    return {};
-}
-
-bool GatewayController::shouldBypassProxy(const QNetworkReply::NetworkError &replyError, const QByteArray &decryptedResponseBody,
-                                          bool isDecryptionSuccessful)
-{
-    const QByteArray &responseBody = decryptedResponseBody;
-
-    int httpStatus = -1;
-    if (isDecryptionSuccessful) {
-        QJsonDocument jsonDoc = QJsonDocument::fromJson(responseBody);
-        if (jsonDoc.isObject()) {
-            QJsonObject jsonObj = jsonDoc.object();
-            httpStatus = jsonObj.value("http_status").toInt(-1);
-        }
-    } else {
-        qDebug() << "failed to decrypt the data";
-        return true;
-    }
-
-    if (replyError == QNetworkReply::NetworkError::OperationCanceledError || replyError == QNetworkReply::NetworkError::TimeoutError) {
-        qDebug() << "timeout occurred";
-        qDebug() << replyError;
-        return true;
-    } else if (responseBody.contains("html")) {
-        qDebug() << "the response contains an html tag";
-        return true;
-    } else if (httpStatus == httpStatusCodeNotFound) {
-        if (responseBody.contains(errorResponsePattern1) || responseBody.contains(errorResponsePattern2)
-            || responseBody.contains(errorResponsePattern3)) {
-            return false;
-        } else {
-            qDebug() << replyError;
-            return true;
-        }
-    } else if (httpStatus == httpStatusCodeNotImplemented) {
-        if (responseBody.contains(updateRequestResponsePattern)) {
-            return false;
-        } else {
-            qDebug() << replyError;
-            return true;
-        }
-    } else if (httpStatus == httpStatusCodeConflict) {
-        return false;
-    } else if (replyError != QNetworkReply::NetworkError::NoError) {
-        qDebug() << replyError;
-        return true;
-    }
-    return false;
-}
-
-void GatewayController::bypassProxy(const QString &endpoint, const QString &serviceType, const QString &userCountryCode,
-                                    std::function<QNetworkReply *(const QString &url)> requestFunction,
-                                    std::function<bool(QNetworkReply *reply, const QList<QSslError> &sslErrors)> replyProcessingFunction)
-{
-    QStringList proxyUrls = getProxyUrls(serviceType, userCountryCode);
-    std::random_device randomDevice;
-    std::mt19937 generator(randomDevice());
-    std::shuffle(proxyUrls.begin(), proxyUrls.end(), generator);
-
-    QByteArray responseBody;
-
-    auto bypassFunction = [this](const QString &endpoint, const QString &proxyUrl,
-                                 std::function<QNetworkReply *(const QString &url)> requestFunction,
-                                 std::function<bool(QNetworkReply * reply, const QList<QSslError> &sslErrors)> replyProcessingFunction) {
-        QEventLoop wait;
-        QList<QSslError> sslErrors;
-
-        qDebug() << "go to the next proxy endpoint";
-        QNetworkReply *reply = requestFunction(endpoint.arg(proxyUrl));
-
-        QObject::connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
-        connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-        wait.exec(QEventLoop::ExcludeUserInputEvents);
-
-        auto result = replyProcessingFunction(reply, sslErrors);
-        reply->deleteLater();
-        return result;
+    auto decryptionHook = [this, key = enc.key, iv = enc.iv, salt = enc.salt](const QByteArray &encrypted) {
+        return decryptResponse(encrypted, key, iv, salt);
     };
 
-    if (m_proxyUrl.isEmpty()) {
-        QNetworkRequest request;
-        request.setTransferTimeout(1000);
-        request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
-
-        QEventLoop wait;
-        QList<QSslError> sslErrors;
-        QNetworkReply *reply;
-
-        for (const QString &proxyUrl : proxyUrls) {
-            request.setUrl(proxyUrl + "lmbd-health");
-            reply = amnApp->networkManager()->get(request);
-
-            connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
-            connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-            wait.exec(QEventLoop::ExcludeUserInputEvents);
-
-            if (reply->error() == QNetworkReply::NetworkError::NoError) {
-                reply->deleteLater();
-
-                m_proxyUrl = proxyUrl;
-                if (!m_proxyUrl.isEmpty()) {
-                    break;
-                }
-            } else {
-                reply->deleteLater();
-            }
-        }
-    }
-
-    if (!m_proxyUrl.isEmpty()) {
-        if (bypassFunction(endpoint, m_proxyUrl, requestFunction, replyProcessingFunction)) {
-            return;
-        }
-    }
-
-    for (const QString &proxyUrl : proxyUrls) {
-        if (bypassFunction(endpoint, proxyUrl, requestFunction, replyProcessingFunction)) {
-            m_proxyUrl = proxyUrl;
-            break;
-        }
-    }
+    return transport->send(endpoint, enc.body, responseBody, decryptionHook);
 }
 
-void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
-                                          std::function<void(const QStringList &)> onComplete)
+QFuture<QPair<amnezia::ErrorCode, QByteArray>> GatewayController::postAsync(const QString &endpoint, const QJsonObject apiPayload)
 {
-    if (currentProxyStorageIndex >= proxyStorageUrls.size()) {
-        onComplete({});
-        return;
-    }
-
-    QNetworkRequest request;
-    request.setTransferTimeout(m_requestTimeoutMsecs);
-    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
-    request.setUrl(proxyStorageUrls[currentProxyStorageIndex]);
-
-    QNetworkReply *reply = amnApp->networkManager()->get(request);
-
-    // connect(reply, &QNetworkReply::sslErrors, this, [state](const QList<QSslError> &e) { *(state->sslErrors) = e; });
-
-    connect(reply, &QNetworkReply::finished, this, [this, proxyStorageUrls, currentProxyStorageIndex, onComplete, reply]() {
-        if (reply->error() == QNetworkReply::NoError) {
-            QByteArray encrypted = reply->readAll();
-            reply->deleteLater();
-
-            QByteArray responseBody;
-            try {
-                QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-                if (!m_isDevEnvironment) {
-                    QCryptographicHash hash(QCryptographicHash::Sha512);
-                    hash.addData(key);
-                    QByteArray h = hash.result().toHex();
-
-                    QByteArray decKey = QByteArray::fromHex(h.left(64));
-                    QByteArray iv = QByteArray::fromHex(h.mid(64, 32));
-                    QByteArray ba = QByteArray::fromBase64(encrypted);
-
-                    QSimpleCrypto::QBlockCipher cipher;
-                    responseBody = cipher.decryptAesBlockCipher(ba, decKey, iv);
-                } else {
-                    responseBody = encrypted;
-                }
-            } catch (...) {
-                Utils::logException();
-                qCritical() << "error decrypting payload";
-                QMetaObject::invokeMethod(
-                        this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
-                return;
-            }
-
-            QJsonArray endpointsArray = QJsonDocument::fromJson(responseBody).array();
-            QStringList endpoints;
-            for (const QJsonValue &endpoint : endpointsArray)
-                endpoints.push_back(endpoint.toString());
-
-            QStringList shuffled = endpoints;
-            std::random_device randomDevice;
-            std::mt19937 generator(randomDevice());
-            std::shuffle(shuffled.begin(), shuffled.end(), generator);
-
-            onComplete(shuffled);
-            return;
-        }
-
-        int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-        qDebug() << httpStatusCode;
-        qDebug() << "go to the next storage endpoint";
-        reply->deleteLater();
-        QMetaObject::invokeMethod(
-                this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
-    });
-}
-
-void GatewayController::getProxyUrlAsync(const QStringList proxyUrls, const int currentProxyIndex,
-                                         std::function<void(const QString &)> onComplete)
-{
-    if (currentProxyIndex >= proxyUrls.size()) {
-        onComplete("");
-        return;
-    }
-
-    QNetworkRequest request;
-    request.setTransferTimeout(1000);
-    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
-    request.setUrl(proxyUrls[currentProxyIndex] + "lmbd-health");
-
-    QNetworkReply *reply = amnApp->networkManager()->get(request);
-
-    // connect(reply, &QNetworkReply::sslErrors, this, [state](const QList<QSslError> &e) {
-    //     *(state->sslErrors) = e;
-    // });
-
-    connect(reply, &QNetworkReply::finished, this, [this, proxyUrls, currentProxyIndex, onComplete, reply]() {
-        reply->deleteLater();
-
-        if (reply->error() == QNetworkReply::NoError) {
-            m_proxyUrl = proxyUrls[currentProxyIndex];
-            onComplete(m_proxyUrl);
-            return;
-        }
-
-        qDebug() << "go to the next proxy endpoint";
-        QMetaObject::invokeMethod(this, [=]() { getProxyUrlAsync(proxyUrls, currentProxyIndex + 1, onComplete); }, Qt::QueuedConnection);
-    });
-}
-
-void GatewayController::bypassProxyAsync(
-        const QString &endpoint, const QString &proxyUrl, EncryptedRequestData encRequestData,
-        std::function<void(const QByteArray &, bool, const QList<QSslError> &, QNetworkReply::NetworkError, const QString &, int)> onComplete)
-{
-    auto sslErrors = QSharedPointer<QList<QSslError>>::create();
-    if (proxyUrl.isEmpty()) {
-        onComplete(QByteArray(), false, *sslErrors, QNetworkReply::InternalServerError, "empty proxy url", 0);
-        return;
-    }
-
-    QNetworkRequest request = encRequestData.request;
-    request.setUrl(endpoint.arg(proxyUrl));
-
-    QNetworkReply *reply = amnApp->networkManager()->post(request, encRequestData.requestBody);
-
-    connect(reply, &QNetworkReply::sslErrors, this, [sslErrors](const QList<QSslError> &errors) { *sslErrors = errors; });
-
-    connect(reply, &QNetworkReply::finished, this, [sslErrors, onComplete, encRequestData, reply, this]() {
-        QByteArray encryptedResponseBody = reply->readAll();
-        QString replyErrorString = reply->errorString();
-        auto replyError = reply->error();
-        int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
-        reply->deleteLater();
-
-        auto decryptionResult =
-                tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);
-
-        onComplete(decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful, *sslErrors, replyError, replyErrorString,
-                   httpStatusCode);
+    return QtConcurrent::run([this, endpoint, apiPayload]() {
+        QByteArray responseBody;
+        amnezia::ErrorCode errorCode = post(endpoint, apiPayload, responseBody);
+        return qMakePair(errorCode, responseBody);
     });
 }

client/core/controllers/gatewayController.h

@@ -2,69 +2,87 @@
 #define GATEWAYCONTROLLER_H
 
 #include <QFuture>
-#include <QNetworkReply>
+#include <QJsonArray>
+#include <QJsonObject>
+#include <QMutex>
 #include <QObject>
 #include <QPair>
-#include <QPromise>
-#include <QSharedPointer>
+#include <memory>
 
 #include "core/defs.h"
+#include "core/transport/dns/dnsResolver.h"
+#include "core/transport/igatewaytransport.h"
 
-#ifdef Q_OS_IOS
-    #include "platforms/ios/ios_controller.h"
-#endif
+struct DnsTransportEntry
+{
+    amnezia::transport::dns::DnsProtocol type = amnezia::transport::dns::DnsProtocol::Udp;
+    QString server;
+    QString domain;
+    quint16 port = 15353;
+    QString dohPath = "/dns-query";
+
+    bool isValid() const { return !server.isEmpty() && !domain.isEmpty(); }
+};
+
+enum class PrimaryTransport { Http, DnsUdp, DnsTcp, DnsDot, DnsDoh, DnsDoq };
+
+struct TransportsConfig
+{
+    PrimaryTransport primary = PrimaryTransport::Http;
+    bool httpEnabled = true;
+    QString httpEndpoint;
+    QList<DnsTransportEntry> dnsTransports;
+    int retryCount = 3;
+    int timeoutMs = 10000;
+
+    bool isValid() const { return httpEnabled || !dnsTransports.isEmpty(); }
+    static TransportsConfig fromJson(const QJsonObject &json);
+};
 
 class GatewayController : public QObject
 {
     Q_OBJECT
 
 public:
-    explicit GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
-                               const bool isStrictKillSwitchEnabled, QObject *parent = nullptr);
+    explicit GatewayController(const QString &gatewayEndpoint,
+                               const bool isDevEnvironment,
+                               const int requestTimeoutMsecs,
+                               const bool isStrictKillSwitchEnabled,
+                               QObject *parent = nullptr);
 
     amnezia::ErrorCode post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody);
     QFuture<QPair<amnezia::ErrorCode, QByteArray>> postAsync(const QString &endpoint, const QJsonObject apiPayload);
 
+    static TransportsConfig buildTransportsConfig();
+    void setTransportsConfig(const TransportsConfig &config);
+
 private:
-    struct EncryptedRequestData
+    struct EncryptedRequest
     {
-        QNetworkRequest request;
-        QByteArray requestBody;
+        QByteArray body;
         QByteArray key;
         QByteArray iv;
         QByteArray salt;
-        amnezia::ErrorCode errorCode;
+        amnezia::ErrorCode errorCode = amnezia::ErrorCode::NoError;
     };
 
-    struct DecryptionResult
-    {
-        QByteArray decryptedBody;
-        bool isDecryptionSuccessful;
-    };
+    EncryptedRequest encryptRequest(const QJsonObject &apiPayload);
+    amnezia::transport::DecryptionResult decryptResponse(const QByteArray &encryptedResponseBody,
+                                                         const QByteArray &key,
+                                                         const QByteArray &iv,
+                                                         const QByteArray &salt) const;
 
-    EncryptedRequestData prepareRequest(const QString &endpoint, const QJsonObject &apiPayload);
-    DecryptionResult tryDecryptResponseBody(const QByteArray &encryptedResponseBody, QNetworkReply::NetworkError replyError,
-                                            const QByteArray &key, const QByteArray &iv, const QByteArray &salt);
-
-    QStringList getProxyUrls(const QString &serviceType, const QString &userCountryCode);
-    bool shouldBypassProxy(const QNetworkReply::NetworkError &replyError, const QByteArray &decryptedResponseBody, bool isDecryptionSuccessful);
-    void bypassProxy(const QString &endpoint, const QString &serviceType, const QString &userCountryCode,
-                     std::function<QNetworkReply *(const QString &url)> requestFunction,
-                     std::function<bool(QNetworkReply *reply, const QList<QSslError> &sslErrors)> replyProcessingFunction);
-
-    void getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
-                           std::function<void(const QStringList &)> onComplete);
-    void getProxyUrlAsync(const QStringList proxyUrls, const int currentProxyIndex, std::function<void(const QString &)> onComplete);
-    void bypassProxyAsync(
-            const QString &endpoint, const QString &proxyUrl, EncryptedRequestData encRequestData,
-            std::function<void(const QByteArray &, bool, const QList<QSslError> &, QNetworkReply::NetworkError, const QString &, int)> onComplete);
+    std::shared_ptr<amnezia::transport::IGatewayTransport> currentTransport() const;
+    static std::shared_ptr<amnezia::transport::IGatewayTransport> buildTransport(
+            const TransportsConfig &config, int requestTimeoutMsecs, bool isDevEnvironment, bool isStrictKillSwitchEnabled);
 
     int m_requestTimeoutMsecs;
     QString m_gatewayEndpoint;
     bool m_isDevEnvironment = false;
     bool m_isStrictKillSwitchEnabled = false;
 
-    inline static QString m_proxyUrl;
+    mutable QMutex m_transportMutex;
+    std::shared_ptr<amnezia::transport::IGatewayTransport> m_transport;
 };
 
 #endif // GATEWAYCONTROLLER_H

client/core/controllers/serverController.cpp

@@ -419,18 +419,6 @@ ErrorCode ServerController::installDockerWorker(const ServerCredentials &credent
                       cbReadStdOut, cbReadStdErr);
 
     qDebug().noquote() << "ServerController::installDockerWorker" << stdOut;
-    if (container == DockerContainer::Awg2) {
-        QRegularExpression regex(R"(Linux\s+(\d+)\.(\d+)[^\d]*)");
-        QRegularExpressionMatch match = regex.match(stdOut);
-        if (match.hasMatch()) {
-            int majorVersion = match.captured(1).toInt();
-            int minorVersion = match.captured(2).toInt();
-
-            if (majorVersion < 4 || (majorVersion == 4 && minorVersion < 14)) {
-                return ErrorCode::ServerLinuxKernelTooOld;
-            }
-        }
-    }
     if (stdOut.contains("lock"))
         return ErrorCode::ServerPacketManagerError;
     if (stdOut.contains("command not found"))

client/core/defs.h

@@ -61,7 +61,6 @@ namespace amnezia
         ServerDockerOnCgroupsV2 = 211,
         ServerCgroupMountpoint = 212,
         DockerPullRateLimit = 213,
-        ServerLinuxKernelTooOld = 214,
 
         // Ssh connection errors
         SshRequestDeniedError = 300,
@@ -123,7 +122,6 @@ namespace amnezia
         ApiUpdateRequestError = 1111,
         ApiSubscriptionExpiredError = 1112,
         ApiPurchaseError = 1113,
-        ApiNoPurchasesToRestore = 1114,
 
         // QFile errors
         OpenError = 1200,
@@ -131,16 +129,7 @@ namespace amnezia
         PermissionsError = 1202,
         UnspecifiedError = 1203,
         FatalError = 1204,
-        AbortError = 1205,
-
-        // Billing errors
-        BillingCanceled = 1300,
-        BillingError = 1301,
-        BillingGooglePlayError = 1302,
-        BillingUnavailable = 1303,
-        SubscriptionAlreadyOwned = 1304,
-        SubscriptionUnavailable = 1305,
-        BillingNetworkError = 1306,
+        AbortError = 1205
       };
       Q_ENUM_NS(ErrorCode)
     }

client/core/errorstrings.cpp

@@ -29,7 +29,6 @@ QString errorString(ErrorCode code) {
     case(ErrorCode::ServerDockerOnCgroupsV2): errorMessage = QObject::tr("Docker error: runc doesn't work on cgroups v2"); break;
     case(ErrorCode::ServerCgroupMountpoint): errorMessage = QObject::tr("Server error: cgroup mountpoint does not exist"); break;
     case(ErrorCode::DockerPullRateLimit): errorMessage = QObject::tr("Docker error: The pull rate limit has been reached"); break;
-    case(ErrorCode::ServerLinuxKernelTooOld): errorMessage = QObject::tr("Server error: Linux kernel is too old"); break;
 
     // Libssh errors
     case(ErrorCode::SshRequestDeniedError): errorMessage = QObject::tr("SSH request was denied"); break;
@@ -80,15 +79,6 @@ QString errorString(ErrorCode code) {
     case (ErrorCode::ApiUpdateRequestError): errorMessage = QObject::tr("Please update the application to use this feature"); break;
     case (ErrorCode::ApiSubscriptionExpiredError): errorMessage = QObject::tr("Your Amnezia Premium subscription has expired.\n Please check your email for renewal instructions.\n If you haven't received an email, please contact our support."); break;
     case (ErrorCode::ApiPurchaseError): errorMessage = QObject::tr("Unable to process purchase"); break;
-    case (ErrorCode::ApiNoPurchasesToRestore):
-#if defined(Q_OS_ANDROID)
-        errorMessage = QObject::tr("No purchases to restore. If you have an active subscription, make sure you're signed in with the same Google account used for the purchase.");
-#elif defined(Q_OS_IOS) || defined(MACOS_NE)
-        errorMessage = QObject::tr("No purchases to restore. If you have an active subscription, make sure you're signed in with the same Apple ID used for the purchase.");
-#else
-        errorMessage = QObject::tr("No purchases to restore. If you have an active subscription, make sure you're signed in with the same account used for the purchase.");
-#endif
-        break;
 
     // QFile errors
     case(ErrorCode::OpenError): errorMessage = QObject::tr("QFile error: The file could not be opened"); break;
@@ -98,15 +88,6 @@ QString errorString(ErrorCode code) {
     case(ErrorCode::FatalError): errorMessage =  QObject::tr("QFile error: A fatal error occurred"); break;
     case(ErrorCode::AbortError): errorMessage =  QObject::tr("QFile error: The operation was aborted"); break;
 
-    // Billing errors
-    case(ErrorCode::BillingCanceled): errorMessage = QObject::tr("Transaction was canceled by the user"); break;
-    case(ErrorCode::BillingError): errorMessage = QObject::tr("Billing error"); break;
-    case(ErrorCode::BillingGooglePlayError): errorMessage = QObject::tr("Internal Google Play error, please try again later"); break;
-    case(ErrorCode::BillingUnavailable): errorMessage = QObject::tr("Billing is unavailable, please try again later"); break;
-    case(ErrorCode::SubscriptionAlreadyOwned): errorMessage = QObject::tr("You already own this subscription"); break;
-    case(ErrorCode::SubscriptionUnavailable): errorMessage = QObject::tr("The requested subscription is not available for purchase"); break;
-    case(ErrorCode::BillingNetworkError): errorMessage = QObject::tr("A network error occurred during the operation, please check the Internet connection"); break;
-
     case(ErrorCode::InternalError):
     default:
         errorMessage = QObject::tr("Internal error"); break;

client/core/ipcclient.cpp

@@ -7,6 +7,7 @@ IpcClient::IpcClient(QObject *parent) : QObject(parent)
 {
     m_node.connectToNode(QUrl("local:" + amnezia::getIpcServiceUrl()));
     m_interface.reset(m_node.acquire<IpcInterfaceReplica>());
+    m_tun2socks.reset(m_node.acquire<IpcProcessTun2SocksReplica>());
 }
 
 IpcClient& IpcClient::Instance()
@@ -32,43 +33,68 @@ QSharedPointer<IpcInterfaceReplica> IpcClient::Interface()
     return rep;
 }
 
-QSharedPointer<IpcProcessInterfaceReplica> IpcClient::CreatePrivilegedProcess()
+QSharedPointer<IpcProcessTun2SocksReplica> IpcClient::InterfaceTun2Socks()
 {
-    return withInterface([](QSharedPointer<IpcInterfaceReplica> &iface) -> QSharedPointer<IpcProcessInterfaceReplica> {
-        auto createPrivilegedProcess = iface->createPrivilegedProcess();
-        if (!createPrivilegedProcess.waitForFinished()) {
-            qCritical() << "Failed to create privileged process";
-            return nullptr;
-        }
-
-        const int pid = createPrivilegedProcess.returnValue();
-
-        auto* node = new QRemoteObjectNode();
-        node->connectToNode(QUrl(QString("local:%1").arg(amnezia::getIpcProcessUrl(pid))));
-
-        QSharedPointer<IpcProcessInterfaceReplica> rep(
-            node->acquire<IpcProcessInterfaceReplica>(),
-            [node] (IpcProcessInterfaceReplica *ptr) {
-                delete ptr;
-                node->deleteLater();
-            }
-        );
-        if (rep.isNull()) {
-            qCritical() << "IpcClient::CreatePrivilegedProcess(): Failed to acquire replica";
-            return nullptr;
-        }
-        if (!rep->waitForSource()) {
-            qCritical() << "IpcClient::CreatePrivilegedProcess(): Failed to initialize replica";
-            return nullptr;
-        }
-        if (!rep->isReplicaValid()) {
-            qCritical() << "IpcClient::CreatePrivilegedProcess(): Replica is invalid";
-            return nullptr;
-        }
-
-        return rep;
-    },
-    []() -> QSharedPointer<IpcProcessInterfaceReplica> {
+    QSharedPointer<IpcProcessTun2SocksReplica> rep = Instance().m_tun2socks;
+    if (rep.isNull()) {
+        qCritical() << "IpcClient::InterfaceTun2Socks: Replica is undefined";
         return nullptr;
-    });
+    }
+    if (!rep->waitForSource(1000)) {
+        qCritical() << "IpcClient::InterfaceTun2Socks: Failed to initialize replica";
+        return nullptr;
+    }
+    if (!rep->isReplicaValid()) {
+        qWarning() << "IpcClient::InterfaceTun2Socks(): Replica is invalid";
+    }
+    return rep;
+}
+
+QSharedPointer<PrivilegedProcess> IpcClient::CreatePrivilegedProcess()
+{
+    QSharedPointer<IpcInterfaceReplica> rep = Interface();
+    if (!rep) {
+        qCritical() << "IpcClient::createPrivilegedProcess: Replica is invalid";
+        return nullptr;
+    }
+
+    QRemoteObjectPendingReply<int> pidReply = rep->createPrivilegedProcess();
+    if (!pidReply.waitForFinished(5000)){
+        qCritical() << "IpcClient::createPrivilegedProcess: Failed to execute RO createPrivilegedProcess call";
+        return nullptr;
+    }
+
+    int pid = pidReply.returnValue();
+    QSharedPointer<ProcessDescriptor> pd(new ProcessDescriptor());
+
+    pd->localSocket.reset(new QLocalSocket(pd->replicaNode.data()));
+
+    connect(pd->localSocket.data(), &QLocalSocket::connected, pd->replicaNode.data(), [pd]() {
+        pd->replicaNode->addClientSideConnection(pd->localSocket.data());
+
+        IpcProcessInterfaceReplica *repl = pd->replicaNode->acquire<IpcProcessInterfaceReplica>();
+        // TODO: rework the unsafe cast below
+        PrivilegedProcess *priv = static_cast<PrivilegedProcess *>(repl);
+        pd->ipcProcess.reset(priv);
+        if (!pd->ipcProcess) {
+            qWarning() << "Acquire PrivilegedProcess failed";
+        } else {
+            pd->ipcProcess->waitForSource(1000);
+            if (!pd->ipcProcess->isReplicaValid()) {
+                qWarning() << "PrivilegedProcess replica is not connected!";
+            }
+
+            QObject::connect(pd->ipcProcess.data(), &PrivilegedProcess::destroyed, pd->ipcProcess.data(),
+                             [pd]() { pd->replicaNode->deleteLater(); });
+        }
+    });
+
+    pd->localSocket->connectToServer(amnezia::getIpcProcessUrl(pid));
+    if (!pd->localSocket->waitForConnected()) {
+        qCritical() << "IpcClient::createPrivilegedProcess: Failed to connect to process' socket";
+        return nullptr;
+    }
+
+    auto processReplica = QSharedPointer<PrivilegedProcess>(pd->ipcProcess);
+    return processReplica;
 }

client/core/ipcclient.h

@@ -5,7 +5,9 @@
 #include <QObject>
 
 #include "rep_ipc_interface_replica.h"
-#include "rep_ipc_process_interface_replica.h"
+#include "rep_ipc_process_tun2socks_replica.h"
+
+#include "privileged_process.h"
 
 class IpcClient : public QObject
 {
@@ -16,7 +18,8 @@ public:
     static IpcClient& Instance();
 
     static QSharedPointer<IpcInterfaceReplica> Interface();
-    static QSharedPointer<IpcProcessInterfaceReplica> CreatePrivilegedProcess();
+    static QSharedPointer<IpcProcessTun2SocksReplica> InterfaceTun2Socks();
+    static QSharedPointer<PrivilegedProcess> CreatePrivilegedProcess();
 
     template <typename Func>
     static auto withInterface(Func func)
@@ -51,6 +54,18 @@ signals:
 private:
     QRemoteObjectNode m_node;
     QSharedPointer<IpcInterfaceReplica> m_interface;
+    QSharedPointer<IpcProcessTun2SocksReplica> m_tun2socks;
+
+    struct ProcessDescriptor {
+        ProcessDescriptor () {
+            replicaNode = QSharedPointer<QRemoteObjectNode>(new QRemoteObjectNode());
+            ipcProcess = QSharedPointer<PrivilegedProcess>();
+            localSocket = QSharedPointer<QLocalSocket>();
+        }
+        QSharedPointer<PrivilegedProcess> ipcProcess;
+        QSharedPointer<QRemoteObjectNode> replicaNode;
+        QSharedPointer<QLocalSocket> localSocket;
+    };
 };
 
 #endif // IPCCLIENT_H

client/core/networkUtilities.cpp

@@ -44,6 +44,7 @@
 
 #include <QHostAddress>
 #include <QHostInfo>
+#include <QDebug>
 
 QRegularExpression NetworkUtilities::ipAddressRegExp()
 {

client/core/privileged_process.cpp

@@ -0,0 +1,27 @@
+#include "privileged_process.h"
+
+PrivilegedProcess::PrivilegedProcess() :
+    IpcProcessInterfaceReplica()
+{
+}
+
+PrivilegedProcess::~PrivilegedProcess()
+{
+    qDebug() << "PrivilegedProcess::~PrivilegedProcess()";
+}
+
+void PrivilegedProcess::waitForFinished(int msecs)
+{
+    QSharedPointer<QEventLoop> loop(new QEventLoop);
+    connect(this, &PrivilegedProcess::finished, this, [this, loop](int exitCode, QProcess::ExitStatus exitStatus) mutable{
+        loop->quit();
+        loop.clear();
+    });
+
+    QTimer::singleShot(msecs, this, [this, loop]() mutable {
+        loop->quit();
+        loop.clear();
+    });
+
+    loop->exec();
+}

client/core/privileged_process.h

@@ -0,0 +1,24 @@
+#ifndef PRIVILEGED_PROCESS_H
+#define PRIVILEGED_PROCESS_H
+
+#include <QObject>
+
+#include "rep_ipc_process_interface_replica.h"
+// This class is dangerous - instance of this class casted from base class,
+// so it support only functions
+// Do not add any members into it
+//
+class PrivilegedProcess : public IpcProcessInterfaceReplica
+{
+    Q_OBJECT
+public:
+    PrivilegedProcess();
+    ~PrivilegedProcess() override;
+
+    void waitForFinished(int msecs);
+
+};
+
+#endif // PRIVILEGED_PROCESS_H
+
+

client/core/serialization/vmess.cpp

@@ -170,7 +170,7 @@ QJsonObject Deserialize(const QString &vmessStr, QString *alias, QString *errMes
     //   - It can be empty, if so,           if the key is not in the JSON, or the value is empty,  report an error.
     //   - Else if it contains one thing.    if the key is not in the JSON, or the value is empty,  use that one.
     //   - Else if it contains many things,  when the key IS in the JSON but not within the THINGS, use the first in the THINGS
-    //   - Else -------------------------------------------- use the JSON value
+    //   - Else -------------------------------------------->>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>  use the JSON value
     //
 #define __vmess_checker__func(key, values)                                                                                                               \
     {                                                                                                                                                    \

client/core/transport/dns/dnsPacket.cpp

@@ -0,0 +1,153 @@
+#include "dnsPacket_p.h"
+
+#include <QHostInfo>
+#include <cstring>
+
+namespace amnezia::transport::dns::detail
+{
+
+QHostAddress resolveHostAddress(const QString &host)
+{
+    QHostAddress addr(host);
+    if (!addr.isNull()) return addr;
+    QHostInfo info = QHostInfo::fromName(host);
+    if (!info.addresses().isEmpty()) return info.addresses().first();
+    return QHostAddress();
+}
+
+QByteArray encodeDnsName(const QString &hostname)
+{
+    QByteArray result;
+    const QStringList parts = hostname.split('.');
+
+    for (const QString &part : parts) {
+        if (part.length() > 63) {
+            return QByteArray();
+        }
+        result.append(static_cast<char>(part.length()));
+        result.append(part.toUtf8());
+    }
+    result.append(static_cast<char>(0));
+    return result;
+}
+
+QByteArray buildDnsQuery(const QString &hostname, quint16 transactionId)
+{
+    QByteArray packet;
+
+    DnsHeader header;
+    header.id = qToBigEndian(transactionId);
+    header.flags = qToBigEndian<quint16>(0x0100);
+    header.qdcount = qToBigEndian<quint16>(1);
+    header.ancount = 0;
+    header.nscount = 0;
+    header.arcount = 0;
+
+    packet.append(reinterpret_cast<const char *>(&header), sizeof(DnsHeader));
+
+    const QByteArray qname = encodeDnsName(hostname);
+    if (qname.isEmpty()) {
+        return QByteArray();
+    }
+    packet.append(qname);
+
+    quint16 qtype = qToBigEndian<quint16>(DNS_TYPE_A);
+    packet.append(reinterpret_cast<const char *>(&qtype), sizeof(quint16));
+
+    quint16 qclass = qToBigEndian<quint16>(DNS_CLASS_IN);
+    packet.append(reinterpret_cast<const char *>(&qclass), sizeof(quint16));
+
+    return packet;
+}
+
+QString parseDnsResponse(const QByteArray &response, bool isTcp)
+{
+    if (response.size() < static_cast<int>(sizeof(DnsHeader))) {
+        return QString();
+    }
+
+    int offset = isTcp ? 2 : 0;
+    if (response.size() < offset + static_cast<int>(sizeof(DnsHeader))) {
+        return QString();
+    }
+
+    DnsHeader header;
+    std::memcpy(&header, response.constData() + offset, sizeof(DnsHeader));
+    offset += sizeof(DnsHeader);
+
+    const quint16 flags = qFromBigEndian(header.flags);
+    const quint16 ancount = qFromBigEndian(header.ancount);
+
+    if ((flags & 0x8000) == 0 || (flags & 0x000F) != 0) {
+        return QString();
+    }
+
+    if (ancount == 0) {
+        return QString();
+    }
+
+    while (offset < response.size() && response.at(offset) != 0) {
+        const quint8 length = static_cast<quint8>(response.at(offset));
+        if (length > 63) {
+            return QString();
+        }
+        offset += length + 1;
+    }
+    if (offset >= response.size()) {
+        return QString();
+    }
+    offset++;
+
+    offset += 4;
+
+    for (int i = 0; i < ancount && offset < response.size(); ++i) {
+        if (offset >= response.size()) {
+            break;
+        }
+
+        const quint8 nameByte = static_cast<quint8>(response.at(offset));
+        if ((nameByte & 0xC0) == 0xC0) {
+            offset += 2;
+        } else {
+            while (offset < response.size() && response.at(offset) != 0) {
+                const quint8 length = static_cast<quint8>(response.at(offset));
+                if (length > 63) {
+                    return QString();
+                }
+                offset += length + 1;
+            }
+            offset++;
+        }
+
+        if (offset + 10 > response.size()) {
+            break;
+        }
+
+        const quint16 type =
+                qFromBigEndian<quint16>(*reinterpret_cast<const quint16 *>(response.constData() + offset));
+        offset += 2;
+        offset += 2;
+        offset += 4;
+
+        const quint16 rdlength =
+                qFromBigEndian<quint16>(*reinterpret_cast<const quint16 *>(response.constData() + offset));
+        offset += 2;
+
+        if (type == DNS_TYPE_A && rdlength == 4) {
+            if (offset + 4 > response.size()) {
+                break;
+            }
+
+            QHostAddress ip;
+            ip.setAddress(
+                    qFromBigEndian<quint32>(*reinterpret_cast<const quint32 *>(response.constData() + offset)));
+            return ip.toString();
+        }
+
+        offset += rdlength;
+    }
+
+    return QString();
+}
+
+} // namespace amnezia::transport::dns::detail

client/core/transport/dns/dnsPacket_p.h

@@ -0,0 +1,38 @@
+#ifndef DNSPACKET_P_H
+#define DNSPACKET_P_H
+
+#include <QByteArray>
+#include <QHostAddress>
+#include <QString>
+#include <QtEndian>
+
+namespace amnezia::transport::dns::detail
+{
+
+constexpr quint16 DNS_PORT = 53;
+constexpr quint16 DNS_TYPE_A = 1;
+constexpr quint16 DNS_CLASS_IN = 1;
+
+#pragma pack(push, 1)
+struct DnsHeader
+{
+    quint16 id;
+    quint16 flags;
+    quint16 qdcount;
+    quint16 ancount;
+    quint16 nscount;
+    quint16 arcount;
+};
+#pragma pack(pop)
+
+QHostAddress resolveHostAddress(const QString &host);
+
+QByteArray encodeDnsName(const QString &hostname);
+
+QByteArray buildDnsQuery(const QString &hostname, quint16 transactionId);
+
+QString parseDnsResponse(const QByteArray &response, bool isTcp);
+
+} // namespace amnezia::transport::dns::detail
+
+#endif // DNSPACKET_P_H

client/core/transport/dns/dnsResolver.cpp

@@ -0,0 +1,354 @@
+#include "dnsResolver.h"
+
+#include "dnsPacket_p.h"
+
+#include <QDateTime>
+#include <QEventLoop>
+#include <QHostAddress>
+#include <QNetworkAccessManager>
+#include <QNetworkDatagram>
+#include <QNetworkReply>
+#include <QNetworkRequest>
+#include <QSslSocket>
+#include <QTcpSocket>
+#include <QTimer>
+#include <QUdpSocket>
+#include <QUrl>
+
+namespace amnezia::transport::dns::DnsResolver
+{
+
+using detail::buildDnsQuery;
+using detail::parseDnsResponse;
+using detail::resolveHostAddress;
+
+QString resolve(const QString &hostname,
+                const QString &dnsServer,
+                DnsProtocol protocol,
+                quint16 port,
+                int timeoutMsecs,
+                const QString &dohEndpoint)
+{
+    switch (protocol) {
+    case DnsProtocol::Udp:
+        return resolveOverUdp(hostname, dnsServer, port, timeoutMsecs);
+    case DnsProtocol::Tcp:
+        return resolveOverTcp(hostname, dnsServer, port, timeoutMsecs);
+    case DnsProtocol::Tls:
+        return resolveOverTls(hostname, dnsServer, port, timeoutMsecs);
+    case DnsProtocol::Https:
+        return resolveOverHttps(hostname, dnsServer, dohEndpoint, timeoutMsecs);
+    case DnsProtocol::Quic:
+        return resolveOverQuic(hostname, dnsServer, port, timeoutMsecs);
+    }
+    return QString();
+}
+
+QString resolveOverUdp(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    QUdpSocket socket;
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsQuery(hostname, transactionId);
+    if (query.isEmpty()) {
+        return QString();
+    }
+
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        return QString();
+    }
+
+    const qint64 bytesWritten = socket.writeDatagram(query, dnsAddress, port);
+    if (bytesWritten != query.size()) {
+        return QString();
+    }
+
+    QEventLoop loop;
+    QTimer timer;
+    timer.setSingleShot(true);
+    timer.setInterval(timeoutMsecs);
+
+    QByteArray response;
+    bool responseReceived = false;
+
+    QObject::connect(&timer, &QTimer::timeout, &loop, &QEventLoop::quit);
+    QObject::connect(&socket, &QUdpSocket::readyRead, [&]() {
+        while (socket.hasPendingDatagrams()) {
+            QNetworkDatagram datagram = socket.receiveDatagram();
+            if (datagram.isValid()) {
+                response = datagram.data();
+                responseReceived = true;
+                loop.quit();
+            }
+        }
+    });
+
+    timer.start();
+    loop.exec();
+    timer.stop();
+
+    if (!responseReceived || response.isEmpty()) {
+        return QString();
+    }
+
+    return parseDnsResponse(response, false);
+}
+
+QString resolveOverTcp(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    QTcpSocket socket;
+
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        return QString();
+    }
+
+    socket.connectToHost(dnsAddress, port);
+    if (!socket.waitForConnected(timeoutMsecs)) {
+        return QString();
+    }
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsQuery(hostname, transactionId);
+    if (query.isEmpty()) {
+        socket.close();
+        return QString();
+    }
+
+    quint16 length = qToBigEndian<quint16>(static_cast<quint16>(query.size()));
+    QByteArray tcpQuery;
+    tcpQuery.append(reinterpret_cast<const char *>(&length), sizeof(quint16));
+    tcpQuery.append(query);
+
+    const qint64 bytesWritten = socket.write(tcpQuery);
+    if (bytesWritten != tcpQuery.size() || !socket.waitForBytesWritten(timeoutMsecs)) {
+        socket.close();
+        return QString();
+    }
+
+    QEventLoop loop;
+    QTimer timer;
+    timer.setSingleShot(true);
+    timer.setInterval(timeoutMsecs);
+
+    QByteArray response;
+    bool responseReceived = false;
+
+    QObject::connect(&timer, &QTimer::timeout, &loop, &QEventLoop::quit);
+    QObject::connect(&socket, &QTcpSocket::readyRead, [&]() {
+        if (socket.bytesAvailable() >= 2 && response.isEmpty()) {
+            QByteArray lengthBytes = socket.read(2);
+            if (lengthBytes.size() == 2) {
+                const quint16 responseLength =
+                        qFromBigEndian<quint16>(*reinterpret_cast<const quint16 *>(lengthBytes.constData()));
+                while (socket.bytesAvailable() < responseLength) {
+                    if (!socket.waitForReadyRead(timeoutMsecs / 2)) {
+                        break;
+                    }
+                }
+                if (socket.bytesAvailable() >= responseLength) {
+                    response = socket.read(responseLength);
+                    responseReceived = true;
+                    loop.quit();
+                }
+            }
+        }
+    });
+
+    timer.start();
+    loop.exec();
+    timer.stop();
+
+    socket.close();
+
+    if (!responseReceived || response.isEmpty()) {
+        return QString();
+    }
+
+    return parseDnsResponse(response, true);
+}
+
+QString resolveOverTls(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    QSslSocket socket;
+
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        return QString();
+    }
+
+    socket.setPeerVerifyMode(QSslSocket::QueryPeer);
+    socket.connectToHostEncrypted(dnsAddress.toString(), port);
+
+    if (!socket.waitForConnected(timeoutMsecs)) {
+        return QString();
+    }
+
+    if (!socket.waitForEncrypted(timeoutMsecs)) {
+        socket.close();
+        return QString();
+    }
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsQuery(hostname, transactionId);
+    if (query.isEmpty()) {
+        socket.close();
+        return QString();
+    }
+
+    quint16 length = qToBigEndian<quint16>(static_cast<quint16>(query.size()));
+    QByteArray tlsQuery;
+    tlsQuery.append(reinterpret_cast<const char *>(&length), sizeof(quint16));
+    tlsQuery.append(query);
+
+    const qint64 bytesWritten = socket.write(tlsQuery);
+    if (bytesWritten != tlsQuery.size() || !socket.waitForBytesWritten(timeoutMsecs)) {
+        socket.close();
+        return QString();
+    }
+
+    QEventLoop loop;
+    QTimer timer;
+    timer.setSingleShot(true);
+    timer.setInterval(timeoutMsecs);
+
+    QByteArray response;
+    bool responseReceived = false;
+
+    QObject::connect(&timer, &QTimer::timeout, &loop, &QEventLoop::quit);
+    QObject::connect(&socket, &QSslSocket::readyRead, [&]() {
+        if (socket.bytesAvailable() >= 2 && response.isEmpty()) {
+            QByteArray lengthBytes = socket.read(2);
+            if (lengthBytes.size() == 2) {
+                const quint16 responseLength =
+                        qFromBigEndian<quint16>(*reinterpret_cast<const quint16 *>(lengthBytes.constData()));
+                while (socket.bytesAvailable() < responseLength) {
+                    if (!socket.waitForReadyRead(timeoutMsecs / 2)) {
+                        break;
+                    }
+                }
+                if (socket.bytesAvailable() >= responseLength) {
+                    response = socket.read(responseLength);
+                    responseReceived = true;
+                    loop.quit();
+                }
+            }
+        }
+    });
+
+    timer.start();
+    loop.exec();
+    timer.stop();
+
+    socket.close();
+
+    if (!responseReceived || response.isEmpty()) {
+        return QString();
+    }
+
+    return parseDnsResponse(response, true);
+}
+
+QString resolveOverHttps(const QString &hostname, const QString &dnsServer, const QString &endpoint, int timeoutMsecs)
+{
+    const QString dohUrl = QStringLiteral("https://%1%2").arg(dnsServer, endpoint);
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsQuery(hostname, transactionId);
+    if (query.isEmpty()) {
+        return QString();
+    }
+
+    QNetworkRequest request;
+    request.setUrl(QUrl(dohUrl));
+    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/dns-message");
+    request.setRawHeader("Accept", "application/dns-message");
+    request.setTransferTimeout(timeoutMsecs);
+
+    QNetworkAccessManager nam;
+    QNetworkReply *reply = nam.post(request, query);
+
+    QEventLoop loop;
+    QTimer timer;
+    timer.setSingleShot(true);
+    timer.setInterval(timeoutMsecs);
+
+    QByteArray response;
+    bool responseReceived = false;
+
+    QObject::connect(&timer, &QTimer::timeout, &loop, &QEventLoop::quit);
+    QObject::connect(reply, &QNetworkReply::finished, [&]() {
+        if (reply->error() == QNetworkReply::NoError) {
+            response = reply->readAll();
+            responseReceived = true;
+        }
+        loop.quit();
+    });
+
+    timer.start();
+    loop.exec();
+    timer.stop();
+
+    reply->deleteLater();
+
+    if (!responseReceived || response.isEmpty()) {
+        return QString();
+    }
+
+    return parseDnsResponse(response, false);
+}
+
+QString resolveOverQuic(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    // QUIC требует специальной библиотеки — пока используем UDP fallback
+    QUdpSocket socket;
+
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        return QString();
+    }
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsQuery(hostname, transactionId);
+    if (query.isEmpty()) {
+        return QString();
+    }
+
+    const qint64 bytesWritten = socket.writeDatagram(query, dnsAddress, port);
+    if (bytesWritten != query.size()) {
+        return QString();
+    }
+
+    QEventLoop loop;
+    QTimer timer;
+    timer.setSingleShot(true);
+    timer.setInterval(timeoutMsecs);
+
+    QByteArray response;
+    bool responseReceived = false;
+
+    QObject::connect(&timer, &QTimer::timeout, &loop, &QEventLoop::quit);
+    QObject::connect(&socket, &QUdpSocket::readyRead, [&]() {
+        while (socket.hasPendingDatagrams()) {
+            QNetworkDatagram datagram = socket.receiveDatagram();
+            if (datagram.isValid()) {
+                response = datagram.data();
+                responseReceived = true;
+                loop.quit();
+            }
+        }
+    });
+
+    timer.start();
+    loop.exec();
+    timer.stop();
+
+    if (!responseReceived || response.isEmpty()) {
+        return QString();
+    }
+
+    return parseDnsResponse(response, false);
+}
+
+} // namespace amnezia::transport::dns::DnsResolver

client/core/transport/dns/dnsResolver.h

@@ -0,0 +1,29 @@
+#ifndef DNSRESOLVER_H
+#define DNSRESOLVER_H
+
+#include <QString>
+
+namespace amnezia::transport::dns
+{
+
+enum class DnsProtocol { Udp, Tcp, Tls, Https, Quic };
+
+namespace DnsResolver
+{
+    QString resolve(const QString &hostname,
+                    const QString &dnsServer,
+                    DnsProtocol protocol,
+                    quint16 port,
+                    int timeoutMsecs = 3000,
+                    const QString &dohEndpoint = QStringLiteral("/dns-query"));
+
+    QString resolveOverUdp(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs = 3000);
+    QString resolveOverTcp(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs = 3000);
+    QString resolveOverTls(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs = 3000);
+    QString resolveOverHttps(const QString &hostname, const QString &dnsServer, const QString &endpoint, int timeoutMsecs = 3000);
+    QString resolveOverQuic(const QString &hostname, const QString &dnsServer, quint16 port, int timeoutMsecs = 3000);
+} // namespace DnsResolver
+
+} // namespace amnezia::transport::dns
+
+#endif // DNSRESOLVER_H

client/core/transport/dns/dnsTunnel.cpp

@@ -0,0 +1,817 @@
+#include "dnsTunnel.h"
+
+#include "dnsPacket_p.h"
+
+#include <QDateTime>
+#include <QDebug>
+#include <QElapsedTimer>
+#include <QEventLoop>
+#include <QHostAddress>
+#include <QList>
+#include <QMap>
+#include <QNetworkAccessManager>
+#include <QNetworkDatagram>
+#include <QNetworkReply>
+#include <QNetworkRequest>
+#include <QSharedPointer>
+#include <QSslError>
+#include <QSslSocket>
+#include <QStringList>
+#include <QTcpSocket>
+#include <QThread>
+#include <QTimer>
+#include <QUdpSocket>
+#include <QUrl>
+
+namespace amnezia::transport::dns::DnsTunnel
+{
+
+using detail::resolveHostAddress;
+
+namespace
+{
+    constexpr quint16 EDNS0_PAYLOAD_OPTION_CODE = 65001;
+    constexpr quint16 EDNS0_CHUNK_REQUEST_CODE = 65002;
+    constexpr quint16 EDNS0_CHUNK_RESPONSE_CODE = 65003;
+
+    struct ChunkMeta
+    {
+        QByteArray chunkId;
+        quint16 totalChunks = 0;
+        quint16 chunkIndex = 0;
+        quint32 totalSize = 0;
+    };
+
+    void appendUint16BE(QByteArray &data, quint16 value)
+    {
+        data.append(static_cast<char>((value >> 8) & 0xFF));
+        data.append(static_cast<char>(value & 0xFF));
+    }
+
+    QByteArray buildDnsChunkRequest(const QString &queryName, quint16 transactionId,
+                                    const QByteArray &chunkId, quint16 chunkIndex)
+    {
+        QByteArray query;
+
+        appendUint16BE(query, transactionId);
+        appendUint16BE(query, 0x0100);
+        appendUint16BE(query, 1);
+        appendUint16BE(query, 0);
+        appendUint16BE(query, 0);
+        appendUint16BE(query, 1);
+
+        const QStringList labels = queryName.split('.');
+        for (const QString &label : labels) {
+            QByteArray labelBytes = label.toUtf8();
+            query.append(static_cast<char>(labelBytes.size()));
+            query.append(labelBytes);
+        }
+        query.append(static_cast<char>(0));
+        appendUint16BE(query, 16);
+        appendUint16BE(query, 1);
+
+        const quint16 optionDataLen = 4 + 18;
+
+        query.append(static_cast<char>(0));
+        appendUint16BE(query, 41);
+        appendUint16BE(query, 4096);
+        query.append(static_cast<char>(0));
+        query.append(static_cast<char>(0));
+        appendUint16BE(query, 0);
+        appendUint16BE(query, optionDataLen);
+
+        appendUint16BE(query, EDNS0_CHUNK_REQUEST_CODE);
+        appendUint16BE(query, 18);
+        query.append(chunkId.left(16).leftJustified(16, '\0'));
+        appendUint16BE(query, chunkIndex);
+
+        return query;
+    }
+
+    ChunkMeta parseChunkMeta(const QByteArray &response)
+    {
+        ChunkMeta meta;
+
+        if (response.size() < 12) return meta;
+
+        const quint8 *data = reinterpret_cast<const quint8 *>(response.constData());
+
+        const quint16 qdCount = (data[4] << 8) | data[5];
+        const quint16 anCount = (data[6] << 8) | data[7];
+        const quint16 nsCount = (data[8] << 8) | data[9];
+        const quint16 arCount = (data[10] << 8) | data[11];
+
+        int pos = 12;
+
+        auto skipDnsName = [&]() -> bool {
+            int maxLabels = 128;
+            while (pos < response.size() && data[pos] != 0 && maxLabels-- > 0) {
+                if ((data[pos] & 0xC0) == 0xC0) {
+                    pos += 2;
+                    return pos <= response.size();
+                }
+                const int labelLen = data[pos];
+                if (pos + 1 + labelLen > response.size()) return false;
+                pos += labelLen + 1;
+            }
+            if (pos < response.size() && data[pos] == 0) pos++;
+            return pos <= response.size();
+        };
+
+        for (int i = 0; i < qdCount && pos < response.size(); ++i) {
+            if (!skipDnsName()) return meta;
+            if (pos + 4 > response.size()) return meta;
+            pos += 4;
+        }
+
+        for (int i = 0; i < anCount && pos < response.size(); ++i) {
+            if (!skipDnsName()) return meta;
+            if (pos + 10 > response.size()) return meta;
+            const quint16 rdlen = (data[pos + 8] << 8) | data[pos + 9];
+            if (pos + 10 + rdlen > response.size()) return meta;
+            pos += 10 + rdlen;
+        }
+
+        for (int i = 0; i < nsCount && pos < response.size(); ++i) {
+            if (!skipDnsName()) return meta;
+            if (pos + 10 > response.size()) return meta;
+            const quint16 rdlen = (data[pos + 8] << 8) | data[pos + 9];
+            if (pos + 10 + rdlen > response.size()) return meta;
+            pos += 10 + rdlen;
+        }
+
+        for (int i = 0; i < arCount && pos < response.size(); ++i) {
+            if (pos < response.size() && data[pos] == 0) {
+                pos++;
+            } else {
+                if (!skipDnsName()) return meta;
+            }
+
+            if (pos + 10 > response.size()) return meta;
+
+            const quint16 rtype = (data[pos] << 8) | data[pos + 1];
+            const quint16 rdlen = (data[pos + 8] << 8) | data[pos + 9];
+            if (pos + 10 + rdlen > response.size()) return meta;
+            pos += 10;
+
+            if (rtype == 41 && rdlen > 0) {
+                const int optEnd = pos + rdlen;
+                while (pos + 4 <= optEnd) {
+                    const quint16 optCode = (data[pos] << 8) | data[pos + 1];
+                    const quint16 optLen = (data[pos + 2] << 8) | data[pos + 3];
+                    pos += 4;
+
+                    if (optCode == EDNS0_CHUNK_RESPONSE_CODE && optLen >= 24) {
+                        meta.chunkId = QByteArray(reinterpret_cast<const char *>(data + pos), 16);
+                        meta.totalChunks = (data[pos + 16] << 8) | data[pos + 17];
+                        meta.chunkIndex = (data[pos + 18] << 8) | data[pos + 19];
+                        meta.totalSize = (static_cast<quint32>(data[pos + 20]) << 24)
+                                | (static_cast<quint32>(data[pos + 21]) << 16)
+                                | (static_cast<quint32>(data[pos + 22]) << 8) | data[pos + 23];
+                        return meta;
+                    }
+                    pos += optLen;
+                }
+            } else {
+                pos += rdlen;
+            }
+        }
+
+        return meta;
+    }
+
+    QByteArray buildDnsTxtQueryWithPayload(const QString &queryName, quint16 transactionId, const QByteArray &payload)
+    {
+        QByteArray query;
+
+        appendUint16BE(query, transactionId);
+        appendUint16BE(query, 0x0100);
+        appendUint16BE(query, 1);
+        appendUint16BE(query, 0);
+        appendUint16BE(query, 0);
+        appendUint16BE(query, 1);
+
+        const QStringList labels = queryName.split('.');
+        for (const QString &label : labels) {
+            QByteArray labelBytes = label.toUtf8();
+            query.append(static_cast<char>(labelBytes.size()));
+            query.append(labelBytes);
+        }
+        query.append(static_cast<char>(0));
+        appendUint16BE(query, 16);
+        appendUint16BE(query, 1);
+
+        const QByteArray payloadBase64 = payload.toBase64();
+        const quint16 optionDataLen = 4 + payloadBase64.size();
+
+        query.append(static_cast<char>(0));
+        appendUint16BE(query, 41);
+        appendUint16BE(query, 4096);
+        query.append(static_cast<char>(0));
+        query.append(static_cast<char>(0));
+        appendUint16BE(query, 0);
+        appendUint16BE(query, optionDataLen);
+
+        appendUint16BE(query, EDNS0_PAYLOAD_OPTION_CODE);
+        appendUint16BE(query, payloadBase64.size());
+        query.append(payloadBase64);
+
+        return query;
+    }
+
+    QByteArray parseDnsTxtResponse(const QByteArray &response)
+    {
+        if (response.size() < 12) {
+            return QByteArray();
+        }
+
+        const uchar *data = reinterpret_cast<const uchar *>(response.constData());
+        int pos = 0;
+
+        pos += 2;
+        const quint16 flags = (data[pos] << 8) | data[pos + 1]; pos += 2;
+        const quint16 qdCount = (data[pos] << 8) | data[pos + 1]; pos += 2;
+        const quint16 anCount = (data[pos] << 8) | data[pos + 1]; pos += 2;
+        pos += 2;
+        pos += 2;
+
+        if ((flags & 0x8000) == 0) {
+            return QByteArray();
+        }
+
+        if (anCount > 100 || qdCount > 10) {
+            return QByteArray();
+        }
+
+        auto skipDnsName = [&]() -> bool {
+            int maxLabels = 128;
+            while (pos < response.size() && data[pos] != 0 && maxLabels-- > 0) {
+                if ((data[pos] & 0xC0) == 0xC0) {
+                    pos += 2;
+                    return pos <= response.size();
+                }
+                const int labelLen = data[pos];
+                if (pos + 1 + labelLen > response.size()) return false;
+                pos += labelLen + 1;
+            }
+            if (pos < response.size() && data[pos] == 0) pos++;
+            return pos <= response.size();
+        };
+
+        for (int i = 0; i < qdCount && pos < response.size(); ++i) {
+            if (!skipDnsName()) {
+                return QByteArray();
+            }
+            if (pos + 4 > response.size()) return QByteArray();
+            pos += 4;
+        }
+
+        QByteArray combinedTxt;
+        for (int i = 0; i < anCount && pos < response.size(); ++i) {
+            if (!skipDnsName()) {
+                break;
+            }
+
+            if (pos + 10 > response.size()) {
+                break;
+            }
+
+            const quint16 rtype = (data[pos] << 8) | data[pos + 1]; pos += 2;
+            pos += 2; // class
+            pos += 4; // ttl
+            const quint16 rdlength = (data[pos] << 8) | data[pos + 1]; pos += 2;
+
+            if (pos + rdlength > response.size()) {
+                break;
+            }
+
+            if (rtype == 16) {
+                const int rdEnd = pos + rdlength;
+                while (pos < rdEnd && pos < response.size()) {
+                    const quint8 txtLen = data[pos++];
+                    if (txtLen > 0 && pos + txtLen <= rdEnd && pos + txtLen <= response.size()) {
+                        combinedTxt.append(reinterpret_cast<const char *>(data + pos), txtLen);
+                        pos += txtLen;
+                    } else {
+                        break;
+                    }
+                }
+            } else {
+                pos += rdlength;
+            }
+        }
+
+        if (combinedTxt.isEmpty()) {
+            return QByteArray();
+        }
+
+        return QByteArray::fromBase64(combinedTxt);
+    }
+} // namespace
+
+QByteArray send(const QByteArray &payload,
+                const QString &endpointName,
+                const QString &baseDomain,
+                const QString &dnsServer,
+                DnsProtocol protocol,
+                quint16 port,
+                int timeoutMsecs,
+                const QString &dohEndpoint)
+{
+    const QString queryName = QStringLiteral("%1.%2").arg(endpointName, baseDomain);
+
+    switch (protocol) {
+    case DnsProtocol::Udp:
+        return sendOverUdpChunked(payload, queryName, dnsServer, port, timeoutMsecs);
+    case DnsProtocol::Tcp:
+        return sendOverTcp(payload, queryName, dnsServer, port, timeoutMsecs);
+    case DnsProtocol::Tls:
+        return sendOverTls(payload, queryName, dnsServer, port, timeoutMsecs);
+    case DnsProtocol::Https:
+        return sendOverHttps(payload, queryName, dnsServer, port, dohEndpoint, timeoutMsecs);
+    case DnsProtocol::Quic:
+        return QByteArray();
+    }
+    return QByteArray();
+}
+
+QByteArray sendOverUdp(const QByteArray &payload, const QString &queryName,
+                       const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    QUdpSocket socket;
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsTxtQueryWithPayload(queryName, transactionId, payload);
+
+    if (query.isEmpty()) {
+        return QByteArray();
+    }
+
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        return QByteArray();
+    }
+
+    const qint64 bytesWritten = socket.writeDatagram(query, dnsAddress, port);
+    if (bytesWritten != query.size()) {
+        return QByteArray();
+    }
+
+    QElapsedTimer timer;
+    timer.start();
+
+    while (timer.elapsed() < timeoutMsecs) {
+        if (socket.waitForReadyRead(qMax(1, timeoutMsecs - static_cast<int>(timer.elapsed())))) {
+            while (socket.hasPendingDatagrams()) {
+                QNetworkDatagram datagram = socket.receiveDatagram();
+                if (datagram.isValid()) {
+                    return parseDnsTxtResponse(datagram.data());
+                }
+            }
+        }
+    }
+
+    return QByteArray();
+}
+
+QByteArray sendOverTcp(const QByteArray &payload, const QString &queryName,
+                       const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    qDebug() << "[DNS-TCP] start: queryName=" << queryName << "server=" << dnsServer
+             << "port=" << port << "payloadBytes=" << payload.size();
+    QTcpSocket socket;
+
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        qWarning() << "[DNS-TCP] failed to resolve" << dnsServer;
+        return QByteArray();
+    }
+
+    socket.connectToHost(dnsAddress, port);
+    if (!socket.waitForConnected(timeoutMsecs)) {
+        qWarning() << "[DNS-TCP] connect failed:" << socket.errorString();
+        return QByteArray();
+    }
+    qDebug() << "[DNS-TCP] connected";
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsTxtQueryWithPayload(queryName, transactionId, payload);
+
+    if (query.isEmpty()) {
+        qWarning() << "[DNS-TCP] failed to build DNS query";
+        socket.close();
+        return QByteArray();
+    }
+    qDebug() << "[DNS-TCP] built DNS query bytes=" << query.size() << "txid=" << transactionId;
+    quint16 length = qToBigEndian<quint16>(static_cast<quint16>(query.size()));
+    QByteArray tcpQuery;
+    tcpQuery.append(reinterpret_cast<const char *>(&length), sizeof(quint16));
+    tcpQuery.append(query);
+
+    const qint64 bytesWritten = socket.write(tcpQuery);
+    qDebug() << "[DNS-TCP] wrote bytes=" << bytesWritten << "/ expected=" << tcpQuery.size();
+    if (bytesWritten != tcpQuery.size() || !socket.waitForBytesWritten(timeoutMsecs)) {
+        qWarning() << "[DNS-TCP] write failed:" << socket.errorString();
+        socket.close();
+        return QByteArray();
+    }
+
+    QElapsedTimer timer;
+    timer.start();
+
+    while (socket.bytesAvailable() < 2) {
+        const int remaining = timeoutMsecs - timer.elapsed();
+        if (remaining <= 0 || !socket.waitForReadyRead(remaining)) {
+            qWarning() << "[DNS-TCP] timeout waiting for response length, socketState="
+                       << socket.state() << "err=" << socket.errorString()
+                       << "bytesAvailable=" << socket.bytesAvailable();
+            socket.close();
+            return QByteArray();
+        }
+    }
+
+    QByteArray lengthBytes = socket.read(2);
+    if (lengthBytes.size() != 2) {
+        qWarning() << "[DNS-TCP] could not read length prefix";
+        socket.close();
+        return QByteArray();
+    }
+
+    const quint16 responseLength =
+            qFromBigEndian<quint16>(*reinterpret_cast<const quint16 *>(lengthBytes.constData()));
+    qDebug() << "[DNS-TCP] response length prefix=" << responseLength;
+
+    QByteArray response;
+    while (response.size() < responseLength) {
+        const int remaining = timeoutMsecs - timer.elapsed();
+        if (remaining <= 0) {
+            qWarning() << "[DNS-TCP] timeout reading body, got" << response.size() << "/" << responseLength;
+            socket.close();
+            return QByteArray();
+        }
+
+        if (socket.bytesAvailable() > 0) {
+            response.append(socket.read(responseLength - response.size()));
+        } else if (!socket.waitForReadyRead(remaining)) {
+            qWarning() << "[DNS-TCP] timeout in waitForReadyRead, got" << response.size() << "/" << responseLength;
+            socket.close();
+            return QByteArray();
+        }
+    }
+
+    qDebug() << "[DNS-TCP] full response read, bytes=" << response.size();
+    socket.close();
+    QByteArray parsed = parseDnsTxtResponse(response);
+    qDebug() << "[DNS-TCP] parsed TXT payload bytes=" << parsed.size();
+    return parsed;
+}
+
+QByteArray sendOverTls(const QByteArray &payload, const QString &queryName,
+                       const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    QSslSocket socket;
+#ifdef AGW_INSECURE_SSL
+    socket.setPeerVerifyMode(QSslSocket::VerifyNone);
+    QObject::connect(&socket, QOverload<const QList<QSslError> &>::of(&QSslSocket::sslErrors),
+                     &socket, [&socket](const QList<QSslError> &errs) {
+                         qWarning() << "[DoT] sslErrors (ignored, AGW_INSECURE_SSL=1):" << errs;
+                         socket.ignoreSslErrors();
+                     });
+#else
+    socket.setPeerVerifyMode(QSslSocket::VerifyPeer);
+#endif
+
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        qWarning() << "[DoT] failed to resolve" << dnsServer;
+        return QByteArray();
+    }
+
+    socket.connectToHostEncrypted(dnsServer, port);
+    if (!socket.waitForEncrypted(timeoutMsecs)) {
+        qWarning() << "[DoT] handshake failed:" << socket.errorString();
+        return QByteArray();
+    }
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray query = buildDnsTxtQueryWithPayload(queryName, transactionId, payload);
+
+    if (query.isEmpty()) {
+        socket.close();
+        return QByteArray();
+    }
+
+    quint16 length = qToBigEndian<quint16>(static_cast<quint16>(query.size()));
+    QByteArray tcpQuery;
+    tcpQuery.append(reinterpret_cast<const char *>(&length), sizeof(quint16));
+    tcpQuery.append(query);
+
+    const qint64 bytesWritten = socket.write(tcpQuery);
+    if (bytesWritten != tcpQuery.size() || !socket.waitForBytesWritten(timeoutMsecs)) {
+        socket.close();
+        return QByteArray();
+    }
+
+    QElapsedTimer timer;
+    timer.start();
+
+    while (socket.bytesAvailable() < 2) {
+        const int remaining = timeoutMsecs - timer.elapsed();
+        if (remaining <= 0 || !socket.waitForReadyRead(remaining)) {
+            socket.close();
+            return QByteArray();
+        }
+    }
+
+    QByteArray lengthBytes = socket.read(2);
+    if (lengthBytes.size() != 2) {
+        socket.close();
+        return QByteArray();
+    }
+
+    const quint16 responseLength =
+            qFromBigEndian<quint16>(*reinterpret_cast<const quint16 *>(lengthBytes.constData()));
+
+    QByteArray response;
+    while (response.size() < responseLength) {
+        const int remaining = timeoutMsecs - timer.elapsed();
+        if (remaining <= 0) {
+            socket.close();
+            return QByteArray();
+        }
+
+        if (socket.bytesAvailable() > 0) {
+            response.append(socket.read(responseLength - response.size()));
+        } else if (!socket.waitForReadyRead(remaining)) {
+            socket.close();
+            return QByteArray();
+        }
+    }
+
+    socket.close();
+    return parseDnsTxtResponse(response);
+}
+
+QByteArray sendOverHttps(const QByteArray &payload, const QString &queryName,
+                         const QString &dnsServer, quint16 port, const QString &endpoint, int timeoutMsecs)
+{
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray dnsQuery = buildDnsTxtQueryWithPayload(queryName, transactionId, payload);
+
+    qDebug() << "[DoH] queryName=" << queryName << "payloadBytes=" << payload.size()
+             << "dnsQueryBytes=" << dnsQuery.size() << "txid=" << transactionId;
+
+    if (dnsQuery.isEmpty()) {
+        qWarning() << "[DoH] failed to build DNS query (payload too big or queryName invalid)";
+        return QByteArray();
+    }
+
+    const QString scheme = (port == 443) ? QStringLiteral("https") : QStringLiteral("http");
+    const QString url = QStringLiteral("%1://%2:%3%4").arg(scheme).arg(dnsServer).arg(port).arg(endpoint);
+
+    qDebug() << "[DoH] POST" << url << "timeoutMs=" << timeoutMsecs;
+
+    QNetworkRequest request((QUrl(url)));
+    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/dns-message");
+    request.setRawHeader("Accept", "application/dns-message");
+    request.setTransferTimeout(timeoutMsecs);
+
+    QNetworkAccessManager manager;
+    QNetworkReply *reply = manager.post(request, dnsQuery);
+
+    QObject::connect(reply, &QNetworkReply::sslErrors, reply,
+                     [reply](const QList<QSslError> &errs) {
+                         qWarning() << "[DoH] sslErrors:" << errs;
+#ifdef AGW_INSECURE_SSL
+                         qWarning() << "[DoH] AGW_INSECURE_SSL=1, ignoring SSL errors";
+                         reply->ignoreSslErrors();
+#endif
+                     });
+
+    QEventLoop loop;
+    QObject::connect(reply, &QNetworkReply::finished, &loop, &QEventLoop::quit);
+
+    QTimer::singleShot(timeoutMsecs, &loop, &QEventLoop::quit);
+    loop.exec();
+
+    if (!reply->isFinished()) {
+        qWarning() << "[DoH] timeout after" << timeoutMsecs << "ms, aborting";
+        reply->abort();
+        reply->deleteLater();
+        return QByteArray();
+    }
+
+    if (reply->error() != QNetworkReply::NoError) {
+        qWarning() << "[DoH] reply error:" << reply->error() << reply->errorString()
+                   << "httpStatus=" << reply->attribute(QNetworkRequest::HttpStatusCodeAttribute);
+        reply->deleteLater();
+        return QByteArray();
+    }
+
+    QByteArray response = reply->readAll();
+    qDebug() << "[DoH] raw HTTP response bytes=" << response.size()
+             << "httpStatus=" << reply->attribute(QNetworkRequest::HttpStatusCodeAttribute);
+    reply->deleteLater();
+
+    if (response.isEmpty()) {
+        qWarning() << "[DoH] empty HTTP response body";
+        return QByteArray();
+    }
+
+    QByteArray parsed = parseDnsTxtResponse(response);
+    qDebug() << "[DoH] parsed TXT payload bytes=" << parsed.size();
+    return parsed;
+}
+
+QByteArray sendOverUdpChunked(const QByteArray &payload, const QString &queryName,
+                              const QString &dnsServer, quint16 port, int timeoutMsecs)
+{
+    qDebug() << "[DNS-UDP] start: queryName=" << queryName << "server=" << dnsServer
+             << "port=" << port << "payloadBytes=" << payload.size() << "timeoutMs=" << timeoutMsecs;
+    const QHostAddress dnsAddress = resolveHostAddress(dnsServer);
+    if (dnsAddress.isNull()) {
+        qWarning() << "[DNS-UDP] failed to resolve" << dnsServer;
+        return QByteArray();
+    }
+    qDebug() << "[DNS-UDP] resolved to" << dnsAddress.toString();
+
+    constexpr int MAX_INITIAL_RETRIES = 3;
+    constexpr int MAX_CHUNK_RETRIES = 2;
+    constexpr int MAX_CONCURRENT_REQUESTS = 5;
+    constexpr int BASE_TIMEOUT_MS = 2000;
+
+    auto sendUdpRequestWithTimeout = [&](const QByteArray &query, int requestTimeoutMs) -> QByteArray {
+        QUdpSocket socket;
+        const qint64 written = socket.writeDatagram(query, dnsAddress, port);
+        if (written != query.size()) {
+            return QByteArray();
+        }
+
+        QElapsedTimer timer;
+        timer.start();
+
+        while (timer.elapsed() < requestTimeoutMs) {
+            if (socket.waitForReadyRead(qMax(1, requestTimeoutMs - static_cast<int>(timer.elapsed())))) {
+                while (socket.hasPendingDatagrams()) {
+                    QNetworkDatagram datagram = socket.receiveDatagram();
+                    if (datagram.isValid()) {
+                        return datagram.data();
+                    }
+                }
+            }
+        }
+
+        return QByteArray();
+    };
+
+    auto sendWithRetry = [&](const QByteArray &query, int maxRetries) -> QByteArray {
+        for (int attempt = 0; attempt < maxRetries; ++attempt) {
+            const int timeout = BASE_TIMEOUT_MS * (attempt + 1);
+            QByteArray response = sendUdpRequestWithTimeout(query, timeout);
+            if (!response.isEmpty()) {
+                return response;
+            }
+
+            if (attempt < maxRetries - 1) {
+                QThread::msleep(timeout / 2);
+            }
+        }
+        return QByteArray();
+    };
+
+    const quint16 transactionId = static_cast<quint16>(QDateTime::currentMSecsSinceEpoch() & 0xFFFF);
+    const QByteArray initialQuery = buildDnsTxtQueryWithPayload(queryName, transactionId, payload);
+
+    qDebug() << "[DNS-UDP] initialQuery size=" << initialQuery.size() << "txid=" << transactionId;
+
+    if (initialQuery.isEmpty()) {
+        qWarning() << "[DNS-UDP] failed to build initial query (payload too big or queryName invalid)";
+        return QByteArray();
+    }
+
+    const QByteArray firstResponse = sendWithRetry(initialQuery, MAX_INITIAL_RETRIES);
+    qDebug() << "[DNS-UDP] first response size=" << firstResponse.size();
+
+    if (firstResponse.isEmpty()) {
+        qWarning() << "[DNS-UDP] no response from server after" << MAX_INITIAL_RETRIES << "retries";
+        return QByteArray();
+    }
+
+    const ChunkMeta meta = parseChunkMeta(firstResponse);
+    const QByteArray firstTxtData = parseDnsTxtResponse(firstResponse);
+
+    qDebug() << "[DNS-UDP] meta totalChunks=" << meta.totalChunks
+             << "chunkId=" << meta.chunkId << "firstTxtData size=" << firstTxtData.size();
+
+    if (firstTxtData.isEmpty()) {
+        qWarning() << "[DNS-UDP] failed to parse TXT data from first response";
+        return QByteArray();
+    }
+
+    if (meta.totalChunks <= 1) {
+        qDebug() << "[DNS-UDP] single chunk, returning" << firstTxtData.size() << "bytes";
+        return firstTxtData;
+    }
+
+    QMap<int, QByteArray> chunks;
+    chunks[0] = firstTxtData;
+
+    auto requestChunksBatch = [&](const QList<int> &chunkIndices, int batchTimeout) {
+        if (chunkIndices.isEmpty()) return;
+
+        QList<QSharedPointer<QUdpSocket>> sockets;
+        QMap<QUdpSocket *, int> socketToIndex;
+
+        for (int idx : chunkIndices) {
+            if (chunks.contains(idx)) continue;
+
+            const quint16 chunkTxId =
+                    static_cast<quint16>((QDateTime::currentMSecsSinceEpoch() + idx) & 0xFFFF);
+            const QByteArray chunkQuery =
+                    buildDnsChunkRequest(queryName, chunkTxId, meta.chunkId, idx);
+
+            if (chunkQuery.isEmpty()) {
+                continue;
+            }
+
+            auto socket = QSharedPointer<QUdpSocket>::create();
+            socket->writeDatagram(chunkQuery, dnsAddress, port);
+            socketToIndex[socket.data()] = idx;
+            sockets.append(socket);
+        }
+
+        if (sockets.isEmpty()) return;
+
+        QElapsedTimer deadline;
+        deadline.start();
+        int receivedCount = 0;
+        const int expectedCount = sockets.size();
+
+        while (deadline.elapsed() < batchTimeout && receivedCount < expectedCount
+               && chunks.size() < meta.totalChunks) {
+            for (auto &socket : sockets) {
+                if (socket->waitForReadyRead(50)) {
+                    while (socket->hasPendingDatagrams()) {
+                        QNetworkDatagram datagram = socket->receiveDatagram();
+                        if (datagram.isValid()) {
+                            const QByteArray chunkTxtData = parseDnsTxtResponse(datagram.data());
+                            if (!chunkTxtData.isEmpty()) {
+                                const ChunkMeta chunkMeta = parseChunkMeta(datagram.data());
+                                const int idx = (chunkMeta.totalChunks > 0)
+                                        ? chunkMeta.chunkIndex
+                                        : socketToIndex.value(socket.data(), -1);
+                                if (idx >= 0 && !chunks.contains(idx)) {
+                                    chunks[idx] = chunkTxtData;
+                                    receivedCount++;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    };
+
+    const int totalTimeout = qMax(timeoutMsecs / 2, 5000);
+    const int batchTimeout = totalTimeout / (MAX_CHUNK_RETRIES + 1);
+
+    for (int retryRound = 0; retryRound <= MAX_CHUNK_RETRIES; ++retryRound) {
+        QList<int> missing;
+        for (int i = 1; i < meta.totalChunks; ++i) {
+            if (!chunks.contains(i)) {
+                missing.append(i);
+            }
+        }
+
+        if (missing.isEmpty()) {
+            break;
+        }
+
+        for (int batchStart = 0; batchStart < missing.size(); batchStart += MAX_CONCURRENT_REQUESTS) {
+            const QList<int> batch = missing.mid(batchStart, MAX_CONCURRENT_REQUESTS);
+            requestChunksBatch(batch, batchTimeout);
+        }
+    }
+
+    QList<int> finalMissing;
+    for (int i = 0; i < meta.totalChunks; ++i) {
+        if (!chunks.contains(i)) {
+            finalMissing.append(i);
+        }
+    }
+
+    if (!finalMissing.isEmpty()) {
+        return QByteArray();
+    }
+
+    QByteArray combined;
+    combined.reserve(meta.totalSize > 0 ? meta.totalSize : meta.totalChunks * 500);
+
+    for (int i = 0; i < meta.totalChunks; ++i) {
+        combined.append(chunks[i]);
+    }
+
+    return combined;
+}
+
+} // namespace amnezia::transport::dns::DnsTunnel

client/core/transport/dns/dnsTunnel.h

@@ -0,0 +1,35 @@
+#ifndef DNSTUNNEL_H
+#define DNSTUNNEL_H
+
+#include <QByteArray>
+#include <QString>
+
+#include "dnsResolver.h"
+
+namespace amnezia::transport::dns::DnsTunnel
+{
+
+QByteArray send(const QByteArray &payload,
+                const QString &endpointName,
+                const QString &baseDomain,
+                const QString &dnsServer,
+                DnsProtocol protocol,
+                quint16 port,
+                int timeoutMsecs = 30000,
+                const QString &dohEndpoint = QStringLiteral("/dns-query"));
+
+QByteArray sendOverUdp(const QByteArray &payload, const QString &queryName,
+                       const QString &dnsServer, quint16 port, int timeoutMsecs);
+QByteArray sendOverTcp(const QByteArray &payload, const QString &queryName,
+                       const QString &dnsServer, quint16 port, int timeoutMsecs);
+QByteArray sendOverTls(const QByteArray &payload, const QString &queryName,
+                       const QString &dnsServer, quint16 port, int timeoutMsecs);
+QByteArray sendOverHttps(const QByteArray &payload, const QString &queryName,
+                         const QString &dnsServer, quint16 port, const QString &endpoint, int timeoutMsecs);
+
+QByteArray sendOverUdpChunked(const QByteArray &payload, const QString &queryName,
+                              const QString &dnsServer, quint16 port, int timeoutMsecs);
+
+} // namespace amnezia::transport::dns::DnsTunnel
+
+#endif // DNSTUNNEL_H

client/core/transport/dnsGatewayTransport.cpp

@@ -0,0 +1,157 @@
+#include "dnsGatewayTransport.h"
+
+#include <QDebug>
+#include <QHostAddress>
+#include <QHostInfo>
+#include <QSharedPointer>
+#include <QStringList>
+
+#include "dns/dnsTunnel.h"
+#include "core/networkUtilities.h"
+
+#ifdef AMNEZIA_DESKTOP
+    #include "core/ipcclient.h"
+#endif
+
+namespace amnezia::transport
+{
+
+DnsGatewayTransport::DnsGatewayTransport(dns::DnsProtocol protocol,
+                                         const QString &dnsServer,
+                                         const QString &baseDomain,
+                                         quint16 port,
+                                         int timeoutMsecs,
+                                         bool isStrictKillSwitchEnabled,
+                                         const QString &dohEndpoint)
+    : m_protocol(protocol),
+      m_dnsServer(dnsServer),
+      m_baseDomain(baseDomain),
+      m_port(port),
+      m_timeoutMsecs(timeoutMsecs),
+      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled),
+      m_dohEndpoint(dohEndpoint)
+{
+}
+
+QString DnsGatewayTransport::name() const
+{
+    switch (m_protocol) {
+    case dns::DnsProtocol::Udp:   return QStringLiteral("DNS-UDP");
+    case dns::DnsProtocol::Tcp:   return QStringLiteral("DNS-TCP");
+    case dns::DnsProtocol::Tls:   return QStringLiteral("DNS-DoT");
+    case dns::DnsProtocol::Https: return QStringLiteral("DNS-DoH");
+    case dns::DnsProtocol::Quic:  return QStringLiteral("DNS-DoQ");
+    }
+    return QStringLiteral("DNS");
+}
+
+QString DnsGatewayTransport::resolveServerOnce()
+{
+    if (m_resolved.load()) {
+        return m_resolvedServerIp;
+    }
+
+    QHostAddress addr(m_dnsServer);
+    if (!addr.isNull()) {
+        m_resolvedServerIp = m_dnsServer;
+    } else {
+        QHostInfo info = QHostInfo::fromName(m_dnsServer);
+        if (!info.addresses().isEmpty()) {
+            m_resolvedServerIp = info.addresses().first().toString();
+        } else {
+            m_resolvedServerIp = m_dnsServer;
+        }
+    }
+    m_resolved.store(true);
+    return m_resolvedServerIp;
+}
+
+void DnsGatewayTransport::applyKillSwitchAllowlist(const QString &ip)
+{
+#ifdef AMNEZIA_DESKTOP
+    if (!m_isStrictKillSwitchEnabled || ip.isEmpty()) {
+        return;
+    }
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(QStringList { ip });
+        if (!reply.waitForFinished(1000) || !reply.returnValue()) {
+            qWarning() << "DnsGatewayTransport: addKillSwitchAllowedRange failed for" << ip;
+        }
+    });
+#else
+    Q_UNUSED(ip)
+#endif
+}
+
+amnezia::ErrorCode DnsGatewayTransport::send(const QString &endpointTemplate,
+                                             const QByteArray &requestBody,
+                                             QByteArray &decryptedResponse,
+                                             const DecryptionHook &decryptionHook)
+{
+    QString endpointName = endpointTemplate;
+    endpointName.remove("%1");
+    if (endpointName.startsWith(QLatin1String("v1/"))) {
+        endpointName = endpointName.mid(3);
+    }
+    while (endpointName.endsWith(QLatin1Char('/'))) {
+        endpointName.chop(1);
+    }
+    while (endpointName.startsWith(QLatin1Char('/'))) {
+        endpointName = endpointName.mid(1);
+    }
+
+    qDebug() << "[DNS-Transport]" << name() << "send() endpointTemplate=" << endpointTemplate
+             << "endpointName=" << endpointName << "baseDomain=" << m_baseDomain
+             << "server=" << m_dnsServer << "port=" << m_port
+             << "dohPath=" << m_dohEndpoint << "timeoutMs=" << m_timeoutMsecs
+             << "requestBodyBytes=" << requestBody.size();
+
+    if (endpointName.isEmpty() || m_baseDomain.isEmpty() || m_dnsServer.isEmpty()) {
+        qWarning() << "[DNS-Transport] ABORT: empty endpoint/baseDomain/server";
+        return amnezia::ErrorCode::AmneziaServiceConnectionFailed;
+    }
+
+    const bool needsHostname = (m_protocol == dns::DnsProtocol::Tls
+                                || m_protocol == dns::DnsProtocol::Https);
+
+    QString serverIp = resolveServerOnce();
+    QString serverForRequest = needsHostname ? m_dnsServer : serverIp;
+
+    qDebug() << "[DNS-Transport] resolved server IP=" << serverIp
+             << "serverForRequest=" << serverForRequest
+             << "needsHostname=" << needsHostname;
+
+    applyKillSwitchAllowlist(serverIp);
+
+    const QByteArray encrypted = dns::DnsTunnel::send(requestBody,
+                                                      endpointName,
+                                                      m_baseDomain,
+                                                      serverForRequest,
+                                                      m_protocol,
+                                                      m_port,
+                                                      m_timeoutMsecs,
+                                                      m_dohEndpoint);
+    qDebug() << "[DNS-Transport] DnsTunnel::send returned" << encrypted.size() << "bytes";
+    if (encrypted.isEmpty()) {
+        qWarning() << "[DNS-Transport] DnsTunnel returned empty payload, treat as connection failure";
+        return amnezia::ErrorCode::AmneziaServiceConnectionFailed;
+    }
+
+    if (!decryptionHook) {
+        qCritical() << "[DNS-Transport] decryption hook is null";
+        return amnezia::ErrorCode::ApiConfigDecryptionError;
+    }
+
+    DecryptionResult decrypted = decryptionHook(encrypted);
+    if (!decrypted.isOk) {
+        qCritical() << "[DNS-Transport] response decryption failed (encrypted bytes="
+                    << encrypted.size() << ")";
+        return amnezia::ErrorCode::ApiConfigDecryptionError;
+    }
+
+    qDebug() << "[DNS-Transport] success, decrypted response bytes=" << decrypted.decrypted.size();
+    decryptedResponse = decrypted.decrypted;
+    return amnezia::ErrorCode::NoError;
+}
+
+} // namespace amnezia::transport

client/core/transport/dnsGatewayTransport.h

@@ -0,0 +1,49 @@
+#ifndef DNSGATEWAYTRANSPORT_H
+#define DNSGATEWAYTRANSPORT_H
+
+#include <QString>
+#include <atomic>
+
+#include "dns/dnsResolver.h"
+#include "igatewaytransport.h"
+
+namespace amnezia::transport
+{
+
+class DnsGatewayTransport : public IGatewayTransport
+{
+public:
+    DnsGatewayTransport(dns::DnsProtocol protocol,
+                        const QString &dnsServer,
+                        const QString &baseDomain,
+                        quint16 port,
+                        int timeoutMsecs,
+                        bool isStrictKillSwitchEnabled,
+                        const QString &dohEndpoint = QStringLiteral("/dns-query"));
+
+    QString name() const override;
+
+    amnezia::ErrorCode send(const QString &endpointTemplate,
+                            const QByteArray &requestBody,
+                            QByteArray &decryptedResponse,
+                            const DecryptionHook &decryptionHook) override;
+
+private:
+    QString resolveServerOnce();
+    void applyKillSwitchAllowlist(const QString &ip);
+
+    dns::DnsProtocol m_protocol;
+    QString m_dnsServer;
+    QString m_baseDomain;
+    quint16 m_port;
+    int m_timeoutMsecs;
+    bool m_isStrictKillSwitchEnabled;
+    QString m_dohEndpoint;
+
+    std::atomic_bool m_resolved{ false };
+    QString m_resolvedServerIp;
+};
+
+} // namespace amnezia::transport
+
+#endif // DNSGATEWAYTRANSPORT_H

client/core/transport/httpGatewayTransport.cpp

@@ -0,0 +1,345 @@
+#include "httpGatewayTransport.h"
+
+#include <algorithm>
+#include <random>
+
+#include <QCryptographicHash>
+#include <QDebug>
+#include <QEventLoop>
+#include <QHostAddress>
+#include <QJsonArray>
+#include <QJsonDocument>
+#include <QMutexLocker>
+#include <QNetworkAccessManager>
+#include <QNetworkReply>
+#include <QNetworkRequest>
+#include <QSharedPointer>
+#include <QThread>
+#include <QUrl>
+#include <QUuid>
+
+#include "QBlockCipher.h"
+
+#include "amnezia_application.h"
+#include "core/api/apiUtils.h"
+#include "core/networkUtilities.h"
+#include "utilities.h"
+
+#ifdef AMNEZIA_DESKTOP
+    #include "core/ipcclient.h"
+#endif
+
+#ifdef Q_OS_IOS
+    #include "platforms/ios/ios_controller.h"
+#endif
+
+namespace amnezia::transport
+{
+
+QMutex HttpGatewayTransport::s_proxyMutex;
+QString HttpGatewayTransport::s_proxyUrl;
+
+namespace
+{
+    constexpr int kProxyHealthTimeoutMsecs = 1000;
+    constexpr int httpStatusCodeNotFound = 404;
+    constexpr int httpStatusCodeConflict = 409;
+    constexpr int httpStatusCodeNotImplemented = 501;
+
+    constexpr QLatin1String errorResponsePattern1("No active configuration found for");
+    constexpr QLatin1String errorResponsePattern2("No non-revoked public key found for");
+    constexpr QLatin1String errorResponsePattern3("Account not found.");
+    constexpr QLatin1String updateRequestResponsePattern("client version update is required");
+} // namespace
+
+HttpGatewayTransport::HttpGatewayTransport(const QString &endpoint,
+                                           bool isDevEnvironment,
+                                           int requestTimeoutMsecs,
+                                           bool isStrictKillSwitchEnabled)
+    : m_endpoint(endpoint),
+      m_isDevEnvironment(isDevEnvironment),
+      m_requestTimeoutMsecs(requestTimeoutMsecs),
+      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled)
+{
+}
+
+void HttpGatewayTransport::applyKillSwitchAllowlist(const QString &host)
+{
+#ifdef AMNEZIA_DESKTOP
+    if (!m_isStrictKillSwitchEnabled || host.isEmpty()) {
+        return;
+    }
+    const QString ip = NetworkUtilities::getIPAddress(host);
+    if (ip.isEmpty()) {
+        return;
+    }
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(QStringList { ip });
+        if (!reply.waitForFinished(1000) || !reply.returnValue()) {
+            qWarning() << "HttpGatewayTransport: addKillSwitchAllowedRange failed for" << ip;
+        }
+    });
+#else
+    Q_UNUSED(host)
+#endif
+}
+
+HttpGatewayTransport::ReplyOutcome HttpGatewayTransport::doPost(const QString &fullUrl, const QByteArray &requestBody)
+{
+    ReplyOutcome outcome;
+
+#ifdef Q_OS_IOS
+    IosController::Instance()->requestInetAccess();
+    QThread::msleep(10);
+#endif
+
+    QNetworkRequest request;
+    request.setTransferTimeout(m_requestTimeoutMsecs);
+    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
+    request.setRawHeader("X-Client-Request-ID",
+                         QUuid::createUuid().toString(QUuid::WithoutBraces).toUtf8());
+    request.setUrl(fullUrl);
+
+    applyKillSwitchAllowlist(QUrl(fullUrl).host());
+
+    QNetworkReply *reply = amnApp->networkManager()->post(request, requestBody);
+
+    QEventLoop wait;
+    QObject::connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
+    QObject::connect(reply, &QNetworkReply::sslErrors, [&, reply](const QList<QSslError> &errors) {
+        outcome.sslErrors = errors;
+#ifdef AGW_INSECURE_SSL
+        qWarning() << "[HTTP] sslErrors (ignored, AGW_INSECURE_SSL=1):" << errors;
+        reply->ignoreSslErrors();
+        outcome.sslErrors.clear();
+#endif
+    });
+    wait.exec(QEventLoop::ExcludeUserInputEvents);
+
+    outcome.encryptedBody = reply->readAll();
+    outcome.errorString = reply->errorString();
+    outcome.networkError = reply->error();
+    outcome.httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+
+    reply->deleteLater();
+    return outcome;
+}
+
+bool HttpGatewayTransport::shouldBypass(const ReplyOutcome &outcome, const DecryptionResult &decrypted) const
+{
+    if (!outcome.sslErrors.isEmpty()) {
+        return false;
+    }
+
+    if (!decrypted.isOk) {
+        return true;
+    }
+
+    int apiHttpStatus = -1;
+    QJsonDocument jsonDoc = QJsonDocument::fromJson(decrypted.decrypted);
+    if (jsonDoc.isObject()) {
+        apiHttpStatus = jsonDoc.object().value("http_status").toInt(-1);
+    }
+
+    if (outcome.networkError == QNetworkReply::NetworkError::OperationCanceledError
+        || outcome.networkError == QNetworkReply::NetworkError::TimeoutError) {
+        return true;
+    }
+    if (decrypted.decrypted.contains("html")) {
+        return true;
+    }
+    if (apiHttpStatus == httpStatusCodeNotFound) {
+        if (decrypted.decrypted.contains(errorResponsePattern1)
+            || decrypted.decrypted.contains(errorResponsePattern2)
+            || decrypted.decrypted.contains(errorResponsePattern3)) {
+            return false;
+        }
+        return true;
+    }
+    if (apiHttpStatus == httpStatusCodeNotImplemented) {
+        if (decrypted.decrypted.contains(updateRequestResponsePattern)) {
+            return false;
+        }
+        return true;
+    }
+    if (apiHttpStatus == httpStatusCodeConflict) {
+        return false;
+    }
+    if (outcome.networkError != QNetworkReply::NetworkError::NoError) {
+        return true;
+    }
+    return false;
+}
+
+QStringList HttpGatewayTransport::fetchProxyUrls(const QByteArray &/*serviceHint*/)
+{
+    QStringList baseUrls = m_isDevEnvironment
+            ? QString(DEV_S3_ENDPOINT).split(", ")
+            : QString(PROD_S3_ENDPOINT).split(", ");
+
+    QByteArray rsaKey = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+
+    QStringList proxyStorageUrls;
+    for (const auto &baseUrl : baseUrls) {
+        proxyStorageUrls.push_back(baseUrl + "endpoints.json");
+    }
+
+    QNetworkRequest request;
+    request.setTransferTimeout(m_requestTimeoutMsecs);
+    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
+
+    for (const auto &proxyStorageUrl : proxyStorageUrls) {
+        request.setUrl(proxyStorageUrl);
+        QNetworkReply *reply = amnApp->networkManager()->get(request);
+        QEventLoop wait;
+        QObject::connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
+        wait.exec(QEventLoop::ExcludeUserInputEvents);
+
+        if (reply->error() != QNetworkReply::NoError) {
+            reply->deleteLater();
+            continue;
+        }
+
+        QByteArray encryptedResponseBody = reply->readAll();
+        reply->deleteLater();
+
+        QByteArray responseBody;
+        try {
+            if (!m_isDevEnvironment) {
+                QCryptographicHash hash(QCryptographicHash::Sha512);
+                hash.addData(rsaKey);
+                QByteArray hashResult = hash.result().toHex();
+
+                QByteArray key = QByteArray::fromHex(hashResult.left(64));
+                QByteArray iv = QByteArray::fromHex(hashResult.mid(64, 32));
+
+                QSimpleCrypto::QBlockCipher blockCipher;
+                responseBody = blockCipher.decryptAesBlockCipher(QByteArray::fromBase64(encryptedResponseBody), key, iv);
+            } else {
+                responseBody = encryptedResponseBody;
+            }
+        } catch (...) {
+            Utils::logException();
+            qCritical() << "HttpGatewayTransport: error decrypting proxy storage payload";
+            continue;
+        }
+
+        QJsonArray endpointsArray = QJsonDocument::fromJson(responseBody).array();
+        QStringList endpoints;
+        endpoints.reserve(endpointsArray.size());
+        for (const QJsonValue &endpoint : endpointsArray) {
+            endpoints.push_back(endpoint.toString());
+        }
+        return endpoints;
+    }
+
+    return {};
+}
+
+amnezia::ErrorCode HttpGatewayTransport::send(const QString &endpointTemplate,
+                                              const QByteArray &requestBody,
+                                              QByteArray &decryptedResponse,
+                                              const DecryptionHook &decryptionHook)
+{
+    auto buildOutcome = [&](const QString &gatewayBase) {
+        return doPost(endpointTemplate.arg(gatewayBase), requestBody);
+    };
+
+    auto tryDecrypt = [&](const QByteArray &encrypted) -> DecryptionResult {
+        if (!decryptionHook) {
+            DecryptionResult r;
+            r.decrypted = encrypted;
+            r.isOk = false;
+            return r;
+        }
+        return decryptionHook(encrypted);
+    };
+
+    QString cachedProxy;
+    {
+        QMutexLocker lock(&s_proxyMutex);
+        cachedProxy = s_proxyUrl;
+    }
+    const QString primaryBase = cachedProxy.isEmpty() ? m_endpoint : cachedProxy;
+
+    ReplyOutcome outcome = buildOutcome(primaryBase);
+    DecryptionResult decrypted = tryDecrypt(outcome.encryptedBody);
+
+    if (outcome.sslErrors.isEmpty() && shouldBypass(outcome, decrypted)) {
+        QStringList proxyUrls = fetchProxyUrls(QByteArray());
+        std::random_device randomDevice;
+        std::mt19937 generator(randomDevice());
+        std::shuffle(proxyUrls.begin(), proxyUrls.end(), generator);
+
+        bool bypassResolved = false;
+
+        if (cachedProxy.isEmpty()) {
+            QNetworkRequest healthRequest;
+            healthRequest.setTransferTimeout(kProxyHealthTimeoutMsecs);
+            healthRequest.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
+
+            for (const QString &proxyUrl : std::as_const(proxyUrls)) {
+                healthRequest.setUrl(proxyUrl + "lmbd-health");
+                QNetworkReply *reply = amnApp->networkManager()->get(healthRequest);
+                QEventLoop wait;
+                QObject::connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
+                wait.exec(QEventLoop::ExcludeUserInputEvents);
+
+                const auto err = reply->error();
+                reply->deleteLater();
+                if (err == QNetworkReply::NoError) {
+                    QMutexLocker lock(&s_proxyMutex);
+                    s_proxyUrl = proxyUrl;
+                    cachedProxy = proxyUrl;
+                    break;
+                }
+            }
+        }
+
+        if (!cachedProxy.isEmpty()) {
+            ReplyOutcome retry = buildOutcome(cachedProxy);
+            DecryptionResult retryDecrypted = tryDecrypt(retry.encryptedBody);
+            if (retry.sslErrors.isEmpty() && !shouldBypass(retry, retryDecrypted)) {
+                outcome = retry;
+                decrypted = retryDecrypted;
+                bypassResolved = true;
+            }
+        }
+
+        if (!bypassResolved) {
+            for (const QString &proxyUrl : std::as_const(proxyUrls)) {
+                ReplyOutcome retry = buildOutcome(proxyUrl);
+                DecryptionResult retryDecrypted = tryDecrypt(retry.encryptedBody);
+                if (retry.sslErrors.isEmpty() && !shouldBypass(retry, retryDecrypted)) {
+                    {
+                        QMutexLocker lock(&s_proxyMutex);
+                        s_proxyUrl = proxyUrl;
+                    }
+                    outcome = retry;
+                    decrypted = retryDecrypted;
+                    bypassResolved = true;
+                    break;
+                }
+            }
+        }
+    }
+
+    auto errorCode = apiUtils::checkNetworkReplyErrors(outcome.sslErrors,
+                                                       outcome.errorString,
+                                                       outcome.networkError,
+                                                       outcome.httpStatusCode,
+                                                       decrypted.decrypted);
+    if (errorCode != amnezia::ErrorCode::NoError) {
+        return errorCode;
+    }
+
+    if (!decrypted.isOk) {
+        qCritical() << "HttpGatewayTransport: response decryption failed";
+        return amnezia::ErrorCode::ApiConfigDecryptionError;
+    }
+
+    decryptedResponse = decrypted.decrypted;
+    return amnezia::ErrorCode::NoError;
+}
+
+} // namespace amnezia::transport

client/core/transport/httpGatewayTransport.h

@@ -0,0 +1,58 @@
+#ifndef HTTPGATEWAYTRANSPORT_H
+#define HTTPGATEWAYTRANSPORT_H
+
+#include <QByteArray>
+#include <QList>
+#include <QMutex>
+#include <QNetworkReply>
+#include <QSslError>
+#include <QString>
+#include <QStringList>
+
+#include "igatewaytransport.h"
+
+namespace amnezia::transport
+{
+
+class HttpGatewayTransport : public IGatewayTransport
+{
+public:
+    HttpGatewayTransport(const QString &endpoint,
+                         bool isDevEnvironment,
+                         int requestTimeoutMsecs,
+                         bool isStrictKillSwitchEnabled);
+
+    QString name() const override { return QStringLiteral("HTTP"); }
+
+    amnezia::ErrorCode send(const QString &endpointTemplate,
+                            const QByteArray &requestBody,
+                            QByteArray &decryptedResponse,
+                            const DecryptionHook &decryptionHook) override;
+
+private:
+    struct ReplyOutcome
+    {
+        QByteArray encryptedBody;
+        QList<QSslError> sslErrors;
+        QNetworkReply::NetworkError networkError = QNetworkReply::NoError;
+        QString errorString;
+        int httpStatusCode = 0;
+    };
+
+    ReplyOutcome doPost(const QString &fullUrl, const QByteArray &requestBody);
+    void applyKillSwitchAllowlist(const QString &host);
+    QStringList fetchProxyUrls(const QByteArray &serviceHint);
+    bool shouldBypass(const ReplyOutcome &outcome, const DecryptionResult &decrypted) const;
+
+    QString m_endpoint;
+    bool m_isDevEnvironment;
+    int m_requestTimeoutMsecs;
+    bool m_isStrictKillSwitchEnabled;
+
+    static QMutex s_proxyMutex;
+    static QString s_proxyUrl;
+};
+
+} // namespace amnezia::transport
+
+#endif // HTTPGATEWAYTRANSPORT_H

client/core/transport/igatewaytransport.h

@@ -0,0 +1,36 @@
+#ifndef IGATEWAYTRANSPORT_H
+#define IGATEWAYTRANSPORT_H
+
+#include <QByteArray>
+#include <QString>
+#include <functional>
+
+#include "core/defs.h"
+
+namespace amnezia::transport
+{
+
+struct DecryptionResult
+{
+    QByteArray decrypted;
+    bool isOk = false;
+};
+
+using DecryptionHook = std::function<DecryptionResult(const QByteArray &encrypted)>;
+
+class IGatewayTransport
+{
+public:
+    virtual ~IGatewayTransport() = default;
+
+    virtual QString name() const = 0;
+
+    virtual amnezia::ErrorCode send(const QString &endpointTemplate,
+                                    const QByteArray &requestBody,
+                                    QByteArray &decryptedResponse,
+                                    const DecryptionHook &decryptionHook) = 0;
+};
+
+} // namespace amnezia::transport
+
+#endif // IGATEWAYTRANSPORT_H

client/gateway.example.json

@@ -0,0 +1,44 @@
+{
+  "primary": "http",
+  "retry_count": 3,
+  "timeout_ms": 10000,
+  
+  "http": {
+    "enabled": true,
+    "endpoint": "https://your-gateway.example.com/"
+  },
+  
+  "dns_transports": [
+    {
+      "type": "udp",
+      "server": "your-gateway.example.com",
+      "domain": "gateway.example.com",
+      "port": 5453
+    },
+    {
+      "type": "tcp",
+      "server": "your-gateway.example.com",
+      "domain": "gateway.example.com",
+      "port": 5453
+    },
+    {
+      "type": "dot",
+      "server": "your-gateway.example.com",
+      "domain": "gateway.example.com",
+      "port": 8853
+    },
+    {
+      "type": "doh",
+      "server": "your-gateway.example.com",
+      "domain": "gateway.example.com",
+      "port": 443,
+      "path": "/dns-query"
+    },
+    {
+      "type": "doq",
+      "server": "your-gateway.example.com",
+      "domain": "gateway.example.com",
+      "port": 8854
+    }
+  ]
+}

client/mozilla/localsocketcontroller.cpp

@@ -270,7 +270,12 @@ void LocalSocketController::activate(const QJsonObject &rawConfig) {
              && !wgConfig.value(amnezia::config_key::initPacketMagicHeader).isUndefined()
              && !wgConfig.value(amnezia::config_key::responsePacketMagicHeader).isUndefined()
              && !wgConfig.value(amnezia::config_key::underloadPacketMagicHeader).isUndefined()
-             && !wgConfig.value(amnezia::config_key::transportPacketMagicHeader).isUndefined()) {
+             && !wgConfig.value(amnezia::config_key::transportPacketMagicHeader).isUndefined()
+             && !wgConfig.value(amnezia::config_key::specialJunk1).isUndefined()
+             && !wgConfig.value(amnezia::config_key::specialJunk2).isUndefined()
+             && !wgConfig.value(amnezia::config_key::specialJunk3).isUndefined()
+             && !wgConfig.value(amnezia::config_key::specialJunk4).isUndefined()
+             && !wgConfig.value(amnezia::config_key::specialJunk5).isUndefined()) {
     json.insert(amnezia::config_key::junkPacketCount, wgConfig.value(amnezia::config_key::junkPacketCount));
     json.insert(amnezia::config_key::junkPacketMinSize, wgConfig.value(amnezia::config_key::junkPacketMinSize));
     json.insert(amnezia::config_key::junkPacketMaxSize, wgConfig.value(amnezia::config_key::junkPacketMaxSize));

client/mozilla/networkwatcher.cpp

@@ -72,9 +72,9 @@ void NetworkWatcher::initialize() {
   connect(m_impl, &NetworkWatcherImpl::unsecuredNetwork, this,
           &NetworkWatcher::unsecuredNetwork);
   connect(m_impl, &NetworkWatcherImpl::networkChanged, this,
-          &NetworkWatcher::networkChanged);
-  connect(m_impl, &NetworkWatcherImpl::wakeup, this,
-          &NetworkWatcher::wakeup);
+          &NetworkWatcher::networkChange);
+  connect(m_impl, &NetworkWatcherImpl::sleepMode, this,
+          &NetworkWatcher::onSleepMode);
   m_impl->initialize();
 
   // Enable sleep/wake monitoring for VPN auto-reconnection
@@ -97,6 +97,12 @@ void NetworkWatcher::settingsChanged() {
   logger.debug() << "NetworkWatcher settings changed - keeping sleep monitoring active";
 }
 
+void NetworkWatcher::onSleepMode()
+{
+  logger.debug() << "Resumed from sleep mode";
+  emit sleepMode();
+}
+
 void NetworkWatcher::unsecuredNetwork(const QString& networkName,
                                       const QString& networkId) {
   logger.debug() << "Unsecured network:" << logger.sensitive(networkName)

client/mozilla/networkwatcher.h

@@ -29,11 +29,13 @@ public:
     // false to restore.
     void simulateDisconnection(bool simulatedDisconnection);
 
+    void onSleepMode();
+
     QNetworkInformation::Reachability getReachability();
 
 signals:
-    void networkChanged();
-    void wakeup();
+    void networkChange();
+    void sleepMode();
 
 private:
     void settingsChanged();

client/mozilla/networkwatcherimpl.h

@@ -41,7 +41,7 @@ signals:
     // TODO: Only windows-networkwatcher has this, the other plattforms should
     // too.
     void networkChanged(QString newBSSID);
-    void wakeup();
+    void sleepMode();
 
 
 private:

client/platforms/android/android_controller.cpp

@@ -326,57 +326,6 @@ void AndroidController::sendTouch(float x, float y)
     callActivityMethod("sendTouch", "(FF)V", x, y);
 }
 
-
-bool AndroidController::isPlay()
-{
-    return callActivityMethod<jboolean>("isPlay", "()Z");
-}
-
-bool AndroidController::isTestPurchaseEnvironment()
-{
-    return callActivityMethod<jboolean>("isTestPurchaseEnvironment", "()Z");
-}
-
-QJsonObject AndroidController::getSubscriptionPlans()
-{
-    QJniObject subscriptionPlans = callActivityMethod<jstring>("getSubscriptionPlans", "()Ljava/lang/String;");
-    QJsonObject json = QJsonDocument::fromJson(subscriptionPlans.toString().toUtf8()).object();
-    return json;
-}
-
-QJsonObject AndroidController::purchaseSubscription(const QString &offerToken)
-{
-    QJniObject result = callActivityMethod<jstring, jstring>("purchaseSubscription", "(Ljava/lang/String;)Ljava/lang/String;",
-                                                    QJniObject::fromString(offerToken).object<jstring>());
-    QJsonObject json = QJsonDocument::fromJson(result.toString().toUtf8()).object();
-    return json;
-}
-
-QJsonObject AndroidController::upgradeSubscription(const QString &offerToken, const QString &oldPurchaseToken)
-{
-    QJniObject result = callActivityMethod<jstring, jstring, jstring>("upgradeSubscription",
-                                                                      "(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
-                                                                      QJniObject::fromString(offerToken).object<jstring>(),
-                                                                      QJniObject::fromString(oldPurchaseToken).object<jstring>());
-    QJsonObject json = QJsonDocument::fromJson(result.toString().toUtf8()).object();
-    return json;
-}
-
-QJsonObject AndroidController::acknowledgePurchase(const QString &purchaseToken)
-{
-    QJniObject result = callActivityMethod<jstring, jstring>("acknowledgePurchase", "(Ljava/lang/String;)Ljava/lang/String;",
-                                                             QJniObject::fromString(purchaseToken).object<jstring>());
-    QJsonObject json = QJsonDocument::fromJson(result.toString().toUtf8()).object();
-    return json;
-}
-
-QJsonObject AndroidController::queryPurchases()
-{
-    QJniObject result = callActivityMethod<jstring>("queryPurchases", "()Ljava/lang/String;");
-    QJsonObject json = QJsonDocument::fromJson(result.toString().toUtf8()).object();
-    return json;
-}
-
 // Moving log processing to the Android side
 jclass AndroidController::log;
 jmethodID AndroidController::logDebug;

client/platforms/android/android_controller.h

@@ -55,13 +55,6 @@ public:
     void requestNotificationPermission();
     bool requestAuthentication();
     void sendTouch(float x, float y);
-    bool isPlay();
-    bool isTestPurchaseEnvironment();
-    QJsonObject getSubscriptionPlans();
-    QJsonObject purchaseSubscription(const QString &offerToken);
-    QJsonObject upgradeSubscription(const QString &offerToken, const QString &oldPurchaseToken);
-    QJsonObject acknowledgePurchase(const QString &purchaseToken);
-    QJsonObject queryPurchases();
 
     static bool initLogging();
     static void messageHandler(QtMsgType type, const QMessageLogContext &context, const QString &message);

client/platforms/linux/linuxnetworkwatcher.cpp

@@ -41,8 +41,8 @@ void LinuxNetworkWatcher::initialize() {
   connect(m_worker, &LinuxNetworkWatcherWorker::unsecuredNetwork, this,
           &LinuxNetworkWatcher::unsecuredNetwork);
 
-  connect(m_worker, &LinuxNetworkWatcherWorker::wakeup, this,
-          &NetworkWatcherImpl::wakeup);
+  connect(m_worker, &LinuxNetworkWatcherWorker::sleepMode, this,
+          &NetworkWatcherImpl::sleepMode);
 
   // Let's wait a few seconds to allow the UI to be fully loaded and shown.
   // This is not strictly needed, but it's better for user experience because

client/platforms/linux/linuxnetworkwatcherworker.cpp

@@ -200,7 +200,7 @@ void LinuxNetworkWatcherWorker::checkDevices() {
 void LinuxNetworkWatcherWorker::NMStateChanged(quint32 state)
 {
   if (state == NM_STATE_ASLEEP) {
-    emit wakeup();
+    emit sleepMode();
   }
 
   logger.debug() << "NMStateChanged " << state;

client/platforms/linux/linuxnetworkwatcherworker.h

@@ -23,7 +23,7 @@ class LinuxNetworkWatcherWorker final : public QObject {
 
  signals:
   void unsecuredNetwork(const QString& networkName, const QString& networkId);
-  void wakeup();
+  void sleepMode();
 
  public slots:
   void initialize();

client/platforms/macos/macosnetworkwatcher.mm

@@ -173,10 +173,10 @@ void PowerNotificationsListener::sleepWakeupCallBack(void *refParam, io_service_
 
     case kIOMessageSystemHasPoweredOn:
         /* Announces that the system and its devices have woken up. */
-        logger.debug() << "System has powered on - emitting wakeup signal from dedicated CFRunLoop thread";
+        logger.debug() << "System has powered on - emitting sleepMode signal from dedicated CFRunLoop thread";
         if (listener->m_watcher) {
             // Use QMetaObject::invokeMethod for thread-safe signal emission
-            QMetaObject::invokeMethod(listener->m_watcher, "wakeup", Qt::QueuedConnection);
+            QMetaObject::invokeMethod(listener->m_watcher, "sleepMode", Qt::QueuedConnection);
         }
         break;
 

client/platforms/windows/daemon/windowsdaemon.cpp

@@ -62,9 +62,6 @@ void WindowsDaemon::prepareActivation(const InterfaceConfig& config, int inetAda
 }
 
 void WindowsDaemon::activateSplitTunnel(const InterfaceConfig& config, int vpnAdapterIndex) {
-    if (m_splitTunnelManager == nullptr)
-        return;
-
   if (config.m_vpnDisabledApps.length() > 0) {
       m_splitTunnelManager->start(m_inetAdapterIndex, vpnAdapterIndex);
       m_splitTunnelManager->excludeApps(config.m_vpnDisabledApps);

client/platforms/windows/windowsnetworkwatcher.cpp

@@ -41,7 +41,7 @@ LRESULT WindowsNetworkWatcher::PowerWndProcCallback(HWND hwnd, UINT uMsg, WPARAM
   switch (uMsg) {
   case WM_POWERBROADCAST:
     if (wParam == PBT_APMRESUMESUSPEND) {
-        emit obj->wakeup();
+        emit obj->sleepMode();
     }
     break;
   default:

client/protocols/openvpnprotocol.cpp

@@ -232,6 +232,12 @@ ErrorCode OpenVpnProtocol::start()
         return ErrorCode::AmneziaServiceConnectionFailed;
     }
 
+    m_openVpnProcess->waitForSource(5000);
+    if (!m_openVpnProcess->isInitialized()) {
+        qWarning() << "IpcProcess replica is not connected!";
+        setLastError(ErrorCode::AmneziaServiceConnectionFailed);
+        return ErrorCode::AmneziaServiceConnectionFailed;
+    }
     m_openVpnProcess->setProgram(PermittedProcess::OpenVPN);
     QStringList arguments({
             "--config", configPath(), "--management", m_managementHost, QString::number(mgmtPort),
@@ -240,13 +246,13 @@ ErrorCode OpenVpnProtocol::start()
     m_openVpnProcess->setArguments(arguments);
 
     qDebug() << arguments.join(" ");
-    connect(m_openVpnProcess.data(), &IpcProcessInterfaceReplica::errorOccurred,
+    connect(m_openVpnProcess.data(), &PrivilegedProcess::errorOccurred,
             [&](QProcess::ProcessError error) { qDebug() << "PrivilegedProcess errorOccurred" << error; });
 
-    connect(m_openVpnProcess.data(), &IpcProcessInterfaceReplica::stateChanged,
+    connect(m_openVpnProcess.data(), &PrivilegedProcess::stateChanged,
             [&](QProcess::ProcessState newState) { qDebug() << "PrivilegedProcess stateChanged" << newState; });
 
-    connect(m_openVpnProcess.data(), &IpcProcessInterfaceReplica::finished, this,
+    connect(m_openVpnProcess.data(), &PrivilegedProcess::finished, this,
             [&]() { setConnectionState(Vpn::ConnectionState::Disconnected); });
 
     m_openVpnProcess->start();

client/protocols/openvpnprotocol.h

@@ -53,7 +53,7 @@ private:
     void updateRouteGateway(QString line);
     void updateVpnGateway(const QString &line);
 
-    QSharedPointer<IpcProcessInterfaceReplica> m_openVpnProcess;
+    QSharedPointer<PrivilegedProcess> m_openVpnProcess;
 };
 
 #endif // OPENVPNPROTOCOL_H

client/protocols/protocols_defs.h

@@ -233,7 +233,7 @@ namespace amnezia
             constexpr char defaultResponsePacketMagicHeader[] = "3288052141";
             constexpr char defaultTransportPacketMagicHeader[] = "2528465083";
             constexpr char defaultUnderloadPacketMagicHeader[] = "1766607858";
-            constexpr char defaultSpecialJunk1[] = "<r 2><b 0x858000010001000000000669636c6f756403636f6d0000010001c00c000100010000105a00044d583737>";
+            constexpr char defaultSpecialJunk1[] = "<b 0x084481800001000300000000077469636b65747306776964676574096b696e6f706f69736b0272750000010001c00c0005000100000039001806776964676574077469636b6574730679616e646578c025c0390005000100000039002b1765787465726e616c2d7469636b6574732d776964676574066166697368610679616e646578036e657400c05d000100010000001c000457fafe25>";
             constexpr char defaultSpecialJunk2[] = "";
             constexpr char defaultSpecialJunk3[] = "";
             constexpr char defaultSpecialJunk4[] = "";

client/protocols/wireguardprotocol.cpp

@@ -15,7 +15,7 @@ WireguardProtocol::WireguardProtocol(const QJsonObject &configuration, QObject *
     m_impl.reset(new LocalSocketController());
     connect(m_impl.get(), &ControllerImpl::connected, this,
             [this](const QString &pubkey, const QDateTime &connectionTimestamp) {
-                setConnectionState(Vpn::ConnectionState::Connected);
+                emit connectionStateChanged(Vpn::ConnectionState::Connected);
             });
     connect(m_impl.get(), &ControllerImpl::statusUpdated, this,
             [this](const QString& serverIpv4Gateway,
@@ -38,7 +38,7 @@ WireguardProtocol::WireguardProtocol(const QJsonObject &configuration, QObject *
             });
 
     connect(m_impl.get(), &ControllerImpl::disconnected, this,
-            [this]() { setConnectionState(Vpn::ConnectionState::Disconnected); });
+            [this]() { emit connectionStateChanged(Vpn::ConnectionState::Disconnected); });
     m_impl->initialize(nullptr, nullptr);
 }
 

client/protocols/xrayprotocol.cpp

@@ -1,7 +1,6 @@
 #include "xrayprotocol.h"
 
 #include "core/ipcclient.h"
-#include "ipc.h"
 #include "utilities.h"
 #include "core/networkUtilities.h"
 
@@ -10,37 +9,14 @@
 #include <QJsonObject>
 #include <QNetworkInterface>
 #include <QJsonDocument>
-#include <QtCore/qlogging.h>
-#include <QtCore/qobjectdefs.h>
-#include <QtCore/qprocess.h>
-
-#ifdef Q_OS_MACOS
-static const QString tunName = "utun22";
-#else
-static const QString tunName = "tun2";
-#endif
 
 XrayProtocol::XrayProtocol(const QJsonObject &configuration, QObject *parent) : VpnProtocol(configuration, parent)
 {
+    readXrayConfiguration(configuration);
+    m_routeGateway = NetworkUtilities::getGatewayAndIface().first;
     m_vpnGateway = amnezia::protocols::xray::defaultLocalAddr;
     m_vpnLocalAddress = amnezia::protocols::xray::defaultLocalAddr;
-    m_routeGateway = NetworkUtilities::getGatewayAndIface().first;
-
-    m_routeMode = static_cast<Settings::RouteMode>(configuration.value(amnezia::config_key::splitTunnelType).toInt());
-    m_remoteAddress = NetworkUtilities::getIPAddress(m_rawConfig.value(amnezia::config_key::hostName).toString());
-
-    const QString primaryDns = configuration.value(amnezia::config_key::dns1).toString();
-    m_dnsServers.push_back(QHostAddress(primaryDns));
-    if (primaryDns != amnezia::protocols::dns::amneziaDnsIp) {
-        const QString secondaryDns = configuration.value(amnezia::config_key::dns2).toString();
-        m_dnsServers.push_back(QHostAddress(secondaryDns));
-    }
-
-    QJsonObject xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::Xray)).toObject();
-    if (xrayConfiguration.isEmpty()) {
-        xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::SSXray)).toObject();
-    }
-    m_xrayConfig = xrayConfiguration;
+    m_t2sProcess = IpcClient::InterfaceTun2Socks();
 }
 
 XrayProtocol::~XrayProtocol()
@@ -53,16 +29,72 @@ ErrorCode XrayProtocol::start()
 {
     qDebug() << "XrayProtocol::start()";
 
-    return IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-        auto xrayStart = iface->xrayStart(QJsonDocument(m_xrayConfig).toJson());
-        if (!xrayStart.waitForFinished() || !xrayStart.returnValue()) {
-            qCritical() << "Failed to start xray";
-            return ErrorCode::XrayExecutableCrashed;
-        }
-        return startTun2Socks();
+    const ErrorCode err = IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        iface->xrayStart(QJsonDocument(m_xrayConfig).toJson());
+        return ErrorCode::NoError;
     }, [] () {
         return ErrorCode::AmneziaServiceConnectionFailed;
     });
+    if (err != ErrorCode::NoError)
+        return err;
+
+    setConnectionState(Vpn::ConnectionState::Connecting);
+    return startTun2Sock();
+}
+
+ErrorCode XrayProtocol::startTun2Sock()
+{
+    m_t2sProcess->start();
+
+    connect(m_t2sProcess.data(), &IpcProcessTun2SocksReplica::stateChanged, this,
+            [&](QProcess::ProcessState newState) { qDebug() << "PrivilegedProcess stateChanged" << newState; });
+
+    connect(m_t2sProcess.data(), &IpcProcessTun2SocksReplica::setConnectionState, this, [&](int vpnState) {
+        qDebug() << "PrivilegedProcess setConnectionState " << vpnState;
+        IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+            if (vpnState == Vpn::ConnectionState::Connected) {
+                setConnectionState(Vpn::ConnectionState::Connecting);
+                QList<QHostAddress> dnsAddr;
+
+                dnsAddr.push_back(QHostAddress(m_primaryDNS));
+                // We don't use secondary DNS if primary DNS is AmneziaDNS
+                if (!m_primaryDNS.contains(amnezia::protocols::dns::amneziaDnsIp)) {
+                    dnsAddr.push_back(QHostAddress(m_secondaryDNS));
+                }
+    #ifdef Q_OS_WIN
+                QThread::msleep(8000);
+    #endif
+    #ifdef Q_OS_MACOS
+                QThread::msleep(5000);
+                iface->createTun("utun22", amnezia::protocols::xray::defaultLocalAddr);
+                iface->updateResolvers("utun22", dnsAddr);
+    #endif
+    #ifdef Q_OS_LINUX
+                QThread::msleep(1000);
+                iface->createTun("tun2", amnezia::protocols::xray::defaultLocalAddr);
+                iface->updateResolvers("tun2", dnsAddr);
+    #endif
+                if (m_routeMode == Settings::RouteMode::VpnAllSites) {
+                    iface->routeAddList(m_vpnGateway, QStringList() << "1.0.0.0/8" << "2.0.0.0/7" << "4.0.0.0/6" << "8.0.0.0/5" << "16.0.0.0/4" << "32.0.0.0/3" << "64.0.0.0/2" << "128.0.0.0/1");
+                }
+                iface->StopRoutingIpv6();
+    #ifdef Q_OS_WIN
+                iface->updateResolvers("tun2", dnsAddr);
+    #endif
+                setConnectionState(Vpn::ConnectionState::Connected);
+            }
+    #if !defined(Q_OS_MACOS)
+            if (vpnState == Vpn::ConnectionState::Disconnected) {
+                setConnectionState(Vpn::ConnectionState::Disconnected);
+                iface->deleteTun("tun2");
+                iface->StartRoutingIpv6();
+                iface->clearSavedRoutes();
+            }
+#endif
+        });
+    });
+
+    return ErrorCode::NoError;
 }
 
 void XrayProtocol::stop()
@@ -70,177 +102,43 @@ void XrayProtocol::stop()
     qDebug() << "XrayProtocol::stop()";
 
     IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
-        auto disableKillSwitch = iface->disableKillSwitch();
-        if (!disableKillSwitch.waitForFinished() || !disableKillSwitch.returnValue())
-            qWarning() << "Failed to disable killswitch";
+#ifdef AMNEZIA_DESKTOP
+        QRemoteObjectPendingReply<bool> StartRoutingIpv6Resp = iface->StartRoutingIpv6();
+        if (!StartRoutingIpv6Resp.waitForFinished(1000)) {
+            qWarning() << "XrayProtocol::stop(): Failed to start routing ipv6";
+        }
 
-        auto StartRoutingIpv6 = iface->StartRoutingIpv6();
-        if (!StartRoutingIpv6.waitForFinished() || !StartRoutingIpv6.returnValue())
-            qWarning() << "Failed to start routing ipv6";
+        QRemoteObjectPendingReply<bool> restoreResolvers = iface->restoreResolvers();
+        if (!restoreResolvers.waitForFinished(1000)) {
+            qWarning() << "XrayProtocol::stop(): Failed to restore resolvers";
+        }
 
-        auto restoreResolvers = iface->restoreResolvers();
-        if (!restoreResolvers.waitForFinished() || !restoreResolvers.returnValue())
-            qWarning() << "Failed to restore resolvers";
-
-        auto deleteTun = iface->deleteTun(tunName);
-        if (!deleteTun.waitForFinished() || !deleteTun.returnValue())
-            qWarning() << "Failed to delete tun";
-
-        auto xrayStop = iface->xrayStop();
-        if (!xrayStop.waitForFinished() || !xrayStop.returnValue())
-            qWarning() << "Failed to stop xray";
+    #if !defined(Q_OS_MACOS)
+        QRemoteObjectPendingReply<bool> deleteTunResp = iface->deleteTun("tun2");
+        if (!deleteTunResp.waitForFinished(1000)) {
+            qWarning() << "XrayProtocol::stop(): Failed to delete tun";
+        }
+    #endif
+#endif
+        iface->xrayStop();
     });
 
-    if (m_tun2socksProcess) {
-        m_tun2socksProcess->blockSignals(true);
-
-#ifndef Q_OS_WIN
-        m_tun2socksProcess->terminate();
-        auto waitForFinished = m_tun2socksProcess->waitForFinished(1000);
-        if (!waitForFinished.waitForFinished() || !waitForFinished.returnValue()) {
-            qWarning() << "Failed to terminate tun2socks. Killing the process...";
-            m_tun2socksProcess->kill();
-        }
-#else
-        // terminate does not do anything useful on Windows
-        // so just kill the process
-        m_tun2socksProcess->kill();
-#endif
-
-        m_tun2socksProcess->close();
-        m_tun2socksProcess.reset();
+    if (m_t2sProcess) {
+        m_t2sProcess->stop();
+        QThread::msleep(200);
     }
 
     setConnectionState(Vpn::ConnectionState::Disconnected);
 }
 
-ErrorCode XrayProtocol::startTun2Socks()
+void XrayProtocol::readXrayConfiguration(const QJsonObject &configuration)
 {
-    m_tun2socksProcess = IpcClient::CreatePrivilegedProcess();
-    if (!m_tun2socksProcess->waitForSource()) {
-        return ErrorCode::AmneziaServiceConnectionFailed;
+    QJsonObject xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::Xray)).toObject();
+    if (xrayConfiguration.isEmpty()) {
+        xrayConfiguration = configuration.value(ProtocolProps::key_proto_config_data(Proto::SSXray)).toObject();
     }
-
-    m_tun2socksProcess->setProgram(PermittedProcess::Tun2Socks);
-    m_tun2socksProcess->setArguments({"-device", QString("tun://%1").arg(tunName), "-proxy", "socks5://127.0.0.1:10808" });
-
-    connect(m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::readyReadStandardOutput, this, [this]() {
-        auto readAllStandardOutput = m_tun2socksProcess->readAllStandardOutput();
-        if (!readAllStandardOutput.waitForFinished()) {
-            qWarning() << "Failed to read output from tun2socks";
-            return;
-        }
-
-        const QString line = readAllStandardOutput.returnValue();
-
-        if (!line.contains("[TCP]") && !line.contains("[UDP]"))
-            qDebug() << "[tun2socks]:" << line;
-        
-        if (line.contains("[STACK] tun://") && line.contains("<-> socks5://127.0.0.1")) {
-            disconnect(m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::readyReadStandardOutput, this, nullptr);
-
-            if (ErrorCode res = setupRouting(); res != ErrorCode::NoError) {
-                stop();
-                setLastError(res);
-            } else {
-                setConnectionState(Vpn::ConnectionState::Connected);
-            }
-        }
-    }, Qt::QueuedConnection);
-
-    connect(m_tun2socksProcess.data(), &IpcProcessInterfaceReplica::finished, this, [this](int exitCode, QProcess::ExitStatus exitStatus) {
-        if (exitStatus == QProcess::ExitStatus::CrashExit) {
-            qCritical() << "Tun2socks process crashed!";
-        } else {
-            qCritical() << QString("Tun2socks process was closed with %1 exit code").arg(exitCode);
-        }
-        stop();
-        setLastError(ErrorCode::Tun2SockExecutableCrashed);
-    }, Qt::QueuedConnection);
-
-    m_tun2socksProcess->start();
-    return ErrorCode::NoError;
-}
-
-ErrorCode XrayProtocol::setupRouting() {
-    return IpcClient::withInterface([this](QSharedPointer<IpcInterfaceReplica> iface) -> ErrorCode {
-#ifdef Q_OS_WIN
-        const int inetAdapterIndex = NetworkUtilities::AdapterIndexTo(QHostAddress(m_remoteAddress));
-#endif
-        auto createTun = iface->createTun(tunName, amnezia::protocols::xray::defaultLocalAddr);
-        if (!createTun.waitForFinished() || !createTun.returnValue()) {
-            qCritical() << "Failed to assign IP address for TUN";
-            return ErrorCode::InternalError;
-        }
-
-        auto updateResolvers = iface->updateResolvers(tunName, m_dnsServers);
-        if (!updateResolvers.waitForFinished() || !updateResolvers.returnValue()) {
-            qCritical() << "Failed to set DNS resolvers for TUN";
-            return ErrorCode::InternalError;
-        }
-
-#ifdef Q_OS_WIN
-        int vpnAdapterIndex = -1;
-        QList<QNetworkInterface> netInterfaces = QNetworkInterface::allInterfaces();
-        for (auto& netInterface : netInterfaces) {
-            for (auto& address : netInterface.addressEntries()) {
-                if (m_vpnLocalAddress == address.ip().toString())
-                    vpnAdapterIndex = netInterface.index();
-            }
-        }
-#else
-        static const int vpnAdapterIndex = 0;
-#endif
-        const bool killSwitchEnabled = QVariant(m_rawConfig.value(config_key::killSwitchOption).toString()).toBool();
-        if (killSwitchEnabled) {
-            if (vpnAdapterIndex != -1) {
-                QJsonObject config = m_rawConfig;
-                config.insert("vpnServer", m_remoteAddress);
-
-                auto enableKillSwitch = IpcClient::Interface()->enableKillSwitch(config, vpnAdapterIndex);
-                if (!enableKillSwitch.waitForFinished() || !enableKillSwitch.returnValue()) {
-                    qCritical() << "Failed to enable killswitch";
-                    return ErrorCode::InternalError;
-                }
-            } else
-                qWarning() << "Failed to get vpnAdapterIndex. Killswitch disabled";
-        }
-
-        if (m_routeMode == Settings::RouteMode::VpnAllSites) {
-            static const QStringList subnets = { "1.0.0.0/8", "2.0.0.0/7", "4.0.0.0/6", "8.0.0.0/5", "16.0.0.0/4", "32.0.0.0/3", "64.0.0.0/2", "128.0.0.0/1" };
-
-            auto routeAddList =  iface->routeAddList(m_vpnGateway, subnets);
-            if (!routeAddList.waitForFinished() || routeAddList.returnValue() != subnets.count()) {
-                qCritical() << "Failed to set routes for TUN";
-                return ErrorCode::InternalError;
-            }
-        }
-
-        auto StopRoutingIpv6 = iface->StopRoutingIpv6();
-        if (!StopRoutingIpv6.waitForFinished() || !StopRoutingIpv6.returnValue()) {
-            qCritical() << "Failed to disable IPv6 routing";
-            return ErrorCode::InternalError;
-        }
-
-#ifdef Q_OS_WIN
-        if (inetAdapterIndex != -1 && vpnAdapterIndex != -1) {
-            QJsonObject config = m_rawConfig;
-            config.insert("inetAdapterIndex", inetAdapterIndex);
-            config.insert("vpnAdapterIndex", vpnAdapterIndex);
-            config.insert("vpnGateway", m_vpnGateway);
-            config.insert("vpnServer", m_remoteAddress);
-
-            auto enablePeerTraffic = iface->enablePeerTraffic(config);
-            if (!enablePeerTraffic.waitForFinished() || !enablePeerTraffic.returnValue()) {
-                qCritical() << "Failed to enable peer traffic";
-                return ErrorCode::InternalError;
-            }
-        } else
-            qWarning() << "Failed to get adapter indexes. Split-tunneling disabled";
-#endif
-        return ErrorCode::NoError;
-    },
-    [] () {
-        return ErrorCode::AmneziaServiceConnectionFailed;
-    });
+    m_xrayConfig = xrayConfiguration;
+    m_routeMode = static_cast<Settings::RouteMode>(configuration.value(amnezia::config_key::splitTunnelType).toInt());
+    m_primaryDNS = configuration.value(amnezia::config_key::dns1).toString();
+    m_secondaryDNS = configuration.value(amnezia::config_key::dns2).toString();
 }

client/protocols/xrayprotocol.h

@@ -6,7 +6,6 @@
 #include "core/ipcclient.h"
 #include "vpnprotocol.h"
 #include "settings.h"
-#include <QtCore/qsharedpointer.h>
 
 class XrayProtocol : public VpnProtocol
 {
@@ -15,18 +14,19 @@ public:
     virtual ~XrayProtocol() override;
 
     ErrorCode start() override;
+    ErrorCode startTun2Sock();
     void stop() override;
 
 private:
-    ErrorCode setupRouting();
-    ErrorCode startTun2Socks();
-
+    void readXrayConfiguration(const QJsonObject &configuration);
+    
     QJsonObject m_xrayConfig;
     Settings::RouteMode m_routeMode;
-    QList<QHostAddress> m_dnsServers;
-    QString m_remoteAddress;
-
-    QSharedPointer<IpcProcessInterfaceReplica> m_tun2socksProcess;
+    QString m_primaryDNS;
+    QString m_secondaryDNS;
+#ifndef Q_OS_IOS
+    QSharedPointer<IpcProcessTun2SocksReplica> m_t2sProcess;
+#endif
 };
 
 #endif // XRAYPROTOCOL_H

client/resources.qrc

@@ -129,7 +129,6 @@
         <file>ui/qml/Components/AdLabel.qml</file>
         <file>ui/qml/Components/ConnectButton.qml</file>
         <file>ui/qml/Components/ConnectionTypeSelectionDrawer.qml</file>
-        <file>ui/qml/Components/GamepadLoader.qml</file>
         <file>ui/qml/Components/HomeContainersListView.qml</file>
         <file>ui/qml/Components/HomeSplitTunnelingDrawer.qml</file>
         <file>ui/qml/Components/InstalledAppsDrawer.qml</file>

client/server_scripts/install_docker.sh

@@ -21,5 +21,4 @@ if [ "$(systemctl is-active docker)" != "active" ]; then \
   sleep 5; sudo systemctl start docker; sleep 5;\
 fi;\
 if ! command -v sudo > /dev/null 2>&1; then echo "Failed to install sudo, command not found"; exit 1; fi;\
-docker --version;\
-uname -sr
+docker --version

client/settings.cpp

@@ -14,7 +14,8 @@ namespace
     const char cloudFlareNs1[] = "1.1.1.1";
     const char cloudFlareNs2[] = "1.0.0.1";
 
-    constexpr char gatewayEndpoint[] = "http://gw.amnezia.org:80/";
+    //constexpr char gatewayEndpoint[] = "http://localhost:80/";
+    constexpr char gatewayEndpoint[] = "http://localhost:80/";
 }
 
 Settings::Settings(QObject *parent) : QObject(parent), m_settings(ORGANIZATION_NAME, APPLICATION_NAME, this)

client/settings.h

@@ -94,15 +94,6 @@ public:
         setValue("Conf/startMinimized", enabled);
     }
 
-    bool isNewsNotifications() const
-    {
-        return value("Conf/newsNotifications", true).toBool();
-    }
-    void setNewsNotifications(bool enabled)
-    {
-        setValue("Conf/newsNotifications", enabled);
-    }
-
     bool isSaveLogs() const
     {
         return value("Conf/saveLogs", false).toBool();

client/tests/CMakeLists.txt

@@ -0,0 +1,81 @@
+cmake_minimum_required(VERSION 3.25.0)
+project(TransportTest)
+
+set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)
+
+find_package(Qt6 REQUIRED COMPONENTS Core Network Test)
+
+set(QSIMPLECRYPTO_DIR ${CLIENT_ROOT_DIR}/3rd/QSimpleCrypto/src)
+
+set(OPENSSL_ROOT_DIR "${CLIENT_ROOT_DIR}/3rd-prebuilt/3rd-prebuilt/openssl/")
+if(WIN32)
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/windows/include")
+    if("${CMAKE_SIZEOF_VOID_P}" STREQUAL "8")
+        set(OPENSSL_LIB_SSL "${OPENSSL_ROOT_DIR}/windows/win64/libssl.lib")
+        set(OPENSSL_LIB_CRYPTO "${OPENSSL_ROOT_DIR}/windows/win64/libcrypto.lib")
+    else()
+        set(OPENSSL_LIB_SSL "${OPENSSL_ROOT_DIR}/windows/win32/libssl.lib")
+        set(OPENSSL_LIB_CRYPTO "${OPENSSL_ROOT_DIR}/windows/win32/libcrypto.lib")
+    endif()
+elseif(APPLE AND NOT IOS)
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/macos/include")
+    set(OPENSSL_LIB_SSL "${OPENSSL_ROOT_DIR}/macos/lib/libssl.a")
+    set(OPENSSL_LIB_CRYPTO "${OPENSSL_ROOT_DIR}/macos/lib/libcrypto.a")
+elseif(LINUX)
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/linux/include")
+    set(OPENSSL_LIB_SSL "${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")
+    set(OPENSSL_LIB_CRYPTO "${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")
+endif()
+
+add_definitions(-DPROD_AGW_PUBLIC_KEY="$ENV{PROD_AGW_PUBLIC_KEY}")
+add_definitions(-DDEV_AGW_PUBLIC_KEY="$ENV{DEV_AGW_PUBLIC_KEY}")
+
+add_definitions(-DAGW_DNS_SERVER="$ENV{AGW_DNS_SERVER}")
+add_definitions(-DAGW_DNS_DOMAIN="$ENV{AGW_DNS_DOMAIN}")
+add_definitions(-DAGW_DNS_PRIMARY="$ENV{AGW_DNS_PRIMARY}")
+add_definitions(-DAGW_DNS_PORT_UDP="$ENV{AGW_DNS_PORT_UDP}")
+add_definitions(-DAGW_DNS_PORT_DOT="$ENV{AGW_DNS_PORT_DOT}")
+add_definitions(-DAGW_DNS_PORT_DOH="$ENV{AGW_DNS_PORT_DOH}")
+add_definitions(-DAGW_DNS_PORT_DOQ="$ENV{AGW_DNS_PORT_DOQ}")
+add_definitions(-DAGW_DNS_DOH_PATH="$ENV{AGW_DNS_DOH_PATH}")
+add_definitions(-DAGW_DNS_RETRY_COUNT="$ENV{AGW_DNS_RETRY_COUNT}")
+add_definitions(-DAGW_DNS_TIMEOUT_MS="$ENV{AGW_DNS_TIMEOUT_MS}")
+
+qt_add_executable(${PROJECT_NAME}
+    tst_transports.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsResolver.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsTunnel.cpp
+    ${CLIENT_ROOT_DIR}/core/transport/dns/dnsPacket.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QBlockCipher.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QRsa.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509Store.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QAead.cpp
+)
+
+target_include_directories(${PROJECT_NAME} PRIVATE
+    ${CLIENT_ROOT_DIR}
+    ${CLIENT_ROOT_DIR}/core
+    ${CLIENT_ROOT_DIR}/core/transport
+    ${QSIMPLECRYPTO_DIR}
+    ${QSIMPLECRYPTO_DIR}/include
+    ${OPENSSL_INCLUDE_DIR}
+)
+
+target_compile_definitions(${PROJECT_NAME} PRIVATE
+    CLIENT_SOURCE_DIR="${CLIENT_ROOT_DIR}"
+)
+
+target_link_libraries(${PROJECT_NAME} PRIVATE
+    Qt6::Core
+    Qt6::Network
+    Qt6::Test
+    ${OPENSSL_LIB_SSL}
+    ${OPENSSL_LIB_CRYPTO}
+)
+
+if(WIN32)
+    target_link_libraries(${PROJECT_NAME} PRIVATE ws2_32 crypt32)
+endif()
+
+add_test(NAME TransportTest COMMAND ${PROJECT_NAME})

client/tests/tst_transports.cpp

@@ -0,0 +1,406 @@
+#include <QCoreApplication>
+#include <QDebug>
+#include <QElapsedTimer>
+#include <QEventLoop>
+#include <QHostAddress>
+#include <QHostInfo>
+#include <QNetworkAccessManager>
+#include <QNetworkReply>
+#include <QNetworkRequest>
+#include <QSslConfiguration>
+#include <QSslError>
+#include <QTest>
+#include <QUrl>
+
+#include "transport/dns/dnsResolver.h"
+#include "transport/dns/dnsTunnel.h"
+#include "QBlockCipher.h"
+#include "QRsa.h"
+
+#include <openssl/evp.h>
+#include <openssl/rsa.h>
+
+using amnezia::transport::dns::DnsProtocol;
+
+struct TransportResult {
+    QString name;
+    bool success = false;
+    int elapsedMs = 0;
+    int responseSize = 0;
+    QString error;
+    QByteArray responseBody;
+};
+
+struct TestConfig {
+    QString httpEndpoint;
+    struct DnsEntry {
+        QString name;
+        DnsProtocol type;
+        QString server;
+        QString domain;
+        quint16 port;
+        QString dohPath;
+    };
+    QList<DnsEntry> dnsTransports;
+    int timeoutMs = 15000;
+};
+
+static TestConfig buildConfigFromEnv()
+{
+    TestConfig cfg;
+
+    QString server(AGW_DNS_SERVER);
+    QString domain(AGW_DNS_DOMAIN);
+
+    cfg.httpEndpoint = QString(DEV_AGW_PUBLIC_KEY).isEmpty()
+        ? QString() : QString("http://%1/").arg(server);
+
+    int timeout = QString(AGW_DNS_TIMEOUT_MS).toInt();
+    cfg.timeoutMs = (timeout > 0) ? timeout : 15000;
+
+    if (server.isEmpty() || domain.isEmpty()) return cfg;
+
+    auto addEntry = [&](DnsProtocol type, const QString &name,
+                        const char *portDefine, quint16 defaultPort, const QString &dohPath = QString()) {
+        TestConfig::DnsEntry e;
+        e.type = type;
+        e.name = name;
+        e.server = server;
+        e.domain = domain;
+        quint16 port = QString(portDefine).toUShort();
+        e.port = (port > 0) ? port : defaultPort;
+        if (!dohPath.isEmpty()) e.dohPath = dohPath;
+        cfg.dnsTransports.append(e);
+    };
+
+    addEntry(DnsProtocol::Udp, "UDP", AGW_DNS_PORT_UDP, 5353);
+    addEntry(DnsProtocol::Tcp, "TCP", AGW_DNS_PORT_UDP, 5353);
+    addEntry(DnsProtocol::Tls, "DoT", AGW_DNS_PORT_DOT, 853);
+
+    QString dohPath = QString(AGW_DNS_DOH_PATH);
+    if (dohPath.isEmpty()) dohPath = "/dns-query";
+    addEntry(DnsProtocol::Https, "DoH", AGW_DNS_PORT_DOH, 443, dohPath);
+
+    addEntry(DnsProtocol::Quic, "DoQ", AGW_DNS_PORT_DOQ, 8853);
+
+    return cfg;
+}
+
+static QString resolveHost(const QString &host)
+{
+    QHostAddress addr(host);
+    if (!addr.isNull()) return host;
+    QHostInfo info = QHostInfo::fromName(host);
+    if (!info.addresses().isEmpty())
+        return info.addresses().first().toString();
+    return host;
+}
+
+struct EncryptedPayload {
+    QByteArray body;
+    QByteArray key;
+    QByteArray iv;
+    QByteArray salt;
+    bool ok = false;
+    QString error;
+};
+
+static EncryptedPayload encryptPayload(const QJsonObject &apiPayload, const QByteArray &rsaPubKeyPem)
+{
+    EncryptedPayload result;
+
+    QSimpleCrypto::QBlockCipher blockCipher;
+    result.key = blockCipher.generatePrivateSalt(32);
+    result.iv = blockCipher.generatePrivateSalt(32);
+    result.salt = blockCipher.generatePrivateSalt(8);
+
+    QJsonObject keyPayload;
+    keyPayload["aes_key"] = QString(result.key.toBase64());
+    keyPayload["aes_iv"] = QString(result.iv.toBase64());
+    keyPayload["aes_salt"] = QString(result.salt.toBase64());
+
+    try {
+        QSimpleCrypto::QRsa rsa;
+        QByteArray pemData = rsaPubKeyPem;
+        pemData.replace("\\n", "\n");
+        EVP_PKEY *pubKey = rsa.getPublicKeyFromByteArray(pemData);
+        if (!pubKey) {
+            result.error = "Failed to load RSA public key";
+            return result;
+        }
+
+        QByteArray encKeyPayload = rsa.encrypt(QJsonDocument(keyPayload).toJson(), pubKey, RSA_PKCS1_PADDING);
+        EVP_PKEY_free(pubKey);
+
+        QByteArray encApiPayload = blockCipher.encryptAesBlockCipher(
+            QJsonDocument(apiPayload).toJson(), result.key, result.iv, "", result.salt);
+
+        QJsonObject requestBody;
+        requestBody["key_payload"] = QString(encKeyPayload.toBase64());
+        requestBody["api_payload"] = QString(encApiPayload.toBase64());
+
+        result.body = QJsonDocument(requestBody).toJson();
+        result.ok = true;
+    } catch (const std::exception &ex) {
+        result.error = QString("Encryption failed: %1").arg(ex.what());
+    } catch (...) {
+        result.error = "Encryption failed: unknown error";
+    }
+    return result;
+}
+
+static QByteArray decryptResponse(const QByteArray &encrypted, const QByteArray &key,
+                                   const QByteArray &iv, const QByteArray &salt)
+{
+    try {
+        QSimpleCrypto::QBlockCipher blockCipher;
+        return blockCipher.decryptAesBlockCipher(encrypted, key, iv, "", salt);
+    } catch (...) {
+        return QByteArray();
+    }
+}
+
+class TransportTest : public QObject
+{
+    Q_OBJECT
+
+private:
+    TestConfig m_config;
+    QByteArray m_rsaKey;
+    bool m_hasRsaKey = false;
+    QList<TransportResult> m_results;
+
+    void logResult(const TransportResult &r) {
+        QString status = r.success ? "OK" : "FAIL";
+        qDebug().noquote() << QString("[%1] %2 | %3ms | %4 bytes | %5")
+            .arg(status, -4)
+            .arg(r.name, -20)
+            .arg(r.elapsedMs, 5)
+            .arg(r.responseSize, 6)
+            .arg(r.error.isEmpty() ? "---" : r.error);
+    }
+
+    TransportResult doHttpTransport(const QString &endpoint, const QByteArray &payload) {
+        TransportResult r;
+        r.name = "HTTP";
+        QElapsedTimer timer;
+        timer.start();
+
+        QNetworkAccessManager nam;
+        QNetworkRequest request(QUrl(endpoint));
+        request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
+        request.setTransferTimeout(m_config.timeoutMs);
+
+        QNetworkReply *reply = nam.post(request, payload);
+
+        QEventLoop loop;
+        QObject::connect(reply, &QNetworkReply::finished, &loop, &QEventLoop::quit);
+        loop.exec();
+
+        r.elapsedMs = static_cast<int>(timer.elapsed());
+
+        if (reply->error() != QNetworkReply::NoError) {
+            r.error = QString("HTTP %1: %2")
+                .arg(reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt())
+                .arg(reply->errorString());
+            r.responseBody = reply->readAll();
+            r.responseSize = r.responseBody.size();
+        } else {
+            r.responseBody = reply->readAll();
+            r.responseSize = r.responseBody.size();
+            r.success = !r.responseBody.isEmpty();
+            if (!r.success) r.error = "Empty response";
+        }
+        reply->deleteLater();
+        return r;
+    }
+
+    TransportResult doDnsTransport(const TestConfig::DnsEntry &entry, const QByteArray &payload,
+                                   const QString &resolvedIp) {
+        TransportResult r;
+        r.name = QString("DNS-%1").arg(entry.name);
+        QElapsedTimer timer;
+        timer.start();
+
+        bool needsHostname = (entry.type == DnsProtocol::Https || entry.type == DnsProtocol::Tls);
+        QString serverAddr = needsHostname ? entry.server : resolvedIp;
+
+        r.responseBody = amnezia::transport::dns::DnsTunnel::send(
+            payload, "services", entry.domain,
+            serverAddr, entry.type, entry.port,
+            m_config.timeoutMs, entry.dohPath);
+
+        r.elapsedMs = static_cast<int>(timer.elapsed());
+        r.responseSize = r.responseBody.size();
+        r.success = !r.responseBody.isEmpty();
+        if (!r.success) r.error = "Empty/no response";
+        return r;
+    }
+
+private slots:
+    void initTestCase()
+    {
+        m_config = buildConfigFromEnv();
+
+        QVERIFY2(!m_config.dnsTransports.isEmpty(),
+                 "AGW_DNS_SERVER / AGW_DNS_DOMAIN not set -- cannot run transport tests");
+
+        qDebug() << "HTTP endpoint:" << m_config.httpEndpoint;
+        qDebug() << "DNS transports:" << m_config.dnsTransports.size();
+        qDebug() << "Timeout:" << m_config.timeoutMs << "ms";
+
+        QByteArray prodKey(PROD_AGW_PUBLIC_KEY);
+        QByteArray devKey(DEV_AGW_PUBLIC_KEY);
+        if (!prodKey.isEmpty()) {
+            m_rsaKey = prodKey;
+            m_hasRsaKey = true;
+            qDebug() << "Using PROD_AGW_PUBLIC_KEY for E2E tests";
+        } else if (!devKey.isEmpty()) {
+            m_rsaKey = devKey;
+            m_hasRsaKey = true;
+            qDebug() << "Using DEV_AGW_PUBLIC_KEY for E2E tests";
+        } else {
+            qWarning() << "No RSA public key found -- E2E tests will be SKIPPED";
+        }
+    }
+
+    void test_transport_http()
+    {
+        QByteArray payload = R"({"test":true})";
+        TransportResult r = doHttpTransport(m_config.httpEndpoint, payload);
+        m_results.append(r);
+        logResult(r);
+        QVERIFY2(r.success || r.responseSize > 0,
+                 qPrintable(QString("HTTP transport failed: %1").arg(r.error)));
+    }
+
+    void test_transport_dns_data()
+    {
+        QTest::addColumn<int>("transportIndex");
+        for (int i = 0; i < m_config.dnsTransports.size(); ++i) {
+            const auto &e = m_config.dnsTransports[i];
+            if (e.type == DnsProtocol::Quic) continue;
+            QTest::newRow(qPrintable(e.name)) << i;
+        }
+    }
+
+    void test_transport_dns()
+    {
+        QFETCH(int, transportIndex);
+        const auto &entry = m_config.dnsTransports[transportIndex];
+        QString resolvedIp = resolveHost(entry.server);
+        qDebug() << "Server:" << entry.server << "-> IP:" << resolvedIp
+                 << "Port:" << entry.port;
+
+        QByteArray payload = R"({"test":true})";
+        TransportResult r = doDnsTransport(entry, payload, resolvedIp);
+        m_results.append(r);
+        logResult(r);
+
+        if (!r.success) {
+            qWarning() << "DNS" << entry.name << "transport failed (server may be down):" << r.error;
+        }
+    }
+
+    void test_e2e_http()
+    {
+        if (!m_hasRsaKey) QSKIP("No RSA key -- skipping E2E");
+
+        QJsonObject apiPayload;
+        apiPayload["protocol"] = "any";
+        EncryptedPayload enc = encryptPayload(apiPayload, m_rsaKey);
+        QVERIFY2(enc.ok, qPrintable(enc.error));
+
+        TransportResult r = doHttpTransport(m_config.httpEndpoint, enc.body);
+        r.name = "E2E-HTTP";
+
+        if (r.success) {
+            QByteArray decrypted = decryptResponse(r.responseBody, enc.key, enc.iv, enc.salt);
+            if (!decrypted.isEmpty()) {
+                r.responseBody = decrypted;
+                r.responseSize = decrypted.size();
+                qDebug() << "Decrypted response:" << decrypted.left(200);
+            } else {
+                r.error = "Decryption failed (raw body size: " + QString::number(r.responseBody.size()) + ")";
+                r.success = false;
+            }
+        }
+
+        m_results.append(r);
+        logResult(r);
+        QVERIFY2(r.success, qPrintable(QString("E2E HTTP failed: %1").arg(r.error)));
+    }
+
+    void test_e2e_dns_data()
+    {
+        QTest::addColumn<int>("transportIndex");
+        for (int i = 0; i < m_config.dnsTransports.size(); ++i) {
+            const auto &e = m_config.dnsTransports[i];
+            if (e.type == DnsProtocol::Quic) continue;
+            QTest::newRow(qPrintable(QString("E2E-%1").arg(e.name))) << i;
+        }
+    }
+
+    void test_e2e_dns()
+    {
+        if (!m_hasRsaKey) QSKIP("No RSA key -- skipping E2E");
+
+        QFETCH(int, transportIndex);
+        const auto &entry = m_config.dnsTransports[transportIndex];
+        QString resolvedIp = resolveHost(entry.server);
+        qDebug() << "E2E via" << entry.name << "server:" << entry.server
+                 << "-> IP:" << resolvedIp << "port:" << entry.port;
+
+        QJsonObject apiPayload;
+        apiPayload["protocol"] = "any";
+        EncryptedPayload enc = encryptPayload(apiPayload, m_rsaKey);
+        QVERIFY2(enc.ok, qPrintable(enc.error));
+
+        TransportResult r = doDnsTransport(entry, enc.body, resolvedIp);
+        r.name = QString("E2E-%1").arg(entry.name);
+
+        if (r.success) {
+            QByteArray decrypted = decryptResponse(r.responseBody, enc.key, enc.iv, enc.salt);
+            if (!decrypted.isEmpty()) {
+                r.responseBody = decrypted;
+                r.responseSize = decrypted.size();
+                qDebug() << "Decrypted response:" << decrypted.left(200);
+            } else {
+                r.error = "Decryption failed (raw body size: " + QString::number(r.responseBody.size()) + ")";
+                r.success = false;
+            }
+        }
+
+        m_results.append(r);
+        logResult(r);
+
+        if (!r.success) {
+            qWarning() << "E2E DNS" << entry.name << "failed:" << r.error;
+        }
+    }
+
+    void cleanupTestCase()
+    {
+        qDebug() << "";
+        qDebug() << "============================================================";
+        qDebug() << "                    TRANSPORT TEST SUMMARY";
+        qDebug() << "============================================================";
+        qDebug().noquote() << QString(" %-4s | %-20s | %5s | %6s | %s")
+            .arg("", "Transport", "ms", "bytes", "Error");
+        qDebug() << "------------------------------------------------------------";
+
+        int passed = 0, failed = 0;
+        for (const auto &r : m_results) {
+            logResult(r);
+            if (r.success) ++passed; else ++failed;
+        }
+
+        qDebug() << "------------------------------------------------------------";
+        qDebug().noquote() << QString("Total: %1 passed, %2 failed, %3 total")
+            .arg(passed).arg(failed).arg(m_results.size());
+        qDebug() << "============================================================";
+    }
+};
+
+QTEST_MAIN(TransportTest)
+#include "tst_transports.moc"

client/ui/controllers/api/apiConfigsController.cpp

@@ -5,20 +5,16 @@
 #include "core/api/apiDefs.h"
 #include "core/api/apiUtils.h"
 #include "core/controllers/gatewayController.h"
+#include "core/networkUtilities.h"
 #include "core/qrCodeUtils.h"
 #include "ui/controllers/systemController.h"
 #include "version.h"
 #include <QClipboard>
 #include <QDebug>
 #include <QEventLoop>
-#include <QFutureWatcher>
 #include <QSet>
-#include <QtConcurrent>
 
 #include "platforms/ios/ios_controller.h"
-#ifdef Q_OS_ANDROID
-#include "platforms/android/android_controller.h"
-#endif
 
 namespace
 {
@@ -375,7 +371,6 @@ bool ApiConfigsController::fillAvailableServices()
 
     QByteArray responseBody;
     ErrorCode errorCode = executeRequest(QString("%1v1/services"), apiPayload, responseBody);
-    qDebug().noquote() << "[Billing] gateway response v1/services responseBody:" << responseBody;
     if (errorCode == ErrorCode::NoError) {
         if (!responseBody.contains("services")) {
             errorCode = ErrorCode::ApiServicesMissingError;
@@ -388,142 +383,6 @@ bool ApiConfigsController::fillAvailableServices()
     }
 
     QJsonObject data = QJsonDocument::fromJson(responseBody).object();
-    
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-    QEventLoop waitProducts;
-    bool productsFetched = false;
-    QString productPrice;
-    QString productCurrency;
-    
-    IosController::Instance()->fetchProducts(QStringList() << QStringLiteral("amnezia_premium_6_month"),
-                                             [&](const QList<QVariantMap> &products,
-                                                 const QStringList &invalidIds,
-                                                 const QString &errorString) {
-                                                 if (!errorString.isEmpty() || products.isEmpty()) {
-                                                     qWarning().noquote() << "[IAP] Failed to fetch product price:" << errorString;
-                                                 } else {
-                                                     const auto &product = products.first();
-                                                     productPrice = product.value("price").toString();
-                                                     productCurrency = product.value("currencyCode").toString();
-                                                     productsFetched = true;
-                                                     qInfo().noquote() << "[IAP] Fetched product price:" << productPrice << productCurrency;
-                                                 }
-                                                 waitProducts.quit();
-                                             });
-    waitProducts.exec();
-    
-    if (productsFetched && !productPrice.isEmpty()) {
-        QJsonArray services = data.value("services").toArray();
-        for (int i = 0; i < services.size(); ++i) {
-            QJsonObject service = services[i].toObject();
-            if (service.value(configKey::serviceType).toString() == serviceType::amneziaPremium) {
-                QJsonObject serviceInfo = service.value(configKey::serviceInfo).toObject();
-                QString formattedPrice = productPrice;
-                if (!productCurrency.isEmpty()) {
-                    formattedPrice += " " + productCurrency;
-                }
-                serviceInfo["price"] = formattedPrice;
-                service[configKey::serviceInfo] = serviceInfo;
-                services[i] = service;
-                data["services"] = services;
-                qInfo().noquote() << "[IAP] Updated premium service price in data:" << formattedPrice;
-                break;
-            }
-        }
-    }
-#elif defined(Q_OS_ANDROID)
-    // Get price from Google Play Billing
-    auto androidController = AndroidController::instance();
-    QJsonObject plansResult = androidController->getSubscriptionPlans();
-    int responseCode = plansResult.value("responseCode").toInt(-1);
-    qDebug().noquote() << "[Billing] getSubscriptionPlans plansResult:" << QJsonDocument(plansResult).toJson(QJsonDocument::Compact);
-    qDebug() << "[Billing] getSubscriptionPlans responseCode:" << responseCode;
-
-    if (responseCode == 0) {
-        QJsonArray products = plansResult.value("products").toArray();
-        QString formattedPrice;
-        int billingPeriodDays = 180;
-        for (const QJsonValue &productValue : products) {
-            QJsonObject product = productValue.toObject();
-            const QString productId = product.value("productId").toString();
-            const bool isPremium = (productId == "premium") || productId.contains("premium");
-            if (isPremium) {
-                QJsonArray offers = product.value("offers").toArray();
-                if (!offers.isEmpty()) {
-                    QJsonObject firstOffer = offers.at(0).toObject();
-                    QJsonArray pricingPhases = firstOffer.value("pricingPhases").toArray();
-                    if (!pricingPhases.isEmpty()) {
-                        QJsonObject pricingPhase = pricingPhases.at(0).toObject();
-                        formattedPrice = pricingPhase.value("formatedPrice").toString();
-                        if (formattedPrice.isEmpty()) {
-                            formattedPrice = pricingPhase.value("formattedPrice").toString();
-                        }
-                        QString billingPeriod = pricingPhase.value("billingPeriod").toString();
-                        if (billingPeriod.contains("Y")) {
-                            int idx = billingPeriod.indexOf("Y");
-                            int years = billingPeriod.mid(1, idx - 1).toInt();
-                            if (years > 0) billingPeriodDays = years * 365;
-                        } else if (billingPeriod.contains("M")) {
-                            int idx = billingPeriod.indexOf("M");
-                            int months = billingPeriod.mid(1, idx - 1).toInt();
-                            if (months > 0) billingPeriodDays = months * 30;
-                        } else if (billingPeriod.contains("D")) {
-                            int idx = billingPeriod.indexOf("D");
-                            billingPeriodDays = billingPeriod.mid(1, idx - 1).toInt();
-                        }
-                    }
-                }
-                break;
-            }
-        }
-        if (!formattedPrice.isEmpty()) {
-            QJsonArray services = data.value("services").toArray();
-            bool premiumFound = false;
-            for (int i = 0; i < services.size(); ++i) {
-                QJsonObject service = services[i].toObject();
-                if (service.value(configKey::serviceType).toString() == serviceType::amneziaPremium) {
-                    QJsonObject serviceInfo = service.value(configKey::serviceInfo).toObject();
-                    serviceInfo["price"] = formattedPrice;
-                    service[configKey::serviceInfo] = serviceInfo;
-                    services[i] = service;
-                    data["services"] = services;
-                    premiumFound = true;
-                    qInfo() << "[Billing] Updated premium service price in data:" << formattedPrice;
-                    break;
-                }
-            }
-         /*   if (!premiumFound) {
-                // Gateway did not return premium; add it from billing data
-                QString region = data.value(configKey::userCountryCode).toString();
-                QJsonObject serviceInfo;
-                serviceInfo["name"] = tr("Amnezia Premium");
-                serviceInfo["price"] = formattedPrice;
-                serviceInfo["region"] = region;
-                serviceInfo["speed"] = "200";
-                serviceInfo["timelimit"] = QString::number(billingPeriodDays);
-                QJsonObject serviceDescription;
-                serviceDescription["card_description"] = tr("Amnezia Premium is classic VPN for seamless work, downloading large files, and watching videos.");
-                serviceDescription["description"] = serviceDescription["card_description"];
-                serviceDescription["features"] = "";
-                QJsonObject premiumService;
-                premiumService[configKey::serviceType] = serviceType::amneziaPremium;
-                premiumService[configKey::serviceProtocol] = "amnezia-premium";
-                premiumService[configKey::serviceInfo] = serviceInfo;
-                premiumService["service_description"] = serviceDescription;
-                premiumService["available_countries"] = QJsonArray();
-                premiumService["is_available"] = true;
-                premiumService["store_endpoint"] = "";
-                premiumService["subscription"] = QJsonObject();
-                services.prepend(premiumService);
-                data["services"] = services;
-                qInfo() << "[Billing] Added premium service from billing (gateway did not return it)";
-            }*/
-        }
-    } else {
-        qWarning() << "[Billing] Failed to fetch product price, responseCode:" << responseCode;
-    }
-#endif
-    
     m_apiServicesModel->updateModel(data);
     if (m_apiServicesModel->rowCount() > 0) {
         m_apiServicesModel->setServiceIndex(0);
@@ -533,19 +392,25 @@ bool ApiConfigsController::fillAvailableServices()
 
 bool ApiConfigsController::importService()
 {
-    if (m_apiServicesModel->getSelectedServiceType() == serviceType::amneziaPremium) {
-#if defined(Q_OS_IOS) || defined(MACOS_NE) || defined(Q_OS_ANDROID)
-        importServiceFromPaymentMarket();
-        return true;
+#if defined(Q_OS_IOS) || defined(MACOS_NE)
+    bool isIosOrMacOsNe = true;
 #else
-        return false; // premium only via App Store / Play
+    bool isIosOrMacOsNe = false;
 #endif
+
+    if (m_apiServicesModel->getSelectedServiceType() == serviceType::amneziaPremium) {
+        if (isIosOrMacOsNe) {
+            importSerivceFromAppStore();
+            return true;
+        }
+    } else {
+        importServiceFromGateway();
+        return true;
     }
-    importServiceFromGateway();
-    return true;
+    return false;
 }
 
-bool ApiConfigsController::importServiceFromPaymentMarket()
+bool ApiConfigsController::importSerivceFromAppStore()
 {
 #if defined(Q_OS_IOS) || defined(MACOS_NE)
     bool purchaseOk = false;
@@ -602,116 +467,12 @@ bool ApiConfigsController::importServiceFromPaymentMarket()
         return false;
     }
 
-    emit installServerFromApiFinished(tr("%1 installed successfully.").arg(m_apiServicesModel->getSelectedServiceName()));
-#elif defined(Q_OS_ANDROID)
-    auto androidController = AndroidController::instance();
-    QString purchaseToken;
-    bool purchaseOk = false;
-
-    QFutureWatcher<QPair<bool, QString>> watcher;
-    QEventLoop waitLoop;
-    connect(&watcher, &QFutureWatcher<QPair<bool, QString>>::finished, &waitLoop, &QEventLoop::quit);
-
-    QFuture<QPair<bool, QString>> future = QtConcurrent::run([androidController]() {
-        QJsonObject plansResult = androidController->getSubscriptionPlans();
-        int responseCode = plansResult.value("responseCode").toInt(-1);
-        qDebug().noquote() << "[Billing] importService getSubscriptionPlans plansResult:" << QJsonDocument(plansResult).toJson(QJsonDocument::Compact);
-        qDebug() << "[Billing] importService getSubscriptionPlans responseCode:" << responseCode;
-        if (responseCode != 0) {
-            qWarning() << "[Billing] Failed to get subscription plans, responseCode:" << responseCode;
-            return qMakePair(false, QString());
-        }
-        QJsonArray products = plansResult.value("products").toArray();
-        QString offerToken;
-        for (const QJsonValue &productValue : products) {
-            QJsonObject product = productValue.toObject();
-            const QString productId = product.value("productId").toString();
-            const bool isPremium = (productId == "premium") || productId.contains("premium");
-            if (isPremium) {
-                QJsonArray offers = product.value("offers").toArray();
-                if (!offers.isEmpty()) {
-                    QJsonObject firstOffer = offers.at(0).toObject();
-                    offerToken = firstOffer.value("offerToken").toString();
-                    qInfo() << "[Billing] Found offer token:" << offerToken;
-                    break;
-                }
-            }
-        }
-        if (offerToken.isEmpty()) {
-            qWarning() << "[Billing] No offer token found for premium subscription";
-            return qMakePair(false, QString());
-        }
-        QJsonObject purchaseResult = androidController->purchaseSubscription(offerToken);
-        responseCode = purchaseResult.value("responseCode").toInt(-1);
-        if (responseCode != 0) {
-            qWarning() << "[Billing] Purchase failed, responseCode:" << responseCode;
-            return qMakePair(false, QString());
-        }
-        QJsonArray purchases = purchaseResult.value("purchases").toArray();
-        if (purchases.isEmpty()) {
-            qWarning() << "[Billing] Purchase succeeded but no purchases returned";
-            return qMakePair(false, QString());
-        }
-        QJsonObject purchase = purchases.at(0).toObject();
-        QString token = purchase.value("purchaseToken").toString();
-        bool isAcknowledged = purchase.value("isAcknowledged").toBool();
-        qInfo() << "[Billing] Purchase success. purchaseToken:" << token << "isAcknowledged:" << isAcknowledged;
-        if (!isAcknowledged) {
-            QJsonObject ackResult = androidController->acknowledgePurchase(token);
-            if (ackResult.value("responseCode").toInt(-1) != 0) {
-                qWarning() << "[Billing] Acknowledge failed";
-            } else {
-                qInfo() << "[Billing] Purchase acknowledged successfully";
-            }
-        }
-        return qMakePair(true, token);
-    });
-
-    watcher.setFuture(future);
-    waitLoop.exec();
-
-    purchaseOk = watcher.result().first;
-    purchaseToken = watcher.result().second;
-
-    if (!purchaseOk || purchaseToken.isEmpty()) {
-        emit errorOccurred(ErrorCode::ApiPurchaseError);
-        return false;
-    }
-    
-    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                            QString(APP_VERSION),
-                                            m_settings->getAppLanguage().name().split("_").first(),
-                                            m_settings->getInstallationUuid(true),
-                                            m_apiServicesModel->getCountryCode(),
-                                            "",
-                                            m_apiServicesModel->getSelectedServiceType(),
-                                            m_apiServicesModel->getSelectedServiceProtocol(),
-                                            QJsonObject() };
-
-    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-    apiPayload[apiDefs::key::transactionId] = purchaseToken;
-    bool isTestPurchase = m_settings->isDevGatewayEnv(false) || androidController->isTestPurchaseEnvironment();
-
-    ErrorCode errorCode;
-    QByteArray responseBody;
-    errorCode = executeRequest(QString("%1v1/subscriptions"), apiPayload, responseBody, isTestPurchase);
-    if (errorCode != ErrorCode::NoError) {
-        emit errorOccurred(errorCode);
-        return false;
-    }
-
-    errorCode = importServiceFromBilling(responseBody, isTestPurchase);
-    if (errorCode != ErrorCode::NoError) {
-        emit errorOccurred(errorCode);
-        return false;
-    }
-
     emit installServerFromApiFinished(tr("%1 installed successfully.").arg(m_apiServicesModel->getSelectedServiceName()));
 #endif
     return true;
 }
 
-bool ApiConfigsController::restoreServiceFromPaymentMarket()
+bool ApiConfigsController::restoreSerivceFromAppStore()
 {
 #if defined(Q_OS_IOS) || defined(MACOS_NE)
     const QString premiumServiceType = QStringLiteral("amnezia-premium");
@@ -834,131 +595,6 @@ bool ApiConfigsController::restoreServiceFromPaymentMarket()
         qInfo().noquote() << "[IAP] Skipped" << duplicateCount
                           << "duplicate restored transactions for original transaction IDs already processed";
     }
-#elif defined(Q_OS_ANDROID)
-    // Android Google Play Billing restore implementation
-    const QString premiumServiceType = QStringLiteral("amnezia-premium");
-
-    if (!fillAvailableServices()) {
-        qWarning() << "[Billing] Unable to fetch services list before restore";
-        emit errorOccurred(ErrorCode::ApiServicesMissingError);
-        return false;
-    }
-
-    if (m_apiServicesModel->rowCount() <= 0) {
-        emit errorOccurred(ErrorCode::ApiServicesMissingError);
-        return false;
-    }
-
-    // Ensure we have a valid premium selection for gateway requests
-    bool premiumSelected = false;
-    for (int i = 0; i < m_apiServicesModel->rowCount(); ++i) {
-        m_apiServicesModel->setServiceIndex(i);
-        if (m_apiServicesModel->getSelectedServiceType() == premiumServiceType) {
-            premiumSelected = true;
-            break;
-        }
-    }
-
-    if (!premiumSelected) {
-        emit errorOccurred(ErrorCode::ApiServicesMissingError);
-        return false;
-    }
-
-    auto androidController = AndroidController::instance();
-    
-    // Query existing purchases
-    QJsonObject purchasesResult = androidController->queryPurchases();
-    int responseCode = purchasesResult.value("responseCode").toInt(-1);
-    
-    if (responseCode != 0) {
-        qWarning() << "[Billing] Failed to query purchases, responseCode:" << responseCode;
-        emit errorOccurred(ErrorCode::ApiPurchaseError);
-        return false;
-    }
-    
-    QJsonArray purchases = purchasesResult.value("purchases").toArray();
-    
-    if (purchases.isEmpty()) {
-        qInfo() << "[Billing] No purchases found to restore";
-        emit errorOccurred(ErrorCode::ApiNoPurchasesToRestore);
-        return false;
-    }
-    
-    bool hasInstalledConfig = false;
-    bool duplicateConfigAlreadyPresent = false;
-    QSet<QString> processedTokens;
-    
-    for (const QJsonValue &purchaseValue : purchases) {
-        QJsonObject purchase = purchaseValue.toObject();
-        QString purchaseToken = purchase.value("purchaseToken").toString();
-        bool isAcknowledged = purchase.value("isAcknowledged").toBool();
-        
-        if (purchaseToken.isEmpty()) {
-            qWarning() << "[Billing] Skipping purchase without token";
-            continue;
-        }
-        
-        if (processedTokens.contains(purchaseToken)) {
-            continue;
-        }
-        processedTokens.insert(purchaseToken);
-        
-        qInfo() << "[Billing] Restoring purchase. purchaseToken:" << purchaseToken
-                << "isAcknowledged:" << isAcknowledged;
-        
-        // Acknowledge purchase if needed
-        if (!isAcknowledged) {
-            QJsonObject ackResult = androidController->acknowledgePurchase(purchaseToken);
-            int ackResponseCode = ackResult.value("responseCode").toInt(-1);
-            if (ackResponseCode != 0) {
-                qWarning() << "[Billing] Acknowledge failed, responseCode:" << ackResponseCode;
-            } else {
-                qInfo() << "[Billing] Purchase acknowledged successfully";
-            }
-        }
-        
-        // Send purchase token to gateway
-        GatewayRequestData gatewayRequestData { QSysInfo::productType(),
-                                                QString(APP_VERSION),
-                                                m_settings->getAppLanguage().name().split("_").first(),
-                                                m_settings->getInstallationUuid(true),
-                                                m_apiServicesModel->getCountryCode(),
-                                                "",
-                                                m_apiServicesModel->getSelectedServiceType(),
-                                                m_apiServicesModel->getSelectedServiceProtocol(),
-                                                QJsonObject() };
-
-        QJsonObject apiPayload = gatewayRequestData.toJsonObject();
-        apiPayload[apiDefs::key::transactionId] = purchaseToken;
-        bool isTestPurchase = m_settings->isDevGatewayEnv(false) || androidController->isTestPurchaseEnvironment();
-
-        QByteArray responseBody;
-        ErrorCode errorCode = executeRequest(QString("%1v1/subscriptions"), apiPayload, responseBody, isTestPurchase);
-        if (errorCode != ErrorCode::NoError) {
-            qWarning() << "[Billing] Failed to restore purchase" << purchaseToken
-                      << "errorCode =" << static_cast<int>(errorCode);
-            continue;
-        }
-
-        ErrorCode installError = importServiceFromBilling(responseBody, isTestPurchase);
-        if (installError == ErrorCode::ApiConfigAlreadyAdded) {
-            duplicateConfigAlreadyPresent = true;
-            qInfo() << "[Billing] Skipping restored purchase" << purchaseToken
-                   << "because subscription config with the same vpn_key already exists";
-        } else if (installError != ErrorCode::NoError) {
-            qWarning() << "[Billing] Failed to process restored subscription response for purchase" << purchaseToken;
-        } else {
-            hasInstalledConfig = true;
-        }
-    }
-    
-    if (!hasInstalledConfig) {
-        const ErrorCode restoreError = duplicateConfigAlreadyPresent ? ErrorCode::ApiConfigAlreadyAdded : ErrorCode::ApiPurchaseError;
-        emit errorOccurred(restoreError);
-        return false;
-    }
-
-    emit installServerFromApiFinished(tr("Subscription restored successfully."));
 #endif
     return true;
 }
@@ -1088,9 +724,6 @@ bool ApiConfigsController::updateServiceFromTelegram(const int serverIndex)
     QThread::msleep(10);
 #endif
 
-    GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
-                                        m_settings->isStrictKillSwitchEnabled());
-
     auto serverConfig = m_serversModel->getServerConfig(serverIndex);
     auto installationUuid = m_settings->getInstallationUuid(true);
 
@@ -1106,7 +739,17 @@ bool ApiConfigsController::updateServiceFromTelegram(const int serverIndex)
     apiPayload[configKey::apiEndpoint] = serverConfig.value(configKey::apiEndpoint).toString();
 
     QByteArray responseBody;
-    ErrorCode errorCode = gatewayController.post(QString("%1v1/proxy_config"), apiPayload, responseBody);
+    QString endpoint = QString("%1v1/proxy_config");
+    
+    // Use GatewayController with parallel transports
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), 
+                                        m_settings->isDevGatewayEnv(), 
+                                        apiDefs::requestTimeoutMsecs,
+                                        m_settings->isStrictKillSwitchEnabled());
+    
+    gatewayController.setTransportsConfig(GatewayController::buildTransportsConfig());
+    
+    ErrorCode errorCode = gatewayController.post(endpoint, apiPayload, responseBody);
 
     if (errorCode == ErrorCode::NoError) {
         errorCode = fillServerConfig(serviceProtocol, protocolData, responseBody, serverConfig);
@@ -1264,16 +907,16 @@ QString ApiConfigsController::getVpnKey()
 
 ErrorCode ApiConfigsController::importServiceFromBilling(const QByteArray &responseBody, const bool isTestPurchase)
 {
-#if defined(Q_OS_IOS) || defined(Q_OS_ANDROID)
+#ifdef Q_OS_IOS
     QJsonObject responseObject = QJsonDocument::fromJson(responseBody).object();
     QString key = responseObject.value(QStringLiteral("key")).toString();
     if (key.isEmpty()) {
-        qWarning().noquote() << "[IAP/Billing] Subscription response does not contain a key field";
+        qWarning().noquote() << "[IAP] Subscription response does not contain a key field";
         return ErrorCode::ApiPurchaseError;
     }
 
     if (m_serversModel->hasServerWithVpnKey(key)) {
-        qInfo().noquote() << "[IAP/Billing] Subscription config with the same vpn_key already exists";
+        qInfo().noquote() << "[IAP] Subscription config with the same vpn_key already exists";
         return ErrorCode::ApiConfigAlreadyAdded;
     }
 
@@ -1287,7 +930,7 @@ ErrorCode ApiConfigsController::importServiceFromBilling(const QByteArray &respo
     }
 
     if (configString.isEmpty()) {
-        qWarning().noquote() << "[IAP/Billing] Subscription response config payload is empty";
+        qWarning().noquote() << "[IAP] Subscription response config payload is empty";
         return ErrorCode::ApiPurchaseError;
     }
 
@@ -1313,7 +956,12 @@ ErrorCode ApiConfigsController::importServiceFromBilling(const QByteArray &respo
 ErrorCode ApiConfigsController::executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody,
                                                bool isTestPurchase)
 {
-    GatewayController gatewayController(m_settings->getGatewayEndpoint(isTestPurchase), m_settings->isDevGatewayEnv(isTestPurchase),
-                                        apiDefs::requestTimeoutMsecs, m_settings->isStrictKillSwitchEnabled());
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(isTestPurchase), 
+                                        m_settings->isDevGatewayEnv(isTestPurchase),
+                                        apiDefs::requestTimeoutMsecs, 
+                                        m_settings->isStrictKillSwitchEnabled());
+    
+    gatewayController.setTransportsConfig(GatewayController::buildTransportsConfig());
+    
     return gatewayController.post(endpoint, apiPayload, responseBody);
 }

client/ui/controllers/api/apiConfigsController.h

@@ -27,8 +27,8 @@ public slots:
 
     bool fillAvailableServices();
     bool importService();
-    bool importServiceFromPaymentMarket();
-    bool restoreServiceFromPaymentMarket();
+    bool importSerivceFromAppStore();
+    bool restoreSerivceFromAppStore();
     bool importServiceFromGateway();
     bool updateServiceFromGateway(const int serverIndex, const QString &newCountryCode, const QString &newCountryName,
                                   bool reloadServiceConfig = false);

client/ui/controllers/api/apiNewsController.cpp

@@ -1,6 +1,8 @@
 #include "apiNewsController.h"
 
 #include "core/api/apiUtils.h"
+#include "core/controllers/gatewayController.h"
+#include "core/networkUtilities.h"
 #include <QJsonDocument>
 #include <QJsonObject>
 
@@ -31,8 +33,6 @@ void ApiNewsController::fetchNews(bool showError)
         return;
     }
 
-    auto gatewayController = QSharedPointer<GatewayController>::create(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(),
-                                                                       apiDefs::requestTimeoutMsecs, m_settings->isStrictKillSwitchEnabled());
     QJsonObject payload;
     payload.insert("locale", m_settings->getAppLanguage().name().split("_").first());
 
@@ -44,26 +44,35 @@ void ApiNewsController::fetchNews(bool showError)
         payload.insert(configKey::serviceType, stacksJson.value(configKey::serviceType));
     }
 
-    auto future = gatewayController->postAsync(QString("%1v1/news"), payload);
-    future.then(this, [this, showError, gatewayController](QPair<ErrorCode, QByteArray> result) {
-        auto [errorCode, responseBody] = result;
-        if (errorCode != ErrorCode::NoError) {
-            emit errorOccurred(errorCode, showError);
-            return;
+    QString endpoint = QString("%1v1/news");
+    
+    // Use GatewayController with parallel transports
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), 
+                                        m_settings->isDevGatewayEnv(),
+                                        apiDefs::requestTimeoutMsecs, 
+                                        m_settings->isStrictKillSwitchEnabled());
+    
+    gatewayController.setTransportsConfig(GatewayController::buildTransportsConfig());
+    
+    QByteArray responseBody;
+    ErrorCode errorCode = gatewayController.post(endpoint, payload, responseBody);
+    
+    if (errorCode != ErrorCode::NoError) {
+        emit errorOccurred(errorCode, showError);
+        return;
+    }
+    
+    // Parse response
+    QJsonDocument doc = QJsonDocument::fromJson(responseBody);
+    QJsonArray newsArray;
+    if (doc.isArray()) {
+        newsArray = doc.array();
+    } else if (doc.isObject()) {
+        QJsonObject obj = doc.object();
+        if (obj.value("news").isArray()) {
+            newsArray = obj.value("news").toArray();
         }
-
-        QJsonDocument doc = QJsonDocument::fromJson(responseBody);
-        QJsonArray newsArray;
-        if (doc.isArray()) {
-            newsArray = doc.array();
-        } else if (doc.isObject()) {
-            QJsonObject obj = doc.object();
-            if (obj.value("news").isArray()) {
-                newsArray = obj.value("news").toArray();
-            }
-        }
-
-        m_newsModel->updateModel(newsArray);
-        emit fetchNewsFinished();
-    });
+    }
+    m_newsModel->updateModel(newsArray);
+    emit fetchNewsFinished();
 }

client/ui/controllers/api/apiSettingsController.cpp

@@ -3,9 +3,13 @@
 #include <QEventLoop>
 #include <QTimer>
 
+#include "core/api/apiDefs.h"
 #include "core/api/apiUtils.h"
 #include "core/controllers/gatewayController.h"
+#include "core/networkUtilities.h"
+#ifdef Q_OS_IOS
 #include "platforms/ios/ios_controller.h"
+#endif
 #include "version.h"
 
 namespace
@@ -56,8 +60,6 @@ bool ApiSettingsController::getAccountInfo(bool reload)
     auto authData = serverConfig.value(configKey::authData).toObject();
 
     bool isTestPurchase = apiConfig.value(apiDefs::key::isTestPurchase).toBool(false);
-    GatewayController gatewayController(m_settings->getGatewayEndpoint(isTestPurchase), m_settings->isDevGatewayEnv(isTestPurchase),
-                                        requestTimeoutMsecs, m_settings->isStrictKillSwitchEnabled());
 
     QJsonObject apiPayload;
     apiPayload[configKey::userCountryCode] = apiConfig.value(configKey::userCountryCode).toString();
@@ -67,8 +69,18 @@ bool ApiSettingsController::getAccountInfo(bool reload)
     apiPayload[apiDefs::key::appLanguage] = m_settings->getAppLanguage().name().split("_").first();
 
     QByteArray responseBody;
-
-    ErrorCode errorCode = gatewayController.post(QString("%1v1/account_info"), apiPayload, responseBody);
+    QString endpoint = QString("%1v1/account_info");
+    
+    // Use GatewayController with parallel transports
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(isTestPurchase), 
+                                        m_settings->isDevGatewayEnv(isTestPurchase),
+                                        requestTimeoutMsecs, 
+                                        m_settings->isStrictKillSwitchEnabled());
+    
+    gatewayController.setTransportsConfig(GatewayController::buildTransportsConfig());
+    
+    ErrorCode errorCode = gatewayController.post(endpoint, apiPayload, responseBody);
+    
     if (errorCode != ErrorCode::NoError) {
         emit errorOccurred(errorCode);
         return false;

client/ui/controllers/importController.cpp

@@ -291,8 +291,6 @@ void ImportController::processNativeWireGuardConfig()
         clientProtocolConfig[config_key::cookieReplyPacketJunkSize] = "0";
         clientProtocolConfig[config_key::transportPacketJunkSize] = "0";
 
-        clientProtocolConfig[config_key::specialJunk1] = protocols::awg::defaultSpecialJunk1;
-
         clientProtocolConfig[config_key::isObfuscationEnabled] = true;
 
         serverProtocolConfig[config_key::last_config] = QString(QJsonDocument(clientProtocolConfig).toJson());

client/ui/controllers/settingsController.cpp

@@ -308,15 +308,6 @@ void SettingsController::toggleStartMinimized(bool enable)
     emit startMinimizedChanged();
 }
 
-bool SettingsController::isNewsNotificationsEnabled()
-{
-    return m_settings->isNewsNotifications();
-}
-void SettingsController::toggleNewsNotificationsEnabled(bool enable)
-{
-    m_settings->setNewsNotifications(enable);
-}
-
 bool SettingsController::isScreenshotsEnabled()
 {
     return m_settings->isScreenshotsEnabled();

client/ui/controllers/settingsController.h

@@ -73,9 +73,6 @@ public slots:
     bool isStartMinimizedEnabled();
     void toggleStartMinimized(bool enable);
 
-    bool isNewsNotificationsEnabled();
-    void toggleNewsNotificationsEnabled(bool enable);
-
     bool isScreenshotsEnabled();
     void toggleScreenshotsEnabled(bool enable);
 

client/ui/models/api/apiServicesModel.cpp

@@ -112,13 +112,7 @@ QVariant ApiServicesModel::data(const QModelIndex &index, int role) const
         if (price == "free") {
             return tr("Free");
         }
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-        return tr("%1 $").arg(price);
-#elif defined(Q_OS_ANDROID)
-        return price;
-#else
         return tr("%1 $/month").arg(price);
-#endif
     }
     case EndDateRole: {
         return QDateTime::fromString(apiServiceData.subscription.endDate, Qt::ISODate).toLocalTime().toString("d MMM yyyy");

client/ui/qml/Components/GamepadLoader.qml

@@ -1,38 +0,0 @@
-import QtQuick
-import QtGamepadLegacy
-
-Item {
-    id: root
-    
-    property alias gamepad: gamepad
-    property alias gamepadKeyNav: gamepadKeyNav
-    
-    Gamepad {
-        id: gamepad
-        deviceId: GamepadManager.connectedGamepads.length > 0 ? GamepadManager.connectedGamepads[0] : -1
-
-        onButtonStartChanged: {
-            if (buttonStart) {
-                ServersModel.setProcessedServerIndex(ServersModel.defaultIndex)
-                ConnectionController.connectButtonClicked()
-            }
-        }
-    }
-
-    GamepadKeyNavigation {
-        id: gamepadKeyNav
-        gamepad: gamepad
-        active: true
-    }
-
-    Connections {
-        target: GamepadManager
-        function onConnectedGamepadsChanged() {
-            if (GamepadManager.connectedGamepads.length > 0) {
-                gamepad.deviceId = GamepadManager.connectedGamepads[0]
-            } else {
-                gamepad.deviceId = -1
-            }
-        }
-    }
-}

client/ui/qml/Controls2/BasicButtonType.qml

@@ -111,11 +111,11 @@ Button {
                 color: {
                     if (root.enabled) {
                         if (root.pressed) {
-                            return root.pressedColor
+                            return pressedColor
                         }
-                        return root.hovered ? root.hoveredColor : root.defaultColor
+                        return root.hovered ? hoveredColor : defaultColor
                     } else {
-                        return root.disabledColor
+                        return disabledColor
                     }
                 }
 

client/ui/qml/Controls2/DrawerType2.qml

@@ -49,55 +49,6 @@ Item {
         return drawerContent.state === stateName
     }
 
-    function isDrawerType2(obj) {
-        return obj && typeof obj.drawerExpandedStateName !== "undefined" && 
-               typeof obj.drawerCollapsedStateName !== "undefined"
-    }
-
-    function isDescendantOfDrawer(obj) {
-        var current = obj
-        while (current && current !== root.parent) {
-            if (isDrawerType2(current)) {
-                return true
-            }
-            current = current.parent
-        }
-        return false
-    }
-
-    function findComponent(obj, typeCtor) {
-        if (!obj)
-            return null
-
-        if (isDrawerType2(obj) || isDescendantOfDrawer(obj))
-            return null
-
-        if (obj instanceof typeCtor)
-            return obj
-
-        if (obj.children && obj.children.length > 0) {
-            for (var i = 0; i < obj.children.length; i++) {
-                var matchingChildren = findComponent(obj.children[i], typeCtor)
-                if (matchingChildren) return matchingChildren
-            }
-        }
-
-        if (obj.contentItem) {
-            var matchingContentItem = findComponent(obj.contentItem, typeCtor)
-            if (matchingContentItem) return matchingContentItem
-        }
-
-        return null
-    }
-
-    function setParentInteractive(value) {
-        var flickableType = findComponent(root.parent, Flickable)
-        var listViewType = findComponent(root.parent, ListView)
-
-        if (flickableType) flickableType.interactive = value
-        if (listViewType) listViewType.interactive = value
-    }
-
     Connections {
         target: Qt.application
 
@@ -142,8 +93,6 @@ Item {
 
             aboutToHide()
 
-            setParentInteractive(true)
-
             closed()
         }
 
@@ -169,8 +118,6 @@ Item {
 
             root.aboutToShow()
 
-            setParentInteractive(false)
-
             root.opened()
         }
 

client/ui/qml/Controls2/LabelWithButtonType.qml

@@ -71,8 +71,6 @@ Item {
     implicitHeight: content.implicitHeight + content.anchors.leftMargin + content.anchors.rightMargin
 
     MouseArea {
-        id: mouseArea
-
         anchors.fill: parent
         cursorShape: Qt.PointingHandCursor
         hoverEnabled: root.enabled
@@ -298,13 +296,13 @@ Item {
     }
 
     Keys.onEnterPressed: {
-        if (!rightImageSource && clickedFunction && typeof clickedFunction === "function") {
+        if (clickedFunction && typeof clickedFunction === "function") {
             clickedFunction()
         }
     }
 
     Keys.onReturnPressed: {
-        if (!rightImageSource && clickedFunction && typeof clickedFunction === "function") {
+        if (clickedFunction && typeof clickedFunction === "function") {
             clickedFunction()
         }
     }

client/ui/qml/Controls2/TextFieldWithHeaderType.qml

@@ -19,6 +19,9 @@ Item {
 
     property string buttonText
     property string buttonImageSource
+    property string buttonImageColor: AmneziaStyle.color.midnightBlack
+    property string buttonBackgroundColor: AmneziaStyle.color.paleGray
+    property string buttonHoveredColor: AmneziaStyle.color.lightGray
     property var clickedFunc
 
     property alias textField: textField
@@ -67,7 +70,7 @@ Item {
             border.width: 1
 
             Behavior on border.color {
-                PropertyAnimation { duration: 200 }
+                PropertyAnimation { duration: 100 }
             }
 
             RowLayout {
@@ -121,7 +124,7 @@ Item {
 
                         background: Rectangle {
                             anchors.fill: parent
-                            color: root.backgroundDisabledColor
+                            color: root.enabled ? root.backgroundColor : root.backgroundDisabledColor
                         }
 
                         onTextChanged: {
@@ -186,6 +189,14 @@ Item {
         focusPolicy: Qt.NoFocus
         text: root.buttonText
         leftImageSource: root.buttonImageSource
+        leftImageColor: root.buttonImageColor
+
+        defaultColor: root.buttonBackgroundColor
+        hoveredColor: root.buttonHoveredColor
+        pressedColor: root.buttonHoveredColor
+        disabledColor: AmneziaStyle.color.transparent
+
+        borderWidth: 0
 
         anchors.top: content.top
         anchors.bottom: content.bottom
@@ -193,7 +204,7 @@ Item {
 
         height: content.implicitHeight
         width: content.implicitHeight
-        squareLeftSide: true
+        squareLeftSide: false
 
         clickedFunc: function() {
             if (root.clickedFunc && typeof root.clickedFunc === "function") {

client/ui/qml/Pages2/PageProtocolCloakSettings.qml

@@ -140,16 +140,6 @@ PageType {
                         ListElement { name : "aes-128-gcm" }
                     }
 
-                    function updateSelectedIndex() {
-                        cipherDropDown.text = cipher
-                        for (var i = 0; i < cipherListView.model.count; i++) {
-                            if (cipherListView.model.get(i).name === cipher) {
-                                selectedIndex = i
-                                break
-                            }
-                        }
-                    }
-
                     clickedFunction: function() {
                         cipherDropDown.text = selectedText
                         cipher = cipherDropDown.text
@@ -157,14 +147,13 @@ PageType {
                     }
 
                     Component.onCompleted: {
-                        updateSelectedIndex()
-                    }
-                }
+                        cipherDropDown.text = cipher
 
-                Connections {
-                    target: listView.model
-                    function onDataChanged() {
-                        cipherListView.updateSelectedIndex()
+                        for (var i = 0; i < cipherListView.model.count; i++) {
+                            if (cipherListView.model.get(i).name === cipherDropDown.text) {
+                                selectedIndex = i
+                            }
+                        }
                     }
                 }
             }

client/ui/qml/Pages2/PageProtocolOpenVpnSettings.qml

@@ -192,16 +192,6 @@ PageType {
                         ListElement { name : qsTr("SHA1") }
                     }
 
-                    function updateSelectedIndex() {
-                        hashDropDown.text = hash
-                        for (var i = 0; i < hashListView.model.count; i++) {
-                            if (hashListView.model.get(i).name === hash) {
-                                selectedIndex = i
-                                break
-                            }
-                        }
-                    }
-
                     clickedFunction: function() {
                         hashDropDown.text = selectedText
                         hash = hashDropDown.text
@@ -209,14 +199,13 @@ PageType {
                     }
 
                     Component.onCompleted: {
-                        updateSelectedIndex()
-                    }
-                }
+                        hashDropDown.text = hash
 
-                Connections {
-                    target: listView.model
-                    function onDataChanged() {
-                        hashListView.updateSelectedIndex()
+                        for (var i = 0; i < hashListView.model.count; i++) {
+                            if (hashListView.model.get(i).name === hashDropDown.text) {
+                                currentIndex = i
+                            }
+                        }
                     }
                 }
             }
@@ -253,16 +242,6 @@ PageType {
                         ListElement { name : qsTr("none") }
                     }
 
-                    function updateSelectedIndex() {
-                        cipherDropDown.text = cipher
-                        for (var i = 0; i < cipherListView.model.count; i++) {
-                            if (cipherListView.model.get(i).name === cipher) {
-                                selectedIndex = i
-                                break
-                            }
-                        }
-                    }
-
                     clickedFunction: function() {
                         cipherDropDown.text = selectedText
                         cipher = cipherDropDown.text
@@ -270,14 +249,13 @@ PageType {
                     }
 
                     Component.onCompleted: {
-                        updateSelectedIndex()
-                    }
-                }
+                        cipherDropDown.text = cipher
 
-                Connections {
-                    target: listView.model
-                    function onDataChanged() {
-                        cipherListView.updateSelectedIndex()
+                        for (var i = 0; i < cipherListView.model.count; i++) {
+                            if (cipherListView.model.get(i).name === cipherDropDown.text) {
+                                currentIndex = i
+                            }
+                        }
                     }
                 }
             }

client/ui/qml/Pages2/PageProtocolShadowSocksSettings.qml

@@ -109,16 +109,6 @@ PageType {
                         ListElement { name : "aes-128-gcm" }
                     }
 
-                    function updateSelectedIndex() {
-                        cipherDropDown.text = cipher
-                        for (var i = 0; i < cipherListView.model.count; i++) {
-                            if (cipherListView.model.get(i).name === cipher) {
-                                selectedIndex = i
-                                break
-                            }
-                        }
-                    }
-
                     clickedFunction: function() {
                         cipherDropDown.text = selectedText
                         cipher = cipherDropDown.text
@@ -126,14 +116,13 @@ PageType {
                     }
 
                     Component.onCompleted: {
-                        updateSelectedIndex()
-                    }
-                }
+                        cipherDropDown.text = cipher
 
-                Connections {
-                    target: listView.model
-                    function onDataChanged() {
-                        cipherListView.updateSelectedIndex()
+                        for (var i = 0; i < cipherListView.model.count; i++) {
+                            if (cipherListView.model.get(i).name === cipherDropDown.text) {
+                                currentIndex = i
+                            }
+                        }
                     }
                 }
             }

client/ui/qml/Pages2/PageSettings.qml

@@ -148,7 +148,7 @@ PageType {
         id: news
 
         property string title: qsTr("News & Notifications")
-        readonly property string leftImagePath: NewsModel.hasUnread && SettingsController.isNewsNotificationsEnabled() ? "qrc:/images/controls/news-unread.svg" : "qrc:/images/controls/news.svg"
+        readonly property string leftImagePath: NewsModel.hasUnread ? "qrc:/images/controls/news-unread.svg" : "qrc:/images/controls/news.svg"
         property bool isVisible: ServersModel.hasServersFromGatewayApi
         readonly property var clickedHandler: function() {
             if (!ServersModel.hasServersFromGatewayApi) {

client/ui/qml/Pages2/PageSettingsApiServerInfo.qml

@@ -396,7 +396,9 @@ PageType {
                             PageController.showNotificationMessage(qsTr("Cannot remove server during active connection"))
                         } else {
                             PageController.showBusyIndicator(true)
-                            InstallController.removeProcessedServer()
+                            if (ApiConfigsController.deactivateDevice(true)) {
+                                InstallController.removeProcessedServer()
+                            }
                             PageController.showBusyIndicator(false)
                         }
                     }

client/ui/qml/Pages2/PageSettingsAppSplitTunneling.qml

@@ -224,6 +224,7 @@ PageType {
         height: addAppButton.implicitHeight + 48 + SettingsController.safeAreaBottomMargin
         
         color: AmneziaStyle.color.midnightBlack
+        opacity: 0.8
         
         RowLayout {
             id: addAppButton

client/ui/qml/Pages2/PageSettingsApplication.qml

@@ -168,29 +168,6 @@ PageType {
             DividerType {
                 visible: !GC.isMobile()
             }
-
-            SwitcherType {
-                id: switcherNewsNotificationEnabled
-
-                visible: ServersModel.hasServersFromGatewayApi
-
-                Layout.fillWidth: true
-                Layout.margins: 16
-
-                text: qsTr("News Notification")
-                descriptionText: qsTr("Show notification icon when has unread news")
-
-                checked: SettingsController.isNewsNotificationsEnabled()
-                onToggled: function() {
-                    if (checked !== SettingsController.isNewsNotificationsEnabled()) {
-                        SettingsController.toggleNewsNotificationsEnabled(checked)
-                    }
-                }
-            }
-
-            DividerType {
-                visible: !GC.isMobile()
-            }
         }
 
         footer: ColumnLayout {

client/ui/qml/Pages2/PageSettingsSplitTunneling.qml

@@ -240,6 +240,7 @@ PageType {
         height: addSiteButton.implicitHeight + 48
         
         color: AmneziaStyle.color.midnightBlack
+        opacity: 0.8
         
         RowLayout {
             id: addSiteButton

client/ui/qml/Pages2/PageSetupWizardApiServiceInfo.qml

@@ -1,237 +1,179 @@
-import QtQuick
-import QtQuick.Controls
-import QtQuick.Layouts
-import QtQuick.Dialogs
-
-import PageEnum 1.0
-import Style 1.0
-
-import "./"
-import "../Controls2"
-import "../Controls2/TextTypes"
-import "../Config"
-import "../Components"
-
-PageType {
-    id: root
-
-    BackButtonType {
-        id: backButton
-
-        anchors.top: parent.top
-        anchors.left: parent.left
-        anchors.right: parent.right
-        anchors.topMargin: 20 + SettingsController.safeAreaTopMargin
-
-        onFocusChanged: {
-            if (this.activeFocus) {
-                listView.positionViewAtBeginning()
-            }
-        }
-    }
-
-    ListViewType {
-        id: listView
-
-        anchors.top: backButton.bottom
-        anchors.bottom: parent.bottom
-        anchors.right: parent.right
-        anchors.left: parent.left
-
-        header: ColumnLayout {
-            width: listView.width
-
-            BaseHeaderType {
-                Layout.fillWidth: true
-                Layout.topMargin: 8
-                Layout.rightMargin: 16
-                Layout.leftMargin: 16
-                Layout.bottomMargin: 32
-
-                headerText: ApiServicesModel.getSelectedServiceData("name")
-                descriptionText: ApiServicesModel.getSelectedServiceData("serviceDescription")
-            }
-        }
-
-        model: inputFields
-        spacing: 0
-
-        delegate: ColumnLayout {
-            width: listView.width
-
-            LabelWithImageType {
-                Layout.fillWidth: true
-                Layout.margins: 16
-
-                imageSource: imagePath
-                leftText: lText
-                rightText: rText
-
-                visible: isVisible
-            }
-        }
-
-        footer: ColumnLayout {
-            width: listView.width
-
-            spacing: 0
-
-            ParagraphTextType {
-                Layout.fillWidth: true
-                Layout.rightMargin: 16
-                Layout.leftMargin: 16
-
-                onLinkActivated: function(link) {
-                    Qt.openUrlExternally(link)
-                }
-                textFormat: Text.RichText
-                text: {
-                    var text = ApiServicesModel.getSelectedServiceData("features")
-                    return text.replace("%1", LanguageModel.getCurrentSiteUrl("free")).replace("/free", "") // todo link should come from gateway
-                }
-
-                MouseArea {
-                    anchors.fill: parent
-                    acceptedButtons: Qt.NoButton
-                    cursorShape: parent.hoveredLink ? Qt.PointingHandCursor : Qt.ArrowCursor
-                }
-            }
-
-            ParagraphTextType {
-                Layout.fillWidth: true
-                Layout.topMargin: 16
-                Layout.leftMargin: 16
-                Layout.rightMargin: 16
-
-                visible: ((Qt.platform.os === "ios" || IsMacOsNeBuild) && ApiServicesModel.getSelectedServiceType() === "amnezia-premium") ||
-                         (Qt.platform.os === "android" && ApiServicesModel.getSelectedServiceType() === "amnezia-premium")
-
-                horizontalAlignment: Text.AlignHCenter
-                textFormat: Text.PlainText
-                color: AmneziaStyle.color.mutedGray
-                font.pixelSize: 12
-
-                text: {
-                    if (Qt.platform.os === "ios" || IsMacOsNeBuild) {
-                        return qsTr("Charged to your Apple ID at confirmation. Renews automatically unless auto-renew is turned off at least 24 hours before period end. Manage in Apple ID settings.")
-                    } else if (Qt.platform.os === "android") {
-                        return qsTr("Charged to your Google Play account at confirmation. Renews automatically unless auto-renew is turned off at least 24 hours before period end. Manage in Google Play settings.")
-                    }
-                    return ""
-                }
-            }
-
-            BasicButtonType {
-                id: continueButton
-
-                Layout.fillWidth: true
-                Layout.topMargin: 32
-                Layout.bottomMargin: 16
-                Layout.leftMargin: 16
-                Layout.rightMargin: 16
-
-                text: ApiServicesModel.getSelectedServiceType() === "amnezia-premium" ? qsTr("Subscribe Now") : qsTr("Connect")
-
-                clickedFunc: function() {
-                    PageController.showBusyIndicator(true)
-                    var result = ApiConfigsController.importService()
-                    PageController.showBusyIndicator(false)
-
-                    if (!result) {
-                        var endpoint = ApiServicesModel.getStoreEndpoint()
-                        Qt.openUrlExternally(endpoint)
-                        PageController.closePage()
-                        PageController.closePage()
-                    }
-                }
-            }
-
-            ParagraphTextType {
-                Layout.fillWidth: true
-                Layout.topMargin: 16
-                Layout.leftMargin: 16
-                Layout.rightMargin: 16
-                Layout.bottomMargin: 32
-
-                visible: ((Qt.platform.os === "ios" || IsMacOsNeBuild) && ApiServicesModel.getSelectedServiceType() === "amnezia-premium") ||
-                         (Qt.platform.os === "android" && ApiServicesModel.getSelectedServiceType() === "amnezia-premium")
-
-                horizontalAlignment: Text.AlignHCenter
-                textFormat: Text.RichText
-                color: AmneziaStyle.color.mutedGray
-                font.pixelSize: 12
-
-                text: {
-                    var termsUrl = Qt.platform.os === "ios" || IsMacOsNeBuild ? 
-                                   "https://www.apple.com/legal/internet-services/itunes/dev/stdeula/" :
-                                   "https://play.google.com/intl/en_us/about/play-terms/"
-                    var privacyUrl = LanguageModel.getCurrentSiteUrl("policy")
-                    return qsTr("By continuing, you agree to the <a href=\"%1\" style=\"color: #FBB26A;\">Terms of Use</a> and <a href=\"%2\" style=\"color: #FBB26A;\">Privacy Policy</a>").arg(termsUrl).arg(privacyUrl)
-                }
-
-                onLinkActivated: function(link) {
-                    Qt.openUrlExternally(link)
-                }
-
-                MouseArea {
-                    anchors.fill: parent
-                    acceptedButtons: Qt.NoButton
-                    cursorShape: parent.hoveredLink ? Qt.PointingHandCursor : Qt.ArrowCursor
-                }
-            }
-        }
-    }
-
-    property list<QtObject> inputFields: [
-        region,
-        price,
-        timeLimit,
-        speed,
-        features
-    ]
-
-    QtObject {
-        id: region
-
-        readonly property string imagePath: "qrc:/images/controls/map-pin.svg"
-        readonly property string lText: qsTr("For the region")
-        readonly property string rText: ApiServicesModel.getSelectedServiceData("region")
-        property bool isVisible: true
-    }
-
-    QtObject {
-        id: price
-
-        readonly property string imagePath: "qrc:/images/controls/tag.svg"
-        readonly property string lText: qsTr("Price")
-        readonly property string rText: ApiServicesModel.getSelectedServiceData("price")
-        property bool isVisible: true
-    }
-
-    QtObject {
-        id: timeLimit
-
-        readonly property string imagePath: "qrc:/images/controls/history.svg"
-        readonly property string lText: qsTr("Work period")
-        readonly property string rText: ApiServicesModel.getSelectedServiceData("timeLimit")
-        property bool isVisible: rText !== ""
-    }
-
-    QtObject {
-        id: speed
-
-        readonly property string imagePath: "qrc:/images/controls/gauge.svg"
-        readonly property string lText: qsTr("Speed")
-        readonly property string rText: ApiServicesModel.getSelectedServiceData("speed")
-        property bool isVisible: true
-    }
-
-    QtObject {
-        id: features
-
-        readonly property string imagePath: "qrc:/images/controls/info.svg"
-        readonly property string lText: qsTr("Features")
-        readonly property string rText: ""
-        property bool isVisible: true
-    }
-}
+import QtQuick
+import QtQuick.Controls
+import QtQuick.Layouts
+import QtQuick.Dialogs
+
+import PageEnum 1.0
+import Style 1.0
+
+import "./"
+import "../Controls2"
+import "../Controls2/TextTypes"
+import "../Config"
+import "../Components"
+
+PageType {
+    id: root
+
+    BackButtonType {
+        id: backButton
+
+        anchors.top: parent.top
+        anchors.left: parent.left
+        anchors.right: parent.right
+        anchors.topMargin: 20 + SettingsController.safeAreaTopMargin
+
+        onFocusChanged: {
+            if (this.activeFocus) {
+                listView.positionViewAtBeginning()
+            }
+        }
+    }
+
+    ListViewType {
+        id: listView
+
+        anchors.top: backButton.bottom
+        anchors.bottom: parent.bottom
+        anchors.right: parent.right
+        anchors.left: parent.left
+
+        header: ColumnLayout {
+            width: listView.width
+
+            BaseHeaderType {
+                Layout.fillWidth: true
+                Layout.topMargin: 8
+                Layout.rightMargin: 16
+                Layout.leftMargin: 16
+                Layout.bottomMargin: 32
+
+                headerText: ApiServicesModel.getSelectedServiceData("name")
+                descriptionText: ApiServicesModel.getSelectedServiceData("serviceDescription")
+            }
+        }
+
+        model: inputFields
+        spacing: 0
+
+        delegate: ColumnLayout {
+            width: listView.width
+
+            LabelWithImageType {
+                Layout.fillWidth: true
+                Layout.margins: 16
+
+                imageSource: imagePath
+                leftText: lText
+                rightText: rText
+
+                visible: isVisible
+            }
+        }
+
+        footer: ColumnLayout {
+            width: listView.width
+
+            spacing: 0
+
+            ParagraphTextType {
+                Layout.fillWidth: true
+                Layout.rightMargin: 16
+                Layout.leftMargin: 16
+
+                onLinkActivated: function(link) {
+                    Qt.openUrlExternally(link)
+                }
+                textFormat: Text.RichText
+                text: {
+                    var text = ApiServicesModel.getSelectedServiceData("features")
+                    return text.replace("%1", LanguageModel.getCurrentSiteUrl("free")).replace("/free", "") // todo link should come from gateway
+                }
+
+                MouseArea {
+                    anchors.fill: parent
+                    acceptedButtons: Qt.NoButton
+                    cursorShape: parent.hoveredLink ? Qt.PointingHandCursor : Qt.ArrowCursor
+                }
+            }
+
+            BasicButtonType {
+                id: continueButton
+
+                Layout.fillWidth: true
+                Layout.topMargin: 32
+                Layout.bottomMargin: 32
+                Layout.leftMargin: 16
+                Layout.rightMargin: 16
+
+                text: qsTr("Connect")
+
+                clickedFunc: function() {
+                    PageController.showBusyIndicator(true)
+                    var result = ApiConfigsController.importService()
+                    PageController.showBusyIndicator(false)
+
+                    if (!result) {
+                        var endpoint = ApiServicesModel.getStoreEndpoint()
+                        Qt.openUrlExternally(endpoint)
+                        PageController.closePage()
+                        PageController.closePage()
+                    }
+                }
+            }
+        }
+    }
+
+    property list<QtObject> inputFields: [
+        region,
+        price,
+        timeLimit,
+        speed,
+        features
+    ]
+
+    QtObject {
+        id: region
+
+        readonly property string imagePath: "qrc:/images/controls/map-pin.svg"
+        readonly property string lText: qsTr("For the region")
+        readonly property string rText: ApiServicesModel.getSelectedServiceData("region")
+        property bool isVisible: true
+    }
+
+    QtObject {
+        id: price
+
+        readonly property string imagePath: "qrc:/images/controls/tag.svg"
+        readonly property string lText: qsTr("Price")
+        readonly property string rText: ApiServicesModel.getSelectedServiceData("price")
+        property bool isVisible: true
+    }
+
+    QtObject {
+        id: timeLimit
+
+        readonly property string imagePath: "qrc:/images/controls/history.svg"
+        readonly property string lText: qsTr("Work period")
+        readonly property string rText: ApiServicesModel.getSelectedServiceData("timeLimit")
+        property bool isVisible: rText !== ""
+    }
+
+    QtObject {
+        id: speed
+
+        readonly property string imagePath: "qrc:/images/controls/gauge.svg"
+        readonly property string lText: qsTr("Speed")
+        readonly property string rText: ApiServicesModel.getSelectedServiceData("speed")
+        property bool isVisible: true
+    }
+
+    QtObject {
+        id: features
+
+        readonly property string imagePath: "qrc:/images/controls/info.svg"
+        readonly property string lText: qsTr("Features")
+        readonly property string rText: ""
+        property bool isVisible: true
+    }
+}

client/ui/qml/Pages2/PageSetupWizardConfigSource.qml

@@ -358,10 +358,10 @@ PageType {
         property string title: qsTr("Restore purchases")
         property string description: qsTr("")
         property string imageSource: "qrc:/images/controls/refresh-cw.svg"
-        property bool isVisible: Qt.platform.os === "ios" || IsMacOsNeBuild || Qt.platform.os === "android"
+        property bool isVisible: Qt.platform.os === "ios" || IsMacOsNeBuild
         property var handler: function() {
             PageController.showBusyIndicator(true)
-            ApiConfigsController.restoreServiceFromPaymentMarket()
+            ApiConfigsController.restoreSerivceFromAppStore()
             PageController.showBusyIndicator(false)
         }
     }

client/ui/qml/Pages2/PageSetupWizardEasy.qml

@@ -107,7 +107,6 @@ PageType {
 
                 onClicked: function() {
                     isEasySetup = true
-                    checked = true
                     var defaultContainerProto =  ContainerProps.defaultProtocol(dockerContainer)
 
                     listView.dockerContainer = dockerContainer

client/ui/qml/Pages2/PageStart.qml

@@ -383,7 +383,7 @@ PageType {
             objectName: "settingsTabButton"
 
             isSelected: tabBar.currentIndex === 2
-            image: (ServersModel.hasServersFromGatewayApi && NewsModel.hasUnread && SettingsController.isNewsNotificationsEnabled()) ? "qrc:/images/controls/settings-news.svg" : "qrc:/images/controls/settings.svg"
+            image: (ServersModel.hasServersFromGatewayApi && NewsModel.hasUnread) ? "qrc:/images/controls/settings-news.svg" : "qrc:/images/controls/settings.svg"
             Binding {
                 target: settingsTabButton
                 property: "defaultColor"

client/ui/qml/main2.qml

@@ -83,11 +83,6 @@ Window  {
         }
     }
 
-    Loader {
-        active: Qt.platform.os === "android"
-        source: Qt.platform.os === "android" ? "Components/GamepadLoader.qml" : ""
-    }
-
     Connections {
         objectName: "pageControllerConnections"
 

client/vpnconnection.cpp

@@ -41,6 +41,7 @@ VpnConnection::VpnConnection(std::shared_ptr<Settings> settings, QObject *parent
     m_checkTimer.setInterval(1000);
     connect(IosController::Instance(), &IosController::connectionStateChanged, this, &VpnConnection::onConnectionStateChanged);
     connect(IosController::Instance(), &IosController::bytesChanged, this, &VpnConnection::onBytesChanged);
+
 #endif
 }
 
@@ -58,7 +59,7 @@ void VpnConnection::onKillSwitchModeChanged(bool enabled)
 #ifdef AMNEZIA_DESKTOP
     IpcClient::withInterface([enabled](QSharedPointer<IpcInterfaceReplica> iface){
         QRemoteObjectPendingReply<bool> reply = iface->refreshKillSwitch(enabled);
-        if (reply.waitForFinished() && reply.returnValue())
+        if (reply.waitForFinished(1000) && reply.returnValue())
             qDebug() << "VpnConnection::onKillSwitchModeChanged: Killswitch refreshed";
         else
             qWarning() << "VpnConnection::onKillSwitchModeChanged: Failed to execute remote refreshKillSwitch call";
@@ -72,57 +73,60 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
     auto container = m_settings->defaultContainer(m_settings->defaultServerIndex());
 
     IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-        switch (state) {
-            case Vpn::ConnectionState::Connected: {
-                iface->resetIpStack();
+        if (state == Vpn::ConnectionState::Connected) {
+            iface->resetIpStack();
+            iface->flushDns();
 
-                auto flushDns = iface->flushDns();
-                if (flushDns.waitForFinished() && flushDns.returnValue())
-                    qDebug() << "VpnConnection::onConnectionStateChanged: Successfully flushed DNS";
-                else
-                    qWarning() << "VpnConnection::onConnectionStateChanged: Failed to clear saved routes";
+            if (!ContainerProps::isAwgContainer(container) && 
+                container != DockerContainer::WireGuard) {
+                QString dns1 = m_vpnConfiguration.value(config_key::dns1).toString();
+                QString dns2 = m_vpnConfiguration.value(config_key::dns2).toString();
 
+                iface->routeAddList(m_vpnProtocol->vpnGateway(), QStringList() << dns1 << dns2);
 
-                if (!ContainerProps::isAwgContainer(container) &&
-                    container != DockerContainer::WireGuard) {
-                    QString dns1 = m_vpnConfiguration.value(config_key::dns1).toString();
-                    QString dns2 = m_vpnConfiguration.value(config_key::dns2).toString();
+                if (m_settings->isSitesSplitTunnelingEnabled()) {
+                    iface->routeDeleteList(m_vpnProtocol->vpnGateway(), QStringList() << "0.0.0.0");
+                    // qDebug() << "VpnConnection::onConnectionStateChanged :: adding custom routes, count:" << forwardIps.size();
+                    if (m_settings->routeMode() == Settings::VpnOnlyForwardSites) {
+                        QTimer::singleShot(1000, m_vpnProtocol.data(),
+                                           [this]() { addSitesRoutes(m_vpnProtocol->vpnGateway(), m_settings->routeMode()); });
+                    } else if (m_settings->routeMode() == Settings::VpnAllExceptSites) {
+                        iface->routeAddList(m_vpnProtocol->vpnGateway(), QStringList() << "0.0.0.0/1");
+                        iface->routeAddList(m_vpnProtocol->vpnGateway(), QStringList() << "128.0.0.0/1");
 
-                    // TODO: add error code handling for all routeAddList (or rework the code below)
-                    iface->routeAddList(m_vpnProtocol->vpnGateway(), QStringList() << dns1 << dns2);
-
-                    if (m_settings->isSitesSplitTunnelingEnabled()) {
-                        iface->routeDeleteList(m_vpnProtocol->vpnGateway(), QStringList() << "0.0.0.0");
-                        // qDebug() << "VpnConnection::onConnectionStateChanged :: adding custom routes, count:" << forwardIps.size();
-                        if (m_settings->routeMode() == Settings::VpnOnlyForwardSites) {
-                            QTimer::singleShot(1000, m_vpnProtocol.data(),
-                                               [this]() { addSitesRoutes(m_vpnProtocol->vpnGateway(), m_settings->routeMode()); });
-                        } else if (m_settings->routeMode() == Settings::VpnAllExceptSites) {
-                            iface->routeAddList(m_vpnProtocol->vpnGateway(), QStringList() << "0.0.0.0/1");
-                            iface->routeAddList(m_vpnProtocol->vpnGateway(), QStringList() << "128.0.0.0/1");
-
-                            iface->routeAddList(m_vpnProtocol->routeGateway(), QStringList() << remoteAddress());
-                            addSitesRoutes(m_vpnProtocol->routeGateway(), m_settings->routeMode());
-                        }
+                        iface->routeAddList(m_vpnProtocol->routeGateway(), QStringList() << remoteAddress());
+                        addSitesRoutes(m_vpnProtocol->routeGateway(), m_settings->routeMode());
                     }
                 }
-            } break;
-            case Vpn::ConnectionState::Disconnected:
-            case Vpn::ConnectionState::Error: {
-                auto flushDns = iface->flushDns();
-                if (flushDns.waitForFinished() && flushDns.returnValue())
-                    qDebug() << "VpnConnection::onConnectionStateChanged: Successfully flushed DNS";
-                else
-                    qWarning() << "VpnConnection::onConnectionStateChanged: Failed to flush DNS";
+            }
 
-                auto clearSavedRoutes = iface->clearSavedRoutes();
-                if (clearSavedRoutes.waitForFinished() && clearSavedRoutes.returnValue())
-                    qDebug() << "VpnConnection::onConnectionStateChanged: Successfully cleared saved routes";
-                else
-                    qWarning() << "VpnConnection::onConnectionStateChanged: Failed to clear saved routes";
-            } break;
-            default:
-                break;
+            if (container != DockerContainer::Ipsec) {
+                if (startNetworkCheckIfReady()) {
+                    m_pendingNetworkCheck = false;
+                } else {
+                    m_pendingNetworkCheck = true;
+                    qWarning() << "Deferring startNetworkCheck; missing gateway/local address"
+                               << m_vpnProtocol->vpnGateway() << m_vpnProtocol->vpnLocalAddress();
+                }
+            } else {
+                m_pendingNetworkCheck = false;
+            }
+
+        } else if (state == Vpn::ConnectionState::Error) {
+            m_pendingNetworkCheck = false;
+            iface->flushDns();
+
+            if (m_settings->isSitesSplitTunnelingEnabled()) {
+                if (m_settings->routeMode() == Settings::VpnOnlyForwardSites) {
+                    iface->clearSavedRoutes();
+                }
+            }
+        } else if (state == Vpn::ConnectionState::Connecting) {
+
+        } else if (state == Vpn::ConnectionState::Disconnected) {
+            m_pendingNetworkCheck = false;
+            auto result = iface->stopNetworkCheck();
+            result.waitForFinished(3000);
         }
     });
 #endif
@@ -136,6 +140,7 @@ void VpnConnection::onConnectionStateChanged(Vpn::ConnectionState state)
         m_checkTimer.stop();
     }
 #endif
+    emit connectionStateChanged(state);
 }
 
 const QString &VpnConnection::remoteAddress() const
@@ -180,11 +185,7 @@ void VpnConnection::addSitesRoutes(const QString &gw, Settings::RouteMode mode)
                         });
                         m_settings->addVpnSite(mode, site, ip);
                     }
-                    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
-                        auto reply = iface->flushDns();
-                        if (reply.waitForFinished() || !reply.returnValue())
-                            qWarning() << "VpnConnection::addSitesRoutes: Failed to flush DNS";
-                    });
+                    flushDns();
                     break;
                 }
             }
@@ -199,6 +200,48 @@ QSharedPointer<VpnProtocol> VpnConnection::vpnProtocol() const
     return m_vpnProtocol;
 }
 
+void VpnConnection::addRoutes(const QStringList &ips)
+{
+#ifdef AMNEZIA_DESKTOP
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        if (connectionState() == Vpn::ConnectionState::Connected) {
+            if (m_settings->routeMode() == Settings::VpnOnlyForwardSites) {
+                iface->routeAddList(m_vpnProtocol->vpnGateway(), ips);
+            } else if (m_settings->routeMode() == Settings::VpnAllExceptSites) {
+                iface->routeAddList(m_vpnProtocol->routeGateway(), ips);
+            }
+        }
+    });
+#endif
+}
+
+void VpnConnection::deleteRoutes(const QStringList &ips)
+{
+#ifdef AMNEZIA_DESKTOP
+    IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        if (connectionState() == Vpn::ConnectionState::Connected) {
+            if (m_settings->routeMode() == Settings::VpnOnlyForwardSites) {
+                iface->routeDeleteList(vpnProtocol()->vpnGateway(), ips);
+            } else if (m_settings->routeMode() == Settings::VpnAllExceptSites) {
+                iface->routeDeleteList(m_vpnProtocol->routeGateway(), ips);
+            }
+        }
+    });
+#endif
+}
+
+void VpnConnection::flushDns()
+{
+#ifdef AMNEZIA_DESKTOP
+    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
+        auto reply = iface->flushDns();
+        if (reply.waitForFinished(1000) || !reply.returnValue()) {
+            qWarning() << "VpnConnection::flushDns(): Failed to flush DNS";
+        }
+    });
+#endif
+}
+
 void VpnConnection::disconnectSlots()
 {
     if (m_vpnProtocol) {
@@ -222,15 +265,19 @@ ErrorCode VpnConnection::lastError() const
 void VpnConnection::connectToVpn(int serverIndex, const ServerCredentials &credentials, DockerContainer container,
                                  const QJsonObject &vpnConfiguration)
 {
-    qDebug() << QString("Trying to connect to VPN, server index is %1, container is %2, route mode is")
+    qDebug() << QString("ConnectToVpn, Server index is %1, container is %2, route mode is")
                         .arg(serverIndex)
                         .arg(ContainerProps::containerToString(container))
              << m_settings->routeMode();
 
     m_remoteAddress = NetworkUtilities::getIPAddress(credentials.hostName);
-    setConnectionState(Vpn::ConnectionState::Connecting);
+    emit connectionStateChanged(Vpn::ConnectionState::Connecting);
 
+    m_pendingNetworkCheck = false;
     m_vpnConfiguration = vpnConfiguration;
+    m_serverIndex = serverIndex;
+    m_serverCredentials = credentials;
+    m_dockerContainer = container;
 
 #ifdef AMNEZIA_DESKTOP
     if (m_vpnProtocol) {
@@ -246,7 +293,7 @@ void VpnConnection::connectToVpn(int serverIndex, const ServerCredentials &crede
 #if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
     m_vpnProtocol.reset(VpnProtocol::factory(container, m_vpnConfiguration));
     if (!m_vpnProtocol) {
-        setConnectionState(Vpn::ConnectionState::Error);
+        emit connectionStateChanged(Vpn::ConnectionState::Error);
         return;
     }
     m_vpnProtocol->prepare();
@@ -264,23 +311,75 @@ void VpnConnection::connectToVpn(int serverIndex, const ServerCredentials &crede
 
     createProtocolConnections();
 
-    if (ErrorCode err = m_vpnProtocol->start(); err != ErrorCode::NoError) {
-        setConnectionState(Vpn::ConnectionState::Error);
-        emit vpnProtocolError(err);
+    ErrorCode errorCode = m_vpnProtocol->start();
+    if (errorCode != ErrorCode::NoError)
+        emit connectionStateChanged(Vpn::ConnectionState::Error);
+}
+
+void VpnConnection::restartConnection()
+{
+    // Only reconnect if VPN was connected before sleep/network change
+    if (!m_wasConnectedBeforeSleep) {
+        qDebug() << "VPN was not connected before sleep/network change, skipping reconnection";
+        return;
     }
+    
+    qDebug() << "VPN was connected before sleep/network change, attempting reconnection";
+    this->disconnectFromVpn();
+#ifdef Q_OS_LINUX
+    QThread::msleep(5000);
+#endif
+    this->connectToVpn(m_serverIndex, m_serverCredentials, m_dockerContainer, m_vpnConfiguration);
+    
+    // Reset the flag after reconnection attempt
+    m_wasConnectedBeforeSleep = false;
 }
 
 void VpnConnection::createProtocolConnections()
 {
     connect(m_vpnProtocol.data(), &VpnProtocol::protocolError, this, &VpnConnection::vpnProtocolError);
-    connect(m_vpnProtocol.data(), &VpnProtocol::connectionStateChanged, this, &VpnConnection::setConnectionState);
+    connect(m_vpnProtocol.data(), SIGNAL(connectionStateChanged(Vpn::ConnectionState)), this,
+            SLOT(onConnectionStateChanged(Vpn::ConnectionState)));
     connect(m_vpnProtocol.data(), SIGNAL(bytesChanged(quint64, quint64)), this, SLOT(onBytesChanged(quint64, quint64)));
 
 #ifdef AMNEZIA_DESKTOP
-    IpcClient::withInterface([this](QSharedPointer<IpcInterfaceReplica> rep) {
-        connect(rep.data(), &IpcInterfaceReplica::networkChanged, this, &VpnConnection::reconnectToVpn, Qt::QueuedConnection);
-        connect(rep.data(), &IpcInterfaceReplica::wakeup, this, &VpnConnection::reconnectToVpn, Qt::QueuedConnection);
-    });
+    if (m_connectionLoseHandle)
+        disconnect(m_connectionLoseHandle);
+    if (m_networkChangeHandle)
+        disconnect(m_networkChangeHandle);
+    m_connectionLoseHandle = QMetaObject::Connection();
+    m_networkChangeHandle = QMetaObject::Connection();
+
+    // TODO: replace unsafe IpcClient::Interface() calls
+    m_connectionLoseHandle = connect(IpcClient::Interface().data(), &IpcInterfaceReplica::connectionLose,
+            this, [this]() {
+                qDebug() << "Connection Lose";
+                auto result = IpcClient::Interface()->stopNetworkCheck();
+                result.waitForFinished(3000);
+                // Track VPN state before connection loss
+                m_wasConnectedBeforeSleep = isConnected();
+                qDebug() << "VPN was connected before connection loss:" << m_wasConnectedBeforeSleep;
+                this->restartConnection();
+            });
+    m_networkChangeHandle = connect(IpcClient::Interface().data(), &IpcInterfaceReplica::networkChange,
+            this, [this]() {
+                qDebug() << "Network change";
+                // Track VPN state before network change (including sleep/wake)
+                m_wasConnectedBeforeSleep = isConnected();
+                qDebug() << "VPN was connected before network change:" << m_wasConnectedBeforeSleep;
+                this->restartConnection();
+            });
+    connect(m_vpnProtocol.data(), &VpnProtocol::tunnelAddressesUpdated,
+            this, [this](const QString& gateway, const QString& localAddress) {
+                Q_UNUSED(gateway)
+                Q_UNUSED(localAddress)
+                if (connectionState() != Vpn::ConnectionState::Connected) {
+                    return;
+                }
+                if (startNetworkCheckIfReady()) {
+                    m_pendingNetworkCheck = false;
+                }
+            });
 #endif
 }
 
@@ -383,13 +482,28 @@ void VpnConnection::appendSplitTunnelingConfig()
 
     m_vpnConfiguration.insert(config_key::appSplitTunnelType, appsRouteMode);
     m_vpnConfiguration.insert(config_key::splitTunnelApps, appsJsonArray);
+}
 
-    qDebug() << QString("Site split tunneling is %1, route mode is %2")
-                        .arg(m_settings->isSitesSplitTunnelingEnabled() ? "enabled" : "disabled")
-                        .arg(routeMode);
-    qDebug() << QString("App split tunneling is %1, route mode is %2")
-                        .arg(m_settings->isAppsSplitTunnelingEnabled() ? "enabled" : "disabled")
-                        .arg(appsRouteMode);
+bool VpnConnection::startNetworkCheckIfReady()
+{
+#ifdef AMNEZIA_DESKTOP
+    if (!m_vpnProtocol || m_dockerContainer == DockerContainer::Ipsec) {
+        return false;
+    }
+
+    const QString gateway = m_vpnProtocol->vpnGateway();
+    const QString localAddress = m_vpnProtocol->vpnLocalAddress();
+    if (gateway.isEmpty() || localAddress.isEmpty()) {
+        return false;
+    }
+
+    return IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
+        QRemoteObjectPendingReply<bool> reply = iface->startNetworkCheck(gateway, localAddress);
+        return reply.waitForFinished() && reply.returnValue();
+    });
+#else
+    return false;
+#endif
 }
 
 #ifdef Q_OS_ANDROID
@@ -423,27 +537,6 @@ QString VpnConnection::bytesPerSecToText(quint64 bytes)
     return QString("%1 %2").arg(QString::number(mbps, 'f', 2)).arg(tr("Mbps")); // Mbit/s
 }
 
-void VpnConnection::reconnectToVpn() {
-    if (m_vpnProtocol.isNull())
-        return;
-
-    if (m_connectionState != Vpn::ConnectionState::Connected) {
-        qWarning() << QString("Reconnect triggered on %1 during inappropriate state: %2; ignoring slot")
-                              .arg(QMetaEnum::fromType<Vpn::ConnectionState>().valueToKey(m_connectionState));
-        return;
-    }
-
-    qDebug() << "Reconnect triggered. Reconnecting to the server";
-
-    setConnectionState(Vpn::ConnectionState::Reconnecting);
-
-    m_vpnProtocol->stop();
-    if (ErrorCode err = m_vpnProtocol->start(); err != ErrorCode::NoError) {
-        setConnectionState(Vpn::ConnectionState::Error);
-        emit vpnProtocolError(err);
-    }
-}
-
 void VpnConnection::disconnectFromVpn()
 {
 #if defined(Q_OS_IOS) || defined(MACOS_NE)
@@ -453,11 +546,27 @@ void VpnConnection::disconnectFromVpn()
 #endif
 
     if (m_vpnProtocol.isNull()) {
-        setConnectionState(Vpn::ConnectionState::Disconnected);
+        emit connectionStateChanged(Vpn::ConnectionState::Disconnected);
         return;
     }
 
-    setConnectionState(Vpn::ConnectionState::Disconnecting);
+    m_vpnProtocol->stop();
+
+#ifdef AMNEZIA_DESKTOP
+    IpcClient::withInterface([](QSharedPointer<IpcInterfaceReplica> iface) {
+        QRemoteObjectPendingReply<bool> flushReply = iface->flushDns();
+        if (flushReply.waitForFinished(5000) && flushReply.returnValue())
+            qDebug() << "VpnConnection::disconnectFromVpn(): Successfully flushed DNS";
+        else
+            qWarning() << "VpnConnection::disconnectFromVpn(): Failed to flush DNS";
+
+        QRemoteObjectPendingReply<bool> clearSavedRoutesReply = iface->clearSavedRoutes();
+        if (clearSavedRoutesReply.waitForFinished(5000) && clearSavedRoutesReply.returnValue())
+            qDebug() << "VpnConnection::disconnectFromVpn(): Successfully cleared saved routes";
+        else
+            qWarning() << "VpnConnection::disconnectFromVpn(): Failed to clear saved routes";
+    });
+#endif
 
 #ifdef Q_OS_ANDROID
     auto *const connection = new QMetaObject::Connection;
@@ -469,9 +578,8 @@ void VpnConnection::disconnectFromVpn()
                                   delete connection;
                               }
                           });
-#endif
-
     m_vpnProtocol->stop();
+#endif
 
 #if !defined(Q_OS_ANDROID) && !defined(AMNEZIA_DESKTOP)
     m_vpnProtocol->deleteLater();
@@ -480,12 +588,27 @@ void VpnConnection::disconnectFromVpn()
     m_vpnProtocol = nullptr;
 }
 
-void VpnConnection::setConnectionState(Vpn::ConnectionState state) {
-    onConnectionStateChanged(state);
-
-    if (state == Vpn::Disconnected && m_connectionState == Vpn::Reconnecting)
-        return;
-
-    m_connectionState = state;
-    emit connectionStateChanged(state);
+Vpn::ConnectionState VpnConnection::connectionState()
+{
+    if (!m_vpnProtocol)
+        return Vpn::ConnectionState::Disconnected;
+    return m_vpnProtocol->connectionState();
+}
+
+bool VpnConnection::isConnected() const
+{
+    if (m_vpnProtocol.isNull()) {
+        return false;
+    }
+
+    return m_vpnProtocol->isConnected();
+}
+
+bool VpnConnection::isDisconnected() const
+{
+    if (m_vpnProtocol.isNull()) {
+        return true;
+    }
+
+    return m_vpnProtocol->isDisconnected();
 }