Version bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

app/build.gradle

@@ -17,8 +17,8 @@ android {
         applicationId 'com.wireguard.android'
         minSdkVersion 21
         targetSdkVersion 29
-        versionCode 452
-        versionName '0.0.20191012'
+        versionCode 455
+        versionName '0.0.20191013'
         buildConfigField 'int', 'MIN_SDK_VERSION', "$minSdkVersion.apiLevel"
     }
     // If the keystore file exists
@@ -71,7 +71,6 @@ ext {
     appcompatVersion = '1.1.0'
     cardviewVersion = '1.0.0'
     databindingVersion = '3.5.0'
-    leakCanaryVersion = "2.0-beta-3"
     materialComponentsVersion = '1.0.0'
     jsr305Version = '3.0.2'
     preferenceVersion = '1.1.0'
@@ -81,6 +80,7 @@ ext {
     // If you choose to upgrade to minSDK 24 then you should also disable Jetifier from
     // gradle.properties.
     zxingEmbeddedVersion = '3.6.0'
+    eddsaVersion = '0.3.0'
 }
 
 dependencies {
@@ -95,7 +95,7 @@ dependencies {
     implementation "com.journeyapps:zxing-android-embedded:$zxingEmbeddedVersion"
     implementation "net.sourceforge.streamsupport:android-retrofuture:$streamsupportVersion"
     implementation "net.sourceforge.streamsupport:android-retrostreams:$streamsupportVersion"
-    debugImplementation "com.squareup.leakcanary:leakcanary-android:$leakCanaryVersion"
+    implementation "net.i2p.crypto:eddsa:$eddsaVersion"
 }
 
 tasks.withType(JavaCompile) {

app/proguard-rules.pro

@@ -1,5 +1,3 @@
 # Squelch all warnings, they're harmless but ProGuard
 # escalates them as errors.
 -dontwarn sun.misc.Unsafe
-# We're OSS anyway and who doesn't love a readable log
--dontobfuscate

app/src/main/AndroidManifest.xml

@@ -19,7 +19,6 @@
     <application
         android:name=".Application"
         android:allowBackup="false"
-        android:extractNativeLibs="true"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"

app/src/main/java/com/wireguard/android/Application.java

@@ -22,6 +22,7 @@ import com.wireguard.android.backend.WgQuickBackend;
 import com.wireguard.android.configStore.FileConfigStore;
 import com.wireguard.android.model.TunnelManager;
 import com.wireguard.android.util.AsyncWorker;
+import com.wireguard.android.util.ModuleLoader;
 import com.wireguard.android.util.RootShell;
 import com.wireguard.android.util.ToolsInstaller;
 
@@ -38,6 +39,7 @@ public class Application extends android.app.Application {
     @SuppressWarnings("NullableProblems") private RootShell rootShell;
     @SuppressWarnings("NullableProblems") private SharedPreferences sharedPreferences;
     @SuppressWarnings("NullableProblems") private ToolsInstaller toolsInstaller;
+    @SuppressWarnings("NullableProblems") private ModuleLoader moduleLoader;
     @SuppressWarnings("NullableProblems") private TunnelManager tunnelManager;
 
     public Application() {
@@ -57,9 +59,19 @@ public class Application extends android.app.Application {
         synchronized (app.futureBackend) {
             if (app.backend == null) {
                 Backend backend = null;
-                if (new File("/sys/module/wireguard").exists()) {
+                boolean didStartRootShell = false;
+                if (!app.moduleLoader.isModuleLoaded() && app.moduleLoader.moduleMightExist()) {
                     try {
                         app.rootShell.start();
+                        didStartRootShell = true;
+                        app.moduleLoader.loadModule();
+                    } catch (final Exception ignored) {
+                    }
+                }
+                if (app.moduleLoader.isModuleLoaded()) {
+                    try {
+                        if (!didStartRootShell)
+                            app.rootShell.start();
                         backend = new WgQuickBackend(app.getApplicationContext());
                     } catch (final Exception ignored) {
                     }
@@ -87,6 +99,9 @@ public class Application extends android.app.Application {
     public static ToolsInstaller getToolsInstaller() {
         return get().toolsInstaller;
     }
+    public static ModuleLoader getModuleLoader() {
+        return get().moduleLoader;
+    }
 
     public static TunnelManager getTunnelManager() {
         return get().tunnelManager;
@@ -113,6 +128,7 @@ public class Application extends android.app.Application {
         asyncWorker = new AsyncWorker(AsyncTask.SERIAL_EXECUTOR, new Handler(Looper.getMainLooper()));
         rootShell = new RootShell(getApplicationContext());
         toolsInstaller = new ToolsInstaller(getApplicationContext());
+        moduleLoader = new ModuleLoader(getApplicationContext());
 
         sharedPreferences = PreferenceManager.getDefaultSharedPreferences(getApplicationContext());
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {

app/src/main/java/com/wireguard/android/activity/MainActivity.java

@@ -53,16 +53,7 @@ public class MainActivity extends BaseActivity
             setSelectedTunnel(null);
             return;
         }
-        if (isTaskRoot()) {
-            // @{link TunnelDetailFragment} is in foreground
-            if (backStackEntries == 2) {
-                getSupportFragmentManager().popBackStack();
-            } else if (backStackEntries == 0) {
-                finishAfterTransition();
-            }
-        } else {
-            super.onBackPressed();
-        }
+        super.onBackPressed();
     }
 
     @Override public void onBackStackChanged() {

app/src/main/java/com/wireguard/android/activity/SettingsActivity.java

@@ -110,6 +110,19 @@ public class SettingsActivity extends ThemeChangeAwareActivity {
                         screen.removePreference(pref);
                 }
             });
+
+            final Preference moduleInstaller = getPreferenceManager().findPreference("module_downloader");
+            moduleInstaller.setVisible(false);
+            if (Application.getModuleLoader().isModuleLoaded()) {
+                screen.removePreference(moduleInstaller);
+            } else {
+                Application.getAsyncWorker().runAsync(Application.getRootShell()::start).whenComplete((v, e) -> {
+                    if (e == null)
+                        moduleInstaller.setVisible(true);
+                    else
+                        screen.removePreference(moduleInstaller);
+                });
+            }
         }
     }
 }

app/src/main/java/com/wireguard/android/preference/ModuleDownloaderPreference.java

@@ -0,0 +1,91 @@
+/*
+ * Copyright © 2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.preference;
+
+import android.content.Context;
+import android.content.Intent;
+import android.system.OsConstants;
+import android.util.AttributeSet;
+import android.widget.Toast;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.R;
+import com.wireguard.android.util.ModuleLoader;
+import com.wireguard.android.util.ToolsInstaller;
+
+import androidx.annotation.Nullable;
+import androidx.preference.Preference;
+
+public class ModuleDownloaderPreference extends Preference {
+    private State state = State.INITIAL;
+
+    public ModuleDownloaderPreference(final Context context, final AttributeSet attrs) {
+        super(context, attrs);
+    }
+
+    @Override
+    public CharSequence getSummary() {
+        return getContext().getString(state.messageResourceId);
+    }
+
+    @Override
+    public CharSequence getTitle() {
+        return getContext().getString(R.string.module_installer_title);
+    }
+
+    @Override
+    protected void onClick() {
+        setState(State.WORKING);
+        Application.getAsyncWorker().supplyAsync(Application.getModuleLoader()::download).whenComplete(this::onDownloadResult);
+    }
+
+    private void onDownloadResult(final Integer result, @Nullable final Throwable throwable) {
+        if (throwable != null) {
+            setState(State.FAILURE);
+            Toast.makeText(getContext(), throwable.getMessage(), Toast.LENGTH_LONG).show();
+        } else if (result == OsConstants.ENOENT)
+            setState(State.NOTFOUND);
+        else if (result == OsConstants.EXIT_SUCCESS) {
+            setState(State.SUCCESS);
+            Application.getAsyncWorker().runAsync(() -> {
+                Thread.sleep(1000 * 5);
+                Intent i = getContext().getPackageManager().getLaunchIntentForPackage(getContext().getPackageName());
+                if (i == null)
+                    return;
+                i.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
+                i.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                Application.get().startActivity(i);
+                System.exit(0);
+            });
+        } else
+            setState(State.FAILURE);
+    }
+
+    private void setState(final State state) {
+        if (this.state == state)
+            return;
+        this.state = state;
+        if (isEnabled() != state.shouldEnableView)
+            setEnabled(state.shouldEnableView);
+        notifyChanged();
+    }
+
+    private enum State {
+        INITIAL(R.string.module_installer_initial, true),
+        FAILURE(R.string.module_installer_error, true),
+        WORKING(R.string.module_installer_working, false),
+        SUCCESS(R.string.module_installer_success, false),
+        NOTFOUND(R.string.module_installer_not_found, false);
+
+        private final int messageResourceId;
+        private final boolean shouldEnableView;
+
+        State(final int messageResourceId, final boolean shouldEnableView) {
+            this.messageResourceId = messageResourceId;
+            this.shouldEnableView = shouldEnableView;
+        }
+    }
+}

app/src/main/java/com/wireguard/android/util/ModuleLoader.java

@@ -0,0 +1,186 @@
+/*
+ * Copyright © 2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.util;
+
+import android.content.Context;
+import android.system.OsConstants;
+import android.util.Base64;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.BuildConfig;
+import com.wireguard.android.util.RootShell.NoRootException;
+
+import net.i2p.crypto.eddsa.EdDSAEngine;
+import net.i2p.crypto.eddsa.EdDSAPublicKey;
+import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable;
+import net.i2p.crypto.eddsa.spec.EdDSAParameterSpec;
+import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidParameterException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.Signature;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.annotation.Nullable;
+
+public class ModuleLoader {
+    private static final String MODULE_PUBLIC_KEY_BASE64 = "RWRmHuT9PSqtwfsLtEx+QS06BJtLgFYteL9WCNjH7yuyu5Y1DieSN7If";
+    private static final String MODULE_LIST_URL = "https://download.wireguard.com/android-module/modules.txt.sig";
+    private static final String MODULE_URL = "https://download.wireguard.com/android-module/%s";
+    private static final String MODULE_NAME = "wireguard-%s.ko";
+
+    private final File moduleDir;
+    private final File tmpDir;
+
+    public ModuleLoader(final Context context) {
+        moduleDir = new File(context.getCacheDir(), "kmod");
+        tmpDir = new File(context.getCacheDir(), "tmp");
+    }
+
+    public boolean moduleMightExist() {
+        return moduleDir.exists() && moduleDir.isDirectory();
+    }
+
+    public void loadModule() throws IOException, NoRootException {
+        Application.getRootShell().run(null, String.format("insmod \"%s/wireguard-$(sha256sum /proc/version|cut -d ' ' -f 1).ko\"", moduleDir.getAbsolutePath()));
+    }
+
+    public boolean isModuleLoaded() {
+        return new File("/sys/module/wireguard").exists();
+    }
+
+    private static final class Sha256Digest {
+        private byte[] bytes;
+        private Sha256Digest(final String hex) {
+            if (hex.length() != 64)
+                throw new InvalidParameterException("SHA256 hashes must be 32 bytes long");
+            bytes = new byte[32];
+            for (int i = 0; i < 32; ++i)
+                bytes[i] = (byte)Integer.parseInt(hex.substring(i * 2, i * 2 + 2), 16);
+        }
+    }
+
+    @Nullable
+    private Map<String, Sha256Digest> verifySignedHashes(final String signifyDigest) {
+        final byte[] publicKeyBytes = Base64.decode(MODULE_PUBLIC_KEY_BASE64, Base64.DEFAULT);
+
+        if (publicKeyBytes == null || publicKeyBytes.length != 32 + 10 || publicKeyBytes[0] != 'E' || publicKeyBytes[1] != 'd')
+            return null;
+
+        final String[] lines = signifyDigest.split("\n", 3);
+        if (lines.length != 3)
+            return null;
+        if (!lines[0].startsWith("untrusted comment: "))
+            return null;
+
+        final byte[] signatureBytes = Base64.decode(lines[1], Base64.DEFAULT);
+        if (signatureBytes == null || signatureBytes.length != 64 + 10)
+            return null;
+        for (int i = 0; i < 10; ++i) {
+            if (signatureBytes[i] != publicKeyBytes[i])
+                return null;
+        }
+
+        try {
+            EdDSAParameterSpec parameterSpec = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.ED_25519);
+            Signature signature = new EdDSAEngine(MessageDigest.getInstance(parameterSpec.getHashAlgorithm()));
+            byte[] rawPublicKeyBytes = new byte[32];
+            System.arraycopy(publicKeyBytes, 10, rawPublicKeyBytes, 0, 32);
+            signature.initVerify(new EdDSAPublicKey(new EdDSAPublicKeySpec(rawPublicKeyBytes, parameterSpec)));
+            signature.update(lines[2].getBytes(StandardCharsets.UTF_8));
+            if (!signature.verify(signatureBytes, 10, 64))
+                return null;
+        } catch (final Exception ignored) {
+            return null;
+        }
+
+        Map<String, Sha256Digest> hashes = new HashMap<>();
+        for (final String line : lines[2].split("\n")) {
+            final String[] components = line.split("  ", 2);
+            if (components.length != 2)
+                return null;
+            try {
+                hashes.put(components[1], new Sha256Digest(components[0]));
+            } catch (final Exception ignored) {
+                return null;
+            }
+        }
+        return hashes;
+    }
+
+    public Integer download() throws IOException, NoRootException, NoSuchAlgorithmException {
+        final List<String> output = new ArrayList<>();
+        Application.getRootShell().run(output, "sha256sum /proc/version|cut -d ' ' -f 1");
+        if (output.size() != 1 || output.get(0).length() != 64)
+            throw new InvalidParameterException("Invalid sha256 of /proc/version");
+        final String moduleName = String.format(MODULE_NAME, output.get(0));
+        final String userAgent = String.format("WireGuard/%s (Android)", BuildConfig.VERSION_NAME); //TODO: expand a bit
+
+        HttpURLConnection connection = (HttpURLConnection)new URL(MODULE_LIST_URL).openConnection();
+        connection.setRequestProperty("User-Agent", userAgent);
+        connection.connect();
+        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
+            throw new IOException("Hash list could not be found");
+        byte[] input = new byte[1024 * 1024 * 3 /* 3MiB */];
+        int len;
+        try (final InputStream inputStream = connection.getInputStream()) {
+            len = inputStream.read(input);
+        }
+        if (len <= 0)
+            throw new IOException("Hash list was empty");
+        final Map<String, Sha256Digest> modules = verifySignedHashes(new String(input, 0, len, StandardCharsets.UTF_8));
+        if (modules == null)
+            throw new InvalidParameterException("The signature did not verify or invalid hash list format");
+        if (!modules.containsKey(moduleName))
+            return OsConstants.ENOENT;
+        connection = (HttpURLConnection)new URL(String.format(MODULE_URL, moduleName)).openConnection();
+        connection.setRequestProperty("User-Agent", userAgent);
+        connection.connect();
+        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
+            throw new IOException("Module file could not be found, despite being on hash list");
+
+        tmpDir.mkdirs();
+        moduleDir.mkdir();
+        File tempFile = null;
+        try {
+            tempFile = File.createTempFile("UNVERIFIED-", null, tmpDir);
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            try (final InputStream inputStream = connection.getInputStream();
+                 final OutputStream outputStream = new FileOutputStream(tempFile)) {
+                int total = 0;
+                while ((len = inputStream.read(input)) > 0) {
+                    total += len;
+                    if (total > 1024 * 1024 * 15 /* 15 MiB */)
+                        throw new IOException("File too big");
+                    outputStream.write(input, 0, len);
+                    digest.update(input, 0, len);
+                }
+            }
+            if (!Arrays.equals(digest.digest(), modules.get(moduleName).bytes))
+                throw new IOException("Incorrect file hash");
+
+            if (!tempFile.renameTo(new File(moduleDir, moduleName)))
+                throw new IOException("Unable to rename to final destination");
+        } finally {
+            if (tempFile != null)
+                tempFile.delete();
+        }
+        return OsConstants.EXIT_SUCCESS;
+    }
+}

app/src/main/java/com/wireguard/android/util/RootShell.java

@@ -43,9 +43,8 @@ public class RootShell {
 
     public RootShell(final Context context) {
         deviceNotRootedMessage = context.getString(R.string.error_root);
-        final File cacheDir = context.getCacheDir();
-        localBinaryDir = new File(cacheDir, "bin");
-        localTemporaryDir = new File(cacheDir, "tmp");
+        localBinaryDir = new File(context.getCodeCacheDir(), "bin");
+        localTemporaryDir = new File(context.getCacheDir(), "tmp");
         preamble = String.format("export CALLING_PACKAGE=%s PATH=\"%s:$PATH\" TMPDIR='%s'; id -u\n",
                 BuildConfig.APPLICATION_ID, localBinaryDir, localTemporaryDir);
         this.context = context;

app/src/main/java/com/wireguard/android/util/SharedLibraryLoader.java

@@ -13,6 +13,9 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashSet;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
@@ -22,6 +25,42 @@ public final class SharedLibraryLoader {
     private SharedLibraryLoader() {
     }
 
+    public static boolean extractLibrary(final Context context, final String libName, final File destination) throws IOException {
+        final Collection<String> apks = new HashSet<>();
+        if (context.getApplicationInfo().sourceDir != null)
+            apks.add(context.getApplicationInfo().sourceDir);
+        if (context.getApplicationInfo().splitSourceDirs != null)
+            apks.addAll(Arrays.asList(context.getApplicationInfo().splitSourceDirs));
+
+        for (final String abi : Build.SUPPORTED_ABIS) {
+            for (final String apk : apks) {
+                final ZipFile zipFile;
+                try {
+                    zipFile = new ZipFile(new File(apk), ZipFile.OPEN_READ);
+                } catch (final IOException e) {
+                    throw new RuntimeException(e);
+                }
+
+                final String mappedLibName = System.mapLibraryName(libName);
+                final byte[] buffer = new byte[1024 * 32];
+                final String libZipPath = "lib" + File.separatorChar + abi + File.separatorChar + mappedLibName;
+                final ZipEntry zipEntry = zipFile.getEntry(libZipPath);
+                if (zipEntry == null)
+                    continue;
+                Log.d(TAG, "Extracting apk:/" + libZipPath + " to " + destination.getAbsolutePath());
+                try (final FileOutputStream out = new FileOutputStream(destination);
+                     final InputStream in = zipFile.getInputStream(zipEntry)) {
+                    int len;
+                    while ((len = in.read(buffer)) != -1) {
+                        out.write(buffer, 0, len);
+                    }
+                }
+                return true;
+            }
+        }
+        return false;
+    }
+
     public static void loadSharedLibrary(final Context context, final String libName) {
         Throwable noAbiException;
         try {
@@ -31,42 +70,20 @@ public final class SharedLibraryLoader {
             Log.d(TAG, "Failed to load library normally, so attempting to extract from apk", e);
             noAbiException = e;
         }
-
-        final ZipFile zipFile;
+        File f = null;
         try {
-            zipFile = new ZipFile(new File(context.getApplicationInfo().sourceDir), ZipFile.OPEN_READ);
-        } catch (final IOException e) {
-            throw new RuntimeException(e);
-        }
-
-        final String mappedLibName = System.mapLibraryName(libName);
-        final byte[] buffer = new byte[1024 * 32];
-        for (final String abi : Build.SUPPORTED_ABIS) {
-            final String libZipPath = "lib" + File.separatorChar + abi + File.separatorChar + mappedLibName;
-            final ZipEntry zipEntry = zipFile.getEntry(libZipPath);
-            if (zipEntry == null)
-                continue;
-            File f = null;
-            try {
-                f = File.createTempFile("lib", ".so", context.getCacheDir());
-                Log.d(TAG, "Extracting apk:/" + libZipPath + " to " + f.getAbsolutePath() + " and loading");
-                try (final FileOutputStream out = new FileOutputStream(f);
-                     final InputStream in = zipFile.getInputStream(zipEntry)) {
-                    int len;
-                    while ((len = in.read(buffer)) != -1) {
-                        out.write(buffer, 0, len);
-                    }
-                }
+            f = File.createTempFile("lib", ".so", context.getCodeCacheDir());
+            if (extractLibrary(context, libName, f)) {
                 System.load(f.getAbsolutePath());
                 return;
-            } catch (final Exception e) {
-                Log.d(TAG, "Failed to load library apk:/" + libZipPath, e);
-                noAbiException = e;
-            } finally {
-                if (f != null)
-                    // noinspection ResultOfMethodCallIgnored
-                    f.delete();
             }
+        } catch (final Exception e) {
+            Log.d(TAG, "Failed to load library apk:/" + libName, e);
+            noAbiException = e;
+        } finally {
+            if (f != null)
+                // noinspection ResultOfMethodCallIgnored
+                f.delete();
         }
         if (noAbiException instanceof RuntimeException)
             throw (RuntimeException) noAbiException;

app/src/main/java/com/wireguard/android/util/ToolsInstaller.java

@@ -31,10 +31,7 @@ public final class ToolsInstaller {
     public static final int NO = 0x2;
     public static final int SYSTEM = 0x8;
     public static final int YES = 0x1;
-    private static final String[][] EXECUTABLES = {
-            {"libwg.so", "wg"},
-            {"libwg-quick.so", "wg-quick"},
-    };
+    private static final String[] EXECUTABLES = {"wg", "wg-quick"};
     private static final File[] INSTALL_DIRS = {
             new File("/system/xbin"),
             new File("/system/bin"),
@@ -45,13 +42,11 @@ public final class ToolsInstaller {
     private final Context context;
     private final File localBinaryDir;
     private final Object lock = new Object();
-    private final File nativeLibraryDir;
     @Nullable private Boolean areToolsAvailable;
     @Nullable private Boolean installAsMagiskModule;
 
     public ToolsInstaller(final Context context) {
-        localBinaryDir = new File(context.getCacheDir(), "bin");
-        nativeLibraryDir = new File(context.getApplicationInfo().nativeLibraryDir);
+        localBinaryDir = new File(context.getCodeCacheDir(), "bin");
         this.context = context;
     }
 
@@ -72,10 +67,10 @@ public final class ToolsInstaller {
         if (INSTALL_DIR == null)
             return ERROR;
         final StringBuilder script = new StringBuilder();
-        for (final String[] names : EXECUTABLES) {
+        for (final String name : EXECUTABLES) {
             script.append(String.format("cmp -s '%s' '%s' && ",
-                    new File(nativeLibraryDir, names[0]),
-                    new File(INSTALL_DIR, names[1])));
+                    new File(localBinaryDir, name).getAbsolutePath(),
+                    new File(INSTALL_DIR, name).getAbsolutePath()));
         }
         script.append("exit ").append(OsConstants.EALREADY).append(';');
         try {
@@ -89,18 +84,15 @@ public final class ToolsInstaller {
         }
     }
 
-    public void ensureToolsAvailable() throws FileNotFoundException, NoRootException {
+    public void ensureToolsAvailable() throws FileNotFoundException {
         synchronized (lock) {
             if (areToolsAvailable == null) {
-                final int ret = symlink();
-                if (ret == OsConstants.EALREADY) {
-                    Log.d(TAG, "Tools were already symlinked into our private binary dir");
+                try {
+                    Log.d(TAG, extract() ? "Tools are now extracted into our private binary dir" :
+                            "Tools were already extracted into our private binary dir");
                     areToolsAvailable = true;
-                } else if (ret == OsConstants.EXIT_SUCCESS) {
-                    Log.d(TAG, "Tools are now symlinked into our private binary dir");
-                    areToolsAvailable = true;
-                } else {
-                    Log.e(TAG, "For some reason, wg and wg-quick are not available at all");
+                } catch (final IOException e) {
+                    Log.e(TAG, "The wg and wg-quick tools are not available", e);
                     areToolsAvailable = false;
                 }
             }
@@ -110,21 +102,22 @@ public final class ToolsInstaller {
         }
     }
 
-    public int install() throws NoRootException {
+    public int install() throws NoRootException, IOException {
         return willInstallAsMagiskModule() ? installMagisk() : installSystem();
     }
 
-    private int installMagisk() throws NoRootException {
+    private int installMagisk() throws NoRootException, IOException {
+        extract();
         final StringBuilder script = new StringBuilder("set -ex; ");
 
         script.append("trap 'rm -rf /sbin/.magisk/img/wireguard' INT TERM EXIT; ");
         script.append(String.format("rm -rf /sbin/.magisk/img/wireguard/; mkdir -p /sbin/.magisk/img/wireguard%s; ", INSTALL_DIR));
         script.append(String.format("printf 'name=WireGuard Command Line Tools\nversion=%s\nversionCode=%s\nauthor=zx2c4\ndescription=Command line tools for WireGuard\nminMagisk=1500\n' > /sbin/.magisk/img/wireguard/module.prop; ", BuildConfig.VERSION_NAME, BuildConfig.VERSION_CODE));
         script.append("touch /sbin/.magisk/img/wireguard/auto_mount; ");
-        for (final String[] names : EXECUTABLES) {
-            final File destination = new File("/sbin/.magisk/img/wireguard" + INSTALL_DIR, names[1]);
+        for (final String name : EXECUTABLES) {
+            final File destination = new File("/sbin/.magisk/img/wireguard" + INSTALL_DIR, name);
             script.append(String.format("cp '%s' '%s'; chmod 755 '%s'; chcon 'u:object_r:system_file:s0' '%s' || true; ",
-                    new File(nativeLibraryDir, names[0]), destination, destination, destination));
+                    new File(localBinaryDir, name), destination, destination, destination));
         }
         script.append("trap - INT TERM EXIT;");
 
@@ -135,15 +128,16 @@ public final class ToolsInstaller {
         }
     }
 
-    private int installSystem() throws NoRootException {
+    private int installSystem() throws NoRootException, IOException {
         if (INSTALL_DIR == null)
             return OsConstants.ENOENT;
+        extract();
         final StringBuilder script = new StringBuilder("set -ex; ");
         script.append("trap 'mount -o ro,remount /system' EXIT; mount -o rw,remount /system; ");
-        for (final String[] names : EXECUTABLES) {
-            final File destination = new File(INSTALL_DIR, names[1]);
+        for (final String name : EXECUTABLES) {
+            final File destination = new File(INSTALL_DIR, name);
             script.append(String.format("cp '%s' '%s'; chmod 755 '%s'; restorecon '%s' || true; ",
-                    new File(nativeLibraryDir, names[0]), destination, destination, destination));
+                    new File(localBinaryDir, name), destination, destination, destination));
         }
         try {
             return Application.getRootShell().run(null, script.toString()) == 0 ? YES | SYSTEM : ERROR;
@@ -152,27 +146,23 @@ public final class ToolsInstaller {
         }
     }
 
-    public int symlink() throws NoRootException {
-        final StringBuilder script = new StringBuilder("set -x; ");
-        for (final String[] names : EXECUTABLES) {
-            script.append(String.format("test '%s' -ef '%s' && ",
-                    new File(nativeLibraryDir, names[0]),
-                    new File(localBinaryDir, names[1])));
+    public boolean extract() throws IOException {
+        localBinaryDir.mkdirs();
+        final File files[] = new File[EXECUTABLES.length];
+        boolean allExist = true;
+        for (int i = 0; i < files.length; ++i) {
+            files[i] = new File(localBinaryDir, EXECUTABLES[i]);
+            allExist &= files[i].exists();
         }
-        script.append("exit ").append(OsConstants.EALREADY).append("; set -e; ");
-
-        for (final String[] names : EXECUTABLES) {
-            script.append(String.format("ln -fns '%s' '%s'; ",
-                    new File(nativeLibraryDir, names[0]),
-                    new File(localBinaryDir, names[1])));
-        }
-        script.append("exit ").append(OsConstants.EXIT_SUCCESS).append(';');
-
-        try {
-            return Application.getRootShell().run(null, script.toString());
-        } catch (final IOException ignored) {
-            return OsConstants.EXIT_FAILURE;
+        if (allExist)
+            return false;
+        for (int i = 0; i < files.length; ++i) {
+            if (!SharedLibraryLoader.extractLibrary(context, EXECUTABLES[i], files[i]))
+                throw new FileNotFoundException("Unable to find " + EXECUTABLES[i]);
+            if (!files[i].setExecutable(true, false))
+                throw new IOException("Unable to mark " + files[i].getAbsolutePath() + " as executable");
         }
+        return true;
     }
 
     private boolean willInstallAsMagiskModule() {

app/src/main/res/values/strings.xml

@@ -99,6 +99,12 @@
     <string name="log_export_title">Export log file</string>
     <string name="logcat_error">Unable to run logcat: </string>
     <string name="module_version_error">Unable to determine kernel module version</string>
+    <string name="module_installer_not_found">No modules are available for your device</string>
+    <string name="module_installer_initial">The experimental kernel module can improve performance</string>
+    <string name="module_installer_success">Success. The application will restart in 5 seconds</string>
+    <string name="module_installer_title">Download and install kernel module</string>
+    <string name="module_installer_working">Downloading and installing…</string>
+    <string name="module_installer_error">Something went wrong. Please try again</string>
     <string name="mtu">MTU</string>
     <string name="multiple_tunnels_error">Only one userspace tunnel can run at a time</string>
     <string name="name">Name</string>

app/src/main/res/xml/preferences.xml

@@ -6,6 +6,7 @@
         android:key="restore_on_boot"
         android:summary="@string/restore_on_boot_summary"
         android:title="@string/restore_on_boot_title" />
+    <com.wireguard.android.preference.ModuleDownloaderPreference android:key="module_downloader" />
     <com.wireguard.android.preference.ToolsInstallerPreference android:key="tools_installer" />
     <com.wireguard.android.preference.ZipExporterPreference />
     <com.wireguard.android.preference.LogExporterPreference />

app/tools/libwg-go/Makefile

@@ -32,4 +32,4 @@ $(BUILDDIR)/go-$(DESIRED_GO_VERSION)/.prepared:
 
 $(DESTDIR)/libwg-go.so: export PATH := $(BUILDDIR)/go-$(DESIRED_GO_VERSION)/bin/:$(PATH)
 $(DESTDIR)/libwg-go.so: $(BUILDDIR)/go-$(DESIRED_GO_VERSION)/.prepared go.mod
-	go build -tags linux -ldflags="-X main.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard" -v -trimpath -o "$@" -buildmode c-shared
+	go build -tags linux -ldflags="-X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard" -v -trimpath -o "$@" -buildmode c-shared

app/tools/libwg-go/go.mod

@@ -6,5 +6,5 @@ require (
 	golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 // indirect
 	golang.org/x/net v0.0.0-20191011234655-491137f69257 // indirect
 	golang.org/x/sys v0.0.0-20191010194322-b09406accb47
-	golang.zx2c4.com/wireguard v0.0.20190908
+	golang.zx2c4.com/wireguard v0.0.20191012
 )

app/tools/libwg-go/go.sum

@@ -1,19 +1,19 @@
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190829043050-9756ffdc2472/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191003171128-d98b1b443823/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191011234655-491137f69257 h1:ry8e2D+cwaV6hk7lb3aRTjjZo24shrbK0e11QEOkTIg=
 golang.org/x/net v0.0.0-20191011234655-491137f69257/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190830023255-19e00faab6ad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191003212358-c178f38b412c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47 h1:/XfQ9z7ib8eEJX2hdgFTZJ/ntt0swNk5oYBziWeTCvY=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.zx2c4.com/wireguard v0.0.20190908 h1:SUoXDdwSMtomLdvke+zz83/u9tNvl4hHmcTIWp38tow=
-golang.zx2c4.com/wireguard v0.0.20190908/go.mod h1:LhfXh5z6bLC2lW2ve6BzYZFwnnsXK3OQjySR0Yh2dO8=
+golang.zx2c4.com/wireguard v0.0.20191012 h1:sdX+y3hrHkW8KJkjY7ZgzpT5Tqo8XnBkH55U1klphko=
+golang.zx2c4.com/wireguard v0.0.20191012/go.mod h1:P2HsVp8SKwZEufsnezXZA4GRX/T49/HlU7DGuelXsU4=