version: bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
strings: sync with crowdin
2026-07-03 14:05:13 +02:00 · 2023-05-26 16:23:49 +02:00 · 2023-05-26 16:19:52 +02:00 · 2023-05-26 16:19:52 +02:00 · 2023-05-26 16:19:52 +02:00 · 2023-05-26 16:19:52 +02:00
272 changed files with 19869 additions and 7755 deletions
@@ -14,4 +14,5 @@ build/
 *.dex
 *.iml
 *.jks
-keystore.properties
+gradlew.bat
+maint/
@@ -1,3 +1,6 @@
 [submodule "tunnel/tools/wireguard-tools"]
 	path = tunnel/tools/wireguard-tools
 	url = https://git.zx2c4.com/wireguard-tools
+[submodule "tunnel/tools/elf-cleaner"]
+	path = tunnel/tools/elf-cleaner
+	url = https://github.com/termux/termux-elf-cleaner
@@ -56,9 +56,16 @@
        </value>
      </option>
    </JavaCodeStyleSettings>
-    <XML>
-      <option name="XML_LEGACY_SETTINGS_IMPORTED" value="true" />
-    </XML>
+    <JetCodeStyleSettings>
+      <option name="PACKAGES_TO_USE_STAR_IMPORTS">
+        <value>
+          <package name="kotlinx.android.synthetic" alias="false" withSubpackages="true" />
+        </value>
+      </option>
+      <option name="NAME_COUNT_TO_USE_STAR_IMPORT" value="10" />
+      <option name="NAME_COUNT_TO_USE_STAR_IMPORT_FOR_MEMBERS" value="10" />
+      <option name="CODE_STYLE_DEFAULTS" value="KOTLIN_OFFICIAL" />
+    </JetCodeStyleSettings>
    <codeStyleSettings language="JAVA">
      <option name="METHOD_ANNOTATION_WRAP" value="0" />
      <option name="FIELD_ANNOTATION_WRAP" value="0" />
@@ -459,5 +466,9 @@
        </rules>
      </arrangement>
    </codeStyleSettings>
+    <codeStyleSettings language="kotlin">
+      <option name="CODE_STYLE_DEFAULTS" value="KOTLIN_OFFICIAL" />
+      <option name="RIGHT_MARGIN" value="160" />
+    </codeStyleSettings>
  </code_scheme>
 </component>
@@ -1,6 +1,6 @@
 <component name="CopyrightManager">
  <copyright>
-    <option name="notice" value="Copyright © &amp;#36;today.year WireGuard LLC. All Rights Reserved.&#10;SPDX-License-Identifier: Apache-2.0" />
+    <option name="notice" value="Copyright © 2017-&amp;#36;today.year WireGuard LLC. All Rights Reserved.&#10;SPDX-License-Identifier: Apache-2.0" />
    <option name="myName" value="Default" />
  </copyright>
 </component>
@@ -9,7 +9,6 @@
      </option>
      <option name="nonThreadSafeTypes" value="" />
    </inspection_tool>
-    <inspection_tool class="AndroidLintGoogleAppIndexingWarning" enabled="false" level="WARNING" enabled_by_default="false" />
    <inspection_tool class="AndroidLintIconExpectedSize" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="AndroidLintNegativeMargin" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="AndroidLintTypographyQuotes" enabled="true" level="WARNING" enabled_by_default="true" />
@@ -40,7 +39,9 @@
    <inspection_tool class="AssignmentToLambdaParameter" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="AssignmentToSuperclassField" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="AssignmentUsedAsCondition" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="AutoCloseableResource" enabled="true" level="WARNING" enabled_by_default="true" />
+    <inspection_tool class="AutoCloseableResource" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="METHOD_MATCHER_CONFIG" value="java.util.Formatter,format,java.io.Writer,append,com.google.common.base.Preconditions,checkNotNull,org.hibernate.Session,close,java.io.PrintWriter,printf,java.util.HashMap,put,java.util.Map,put" />
+    </inspection_tool>
    <inspection_tool class="BadExceptionCaught" enabled="true" level="WARNING" enabled_by_default="true">
      <option name="exceptionsString" value="" />
      <option name="exceptions">
@@ -59,6 +60,9 @@
    <inspection_tool class="CallToStringConcatCanBeReplacedByOperator" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="CannotResolve" enabled="true" level="ERROR" enabled_by_default="true" />
    <inspection_tool class="CastConflictsWithInstanceof" enabled="true" level="WARNING" enabled_by_default="true" />
+    <inspection_tool class="CatchMayIgnoreException" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="m_ignoreCatchBlocksWithComments" value="false" />
+    </inspection_tool>
    <inspection_tool class="ChainedEquality" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ClassInitializer" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ClassNameDiffersFromFileName" enabled="true" level="WARNING" enabled_by_default="true" />
@@ -103,9 +107,6 @@
    <inspection_tool class="DoubleLiteralMayBeFloatLiteral" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="DuplicateAlternationBranch" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="DuplicateBooleanBranch" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="DuplicateCondition" enabled="true" level="WARNING" enabled_by_default="true">
-      <option name="ignoreSideEffectConditions" value="true" />
-    </inspection_tool>
    <inspection_tool class="DuplicateDeclarations" enabled="true" level="ERROR" enabled_by_default="true" />
    <inspection_tool class="DynamicRegexReplaceableByCompiledPattern" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ElementOnlyUsedFromTestCode" enabled="false" level="WARNING" enabled_by_default="false" />
@@ -196,7 +197,6 @@
    <inspection_tool class="ImplicitSubclassInspection" enabled="false" level="ERROR" enabled_by_default="false" />
    <inspection_tool class="IncompatibleTypes" enabled="true" level="ERROR" enabled_by_default="true" />
    <inspection_tool class="InitializerIssues" enabled="true" level="ERROR" enabled_by_default="true" />
-    <inspection_tool class="InnerClassMayBeStatic" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="InnerClassReferencedViaSubclass" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="InnerClassVariableHidesOuterClassVariable" enabled="true" level="WARNING" enabled_by_default="true">
      <option name="m_ignoreInvisibleFields" value="true" />
@@ -215,7 +215,6 @@
    <inspection_tool class="InstanceofThis" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="InstantiationOfUtilityClass" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="IntLiteralMayBeLongLiteral" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="IntegerDivisionInFloatingPointContext" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="IntegerTypeRequired" enabled="true" level="ERROR" enabled_by_default="true" />
    <inspection_tool class="InterfaceMayBeAnnotatedFunctional" enabled="true" level="INFORMATION" enabled_by_default="true" />
    <inspection_tool class="InterfaceNamingConvention" enabled="false" level="WARNING" enabled_by_default="false">
@@ -294,6 +293,7 @@
      <option name="ignoreForLoopDeclarations" value="true" />
    </inspection_tool>
    <inspection_tool class="MultipleTopLevelClassesInFile" enabled="true" level="WARNING" enabled_by_default="true" />
+    <inspection_tool class="MultipleVariablesInDeclaration" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="NamedResource" enabled="true" level="ERROR" enabled_by_default="true" />
    <inspection_tool class="NativeMethodNamingConvention" enabled="false" level="WARNING" enabled_by_default="false" />
    <inspection_tool class="NegatedConditional" enabled="true" level="WARNING" enabled_by_default="true">
@@ -347,7 +347,6 @@
    <inspection_tool class="OverriddenMethodCallDuringObjectConstruction" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="PackageInfoWithoutPackage" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="PointerTypeRequired" enabled="true" level="ERROR" enabled_by_default="true" />
-    <inspection_tool class="PointlessNullCheck" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ProblematicVarargsMethodOverride" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ProtectedField" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ProtectedInnerClass" enabled="true" level="WARNING" enabled_by_default="true">
@@ -394,7 +393,13 @@
    <inspection_tool class="SizeReplaceableByIsEmpty" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="StaticCallOnSubclass" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="StaticFieldReferenceOnSubclass" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="StaticImport" enabled="true" level="WARNING" enabled_by_default="true" />
+    <inspection_tool class="StaticImport" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="allowedClasses">
+        <set>
+          <option value="org.junit.Assert" />
+        </set>
+      </option>
+    </inspection_tool>
    <inspection_tool class="StaticInheritance" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="StaticMethodNamingConvention" enabled="false" level="WARNING" enabled_by_default="false">
      <option name="m_regex" value="[a-z][A-Za-z\d]*" />
@@ -432,7 +437,6 @@
    <inspection_tool class="TemplateArgumentsIssues" enabled="true" level="ERROR" enabled_by_default="true" />
    <inspection_tool class="TestMethodWithoutAssertion" enabled="false" level="WARNING" enabled_by_default="false">
      <option name="assertionMethods" value="org.junit.Assert,assert.*|fail.*,junit.framework.Assert,assert.*|fail.*,org.junit.jupiter.api.Assertions,assert.*|fail.*,org.mockito.Mockito,verify.*,org.mockito.InOrder,verify,org.junit.rules.ExpectedException,expect.*,org.hamcrest.MatcherAssert,assertThat" />
-      <option name="assertKeywordIsAssertion" value="false" />
    </inspection_tool>
    <inspection_tool class="TestNGMethodNamingConvention" enabled="false" level="WARNING" enabled_by_default="false" />
    <inspection_tool class="ThisEscapedInConstructor" enabled="true" level="WARNING" enabled_by_default="true" />
@@ -440,7 +444,6 @@
      <option name="ignoreRethrownExceptions" value="true" />
    </inspection_tool>
    <inspection_tool class="ThrowsRuntimeException" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="ToArrayCallWithZeroLengthArrayArgument" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="TooBroadScope" enabled="true" level="WARNING" enabled_by_default="true">
      <option name="m_allowConstructorAsInitializer" value="false" />
      <option name="m_onlyLookAtBlocks" value="true" />
@@ -466,10 +469,8 @@
    <inspection_tool class="UnnecessaryBlockStatement" enabled="true" level="WARNING" enabled_by_default="true">
      <option name="ignoreSwitchBranches" value="false" />
    </inspection_tool>
-    <inspection_tool class="UnnecessaryCallToStringValueOf" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="UnnecessaryConstantArrayCreationExpression" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="UnnecessaryConstructor" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="UnnecessaryDefault" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="UnnecessaryExplicitNumericCast" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="UnnecessaryFullyQualifiedName" enabled="true" level="WARNING" enabled_by_default="true">
      <option name="m_ignoreJavadoc" value="false" />
@@ -11,3 +11,30 @@ $ git clone --recurse-submodules https://git.zx2c4.com/wireguard-android
 $ cd wireguard-android
 $ ./gradlew assembleRelease
 ```
+
+macOS users may need [flock(1)](https://github.com/discoteq/flock).
+
+## Embedding
+
+The tunnel library is [on Maven Central](https://search.maven.org/artifact/com.wireguard.android/tunnel), alongside [extensive class library documentation](https://javadoc.io/doc/com.wireguard.android/tunnel).
+
+```
+implementation 'com.wireguard.android:tunnel:$wireguardTunnelVersion'
+```
+
+The library makes use of Java 8 features, so be sure to support those in your gradle configuration with [desugaring](https://developer.android.com/studio/write/java8-support#library-desugaring):
+
+```
+compileOptions {
+    sourceCompatibility JavaVersion.VERSION_17
+    targetCompatibility JavaVersion.VERSION_17
+    coreLibraryDesugaringEnabled = true
+}
+dependencies {
+    coreLibraryDesugaring "com.android.tools:desugar_jdk_libs:2.0.3"
+}
+```
+
+## Translating
+
+Please help us translate the app into several languages on [our translation platform](https://crowdin.com/project/WireGuard).
@@ -1,52 +0,0 @@
-allprojects {
-    repositories {
-        google()
-        jcenter()
-    }
-}
-
-buildscript {
-    ext {
-        annotationsVersion = '1.1.0'
-        appcompatVersion = '1.1.0'
-        cardviewVersion = '1.0.0'
-        collectionVersion = '1.1.0'
-        coreKtxVersion = '1.2.0'
-        constraintLayoutVersion = '1.1.3'
-        coordinatorLayoutVersion = '1.1.0'
-        agpVersion = '3.6.1'
-        fragmentVersion = '1.2.2'
-        materialComponentsVersion = '1.1.0'
-        jsr305Version = '3.0.2'
-        kotlinVersion = '1.3.70'
-        preferenceVersion = '1.1.0'
-        streamsupportVersion = '1.7.1'
-        threetenabpVersion = '1.2.2'
-        // ZXING switched minSdk to 24 so we cannot upgrade to 4.0.2 without following suit.
-        // If you choose to upgrade to minSDK 24 then you should also disable Jetifier from
-        // gradle.properties.
-        zxingEmbeddedVersion = '3.6.0'
-        eddsaVersion = '0.3.0'
-    }
-    dependencies {
-        classpath "com.android.tools.build:gradle:$agpVersion"
-        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinVersion"
-    }
-    repositories {
-        google()
-        jcenter()
-    }
-}
-
-task clean(type: Delete) {
-    delete rootProject.buildDir
-}
-
-tasks {
-    wrapper {
-        gradleVersion = "6.2.1"
-        distributionType = Wrapper.DistributionType.ALL
-    }
-}
-
-apply from: "version.gradle"
@@ -0,0 +1,13 @@
+plugins {
+    alias(libs.plugins.android.application) apply false
+    alias(libs.plugins.android.library) apply false
+    alias(libs.plugins.kotlin.android) apply false
+    alias(libs.plugins.kotlin.kapt) apply false
+}
+
+tasks {
+    wrapper {
+        gradleVersion = "8.1.1"
+        distributionSha256Sum = "e111cb9948407e26351227dabce49822fb88c37ee72f1d1582a69c68af2e702f"
+    }
+}
@@ -1,19 +1,73 @@
-# Project-wide Gradle settings.
-
-# IDE (e.g. Android Studio) users:
-# Gradle settings configured through the IDE *will override*
-# any settings specified in this file.
-
-# For more details on how to configure your build environment visit
-# http://www.gradle.org/docs/current/userguide/build_environment.html
-
-# Specifies the JVM arguments used for the daemon process.
-# The setting is particularly useful for tweaking memory settings.
-android.enableJetifier=true
-android.useAndroidX=true
-org.gradle.jvmargs=-Xmx1536m
+wireguardVersionCode=506
+wireguardVersionName=1.0.20230526
+wireguardPackageName=com.wireguard.android

 # When configured, Gradle will run in incubating parallel mode.
 # This option should only be used with decoupled projects. More details, visit
 # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
-# org.gradle.parallel=true
+org.gradle.parallel=true
+org.gradle.configureondemand=true
+org.gradle.caching=true
+
+# Enable Kotlin incremental compilation
+kotlin.incremental=true
+
+# Enable AndroidX support
+android.useAndroidX=true
+
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx1536m
+
+# Turn off AP discovery in compile path to enable compile avoidance
+kapt.include.compile.classpath=false
+
+# Enable non-transitive R class namespacing where each library only contains
+# references to the resources it declares instead of declarations plus all
+# transitive dependency references.
+android.nonTransitiveRClass=true
+
+# Experimental AGP flags
+# Generate compile-time only R class for app modules.
+android.enableAppCompileTimeRClass=true
+# Keep AAPT2 daemons alive between incremental builds.
+android.keepWorkerActionServicesBetweenBuilds=true
+# Make R fields non-final to improve build speeds.
+# http://tools.android.com/tips/non-constant-fields
+android.nonFinalResIds=true
+# Enable the newly refactored resource shrinker.
+android.experimental.enableNewResourceShrinker=true
+# Enable precise shrinking in the new resource shrinker.
+android.experimental.enableNewResourceShrinker.preciseShrinking=true
+# Generate manifest class as a .class directly rather than a Java source file.
+android.generateManifestClass=true
+# Generate the text map of source sets and absolute paths to allow
+# generating relative paths from absolute paths later in the build.
+android.experimental.enableSourceSetPathsMap=true
+# Use relative paths for better Gradle caching of library build tasks
+android.experimental.cacheCompileLibResources=true
+
+# Default Android build features
+# Disable BuildConfig generation by default
+android.defaults.buildfeatures.buildconfig=false
+# Disable AIDL stub generation by default
+android.defaults.buildfeatures.aidl=false
+# Disable RenderScript compilation by default
+android.defaults.buildfeatures.renderscript=false
+# Disable resource values generation by default in libraries
+android.defaults.buildfeatures.resvalues=false
+# Disable shader compilation by default
+android.defaults.buildfeatures.shaders=false
+# Disable Android resource processing by default
+android.library.defaults.buildfeatures.androidresources=false
+
+# Suppress warnings for some features that aren't yet stabilized
+android.suppressUnsupportedOptionWarnings=android.keepWorkerActionServicesBetweenBuilds,\
+  android.experimental.enableNewResourceShrinker.preciseShrinking,\
+  android.enableAppCompileTimeRClass,\
+  android.suppressUnsupportedOptionWarnings
+
+# OSSRH sometimes struggles with slow deployments, so this makes Gradle
+# more tolerant to those delays.
+systemProp.org.gradle.internal.http.connectionTimeout=500000
+systemProp.org.gradle.internal.http.socketTimeout=500000
@@ -0,0 +1,29 @@
+[versions]
+agp = "8.2.0-alpha05"
+kotlin = "1.8.21"
+
+[libraries]
+androidx-activity-ktx = "androidx.activity:activity-ktx:1.7.1"
+androidx-annotation = "androidx.annotation:annotation:1.6.0"
+androidx-appcompat = "androidx.appcompat:appcompat:1.6.1"
+androidx-biometric = "androidx.biometric:biometric:1.1.0"
+androidx-collection = "androidx.collection:collection:1.2.0"
+androidx-constraintlayout = "androidx.constraintlayout:constraintlayout:2.1.4"
+androidx-coordinatorlayout = "androidx.coordinatorlayout:coordinatorlayout:1.2.0"
+androidx-core-ktx = "androidx.core:core-ktx:1.10.1"
+androidx-datastore-preferences = "androidx.datastore:datastore-preferences:1.0.0"
+androidx-fragment-ktx = "androidx.fragment:fragment-ktx:1.5.7"
+androidx-lifecycle-runtime-ktx = "androidx.lifecycle:lifecycle-runtime-ktx:2.6.1"
+androidx-preference-ktx = "androidx.preference:preference-ktx:1.2.0"
+desugarJdkLibs = "com.android.tools:desugar_jdk_libs:2.0.3"
+google-material = "com.google.android.material:material:1.9.0"
+jsr305 = "com.google.code.findbugs:jsr305:3.0.2"
+junit = "junit:junit:4.13.2"
+kotlinx-coroutines-android = "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.0"
+zxing-android-embedded = "com.journeyapps:zxing-android-embedded:4.3.0"
+
+[plugins]
+android-application = { id = "com.android.application", version.ref = "agp" }
+android-library = { id = "com.android.library", version.ref = "agp" }
+kotlin-android = { id = "org.jetbrains.kotlin.android", version.ref = "kotlin" }
+kotlin-kapt = { id = "org.jetbrains.kotlin.kapt", version.ref = "kotlin" }
@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.2.1-all.zip
+distributionSha256Sum=e111cb9948407e26351227dabce49822fb88c37ee72f1d1582a69c68af2e702f
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip
+networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
@@ -1,7 +1,7 @@
-#!/usr/bin/env sh
+#!/bin/sh

 #
-# Copyright 2015 the original author or authors.
+# Copyright © 2015-2021 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -17,78 +17,110 @@
 #

 ##############################################################################
-##
-##  Gradle start up script for UN*X
-##
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################

 # Attempt to set APP_HOME
+
 # Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
 done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null

-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit

 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum

 warn () {
    echo "$*"
-}
+} >&2

 die () {
    echo
    echo "$*"
    echo
    exit 1
-}
+} >&2

 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
 esac

 CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar

+
 # Determine the Java command to use to start the JVM.
 if [ -n "$JAVA_HOME" ] ; then
    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
        # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
    else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
    fi
    if [ ! -x "$JAVACMD" ] ; then
        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -97,7 +129,7 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
    fi
 else
-    JAVACMD="java"
+    JAVACMD=java
    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.

 Please set the JAVA_HOME variable in your environment to match the
@@ -105,79 +137,109 @@ location of your Java installation."
 fi

 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
-fi
-
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
-        fi
-        i=`expr $i + 1`
-    done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
    esac
 fi

-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=`save "$@"`
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.

-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command;
+#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#     shell script including quotes and variable substitutions, so put them in
+#     double quotes to make sure that they get re-expanded; and
+#   * put everything else in single quotes, so that it's not re-expanded.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'

 exec "$JAVACMD" "$@"
@@ -1,2 +0,0 @@
-include ':tunnel'
-include ':ui'
@@ -0,0 +1,22 @@
+@file:Suppress("UnstableApiUsage")
+
+pluginManagement {
+    repositories {
+        gradlePluginPortal()
+        google()
+        mavenCentral()
+    }
+}
+
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+rootProject.name = "wireguard-android"
+
+include(":tunnel")
+include(":ui")
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -ex
+curl -Lo - https://crowdin.com/backend/download/project/wireguard.zip | bsdtar -C ui/src/main/res -x -f - --strip-components 5 wireguard-android
+find ui/src/main/res -name strings.xml -exec bash -c '[[ $(xmllint --xpath "count(//resources/*)" {}) -ne 0 ]] || rm -rf "$(dirname {})"' \;
@@ -1,31 +0,0 @@
-apply plugin: 'com.android.library'
-
-android {
-    buildToolsVersion '29.0.3'
-    compileSdkVersion 29
-    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_1_8
-        targetCompatibility JavaVersion.VERSION_1_8
-    }
-    defaultConfig {
-        minSdkVersion 21
-        targetSdkVersion 29
-        versionCode wireguardVersionCode
-        versionName wireguardVersionName
-    }
-    externalNativeBuild {
-        cmake {
-            path 'tools/CMakeLists.txt'
-        }
-    }
-}
-
-dependencies {
-    api "net.sourceforge.streamsupport:android-retrofuture:$streamsupportVersion"
-    api "net.sourceforge.streamsupport:android-retrostreams:$streamsupportVersion"
-    implementation "androidx.annotation:annotation:$annotationsVersion"
-    implementation "androidx.collection:collection:$collectionVersion"
-    implementation "com.google.code.findbugs:jsr305:$jsr305Version"
-    implementation "com.jakewharton.threetenabp:threetenabp:$threetenabpVersion"
-    implementation "net.i2p.crypto:eddsa:$eddsaVersion"
-}
@@ -0,0 +1,128 @@
+@file:Suppress("UnstableApiUsage")
+
+import org.gradle.api.tasks.testing.logging.TestLogEvent
+
+val pkg: String = providers.gradleProperty("wireguardPackageName").get()
+
+plugins {
+    alias(libs.plugins.android.library)
+    `maven-publish`
+    signing
+}
+
+android {
+    compileSdk = 33
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+    namespace = "${pkg}.tunnel"
+    defaultConfig {
+        minSdk = 21
+    }
+    externalNativeBuild {
+        cmake {
+            path("tools/CMakeLists.txt")
+        }
+    }
+    testOptions.unitTests.all {
+        it.testLogging { events(TestLogEvent.PASSED, TestLogEvent.SKIPPED, TestLogEvent.FAILED) }
+    }
+    buildTypes {
+        all {
+            externalNativeBuild {
+                cmake {
+                    targets("libwg-go.so", "libwg.so", "libwg-quick.so")
+                    arguments("-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}")
+                }
+            }
+        }
+        release {
+            externalNativeBuild {
+                cmake {
+                    arguments("-DANDROID_PACKAGE_NAME=${pkg}")
+                }
+            }
+        }
+        debug {
+            externalNativeBuild {
+                cmake {
+                    arguments("-DANDROID_PACKAGE_NAME=${pkg}.debug")
+                }
+            }
+        }
+    }
+    lint {
+        disable += "LongLogTag"
+        disable += "NewApi"
+    }
+    publishing {
+        singleVariant("release") {
+            withJavadocJar()
+            withSourcesJar()
+        }
+    }
+}
+
+dependencies {
+    implementation(libs.androidx.annotation)
+    implementation(libs.androidx.collection)
+    compileOnly(libs.jsr305)
+    testImplementation(libs.junit)
+}
+
+publishing {
+    publications {
+        register<MavenPublication>("release") {
+            groupId = pkg
+            artifactId = "tunnel"
+            version = providers.gradleProperty("wireguardVersionName").get()
+            afterEvaluate {
+                from(components["release"])
+            }
+            pom {
+                name.set("WireGuard Tunnel Library")
+                description.set("Embeddable tunnel library for WireGuard for Android")
+                url.set("https://www.wireguard.com/")
+
+                licenses {
+                    license {
+                        name.set("The Apache Software License, Version 2.0")
+                        url.set("http://www.apache.org/licenses/LICENSE-2.0.txt")
+                        distribution.set("repo")
+                    }
+                }
+                scm {
+                    connection.set("scm:git:https://git.zx2c4.com/wireguard-android")
+                    developerConnection.set("scm:git:https://git.zx2c4.com/wireguard-android")
+                    url.set("https://git.zx2c4.com/wireguard-android")
+                }
+                developers {
+                    organization {
+                        name.set("WireGuard")
+                        url.set("https://www.wireguard.com/")
+                    }
+                    developer {
+                        name.set("WireGuard")
+                        email.set("team@wireguard.com")
+                    }
+                }
+            }
+        }
+    }
+    repositories {
+        maven {
+            name = "sonatype"
+            url = uri("https://oss.sonatype.org/service/local/staging/deploy/maven2/")
+            credentials {
+                username = providers.environmentVariable("SONATYPE_USER").orNull
+                password = providers.environmentVariable("SONATYPE_PASSWORD").orNull
+            }
+        }
+    }
+}
+
+signing {
+    useGpgCmd()
+    sign(publishing.publications)
+}
@@ -1,14 +1,15 @@
 <!--
-  ~ Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+  ~ Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
  ~ SPDX-License-Identifier: Apache-2.0
  -->

-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="com.wireguard.android.tunnel">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
    <application>
-            <service
+        <service
            android:name="com.wireguard.android.backend.GoBackend$VpnService"
-            android:permission="android.permission.BIND_VPN_SERVICE">
+            android:permission="android.permission.BIND_VPN_SERVICE"
+            android:exported="false">
            <intent-filter>
                <action android:name="android.net.VpnService" />
            </intent-filter>
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -30,6 +30,7 @@ public interface Backend {
     *
     * @param tunnel The tunnel to examine the state of.
     * @return The state of the tunnel.
+     * @throws Exception Exception raised when retrieving tunnel's state.
     */
    Tunnel.State getState(Tunnel tunnel) throws Exception;

@@ -39,6 +40,7 @@ public interface Backend {
     *
     * @param tunnel The tunnel to retrieve statistics for.
     * @return The statistics for the tunnel.
+     * @throws Exception Exception raised when retrieving statistics.
     */
    Statistics getStatistics(Tunnel tunnel) throws Exception;

@@ -46,7 +48,7 @@ public interface Backend {
     * Determine version of underlying backend.
     *
     * @return The version of the backend.
-     * @throws Exception
+     * @throws Exception Exception raised while retrieving version.
     */
    String getVersion() throws Exception;

@@ -59,6 +61,7 @@ public interface Backend {
     *               {@code TOGGLE}.
     * @param config The configuration for this tunnel, may be null if state is {@code DOWN}.
     * @return The updated state of the tunnel.
+     * @throws Exception Exception raised while changing state.
     */
    Tunnel.State setState(Tunnel tunnel, Tunnel.State state, @Nullable Config config) throws Exception;
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -7,23 +7,47 @@ package com.wireguard.android.backend;

 import com.wireguard.util.NonNullForAll;

+/**
+ * A subclass of {@link Exception} that encapsulates the reasons for a failure originating in
+ * implementations of {@link Backend}.
+ */
@NonNullForAll
 public final class BackendException extends Exception {
    private final Object[] format;
    private final Reason reason;
+
+    /**
+     * Public constructor for BackendException.
+     *
+     * @param reason The {@link Reason} which caused this exception to be thrown
+     * @param format Format string values used when converting exceptions to user-facing strings.
+     */
    public BackendException(final Reason reason, final Object... format) {
        this.reason = reason;
        this.format = format;
    }

+    /**
+     * Get the format string values associated with the instance.
+     *
+     * @return Array of {@link Object} for string formatting purposes
+     */
    public Object[] getFormat() {
        return format;
    }

+    /**
+     * Get the reason for this exception.
+     *
+     * @return Associated {@link Reason} for this exception.
+     */
    public Reason getReason() {
        return reason;
    }

+    /**
+     * Enum class containing all known reasons for why a {@link BackendException} might be thrown.
+     */
    public enum Reason {
        UNKNOWN_KERNEL_MODULE_NAME,
        WG_QUICK_CONFIG_ERROR_CODE,
@@ -31,6 +55,7 @@ public final class BackendException extends Exception {
        VPN_NOT_AUTHORIZED,
        UNABLE_TO_START_VPN,
        TUN_CREATION_ERROR,
-        GO_ACTIVATION_ERROR_CODE
+        GO_ACTIVATION_ERROR_CODE,
+        DNS_RESOLUTION_FAILURE,
    }
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -9,12 +9,14 @@ import android.content.Context;
 import android.content.Intent;
 import android.os.Build;
 import android.os.ParcelFileDescriptor;
+import android.system.OsConstants;
 import android.util.Log;

 import com.wireguard.android.backend.BackendException.Reason;
 import com.wireguard.android.backend.Tunnel.State;
 import com.wireguard.android.util.SharedLibraryLoader;
 import com.wireguard.config.Config;
+import com.wireguard.config.InetEndpoint;
 import com.wireguard.config.InetNetwork;
 import com.wireguard.config.Peer;
 import com.wireguard.crypto.Key;
@@ -22,34 +24,54 @@ import com.wireguard.crypto.KeyFormatException;
 import com.wireguard.util.NonNullForAll;

 import java.net.InetAddress;
+import java.time.Instant;
 import java.util.Collections;
 import java.util.Set;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.FutureTask;
+import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;

 import androidx.annotation.Nullable;
 import androidx.collection.ArraySet;
-import java9.util.concurrent.CompletableFuture;

+/**
+ * Implementation of {@link Backend} that uses the wireguard-go userspace implementation to provide
+ * WireGuard tunnels.
+ */
@NonNullForAll
 public final class GoBackend implements Backend {
-    private static final String TAG = "WireGuard/" + GoBackend.class.getSimpleName();
+    private static final int DNS_RESOLUTION_RETRIES = 10;
+    private static final String TAG = "WireGuard/GoBackend";
    @Nullable private static AlwaysOnCallback alwaysOnCallback;
-    private static CompletableFuture<VpnService> vpnService = new CompletableFuture<>();
+    private static GhettoCompletableFuture<VpnService> vpnService = new GhettoCompletableFuture<>();
    private final Context context;
    @Nullable private Config currentConfig;
    @Nullable private Tunnel currentTunnel;
    private int currentTunnelHandle = -1;
+
+    /**
+     * Public constructor for GoBackend.
+     *
+     * @param context An Android {@link Context}
+     */
    public GoBackend(final Context context) {
        SharedLibraryLoader.loadSharedLibrary(context, "wg-go");
        this.context = context;
    }

-    public static void setAlwaysOnCallback(AlwaysOnCallback cb) {
+    /**
+     * Set a {@link AlwaysOnCallback} to be invoked when {@link VpnService} is started by the
+     * system's Always-On VPN mode.
+     *
+     * @param cb Callback to be invoked
+     */
+    public static void setAlwaysOnCallback(final AlwaysOnCallback cb) {
        alwaysOnCallback = cb;
    }

-    private static native String wgGetConfig(int handle);
+    @Nullable private static native String wgGetConfig(int handle);

    private static native int wgGetSocketV4(int handle);

@@ -61,6 +83,11 @@ public final class GoBackend implements Backend {

    private static native String wgVersion();

+    /**
+     * Method to get the names of running tunnels.
+     *
+     * @return A set of string values denoting names of running tunnels.
+     */
    @Override
    public Set<String> getRunningTunnelNames() {
        if (currentTunnel != null) {
@@ -71,26 +98,42 @@ public final class GoBackend implements Backend {
        return Collections.emptySet();
    }

+    /**
+     * Get the associated {@link State} for a given {@link Tunnel}.
+     *
+     * @param tunnel The tunnel to examine the state of.
+     * @return {@link State} associated with the given tunnel.
+     */
    @Override
    public State getState(final Tunnel tunnel) {
        return currentTunnel == tunnel ? State.UP : State.DOWN;
    }

+    /**
+     * Get the associated {@link Statistics} for a given {@link Tunnel}.
+     *
+     * @param tunnel The tunnel to retrieve statistics for.
+     * @return {@link Statistics} associated with the given tunnel.
+     */
    @Override
    public Statistics getStatistics(final Tunnel tunnel) {
        final Statistics stats = new Statistics();
-        if (tunnel != currentTunnel) {
+        if (tunnel != currentTunnel || currentTunnelHandle == -1)
            return stats;
-        }
        final String config = wgGetConfig(currentTunnelHandle);
+        if (config == null)
+            return stats;
        Key key = null;
-        long rx = 0, tx = 0;
+        long rx = 0;
+        long tx = 0;
+        long latestHandshakeMSec = 0;
        for (final String line : config.split("\\n")) {
            if (line.startsWith("public_key=")) {
                if (key != null)
-                    stats.add(key, rx, tx);
+                    stats.add(key, rx, tx, latestHandshakeMSec);
                rx = 0;
                tx = 0;
+                latestHandshakeMSec = 0;
                try {
                    key = Key.fromHex(line.substring(11));
                } catch (final KeyFormatException ignored) {
@@ -112,18 +155,49 @@ public final class GoBackend implements Backend {
                } catch (final NumberFormatException ignored) {
                    tx = 0;
                }
+            } else if (line.startsWith("last_handshake_time_sec=")) {
+                if (key == null)
+                    continue;
+                try {
+                    latestHandshakeMSec += Long.parseLong(line.substring(24)) * 1000;
+                } catch (final NumberFormatException ignored) {
+                    latestHandshakeMSec = 0;
+                }
+            } else if (line.startsWith("last_handshake_time_nsec=")) {
+                if (key == null)
+                    continue;
+                try {
+                    latestHandshakeMSec += Long.parseLong(line.substring(25)) / 1000000;
+                } catch (final NumberFormatException ignored) {
+                    latestHandshakeMSec = 0;
+                }
            }
        }
        if (key != null)
-            stats.add(key, rx, tx);
+            stats.add(key, rx, tx, latestHandshakeMSec);
        return stats;
    }

+    /**
+     * Get the version of the underlying wireguard-go library.
+     *
+     * @return {@link String} value of the version of the wireguard-go library.
+     */
    @Override
    public String getVersion() {
        return wgVersion();
    }

+    /**
+     * Change the state of a given {@link Tunnel}, optionally applying a given {@link Config}.
+     *
+     * @param tunnel The tunnel to control the state of.
+     * @param state  The new state for this tunnel. Must be {@code UP}, {@code DOWN}, or
+     *               {@code TOGGLE}.
+     * @param config The configuration for this tunnel, may be null if state is {@code DOWN}.
+     * @return {@link State} of the tunnel after state changes are applied.
+     * @throws Exception Exception raised while changing tunnel state.
+     */
    @Override
    public State setState(final Tunnel tunnel, State state, @Nullable final Config config) throws Exception {
        final State originalState = getState(tunnel);
@@ -152,7 +226,7 @@ public final class GoBackend implements Backend {

    private void setStateInternal(final Tunnel tunnel, @Nullable final Config config, final State state)
            throws Exception {
-        Log.i(TAG, "Bringing tunnel " + tunnel.getName() + " " + state);
+        Log.i(TAG, "Bringing tunnel " + tunnel.getName() + ' ' + state);

        if (state == State.UP) {
            if (config == null)
@@ -162,8 +236,10 @@ public final class GoBackend implements Backend {
                throw new BackendException(Reason.VPN_NOT_AUTHORIZED);

            final VpnService service;
-            if (!vpnService.isDone())
-                startVpnService();
+            if (!vpnService.isDone()) {
+                Log.d(TAG, "Requesting to start VpnService");
+                context.startService(new Intent(context, VpnService.class));
+            }

            try {
                service = vpnService.get(2, TimeUnit.SECONDS);
@@ -179,6 +255,25 @@ public final class GoBackend implements Backend {
                return;
            }

+
+            dnsRetry: for (int i = 0; i < DNS_RESOLUTION_RETRIES; ++i) {
+                // Pre-resolve IPs so they're cached when building the userspace string
+                for (final Peer peer : config.getPeers()) {
+                    final InetEndpoint ep = peer.getEndpoint().orElse(null);
+                    if (ep == null)
+                        continue;
+                    if (ep.getResolved().orElse(null) == null) {
+                        if (i < DNS_RESOLUTION_RETRIES - 1) {
+                            Log.w(TAG, "DNS host \"" + ep.getHost() + "\" failed to resolve; trying again");
+                            Thread.sleep(1000);
+                            continue dnsRetry;
+                        } else
+                            throw new BackendException(Reason.DNS_RESOLUTION_FAILURE, ep.getHost());
+                    }
+                }
+                break;
+            }
+
            // Build config
            final String goConfig = config.toWgUserspaceString();

@@ -189,15 +284,31 @@ public final class GoBackend implements Backend {
            for (final String excludedApplication : config.getInterface().getExcludedApplications())
                builder.addDisallowedApplication(excludedApplication);

+            for (final String includedApplication : config.getInterface().getIncludedApplications())
+                builder.addAllowedApplication(includedApplication);
+
            for (final InetNetwork addr : config.getInterface().getAddresses())
                builder.addAddress(addr.getAddress(), addr.getMask());

            for (final InetAddress addr : config.getInterface().getDnsServers())
                builder.addDnsServer(addr.getHostAddress());

+            for (final String dnsSearchDomain : config.getInterface().getDnsSearchDomains())
+                builder.addSearchDomain(dnsSearchDomain);
+
+            boolean sawDefaultRoute = false;
            for (final Peer peer : config.getPeers()) {
-                for (final InetNetwork addr : peer.getAllowedIps())
+                for (final InetNetwork addr : peer.getAllowedIps()) {
+                    if (addr.getMask() == 0)
+                        sawDefaultRoute = true;
                    builder.addRoute(addr.getAddress(), addr.getMask());
+                }
+            }
+
+            // "Kill-switch" semantics
+            if (!(sawDefaultRoute && config.getPeers().size() == 1)) {
+                builder.allowFamily(OsConstants.AF_INET);
+                builder.allowFamily(OsConstants.AF_INET6);
            }

            builder.setMtu(config.getInterface().getMtu().orElse(1280));
@@ -211,7 +322,7 @@ public final class GoBackend implements Backend {
            try (final ParcelFileDescriptor tun = builder.establish()) {
                if (tun == null)
                    throw new BackendException(Reason.TUN_CREATION_ERROR);
-                Log.d(TAG, "Go backend v" + wgVersion());
+                Log.d(TAG, "Go backend " + wgVersion());
                currentTunnelHandle = wgTurnOn(tunnel.getName(), tun.detachFd(), goConfig);
            }
            if (currentTunnelHandle < 0)
@@ -227,25 +338,59 @@ public final class GoBackend implements Backend {
                Log.w(TAG, "Tunnel already down");
                return;
            }
-
-            wgTurnOff(currentTunnelHandle);
+            int handleToClose = currentTunnelHandle;
            currentTunnel = null;
            currentTunnelHandle = -1;
            currentConfig = null;
+            wgTurnOff(handleToClose);
+            try {
+                vpnService.get(0, TimeUnit.NANOSECONDS).stopSelf();
+            } catch (final TimeoutException ignored) { }
        }

        tunnel.onStateChange(state);
    }

-    private void startVpnService() {
-        Log.d(TAG, "Requesting to start VpnService");
-        context.startService(new Intent(context, VpnService.class));
-    }
-
+    /**
+     * Callback for {@link GoBackend} that is invoked when {@link VpnService} is started by the
+     * system's Always-On VPN mode.
+     */
    public interface AlwaysOnCallback {
        void alwaysOnTriggered();
    }

+    // TODO: When we finally drop API 21 and move to API 24, delete this and replace with the ordinary CompletableFuture.
+    private static final class GhettoCompletableFuture<V> {
+        private final LinkedBlockingQueue<V> completion = new LinkedBlockingQueue<>(1);
+        private final FutureTask<V> result = new FutureTask<>(completion::peek);
+
+        public boolean complete(final V value) {
+            final boolean offered = completion.offer(value);
+            if (offered)
+                result.run();
+            return offered;
+        }
+
+        public V get() throws ExecutionException, InterruptedException {
+            return result.get();
+        }
+
+        public V get(final long timeout, final TimeUnit unit) throws ExecutionException, InterruptedException, TimeoutException {
+            return result.get(timeout, unit);
+        }
+
+        public boolean isDone() {
+            return !completion.isEmpty();
+        }
+
+        public GhettoCompletableFuture<V> newIncompleteFuture() {
+            return new GhettoCompletableFuture<>();
+        }
+    }
+
+    /**
+     * {@link android.net.VpnService} implementation for {@link GoBackend}
+     */
    public static class VpnService extends android.net.VpnService {
        @Nullable private GoBackend owner;

@@ -1,64 +1,125 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.backend;

 import android.os.SystemClock;
-import android.util.Pair;

 import com.wireguard.crypto.Key;
 import com.wireguard.util.NonNullForAll;

 import java.util.HashMap;
 import java.util.Map;
+import java.util.Objects;

+import androidx.annotation.Nullable;
+
+/**
+ * Class representing transfer statistics for a {@link Tunnel} instance.
+ */
@NonNullForAll
 public class Statistics {
-    private final Map<Key, Pair<Long, Long>> peerBytes = new HashMap<>();
+
+    // TODO: switch to Java Record class once R8 supports desugaring those.
+    public final class PeerStats {
+        public final long rxBytes, txBytes, latestHandshakeEpochMillis;
+
+        PeerStats(final long rxBytes, final long txBytes, final long latestHandshakeEpochMillis) {
+            this.rxBytes = rxBytes;
+            this.txBytes = txBytes;
+            this.latestHandshakeEpochMillis = latestHandshakeEpochMillis;
+        }
+
+        @Override public boolean equals(final Object o) {
+            if (this == o)
+                return true;
+            if (o == null || getClass() != o.getClass())
+                return false;
+            final PeerStats stats = (PeerStats) o;
+            return rxBytes == stats.rxBytes && txBytes == stats.txBytes && latestHandshakeEpochMillis == stats.latestHandshakeEpochMillis;
+        }
+
+        @Override public int hashCode() {
+            return Objects.hash(rxBytes, txBytes, latestHandshakeEpochMillis);
+        }
+    }
+
+    private final Map<Key, PeerStats> stats = new HashMap<>();
    private long lastTouched = SystemClock.elapsedRealtime();

    Statistics() {
    }

-    void add(final Key key, final long rx, final long tx) {
-        peerBytes.put(key, Pair.create(rx, tx));
+    /**
+     * Add a peer and its current stats to the internal map.
+     *
+     * @param key               A WireGuard public key bound to a particular peer
+     * @param rxBytes           The received traffic for the {@link com.wireguard.config.Peer} referenced by
+     *                          the provided {@link Key}. This value is in bytes
+     * @param txBytes           The transmitted traffic for the {@link com.wireguard.config.Peer} referenced by
+     *                          the provided {@link Key}. This value is in bytes.
+     * @param latestHandshake   The timestamp of the latest handshake for the {@link com.wireguard.config.Peer}
+     *                          referenced by the provided {@link Key}. The value is in epoch milliseconds.
+     */
+    void add(final Key key, final long rxBytes, final long txBytes, final long latestHandshake) {
+        stats.put(key, new PeerStats(rxBytes, txBytes, latestHandshake));
        lastTouched = SystemClock.elapsedRealtime();
    }

+    /**
+     * Check if the statistics are stale, indicating the need for the {@link Backend} to update them.
+     *
+     * @return boolean indicating if the current statistics instance has stale values.
+     */
    public boolean isStale() {
        return SystemClock.elapsedRealtime() - lastTouched > 900;
    }

-    public long peerRx(final Key peer) {
-        if (!peerBytes.containsKey(peer))
-            return 0;
-        return peerBytes.get(peer).first;
-    }
-
-    public long peerTx(final Key peer) {
-        if (!peerBytes.containsKey(peer))
-            return 0;
-        return peerBytes.get(peer).second;
+    /**
+     * Get the statistics for the {@link com.wireguard.config.Peer} referenced by the provided {@link Key}
+     *
+     * @param peer A {@link Key} representing a {@link com.wireguard.config.Peer}.
+     * @return a {@link PeerStats} representing various statistics about this peer.
+     */
+    @Nullable
+    public PeerStats peer(final Key peer) {
+        return this.stats.get(peer);
    }

+    /**
+     * Get the list of peers being tracked by this instance.
+     *
+     * @return An array of {@link Key} instances representing WireGuard
+     * {@link com.wireguard.config.Peer}s
+     */
    public Key[] peers() {
-        return peerBytes.keySet().toArray(new Key[0]);
+        return stats.keySet().toArray(new Key[0]);
    }

+    /**
+     * Get the total received traffic by all the peers being tracked by this instance
+     *
+     * @return a long representing the number of bytes received by the peers being tracked.
+     */
    public long totalRx() {
        long rx = 0;
-        for (final Pair<Long, Long> val : peerBytes.values()) {
-            rx += val.first;
+        for (final PeerStats val : stats.values()) {
+            rx += val.rxBytes;
        }
        return rx;
    }

+    /**
+     * Get the total transmitted traffic by all the peers being tracked by this instance
+     *
+     * @return a long representing the number of bytes transmitted by the peers being tracked.
+     */
    public long totalTx() {
        long tx = 0;
-        for (final Pair<Long, Long> val : peerBytes.values()) {
-            tx += val.second;
+        for (final PeerStats val : stats.values()) {
+            tx += val.txBytes;
        }
        return tx;
    }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -33,15 +33,23 @@ public interface Tunnel {
     * React to a change in state of the tunnel. Should only be directly called by Backend.
     *
     * @param newState The new state of the tunnel.
-     * @return The new state of the tunnel.
     */
    void onStateChange(State newState);

+    /**
+     * Enum class to represent all possible states of a {@link Tunnel}.
+     */
    enum State {
        DOWN,
        TOGGLE,
        UP;

+        /**
+         * Get the state of a {@link Tunnel}
+         *
+         * @param running boolean indicating if the tunnel is running.
+         * @return State of the tunnel based on whether or not it is running.
+         */
        public static State of(final boolean running) {
            return running ? UP : DOWN;
        }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -20,6 +20,7 @@ import com.wireguard.util.NonNullForAll;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.nio.charset.StandardCharsets;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -32,16 +33,15 @@ import java.util.Objects;
 import java.util.Set;

 import androidx.annotation.Nullable;
-import java9.util.stream.Collectors;
-import java9.util.stream.Stream;

 /**
- * WireGuard backend that uses {@code wg-quick} to implement tunnel configuration.
+ * Implementation of {@link Backend} that uses the kernel module and {@code wg-quick} to provide
+ * WireGuard tunnels.
 */

@NonNullForAll
 public final class WgQuickBackend implements Backend {
-    private static final String TAG = "WireGuard/" + WgQuickBackend.class.getSimpleName();
+    private static final String TAG = "WireGuard/WgQuickBackend";
    private final File localTemporaryDir;
    private final RootShell rootShell;
    private final Map<Tunnel, Config> runningConfigs = new HashMap<>();
@@ -54,6 +54,10 @@ public final class WgQuickBackend implements Backend {
        this.toolsInstaller = toolsInstaller;
    }

+    public static boolean hasKernelSupport() {
+        return new File("/sys/module/wireguard").exists();
+    }
+
    @Override
    public Set<String> getRunningTunnelNames() {
        final List<String> output = new ArrayList<>();
@@ -67,7 +71,7 @@ public final class WgQuickBackend implements Backend {
            return Collections.emptySet();
        }
        // wg puts all interface names on the same line. Split them into separate elements.
-        return Stream.of(output.get(0).split(" ")).collect(Collectors.toUnmodifiableSet());
+        return Set.of(output.get(0).split(" "));
    }

    @Override
@@ -80,17 +84,17 @@ public final class WgQuickBackend implements Backend {
        final Statistics stats = new Statistics();
        final Collection<String> output = new ArrayList<>();
        try {
-            if (rootShell.run(output, String.format("wg show '%s' transfer", tunnel.getName())) != 0)
+            if (rootShell.run(output, String.format("wg show '%s' dump", tunnel.getName())) != 0)
                return stats;
        } catch (final Exception ignored) {
            return stats;
        }
        for (final String line : output) {
            final String[] parts = line.split("\\t");
-            if (parts.length != 3)
+            if (parts.length != 8)
                continue;
            try {
-                stats.add(Key.fromBase64(parts[0]), Long.parseLong(parts[1]), Long.parseLong(parts[2]));
+                stats.add(Key.fromBase64(parts[0]), Long.parseLong(parts[5]), Long.parseLong(parts[6]), Long.parseLong(parts[4]) * 1000);
            } catch (final Exception ignored) {
            }
        }
@@ -105,7 +109,7 @@ public final class WgQuickBackend implements Backend {
        return output.get(0);
    }

-    public void setMultipleTunnels(boolean on) {
+    public void setMultipleTunnels(final boolean on) {
        multipleTunnels = on;
    }

@@ -164,7 +168,7 @@ public final class WgQuickBackend implements Backend {
    }

    private void setStateInternal(final Tunnel tunnel, @Nullable final Config config, final State state) throws Exception {
-        Log.i(TAG, "Bringing tunnel " + tunnel.getName() + " " + state);
+        Log.i(TAG, "Bringing tunnel " + tunnel.getName() + ' ' + state);

        Objects.requireNonNull(config, "Trying to set state up with a null config");

@@ -1,188 +0,0 @@
-/*
- * Copyright © 2019-2020 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.util;
-
-import android.content.Context;
-import android.system.OsConstants;
-import android.util.Base64;
-
-import com.wireguard.android.util.RootShell.RootShellException;
-import com.wireguard.util.NonNullForAll;
-
-import net.i2p.crypto.eddsa.EdDSAEngine;
-import net.i2p.crypto.eddsa.EdDSAPublicKey;
-import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable;
-import net.i2p.crypto.eddsa.spec.EdDSAParameterSpec;
-import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec;
-
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.HttpURLConnection;
-import java.net.URL;
-import java.nio.charset.StandardCharsets;
-import java.security.InvalidParameterException;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.security.Signature;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import androidx.annotation.Nullable;
-
-@NonNullForAll
-public class ModuleLoader {
-    private static final String MODULE_LIST_URL = "https://download.wireguard.com/android-module/modules.txt.sig";
-    private static final String MODULE_NAME = "wireguard-%s.ko";
-    private static final String MODULE_PUBLIC_KEY_BASE64 = "RWRmHuT9PSqtwfsLtEx+QS06BJtLgFYteL9WCNjH7yuyu5Y1DieSN7If";
-    private static final String MODULE_URL = "https://download.wireguard.com/android-module/%s";
-    private final File moduleDir;
-    private final RootShell rootShell;
-    private final File tmpDir;
-    private final String userAgent;
-
-    public ModuleLoader(final Context context, final RootShell rootShell, final String userAgent) {
-        moduleDir = new File(context.getCacheDir(), "kmod");
-        tmpDir = new File(context.getCacheDir(), "tmp");
-        this.rootShell = rootShell;
-        this.userAgent = userAgent;
-    }
-
-    public static boolean isModuleLoaded() {
-        return new File("/sys/module/wireguard").exists();
-    }
-
-    public Integer download() throws IOException, RootShellException, NoSuchAlgorithmException {
-        final List<String> output = new ArrayList<>();
-        rootShell.run(output, "sha256sum /proc/version|cut -d ' ' -f 1");
-        if (output.size() != 1 || output.get(0).length() != 64)
-            throw new InvalidParameterException("Invalid sha256 of /proc/version");
-        final String moduleName = String.format(MODULE_NAME, output.get(0));
-        HttpURLConnection connection = (HttpURLConnection) new URL(MODULE_LIST_URL).openConnection();
-        connection.setRequestProperty("User-Agent", userAgent);
-        connection.connect();
-        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
-            throw new IOException("Hash list could not be found");
-        byte[] input = new byte[1024 * 1024 * 3 /* 3MiB */];
-        int len;
-        try (final InputStream inputStream = connection.getInputStream()) {
-            len = inputStream.read(input);
-        }
-        if (len <= 0)
-            throw new IOException("Hash list was empty");
-        final Map<String, Sha256Digest> modules = verifySignedHashes(new String(input, 0, len, StandardCharsets.UTF_8));
-        if (modules == null)
-            throw new InvalidParameterException("The signature did not verify or invalid hash list format");
-        if (!modules.containsKey(moduleName))
-            return OsConstants.ENOENT;
-        connection = (HttpURLConnection) new URL(String.format(MODULE_URL, moduleName)).openConnection();
-        connection.setRequestProperty("User-Agent", userAgent);
-        connection.connect();
-        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
-            throw new IOException("Module file could not be found, despite being on hash list");
-
-        tmpDir.mkdirs();
-        moduleDir.mkdir();
-        File tempFile = null;
-        try {
-            tempFile = File.createTempFile("UNVERIFIED-", null, tmpDir);
-            MessageDigest digest = MessageDigest.getInstance("SHA-256");
-            try (final InputStream inputStream = connection.getInputStream();
-                 final FileOutputStream outputStream = new FileOutputStream(tempFile)) {
-                int total = 0;
-                while ((len = inputStream.read(input)) > 0) {
-                    total += len;
-                    if (total > 1024 * 1024 * 15 /* 15 MiB */)
-                        throw new IOException("File too big");
-                    outputStream.write(input, 0, len);
-                    digest.update(input, 0, len);
-                }
-                outputStream.getFD().sync();
-            }
-            if (!Arrays.equals(digest.digest(), modules.get(moduleName).bytes))
-                throw new IOException("Incorrect file hash");
-
-            if (!tempFile.renameTo(new File(moduleDir, moduleName)))
-                throw new IOException("Unable to rename to final destination");
-        } finally {
-            if (tempFile != null)
-                tempFile.delete();
-        }
-        return OsConstants.EXIT_SUCCESS;
-    }
-
-    public void loadModule() throws IOException, RootShellException {
-        rootShell.run(null, String.format("insmod \"%s/wireguard-$(sha256sum /proc/version|cut -d ' ' -f 1).ko\"", moduleDir.getAbsolutePath()));
-    }
-
-    public boolean moduleMightExist() {
-        return moduleDir.exists() && moduleDir.isDirectory();
-    }
-
-    @Nullable
-    private Map<String, Sha256Digest> verifySignedHashes(final String signifyDigest) {
-        final byte[] publicKeyBytes = Base64.decode(MODULE_PUBLIC_KEY_BASE64, Base64.DEFAULT);
-
-        if (publicKeyBytes == null || publicKeyBytes.length != 32 + 10 || publicKeyBytes[0] != 'E' || publicKeyBytes[1] != 'd')
-            return null;
-
-        final String[] lines = signifyDigest.split("\n", 3);
-        if (lines.length != 3)
-            return null;
-        if (!lines[0].startsWith("untrusted comment: "))
-            return null;
-
-        final byte[] signatureBytes = Base64.decode(lines[1], Base64.DEFAULT);
-        if (signatureBytes == null || signatureBytes.length != 64 + 10)
-            return null;
-        for (int i = 0; i < 10; ++i) {
-            if (signatureBytes[i] != publicKeyBytes[i])
-                return null;
-        }
-
-        try {
-            EdDSAParameterSpec parameterSpec = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.ED_25519);
-            Signature signature = new EdDSAEngine(MessageDigest.getInstance(parameterSpec.getHashAlgorithm()));
-            byte[] rawPublicKeyBytes = new byte[32];
-            System.arraycopy(publicKeyBytes, 10, rawPublicKeyBytes, 0, 32);
-            signature.initVerify(new EdDSAPublicKey(new EdDSAPublicKeySpec(rawPublicKeyBytes, parameterSpec)));
-            signature.update(lines[2].getBytes(StandardCharsets.UTF_8));
-            if (!signature.verify(signatureBytes, 10, 64))
-                return null;
-        } catch (final Exception ignored) {
-            return null;
-        }
-
-        Map<String, Sha256Digest> hashes = new HashMap<>();
-        for (final String line : lines[2].split("\n")) {
-            final String[] components = line.split("  ", 2);
-            if (components.length != 2)
-                return null;
-            try {
-                hashes.put(components[1], new Sha256Digest(components[0]));
-            } catch (final Exception ignored) {
-                return null;
-            }
-        }
-        return hashes;
-    }
-
-    private static final class Sha256Digest {
-        private byte[] bytes;
-
-        private Sha256Digest(final String hex) {
-            if (hex.length() != 64)
-                throw new InvalidParameterException("SHA256 hashes must be 32 bytes long");
-            bytes = new byte[32];
-            for (int i = 0; i < 32; ++i)
-                bytes[i] = (byte) Integer.parseInt(hex.substring(i * 2, i * 2 + 2), 16);
-        }
-    }
-}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -29,7 +29,7 @@ import androidx.annotation.Nullable;
@NonNullForAll
 public class RootShell {
    private static final String SU = "su";
-    private static final String TAG = "WireGuard/" + RootShell.class.getSimpleName();
+    private static final String TAG = "WireGuard/RootShell";

    private final File localBinaryDir;
    private final File localTemporaryDir;
@@ -43,8 +43,11 @@ public class RootShell {
    public RootShell(final Context context) {
        localBinaryDir = new File(context.getCodeCacheDir(), "bin");
        localTemporaryDir = new File(context.getCacheDir(), "tmp");
-        preamble = String.format("export CALLING_PACKAGE=%s PATH=\"%s:$PATH\" TMPDIR='%s'; id -u\n",
-                context.getPackageName(), localBinaryDir, localTemporaryDir);
+        final String packageName = context.getPackageName();
+        if (packageName.contains("'"))
+            throw new RuntimeException("Impossibly invalid package name contains a single quote");
+        preamble = String.format("export CALLING_PACKAGE=%s PATH=\"%s:$PATH\" TMPDIR='%s'; magisk --sqlite \"UPDATE policies SET notification=0, logging=0 WHERE package_name='%s'\" >/dev/null 2>&1; id -u\n",
+                packageName, localBinaryDir, localTemporaryDir, packageName);
    }

    private static boolean isExecutableInPath(final String name) {
@@ -189,6 +192,7 @@ public class RootShell {
    public static class RootShellException extends Exception {
        private final Object[] format;
        private final Reason reason;
+
        public RootShellException(final Reason reason, final Object... format) {
            this.reason = reason;
            this.format = format;
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -21,9 +21,13 @@ import java.util.HashSet;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;

+import androidx.annotation.RestrictTo;
+import androidx.annotation.RestrictTo.Scope;
+
@NonNullForAll
+@RestrictTo(Scope.LIBRARY_GROUP)
 public final class SharedLibraryLoader {
-    private static final String TAG = "WireGuard/" + SharedLibraryLoader.class.getSimpleName();
+    private static final String TAG = "WireGuard/SharedLibraryLoader";

    private SharedLibraryLoader() {
    }
@@ -37,29 +41,23 @@ public final class SharedLibraryLoader {

        for (final String abi : Build.SUPPORTED_ABIS) {
            for (final String apk : apks) {
-                final ZipFile zipFile;
-                try {
-                    zipFile = new ZipFile(new File(apk), ZipFile.OPEN_READ);
-                } catch (final IOException e) {
-                    throw new RuntimeException(e);
-                }
-
-                final String mappedLibName = System.mapLibraryName(libName);
-                final byte[] buffer = new byte[1024 * 32];
-                final String libZipPath = "lib" + File.separatorChar + abi + File.separatorChar + mappedLibName;
-                final ZipEntry zipEntry = zipFile.getEntry(libZipPath);
-                if (zipEntry == null)
-                    continue;
-                Log.d(TAG, "Extracting apk:/" + libZipPath + " to " + destination.getAbsolutePath());
-                try (final FileOutputStream out = new FileOutputStream(destination);
-                     final InputStream in = zipFile.getInputStream(zipEntry)) {
-                    int len;
-                    while ((len = in.read(buffer)) != -1) {
-                        out.write(buffer, 0, len);
+                try (final ZipFile zipFile = new ZipFile(new File(apk), ZipFile.OPEN_READ)) {
+                    final String mappedLibName = System.mapLibraryName(libName);
+                    final String libZipPath = "lib" + File.separatorChar + abi + File.separatorChar + mappedLibName;
+                    final ZipEntry zipEntry = zipFile.getEntry(libZipPath);
+                    if (zipEntry == null)
+                        continue;
+                    Log.d(TAG, "Extracting apk:/" + libZipPath + " to " + destination.getAbsolutePath());
+                    try (final FileOutputStream out = new FileOutputStream(destination);
+                         final InputStream in = zipFile.getInputStream(zipEntry)) {
+                        int len;
+                        final byte[] buffer = new byte[1024 * 32];
+                        while ((len = in.read(buffer)) != -1) {
+                            out.write(buffer, 0, len);
+                        }
+                        out.getFD().sync();
                    }
-                    out.getFD().sync();
                }
-                zipFile.close();
                return true;
            }
        }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -19,6 +19,8 @@ import java.util.Arrays;
 import java.util.List;

 import androidx.annotation.Nullable;
+import androidx.annotation.RestrictTo;
+import androidx.annotation.RestrictTo.Scope;

 /**
 * Helper to install WireGuard tools to the system partition.
@@ -37,7 +39,7 @@ public final class ToolsInstaller {
            new File("/system/bin"),
    };
    @Nullable private static final File INSTALL_DIR = getInstallDir();
-    private static final String TAG = "WireGuard/" + ToolsInstaller.class.getSimpleName();
+    private static final String TAG = "WireGuard/ToolsInstaller";

    private final Context context;
    private final File localBinaryDir;
@@ -109,8 +111,8 @@ public final class ToolsInstaller {

    public boolean extract() throws IOException {
        localBinaryDir.mkdirs();
-        final File files[] = new File[EXECUTABLES.length];
-        final File tempFiles[] = new File[EXECUTABLES.length];
+        final File[] files = new File[EXECUTABLES.length];
+        final File[] tempFiles = new File[EXECUTABLES.length];
        boolean allExist = true;
        for (int i = 0; i < files.length; ++i) {
            files[i] = new File(localBinaryDir, EXECUTABLES[i]);
@@ -130,6 +132,7 @@ public final class ToolsInstaller {
        return true;
    }

+    @RestrictTo(Scope.LIBRARY_GROUP)
    public int install() throws RootShellException, IOException {
        if (!context.getPackageName().startsWith("com.wireguard."))
            throw new SecurityException("The tools may only be installed system-wide from the main WireGuard app.");
@@ -140,12 +143,12 @@ public final class ToolsInstaller {
        extract();
        final StringBuilder script = new StringBuilder("set -ex; ");

-        script.append("trap 'rm -rf /sbin/.magisk/img/wireguard' INT TERM EXIT; ");
-        script.append(String.format("rm -rf /sbin/.magisk/img/wireguard/; mkdir -p /sbin/.magisk/img/wireguard%s; ", INSTALL_DIR));
-        script.append("printf 'name=WireGuard Command Line Tools\nversion=1.0\nversionCode=1\nauthor=zx2c4\ndescription=Command line tools for WireGuard\nminMagisk=1500\n' > /sbin/.magisk/img/wireguard/module.prop; ");
-        script.append("touch /sbin/.magisk/img/wireguard/auto_mount; ");
+        script.append("trap 'rm -rf /data/adb/modules/wireguard' INT TERM EXIT; ");
+        script.append(String.format("rm -rf /data/adb/modules/wireguard/; mkdir -p /data/adb/modules/wireguard%s; ", INSTALL_DIR));
+        script.append("printf 'id=wireguard\nname=WireGuard Command Line Tools\nversion=1.0\nversionCode=1\nauthor=zx2c4\ndescription=Command line tools for WireGuard\nminMagisk=1500\n' > /data/adb/modules/wireguard/module.prop; ");
+        script.append("touch /data/adb/modules/wireguard/auto_mount; ");
        for (final String name : EXECUTABLES) {
-            final File destination = new File("/sbin/.magisk/img/wireguard" + INSTALL_DIR, name);
+            final File destination = new File("/data/adb/modules/wireguard" + INSTALL_DIR, name);
            script.append(String.format("cp '%s' '%s'; chmod 755 '%s'; chcon 'u:object_r:system_file:s0' '%s' || true; ",
                    new File(localBinaryDir, name), destination, destination, destination));
        }
@@ -188,7 +191,7 @@ public final class ToolsInstaller {
        synchronized (lock) {
            if (installAsMagiskModule == null) {
                try {
-                    installAsMagiskModule = rootShell.run(null, "[ -d /sbin/.magisk/mirror -a -d /sbin/.magisk/img -a ! -f /cache/.disable_magisk ]") == OsConstants.EXIT_SUCCESS;
+                    installAsMagiskModule = rootShell.run(null, "[ -d /data/adb/modules -a ! -f /cache/.disable_magisk ]") == OsConstants.EXIT_SUCCESS;
                } catch (final Exception ignored) {
                    installAsMagiskModule = false;
                }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -8,11 +8,10 @@ package com.wireguard.config;
 import com.wireguard.util.NonNullForAll;

 import java.util.Iterator;
+import java.util.Optional;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;

-import java9.util.Optional;
-
@NonNullForAll
 public final class Attribute {
    private static final Pattern LINE_PATTERN = Pattern.compile("(\\w+)\\s*=\\s*([^\\s#][^#]*)");
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -72,6 +72,7 @@ public class BadConfigException extends Exception {
        DNS("DNS"),
        ENDPOINT("Endpoint"),
        EXCLUDED_APPLICATIONS("ExcludedApplications"),
+        INCLUDED_APPLICATIONS("IncludedApplications"),
        LISTEN_PORT("ListenPort"),
        MTU("MTU"),
        PERSISTENT_KEEPALIVE("PersistentKeepalive"),
@@ -96,7 +97,6 @@ public class BadConfigException extends Exception {
        INVALID_VALUE,
        MISSING_ATTRIBUTE,
        MISSING_SECTION,
-        MISSING_VALUE,
        SYNTAX_ERROR,
        UNKNOWN_ATTRIBUTE,
        UNKNOWN_SECTION
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -17,10 +17,8 @@ import java.io.InputStreamReader;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
-import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Objects;
-import java.util.Set;

 import androidx.annotation.Nullable;

@@ -69,6 +67,7 @@ public final class Config {
        final Collection<String> peerLines = new ArrayList<>();
        boolean inInterfaceSection = false;
        boolean inPeerSection = false;
+        boolean seenInterfaceSection = false;
        @Nullable String line;
        while ((line = reader.readLine()) != null) {
            final int commentIndex = line.indexOf('#');
@@ -86,6 +85,7 @@ public final class Config {
                if ("[Interface]".equalsIgnoreCase(line)) {
                    inInterfaceSection = true;
                    inPeerSection = false;
+                    seenInterfaceSection = true;
                } else if ("[Peer]".equalsIgnoreCase(line)) {
                    inInterfaceSection = false;
                    inPeerSection = true;
@@ -104,7 +104,7 @@ public final class Config {
        }
        if (inPeerSection)
            builder.parsePeer(peerLines);
-        else if (!inInterfaceSection)
+        if (!seenInterfaceSection)
            throw new BadConfigException(Section.CONFIG, Location.TOP_LEVEL,
                    Reason.MISSING_SECTION, null);
        // Combine all [Interface] sections in the file.
@@ -185,7 +185,7 @@ public final class Config {
    @SuppressWarnings("UnusedReturnValue")
    public static final class Builder {
        // Defaults to an empty set.
-        private final Set<Peer> peers = new LinkedHashSet<>();
+        private final ArrayList<Peer> peers = new ArrayList<>();
        // No default; must be provided before building.
        @Nullable private Interface interfaze;

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -23,6 +23,7 @@ import androidx.annotation.Nullable;
 public final class InetAddresses {
    @Nullable private static final Method PARSER_METHOD;
    private static final Pattern WONT_TOUCH_RESOLVER = Pattern.compile("^(((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:)))(%.+)?)|((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$");
+    private static final Pattern VALID_HOSTNAME = Pattern.compile("^(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\\.?$");

    static {
        Method m = null;
@@ -38,6 +39,16 @@ public final class InetAddresses {
    private InetAddresses() {
    }

+    /**
+     * Determines whether input is a valid DNS hostname.
+     *
+     * @param maybeHostname a string that is possibly a DNS hostname
+     * @return whether or not maybeHostname is a valid DNS hostname
+     */
+    public static boolean isHostname(final CharSequence maybeHostname) {
+        return VALID_HOSTNAME.matcher(maybeHostname).matches();
+    }
+
    /**
     * Parses a numeric IPv4 or IPv6 address without performing any DNS lookups.
     *
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -7,18 +7,17 @@ package com.wireguard.config;

 import com.wireguard.util.NonNullForAll;

-import org.threeten.bp.Duration;
-import org.threeten.bp.Instant;
-
 import java.net.Inet4Address;
 import java.net.InetAddress;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.UnknownHostException;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Optional;
 import java.util.regex.Pattern;

 import androidx.annotation.Nullable;
-import java9.util.Optional;


 /**
@@ -51,7 +50,7 @@ public final class InetEndpoint {
        try {
            uri = new URI("wg://" + endpoint);
        } catch (final URISyntaxException e) {
-            throw new IllegalArgumentException(e);
+            throw new ParseException(InetEndpoint.class, endpoint, e);
        }
        if (uri.getPort() < 0 || uri.getPort() > 65535)
            throw new ParseException(InetEndpoint.class, endpoint, "Missing/invalid port number");
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -47,7 +47,7 @@ public final class InetNetwork {
        final int maxMask = (address instanceof Inet4Address) ? 32 : 128;
        if (rawMask > maxMask)
            throw new ParseException(InetNetwork.class, maskString, "Invalid network mask");
-        final int mask = rawMask >= 0 && rawMask <= maxMask ? rawMask : maxMask;
+        final int mask = rawMask >= 0 ? rawMask : maxMask;
        return new InetNetwork(address, mask);
    }

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -20,13 +20,11 @@ import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Locale;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collectors;

 import androidx.annotation.Nullable;
-import java9.util.Lists;
-import java9.util.Optional;
-import java9.util.stream.Collectors;
-import java9.util.stream.StreamSupport;

 /**
 * Represents the configuration for a WireGuard interface (an [Interface] block). Interfaces must
@@ -42,7 +40,9 @@ public final class Interface {

    private final Set<InetNetwork> addresses;
    private final Set<InetAddress> dnsServers;
+    private final Set<String> dnsSearchDomains;
    private final Set<String> excludedApplications;
+    private final Set<String> includedApplications;
    private final KeyPair keyPair;
    private final Optional<Integer> listenPort;
    private final Optional<Integer> mtu;
@@ -51,7 +51,9 @@ public final class Interface {
        // Defensively copy to ensure immutability even if the Builder is reused.
        addresses = Collections.unmodifiableSet(new LinkedHashSet<>(builder.addresses));
        dnsServers = Collections.unmodifiableSet(new LinkedHashSet<>(builder.dnsServers));
+        dnsSearchDomains = Collections.unmodifiableSet(new LinkedHashSet<>(builder.dnsSearchDomains));
        excludedApplications = Collections.unmodifiableSet(new LinkedHashSet<>(builder.excludedApplications));
+        includedApplications = Collections.unmodifiableSet(new LinkedHashSet<>(builder.includedApplications));
        keyPair = Objects.requireNonNull(builder.keyPair, "Interfaces must have a private key");
        listenPort = builder.listenPort;
        mtu = builder.mtu;
@@ -81,6 +83,9 @@ public final class Interface {
                case "excludedapplications":
                    builder.parseExcludedApplications(attribute.getValue());
                    break;
+                case "includedapplications":
+                    builder.parseIncludedApplications(attribute.getValue());
+                    break;
                case "listenport":
                    builder.parseListenPort(attribute.getValue());
                    break;
@@ -105,7 +110,9 @@ public final class Interface {
        final Interface other = (Interface) obj;
        return addresses.equals(other.addresses)
                && dnsServers.equals(other.dnsServers)
+                && dnsSearchDomains.equals(other.dnsSearchDomains)
                && excludedApplications.equals(other.excludedApplications)
+                && includedApplications.equals(other.includedApplications)
                && keyPair.equals(other.keyPair)
                && listenPort.equals(other.listenPort)
                && mtu.equals(other.mtu);
@@ -131,6 +138,16 @@ public final class Interface {
        return dnsServers;
    }

+    /**
+     * Returns the set of DNS search domains associated with the interface.
+     *
+     * @return a set of strings
+     */
+    public Set<String> getDnsSearchDomains() {
+        // The collection is already immutable.
+        return dnsSearchDomains;
+    }
+
    /**
     * Returns the set of applications excluded from using the interface.
     *
@@ -141,6 +158,16 @@ public final class Interface {
        return excludedApplications;
    }

+    /**
+     * Returns the set of applications included exclusively for using the interface.
+     *
+     * @return a set of package names
+     */
+    public Set<String> getIncludedApplications() {
+        // The collection is already immutable.
+        return includedApplications;
+    }
+
    /**
     * Returns the public/private key pair used by the interface.
     *
@@ -174,6 +201,7 @@ public final class Interface {
        hash = 31 * hash + addresses.hashCode();
        hash = 31 * hash + dnsServers.hashCode();
        hash = 31 * hash + excludedApplications.hashCode();
+        hash = 31 * hash + includedApplications.hashCode();
        hash = 31 * hash + keyPair.hashCode();
        hash = 31 * hash + listenPort.hashCode();
        hash = 31 * hash + mtu.hashCode();
@@ -206,13 +234,14 @@ public final class Interface {
        if (!addresses.isEmpty())
            sb.append("Address = ").append(Attribute.join(addresses)).append('\n');
        if (!dnsServers.isEmpty()) {
-            final List<String> dnsServerStrings = StreamSupport.stream(dnsServers)
-                    .map(InetAddress::getHostAddress)
-                    .collect(Collectors.toUnmodifiableList());
+            final List<String> dnsServerStrings = dnsServers.stream().map(InetAddress::getHostAddress).collect(Collectors.toList());
+            dnsServerStrings.addAll(dnsSearchDomains);
            sb.append("DNS = ").append(Attribute.join(dnsServerStrings)).append('\n');
        }
        if (!excludedApplications.isEmpty())
            sb.append("ExcludedApplications = ").append(Attribute.join(excludedApplications)).append('\n');
+        if (!includedApplications.isEmpty())
+            sb.append("IncludedApplications = ").append(Attribute.join(includedApplications)).append('\n');
        listenPort.ifPresent(lp -> sb.append("ListenPort = ").append(lp).append('\n'));
        mtu.ifPresent(m -> sb.append("MTU = ").append(m).append('\n'));
        sb.append("PrivateKey = ").append(keyPair.getPrivateKey().toBase64()).append('\n');
@@ -239,7 +268,11 @@ public final class Interface {
        // Defaults to an empty set.
        private final Set<InetAddress> dnsServers = new LinkedHashSet<>();
        // Defaults to an empty set.
+        private final Set<String> dnsSearchDomains = new LinkedHashSet<>();
+        // Defaults to an empty set.
        private final Set<String> excludedApplications = new LinkedHashSet<>();
+        // Defaults to an empty set.
+        private final Set<String> includedApplications = new LinkedHashSet<>();
        // No default; must be provided before building.
        @Nullable private KeyPair keyPair;
        // Defaults to not present.
@@ -267,10 +300,23 @@ public final class Interface {
            return this;
        }

+        public Builder addDnsSearchDomain(final String dnsSearchDomain) {
+            dnsSearchDomains.add(dnsSearchDomain);
+            return this;
+        }
+
+        public Builder addDnsSearchDomains(final Collection<String> dnsSearchDomains) {
+            this.dnsSearchDomains.addAll(dnsSearchDomains);
+            return this;
+        }
+
        public Interface build() throws BadConfigException {
            if (keyPair == null)
                throw new BadConfigException(Section.INTERFACE, Location.PRIVATE_KEY,
                        Reason.MISSING_ATTRIBUTE, null);
+            if (!includedApplications.isEmpty() && !excludedApplications.isEmpty())
+                throw new BadConfigException(Section.INTERFACE, Location.INCLUDED_APPLICATIONS,
+                        Reason.INVALID_KEY, null);
            return new Interface(this);
        }

@@ -284,6 +330,16 @@ public final class Interface {
            return this;
        }

+        public Builder includeApplication(final String application) {
+            includedApplications.add(application);
+            return this;
+        }
+
+        public Builder includeApplications(final Collection<String> applications) {
+            includedApplications.addAll(applications);
+            return this;
+        }
+
        public Builder parseAddresses(final CharSequence addresses) throws BadConfigException {
            try {
                for (final String address : Attribute.split(addresses))
@@ -296,8 +352,15 @@ public final class Interface {

        public Builder parseDnsServers(final CharSequence dnsServers) throws BadConfigException {
            try {
-                for (final String dnsServer : Attribute.split(dnsServers))
-                    addDnsServer(InetAddresses.parse(dnsServer));
+                for (final String dnsServer : Attribute.split(dnsServers)) {
+                    try {
+                        addDnsServer(InetAddresses.parse(dnsServer));
+                    } catch (final ParseException e) {
+                        if (e.getParsingClass() != InetAddress.class || !InetAddresses.isHostname(dnsServer))
+                            throw e;
+                        addDnsSearchDomain(dnsServer);
+                    }
+                }
                return this;
            } catch (final ParseException e) {
                throw new BadConfigException(Section.INTERFACE, Location.DNS, e);
@@ -305,7 +368,11 @@ public final class Interface {
        }

        public Builder parseExcludedApplications(final CharSequence apps) {
-            return excludeApplications(Lists.of(Attribute.split(apps)));
+            return excludeApplications(List.of(Attribute.split(apps)));
+        }
+
+        public Builder parseIncludedApplications(final CharSequence apps) {
+            return includeApplications(List.of(Attribute.split(apps)));
        }

        public Builder parseListenPort(final String listenPort) throws BadConfigException {
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -17,10 +17,10 @@ import java.util.Collections;
 import java.util.LinkedHashSet;
 import java.util.Locale;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;

 import androidx.annotation.Nullable;
-import java9.util.Optional;

 /**
 * Represents the configuration for a WireGuard peer (a [Peer] block). Peers must have a public key,
@@ -1,6 +1,6 @@
 /*
 * Copyright © 2016 Southern Storm Software, Pty Ltd.
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -13,7 +13,7 @@ import java.util.Arrays;
 import androidx.annotation.Nullable;

 /**
- * Implementation of the Curve25519 elliptic curve algorithm.
+ * Implementation of Curve25519 ECDH.
 * <p>
 * This implementation was imported to WireGuard from noise-java:
 * https://github.com/rweather/noise-java
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,11 +1,10 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.util;

-import java.lang.annotation.Documented;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
@@ -13,12 +12,15 @@ import java.lang.annotation.RetentionPolicy;
 import javax.annotation.Nonnull;
 import javax.annotation.meta.TypeQualifierDefault;

+import androidx.annotation.RestrictTo;
+import androidx.annotation.RestrictTo.Scope;
+
 /**
 * This annotation can be applied to a package, class or method to indicate that all
 * class fields and method parameters and return values in that element are nonnull
 * by default unless overridden.
 */
-@Documented
+@RestrictTo(Scope.LIBRARY_GROUP)
@Nonnull
@TypeQualifierDefault({ElementType.FIELD, ElementType.METHOD, ElementType.PARAMETER})
@Retention(RetentionPolicy.RUNTIME)
@@ -0,0 +1,173 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import com.wireguard.config.BadConfigException.Location;
+import com.wireguard.config.BadConfigException.Reason;
+import com.wireguard.config.BadConfigException.Section;
+
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+public class BadConfigExceptionTest {
+    private static final Map<String, InputStream> CONFIG_MAP = new HashMap<>();
+    private static final String[] CONFIG_NAMES = {
+            "invalid-key",
+            "invalid-number",
+            "invalid-value",
+            "missing-attribute",
+            "missing-section",
+            "syntax-error",
+            "unknown-attribute",
+            "unknown-section"
+    };
+
+    @AfterClass
+    public static void closeStreams() {
+        for (final InputStream inputStream : CONFIG_MAP.values()) {
+            try {
+                inputStream.close();
+            } catch (final IOException ignored) {
+            }
+        }
+    }
+
+    @BeforeClass
+    public static void readConfigs() {
+        for (final String config : CONFIG_NAMES) {
+            CONFIG_MAP.put(config, BadConfigExceptionTest.class.getClassLoader().getResourceAsStream(config + ".conf"));
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_INVALID_KEY_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("invalid-key"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.INVALID_KEY);
+            assertEquals(e.getLocation(), Location.PUBLIC_KEY);
+            assertEquals(e.getSection(), Section.PEER);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException thrown during test");
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_INVALID_NUMBER_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("invalid-number"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.INVALID_NUMBER);
+            assertEquals(e.getLocation(), Location.PERSISTENT_KEEPALIVE);
+            assertEquals(e.getSection(), Section.PEER);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException thrown during test");
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_INVALID_VALUE_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("invalid-value"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.INVALID_VALUE);
+            assertEquals(e.getLocation(), Location.DNS);
+            assertEquals(e.getSection(), Section.INTERFACE);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException throwing during test");
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_MISSING_ATTRIBUTE_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("missing-attribute"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.MISSING_ATTRIBUTE);
+            assertEquals(e.getLocation(), Location.PUBLIC_KEY);
+            assertEquals(e.getSection(), Section.PEER);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException throwing during test");
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_MISSING_SECTION_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("missing-section"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.MISSING_SECTION);
+            assertEquals(e.getLocation(), Location.TOP_LEVEL);
+            assertEquals(e.getSection(), Section.CONFIG);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException throwing during test");
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_SYNTAX_ERROR_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("syntax-error"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.SYNTAX_ERROR);
+            assertEquals(e.getLocation(), Location.TOP_LEVEL);
+            assertEquals(e.getSection(), Section.PEER);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException throwing during test");
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_UNKNOWN_ATTRIBUTE_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("unknown-attribute"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.UNKNOWN_ATTRIBUTE);
+            assertEquals(e.getLocation(), Location.TOP_LEVEL);
+            assertEquals(e.getSection(), Section.PEER);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException throwing during test");
+        }
+    }
+
+    @Test
+    public void throws_correctly_with_UNKNOWN_SECTION_reason() {
+        try {
+            Config.parse(CONFIG_MAP.get("unknown-section"));
+            fail("Config parsing must fail in this test");
+        } catch (final BadConfigException e) {
+            assertEquals(e.getReason(), Reason.UNKNOWN_SECTION);
+            assertEquals(e.getLocation(), Location.TOP_LEVEL);
+            assertEquals(e.getSection(), Section.CONFIG);
+        } catch (final IOException e) {
+            e.printStackTrace();
+            fail("IOException throwing during test");
+        }
+    }
+}
@@ -0,0 +1,49 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import org.junit.Test;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Objects;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+public class ConfigTest {
+
+    @Test(expected = BadConfigException.class)
+    public void invalid_config_throws() throws IOException, BadConfigException {
+        try (final InputStream is = Objects.requireNonNull(getClass().getClassLoader()).getResourceAsStream("broken.conf")) {
+            Config.parse(is);
+        }
+    }
+
+    @Test
+    public void valid_config_parses_correctly() throws IOException, ParseException {
+        Config config = null;
+        final Collection<InetNetwork> expectedAllowedIps = new HashSet<>(Arrays.asList(InetNetwork.parse("0.0.0.0/0"), InetNetwork.parse("::0/0")));
+        try (final InputStream is = Objects.requireNonNull(getClass().getClassLoader()).getResourceAsStream("working.conf")) {
+            config = Config.parse(is);
+        } catch (final BadConfigException e) {
+            fail("'working.conf' should never fail to parse");
+        }
+        assertNotNull("config cannot be null after parsing", config);
+        assertTrue(
+                "No applications should be excluded by default",
+                config.getInterface().getExcludedApplications().isEmpty()
+        );
+        assertEquals("Test config has exactly one peer", 1, config.getPeers().size());
+        assertEquals("Test config's allowed IPs are 0.0.0.0/0 and ::0/0", config.getPeers().get(0).getAllowedIps(), expectedAllowedIps);
+        assertEquals("Test config has one DNS server", 1, config.getInterface().getDnsServers().size());
+    }
+}
@@ -0,0 +1,9 @@
+[Interface]
+PrivateKey = l0lth1s1sd3f1n1t3lybr0k3n=
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+
+[Peer]
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
+AllowedIPs = 0.0.0.0/0,::0/0
+Endpoint = 192.0.2.1:51820
@@ -0,0 +1,9 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+PersistentKeepalive = 0
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6Og=
@@ -0,0 +1,9 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+PersistentKeepalive = 0L
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
@@ -0,0 +1,9 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0,invalid_value
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+PersistentKeepalive = 0
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
@@ -0,0 +1,8 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+PersistentKeepalive = 0
@@ -0,0 +1,5 @@
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+PersistentKeepalive = 0
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
@@ -0,0 +1,9 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 
+PersistentKeepalive = 0
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
@@ -0,0 +1,9 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+DontLetTheFeelingFade = 1
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
@@ -0,0 +1,9 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peers]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+PersistentKeepalive = 0
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
@@ -0,0 +1,9 @@
+[Interface]
+Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
+DNS = 192.0.2.0
+PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::0/0
+Endpoint = 192.0.2.1:51820
+PersistentKeepalive = 0
+PublicKey = vBN7qyUTb5lJtWYJ8LhbPio1Z4RcyBPGnqFBGn6O6Qg=
@@ -1,33 +1,44 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+# Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.

 cmake_minimum_required(VERSION 3.4.1)
+project("WireGuard")
 set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
-
-# Work around https://github.com/android-ndk/ndk/issues/602
-set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=gold")
+add_link_options(LINKER:--build-id=none)
+add_compile_options(-Wall -Werror)

 add_executable(libwg-quick.so wireguard-tools/src/wg-quick/android.c ndk-compat/compat.c)
-target_compile_options(libwg-quick.so PUBLIC -O3 -std=gnu11 -Wall -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DWG_PACKAGE_NAME=\"${ANDROID_PACKAGE_NAME}\")
+target_compile_options(libwg-quick.so PUBLIC -std=gnu11 -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DWG_PACKAGE_NAME=\"${ANDROID_PACKAGE_NAME}\")
 target_link_libraries(libwg-quick.so -ldl)

 file(GLOB WG_SOURCES wireguard-tools/src/*.c ndk-compat/compat.c)
 add_executable(libwg.so ${WG_SOURCES})
-target_include_directories(libwg.so PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/uapi/" "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/")
-target_compile_options(libwg.so PUBLIC -O3 -std=gnu11 -D_GNU_SOURCE -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DHAVE_VISIBILITY_HIDDEN -DRUNSTATEDIR=\"/data/data/${ANDROID_PACKAGE_NAME}/cache\")
+target_include_directories(libwg.so PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/uapi/linux/" "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/")
+target_compile_options(libwg.so PUBLIC -std=gnu11 -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DRUNSTATEDIR=\"/data/data/${ANDROID_PACKAGE_NAME}/cache\")

-add_custom_target(libwg-go.so WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/libwg-go" COMMENT "Building wireguard-go" VERBATIM COMMAND make
+add_custom_target(libwg-go.so WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/libwg-go" COMMENT "Building wireguard-go" VERBATIM COMMAND "${ANDROID_HOST_PREBUILTS}/bin/make"
    ANDROID_ARCH_NAME=${ANDROID_ARCH_NAME}
-    ANDROID_C_COMPILER=${ANDROID_C_COMPILER}
-    ANDROID_TOOLCHAIN_ROOT=${ANDROID_TOOLCHAIN_ROOT}
-    ANDROID_LLVM_TRIPLE=${ANDROID_LLVM_TRIPLE}
-    ANDROID_SYSROOT=${ANDROID_SYSROOT}
    ANDROID_PACKAGE_NAME=${ANDROID_PACKAGE_NAME}
-    CFLAGS=${CMAKE_C_FLAGS}\ -Wno-unused-command-line-argument
-    LDFLAGS=${CMAKE_SHARED_LINKER_FLAGS}\ -fuse-ld=gold
+    GRADLE_USER_HOME=${GRADLE_USER_HOME}
+    CC=${CMAKE_C_COMPILER}
+    CFLAGS=${CMAKE_C_FLAGS}
+    LDFLAGS=${CMAKE_SHARED_LINKER_FLAGS}
+    SYSROOT=${CMAKE_SYSROOT}
+    TARGET=${CMAKE_C_COMPILER_TARGET}
    DESTDIR=${CMAKE_LIBRARY_OUTPUT_DIRECTORY}
    BUILDDIR=${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/../generated-src
 )
-# Hack to make it actually build as part of the default target
-add_dependencies(libwg.so libwg-go.so)
+
+# Strip unwanted ELF sections to prevent DT_FLAGS_1 warnings on old Android versions
+file(GLOB ELF_CLEANER_SOURCES elf-cleaner/*.c elf-cleaner/*.cpp)
+add_custom_target(elf-cleaner COMMENT "Building elf-cleaner" VERBATIM COMMAND cc
+        -O2 -DPACKAGE_NAME="elf-cleaner" -DPACKAGE_VERSION="" -DCOPYRIGHT=""
+        -o "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner" ${ELF_CLEANER_SOURCES}
+)
+add_custom_command(TARGET libwg.so POST_BUILD VERBATIM COMMAND "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner"
+        --api-level "${ANDROID_NATIVE_API_LEVEL}" "$<TARGET_FILE:libwg.so>")
+add_dependencies(libwg.so elf-cleaner)
+add_custom_command(TARGET libwg-quick.so POST_BUILD VERBATIM COMMAND "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner"
+        --api-level "${ANDROID_NATIVE_API_LEVEL}" "$<TARGET_FILE:libwg-quick.so>")
+add_dependencies(libwg-quick.so elf-cleaner)
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+# Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.

 BUILDDIR ?= $(CURDIR)/build
 DESTDIR ?= $(CURDIR)/out
@@ -12,24 +12,41 @@ NDK_GO_ARCH_MAP_arm64 := arm64
 NDK_GO_ARCH_MAP_mips := mipsx
 NDK_GO_ARCH_MAP_mips64 := mips64x

-CLANG_FLAGS := --target=$(ANDROID_LLVM_TRIPLE) --gcc-toolchain=$(ANDROID_TOOLCHAIN_ROOT) --sysroot=$(ANDROID_SYSROOT)
-export CGO_CFLAGS := $(CLANG_FLAGS) $(CFLAGS)
-export CGO_LDFLAGS := $(CLANG_FLAGS) $(LDFLAGS)
-export CC := $(ANDROID_C_COMPILER)
+comma := ,
+CLANG_FLAGS := --target=$(TARGET) --sysroot=$(SYSROOT)
+export CGO_CFLAGS := $(CLANG_FLAGS) $(subst -mthumb,-marm,$(CFLAGS))
+export CGO_LDFLAGS := $(CLANG_FLAGS) $(patsubst -Wl$(comma)--build-id=%,-Wl$(comma)--build-id=none,$(LDFLAGS)) -Wl,-soname=libwg-go.so
 export GOARCH := $(NDK_GO_ARCH_MAP_$(ANDROID_ARCH_NAME))
 export GOOS := android
 export CGO_ENABLED := 1

-DESIRED_GO_VERSION := 1.13.7
+GO_VERSION := 1.20.3
+GO_PLATFORM := $(shell uname -s | tr '[:upper:]' '[:lower:]')-$(NDK_GO_ARCH_MAP_$(shell uname -m))
+GO_TARBALL := go$(GO_VERSION).$(GO_PLATFORM).tar.gz
+GO_HASH_darwin-amd64 := c1e1161d6d859deb576e6cfabeb40e3d042ceb1c6f444f617c3c9d76269c3565
+GO_HASH_darwin-arm64 := 86b0ed0f2b2df50fa8036eea875d1cf2d76cefdacf247c44639a1464b7e36b95
+GO_HASH_linux-amd64 := 979694c2c25c735755bf26f4f45e19e64e4811d661dd07b8c010f7a8e18adfca

 default: $(DESTDIR)/libwg-go.so

-$(BUILDDIR)/go-$(DESIRED_GO_VERSION)/.prepared:
+$(GRADLE_USER_HOME)/caches/golang/$(GO_TARBALL):
 	mkdir -p "$(dir $@)"
-	curl "https://dl.google.com/go/go$(DESIRED_GO_VERSION).$(shell uname -s | tr '[:upper:]' '[:lower:]')-$(NDK_GO_ARCH_MAP_$(shell uname -m)).tar.gz" | tar -C "$(dir $@)" --strip-components=1 -xzf -
-	patch -p1 -f -N -r- -d "$(dir $@)" < goruntime-boottime-over-monotonic.diff
-	touch "$@"
+	flock "$@.lock" -c ' \
+	[ -f "$@" ] && exit 0; \
+	curl -o "$@.tmp" "https://dl.google.com/go/$(GO_TARBALL)" && \
+	echo "$(GO_HASH_$(GO_PLATFORM))  $@.tmp" | sha256sum -c && \
+	mv "$@.tmp" "$@"'

-$(DESTDIR)/libwg-go.so: export PATH := $(BUILDDIR)/go-$(DESIRED_GO_VERSION)/bin/:$(PATH)
-$(DESTDIR)/libwg-go.so: $(BUILDDIR)/go-$(DESIRED_GO_VERSION)/.prepared go.mod
-	go build -tags linux -ldflags="-X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard" -v -trimpath -o "$@" -buildmode c-shared
+$(BUILDDIR)/go-$(GO_VERSION)/.prepared: $(GRADLE_USER_HOME)/caches/golang/$(GO_TARBALL)
+	mkdir -p "$(dir $@)"
+	flock "$@.lock" -c ' \
+	[ -f "$@" ] && exit 0; \
+	tar -C "$(dir $@)" --strip-components=1 -xzf "$^" && \
+	patch -p1 -f -N -r- -d "$(dir $@)" < goruntime-boottime-over-monotonic.diff && \
+	touch "$@"'
+
+$(DESTDIR)/libwg-go.so: export PATH := $(BUILDDIR)/go-$(GO_VERSION)/bin/:$(PATH)
+$(DESTDIR)/libwg-go.so: $(BUILDDIR)/go-$(GO_VERSION)/.prepared go.mod
+	go build -tags linux -ldflags="-X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard -buildid=" -v -trimpath -buildvcs=false -o "$@" -buildmode c-shared
+
+.DELETE_ON_ERROR:
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: Apache-2.0
 *
- * Copyright (C) 2017-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ * Copyright © 2017-2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 */

 package main
@@ -10,30 +10,39 @@ package main
 import "C"

 import (
-	"bufio"
-	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/ipc"
-	"golang.zx2c4.com/wireguard/tun"
-	"bytes"
-	"log"
+	"fmt"
 	"math"
 	"net"
 	"os"
 	"os/signal"
 	"runtime"
+	"runtime/debug"
 	"strings"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
+	"golang.zx2c4.com/wireguard/conn"
+	"golang.zx2c4.com/wireguard/device"
+	"golang.zx2c4.com/wireguard/ipc"
+	"golang.zx2c4.com/wireguard/tun"
 )

 type AndroidLogger struct {
-	level         C.int
-	interfaceName string
+	level C.int
+	tag   *C.char
 }

-func (l AndroidLogger) Write(p []byte) (int, error) {
-	C.__android_log_write(l.level, C.CString("WireGuard/GoBackend/"+l.interfaceName), C.CString(string(p)))
-	return len(p), nil
+func cstring(s string) *C.char {
+	b, err := unix.BytePtrFromString(s)
+	if err != nil {
+		b := [1]C.char{}
+		return &b[0]
+	}
+	return (*C.char)(unsafe.Pointer(b))
+}
+
+func (l AndroidLogger) Printf(format string, args ...interface{}) {
+	C.__android_log_write(l.level, l.tag, cstring(fmt.Sprintf(format, args...)))
 }

 type TunnelHandle struct {
@@ -44,7 +53,6 @@ type TunnelHandle struct {
 var tunnelHandles map[int32]TunnelHandle

 func init() {
-	device.RoamingDisabled = true
 	tunnelHandles = make(map[int32]TunnelHandle)
 	signals := make(chan os.Signal)
 	signal.Notify(signals, unix.SIGUSR2)
@@ -54,52 +62,52 @@ func init() {
 			select {
 			case <-signals:
 				n := runtime.Stack(buf, true)
+				if n == len(buf) {
+					n--
+				}
 				buf[n] = 0
-				C.__android_log_write(C.ANDROID_LOG_ERROR, C.CString("WireGuard/GoBackend/Stacktrace"), (*C.char)(unsafe.Pointer(&buf[0])))
+				C.__android_log_write(C.ANDROID_LOG_ERROR, cstring("WireGuard/GoBackend/Stacktrace"), (*C.char)(unsafe.Pointer(&buf[0])))
 			}
 		}
 	}()
 }

 //export wgTurnOn
-func wgTurnOn(ifnameRef string, tunFd int32, settings string) int32 {
-	interfaceName := string([]byte(ifnameRef))
-
+func wgTurnOn(interfaceName string, tunFd int32, settings string) int32 {
+	tag := cstring("WireGuard/GoBackend/" + interfaceName)
 	logger := &device.Logger{
-		Debug: log.New(&AndroidLogger{level: C.ANDROID_LOG_DEBUG, interfaceName: interfaceName}, "", 0),
-		Info:  log.New(&AndroidLogger{level: C.ANDROID_LOG_INFO, interfaceName: interfaceName}, "", 0),
-		Error: log.New(&AndroidLogger{level: C.ANDROID_LOG_ERROR, interfaceName: interfaceName}, "", 0),
+		Verbosef: AndroidLogger{level: C.ANDROID_LOG_DEBUG, tag: tag}.Printf,
+		Errorf:   AndroidLogger{level: C.ANDROID_LOG_ERROR, tag: tag}.Printf,
 	}

-	logger.Debug.Println("Debug log enabled")
-
 	tun, name, err := tun.CreateUnmonitoredTUNFromFD(int(tunFd))
 	if err != nil {
 		unix.Close(int(tunFd))
-		logger.Error.Println(err)
+		logger.Errorf("CreateUnmonitoredTUNFromFD: %v", err)
 		return -1
 	}

-	logger.Info.Println("Attaching to interface", name)
-	device := device.NewDevice(tun, logger)
+	logger.Verbosef("Attaching to interface %v", name)
+	device := device.NewDevice(tun, conn.NewStdNetBind(), logger)

-	setError := device.IpcSetOperation(bufio.NewReader(strings.NewReader(settings)))
-	if setError != nil {
+	err = device.IpcSet(settings)
+	if err != nil {
 		unix.Close(int(tunFd))
-		logger.Error.Println(setError)
+		logger.Errorf("IpcSet: %v", err)
 		return -1
 	}
+	device.DisableSomeRoamingForBrokenMobileSemantics()

 	var uapi net.Listener

 	uapiFile, err := ipc.UAPIOpen(name)
 	if err != nil {
-		logger.Error.Println(err)
+		logger.Errorf("UAPIOpen: %v", err)
 	} else {
 		uapi, err = ipc.UAPIListen(name, uapiFile)
 		if err != nil {
 			uapiFile.Close()
-			logger.Error.Println(err)
+			logger.Errorf("UAPIListen: %v", err)
 		} else {
 			go func() {
 				for {
@@ -113,8 +121,14 @@ func wgTurnOn(ifnameRef string, tunFd int32, settings string) int32 {
 		}
 	}

-	device.Up()
-	logger.Info.Println("Device started")
+	err = device.Up()
+	if err != nil {
+		logger.Errorf("Unable to bring up device: %v", err)
+		uapiFile.Close()
+		device.Close()
+		return -1
+	}
+	logger.Verbosef("Device started")

 	var i int32
 	for i = 0; i < math.MaxInt32; i++ {
@@ -123,7 +137,9 @@ func wgTurnOn(ifnameRef string, tunFd int32, settings string) int32 {
 		}
 	}
 	if i == math.MaxInt32 {
-		unix.Close(int(tunFd))
+		logger.Errorf("Unable to find empty handle")
+		uapiFile.Close()
+		device.Close()
 		return -1
 	}
 	tunnelHandles[i] = TunnelHandle{device: device, uapi: uapi}
@@ -149,7 +165,11 @@ func wgGetSocketV4(tunnelHandle int32) int32 {
 	if !ok {
 		return -1
 	}
-	fd, err := handle.device.PeekLookAtSocketFd4()
+	bind, _ := handle.device.Bind().(conn.PeekLookAtSocketFd)
+	if bind == nil {
+		return -1
+	}
+	fd, err := bind.PeekLookAtSocketFd4()
 	if err != nil {
 		return -1
 	}
@@ -162,7 +182,11 @@ func wgGetSocketV6(tunnelHandle int32) int32 {
 	if !ok {
 		return -1
 	}
-	fd, err := handle.device.PeekLookAtSocketFd6()
+	bind, _ := handle.device.Bind().(conn.PeekLookAtSocketFd)
+	if bind == nil {
+		return -1
+	}
+	fd, err := bind.PeekLookAtSocketFd6()
 	if err != nil {
 		return -1
 	}
@@ -175,19 +199,29 @@ func wgGetConfig(tunnelHandle int32) *C.char {
 	if !ok {
 		return nil
 	}
-	settings := new(bytes.Buffer)
-	writer := bufio.NewWriter(settings)
-	err := handle.device.IpcGetOperation(writer)
+	settings, err := handle.device.IpcGet()
 	if err != nil {
 		return nil
 	}
-	writer.Flush()
-	return C.CString(settings.String())
+	return C.CString(settings)
 }

 //export wgVersion
 func wgVersion() *C.char {
-	return C.CString(device.WireGuardGoVersion)
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return C.CString("unknown")
+	}
+	for _, dep := range info.Deps {
+		if dep.Path == "golang.zx2c4.com/wireguard" {
+			parts := strings.Split(dep.Version, "-")
+			if len(parts) == 3 && len(parts[2]) == 12 {
+				return C.CString(parts[2][:7])
+			}
+			return C.CString(dep.Version)
+		}
+	}
+	return C.CString("unknown")
 }

 func main() {}
@@ -1,10 +1,14 @@
 module golang.zx2c4.com/wireguard/android

-go 1.13
+go 1.20

 require (
-	golang.org/x/crypto v0.0.0-20200117160349-530e935923ad // indirect
-	golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa // indirect
-	golang.org/x/sys v0.0.0-20200122134326-e047566fdf82
-	golang.zx2c4.com/wireguard v0.0.20200121
+	golang.org/x/sys v0.6.0
+	golang.zx2c4.com/wireguard v0.0.0-20230223181233-21636207a675
+)
+
+require (
+	golang.org/x/crypto v0.7.0 // indirect
+	golang.org/x/net v0.8.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 )
@@ -1,19 +1,10 @@
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200117160349-530e935923ad h1:Jh8cai0fqIK+f6nG0UgPW5wFk8wmiMhM3AyciDBdtQg=
-golang.org/x/crypto v0.0.0-20200117160349-530e935923ad/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20191003171128-d98b1b443823/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa h1:F+8P+gmewFQYRk6JoLQLwjBCTu3mcIURZfNkVweuRKA=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191003212358-c178f38b412c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82 h1:ywK/j/KkyTHcdyYSZNXGjMwgmDSfjglYZ3vStQ/gSCU=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.zx2c4.com/wireguard v0.0.20200121 h1:vcswa5Q6f+sylDfjqyrVNNrjsFUUbPsgAQTBCAg/Qf8=
-golang.zx2c4.com/wireguard v0.0.20200121/go.mod h1:P2HsVp8SKwZEufsnezXZA4GRX/T49/HlU7DGuelXsU4=
+golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20230223181233-21636207a675 h1:/J/RVnr7ng4fWPRH3xa4WtBJ1Jp+Auu4YNLmGiPv5QU=
+golang.zx2c4.com/wireguard v0.0.0-20230223181233-21636207a675/go.mod h1:whfbyDBt09xhCYQWtO2+3UVjlaq6/9hDZrjg2ZE6SyA=
@@ -1,7 +1,8 @@
-From b19623e7673a4d6743745382d5d38751b64e011d Mon Sep 17 00:00:00 2001
+From 61f3ae8298d1c503cbc31539e0f3a73446c7db9d Mon Sep 17 00:00:00 2001
 From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-Date: Wed, 27 Feb 2019 05:05:44 +0100
-Subject: [PATCH] runtime: use CLOCK_BOOTTIME in nanotime on Linux
+Date: Tue, 21 Mar 2023 15:33:56 +0100
+Subject: [PATCH] [release-branch.go1.20] runtime: use CLOCK_BOOTTIME in
+ nanotime on Linux

 This makes timers account for having expired while a computer was
 asleep, which is quite common on mobile devices. Note that BOOTTIME is
@@ -21,17 +22,17 @@ Change-Id: I7b2a6ca0c5bc5fce57ec0eeafe7b68270b429321
 src/runtime/sys_linux_amd64.s   | 2 +-
 src/runtime/sys_linux_arm.s     | 4 ++--
 src/runtime/sys_linux_arm64.s   | 4 ++--
- src/runtime/sys_linux_mips64x.s | 2 +-
+ src/runtime/sys_linux_mips64x.s | 4 ++--
 src/runtime/sys_linux_mipsx.s   | 2 +-
 src/runtime/sys_linux_ppc64x.s  | 2 +-
 src/runtime/sys_linux_s390x.s   | 2 +-
- 8 files changed, 11 insertions(+), 11 deletions(-)
+ 8 files changed, 12 insertions(+), 12 deletions(-)

 diff --git a/src/runtime/sys_linux_386.s b/src/runtime/sys_linux_386.s
-index 72c43bd9da..daadfe32a9 100644
+index 12a294153d..17e3524b40 100644
 --- a/src/runtime/sys_linux_386.s
 +++ b/src/runtime/sys_linux_386.s
-@@ -288,13 +288,13 @@ noswitch:
+@@ -352,13 +352,13 @@ noswitch:
 
 	LEAL	8(SP), BX	// &ts (struct timespec)
 	MOVL	BX, 4(SP)
@@ -48,20 +49,20 @@ index 72c43bd9da..daadfe32a9 100644
 	INVOKE_SYSCALL
 
 diff --git a/src/runtime/sys_linux_amd64.s b/src/runtime/sys_linux_amd64.s
-index 5c300f553d..e4a6f12ec6 100644
+index c7a89ba536..01f0a6a26e 100644
 --- a/src/runtime/sys_linux_amd64.s
 +++ b/src/runtime/sys_linux_amd64.s
-@@ -261,7 +261,7 @@ noswitch:
- 	MOVQ	runtime·vdsoClockgettimeSym(SB), AX
- 	CMPQ	AX, $0
- 	JEQ	fallback
+@@ -255,7 +255,7 @@ noswitch:
+ 	SUBQ	$16, SP		// Space for results
+ 	ANDQ	$~15, SP	// Align for C code
+ 
 -	MOVL	$1, DI // CLOCK_MONOTONIC
 +	MOVL	$7, DI // CLOCK_BOOTTIME
 	LEAQ	0(SP), SI
- 	CALL	AX
- 	MOVQ	0(SP), AX	// sec
+ 	MOVQ	runtime·vdsoClockgettimeSym(SB), AX
+ 	CMPQ	AX, $0
 diff --git a/src/runtime/sys_linux_arm.s b/src/runtime/sys_linux_arm.s
-index 9c7398451c..61b6cd91f6 100644
+index 7b8c4f0e04..9798a1334e 100644
 --- a/src/runtime/sys_linux_arm.s
 +++ b/src/runtime/sys_linux_arm.s
@@ -11,7 +11,7 @@
@@ -73,20 +74,20 @@ index 9c7398451c..61b6cd91f6 100644
 
 // for EABI, as we don't support OABI
 #define SYS_BASE 0x0
-@@ -291,7 +291,7 @@ noswitch:
- 	SUB	$24, R13	// Space for results
- 	BIC	$0x7, R13	// Align for C code
+@@ -374,7 +374,7 @@ finish:
 
+ // func nanotime1() int64
+ TEXT runtime·nanotime1(SB),NOSPLIT,$12-8
 -	MOVW	$CLOCK_MONOTONIC, R0
 +	MOVW	$CLOCK_BOOTTIME, R0
- 	MOVW	$8(R13), R1	// timespec
- 	MOVW	runtime·vdsoClockgettimeSym(SB), R11
- 	CMP	$0, R11
+ 	MOVW	$spec-12(SP), R1	// timespec
+ 
+ 	MOVW	runtime·vdsoClockgettimeSym(SB), R4
 diff --git a/src/runtime/sys_linux_arm64.s b/src/runtime/sys_linux_arm64.s
-index 2835b6ca1c..346ca9cfce 100644
+index 38ff6ac330..6b819c5441 100644
 --- a/src/runtime/sys_linux_arm64.s
 +++ b/src/runtime/sys_linux_arm64.s
-@@ -13,7 +13,7 @@
+@@ -14,7 +14,7 @@
 #define AT_FDCWD -100
 
 #define CLOCK_REALTIME 0
@@ -95,7 +96,7 @@ index 2835b6ca1c..346ca9cfce 100644
 
 #define SYS_exit		93
 #define SYS_read		63
-@@ -247,7 +247,7 @@ noswitch:
+@@ -338,7 +338,7 @@ noswitch:
 	BIC	$15, R1
 	MOVD	R1, RSP
 
@@ -103,59 +104,68 @@ index 2835b6ca1c..346ca9cfce 100644
 +	MOVW	$CLOCK_BOOTTIME, R0
 	MOVD	runtime·vdsoClockgettimeSym(SB), R2
 	CBZ	R2, fallback
- 	BL	(R2)
+ 
 diff --git a/src/runtime/sys_linux_mips64x.s b/src/runtime/sys_linux_mips64x.s
-index 33ed1050c2..59a5be179c 100644
+index 47f2da524d..a8b387f193 100644
 --- a/src/runtime/sys_linux_mips64x.s
 +++ b/src/runtime/sys_linux_mips64x.s
-@@ -189,7 +189,7 @@ TEXT runtime·walltime(SB),NOSPLIT,$16
- 	RET
+@@ -326,7 +326,7 @@ noswitch:
+ 	AND	$~15, R1	// Align for C code
+ 	MOVV	R1, R29
 
- TEXT runtime·nanotime(SB),NOSPLIT,$16
 -	MOVW	$1, R4 // CLOCK_MONOTONIC
 +	MOVW	$7, R4 // CLOCK_BOOTTIME
 	MOVV	$0(R29), R5
- 	MOVV	$SYS_clock_gettime, R2
- 	SYSCALL
+ 
+ 	MOVV	runtime·vdsoClockgettimeSym(SB), R25
+@@ -336,7 +336,7 @@ noswitch:
+ 	// see walltime for detail
+ 	BEQ	R2, R0, finish
+ 	MOVV	R0, runtime·vdsoClockgettimeSym(SB)
+-	MOVW	$1, R4 // CLOCK_MONOTONIC
+	MOVW	$7, R4 // CLOCK_BOOTTIME
+ 	MOVV	$0(R29), R5
+ 	JMP	fallback
+ 
 diff --git a/src/runtime/sys_linux_mipsx.s b/src/runtime/sys_linux_mipsx.s
-index 6e539fbc6f..55b2bf7156 100644
+index 5e6b6c1504..7f5fd2a80e 100644
 --- a/src/runtime/sys_linux_mipsx.s
 +++ b/src/runtime/sys_linux_mipsx.s
-@@ -194,7 +194,7 @@ TEXT runtime·walltime(SB),NOSPLIT,$8-12
+@@ -243,7 +243,7 @@ TEXT runtime·walltime(SB),NOSPLIT,$8-12
 	RET
 
- TEXT runtime·nanotime(SB),NOSPLIT,$8-8
+ TEXT runtime·nanotime1(SB),NOSPLIT,$8-8
 -	MOVW	$1, R4	// CLOCK_MONOTONIC
 +	MOVW	$7, R4	// CLOCK_BOOTTIME
 	MOVW	$4(R29), R5
 	MOVW	$SYS_clock_gettime, R2
 	SYSCALL
 diff --git a/src/runtime/sys_linux_ppc64x.s b/src/runtime/sys_linux_ppc64x.s
-index 13d23156bd..f67e5062aa 100644
+index d0427a4807..05ee9fede9 100644
 --- a/src/runtime/sys_linux_ppc64x.s
 +++ b/src/runtime/sys_linux_ppc64x.s
-@@ -204,7 +204,7 @@ fallback:
- 	JMP	finish
+@@ -298,7 +298,7 @@ fallback:
+ 	JMP	return
 
- TEXT runtime·nanotime(SB),NOSPLIT,$16
+ TEXT runtime·nanotime1(SB),NOSPLIT,$16-8
 -	MOVD	$1, R3		// CLOCK_MONOTONIC
 +	MOVD	$7, R3		// CLOCK_BOOTTIME
 
 	MOVD	R1, R15		// R15 is unchanged by C code
 	MOVD	g_m(g), R21	// R21 = m
 diff --git a/src/runtime/sys_linux_s390x.s b/src/runtime/sys_linux_s390x.s
-index 58b36dff0a..cb92e9a402 100644
+index 1448670b91..7d2ee3231c 100644
 --- a/src/runtime/sys_linux_s390x.s
 +++ b/src/runtime/sys_linux_s390x.s
-@@ -180,7 +180,7 @@ TEXT runtime·walltime(SB),NOSPLIT,$16
+@@ -296,7 +296,7 @@ fallback:
 	RET
 
- TEXT runtime·nanotime(SB),NOSPLIT,$16
-	MOVW	$1, R2 // CLOCK_MONOTONIC
-+	MOVW	$7, R2 // CLOCK_BOOTTIME
- 	MOVD	$tp-16(SP), R3
- 	MOVW	$SYS_clock_gettime, R1
- 	SYSCALL
+ TEXT runtime·nanotime1(SB),NOSPLIT,$32-8
+-	MOVW	$1, R2			// CLOCK_MONOTONIC
+	MOVW	$7, R2			// CLOCK_BOOTTIME
+ 
+ 	MOVD	R15, R7			// Backup stack pointer
+ 
 -- 
-2.23.0
+2.17.1

@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: Apache-2.0
 *
- * Copyright © 2017-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ * Copyright © 2017-2021 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 */

 #include <jni.h>
@@ -1,64 +1,12 @@
 /* SPDX-License-Identifier: BSD
 *
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 *
 */

 #define FILE_IS_EMPTY

-#if defined(__ANDROID_API__) && __ANDROID_API__ < 18
-#undef FILE_IS_EMPTY
-#include <stdio.h>
-#include <stdlib.h>
-
-ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
-{
-	char *ptr, *eptr;
-
-	if (*buf == NULL || *bufsiz == 0) {
-		*bufsiz = BUFSIZ;
-		if ((*buf = malloc(*bufsiz)) == NULL)
-			return -1;
-	}
-
-	for (ptr = *buf, eptr = *buf + *bufsiz;;) {
-		int c = fgetc(fp);
-		if (c == -1) {
-			if (feof(fp)) {
-				ssize_t diff = (ssize_t)(ptr - *buf);
-				if (diff != 0) {
-					*ptr = '\0';
-					return diff;
-				}
-			}
-			return -1;
-		}
-		*ptr++ = c;
-		if (c == delimiter) {
-			*ptr = '\0';
-			return ptr - *buf;
-		}
-		if (ptr + 2 >= eptr) {
-			char *nbuf;
-			size_t nbufsiz = *bufsiz * 2;
-			ssize_t d = ptr - *buf;
-			if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
-				return -1;
-			*buf = nbuf;
-			*bufsiz = nbufsiz;
-			eptr = nbuf + nbufsiz;
-			ptr = nbuf + d;
-		}
-	}
-}
-
-ssize_t getline(char **buf, size_t *bufsiz, FILE *fp)
-{
-	return getdelim(buf, bufsiz, '\n', fp);
-}
-#endif
-
-#if defined(__ANDROID_API__) && __ANDROID_API__ < 24
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 24
 #undef FILE_IS_EMPTY
 #include <string.h>

@@ -1,16 +1,10 @@
 /* SPDX-License-Identifier: BSD
 *
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 *
 */

-#if defined(__ANDROID_API__) && __ANDROID_API__ < 18
-#include <stdio.h>
-ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp);
-ssize_t getline(char **buf, size_t *bufsiz, FILE *fp);
-#endif
-
-#if defined(__ANDROID_API__) && __ANDROID_API__ < 24
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 24
 char *strchrnul(const char *s, int c);
 #endif

@@ -1,88 +0,0 @@
-apply plugin: 'com.android.application'
-apply plugin: 'kotlin-android'
-
-// Create a variable called keystorePropertiesFile, and initialize it to your
-// keystore.properties file, in the rootProject folder.
-final def keystorePropertiesFile = rootProject.file("keystore.properties")
-
-android {
-    buildToolsVersion '29.0.3'
-    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_1_8
-        targetCompatibility JavaVersion.VERSION_1_8
-    }
-    tasks.withType(org.jetbrains.kotlin.gradle.tasks.KotlinCompile).all {
-        kotlinOptions {
-            jvmTarget = '1.8'
-        }
-    }
-    compileSdkVersion 29
-    dataBinding.enabled true
-    defaultConfig {
-        applicationId 'com.wireguard.android'
-        minSdkVersion 21
-        targetSdkVersion 29
-        versionCode wireguardVersionCode
-        versionName wireguardVersionName
-        buildConfigField 'int', 'MIN_SDK_VERSION', "$minSdkVersion.apiLevel"
-    }
-    // If the keystore file exists
-    if (keystorePropertiesFile.exists()) {
-        // Initialize a new Properties() object called keystoreProperties.
-        final def keystoreProperties = new Properties()
-
-        // Load your keystore.properties file into the keystoreProperties object.
-        keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
-
-        signingConfigs {
-            release {
-                keyAlias keystoreProperties['keyAlias']
-                keyPassword keystoreProperties['keyPassword']
-                storeFile file(keystoreProperties['storeFile'])
-                storePassword keystoreProperties['storePassword']
-            }
-        }
-    }
-    buildTypes {
-        release {
-            if (keystorePropertiesFile.exists()) signingConfig signingConfigs.release
-            externalNativeBuild {
-                cmake {
-                    arguments "-DANDROID_PACKAGE_NAME=${android.defaultConfig.applicationId}"
-                }
-            }
-            minifyEnabled true
-            proguardFiles getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro"
-        }
-        debug {
-            applicationIdSuffix ".debug"
-            versionNameSuffix "-debug"
-            externalNativeBuild {
-                cmake {
-                    arguments "-DANDROID_PACKAGE_NAME=${android.defaultConfig.applicationId}${applicationIdSuffix}"
-                }
-            }
-        }
-    }
-}
-
-dependencies {
-    implementation project(":tunnel")
-    implementation "androidx.annotation:annotation:$annotationsVersion"
-    implementation "androidx.appcompat:appcompat:$appcompatVersion"
-    implementation "androidx.cardview:cardview:$cardviewVersion"
-    implementation "androidx.constraintlayout:constraintlayout:$constraintLayoutVersion"
-    implementation "androidx.coordinatorlayout:coordinatorlayout:$coordinatorLayoutVersion"
-    implementation "androidx.core:core-ktx:$coreKtxVersion"
-    implementation "androidx.databinding:databinding-runtime:$agpVersion"
-    implementation "androidx.fragment:fragment:$fragmentVersion"
-    implementation "androidx.preference:preference:$preferenceVersion"
-    implementation "com.google.android.material:material:$materialComponentsVersion"
-    implementation "com.journeyapps:zxing-android-embedded:$zxingEmbeddedVersion"
-    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk8:$kotlinVersion"
-}
-
-tasks.withType(JavaCompile) {
-    options.compilerArgs << '-Xlint:unchecked'
-    options.deprecation = true
-}
@@ -0,0 +1,94 @@
+@file:Suppress("UnstableApiUsage")
+
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+import com.android.build.gradle.tasks.ExtractSupportedLocalesTask
+
+val pkg: String = providers.gradleProperty("wireguardPackageName").get()
+
+plugins {
+    alias(libs.plugins.android.application)
+    alias(libs.plugins.kotlin.android)
+    alias(libs.plugins.kotlin.kapt)
+}
+
+android {
+    compileSdk = 33
+    buildFeatures {
+        buildConfig = true
+        dataBinding = true
+        viewBinding = true
+    }
+    namespace = pkg
+    defaultConfig {
+        applicationId = pkg
+        minSdk = 21
+        targetSdk = 33
+        versionCode = providers.gradleProperty("wireguardVersionCode").get().toInt()
+        versionName = providers.gradleProperty("wireguardVersionName").get()
+        buildConfigField("int", "MIN_SDK_VERSION", minSdk.toString())
+    }
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+        isCoreLibraryDesugaringEnabled = true
+    }
+    buildTypes {
+        release {
+            isMinifyEnabled = true
+            isShrinkResources = true
+            proguardFiles("proguard-android-optimize.txt")
+            packaging {
+                resources {
+                    excludes += "DebugProbesKt.bin"
+                    excludes += "kotlin-tooling-metadata.json"
+                    excludes += "META-INF/*.version"
+                }
+            }
+        }
+        debug {
+            applicationIdSuffix = ".debug"
+            versionNameSuffix = "-debug"
+        }
+        create("googleplay") {
+            initWith(getByName("release"))
+            matchingFallbacks += "release"
+        }
+    }
+    androidResources {
+        generateLocaleConfig = true
+    }
+    lint {
+        disable += "LongLogTag"
+        warning += "MissingTranslation"
+        warning += "ImpliedQuantity"
+    }
+}
+
+dependencies {
+    implementation(project(":tunnel"))
+    implementation(libs.androidx.activity.ktx)
+    implementation(libs.androidx.annotation)
+    implementation(libs.androidx.appcompat)
+    implementation(libs.androidx.constraintlayout)
+    implementation(libs.androidx.coordinatorlayout)
+    implementation(libs.androidx.biometric)
+    implementation(libs.androidx.core.ktx)
+    implementation(libs.androidx.fragment.ktx)
+    implementation(libs.androidx.preference.ktx)
+    implementation(libs.androidx.lifecycle.runtime.ktx)
+    implementation(libs.androidx.datastore.preferences)
+    implementation(libs.google.material)
+    implementation(libs.zxing.android.embedded)
+    implementation(libs.kotlinx.coroutines.android)
+    coreLibraryDesugaring(libs.desugarJdkLibs)
+}
+
+tasks.withType<JavaCompile>().configureEach {
+    options.compilerArgs.add("-Xlint:unchecked")
+    options.isDeprecation = true
+}
+
+tasks.withType<KotlinCompile>().configureEach {
+    compilerOptions.jvmTarget.set(JvmTarget.JVM_17)
+}
@@ -0,0 +1,35 @@
+-allowaccessmodification
+-dontusemixedcaseclassnames
+-dontobfuscate
+-verbose
+
+-keepattributes *Annotation*
+
+-keepclasseswithmembernames class * {
+    native <methods>;
+}
+
+-keepclassmembers enum * {
+    public static **[] values();
+    public static ** valueOf(java.lang.String);
+}
+
+-keepclassmembers class * implements android.os.Parcelable {
+  public static final ** CREATOR;
+}
+
+-keep class androidx.annotation.Keep
+
+-keep @androidx.annotation.Keep class * {*;}
+
+-keepclasseswithmembers class * {
+    @androidx.annotation.Keep <methods>;
+}
+
+-keepclasseswithmembers class * {
+    @androidx.annotation.Keep <fields>;
+}
+
+-keepclasseswithmembers class * {
+    @androidx.annotation.Keep <init>(...);
+}
@@ -1,3 +0,0 @@
-# Squelch all warnings, they're harmless but ProGuard
-# escalates them as errors.
-dontwarn sun.misc.Unsafe
@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">WireGuard β</string>
+    <string name="app_name" translatable="false">WireGuard β</string>
 </resources>
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <uses-permission
+        android:name="android.permission.REQUEST_INSTALL_PACKAGES"
+        tools:node="remove" />
+</manifest>
@@ -1,15 +1,29 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
-    package="com.wireguard.android"
    android:installLocation="internalOnly">

    <uses-permission android:name="android.permission.CAMERA" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+    <uses-permission
+        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
+        android:maxSdkVersion="28"
+        tools:ignore="ScopedStorage" />

-    <uses-feature android:name="android.hardware.touchscreen" android:required="false"/>
+    <uses-feature
+        android:name="android.hardware.touchscreen"
+        android:required="false" />
+    <uses-feature
+        android:name="android.software.leanback"
+        android:required="false" />
+    <uses-feature
+        android:name="android.hardware.camera.any"
+        android:required="false" />
+    <uses-feature
+        android:name="android.hardware.camera"
+        android:required="false" />

    <permission
        android:name="${applicationId}.permission.CONTROL_TUNNELS"
@@ -21,19 +35,26 @@
    <application
        android:name=".Application"
        android:allowBackup="false"
+        android:banner="@mipmap/banner"
+        android:enableOnBackInvokedCallback="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
-        android:theme="@style/AppTheme"
-        tools:ignore="UnusedAttribute">
+        android:theme="@style/AppTheme">

-        <activity android:name=".activity.TunnelToggleActivity" android:theme="@style/NoBackgroundTheme"/>
-        <activity android:name=".activity.MainActivity">
+        <activity
+            android:name=".activity.TunnelToggleActivity"
+            android:excludeFromRecents="true"
+            android:theme="@style/NoBackgroundTheme" />
+
+        <activity
+            android:name=".activity.MainActivity"
+            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
+
                <category android:name="android.intent.category.LAUNCHER" />
-                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
            </intent-filter>

            <intent-filter>
@@ -41,6 +62,16 @@
            </intent-filter>
        </activity>

+        <activity
+            android:name=".activity.TvMainActivity"
+            android:exported="true"
+            android:theme="@style/TvTheme">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
+            </intent-filter>
+        </activity>
+
        <activity
            android:name=".activity.SettingsActivity"
            android:label="@string/settings"
@@ -56,15 +87,41 @@
            android:screenOrientation="fullSensor"
            tools:replace="screenOrientation" />

-        <receiver android:name=".BootShutdownReceiver">
+        <activity
+            android:name=".activity.LogViewerActivity"
+            android:exported="false"
+            android:label="@string/log_viewer_title">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+            </intent-filter>
+        </activity>
+
+        <provider
+            android:name=".activity.LogViewerActivity$ExportedLogContentProvider"
+            android:authorities="${applicationId}.exported-log"
+            android:exported="false"
+            android:grantUriPermissions="true" />
+
+        <receiver
+            android:name=".BootShutdownReceiver"
+            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
            </intent-filter>
        </receiver>

+        <receiver
+            android:name=".updater.Updater$AppUpdatedReceiver"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
+            </intent-filter>
+        </receiver>
+
        <receiver
            android:name=".model.TunnelManager$IntentReceiver"
+            android:exported="true"
            android:permission="${applicationId}.permission.CONTROL_TUNNELS">
            <intent-filter>
                <action android:name="com.wireguard.android.action.REFRESH_TUNNEL_STATES" />
@@ -75,6 +132,7 @@

        <service
            android:name=".QuickTileService"
+            android:exported="true"
            android:icon="@drawable/ic_tile"
            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE">

@@ -85,6 +143,21 @@
            <meta-data
                android:name="android.service.quicksettings.ACTIVE_TILE"
                android:value="false" />
+
+            <meta-data
+                android:name="android.service.quicksettings.TOGGLEABLE_TILE"
+                android:value="true" />
        </service>
+
+        <meta-data
+            android:name="android.content.APP_RESTRICTIONS"
+            android:resource="@xml/app_restrictions" />
    </application>
+
+    <queries>
+        <intent>
+            <action android:name="android.intent.action.MAIN" />
+            <category android:name="android.intent.category.LAUNCHER" />
+        </intent>
+    </queries>
 </manifest>
@@ -1,180 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android;
-
-import android.content.Context;
-import android.content.Intent;
-import android.content.SharedPreferences;
-import android.os.AsyncTask;
-import android.os.Build;
-import android.os.Handler;
-import android.os.Looper;
-import android.os.StrictMode;
-import android.util.Log;
-
-import com.wireguard.android.backend.Backend;
-import com.wireguard.android.backend.GoBackend;
-import com.wireguard.android.backend.WgQuickBackend;
-import com.wireguard.android.configStore.FileConfigStore;
-import com.wireguard.android.model.TunnelManager;
-import com.wireguard.android.util.AsyncWorker;
-import com.wireguard.android.util.ExceptionLoggers;
-import com.wireguard.android.util.ModuleLoader;
-import com.wireguard.android.util.RootShell;
-import com.wireguard.android.util.ToolsInstaller;
-import com.wireguard.util.NonNullForAll;
-
-import java.lang.ref.WeakReference;
-import java.util.Locale;
-
-import androidx.annotation.Nullable;
-import androidx.appcompat.app.AppCompatDelegate;
-import androidx.preference.PreferenceManager;
-import java9.util.concurrent.CompletableFuture;
-
-@NonNullForAll
-public class Application extends android.app.Application implements SharedPreferences.OnSharedPreferenceChangeListener {
-    public static final String USER_AGENT = String.format(Locale.ENGLISH, "WireGuard/%s (Android %d; %s; %s; %s %s; %s)", BuildConfig.VERSION_NAME, Build.VERSION.SDK_INT, Build.SUPPORTED_ABIS.length > 0 ? Build.SUPPORTED_ABIS[0] : "unknown ABI", Build.BOARD, Build.MANUFACTURER, Build.MODEL, Build.FINGERPRINT);
-    private static final String TAG = "WireGuard/" + Application.class.getSimpleName();
-    @SuppressWarnings("NullableProblems") private static WeakReference<Application> weakSelf;
-    private final CompletableFuture<Backend> futureBackend = new CompletableFuture<>();
-    @SuppressWarnings("NullableProblems") private AsyncWorker asyncWorker;
-    @Nullable private Backend backend;
-    @SuppressWarnings("NullableProblems") private ModuleLoader moduleLoader;
-    @SuppressWarnings("NullableProblems") private RootShell rootShell;
-    @SuppressWarnings("NullableProblems") private SharedPreferences sharedPreferences;
-    @SuppressWarnings("NullableProblems") private ToolsInstaller toolsInstaller;
-    @SuppressWarnings("NullableProblems") private TunnelManager tunnelManager;
-
-    public Application() {
-        weakSelf = new WeakReference<>(this);
-    }
-
-    public static Application get() {
-        return weakSelf.get();
-    }
-
-    public static AsyncWorker getAsyncWorker() {
-        return get().asyncWorker;
-    }
-
-    public static Backend getBackend() {
-        final Application app = get();
-        synchronized (app.futureBackend) {
-            if (app.backend == null) {
-                Backend backend = null;
-                boolean didStartRootShell = false;
-                if (!ModuleLoader.isModuleLoaded() && app.moduleLoader.moduleMightExist()) {
-                    try {
-                        app.rootShell.start();
-                        didStartRootShell = true;
-                        app.moduleLoader.loadModule();
-                    } catch (final Exception ignored) {
-                    }
-                }
-                if (!app.sharedPreferences.getBoolean("disable_kernel_module", false) && ModuleLoader.isModuleLoaded()) {
-                    try {
-                        if (!didStartRootShell)
-                            app.rootShell.start();
-                        WgQuickBackend wgQuickBackend = new WgQuickBackend(app.getApplicationContext(), app.rootShell, app.toolsInstaller);
-                        wgQuickBackend.setMultipleTunnels(app.sharedPreferences.getBoolean("multiple_tunnels", false));
-                        backend = wgQuickBackend;
-                    } catch (final Exception ignored) {
-                    }
-                }
-                if (backend == null) {
-                    backend = new GoBackend(app.getApplicationContext());
-                    GoBackend.setAlwaysOnCallback(() -> {
-                        get().tunnelManager.restoreState(true).whenComplete(ExceptionLoggers.D);
-                    });
-                }
-                app.backend = backend;
-            }
-            return app.backend;
-        }
-    }
-
-    public static CompletableFuture<Backend> getBackendAsync() {
-        return get().futureBackend;
-    }
-
-    public static ModuleLoader getModuleLoader() {
-        return get().moduleLoader;
-    }
-
-    public static RootShell getRootShell() {
-        return get().rootShell;
-    }
-
-    public static SharedPreferences getSharedPreferences() {
-        return get().sharedPreferences;
-    }
-
-    public static ToolsInstaller getToolsInstaller() {
-        return get().toolsInstaller;
-    }
-
-    public static TunnelManager getTunnelManager() {
-        return get().tunnelManager;
-    }
-
-    @Override
-    protected void attachBaseContext(final Context context) {
-        super.attachBaseContext(context);
-
-        if (BuildConfig.MIN_SDK_VERSION > Build.VERSION.SDK_INT) {
-            final Intent intent = new Intent(Intent.ACTION_MAIN);
-            intent.addCategory(Intent.CATEGORY_HOME);
-            intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
-            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-            startActivity(intent);
-            System.exit(0);
-        }
-
-        if (BuildConfig.DEBUG) {
-            StrictMode.setVmPolicy(new StrictMode.VmPolicy.Builder().detectAll().penaltyLog().build());
-        }
-    }
-
-    @Override
-    public void onCreate() {
-        Log.i(TAG, USER_AGENT);
-        super.onCreate();
-
-        asyncWorker = new AsyncWorker(AsyncTask.SERIAL_EXECUTOR, new Handler(Looper.getMainLooper()));
-        rootShell = new RootShell(getApplicationContext());
-        toolsInstaller = new ToolsInstaller(getApplicationContext(), rootShell);
-        moduleLoader = new ModuleLoader(getApplicationContext(), rootShell, USER_AGENT);
-
-        sharedPreferences = PreferenceManager.getDefaultSharedPreferences(getApplicationContext());
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
-            AppCompatDelegate.setDefaultNightMode(
-                    sharedPreferences.getBoolean("dark_theme", false) ?
-                            AppCompatDelegate.MODE_NIGHT_YES : AppCompatDelegate.MODE_NIGHT_NO);
-        } else {
-            AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM);
-        }
-
-        tunnelManager = new TunnelManager(new FileConfigStore(getApplicationContext()));
-        tunnelManager.onCreate();
-
-        asyncWorker.supplyAsync(Application::getBackend).thenAccept(futureBackend::complete);
-
-        sharedPreferences.registerOnSharedPreferenceChangeListener(this);
-    }
-
-    @Override
-    public void onSharedPreferenceChanged(final SharedPreferences sharedPreferences, final String key) {
-        if ("multiple_tunnels".equals(key) && backend != null && backend instanceof WgQuickBackend)
-            ((WgQuickBackend) backend).setMultipleTunnels(sharedPreferences.getBoolean(key, false));
-    }
-
-    @Override
-    public void onTerminate() {
-        sharedPreferences.unregisterOnSharedPreferenceChangeListener(this);
-        super.onTerminate();
-    }
-}
@@ -0,0 +1,157 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android
+
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import android.os.StrictMode
+import android.os.StrictMode.ThreadPolicy
+import android.os.StrictMode.VmPolicy
+import android.util.Log
+import androidx.appcompat.app.AppCompatDelegate
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.PreferenceDataStoreFactory
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.preferencesDataStoreFile
+import com.google.android.material.color.DynamicColors
+import com.wireguard.android.backend.Backend
+import com.wireguard.android.backend.GoBackend
+import com.wireguard.android.backend.WgQuickBackend
+import com.wireguard.android.configStore.FileConfigStore
+import com.wireguard.android.model.TunnelManager
+import com.wireguard.android.updater.Updater
+import com.wireguard.android.util.RootShell
+import com.wireguard.android.util.ToolsInstaller
+import com.wireguard.android.util.UserKnobs
+import com.wireguard.android.util.applicationScope
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.launchIn
+import kotlinx.coroutines.flow.onEach
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+import java.lang.ref.WeakReference
+import java.util.Locale
+
+class Application : android.app.Application() {
+    private val futureBackend = CompletableDeferred<Backend>()
+    private val coroutineScope = CoroutineScope(Job() + Dispatchers.Main.immediate)
+    private var backend: Backend? = null
+    private lateinit var rootShell: RootShell
+    private lateinit var preferencesDataStore: DataStore<Preferences>
+    private lateinit var toolsInstaller: ToolsInstaller
+    private lateinit var tunnelManager: TunnelManager
+
+    override fun attachBaseContext(context: Context) {
+        super.attachBaseContext(context)
+        if (BuildConfig.MIN_SDK_VERSION > Build.VERSION.SDK_INT) {
+            val intent = Intent(Intent.ACTION_MAIN)
+            intent.addCategory(Intent.CATEGORY_HOME)
+            intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK)
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            startActivity(intent)
+            System.exit(0)
+        }
+    }
+
+    private suspend fun determineBackend(): Backend {
+        var backend: Backend? = null
+        if (UserKnobs.enableKernelModule.first() && WgQuickBackend.hasKernelSupport()) {
+            try {
+                rootShell.start()
+                val wgQuickBackend = WgQuickBackend(applicationContext, rootShell, toolsInstaller)
+                wgQuickBackend.setMultipleTunnels(UserKnobs.multipleTunnels.first())
+                backend = wgQuickBackend
+                UserKnobs.multipleTunnels.onEach {
+                    wgQuickBackend.setMultipleTunnels(it)
+                }.launchIn(coroutineScope)
+            } catch (ignored: Exception) {
+            }
+        }
+        if (backend == null) {
+            backend = GoBackend(applicationContext)
+            GoBackend.setAlwaysOnCallback { get().applicationScope.launch { get().tunnelManager.restoreState(true) } }
+        }
+        return backend
+    }
+
+    override fun onCreate() {
+        Log.i(TAG, USER_AGENT)
+        super.onCreate()
+        DynamicColors.applyToActivitiesIfAvailable(this)
+        rootShell = RootShell(applicationContext)
+        toolsInstaller = ToolsInstaller(applicationContext, rootShell)
+        preferencesDataStore = PreferenceDataStoreFactory.create { applicationContext.preferencesDataStoreFile("settings") }
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+            runBlocking {
+                AppCompatDelegate.setDefaultNightMode(if (UserKnobs.darkTheme.first()) AppCompatDelegate.MODE_NIGHT_YES else AppCompatDelegate.MODE_NIGHT_NO)
+            }
+            UserKnobs.darkTheme.onEach {
+                val newMode = if (it) {
+                    AppCompatDelegate.MODE_NIGHT_YES
+                } else {
+                    AppCompatDelegate.MODE_NIGHT_NO
+                }
+                if (AppCompatDelegate.getDefaultNightMode() != newMode) {
+                    AppCompatDelegate.setDefaultNightMode(newMode)
+                }
+            }.launchIn(coroutineScope)
+        } else {
+            AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM)
+        }
+        tunnelManager = TunnelManager(FileConfigStore(applicationContext))
+        tunnelManager.onCreate()
+        coroutineScope.launch(Dispatchers.IO) {
+            try {
+                backend = determineBackend()
+                futureBackend.complete(backend!!)
+            } catch (e: Throwable) {
+                Log.e(TAG, Log.getStackTraceString(e))
+            }
+        }
+        Updater.monitorForUpdates()
+
+        if (BuildConfig.DEBUG) {
+            StrictMode.setVmPolicy(VmPolicy.Builder().detectAll().penaltyLog().build())
+            StrictMode.setThreadPolicy(ThreadPolicy.Builder().detectAll().penaltyLog().build())
+        }
+    }
+
+    override fun onTerminate() {
+        coroutineScope.cancel()
+        super.onTerminate()
+    }
+
+    companion object {
+        val USER_AGENT = String.format(Locale.ENGLISH, "WireGuard/%s (Android %d; %s; %s; %s %s; %s)", BuildConfig.VERSION_NAME, Build.VERSION.SDK_INT, if (Build.SUPPORTED_ABIS.isNotEmpty()) Build.SUPPORTED_ABIS[0] else "unknown ABI", Build.BOARD, Build.MANUFACTURER, Build.MODEL, Build.FINGERPRINT)
+        private const val TAG = "WireGuard/Application"
+        private lateinit var weakSelf: WeakReference<Application>
+
+        fun get(): Application {
+            return weakSelf.get()!!
+        }
+
+        suspend fun getBackend() = get().futureBackend.await()
+
+        fun getRootShell() = get().rootShell
+
+        fun getPreferencesDataStore() = get().preferencesDataStore
+
+        fun getToolsInstaller() = get().toolsInstaller
+
+        fun getTunnelManager() = get().tunnelManager
+
+        fun getCoroutineScope() = get().coroutineScope
+    }
+
+    init {
+        weakSelf = WeakReference(this)
+    }
+}
@@ -1,40 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android;
-
-import android.content.BroadcastReceiver;
-import android.content.Context;
-import android.content.Intent;
-import android.util.Log;
-
-import com.wireguard.android.backend.WgQuickBackend;
-import com.wireguard.android.model.TunnelManager;
-import com.wireguard.android.util.ExceptionLoggers;
-import com.wireguard.util.NonNullForAll;
-
-@NonNullForAll
-public class BootShutdownReceiver extends BroadcastReceiver {
-    private static final String TAG = "WireGuard/" + BootShutdownReceiver.class.getSimpleName();
-
-    @Override
-    public void onReceive(final Context context, final Intent intent) {
-        Application.getBackendAsync().thenAccept(backend -> {
-            if (!(backend instanceof WgQuickBackend))
-                return;
-            final String action = intent.getAction();
-            if (action == null)
-                return;
-            final TunnelManager tunnelManager = Application.getTunnelManager();
-            if (Intent.ACTION_BOOT_COMPLETED.equals(action)) {
-                Log.i(TAG, "Broadcast receiver restoring state (boot)");
-                tunnelManager.restoreState(false).whenComplete(ExceptionLoggers.D);
-            } else if (Intent.ACTION_SHUTDOWN.equals(action)) {
-                Log.i(TAG, "Broadcast receiver saving state (shutdown)");
-                tunnelManager.saveState();
-            }
-        });
-    }
-}
@@ -0,0 +1,34 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.util.Log
+import com.wireguard.android.backend.WgQuickBackend
+import com.wireguard.android.util.applicationScope
+import kotlinx.coroutines.launch
+
+class BootShutdownReceiver : BroadcastReceiver() {
+    override fun onReceive(context: Context, intent: Intent) {
+        val action = intent.action ?: return
+        applicationScope.launch {
+            if (Application.getBackend() !is WgQuickBackend) return@launch
+            val tunnelManager = Application.getTunnelManager()
+            if (Intent.ACTION_BOOT_COMPLETED == action) {
+                Log.i(TAG, "Broadcast receiver restoring state (boot)")
+                tunnelManager.restoreState(false)
+            } else if (Intent.ACTION_SHUTDOWN == action) {
+                Log.i(TAG, "Broadcast receiver saving state (shutdown)")
+                tunnelManager.saveState()
+            }
+        }
+    }
+
+    companion object {
+        private const val TAG = "WireGuard/BootShutdownReceiver"
+    }
+}
@@ -1,177 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android;
-
-import android.content.Intent;
-import android.graphics.Bitmap;
-import android.graphics.Canvas;
-import android.graphics.drawable.Icon;
-import android.os.Build;
-import android.os.IBinder;
-import android.service.quicksettings.Tile;
-import android.service.quicksettings.TileService;
-import android.util.Log;
-
-import com.wireguard.android.activity.MainActivity;
-import com.wireguard.android.activity.TunnelToggleActivity;
-import com.wireguard.android.backend.Tunnel.State;
-import com.wireguard.android.model.ObservableTunnel;
-import com.wireguard.android.widget.SlashDrawable;
-import com.wireguard.util.NonNullForAll;
-
-import java.util.Objects;
-
-import androidx.annotation.Nullable;
-import androidx.annotation.RequiresApi;
-import androidx.databinding.Observable;
-import androidx.databinding.Observable.OnPropertyChangedCallback;
-
-/**
- * Service that maintains the application's custom Quick Settings tile. This service is bound by the
- * system framework as necessary to update the appearance of the tile in the system UI, and to
- * forward click events to the application.
- */
-
-@RequiresApi(Build.VERSION_CODES.N)
-@NonNullForAll
-public class QuickTileService extends TileService {
-    private static final String TAG = "WireGuard/" + QuickTileService.class.getSimpleName();
-
-    private final OnStateChangedCallback onStateChangedCallback = new OnStateChangedCallback();
-    private final OnTunnelChangedCallback onTunnelChangedCallback = new OnTunnelChangedCallback();
-    @Nullable private Icon iconOff;
-    @Nullable private Icon iconOn;
-    @Nullable private ObservableTunnel tunnel;
-
-    /* This works around an annoying unsolved frameworks bug some people are hitting. */
-    @Override
-    @Nullable
-    public IBinder onBind(final Intent intent) {
-        IBinder ret = null;
-        try {
-            ret = super.onBind(intent);
-        } catch (final Exception e) {
-            Log.d(TAG, "Failed to bind to TileService", e);
-        }
-        return ret;
-    }
-
-    @Override
-    public void onClick() {
-        if (tunnel != null) {
-            unlockAndRun(() -> {
-                final Tile tile = getQsTile();
-                if (tile != null) {
-                    tile.setIcon(tile.getIcon() == iconOn ? iconOff : iconOn);
-                    tile.updateTile();
-                }
-                tunnel.setState(State.TOGGLE).whenComplete((v, t) -> {
-                    if (t == null) {
-                        updateTile();
-                    } else {
-                        final Intent toggleIntent = new Intent(this, TunnelToggleActivity.class);
-                        toggleIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-                        startActivity(toggleIntent);
-                    }
-                });
-            });
-        } else {
-            final Intent intent = new Intent(this, MainActivity.class);
-            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-            startActivityAndCollapse(intent);
-        }
-    }
-
-    @Override
-    public void onCreate() {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
-            iconOff = iconOn = Icon.createWithResource(this, R.drawable.ic_tile);
-            return;
-        }
-        final SlashDrawable icon = new SlashDrawable(getResources().getDrawable(R.drawable.ic_tile, Application.get().getTheme()));
-        icon.setAnimationEnabled(false); /* Unfortunately we can't have animations, since Icons are marshaled. */
-        icon.setSlashed(false);
-        Bitmap b = Bitmap.createBitmap(icon.getIntrinsicWidth(), icon.getIntrinsicHeight(), Bitmap.Config.ARGB_8888);
-        Canvas c = new Canvas(b);
-        icon.setBounds(0, 0, c.getWidth(), c.getHeight());
-        icon.draw(c);
-        iconOn = Icon.createWithBitmap(b);
-        icon.setSlashed(true);
-        b = Bitmap.createBitmap(icon.getIntrinsicWidth(), icon.getIntrinsicHeight(), Bitmap.Config.ARGB_8888);
-        c = new Canvas(b);
-        icon.setBounds(0, 0, c.getWidth(), c.getHeight());
-        icon.draw(c);
-        iconOff = Icon.createWithBitmap(b);
-    }
-
-    @Override
-    public void onStartListening() {
-        Application.getTunnelManager().addOnPropertyChangedCallback(onTunnelChangedCallback);
-        if (tunnel != null)
-            tunnel.addOnPropertyChangedCallback(onStateChangedCallback);
-        updateTile();
-    }
-
-    @Override
-    public void onStopListening() {
-        if (tunnel != null)
-            tunnel.removeOnPropertyChangedCallback(onStateChangedCallback);
-        Application.getTunnelManager().removeOnPropertyChangedCallback(onTunnelChangedCallback);
-    }
-
-    private void updateTile() {
-        // Update the tunnel.
-        final ObservableTunnel newTunnel = Application.getTunnelManager().getLastUsedTunnel();
-        if (newTunnel != tunnel) {
-            if (tunnel != null)
-                tunnel.removeOnPropertyChangedCallback(onStateChangedCallback);
-            tunnel = newTunnel;
-            if (tunnel != null)
-                tunnel.addOnPropertyChangedCallback(onStateChangedCallback);
-        }
-        // Update the tile contents.
-        final String label;
-        final int state;
-        final Tile tile = getQsTile();
-        if (tunnel != null) {
-            label = tunnel.getName();
-            state = tunnel.getState() == State.UP ? Tile.STATE_ACTIVE : Tile.STATE_INACTIVE;
-        } else {
-            label = getString(R.string.app_name);
-            state = Tile.STATE_INACTIVE;
-        }
-        if (tile == null)
-            return;
-        tile.setLabel(label);
-        if (tile.getState() != state) {
-            tile.setIcon(state == Tile.STATE_ACTIVE ? iconOn : iconOff);
-            tile.setState(state);
-        }
-        tile.updateTile();
-    }
-
-    private final class OnStateChangedCallback extends OnPropertyChangedCallback {
-        @Override
-        public void onPropertyChanged(final Observable sender, final int propertyId) {
-            if (!Objects.equals(sender, tunnel)) {
-                sender.removeOnPropertyChangedCallback(this);
-                return;
-            }
-            if (propertyId != 0 && propertyId != BR.state)
-                return;
-            updateTile();
-        }
-    }
-
-    private final class OnTunnelChangedCallback extends OnPropertyChangedCallback {
-        @Override
-        public void onPropertyChanged(final Observable sender, final int propertyId) {
-            if (propertyId != 0 && propertyId != BR.lastUsedTunnel)
-                return;
-            updateTile();
-        }
-    }
-}
@@ -0,0 +1,173 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android
+
+import android.content.Intent
+import android.graphics.Bitmap
+import android.graphics.Canvas
+import android.graphics.drawable.Icon
+import android.os.Build
+import android.os.IBinder
+import android.service.quicksettings.Tile
+import android.service.quicksettings.TileService
+import android.util.Log
+import androidx.annotation.RequiresApi
+import androidx.databinding.Observable
+import androidx.databinding.Observable.OnPropertyChangedCallback
+import com.wireguard.android.activity.MainActivity
+import com.wireguard.android.activity.TunnelToggleActivity
+import com.wireguard.android.backend.Tunnel
+import com.wireguard.android.model.ObservableTunnel
+import com.wireguard.android.util.applicationScope
+import com.wireguard.android.widget.SlashDrawable
+import kotlinx.coroutines.launch
+
+/**
+ * Service that maintains the application's custom Quick Settings tile. This service is bound by the
+ * system framework as necessary to update the appearance of the tile in the system UI, and to
+ * forward click events to the application.
+ */
+@RequiresApi(Build.VERSION_CODES.N)
+class QuickTileService : TileService() {
+    private val onStateChangedCallback = OnStateChangedCallback()
+    private val onTunnelChangedCallback = OnTunnelChangedCallback()
+    private var iconOff: Icon? = null
+    private var iconOn: Icon? = null
+    private var tunnel: ObservableTunnel? = null
+
+    /* This works around an annoying unsolved frameworks bug some people are hitting. */
+    override fun onBind(intent: Intent): IBinder? {
+        var ret: IBinder? = null
+        try {
+            ret = super.onBind(intent)
+        } catch (e: Throwable) {
+            Log.d(TAG, "Failed to bind to TileService", e)
+        }
+        return ret
+    }
+
+    override fun onClick() {
+        when (val tunnel = tunnel) {
+            null -> {
+                val intent = Intent(this, MainActivity::class.java)
+                intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                startActivityAndCollapse(intent)
+            }
+            else -> {
+                unlockAndRun {
+                    applicationScope.launch {
+                        try {
+                            tunnel.setStateAsync(Tunnel.State.TOGGLE)
+                            updateTile()
+                        } catch (_: Throwable) {
+                            val toggleIntent = Intent(this@QuickTileService, TunnelToggleActivity::class.java)
+                            toggleIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                            startActivity(toggleIntent)
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    override fun onCreate() {
+        isAdded = true
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+            iconOn = Icon.createWithResource(this, R.drawable.ic_tile)
+            iconOff = iconOn
+            return
+        }
+        val icon = SlashDrawable(resources.getDrawable(R.drawable.ic_tile, Application.get().theme))
+        icon.setAnimationEnabled(false) /* Unfortunately we can't have animations, since Icons are marshaled. */
+        icon.setSlashed(false)
+        var b = Bitmap.createBitmap(icon.intrinsicWidth, icon.intrinsicHeight, Bitmap.Config.ARGB_8888) ?: return
+        var c = Canvas(b)
+        icon.setBounds(0, 0, c.width, c.height)
+        icon.draw(c)
+        iconOn = Icon.createWithBitmap(b)
+        icon.setSlashed(true)
+        b = Bitmap.createBitmap(icon.intrinsicWidth, icon.intrinsicHeight, Bitmap.Config.ARGB_8888) ?: return
+        c = Canvas(b)
+        icon.setBounds(0, 0, c.width, c.height)
+        icon.draw(c)
+        iconOff = Icon.createWithBitmap(b)
+    }
+
+    override fun onDestroy() {
+        super.onDestroy()
+        isAdded = false
+    }
+
+    override fun onStartListening() {
+        Application.getTunnelManager().addOnPropertyChangedCallback(onTunnelChangedCallback)
+        tunnel?.addOnPropertyChangedCallback(onStateChangedCallback)
+        updateTile()
+    }
+
+    override fun onStopListening() {
+        tunnel?.removeOnPropertyChangedCallback(onStateChangedCallback)
+        Application.getTunnelManager().removeOnPropertyChangedCallback(onTunnelChangedCallback)
+    }
+
+    override fun onTileAdded() {
+        isAdded = true
+    }
+
+    override fun onTileRemoved() {
+        isAdded = false
+    }
+
+    private fun updateTile() {
+        // Update the tunnel.
+        val newTunnel = Application.getTunnelManager().lastUsedTunnel
+        if (newTunnel != tunnel) {
+            tunnel?.removeOnPropertyChangedCallback(onStateChangedCallback)
+            tunnel = newTunnel
+            tunnel?.addOnPropertyChangedCallback(onStateChangedCallback)
+        }
+        // Update the tile contents.
+        val tile = qsTile ?: return
+
+        when (val tunnel = tunnel) {
+            null -> {
+                tile.label = getString(R.string.app_name)
+                tile.state = Tile.STATE_INACTIVE
+                tile.icon = iconOff
+            }
+            else -> {
+                tile.label = tunnel.name
+                tile.state = if (tunnel.state == Tunnel.State.UP) Tile.STATE_ACTIVE else Tile.STATE_INACTIVE
+                tile.icon = if (tunnel.state == Tunnel.State.UP) iconOn else iconOff
+            }
+        }
+        tile.updateTile()
+    }
+
+    private inner class OnStateChangedCallback : OnPropertyChangedCallback() {
+        override fun onPropertyChanged(sender: Observable, propertyId: Int) {
+            if (sender != tunnel) {
+                sender.removeOnPropertyChangedCallback(this)
+                return
+            }
+            if (propertyId != 0 && propertyId != BR.state)
+                return
+            updateTile()
+        }
+    }
+
+    private inner class OnTunnelChangedCallback : OnPropertyChangedCallback() {
+        override fun onPropertyChanged(sender: Observable, propertyId: Int) {
+            if (propertyId != 0 && propertyId != BR.lastUsedTunnel)
+                return
+            updateTile()
+        }
+    }
+
+    companion object {
+        private const val TAG = "WireGuard/QuickTileService"
+        var isAdded: Boolean = false
+            private set
+    }
+}
@@ -1,102 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.activity;
-
-import android.os.Bundle;
-
-import com.wireguard.android.Application;
-import com.wireguard.android.model.ObservableTunnel;
-import com.wireguard.util.NonNullForAll;
-
-import java.util.Objects;
-
-import androidx.annotation.Nullable;
-import androidx.databinding.CallbackRegistry;
-import androidx.databinding.CallbackRegistry.NotifierCallback;
-
-/**
- * Base class for activities that need to remember the currently-selected tunnel.
- */
-
-@NonNullForAll
-public abstract class BaseActivity extends ThemeChangeAwareActivity {
-    private static final String KEY_SELECTED_TUNNEL = "selected_tunnel";
-
-    private final SelectionChangeRegistry selectionChangeRegistry = new SelectionChangeRegistry();
-    @Nullable private ObservableTunnel selectedTunnel;
-
-    public void addOnSelectedTunnelChangedListener(final OnSelectedTunnelChangedListener listener) {
-        selectionChangeRegistry.add(listener);
-    }
-
-    @Nullable
-    public ObservableTunnel getSelectedTunnel() {
-        return selectedTunnel;
-    }
-
-    @Override
-    protected void onCreate(@Nullable final Bundle savedInstanceState) {
-        // Restore the saved tunnel if there is one; otherwise grab it from the arguments.
-        final String savedTunnelName;
-        if (savedInstanceState != null)
-            savedTunnelName = savedInstanceState.getString(KEY_SELECTED_TUNNEL);
-        else if (getIntent() != null)
-            savedTunnelName = getIntent().getStringExtra(KEY_SELECTED_TUNNEL);
-        else
-            savedTunnelName = null;
-
-        if (savedTunnelName != null)
-            Application.getTunnelManager().getTunnels()
-                    .thenAccept(tunnels -> setSelectedTunnel(tunnels.get(savedTunnelName)));
-
-        // The selected tunnel must be set before the superclass method recreates fragments.
-        super.onCreate(savedInstanceState);
-    }
-
-    @Override
-    protected void onSaveInstanceState(final Bundle outState) {
-        if (selectedTunnel != null)
-            outState.putString(KEY_SELECTED_TUNNEL, selectedTunnel.getName());
-        super.onSaveInstanceState(outState);
-    }
-
-    protected abstract void onSelectedTunnelChanged(@Nullable ObservableTunnel oldTunnel, @Nullable ObservableTunnel newTunnel);
-
-    public void removeOnSelectedTunnelChangedListener(
-            final OnSelectedTunnelChangedListener listener) {
-        selectionChangeRegistry.remove(listener);
-    }
-
-    public void setSelectedTunnel(@Nullable final ObservableTunnel tunnel) {
-        final ObservableTunnel oldTunnel = selectedTunnel;
-        if (Objects.equals(oldTunnel, tunnel))
-            return;
-        selectedTunnel = tunnel;
-        onSelectedTunnelChanged(oldTunnel, tunnel);
-        selectionChangeRegistry.notifyCallbacks(oldTunnel, 0, tunnel);
-    }
-
-    public interface OnSelectedTunnelChangedListener {
-        void onSelectedTunnelChanged(@Nullable ObservableTunnel oldTunnel, @Nullable ObservableTunnel newTunnel);
-    }
-
-    private static final class SelectionChangeNotifier
-            extends NotifierCallback<OnSelectedTunnelChangedListener, ObservableTunnel, ObservableTunnel> {
-        @Override
-        public void onNotifyCallback(final OnSelectedTunnelChangedListener listener,
-                                     final ObservableTunnel oldTunnel, final int ignored,
-                                     final ObservableTunnel newTunnel) {
-            listener.onSelectedTunnelChanged(oldTunnel, newTunnel);
-        }
-    }
-
-    private static final class SelectionChangeRegistry
-            extends CallbackRegistry<OnSelectedTunnelChangedListener, ObservableTunnel, ObservableTunnel> {
-        private SelectionChangeRegistry() {
-            super(new SelectionChangeNotifier());
-        }
-    }
-}
@@ -0,0 +1,96 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.activity
+
+import android.os.Bundle
+import androidx.appcompat.app.AppCompatActivity
+import androidx.databinding.CallbackRegistry
+import androidx.databinding.CallbackRegistry.NotifierCallback
+import androidx.lifecycle.lifecycleScope
+import com.wireguard.android.Application
+import com.wireguard.android.model.ObservableTunnel
+import kotlinx.coroutines.launch
+
+/**
+ * Base class for activities that need to remember the currently-selected tunnel.
+ */
+abstract class BaseActivity : AppCompatActivity() {
+    private val selectionChangeRegistry = SelectionChangeRegistry()
+    private var created = false
+    var selectedTunnel: ObservableTunnel? = null
+        set(value) {
+            val oldTunnel = field
+            if (oldTunnel == value) return
+            field = value
+            if (created) {
+                if (!onSelectedTunnelChanged(oldTunnel, value)) {
+                    field = oldTunnel
+                } else {
+                    selectionChangeRegistry.notifyCallbacks(oldTunnel, 0, value)
+                }
+            }
+        }
+
+    fun addOnSelectedTunnelChangedListener(listener: OnSelectedTunnelChangedListener) {
+        selectionChangeRegistry.add(listener)
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        // Restore the saved tunnel if there is one; otherwise grab it from the arguments.
+        val savedTunnelName = when {
+            savedInstanceState != null -> savedInstanceState.getString(KEY_SELECTED_TUNNEL)
+            intent != null -> intent.getStringExtra(KEY_SELECTED_TUNNEL)
+            else -> null
+        }
+        if (savedTunnelName != null) {
+            lifecycleScope.launch {
+                val tunnel = Application.getTunnelManager().getTunnels()[savedTunnelName]
+                if (tunnel == null)
+                    created = true
+                selectedTunnel = tunnel
+                created = true
+            }
+        } else {
+            created = true
+        }
+    }
+
+    override fun onSaveInstanceState(outState: Bundle) {
+        if (selectedTunnel != null) outState.putString(KEY_SELECTED_TUNNEL, selectedTunnel!!.name)
+        super.onSaveInstanceState(outState)
+    }
+
+    protected abstract fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?): Boolean
+
+    fun removeOnSelectedTunnelChangedListener(
+        listener: OnSelectedTunnelChangedListener
+    ) {
+        selectionChangeRegistry.remove(listener)
+    }
+
+    interface OnSelectedTunnelChangedListener {
+        fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?)
+    }
+
+    private class SelectionChangeNotifier : NotifierCallback<OnSelectedTunnelChangedListener, ObservableTunnel, ObservableTunnel>() {
+        override fun onNotifyCallback(
+            listener: OnSelectedTunnelChangedListener,
+            oldTunnel: ObservableTunnel?,
+            ignored: Int,
+            newTunnel: ObservableTunnel?
+        ) {
+            listener.onSelectedTunnelChanged(oldTunnel, newTunnel)
+        }
+    }
+
+    private class SelectionChangeRegistry :
+        CallbackRegistry<OnSelectedTunnelChangedListener, ObservableTunnel, ObservableTunnel>(SelectionChangeNotifier())
+
+    companion object {
+        private const val KEY_SELECTED_TUNNEL = "selected_tunnel"
+    }
+}
@@ -0,0 +1,382 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.activity
+
+import android.content.ClipDescription.compareMimeTypes
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.Intent
+import android.database.Cursor
+import android.database.MatrixCursor
+import android.graphics.Typeface.BOLD
+import android.net.Uri
+import android.os.Bundle
+import android.os.ParcelFileDescriptor
+import android.text.Spannable
+import android.text.SpannableString
+import android.text.style.ForegroundColorSpan
+import android.text.style.StyleSpan
+import android.util.Log
+import android.view.LayoutInflater
+import android.view.Menu
+import android.view.MenuItem
+import android.view.View
+import android.view.ViewGroup
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.appcompat.app.AppCompatActivity
+import androidx.collection.CircularArray
+import androidx.core.app.ShareCompat
+import androidx.core.content.res.ResourcesCompat
+import androidx.lifecycle.lifecycleScope
+import androidx.recyclerview.widget.DividerItemDecoration
+import androidx.recyclerview.widget.LinearLayoutManager
+import androidx.recyclerview.widget.RecyclerView
+import com.google.android.material.snackbar.Snackbar
+import com.google.android.material.textview.MaterialTextView
+import com.wireguard.android.BuildConfig
+import com.wireguard.android.R
+import com.wireguard.android.databinding.LogViewerActivityBinding
+import com.wireguard.android.util.DownloadsFileSaver
+import com.wireguard.android.util.ErrorMessages
+import com.wireguard.android.util.resolveAttribute
+import com.wireguard.crypto.KeyPair
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import java.io.BufferedReader
+import java.io.FileOutputStream
+import java.io.IOException
+import java.io.InputStreamReader
+import java.nio.charset.StandardCharsets
+import java.text.DateFormat
+import java.text.ParseException
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+import java.util.concurrent.ConcurrentHashMap
+import java.util.regex.Matcher
+import java.util.regex.Pattern
+
+class LogViewerActivity : AppCompatActivity() {
+    private lateinit var binding: LogViewerActivityBinding
+    private lateinit var logAdapter: LogEntryAdapter
+    private var logLines = CircularArray<LogLine>()
+    private var rawLogLines = CircularArray<String>()
+    private var recyclerView: RecyclerView? = null
+    private var saveButton: MenuItem? = null
+    private val year by lazy {
+        val yearFormatter: DateFormat = SimpleDateFormat("yyyy", Locale.US)
+        yearFormatter.format(Date())
+    }
+
+    private val defaultColor by lazy { resolveAttribute(com.google.android.material.R.attr.colorOnSurface) }
+
+    private val debugColor by lazy { ResourcesCompat.getColor(resources, R.color.debug_tag_color, theme) }
+
+    private val errorColor by lazy { ResourcesCompat.getColor(resources, R.color.error_tag_color, theme) }
+
+    private val infoColor by lazy { ResourcesCompat.getColor(resources, R.color.info_tag_color, theme) }
+
+    private val warningColor by lazy { ResourcesCompat.getColor(resources, R.color.warning_tag_color, theme) }
+
+    private var lastUri: Uri? = null
+
+    private fun revokeLastUri() {
+        lastUri?.let {
+            LOGS.remove(it.pathSegments.lastOrNull())
+            revokeUriPermission(it, Intent.FLAG_GRANT_READ_URI_PERMISSION)
+            lastUri = null
+        }
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        binding = LogViewerActivityBinding.inflate(layoutInflater)
+        setContentView(binding.root)
+        supportActionBar?.setDisplayHomeAsUpEnabled(true)
+        logAdapter = LogEntryAdapter()
+        binding.recyclerView.apply {
+            recyclerView = this
+            layoutManager = LinearLayoutManager(context)
+            adapter = logAdapter
+            addItemDecoration(DividerItemDecoration(context, LinearLayoutManager.VERTICAL))
+        }
+
+        lifecycleScope.launch(Dispatchers.IO) { streamingLog() }
+
+        val revokeLastActivityResultLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) {
+            revokeLastUri()
+        }
+
+        binding.shareFab.setOnClickListener {
+            lifecycleScope.launch {
+                revokeLastUri()
+                val key = KeyPair().privateKey.toHex()
+                LOGS[key] = rawLogBytes()
+                lastUri = Uri.parse("content://${BuildConfig.APPLICATION_ID}.exported-log/$key")
+                val shareIntent = ShareCompat.IntentBuilder(this@LogViewerActivity)
+                    .setType("text/plain")
+                    .setSubject(getString(R.string.log_export_subject))
+                    .setStream(lastUri)
+                    .setChooserTitle(R.string.log_export_title)
+                    .createChooserIntent()
+                    .addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
+                grantUriPermission("android", lastUri, Intent.FLAG_GRANT_READ_URI_PERMISSION)
+                revokeLastActivityResultLauncher.launch(shareIntent)
+            }
+        }
+    }
+
+    override fun onCreateOptionsMenu(menu: Menu): Boolean {
+        menuInflater.inflate(R.menu.log_viewer, menu)
+        saveButton = menu.findItem(R.id.save_log)
+        return true
+    }
+
+    override fun onOptionsItemSelected(item: MenuItem): Boolean {
+        return when (item.itemId) {
+            android.R.id.home -> {
+                finish()
+                true
+            }
+
+            R.id.save_log -> {
+                saveButton?.isEnabled = false
+                lifecycleScope.launch { saveLog() }
+                true
+            }
+
+            else -> super.onOptionsItemSelected(item)
+        }
+    }
+
+    private val downloadsFileSaver = DownloadsFileSaver(this)
+
+    private suspend fun rawLogBytes(): ByteArray {
+        val builder = StringBuilder()
+        withContext(Dispatchers.IO) {
+            for (i in 0 until rawLogLines.size()) {
+                builder.append(rawLogLines[i])
+                builder.append('\n')
+            }
+        }
+        return builder.toString().toByteArray(Charsets.UTF_8)
+    }
+
+    private suspend fun saveLog() {
+        var exception: Throwable? = null
+        var outputFile: DownloadsFileSaver.DownloadsFile? = null
+        withContext(Dispatchers.IO) {
+            try {
+                outputFile = downloadsFileSaver.save("wireguard-log.txt", "text/plain", true)
+                outputFile?.outputStream?.write(rawLogBytes())
+            } catch (e: Throwable) {
+                outputFile?.delete()
+                exception = e
+            }
+        }
+        saveButton?.isEnabled = true
+        if (outputFile == null)
+            return
+        Snackbar.make(
+            findViewById(android.R.id.content),
+            if (exception == null) getString(R.string.log_export_success, outputFile?.fileName)
+            else getString(R.string.log_export_error, ErrorMessages[exception]),
+            if (exception == null) Snackbar.LENGTH_SHORT else Snackbar.LENGTH_LONG
+        )
+            .setAnchorView(binding.shareFab)
+            .show()
+    }
+
+    private suspend fun streamingLog() = withContext(Dispatchers.IO) {
+        val builder = ProcessBuilder().command("logcat", "-b", "all", "-v", "threadtime", "*:V")
+        builder.environment()["LC_ALL"] = "C"
+        var process: Process? = null
+        try {
+            process = try {
+                builder.start()
+            } catch (e: IOException) {
+                Log.e(TAG, Log.getStackTraceString(e))
+                return@withContext
+            }
+            val stdout = BufferedReader(InputStreamReader(process!!.inputStream, StandardCharsets.UTF_8))
+
+            var posStart = 0
+            var timeLastNotify = System.nanoTime()
+            var priorModified = false
+            val bufferedLogLines = arrayListOf<LogLine>()
+            var timeout = 1000000000L / 2 // The timeout is initially small so that the view gets populated immediately.
+            val MAX_LINES = (1 shl 16) - 1
+            val MAX_BUFFERED_LINES = (1 shl 14) - 1
+
+            while (true) {
+                val line = stdout.readLine() ?: break
+                if (rawLogLines.size() >= MAX_LINES)
+                    rawLogLines.popFirst()
+                rawLogLines.addLast(line)
+                val logLine = parseLine(line)
+                if (logLine != null) {
+                    bufferedLogLines.add(logLine)
+                } else {
+                    if (bufferedLogLines.isNotEmpty()) {
+                        bufferedLogLines.last().msg += "\n$line"
+                    } else if (!logLines.isEmpty) {
+                        logLines[logLines.size() - 1].msg += "\n$line"
+                        priorModified = true
+                    }
+                }
+                val timeNow = System.nanoTime()
+                if (bufferedLogLines.size < MAX_BUFFERED_LINES && (timeNow - timeLastNotify) < timeout && stdout.ready())
+                    continue
+                timeout = 1000000000L * 5 / 2 // Increase the timeout after the initial view has something in it.
+                timeLastNotify = timeNow
+
+                withContext(Dispatchers.Main.immediate) {
+                    val isScrolledToBottomAlready = recyclerView?.canScrollVertically(1) == false
+                    if (priorModified) {
+                        logAdapter.notifyItemChanged(posStart - 1)
+                        priorModified = false
+                    }
+                    val fullLen = logLines.size() + bufferedLogLines.size
+                    if (fullLen >= MAX_LINES) {
+                        val numToRemove = fullLen - MAX_LINES + 1
+                        logLines.removeFromStart(numToRemove)
+                        logAdapter.notifyItemRangeRemoved(0, numToRemove)
+                        posStart -= numToRemove
+
+                    }
+                    for (bufferedLine in bufferedLogLines) {
+                        logLines.addLast(bufferedLine)
+                    }
+                    bufferedLogLines.clear()
+                    logAdapter.notifyItemRangeInserted(posStart, logLines.size() - posStart)
+                    posStart = logLines.size()
+
+                    if (isScrolledToBottomAlready) {
+                        recyclerView?.scrollToPosition(logLines.size() - 1)
+                    }
+                }
+            }
+        } finally {
+            process?.destroy()
+        }
+    }
+
+    private fun parseTime(timeStr: String): Date? {
+        val formatter: DateFormat = SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS", Locale.US)
+        return try {
+            formatter.parse("$year-$timeStr")
+        } catch (e: ParseException) {
+            null
+        }
+    }
+
+    private fun parseLine(line: String): LogLine? {
+        val m: Matcher = THREADTIME_LINE.matcher(line)
+        return if (m.matches()) {
+            LogLine(m.group(2)!!.toInt(), m.group(3)!!.toInt(), parseTime(m.group(1)!!), m.group(4)!!, m.group(5)!!, m.group(6)!!)
+        } else {
+            null
+        }
+    }
+
+    private data class LogLine(val pid: Int, val tid: Int, val time: Date?, val level: String, val tag: String, var msg: String)
+
+    companion object {
+        /**
+         * Match a single line of `logcat -v threadtime`, such as:
+         *
+         * <pre>05-26 11:02:36.886 5689 5689 D AndroidRuntime: CheckJNI is OFF.</pre>
+         */
+        private val THREADTIME_LINE: Pattern =
+            Pattern.compile("^(\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}.\\d{3})(?:\\s+[0-9A-Za-z]+)?\\s+(\\d+)\\s+(\\d+)\\s+([A-Z])\\s+(.+?)\\s*: (.*)$")
+        private val LOGS: MutableMap<String, ByteArray> = ConcurrentHashMap()
+        private const val TAG = "WireGuard/LogViewerActivity"
+    }
+
+    private inner class LogEntryAdapter : RecyclerView.Adapter<LogEntryAdapter.ViewHolder>() {
+
+        private inner class ViewHolder(val layout: View, var isSingleLine: Boolean = true) : RecyclerView.ViewHolder(layout)
+
+        private fun levelToColor(level: String): Int {
+            return when (level) {
+                "V", "D" -> debugColor
+                "E" -> errorColor
+                "I" -> infoColor
+                "W" -> warningColor
+                else -> defaultColor
+            }
+        }
+
+        override fun getItemCount() = logLines.size()
+
+        override fun onCreateViewHolder(parent: ViewGroup, viewType: Int): ViewHolder {
+            val view = LayoutInflater.from(parent.context)
+                .inflate(R.layout.log_viewer_entry, parent, false)
+            return ViewHolder(view)
+        }
+
+        override fun onBindViewHolder(holder: ViewHolder, position: Int) {
+            val line = logLines[position]
+            val spannable = if (position > 0 && logLines[position - 1].tag == line.tag)
+                SpannableString(line.msg)
+            else
+                SpannableString("${line.tag}: ${line.msg}").apply {
+                    setSpan(StyleSpan(BOLD), 0, "${line.tag}:".length, Spannable.SPAN_EXCLUSIVE_EXCLUSIVE)
+                    setSpan(
+                        ForegroundColorSpan(levelToColor(line.level)),
+                        0, "${line.tag}:".length, Spannable.SPAN_EXCLUSIVE_EXCLUSIVE
+                    )
+                }
+            holder.layout.apply {
+                findViewById<MaterialTextView>(R.id.log_date).text = line.time.toString()
+                findViewById<MaterialTextView>(R.id.log_msg).apply {
+                    setSingleLine()
+                    text = spannable
+                    setOnClickListener {
+                        isSingleLine = !holder.isSingleLine
+                        holder.isSingleLine = !holder.isSingleLine
+                    }
+                }
+            }
+        }
+    }
+
+    class ExportedLogContentProvider : ContentProvider() {
+        private fun logForUri(uri: Uri): ByteArray? = LOGS[uri.pathSegments.lastOrNull()]
+
+        override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+
+        override fun query(uri: Uri, projection: Array<out String>?, selection: String?, selectionArgs: Array<out String>?, sortOrder: String?): Cursor? =
+            logForUri(uri)?.let {
+                val m = MatrixCursor(arrayOf(android.provider.OpenableColumns.DISPLAY_NAME, android.provider.OpenableColumns.SIZE), 1)
+                m.addRow(arrayOf("wireguard-log.txt", it.size.toLong()))
+                m
+            }
+
+        override fun onCreate(): Boolean = true
+
+        override fun update(uri: Uri, values: ContentValues?, selection: String?, selectionArgs: Array<out String>?): Int = 0
+
+        override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int = 0
+
+        override fun getType(uri: Uri): String? = logForUri(uri)?.let { "text/plain" }
+
+        override fun getStreamTypes(uri: Uri, mimeTypeFilter: String): Array<String>? =
+            getType(uri)?.let { if (compareMimeTypes(it, mimeTypeFilter)) arrayOf(it) else null }
+
+        override fun openFile(uri: Uri, mode: String): ParcelFileDescriptor? {
+            if (mode != "r") return null
+            val log = logForUri(uri) ?: return null
+            return openPipeHelper(uri, "text/plain", null, log) { output, _, _, _, l ->
+                try {
+                    FileOutputStream(output.fileDescriptor).write(l!!)
+                } catch (_: Throwable) {
+                }
+            }
+        }
+    }
+}
@@ -1,147 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.activity;
-
-import android.annotation.SuppressLint;
-import android.content.Intent;
-import android.os.Bundle;
-import android.view.Menu;
-import android.view.MenuItem;
-import android.view.View.OnApplyWindowInsetsListener;
-import android.widget.LinearLayout;
-
-import com.wireguard.android.R;
-import com.wireguard.android.fragment.TunnelDetailFragment;
-import com.wireguard.android.fragment.TunnelEditorFragment;
-import com.wireguard.android.model.ObservableTunnel;
-import com.wireguard.util.NonNullForAll;
-
-import java.util.List;
-
-import androidx.annotation.Nullable;
-import androidx.appcompat.app.ActionBar;
-import androidx.fragment.app.Fragment;
-import androidx.fragment.app.FragmentManager;
-import androidx.fragment.app.FragmentTransaction;
-
-/**
- * CRUD interface for WireGuard tunnels. This activity serves as the main entry point to the
- * WireGuard application, and contains several fragments for listing, viewing details of, and
- * editing the configuration and interface state of WireGuard tunnels.
- */
-
-@NonNullForAll
-public class MainActivity extends BaseActivity
-        implements FragmentManager.OnBackStackChangedListener {
-    @Nullable private ActionBar actionBar;
-    private boolean isTwoPaneLayout;
-
-    @Override
-    public void onBackPressed() {
-        final int backStackEntries = getSupportFragmentManager().getBackStackEntryCount();
-        // If the two-pane layout does not have an editor open, going back should exit the app.
-        if (isTwoPaneLayout && backStackEntries <= 1) {
-            finish();
-            return;
-        }
-        // Deselect the current tunnel on navigating back from the detail pane to the one-pane list.
-        if (!isTwoPaneLayout && backStackEntries == 1) {
-            getSupportFragmentManager().popBackStack();
-            setSelectedTunnel(null);
-            return;
-        }
-        super.onBackPressed();
-    }
-
-    @Override public void onBackStackChanged() {
-        if (actionBar == null)
-            return;
-        // Do not show the home menu when the two-pane layout is at the detail view (see above).
-        final int backStackEntries = getSupportFragmentManager().getBackStackEntryCount();
-        final int minBackStackEntries = isTwoPaneLayout ? 2 : 1;
-        actionBar.setDisplayHomeAsUpEnabled(backStackEntries >= minBackStackEntries);
-    }
-
-    // We use onTouchListener here to avoid the UI click sound, hence
-    // calling View#performClick defeats the purpose of it.
-    @SuppressLint("ClickableViewAccessibility")
-    @Override
-    protected void onCreate(@Nullable final Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        setContentView(R.layout.main_activity);
-        actionBar = getSupportActionBar();
-        isTwoPaneLayout = findViewById(R.id.master_detail_wrapper) instanceof LinearLayout;
-        getSupportFragmentManager().addOnBackStackChangedListener(this);
-        onBackStackChanged();
-        // Dispatch insets on back stack change
-        // This is required to ensure replaced fragments are also able to consume insets
-        findViewById(R.id.master_detail_wrapper).setOnApplyWindowInsetsListener((OnApplyWindowInsetsListener) (v, insets) -> {
-            final FragmentManager fragmentManager = getSupportFragmentManager();
-            fragmentManager.addOnBackStackChangedListener(() -> {
-                final List<Fragment> fragments = fragmentManager.getFragments();
-                for (int i = 0; i < fragments.size(); i++) {
-                    fragments.get(i).requireView().dispatchApplyWindowInsets(insets);
-                }
-            });
-            return insets;
-        });
-    }
-
-    @Override
-    public boolean onCreateOptionsMenu(final Menu menu) {
-        getMenuInflater().inflate(R.menu.main_activity, menu);
-        return true;
-    }
-
-    @Override
-    public boolean onOptionsItemSelected(final MenuItem item) {
-        switch (item.getItemId()) {
-            case android.R.id.home:
-                // The back arrow in the action bar should act the same as the back button.
-                onBackPressed();
-                return true;
-            case R.id.menu_action_edit:
-                getSupportFragmentManager().beginTransaction()
-                        .replace(R.id.detail_container, new TunnelEditorFragment())
-                        .setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
-                        .addToBackStack(null)
-                        .commit();
-                return true;
-            case R.id.menu_action_save:
-                // This menu item is handled by the editor fragment.
-                return false;
-            case R.id.menu_settings:
-                startActivity(new Intent(this, SettingsActivity.class));
-                return true;
-            default:
-                return super.onOptionsItemSelected(item);
-        }
-    }
-
-    @Override
-    protected void onSelectedTunnelChanged(@Nullable final ObservableTunnel oldTunnel,
-                                           @Nullable final ObservableTunnel newTunnel) {
-        final FragmentManager fragmentManager = getSupportFragmentManager();
-        final int backStackEntries = fragmentManager.getBackStackEntryCount();
-        if (newTunnel == null) {
-            // Clear everything off the back stack (all editors and detail fragments).
-            fragmentManager.popBackStackImmediate(0, FragmentManager.POP_BACK_STACK_INCLUSIVE);
-            return;
-        }
-        if (backStackEntries == 2) {
-            // Pop the editor off the back stack to reveal the detail fragment. Use the immediate
-            // method to avoid the editor picking up the new tunnel while it is still visible.
-            fragmentManager.popBackStackImmediate();
-        } else if (backStackEntries == 0) {
-            // Create and show a new detail fragment.
-            fragmentManager.beginTransaction()
-                    .add(R.id.detail_container, new TunnelDetailFragment())
-                    .setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
-                    .addToBackStack(null)
-                    .commit();
-        }
-    }
-}
@@ -0,0 +1,129 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.activity
+
+import android.content.Intent
+import android.os.Bundle
+import android.view.Menu
+import android.view.MenuItem
+import android.view.View
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.addCallback
+import androidx.appcompat.app.ActionBar
+import androidx.fragment.app.FragmentManager
+import androidx.fragment.app.FragmentTransaction
+import androidx.fragment.app.commit
+import com.wireguard.android.R
+import com.wireguard.android.fragment.TunnelDetailFragment
+import com.wireguard.android.fragment.TunnelEditorFragment
+import com.wireguard.android.model.ObservableTunnel
+
+/**
+ * CRUD interface for WireGuard tunnels. This activity serves as the main entry point to the
+ * WireGuard application, and contains several fragments for listing, viewing details of, and
+ * editing the configuration and interface state of WireGuard tunnels.
+ */
+class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener {
+    private var actionBar: ActionBar? = null
+    private var isTwoPaneLayout = false
+    private var backPressedCallback: OnBackPressedCallback? = null
+
+    private fun handleBackPressed() {
+        val backStackEntries = supportFragmentManager.backStackEntryCount
+        // If the two-pane layout does not have an editor open, going back should exit the app.
+        if (isTwoPaneLayout && backStackEntries <= 1) {
+            finish()
+            return
+        }
+
+        if (backStackEntries >= 1)
+            supportFragmentManager.popBackStack()
+
+        // Deselect the current tunnel on navigating back from the detail pane to the one-pane list.
+        if (backStackEntries == 1)
+            selectedTunnel = null
+    }
+
+    override fun onBackStackChanged() {
+        val backStackEntries = supportFragmentManager.backStackEntryCount
+        backPressedCallback?.isEnabled = backStackEntries >= 1
+        if (actionBar == null) return
+        // Do not show the home menu when the two-pane layout is at the detail view (see above).
+        val minBackStackEntries = if (isTwoPaneLayout) 2 else 1
+        actionBar!!.setDisplayHomeAsUpEnabled(backStackEntries >= minBackStackEntries)
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        setContentView(R.layout.main_activity)
+        actionBar = supportActionBar
+        isTwoPaneLayout = findViewById<View?>(R.id.master_detail_wrapper) != null
+        supportFragmentManager.addOnBackStackChangedListener(this)
+        backPressedCallback = onBackPressedDispatcher.addCallback(this) { handleBackPressed() }
+        onBackStackChanged()
+    }
+
+    override fun onCreateOptionsMenu(menu: Menu): Boolean {
+        menuInflater.inflate(R.menu.main_activity, menu)
+        return true
+    }
+
+    override fun onOptionsItemSelected(item: MenuItem): Boolean {
+        return when (item.itemId) {
+            android.R.id.home -> {
+                // The back arrow in the action bar should act the same as the back button.
+                onBackPressedDispatcher.onBackPressed()
+                true
+            }
+
+            R.id.menu_action_edit -> {
+                supportFragmentManager.commit {
+                    replace(R.id.detail_container, TunnelEditorFragment())
+                    setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
+                    addToBackStack(null)
+                }
+                true
+            }
+            // This menu item is handled by the editor fragment.
+            R.id.menu_action_save -> false
+            R.id.menu_settings -> {
+                startActivity(Intent(this, SettingsActivity::class.java))
+                true
+            }
+
+            else -> super.onOptionsItemSelected(item)
+        }
+    }
+
+    override fun onSelectedTunnelChanged(
+        oldTunnel: ObservableTunnel?,
+        newTunnel: ObservableTunnel?
+    ): Boolean {
+        val fragmentManager = supportFragmentManager
+        if (fragmentManager.isStateSaved) {
+            return false
+        }
+
+        val backStackEntries = fragmentManager.backStackEntryCount
+        if (newTunnel == null) {
+            // Clear everything off the back stack (all editors and detail fragments).
+            fragmentManager.popBackStackImmediate(0, FragmentManager.POP_BACK_STACK_INCLUSIVE)
+            return true
+        }
+        if (backStackEntries == 2) {
+            // Pop the editor off the back stack to reveal the detail fragment. Use the immediate
+            // method to avoid the editor picking up the new tunnel while it is still visible.
+            fragmentManager.popBackStackImmediate()
+        } else if (backStackEntries == 0) {
+            // Create and show a new detail fragment.
+            fragmentManager.commit {
+                add(R.id.detail_container, TunnelDetailFragment())
+                setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
+                addToBackStack(null)
+            }
+        }
+        return true
+    }
+}
@@ -1,135 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.activity;
-
-import android.content.pm.PackageManager;
-import android.os.Build;
-import android.os.Bundle;
-import android.util.SparseArray;
-import android.view.MenuItem;
-
-import com.wireguard.android.Application;
-import com.wireguard.android.R;
-import com.wireguard.android.backend.WgQuickBackend;
-import com.wireguard.android.util.ModuleLoader;
-import com.wireguard.util.NonNullForAll;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import androidx.annotation.Nullable;
-import androidx.core.app.ActivityCompat;
-import androidx.core.content.ContextCompat;
-import androidx.preference.Preference;
-import androidx.preference.PreferenceFragmentCompat;
-import androidx.preference.PreferenceScreen;
-
-/**
- * Interface for changing application-global persistent settings.
- */
-
-@NonNullForAll
-public class SettingsActivity extends ThemeChangeAwareActivity {
-    private final SparseArray<PermissionRequestCallback> permissionRequestCallbacks = new SparseArray<>();
-    private int permissionRequestCounter;
-
-    public void ensurePermissions(final String[] permissions, final PermissionRequestCallback cb) {
-        final List<String> needPermissions = new ArrayList<>(permissions.length);
-        for (final String permission : permissions) {
-            if (ContextCompat.checkSelfPermission(this, permission)
-                    != PackageManager.PERMISSION_GRANTED)
-                needPermissions.add(permission);
-        }
-        if (needPermissions.isEmpty()) {
-            final int[] granted = new int[permissions.length];
-            Arrays.fill(granted, PackageManager.PERMISSION_GRANTED);
-            cb.done(permissions, granted);
-            return;
-        }
-        final int idx = permissionRequestCounter++;
-        permissionRequestCallbacks.put(idx, cb);
-        ActivityCompat.requestPermissions(this,
-                needPermissions.toArray(new String[needPermissions.size()]), idx);
-    }
-
-    @Override
-    protected void onCreate(@Nullable final Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        if (getSupportFragmentManager().findFragmentById(android.R.id.content) == null) {
-            getSupportFragmentManager().beginTransaction()
-                    .add(android.R.id.content, new SettingsFragment())
-                    .commit();
-        }
-    }
-
-    @Override
-    public boolean onOptionsItemSelected(final MenuItem item) {
-        switch (item.getItemId()) {
-            case android.R.id.home:
-                finish();
-                return true;
-            default:
-                return super.onOptionsItemSelected(item);
-        }
-    }
-
-    @Override
-    public void onRequestPermissionsResult(final int requestCode,
-                                           final String[] permissions,
-                                           final int[] grantResults) {
-        final PermissionRequestCallback f = permissionRequestCallbacks.get(requestCode);
-        if (f != null) {
-            permissionRequestCallbacks.remove(requestCode);
-            f.done(permissions, grantResults);
-        }
-    }
-
-    public interface PermissionRequestCallback {
-        void done(String[] permissions, int[] grantResults);
-    }
-
-    public static class SettingsFragment extends PreferenceFragmentCompat {
-        @Override
-        public void onCreatePreferences(final Bundle savedInstanceState, final String key) {
-            addPreferencesFromResource(R.xml.preferences);
-            final PreferenceScreen screen = getPreferenceScreen();
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
-                screen.removePreference(getPreferenceManager().findPreference("dark_theme"));
-
-            final Preference wgQuickOnlyPrefs[] = {
-                    getPreferenceManager().findPreference("tools_installer"),
-                    getPreferenceManager().findPreference("restore_on_boot"),
-                    getPreferenceManager().findPreference("multiple_tunnels")
-            };
-            for (final Preference pref : wgQuickOnlyPrefs)
-                pref.setVisible(false);
-            Application.getBackendAsync().thenAccept(backend -> {
-                for (final Preference pref : wgQuickOnlyPrefs) {
-                    if (backend instanceof WgQuickBackend)
-                        pref.setVisible(true);
-                    else
-                        screen.removePreference(pref);
-                }
-            });
-
-            final Preference moduleInstaller = getPreferenceManager().findPreference("module_downloader");
-            final Preference kernelModuleDisabler = getPreferenceManager().findPreference("kernel_module_disabler");
-            moduleInstaller.setVisible(false);
-            if (ModuleLoader.isModuleLoaded()) {
-                screen.removePreference(moduleInstaller);
-            } else {
-                screen.removePreference(kernelModuleDisabler);
-                Application.getAsyncWorker().runAsync(Application.getRootShell()::start).whenComplete((v, e) -> {
-                    if (e == null)
-                        moduleInstaller.setVisible(true);
-                    else
-                        screen.removePreference(moduleInstaller);
-                });
-            }
-        }
-    }
-}
@@ -0,0 +1,107 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.activity
+
+import android.content.ComponentName
+import android.content.Intent
+import android.os.Build
+import android.os.Bundle
+import android.service.quicksettings.TileService
+import android.view.MenuItem
+import androidx.appcompat.app.AppCompatActivity
+import androidx.fragment.app.commit
+import androidx.lifecycle.lifecycleScope
+import androidx.preference.Preference
+import androidx.preference.PreferenceFragmentCompat
+import com.wireguard.android.Application
+import com.wireguard.android.QuickTileService
+import com.wireguard.android.R
+import com.wireguard.android.backend.WgQuickBackend
+import com.wireguard.android.preference.PreferencesPreferenceDataStore
+import com.wireguard.android.util.AdminKnobs
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/**
+ * Interface for changing application-global persistent settings.
+ */
+class SettingsActivity : AppCompatActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        if (supportFragmentManager.findFragmentById(android.R.id.content) == null) {
+            supportFragmentManager.commit {
+                add(android.R.id.content, SettingsFragment())
+            }
+        }
+    }
+
+    override fun onOptionsItemSelected(item: MenuItem): Boolean {
+        if (item.itemId == android.R.id.home) {
+            finish()
+            return true
+        }
+        return super.onOptionsItemSelected(item)
+    }
+
+    class SettingsFragment : PreferenceFragmentCompat() {
+        override fun onCreatePreferences(savedInstanceState: Bundle?, key: String?) {
+            preferenceManager.preferenceDataStore = PreferencesPreferenceDataStore(lifecycleScope, Application.getPreferencesDataStore())
+            addPreferencesFromResource(R.xml.preferences)
+            preferenceScreen.initialExpandedChildrenCount = 5
+
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU || QuickTileService.isAdded) {
+                val quickTile = preferenceManager.findPreference<Preference>("quick_tile")
+                quickTile?.parent?.removePreference(quickTile)
+                --preferenceScreen.initialExpandedChildrenCount
+            }
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                val darkTheme = preferenceManager.findPreference<Preference>("dark_theme")
+                darkTheme?.parent?.removePreference(darkTheme)
+                --preferenceScreen.initialExpandedChildrenCount
+            }
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
+                val remoteApps = preferenceManager.findPreference<Preference>("allow_remote_control_intents")
+                remoteApps?.parent?.removePreference(remoteApps)
+            }
+            if (AdminKnobs.disableConfigExport) {
+                val zipExporter = preferenceManager.findPreference<Preference>("zip_exporter")
+                zipExporter?.parent?.removePreference(zipExporter)
+            }
+            val wgQuickOnlyPrefs = arrayOf(
+                preferenceManager.findPreference("tools_installer"),
+                preferenceManager.findPreference("restore_on_boot"),
+                preferenceManager.findPreference<Preference>("multiple_tunnels")
+            ).filterNotNull()
+            wgQuickOnlyPrefs.forEach { it.isVisible = false }
+            lifecycleScope.launch {
+                if (Application.getBackend() is WgQuickBackend) {
+                    ++preferenceScreen.initialExpandedChildrenCount
+                    wgQuickOnlyPrefs.forEach { it.isVisible = true }
+                } else {
+                    wgQuickOnlyPrefs.forEach { it.parent?.removePreference(it) }
+                }
+            }
+            preferenceManager.findPreference<Preference>("log_viewer")?.setOnPreferenceClickListener {
+                startActivity(Intent(requireContext(), LogViewerActivity::class.java))
+                true
+            }
+            val kernelModuleEnabler = preferenceManager.findPreference<Preference>("kernel_module_enabler")
+            if (WgQuickBackend.hasKernelSupport()) {
+                lifecycleScope.launch {
+                    if (Application.getBackend() !is WgQuickBackend) {
+                        try {
+                            withContext(Dispatchers.IO) { Application.getRootShell().start() }
+                        } catch (_: Throwable) {
+                            kernelModuleEnabler?.parent?.removePreference(kernelModuleEnabler)
+                        }
+                    }
+                }
+            } else {
+                kernelModuleEnabler?.parent?.removePreference(kernelModuleEnabler)
+            }
+        }
+    }
+}
@@ -1,47 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.activity;
-
-import android.content.SharedPreferences;
-import android.os.Build;
-import android.os.Bundle;
-
-import com.wireguard.android.Application;
-import com.wireguard.util.NonNullForAll;
-
-import androidx.annotation.Nullable;
-import androidx.appcompat.app.AppCompatActivity;
-import androidx.appcompat.app.AppCompatDelegate;
-
-@NonNullForAll
-public abstract class ThemeChangeAwareActivity extends AppCompatActivity implements SharedPreferences.OnSharedPreferenceChangeListener {
-    private static final String TAG = "WireGuard/" + ThemeChangeAwareActivity.class.getSimpleName();
-
-    @Override
-    protected void onCreate(@Nullable final Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
-            Application.getSharedPreferences().registerOnSharedPreferenceChangeListener(this);
-    }
-
-    @Override
-    protected void onDestroy() {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
-            Application.getSharedPreferences().unregisterOnSharedPreferenceChangeListener(this);
-        super.onDestroy();
-    }
-
-    @Override
-    public void onSharedPreferenceChanged(final SharedPreferences sharedPreferences, final String key) {
-        if ("dark_theme".equals(key)) {
-            AppCompatDelegate.setDefaultNightMode(
-                    sharedPreferences.getBoolean(key, false) ?
-                            AppCompatDelegate.MODE_NIGHT_YES :
-                            AppCompatDelegate.MODE_NIGHT_NO);
-            recreate();
-        }
-    }
-}
@@ -1,37 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.activity;
-
-import android.os.Bundle;
-
-import com.wireguard.android.fragment.TunnelEditorFragment;
-import com.wireguard.android.model.ObservableTunnel;
-import com.wireguard.util.NonNullForAll;
-
-import androidx.annotation.Nullable;
-
-/**
- * Standalone activity for creating tunnels.
- */
-
-@NonNullForAll
-public class TunnelCreatorActivity extends BaseActivity {
-    @Override
-    @SuppressWarnings("UnnecessaryFullyQualifiedName")
-    protected void onCreate(@Nullable final Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        if (getSupportFragmentManager().findFragmentById(android.R.id.content) == null) {
-            getSupportFragmentManager().beginTransaction()
-                    .add(android.R.id.content, new TunnelEditorFragment())
-                    .commit();
-        }
-    }
-
-    @Override
-    protected void onSelectedTunnelChanged(@Nullable final ObservableTunnel oldTunnel, @Nullable final ObservableTunnel newTunnel) {
-        finish();
-    }
-}
@@ -0,0 +1,29 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.activity
+
+import android.os.Bundle
+import androidx.fragment.app.commit
+import com.wireguard.android.fragment.TunnelEditorFragment
+import com.wireguard.android.model.ObservableTunnel
+
+/**
+ * Standalone activity for creating tunnels.
+ */
+class TunnelCreatorActivity : BaseActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        if (supportFragmentManager.findFragmentById(android.R.id.content) == null) {
+            supportFragmentManager.commit {
+                add(android.R.id.content, TunnelEditorFragment())
+            }
+        }
+    }
+
+    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?): Boolean {
+        finish()
+        return true
+    }
+}
@@ -1,53 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.activity;
-
-import android.content.ComponentName;
-import android.os.Build;
-import android.os.Bundle;
-import android.service.quicksettings.TileService;
-import android.util.Log;
-import android.widget.Toast;
-
-import com.wireguard.android.Application;
-import com.wireguard.android.QuickTileService;
-import com.wireguard.android.R;
-import com.wireguard.android.backend.Tunnel.State;
-import com.wireguard.android.model.ObservableTunnel;
-import com.wireguard.android.util.ErrorMessages;
-import com.wireguard.util.NonNullForAll;
-
-import androidx.annotation.Nullable;
-import androidx.annotation.RequiresApi;
-import androidx.appcompat.app.AppCompatActivity;
-
-@RequiresApi(Build.VERSION_CODES.N)
-@NonNullForAll
-public class TunnelToggleActivity extends AppCompatActivity {
-    private static final String TAG = "WireGuard/" + TunnelToggleActivity.class.getSimpleName();
-
-    @Override
-    protected void onCreate(@Nullable final Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        final ObservableTunnel tunnel = Application.getTunnelManager().getLastUsedTunnel();
-        if (tunnel == null)
-            return;
-        tunnel.setState(State.TOGGLE).whenComplete((v, t) -> {
-            TileService.requestListeningState(this, new ComponentName(this, QuickTileService.class));
-            onToggleFinished(t);
-            finishAffinity();
-        });
-    }
-
-    private void onToggleFinished(@Nullable final Throwable throwable) {
-        if (throwable == null)
-            return;
-        final String error = ErrorMessages.get(throwable);
-        final String message = getString(R.string.toggle_error, error);
-        Log.e(TAG, message, throwable);
-        Toast.makeText(this, message, Toast.LENGTH_LONG).show();
-    }
-}
@@ -0,0 +1,66 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.activity
+
+import android.content.ComponentName
+import android.os.Build
+import android.os.Bundle
+import android.service.quicksettings.TileService
+import android.util.Log
+import android.widget.Toast
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.annotation.RequiresApi
+import androidx.appcompat.app.AppCompatActivity
+import androidx.lifecycle.lifecycleScope
+import com.wireguard.android.Application
+import com.wireguard.android.QuickTileService
+import com.wireguard.android.R
+import com.wireguard.android.backend.GoBackend
+import com.wireguard.android.backend.Tunnel
+import com.wireguard.android.util.ErrorMessages
+import kotlinx.coroutines.launch
+
+@RequiresApi(Build.VERSION_CODES.N)
+class TunnelToggleActivity : AppCompatActivity() {
+    private val permissionActivityResultLauncher =
+        registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { toggleTunnelWithPermissionsResult() }
+
+    private fun toggleTunnelWithPermissionsResult() {
+        val tunnel = Application.getTunnelManager().lastUsedTunnel ?: return
+        lifecycleScope.launch {
+            try {
+                tunnel.setStateAsync(Tunnel.State.TOGGLE)
+            } catch (e: Throwable) {
+                TileService.requestListeningState(this@TunnelToggleActivity, ComponentName(this@TunnelToggleActivity, QuickTileService::class.java))
+                val error = ErrorMessages[e]
+                val message = getString(R.string.toggle_error, error)
+                Log.e(TAG, message, e)
+                Toast.makeText(this@TunnelToggleActivity, message, Toast.LENGTH_LONG).show()
+                finishAffinity()
+                return@launch
+            }
+            TileService.requestListeningState(this@TunnelToggleActivity, ComponentName(this@TunnelToggleActivity, QuickTileService::class.java))
+            finishAffinity()
+        }
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        lifecycleScope.launch {
+            if (Application.getBackend() is GoBackend) {
+                val intent = GoBackend.VpnService.prepare(this@TunnelToggleActivity)
+                if (intent != null) {
+                    permissionActivityResultLauncher.launch(intent)
+                    return@launch
+                }
+            }
+            toggleTunnelWithPermissionsResult()
+        }
+    }
+
+    companion object {
+        private const val TAG = "WireGuard/TunnelToggleActivity"
+    }
+}
@@ -0,0 +1,445 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.activity
+
+import android.Manifest
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Build
+import android.os.Bundle
+import android.os.Environment
+import android.os.storage.StorageManager
+import android.os.storage.StorageVolume
+import android.util.Log
+import android.view.View
+import android.widget.Toast
+import androidx.activity.addCallback
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.appcompat.app.AppCompatActivity
+import androidx.appcompat.app.AppCompatDelegate
+import androidx.core.content.ContextCompat
+import androidx.core.content.getSystemService
+import androidx.core.view.forEach
+import androidx.databinding.DataBindingUtil
+import androidx.databinding.Observable
+import androidx.databinding.ObservableBoolean
+import androidx.databinding.ObservableField
+import androidx.lifecycle.lifecycleScope
+import androidx.recyclerview.widget.GridLayoutManager
+import androidx.recyclerview.widget.GridLayoutManager.SpanSizeLookup
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
+import com.wireguard.android.Application
+import com.wireguard.android.R
+import com.wireguard.android.backend.GoBackend
+import com.wireguard.android.backend.Tunnel
+import com.wireguard.android.databinding.Keyed
+import com.wireguard.android.databinding.ObservableKeyedArrayList
+import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter
+import com.wireguard.android.databinding.TvActivityBinding
+import com.wireguard.android.databinding.TvFileListItemBinding
+import com.wireguard.android.databinding.TvTunnelListItemBinding
+import com.wireguard.android.model.ObservableTunnel
+import com.wireguard.android.util.ErrorMessages
+import com.wireguard.android.util.QuantityFormatter
+import com.wireguard.android.util.TunnelImporter
+import com.wireguard.android.util.UserKnobs
+import com.wireguard.android.util.applicationScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import java.io.File
+
+class TvMainActivity : AppCompatActivity() {
+    private val tunnelFileImportResultLauncher = registerForActivityResult(object : ActivityResultContracts.GetContent() {
+        override fun createIntent(context: Context, input: String): Intent {
+            val intent = super.createIntent(context, input)
+
+            /* AndroidTV now comes with stubs that do nothing but display a Toast less helpful than
+             * what we can do, so detect this and throw an exception that we can catch later. */
+            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
+            } else {
+                @Suppress("DEPRECATION")
+                context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
+            }
+            if (activitiesToResolveIntent.all {
+                    val name = it.activityInfo.packageName
+                    name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
+                }) {
+                throw ActivityNotFoundException()
+            }
+            return intent
+        }
+    }) { data ->
+        if (data == null) return@registerForActivityResult
+        lifecycleScope.launch {
+            TunnelImporter.importTunnel(contentResolver, data) {
+                Toast.makeText(this@TvMainActivity, it, Toast.LENGTH_LONG).show()
+            }
+        }
+    }
+    private var pendingTunnel: ObservableTunnel? = null
+    private val permissionActivityResultLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) {
+        val tunnel = pendingTunnel
+        if (tunnel != null)
+            setTunnelStateWithPermissionsResult(tunnel)
+        pendingTunnel = null
+    }
+
+    private fun setTunnelStateWithPermissionsResult(tunnel: ObservableTunnel) {
+        lifecycleScope.launch {
+            try {
+                tunnel.setStateAsync(Tunnel.State.TOGGLE)
+            } catch (e: Throwable) {
+                val error = ErrorMessages[e]
+                val message = getString(R.string.error_up, error)
+                Toast.makeText(this@TvMainActivity, message, Toast.LENGTH_LONG).show()
+                Log.e(TAG, message, e)
+            }
+            updateStats()
+        }
+    }
+
+    private lateinit var binding: TvActivityBinding
+    private val isDeleting = ObservableBoolean()
+    private val files = ObservableKeyedArrayList<String, KeyedFile>()
+    private val filesRoot = ObservableField("")
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        if (AppCompatDelegate.getDefaultNightMode() != AppCompatDelegate.MODE_NIGHT_YES) {
+            AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_YES)
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+                applicationScope.launch {
+                    UserKnobs.setDarkTheme(true)
+                }
+            }
+        }
+        super.onCreate(savedInstanceState)
+        binding = TvActivityBinding.inflate(layoutInflater)
+        lifecycleScope.launch {
+            binding.tunnels = Application.getTunnelManager().getTunnels()
+            if (binding.tunnels?.isEmpty() == true)
+                binding.importButton.requestFocus()
+            else
+                binding.tunnelList.requestFocus()
+        }
+        binding.isDeleting = isDeleting
+        binding.files = files
+        binding.filesRoot = filesRoot
+        val gridManager = binding.tunnelList.layoutManager as GridLayoutManager
+        gridManager.spanSizeLookup = SlatedSpanSizeLookup(gridManager)
+        binding.tunnelRowConfigurationHandler = object : ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler<TvTunnelListItemBinding, ObservableTunnel> {
+            override fun onConfigureRow(binding: TvTunnelListItemBinding, item: ObservableTunnel, position: Int) {
+                binding.isDeleting = isDeleting
+                binding.isFocused = ObservableBoolean()
+                binding.root.setOnFocusChangeListener { _, focused ->
+                    binding.isFocused?.set(focused)
+                }
+                binding.root.setOnClickListener {
+                    lifecycleScope.launch {
+                        if (isDeleting.get()) {
+                            try {
+                                item.deleteAsync()
+                                if (this@TvMainActivity.binding.tunnels?.isEmpty() != false)
+                                    isDeleting.set(false)
+                            } catch (e: Throwable) {
+                                val error = ErrorMessages[e]
+                                val message = getString(R.string.config_delete_error, error)
+                                Toast.makeText(this@TvMainActivity, message, Toast.LENGTH_LONG).show()
+                                Log.e(TAG, message, e)
+                            }
+                        } else {
+                            if (Application.getBackend() is GoBackend) {
+                                val intent = GoBackend.VpnService.prepare(binding.root.context)
+                                if (intent != null) {
+                                    pendingTunnel = item
+                                    permissionActivityResultLauncher.launch(intent)
+                                    return@launch
+                                }
+                            }
+                            setTunnelStateWithPermissionsResult(item)
+                        }
+                    }
+                }
+            }
+        }
+
+        binding.filesRowConfigurationHandler = object : ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler<TvFileListItemBinding, KeyedFile> {
+            override fun onConfigureRow(binding: TvFileListItemBinding, item: KeyedFile, position: Int) {
+                binding.root.setOnClickListener {
+                    if (item.file.isDirectory)
+                        navigateTo(item.file)
+                    else {
+                        val uri = Uri.fromFile(item.file)
+                        files.clear()
+                        filesRoot.set("")
+                        lifecycleScope.launch {
+                            TunnelImporter.importTunnel(contentResolver, uri) {
+                                Toast.makeText(this@TvMainActivity, it, Toast.LENGTH_LONG).show()
+                            }
+                        }
+                        runOnUiThread {
+                            this@TvMainActivity.binding.tunnelList.requestFocus()
+                        }
+                    }
+                }
+            }
+        }
+
+        binding.importButton.setOnClickListener {
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+                if (filesRoot.get()?.isEmpty() != false) {
+                    navigateTo(File("/"))
+                    runOnUiThread {
+                        binding.filesList.requestFocus()
+                    }
+                } else {
+                    files.clear()
+                    filesRoot.set("")
+                    runOnUiThread {
+                        binding.tunnelList.requestFocus()
+                    }
+                }
+            } else {
+                try {
+                    tunnelFileImportResultLauncher.launch("*/*")
+                } catch (_: Throwable) {
+                    MaterialAlertDialogBuilder(binding.root.context).setMessage(R.string.tv_no_file_picker).setCancelable(false)
+                        .setPositiveButton(android.R.string.ok) { _, _ ->
+                            try {
+                                startActivity(Intent(Intent.ACTION_VIEW, Uri.parse("market://webstoreredirect")))
+                            } catch (_: Throwable) {
+                            }
+                        }.show()
+                }
+            }
+        }
+
+        binding.deleteButton.setOnClickListener {
+            isDeleting.set(!isDeleting.get())
+            runOnUiThread {
+                binding.tunnelList.requestFocus()
+            }
+        }
+
+        val backPressedCallback = onBackPressedDispatcher.addCallback(this) { handleBackPressed() }
+        val updateBackPressedCallback = object : Observable.OnPropertyChangedCallback() {
+            override fun onPropertyChanged(sender: Observable?, propertyId: Int) {
+                backPressedCallback.isEnabled = isDeleting.get() || filesRoot.get()?.isNotEmpty() == true
+            }
+        }
+        isDeleting.addOnPropertyChangedCallback(updateBackPressedCallback)
+        filesRoot.addOnPropertyChangedCallback(updateBackPressedCallback)
+        backPressedCallback.isEnabled = false
+
+        binding.executePendingBindings()
+        setContentView(binding.root)
+
+        lifecycleScope.launch {
+            while (true) {
+                updateStats()
+                delay(1000)
+            }
+        }
+    }
+
+    private var pendingNavigation: File? = null
+    private val permissionRequestPermissionLauncher = registerForActivityResult(ActivityResultContracts.RequestPermission()) {
+        val to = pendingNavigation
+        if (it && to != null)
+            navigateTo(to)
+        pendingNavigation = null
+    }
+
+    private var cachedRoots: Collection<KeyedFile>? = null
+
+    private suspend fun makeStorageRoots(): Collection<KeyedFile> = withContext(Dispatchers.IO) {
+        cachedRoots?.let { return@withContext it }
+        val list = HashSet<KeyedFile>()
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+            val storageManager: StorageManager = getSystemService() ?: return@withContext list
+            list.addAll(storageManager.storageVolumes.mapNotNull { volume ->
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                    volume.directory?.let { KeyedFile(it, volume.getDescription(this@TvMainActivity)) }
+                } else {
+                    KeyedFile((StorageVolume::class.java.getMethod("getPathFile").invoke(volume) as File), volume.getDescription(this@TvMainActivity))
+                }
+            })
+        } else {
+            @Suppress("DEPRECATION")
+            list.add(KeyedFile(Environment.getExternalStorageDirectory()))
+            try {
+                File("/storage").listFiles()?.forEach {
+                    if (!it.isDirectory) return@forEach
+                    try {
+                        if (Environment.isExternalStorageRemovable(it)) {
+                            list.add(KeyedFile(it))
+                        }
+                    } catch (_: Throwable) {
+                    }
+                }
+            } catch (_: Throwable) {
+            }
+        }
+        cachedRoots = list
+        list
+    }
+
+    private fun isBelowCachedRoots(maybeChild: File): Boolean {
+        val cachedRoots = cachedRoots ?: return true
+        for (root in cachedRoots) {
+            if (maybeChild.canonicalPath.startsWith(root.file.canonicalPath))
+                return false
+        }
+        return true
+    }
+
+    private fun navigateTo(directory: File) {
+        require(Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
+
+        if (ContextCompat.checkSelfPermission(this, Manifest.permission.READ_EXTERNAL_STORAGE) != PackageManager.PERMISSION_GRANTED) {
+            pendingNavigation = directory
+            permissionRequestPermissionLauncher.launch(Manifest.permission.READ_EXTERNAL_STORAGE)
+            return
+        }
+
+        lifecycleScope.launch {
+            if (isBelowCachedRoots(directory)) {
+                val roots = makeStorageRoots()
+                if (roots.count() == 1) {
+                    navigateTo(roots.first().file)
+                    return@launch
+                }
+                files.clear()
+                files.addAll(roots)
+                filesRoot.set(getString(R.string.tv_select_a_storage_drive))
+                return@launch
+            }
+
+            val newFiles = withContext(Dispatchers.IO) {
+                val newFiles = ArrayList<KeyedFile>()
+                try {
+                    directory.parentFile?.let {
+                        newFiles.add(KeyedFile(it, "../"))
+                    }
+                    val listing = directory.listFiles() ?: return@withContext null
+                    listing.forEach {
+                        if (it.extension == "conf" || it.extension == "zip" || it.isDirectory)
+                            newFiles.add(KeyedFile(it))
+                    }
+                    newFiles.sortWith { a, b ->
+                        if (a.file.isDirectory && !b.file.isDirectory) -1
+                        else if (!a.file.isDirectory && b.file.isDirectory) 1
+                        else a.file.compareTo(b.file)
+                    }
+                } catch (e: Throwable) {
+                    Log.e(TAG, Log.getStackTraceString(e))
+                }
+                newFiles
+            }
+            if (newFiles?.isEmpty() != false)
+                return@launch
+            files.clear()
+            files.addAll(newFiles)
+            filesRoot.set(directory.canonicalPath)
+        }
+    }
+
+    private fun handleBackPressed() {
+        when {
+            isDeleting.get() -> {
+                isDeleting.set(false)
+                runOnUiThread {
+                    binding.tunnelList.requestFocus()
+                }
+            }
+
+            filesRoot.get()?.isNotEmpty() == true -> {
+                files.clear()
+                filesRoot.set("")
+                runOnUiThread {
+                    binding.tunnelList.requestFocus()
+                }
+            }
+        }
+    }
+
+    private suspend fun updateStats() {
+        binding.tunnelList.forEach { viewItem ->
+            val listItem = DataBindingUtil.findBinding<TvTunnelListItemBinding>(viewItem)
+                ?: return@forEach
+            try {
+                val tunnel = listItem.item!!
+                if (tunnel.state != Tunnel.State.UP || isDeleting.get()) {
+                    throw Exception()
+                }
+                val statistics = tunnel.getStatisticsAsync()
+                val rx = statistics.totalRx()
+                val tx = statistics.totalTx()
+                listItem.tunnelTransfer.text = getString(R.string.transfer_rx_tx, QuantityFormatter.formatBytes(rx), QuantityFormatter.formatBytes(tx))
+                listItem.tunnelTransfer.visibility = View.VISIBLE
+            } catch (_: Throwable) {
+                listItem.tunnelTransfer.visibility = View.GONE
+                listItem.tunnelTransfer.text = ""
+            }
+        }
+    }
+
+    class KeyedFile(val file: File, private val forcedKey: String? = null) : Keyed<String> {
+        override val key: String
+            get() = forcedKey ?: if (file.isDirectory) "${file.name}/" else file.name
+    }
+
+    private class SlatedSpanSizeLookup(private val gridManager: GridLayoutManager) : SpanSizeLookup() {
+        private val originalHeight = gridManager.spanCount
+        private var newWidth = 0
+        private lateinit var sizeMap: Array<IntArray?>
+
+        private fun emptyUnderIndex(index: Int, size: Int): Int {
+            sizeMap[size - 1]?.let { return it[index] }
+            val sizes = IntArray(size)
+            val oh = originalHeight
+            val nw = newWidth
+            var empties = 0
+            for (i in 0 until size) {
+                val ox = (i + empties) / oh
+                val oy = (i + empties) % oh
+                var empty = 0
+                for (j in oy + 1 until oh) {
+                    val ni = nw * j + ox
+                    if (ni < size)
+                        break
+                    empty++
+                }
+                empties += empty
+                sizes[i] = empty
+            }
+            sizeMap[size - 1] = sizes
+            return sizes[index]
+        }
+
+        override fun getSpanSize(position: Int): Int {
+            if (newWidth == 0) {
+                val child = gridManager.getChildAt(0) ?: return 1
+                if (child.width == 0) return 1
+                newWidth = gridManager.width / child.width
+                sizeMap = Array(originalHeight * newWidth - 1) { null }
+            }
+            val total = gridManager.itemCount
+            if (total >= originalHeight * newWidth || total == 0)
+                return 1
+            return emptyUnderIndex(position, total) + 1
+        }
+    }
+
+    companion object {
+        private const val TAG = "WireGuard/TvMainActivity"
+    }
+}
@@ -1,21 +1,15 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
+package com.wireguard.android.configStore

-package com.wireguard.android.configStore;
-
-import com.wireguard.config.Config;
-import com.wireguard.util.NonNullForAll;
-
-import java.util.Set;
+import com.wireguard.config.Config

 /**
 * Interface for persistent storage providers for WireGuard configurations.
 */
-
-@NonNullForAll
-public interface ConfigStore {
+interface ConfigStore {
    /**
     * Create a persistent tunnel, which must have a unique name within the persistent storage
     * medium.
@@ -24,46 +18,51 @@ public interface ConfigStore {
     * @param config Configuration for the new tunnel.
     * @return The configuration that was actually saved to persistent storage.
     */
-    Config create(final String name, final Config config) throws Exception;
+    @Throws(Exception::class)
+    fun create(name: String, config: Config): Config

    /**
     * Delete a persistent tunnel.
     *
     * @param name The name of the tunnel to delete.
     */
-    void delete(final String name) throws Exception;
+    @Throws(Exception::class)
+    fun delete(name: String)

    /**
     * Enumerate the names of tunnels present in persistent storage.
     *
     * @return The set of present tunnel names.
     */
-    Set<String> enumerate();
+    fun enumerate(): Set<String>

    /**
-     * Load the configuration for the tunnel given by {@code name}.
+     * Load the configuration for the tunnel given by `name`.
     *
     * @param name The identifier for the configuration in persistent storage (i.e. the name of the
-     *             tunnel).
+     * tunnel).
     * @return An in-memory representation of the configuration loaded from persistent storage.
     */
-    Config load(final String name) throws Exception;
+    @Throws(Exception::class)
+    fun load(name: String): Config

    /**
-     * Rename the configuration for the tunnel given by {@code name}.
+     * Rename the configuration for the tunnel given by `name`.
     *
     * @param name        The identifier for the existing configuration in persistent storage.
     * @param replacement The new identifier for the configuration in persistent storage.
     */
-    void rename(String name, String replacement) throws Exception;
+    @Throws(Exception::class)
+    fun rename(name: String, replacement: String)

    /**
-     * Save the configuration for an existing tunnel given by {@code name}.
+     * Save the configuration for an existing tunnel given by `name`.
     *
     * @param name   The identifier for the configuration in persistent storage (i.e. the name of
-     *               the tunnel).
+     * the tunnel).
     * @param config An updated configuration object for the tunnel.
     * @return The configuration that was actually saved to persistent storage.
     */
-    Config save(final String name, final Config config) throws Exception;
+    @Throws(Exception::class)
+    fun save(name: String, config: Config): Config
 }
@@ -1,105 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.configStore;
-
-import android.content.Context;
-import android.util.Log;
-
-import com.wireguard.android.R;
-import com.wireguard.config.BadConfigException;
-import com.wireguard.config.Config;
-import com.wireguard.util.NonNullForAll;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Set;
-
-import java9.util.stream.Collectors;
-import java9.util.stream.Stream;
-
-/**
- * Configuration store that uses a {@code wg-quick}-style file for each configured tunnel.
- */
-
-@NonNullForAll
-public final class FileConfigStore implements ConfigStore {
-    private static final String TAG = "WireGuard/" + FileConfigStore.class.getSimpleName();
-
-    private final Context context;
-
-    public FileConfigStore(final Context context) {
-        this.context = context;
-    }
-
-    @Override
-    public Config create(final String name, final Config config) throws IOException {
-        Log.d(TAG, "Creating configuration for tunnel " + name);
-        final File file = fileFor(name);
-        if (!file.createNewFile())
-            throw new IOException(context.getString(R.string.config_file_exists_error, file.getName()));
-        try (final FileOutputStream stream = new FileOutputStream(file, false)) {
-            stream.write(config.toWgQuickString().getBytes(StandardCharsets.UTF_8));
-        }
-        return config;
-    }
-
-    @Override
-    public void delete(final String name) throws IOException {
-        Log.d(TAG, "Deleting configuration for tunnel " + name);
-        final File file = fileFor(name);
-        if (!file.delete())
-            throw new IOException(context.getString(R.string.config_delete_error, file.getName()));
-    }
-
-    @Override
-    public Set<String> enumerate() {
-        return Stream.of(context.fileList())
-                .filter(name -> name.endsWith(".conf"))
-                .map(name -> name.substring(0, name.length() - ".conf".length()))
-                .collect(Collectors.toUnmodifiableSet());
-    }
-
-    private File fileFor(final String name) {
-        return new File(context.getFilesDir(), name + ".conf");
-    }
-
-    @Override
-    public Config load(final String name) throws BadConfigException, IOException {
-        try (final FileInputStream stream = new FileInputStream(fileFor(name))) {
-            return Config.parse(stream);
-        }
-    }
-
-    @Override
-    public void rename(final String name, final String replacement) throws IOException {
-        Log.d(TAG, "Renaming configuration for tunnel " + name + " to " + replacement);
-        final File file = fileFor(name);
-        final File replacementFile = fileFor(replacement);
-        if (!replacementFile.createNewFile())
-            throw new IOException(context.getString(R.string.config_exists_error, replacement));
-        if (!file.renameTo(replacementFile)) {
-            if (!replacementFile.delete())
-                Log.w(TAG, "Couldn't delete marker file for new name " + replacement);
-            throw new IOException(context.getString(R.string.config_rename_error, file.getName()));
-        }
-    }
-
-    @Override
-    public Config save(final String name, final Config config) throws IOException {
-        Log.d(TAG, "Saving configuration for tunnel " + name);
-        final File file = fileFor(name);
-        if (!file.isFile())
-            throw new FileNotFoundException(context.getString(R.string.config_not_found_error, file.getName()));
-        try (final FileOutputStream stream = new FileOutputStream(file, false)) {
-            stream.write(config.toWgQuickString().getBytes(StandardCharsets.UTF_8));
-        }
-        return config;
-    }
-}
@@ -0,0 +1,82 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.configStore
+
+import android.content.Context
+import android.util.Log
+import com.wireguard.android.R
+import com.wireguard.config.BadConfigException
+import com.wireguard.config.Config
+import java.io.File
+import java.io.FileInputStream
+import java.io.FileNotFoundException
+import java.io.FileOutputStream
+import java.io.IOException
+import java.nio.charset.StandardCharsets
+
+/**
+ * Configuration store that uses a `wg-quick`-style file for each configured tunnel.
+ */
+class FileConfigStore(private val context: Context) : ConfigStore {
+    @Throws(IOException::class)
+    override fun create(name: String, config: Config): Config {
+        Log.d(TAG, "Creating configuration for tunnel $name")
+        val file = fileFor(name)
+        if (!file.createNewFile())
+            throw IOException(context.getString(R.string.config_file_exists_error, file.name))
+        FileOutputStream(file, false).use { it.write(config.toWgQuickString().toByteArray(StandardCharsets.UTF_8)) }
+        return config
+    }
+
+    @Throws(IOException::class)
+    override fun delete(name: String) {
+        Log.d(TAG, "Deleting configuration for tunnel $name")
+        val file = fileFor(name)
+        if (!file.delete())
+            throw IOException(context.getString(R.string.config_delete_error, file.name))
+    }
+
+    override fun enumerate(): Set<String> {
+        return context.fileList()
+            .filter { it.endsWith(".conf") }
+            .map { it.substring(0, it.length - ".conf".length) }
+            .toSet()
+    }
+
+    private fun fileFor(name: String): File {
+        return File(context.filesDir, "$name.conf")
+    }
+
+    @Throws(BadConfigException::class, IOException::class)
+    override fun load(name: String): Config {
+        FileInputStream(fileFor(name)).use { stream -> return Config.parse(stream) }
+    }
+
+    @Throws(IOException::class)
+    override fun rename(name: String, replacement: String) {
+        Log.d(TAG, "Renaming configuration for tunnel $name to $replacement")
+        val file = fileFor(name)
+        val replacementFile = fileFor(replacement)
+        if (!replacementFile.createNewFile()) throw IOException(context.getString(R.string.config_exists_error, replacement))
+        if (!file.renameTo(replacementFile)) {
+            if (!replacementFile.delete()) Log.w(TAG, "Couldn't delete marker file for new name $replacement")
+            throw IOException(context.getString(R.string.config_rename_error, file.name))
+        }
+    }
+
+    @Throws(IOException::class)
+    override fun save(name: String, config: Config): Config {
+        Log.d(TAG, "Saving configuration for tunnel $name")
+        val file = fileFor(name)
+        if (!file.isFile)
+            throw FileNotFoundException(context.getString(R.string.config_not_found_error, file.name))
+        FileOutputStream(file, false).use { stream -> stream.write(config.toWgQuickString().toByteArray(StandardCharsets.UTF_8)) }
+        return config
+    }
+
+    companion object {
+        private const val TAG = "WireGuard/FileConfigStore"
+    }
+}
@@ -1,150 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.databinding;
-
-import android.text.InputFilter;
-import android.view.LayoutInflater;
-import android.widget.LinearLayout;
-import android.widget.TextView;
-
-import com.wireguard.android.BR;
-import com.wireguard.android.R;
-import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler;
-import com.wireguard.android.util.ObservableKeyedList;
-import com.wireguard.android.widget.ToggleSwitch;
-import com.wireguard.android.widget.ToggleSwitch.OnBeforeCheckedChangeListener;
-import com.wireguard.config.Attribute;
-import com.wireguard.config.InetNetwork;
-import com.wireguard.util.Keyed;
-import com.wireguard.util.NonNullForAll;
-
-import androidx.annotation.Nullable;
-import androidx.databinding.BindingAdapter;
-import androidx.databinding.DataBindingUtil;
-import androidx.databinding.ObservableList;
-import androidx.databinding.ViewDataBinding;
-import androidx.databinding.adapters.ListenerUtil;
-import androidx.recyclerview.widget.LinearLayoutManager;
-import androidx.recyclerview.widget.RecyclerView;
-import java9.util.Optional;
-
-/**
- * Static methods for use by generated code in the Android data binding library.
- */
-
-@SuppressWarnings("unused")
-@NonNullForAll
-public final class BindingAdapters {
-    private BindingAdapters() {
-        // Prevent instantiation.
-    }
-
-    @BindingAdapter("checked")
-    public static void setChecked(final ToggleSwitch view, final boolean checked) {
-        view.setCheckedInternal(checked);
-    }
-
-    @BindingAdapter("filter")
-    public static void setFilter(final TextView view, final InputFilter filter) {
-        view.setFilters(new InputFilter[]{filter});
-    }
-
-    @BindingAdapter({"items", "layout"})
-    public static <E>
-    void setItems(final LinearLayout view,
-                  @Nullable final ObservableList<E> oldList, final int oldLayoutId,
-                  @Nullable final ObservableList<E> newList, final int newLayoutId) {
-        if (oldList == newList && oldLayoutId == newLayoutId)
-            return;
-        ItemChangeListener<E> listener = ListenerUtil.getListener(view, R.id.item_change_listener);
-        // If the layout changes, any existing listener must be replaced.
-        if (listener != null && oldList != null && oldLayoutId != newLayoutId) {
-            listener.setList(null);
-            listener = null;
-            // Stop tracking the old listener.
-            ListenerUtil.trackListener(view, null, R.id.item_change_listener);
-        }
-        // Avoid adding a listener when there is no new list or layout.
-        if (newList == null || newLayoutId == 0)
-            return;
-        if (listener == null) {
-            listener = new ItemChangeListener<>(view, newLayoutId);
-            ListenerUtil.trackListener(view, listener, R.id.item_change_listener);
-        }
-        // Either the list changed, or this is an entirely new listener because the layout changed.
-        listener.setList(newList);
-    }
-
-    @BindingAdapter({"items", "layout"})
-    public static <E>
-    void setItems(final LinearLayout view,
-                  @Nullable final Iterable<E> oldList, final int oldLayoutId,
-                  @Nullable final Iterable<E> newList, final int newLayoutId) {
-        if (oldList == newList && oldLayoutId == newLayoutId)
-            return;
-        view.removeAllViews();
-        if (newList == null)
-            return;
-        final LayoutInflater layoutInflater = LayoutInflater.from(view.getContext());
-        for (final E item : newList) {
-            final ViewDataBinding binding =
-                    DataBindingUtil.inflate(layoutInflater, newLayoutId, view, false);
-            binding.setVariable(BR.collection, newList);
-            binding.setVariable(BR.item, item);
-            binding.executePendingBindings();
-            view.addView(binding.getRoot());
-        }
-    }
-
-    @BindingAdapter(requireAll = false, value = {"items", "layout", "configurationHandler"})
-    public static <K, E extends Keyed<? extends K>>
-    void setItems(final RecyclerView view,
-                  @Nullable final ObservableKeyedList<K, E> oldList, final int oldLayoutId,
-                  final RowConfigurationHandler oldRowConfigurationHandler,
-                  @Nullable final ObservableKeyedList<K, E> newList, final int newLayoutId,
-                  final RowConfigurationHandler newRowConfigurationHandler) {
-        if (view.getLayoutManager() == null)
-            view.setLayoutManager(new LinearLayoutManager(view.getContext(), RecyclerView.VERTICAL, false));
-
-        if (oldList == newList && oldLayoutId == newLayoutId)
-            return;
-        // The ListAdapter interface is not generic, so this cannot be checked.
-        @SuppressWarnings("unchecked") ObservableKeyedRecyclerViewAdapter<K, E> adapter =
-                (ObservableKeyedRecyclerViewAdapter<K, E>) view.getAdapter();
-        // If the layout changes, any existing adapter must be replaced.
-        if (adapter != null && oldList != null && oldLayoutId != newLayoutId) {
-            adapter.setList(null);
-            adapter = null;
-        }
-        // Avoid setting an adapter when there is no new list or layout.
-        if (newList == null || newLayoutId == 0)
-            return;
-        if (adapter == null) {
-            adapter = new ObservableKeyedRecyclerViewAdapter<>(view.getContext(), newLayoutId, newList);
-            view.setAdapter(adapter);
-        }
-
-        adapter.setRowConfigurationHandler(newRowConfigurationHandler);
-        // Either the list changed, or this is an entirely new listener because the layout changed.
-        adapter.setList(newList);
-    }
-
-    @BindingAdapter("onBeforeCheckedChanged")
-    public static void setOnBeforeCheckedChanged(final ToggleSwitch view,
-                                                 final OnBeforeCheckedChangeListener listener) {
-        view.setOnBeforeCheckedChangeListener(listener);
-    }
-
-    @BindingAdapter("android:text")
-    public static void setText(final TextView view, final Optional<?> text) {
-        view.setText(text.map(Object::toString).orElse(""));
-    }
-
-    @BindingAdapter("android:text")
-    public static void setText(final TextView view, @Nullable final Iterable<InetNetwork> networks) {
-        view.setText(networks != null ? Attribute.join(networks) : "");
-    }
-}
@@ -0,0 +1,194 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.databinding
+
+import android.text.InputFilter
+import android.view.LayoutInflater
+import android.view.View
+import android.widget.EditText
+import android.widget.LinearLayout
+import android.widget.TextView
+import androidx.databinding.BindingAdapter
+import androidx.databinding.DataBindingUtil
+import androidx.databinding.ObservableList
+import androidx.databinding.ViewDataBinding
+import androidx.databinding.adapters.ListenerUtil
+import androidx.fragment.app.Fragment
+import androidx.recyclerview.widget.LinearLayoutManager
+import androidx.recyclerview.widget.RecyclerView
+import com.wireguard.android.BR
+import com.wireguard.android.R
+import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler
+import com.wireguard.android.widget.ToggleSwitch
+import com.wireguard.android.widget.ToggleSwitch.OnBeforeCheckedChangeListener
+import com.wireguard.android.widget.TvCardView
+import com.wireguard.config.Attribute
+import com.wireguard.config.InetNetwork
+import java.net.InetAddress
+import java.util.Optional
+
+/**
+ * Static methods for use by generated code in the Android data binding library.
+ */
+object BindingAdapters {
+    @JvmStatic
+    @BindingAdapter("checked")
+    fun setChecked(view: ToggleSwitch, checked: Boolean) {
+        view.setCheckedInternal(checked)
+    }
+
+    @JvmStatic
+    @BindingAdapter("filter")
+    fun setFilter(view: TextView, filter: InputFilter) {
+        view.filters = arrayOf(filter)
+    }
+
+    @JvmStatic
+    @BindingAdapter("items", "layout", "fragment")
+    fun <E> setItems(
+        view: LinearLayout,
+        oldList: ObservableList<E>?, oldLayoutId: Int, @Suppress("UNUSED_PARAMETER") oldFragment: Fragment?,
+        newList: ObservableList<E>?, newLayoutId: Int, newFragment: Fragment?
+    ) {
+        if (oldList === newList && oldLayoutId == newLayoutId)
+            return
+        var listener: ItemChangeListener<E>? = ListenerUtil.getListener(view, R.id.item_change_listener)
+        // If the layout changes, any existing listener must be replaced.
+        if (listener != null && oldList != null && oldLayoutId != newLayoutId) {
+            listener.setList(null)
+            listener = null
+            // Stop tracking the old listener.
+            ListenerUtil.trackListener<Any?>(view, null, R.id.item_change_listener)
+        }
+        // Avoid adding a listener when there is no new list or layout.
+        if (newList == null || newLayoutId == 0)
+            return
+        if (listener == null) {
+            listener = ItemChangeListener(view, newLayoutId, newFragment)
+            ListenerUtil.trackListener(view, listener, R.id.item_change_listener)
+        }
+        // Either the list changed, or this is an entirely new listener because the layout changed.
+        listener.setList(newList)
+    }
+
+    @JvmStatic
+    @BindingAdapter("items", "layout")
+    fun <E> setItems(
+        view: LinearLayout,
+        oldList: Iterable<E>?, oldLayoutId: Int,
+        newList: Iterable<E>?, newLayoutId: Int
+    ) {
+        if (oldList === newList && oldLayoutId == newLayoutId)
+            return
+        view.removeAllViews()
+        if (newList == null)
+            return
+        val layoutInflater = LayoutInflater.from(view.context)
+        for (item in newList) {
+            val binding = DataBindingUtil.inflate<ViewDataBinding>(layoutInflater, newLayoutId, view, false)
+            binding.setVariable(BR.collection, newList)
+            binding.setVariable(BR.item, item)
+            binding.executePendingBindings()
+            view.addView(binding.root)
+        }
+    }
+
+    @JvmStatic
+    @BindingAdapter(requireAll = false, value = ["items", "layout", "configurationHandler"])
+    fun <K, E : Keyed<out K>> setItems(
+        view: RecyclerView,
+        oldList: ObservableKeyedArrayList<K, E>?, oldLayoutId: Int,
+        @Suppress("UNUSED_PARAMETER") oldRowConfigurationHandler: RowConfigurationHandler<*, *>?,
+        newList: ObservableKeyedArrayList<K, E>?, newLayoutId: Int,
+        newRowConfigurationHandler: RowConfigurationHandler<*, *>?
+    ) {
+        if (view.layoutManager == null)
+            view.layoutManager = LinearLayoutManager(view.context, RecyclerView.VERTICAL, false)
+        if (oldList === newList && oldLayoutId == newLayoutId)
+            return
+        // The ListAdapter interface is not generic, so this cannot be checked.
+        @Suppress("UNCHECKED_CAST") var adapter = view.adapter as? ObservableKeyedRecyclerViewAdapter<K, E>?
+        // If the layout changes, any existing adapter must be replaced.
+        if (adapter != null && oldList != null && oldLayoutId != newLayoutId) {
+            adapter.setList(null)
+            adapter = null
+        }
+        // Avoid setting an adapter when there is no new list or layout.
+        if (newList == null || newLayoutId == 0)
+            return
+        if (adapter == null) {
+            adapter = ObservableKeyedRecyclerViewAdapter(view.context, newLayoutId, newList)
+            view.adapter = adapter
+        }
+        adapter.setRowConfigurationHandler(newRowConfigurationHandler)
+        // Either the list changed, or this is an entirely new listener because the layout changed.
+        adapter.setList(newList)
+    }
+
+    @JvmStatic
+    @BindingAdapter("onBeforeCheckedChanged")
+    fun setOnBeforeCheckedChanged(
+        view: ToggleSwitch,
+        listener: OnBeforeCheckedChangeListener?
+    ) {
+        view.setOnBeforeCheckedChangeListener(listener)
+    }
+
+    @JvmStatic
+    @BindingAdapter("onFocusChange")
+    fun setOnFocusChange(
+        view: EditText,
+        listener: View.OnFocusChangeListener?
+    ) {
+        view.onFocusChangeListener = listener
+    }
+
+    @JvmStatic
+    @BindingAdapter("android:text")
+    fun setOptionalText(view: TextView, text: Optional<*>?) {
+        view.text = text?.map { it.toString() }?.orElse("") ?: ""
+    }
+
+    @JvmStatic
+    @BindingAdapter("android:text")
+    fun setInetNetworkSetText(view: TextView, networks: Iterable<InetNetwork?>?) {
+        view.text = if (networks != null) Attribute.join(networks) else ""
+    }
+
+    @JvmStatic
+    @BindingAdapter("android:text")
+    fun setInetAddressSetText(view: TextView, addresses: Iterable<InetAddress?>?) {
+        view.text = if (addresses != null) Attribute.join(addresses.map { it?.hostAddress }) else ""
+    }
+
+    @JvmStatic
+    @BindingAdapter("android:text")
+    fun setStringSetText(view: TextView, strings: Iterable<String?>?) {
+        view.text = if (strings != null) Attribute.join(strings) else ""
+    }
+
+    @JvmStatic
+    fun tryParseInt(s: String?): Int {
+        if (s == null)
+            return 0
+        return try {
+            Integer.parseInt(s)
+        } catch (_: Throwable) {
+            0
+        }
+    }
+
+    @JvmStatic
+    @BindingAdapter("isUp")
+    fun setIsUp(card: TvCardView, up: Boolean) {
+        card.isUp = up
+    }
+
+    @JvmStatic
+    @BindingAdapter("isDeleting")
+    fun setIsDeleting(card: TvCardView, deleting: Boolean) {
+        card.isDeleting = deleting
+    }
+}
@@ -1,143 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.databinding;
-
-import android.view.LayoutInflater;
-import android.view.View;
-import android.view.ViewGroup;
-
-import com.wireguard.android.BR;
-import com.wireguard.util.NonNullForAll;
-
-import java.lang.ref.WeakReference;
-import java.util.Objects;
-
-import androidx.annotation.Nullable;
-import androidx.databinding.DataBindingUtil;
-import androidx.databinding.ObservableList;
-import androidx.databinding.ViewDataBinding;
-
-/**
- * Helper class for binding an ObservableList to the children of a ViewGroup.
- */
-
-@NonNullForAll
-class ItemChangeListener<T> {
-    private final OnListChangedCallback<T> callback = new OnListChangedCallback<>(this);
-    private final ViewGroup container;
-    private final int layoutId;
-    private final LayoutInflater layoutInflater;
-    @Nullable private ObservableList<T> list;
-
-    ItemChangeListener(final ViewGroup container, final int layoutId) {
-        this.container = container;
-        this.layoutId = layoutId;
-        layoutInflater = LayoutInflater.from(container.getContext());
-    }
-
-    private View getView(final int position, @Nullable final View convertView) {
-        ViewDataBinding binding = convertView != null ? DataBindingUtil.getBinding(convertView) : null;
-        if (binding == null) {
-            binding = DataBindingUtil.inflate(layoutInflater, layoutId, container, false);
-        }
-
-        Objects.requireNonNull(list, "Trying to get a view while list is still null");
-
-        binding.setVariable(BR.collection, list);
-        binding.setVariable(BR.item, list.get(position));
-        binding.executePendingBindings();
-        return binding.getRoot();
-    }
-
-    void setList(@Nullable final ObservableList<T> newList) {
-        if (list != null)
-            list.removeOnListChangedCallback(callback);
-        list = newList;
-        if (list != null) {
-            list.addOnListChangedCallback(callback);
-            callback.onChanged(list);
-        } else {
-            container.removeAllViews();
-        }
-    }
-
-    private static final class OnListChangedCallback<T>
-            extends ObservableList.OnListChangedCallback<ObservableList<T>> {
-
-        private final WeakReference<ItemChangeListener<T>> weakListener;
-
-        private OnListChangedCallback(final ItemChangeListener<T> listener) {
-            weakListener = new WeakReference<>(listener);
-        }
-
-        @Override
-        public void onChanged(final ObservableList<T> sender) {
-            final ItemChangeListener<T> listener = weakListener.get();
-            if (listener != null) {
-                // TODO: recycle views
-                listener.container.removeAllViews();
-                for (int i = 0; i < sender.size(); ++i)
-                    listener.container.addView(listener.getView(i, null));
-            } else {
-                sender.removeOnListChangedCallback(this);
-            }
-        }
-
-        @Override
-        public void onItemRangeChanged(final ObservableList<T> sender, final int positionStart,
-                                       final int itemCount) {
-            final ItemChangeListener<T> listener = weakListener.get();
-            if (listener != null) {
-                for (int i = positionStart; i < positionStart + itemCount; ++i) {
-                    final View child = listener.container.getChildAt(i);
-                    listener.container.removeViewAt(i);
-                    listener.container.addView(listener.getView(i, child));
-                }
-            } else {
-                sender.removeOnListChangedCallback(this);
-            }
-        }
-
-        @Override
-        public void onItemRangeInserted(final ObservableList<T> sender, final int positionStart,
-                                        final int itemCount) {
-            final ItemChangeListener<T> listener = weakListener.get();
-            if (listener != null) {
-                for (int i = positionStart; i < positionStart + itemCount; ++i)
-                    listener.container.addView(listener.getView(i, null));
-            } else {
-                sender.removeOnListChangedCallback(this);
-            }
-        }
-
-        @Override
-        public void onItemRangeMoved(final ObservableList<T> sender, final int fromPosition,
-                                     final int toPosition, final int itemCount) {
-            final ItemChangeListener<T> listener = weakListener.get();
-            if (listener != null) {
-                final View[] views = new View[itemCount];
-                for (int i = 0; i < itemCount; ++i)
-                    views[i] = listener.container.getChildAt(fromPosition + i);
-                listener.container.removeViews(fromPosition, itemCount);
-                for (int i = 0; i < itemCount; ++i)
-                    listener.container.addView(views[i], toPosition + i);
-            } else {
-                sender.removeOnListChangedCallback(this);
-            }
-        }
-
-        @Override
-        public void onItemRangeRemoved(final ObservableList<T> sender, final int positionStart,
-                                       final int itemCount) {
-            final ItemChangeListener<T> listener = weakListener.get();
-            if (listener != null) {
-                listener.container.removeViews(positionStart, itemCount);
-            } else {
-                sender.removeOnListChangedCallback(this);
-            }
-        }
-    }
-}
@@ -0,0 +1,122 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.databinding
+
+import android.view.LayoutInflater
+import android.view.View
+import android.view.ViewGroup
+import androidx.databinding.DataBindingUtil
+import androidx.databinding.ObservableList
+import androidx.databinding.ViewDataBinding
+import androidx.fragment.app.Fragment
+import com.wireguard.android.BR
+import java.lang.ref.WeakReference
+
+/**
+ * Helper class for binding an ObservableList to the children of a ViewGroup.
+ */
+internal class ItemChangeListener<T>(private val container: ViewGroup, private val layoutId: Int, private val fragment: Fragment?) {
+    private val callback = OnListChangedCallback(this)
+    private val layoutInflater: LayoutInflater = LayoutInflater.from(container.context)
+    private var list: ObservableList<T>? = null
+
+    private fun getView(position: Int, convertView: View?): View {
+        var binding = if (convertView != null) DataBindingUtil.getBinding<ViewDataBinding>(convertView) else null
+        if (binding == null) {
+            binding = DataBindingUtil.inflate(layoutInflater, layoutId, container, false)
+        }
+        require(list != null) { "Trying to get a view while list is still null" }
+        binding!!.setVariable(BR.collection, list)
+        binding.setVariable(BR.item, list!![position])
+        binding.setVariable(BR.fragment, fragment)
+        binding.executePendingBindings()
+        return binding.root
+    }
+
+    fun setList(newList: ObservableList<T>?) {
+        list?.removeOnListChangedCallback(callback)
+        list = newList
+        if (list != null) {
+            list!!.addOnListChangedCallback(callback)
+            callback.onChanged(list!!)
+        } else {
+            container.removeAllViews()
+        }
+    }
+
+    private class OnListChangedCallback<T> constructor(listener: ItemChangeListener<T>) : ObservableList.OnListChangedCallback<ObservableList<T>>() {
+        private val weakListener: WeakReference<ItemChangeListener<T>> = WeakReference(listener)
+
+        override fun onChanged(sender: ObservableList<T>) {
+            val listener = weakListener.get()
+            if (listener != null) {
+                // TODO: recycle views
+                listener.container.removeAllViews()
+                for (i in sender.indices)
+                    listener.container.addView(listener.getView(i, null))
+            } else {
+                sender.removeOnListChangedCallback(this)
+            }
+        }
+
+        override fun onItemRangeChanged(
+            sender: ObservableList<T>, positionStart: Int,
+            itemCount: Int
+        ) {
+            val listener = weakListener.get()
+            if (listener != null) {
+                for (i in positionStart until positionStart + itemCount) {
+                    val child = listener.container.getChildAt(i)
+                    listener.container.removeViewAt(i)
+                    listener.container.addView(listener.getView(i, child))
+                }
+            } else {
+                sender.removeOnListChangedCallback(this)
+            }
+        }
+
+        override fun onItemRangeInserted(
+            sender: ObservableList<T>, positionStart: Int,
+            itemCount: Int
+        ) {
+            val listener = weakListener.get()
+            if (listener != null) {
+                for (i in positionStart until positionStart + itemCount)
+                    listener.container.addView(listener.getView(i, null))
+            } else {
+                sender.removeOnListChangedCallback(this)
+            }
+        }
+
+        override fun onItemRangeMoved(
+            sender: ObservableList<T>, fromPosition: Int,
+            toPosition: Int, itemCount: Int
+        ) {
+            val listener = weakListener.get()
+            if (listener != null) {
+                val views = arrayOfNulls<View>(itemCount)
+                for (i in 0 until itemCount) views[i] = listener.container.getChildAt(fromPosition + i)
+                listener.container.removeViews(fromPosition, itemCount)
+                for (i in 0 until itemCount) listener.container.addView(views[i], toPosition + i)
+            } else {
+                sender.removeOnListChangedCallback(this)
+            }
+        }
+
+        override fun onItemRangeRemoved(
+            sender: ObservableList<T>, positionStart: Int,
+            itemCount: Int
+        ) {
+            val listener = weakListener.get()
+            if (listener != null) {
+                listener.container.removeViews(positionStart, itemCount)
+            } else {
+                sender.removeOnListChangedCallback(this)
+            }
+        }
+
+    }
+
+}
@@ -0,0 +1,12 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.databinding
+
+/**
+ * Interface for objects that have a identifying key of the given type.
+ */
+interface Keyed<K> {
+    val key: K
+}
--- a/Show More
+++ b/Show More