version: bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

.gitignore

@@ -14,5 +14,5 @@ build/
 *.dex
 *.iml
 *.jks
-keystore.properties
 gradlew.bat
+maint/

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "tunnel/tools/wireguard-tools"]
 	path = tunnel/tools/wireguard-tools
 	url = https://git.zx2c4.com/wireguard-tools
+[submodule "tunnel/tools/elf-cleaner"]
+	path = tunnel/tools/elf-cleaner
+	url = https://github.com/termux/termux-elf-cleaner

.idea/codeStyles/Project.xml

@@ -62,21 +62,10 @@
           <package name="kotlinx.android.synthetic" alias="false" withSubpackages="true" />
         </value>
       </option>
-      <option name="PACKAGES_IMPORT_LAYOUT">
-        <value>
-          <package name="" alias="false" withSubpackages="true" />
-          <package name="java" alias="false" withSubpackages="true" />
-          <package name="javax" alias="false" withSubpackages="true" />
-          <package name="kotlin" alias="false" withSubpackages="true" />
-          <package name="" alias="true" withSubpackages="true" />
-        </value>
-      </option>
       <option name="NAME_COUNT_TO_USE_STAR_IMPORT" value="10" />
       <option name="NAME_COUNT_TO_USE_STAR_IMPORT_FOR_MEMBERS" value="10" />
+      <option name="CODE_STYLE_DEFAULTS" value="KOTLIN_OFFICIAL" />
     </JetCodeStyleSettings>
-    <XML>
-      <option name="XML_LEGACY_SETTINGS_IMPORTED" value="true" />
-    </XML>
     <codeStyleSettings language="JAVA">
       <option name="METHOD_ANNOTATION_WRAP" value="0" />
       <option name="FIELD_ANNOTATION_WRAP" value="0" />
@@ -477,5 +466,9 @@
         </rules>
       </arrangement>
     </codeStyleSettings>
+    <codeStyleSettings language="kotlin">
+      <option name="CODE_STYLE_DEFAULTS" value="KOTLIN_OFFICIAL" />
+      <option name="RIGHT_MARGIN" value="160" />
+    </codeStyleSettings>
   </code_scheme>
 </component>

.idea/copyright/Default.xml

@@ -1,6 +1,6 @@
 <component name="CopyrightManager">
   <copyright>
-    <option name="notice" value="Copyright © &amp;#36;today.year WireGuard LLC. All Rights Reserved.&#10;SPDX-License-Identifier: Apache-2.0" />
+    <option name="notice" value="Copyright © 2017-&amp;#36;today.year WireGuard LLC. All Rights Reserved.&#10;SPDX-License-Identifier: Apache-2.0" />
     <option name="myName" value="Default" />
   </copyright>
 </component>

README.md

@@ -16,22 +16,22 @@ macOS users may need [flock(1)](https://github.com/discoteq/flock).
 
 ## Embedding
 
-The tunnel library is [on JCenter](https://bintray.com/wireguard/wireguard-android/wireguard-android/_latestVersion), alongside [extensive class library documentation](https://javadoc.io/doc/com.wireguard.android/tunnel).
+The tunnel library is [on Maven Central](https://search.maven.org/artifact/com.wireguard.android/tunnel), alongside [extensive class library documentation](https://javadoc.io/doc/com.wireguard.android/tunnel).
 
 ```
 implementation 'com.wireguard.android:tunnel:$wireguardTunnelVersion'
 ```
 
-The library makes use of Java 8 features, so be sure to support those in your gradle configuration with desugaring:
+The library makes use of Java 8 features, so be sure to support those in your gradle configuration with [desugaring](https://developer.android.com/studio/write/java8-support#library-desugaring):
 
 ```
 compileOptions {
-    sourceCompatibility JavaVersion.VERSION_1_8
-    targetCompatibility JavaVersion.VERSION_1_8
+    sourceCompatibility JavaVersion.VERSION_17
+    targetCompatibility JavaVersion.VERSION_17
     coreLibraryDesugaringEnabled = true
 }
 dependencies {
-    coreLibraryDesugaring "com.android.tools:desugar_jdk_libs:1.0.10"
+    coreLibraryDesugaring "com.android.tools:desugar_jdk_libs:2.0.3"
 }
 ```
 

build.gradle

@@ -1,88 +0,0 @@
-buildscript {
-    ext {
-        activityVersion = '1.2.0-beta02'
-        agpVersion = '4.1.1'
-        annotationsVersion = '1.1.0'
-        appcompatVersion = '1.2.0'
-        biometricVersion = '1.1.0-rc01'
-        collectionVersion = '1.1.0'
-        constraintLayoutVersion = '2.0.4'
-        coordinatorLayoutVersion = '1.1.0'
-        coreKtxVersion = '1.3.2'
-        coroutinesVersion = '1.4.2'
-        datastoreVersion = '1.0.0-alpha02'
-        desugarVersion = '1.0.10'
-        fragmentVersion = '1.3.0-beta02'
-        jsr305Version = '3.0.2'
-        junitVersion = '4.13.1'
-        kotlinVersion = '1.4.21'
-        lifecycleRuntimeKtxVersion = '2.3.0-beta01'
-        materialComponentsVersion = '1.3.0-alpha04'
-        preferenceVersion = '1.1.1'
-        zxingEmbeddedVersion = '3.6.0'
-
-        groupName = 'com.wireguard.android'
-    }
-    dependencies {
-        classpath "com.android.tools.build:gradle:$agpVersion"
-        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinVersion"
-    }
-    repositories {
-        google()
-        jcenter()
-    }
-}
-
-plugins {
-    id "de.undercouch.download" version "4.1.1"
-}
-
-task downloadCrowdin(type: Download) {
-	src 'https://crowdin.com/backend/download/project/wireguard.zip'
-	dest file('build/translations.zip')
-	overwrite true
-}
-
-task cleanCrowdin(type: Delete) {
-	delete 'ui/src/main/res/values-*/strings.xml'
-}
-
-task extractCrowdin(type: Copy, dependsOn: ['downloadCrowdin', 'cleanCrowdin']) {
-	mustRunAfter 'downloadCrowdin'
-	from zipTree(file('build/translations.zip'))
-	into file('build/translations')
-	doFirst {
-		delete 'build/translations'
-	}
-}
-
-task crowdin(type: Copy, dependsOn: ['extractCrowdin']) {
-    mustRunAfter 'extractCrowdin'
-    from 'build/translations/wireguard-android/ui/src/main/res'
-    into 'ui/src/main/res/'
-    doLast {
-        delete 'build/translations'
-        delete 'build/translations.zip'
-    }
-}
-
-allprojects {
-    repositories {
-        google()
-        jcenter()
-    }
-}
-
-task clean(type: Delete) {
-    delete rootProject.buildDir
-}
-
-tasks {
-    wrapper {
-        gradleVersion = "6.7.1"
-        distributionType = Wrapper.DistributionType.ALL
-        distributionSha256Sum = "22449f5231796abd892c98b2a07c9ceebe4688d192cd2d6763f8e3bf8acbedeb"
-    }
-}
-
-apply from: "version.gradle"

build.gradle.kts

@@ -0,0 +1,13 @@
+plugins {
+    alias(libs.plugins.android.application) apply false
+    alias(libs.plugins.android.library) apply false
+    alias(libs.plugins.kotlin.android) apply false
+    alias(libs.plugins.kotlin.kapt) apply false
+}
+
+tasks {
+    wrapper {
+        gradleVersion = "8.14"
+        distributionSha256Sum = "61ad310d3c7d3e5da131b76bbf22b5a4c0786e9d892dae8c1658d4b484de3caa"
+    }
+}

gradle.properties

@@ -1,30 +1,49 @@
-# Project-wide Gradle settings.
-
-# IDE (e.g. Android Studio) users:
-# Gradle settings configured through the IDE *will override*
-# any settings specified in this file.
-
-# For more details on how to configure your build environment visit
-# http://www.gradle.org/docs/current/userguide/build_environment.html
-
-# Specifies the JVM arguments used for the daemon process.
-# The setting is particularly useful for tweaking memory settings.
-android.enableJetifier=true
-android.useAndroidX=true
-org.gradle.jvmargs=-Xmx1536m
+wireguardVersionCode=517
+wireguardVersionName=1.0.20251231
+wireguardPackageName=com.wireguard.android
 
 # When configured, Gradle will run in incubating parallel mode.
 # This option should only be used with decoupled projects. More details, visit
 # http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
-# org.gradle.parallel=true
+org.gradle.parallel=true
+org.gradle.configureondemand=true
+org.gradle.caching=true
 
-# https://jakewharton.com/increased-accuracy-of-aapt2-keep-rules/
-android.useMinimalKeepRules=true
+# Enable Kotlin incremental compilation
+kotlin.incremental=true
 
-# Enable rudimentary R class namespacing where each library only contains
-# references to the resources it declares instead of declarations plus all
-# transitive dependency references.
-android.namespacedRClass=true
+# Enable AndroidX support
+android.useAndroidX=true
+
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx1536m
+
+# Turn off AP discovery in compile path to enable compile avoidance
+kapt.include.compile.classpath=false
+
+# Experimental AGP flags
+# Generate compile-time only R class for app modules.
+android.enableAppCompileTimeRClass=true
+# Keep AAPT2 daemons alive between incremental builds.
+android.keepWorkerActionServicesBetweenBuilds=true
+# Generate manifest class as a .class directly rather than a Java source file.
+android.generateManifestClass=true
+
+# Default Android build features
+# Disable resource values generation by default in libraries
+android.defaults.buildfeatures.resvalues=false
+# Disable shader compilation by default
+android.defaults.buildfeatures.shaders=false
+# Disable Android resource processing by default
+android.library.defaults.buildfeatures.androidresources=false
 
 # Suppress warnings for some features that aren't yet stabilized
-android.suppressUnsupportedOptionWarnings=android.enableR8.fullMode,android.useMinimalKeepRules,android.namespacedRClass,android.suppressUnsupportedOptionWarnings
+android.suppressUnsupportedOptionWarnings=android.keepWorkerActionServicesBetweenBuilds,\
+  android.enableAppCompileTimeRClass,\
+  android.suppressUnsupportedOptionWarnings
+
+# OSSRH sometimes struggles with slow deployments, so this makes Gradle
+# more tolerant to those delays.
+systemProp.org.gradle.internal.http.connectionTimeout=500000
+systemProp.org.gradle.internal.http.socketTimeout=500000

gradle/libs.versions.toml

@@ -0,0 +1,29 @@
+[versions]
+agp = "8.13.2"
+kotlin = "2.3.0"
+
+[libraries]
+androidx-activity-ktx = "androidx.activity:activity-ktx:1.12.2"
+androidx-annotation = "androidx.annotation:annotation:1.9.1"
+androidx-appcompat = "androidx.appcompat:appcompat:1.7.1"
+androidx-biometric = "androidx.biometric:biometric:1.1.0"
+androidx-collection = "androidx.collection:collection:1.5.0"
+androidx-constraintlayout = "androidx.constraintlayout:constraintlayout:2.2.1"
+androidx-coordinatorlayout = "androidx.coordinatorlayout:coordinatorlayout:1.3.0"
+androidx-core-ktx = "androidx.core:core-ktx:1.17.0"
+androidx-datastore-preferences = "androidx.datastore:datastore-preferences:1.2.0"
+androidx-fragment-ktx = "androidx.fragment:fragment-ktx:1.8.9"
+androidx-lifecycle-runtime-ktx = "androidx.lifecycle:lifecycle-runtime-ktx:2.10.0"
+androidx-preference-ktx = "androidx.preference:preference-ktx:1.2.1"
+desugarJdkLibs = "com.android.tools:desugar_jdk_libs:2.1.5"
+google-material = "com.google.android.material:material:1.13.0"
+jsr305 = "com.google.code.findbugs:jsr305:3.0.2"
+junit = "junit:junit:4.13.2"
+kotlinx-coroutines-android = "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.10.2"
+zxing-android-embedded = "com.journeyapps:zxing-android-embedded:4.3.0"
+
+[plugins]
+android-application = { id = "com.android.application", version.ref = "agp" }
+android-library = { id = "com.android.library", version.ref = "agp" }
+kotlin-android = { id = "org.jetbrains.kotlin.android", version.ref = "kotlin" }
+kotlin-kapt = { id = "org.jetbrains.kotlin.kapt", version.ref = "kotlin" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=22449f5231796abd892c98b2a07c9ceebe4688d192cd2d6763f8e3bf8acbedeb
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.7.1-all.zip
+distributionSha256Sum=a17ddd85a26b6a7f5ddb71ff8b05fc5104c0202c6e64782429790c933686c806
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.1.0-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -1,7 +1,7 @@
-#!/usr/bin/env sh
+#!/bin/sh
 
 #
-# Copyright 2015 the original author or authors.
+# Copyright © 2015 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,81 +15,114 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
-##
-##  Gradle start up script for UN*X
-##
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################
 
 # Attempt to set APP_HOME
+
 # Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
 done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
 
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum
 
 warn () {
     echo "$*"
-}
+} >&2
 
 die () {
     echo
     echo "$*"
     echo
     exit 1
-}
+} >&2
 
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
-  NONSTOP* )
-    nonstop=true
-    ;;
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
 esac
 
-CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
 
 
 # Determine the Java command to use to start the JVM.
 if [ -n "$JAVA_HOME" ] ; then
     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
         # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
     else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
     fi
     if [ ! -x "$JAVACMD" ] ; then
         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -98,88 +131,118 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
 else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
-fi
-
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
-
-# For Cygwin or MSYS, switch paths to Windows format before running java
-if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
-    # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
-        fi
-        i=`expr $i + 1`
-    done
-    case $i in
-        0) set -- ;;
-        1) set -- "$args0" ;;
-        2) set -- "$args0" "$args1" ;;
-        3) set -- "$args0" "$args1" "$args2" ;;
-        4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
 fi
 
-# Escape application args
-save () {
-    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
-    echo " "
-}
-APP_ARGS=`save "$@"`
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
 
-# Collect all arguments for the java command, following the shell quoting and substitution rules
-eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
 
 exec "$JAVACMD" "$@"

settings.gradle

@@ -1,2 +0,0 @@
-include ':tunnel'
-include ':ui'

settings.gradle.kts

@@ -0,0 +1,22 @@
+@file:Suppress("UnstableApiUsage")
+
+pluginManagement {
+    repositories {
+        gradlePluginPortal()
+        google()
+        mavenCentral()
+    }
+}
+
+dependencyResolutionManagement {
+    repositoriesMode = RepositoriesMode.FAIL_ON_PROJECT_REPOS
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+rootProject.name = "wireguard-android"
+
+include(":tunnel")
+include(":ui")

sync-crowdin.sh

@@ -1,4 +1,10 @@
 #!/bin/bash
+if [[ $# -ne 1 ]]; then
+	echo "Download https://crowdin.com/backend/download/project/wireguard.zip and provide path as argument"
+	exit 1
+fi
+
 set -ex
-curl -Lo - https://crowdin.com/backend/download/project/wireguard.zip | bsdtar -C ui/src/main/res -x -f - --strip-components 5 wireguard-android
+
+bsdtar -C ui/src/main/res -x -f "$1" --strip-components 5 wireguard-android
 find ui/src/main/res -name strings.xml -exec bash -c '[[ $(xmllint --xpath "count(//resources/*)" {}) -ne 0 ]] || rm -rf "$(dirname {})"' \;

tunnel/build.gradle

@@ -1,60 +0,0 @@
-apply plugin: 'com.android.library'
-
-version wireguardVersionName
-group groupName
-
-android {
-    compileSdkVersion 30
-    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_1_8
-        targetCompatibility JavaVersion.VERSION_1_8
-    }
-    defaultConfig {
-        minSdkVersion 21
-        targetSdkVersion 30
-        versionCode wireguardVersionCode
-        versionName wireguardVersionName
-    }
-    externalNativeBuild {
-        cmake {
-            path 'tools/CMakeLists.txt'
-        }
-    }
-    libraryVariants.all {
-        it.generateBuildConfigProvider.configure { enabled = false }
-    }
-    testOptions.unitTests.all {
-        testLogging {
-            events 'passed', 'skipped', 'failed', 'standardOut', 'standardError'
-        }
-    }
-    buildTypes {
-        release {
-            externalNativeBuild {
-                cmake {
-                    arguments "-DANDROID_PACKAGE_NAME=${groupName}", "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}"
-                }
-            }
-        }
-        debug {
-            externalNativeBuild {
-                cmake {
-                    arguments "-DANDROID_PACKAGE_NAME=${groupName}.debug", "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}"
-                }
-            }
-        }
-    }
-    lintOptions {
-        disable('LongLogTag')
-        disable('NewApi') // Desugaring!
-    }
-}
-
-dependencies {
-    implementation "androidx.annotation:annotation:$annotationsVersion"
-    implementation "androidx.collection:collection:$collectionVersion"
-    implementation "com.google.code.findbugs:jsr305:$jsr305Version"
-    testImplementation "junit:junit:$junitVersion"
-}
-
-apply from: "publish.gradle"

tunnel/build.gradle.kts

@@ -0,0 +1,143 @@
+@file:Suppress("UnstableApiUsage")
+
+import org.gradle.api.tasks.testing.logging.TestLogEvent
+import org.gradle.api.tasks.bundling.Zip
+
+val pkg: String = providers.gradleProperty("wireguardPackageName").get()
+
+plugins {
+    alias(libs.plugins.android.library)
+    `maven-publish`
+    signing
+}
+
+android {
+    compileSdk = 36
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+    namespace = "${pkg}.tunnel"
+    defaultConfig {
+        minSdk = 21
+    }
+    externalNativeBuild {
+        cmake {
+            path("tools/CMakeLists.txt")
+        }
+    }
+    testOptions.unitTests.all {
+        it.testLogging { events(TestLogEvent.PASSED, TestLogEvent.SKIPPED, TestLogEvent.FAILED) }
+    }
+    buildTypes {
+        all {
+            externalNativeBuild {
+                cmake {
+                    targets("libwg-go.so", "libwg.so", "libwg-quick.so")
+                    arguments("-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}")
+                    arguments("-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON")
+                }
+            }
+        }
+        release {
+            externalNativeBuild {
+                cmake {
+                    arguments("-DANDROID_PACKAGE_NAME=${pkg}")
+                }
+            }
+        }
+        debug {
+            externalNativeBuild {
+                cmake {
+                    arguments("-DANDROID_PACKAGE_NAME=${pkg}.debug")
+                }
+            }
+        }
+    }
+    lint {
+        disable += "LongLogTag"
+        disable += "NewApi"
+    }
+    publishing {
+        singleVariant("release") {
+            withJavadocJar()
+            withSourcesJar()
+        }
+    }
+}
+
+dependencies {
+    implementation(libs.androidx.annotation)
+    implementation(libs.androidx.collection)
+    compileOnly(libs.jsr305)
+    testImplementation(libs.junit)
+}
+
+publishing {
+    publications {
+        register<MavenPublication>("release") {
+            groupId = pkg
+            artifactId = "tunnel"
+            version = providers.gradleProperty("wireguardVersionName").get()
+            afterEvaluate {
+                from(components["release"])
+            }
+            pom {
+                name = "WireGuard Tunnel Library"
+                description = "Embeddable tunnel library for WireGuard for Android"
+                url = "https://www.wireguard.com/"
+
+                licenses {
+                    license {
+                        name = "The Apache Software License, Version 2.0"
+                        url = "http://www.apache.org/licenses/LICENSE-2.0.txt"
+                        distribution = "repo"
+                    }
+                }
+                scm {
+                    connection = "scm:git:https://git.zx2c4.com/wireguard-android"
+                    developerConnection = "scm:git:https://git.zx2c4.com/wireguard-android"
+                    url = "https://git.zx2c4.com/wireguard-android"
+                }
+                developers {
+                    organization {
+                        name = "WireGuard"
+                        url = "https://www.wireguard.com/"
+                    }
+                    developer {
+                        name = "WireGuard"
+                        email = "team@wireguard.com"
+                    }
+                }
+            }
+        }
+    }
+    repositories {
+        maven {
+            name = "SonatypeUpload"
+            setUrl(layout.buildDirectory.dir("sonatype"))
+        }
+    }
+}
+
+val releasePublication = publishing.publications.named("release").get() as MavenPublication
+val mavenGroupPath = releasePublication.groupId.replace('.', '/')
+val mavenArtifactId = releasePublication.artifactId
+val mavenVersion = releasePublication.version
+
+tasks.register<Zip>("zipReleasePublication") {
+    dependsOn(tasks.named("publishReleasePublicationToSonatypeUploadRepository"))
+    group = "distribution"
+    description = "Zips the release publication in Maven repository layout."
+
+    val sourceDir = layout.buildDirectory.dir("sonatype/${mavenGroupPath}/${mavenArtifactId}/${mavenVersion}")
+    from(sourceDir)
+    archiveFileName.set("${mavenArtifactId}-${mavenVersion}-maven.zip")
+    destinationDirectory.set(layout.buildDirectory.dir("distributions"))
+    into("${mavenGroupPath}/${mavenArtifactId}/${mavenVersion}")
+}
+
+signing {
+    useGpgCmd()
+    sign(publishing.publications)
+}

tunnel/publish.gradle

@@ -1,72 +0,0 @@
-apply plugin: 'maven-publish'
-
-afterEvaluate {
-    publishing {
-        publications {
-            release(MavenPublication) {
-                groupId = groupName
-                artifactId = 'tunnel'
-                version wireguardVersionName
-
-                artifact sourcesJar
-                artifact javadocJar
-
-                from components.getByName("release")
-
-                pom {
-                    name = 'WireGuard Tunnel Library'
-                    description = 'Embeddable tunnel library for WireGuard for Android'
-                    url = 'https://www.wireguard.com/'
-
-                    licenses {
-                        license {
-                            name = 'The Apache Software License, Version 2.0'
-                            url = 'http://www.apache.org/licenses/LICENSE-2.0.txt'
-                            distribution = 'repo'
-                        }
-                    }
-                    scm {
-                        connection = 'scm:git:https://git.zx2c4.com/wireguard-android'
-                        developerConnection = 'scm:git:https://git.zx2c4.com/wireguard-android'
-                        url = 'https://git.zx2c4.com/wireguard-android'
-                    }
-                    developers {
-                        organization {
-                            name = 'WireGuard'
-                            url = 'https://www.wireguard.com/'
-                        }
-                    }
-                }
-            }
-        }
-        repositories {
-            maven {
-                name = "bintray"
-                url = uri("https://api.bintray.com/maven/wireguard/wireguard-android/wireguard-android/;publish=1;override=0")
-                credentials {
-                    username = hasProperty('BINTRAY_USER') ? getProperty('BINTRAY_USER') : System.getenv('BINTRAY_USER')
-                    password = hasProperty('BINTRAY_KEY') ? getProperty('BINTRAY_KEY') : System.getenv('BINTRAY_KEY')
-                }
-            }
-        }
-    }
-}
-
-android.libraryVariants.all { variant ->
-    if (variant.name == 'release') {
-        task javadoc(type: Javadoc) {
-            source = variant.javaCompileProvider.get().source
-            classpath = files((android.bootClasspath.join(File.pathSeparator)))
-            classpath += variant.javaCompileProvider.get().classpath
-            title = 'Embeddable WireGuard Tunnel for Android v$wireguardVersionName'
-        }
-        task javadocJar(type: Jar, dependsOn: javadoc) {
-            archiveClassifier = 'javadoc'
-            from javadoc.destinationDir
-        }
-        task sourcesJar(type: Jar) {
-            archiveClassifier = 'sources'
-            from android.sourceSets.main.java.srcDirs
-        }
-    }
-}

tunnel/src/main/AndroidManifest.xml

@@ -1,15 +1,15 @@
 <!--
-  ~ Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+  ~ Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
   ~ SPDX-License-Identifier: Apache-2.0
   -->
 
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="com.wireguard.android.tunnel">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
 
     <application>
         <service
             android:name="com.wireguard.android.backend.GoBackend$VpnService"
-            android:permission="android.permission.BIND_VPN_SERVICE">
+            android:permission="android.permission.BIND_VPN_SERVICE"
+            android:exported="false">
             <intent-filter>
                 <action android:name="android.net.VpnService" />
             </intent-filter>

tunnel/src/main/java/com/wireguard/android/backend/Backend.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -52,6 +52,28 @@ public interface Backend {
      */
     String getVersion() throws Exception;
 
+    /**
+     * Determines whether the service is running in always-on VPN mode.
+     * In this mode the system ensures that the service is always running by restarting it when necessary,
+     * e.g. after reboot.
+     *
+     * @return A boolean indicating whether the service is running in always-on VPN mode.
+     * @throws Exception Exception raised while retrieving the always-on status.
+     */
+
+    boolean isAlwaysOn() throws Exception;
+
+    /**
+     * Determines whether the service is running in always-on VPN lockdown mode.
+     * In this mode the system ensures that the service is always running and that the apps
+     * aren't allowed to bypass the VPN.
+     *
+     * @return A boolean indicating whether the service is running in always-on VPN lockdown mode.
+     * @throws Exception Exception raised while retrieving the lockdown status.
+     */
+
+    boolean isLockdownEnabled() throws Exception;
+
     /**
      * Set the state of a tunnel, updating it's configuration. If the tunnel is already up, config
      * may update the running configuration; config may be null when setting the tunnel down.

tunnel/src/main/java/com/wireguard/android/backend/BackendException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -55,6 +55,7 @@ public final class BackendException extends Exception {
         VPN_NOT_AUTHORIZED,
         UNABLE_TO_START_VPN,
         TUN_CREATION_ERROR,
-        GO_ACTIVATION_ERROR_CODE
+        GO_ACTIVATION_ERROR_CODE,
+        DNS_RESOLUTION_FAILURE,
     }
 }

tunnel/src/main/java/com/wireguard/android/backend/GoBackend.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -16,6 +16,7 @@ import com.wireguard.android.backend.BackendException.Reason;
 import com.wireguard.android.backend.Tunnel.State;
 import com.wireguard.android.util.SharedLibraryLoader;
 import com.wireguard.config.Config;
+import com.wireguard.config.InetEndpoint;
 import com.wireguard.config.InetNetwork;
 import com.wireguard.config.Peer;
 import com.wireguard.crypto.Key;
@@ -25,9 +26,8 @@ import com.wireguard.util.NonNullForAll;
 import java.net.InetAddress;
 import java.util.Collections;
 import java.util.Set;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ExecutionException;
-import java.util.concurrent.FutureTask;
-import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 
@@ -40,9 +40,10 @@ import androidx.collection.ArraySet;
  */
 @NonNullForAll
 public final class GoBackend implements Backend {
+    private static final int DNS_RESOLUTION_RETRIES = 10;
     private static final String TAG = "WireGuard/GoBackend";
     @Nullable private static AlwaysOnCallback alwaysOnCallback;
-    private static GhettoCompletableFuture<VpnService> vpnService = new GhettoCompletableFuture<>();
+    private static CompletableFuture<VpnService> vpnService = new CompletableFuture<>();
     private final Context context;
     @Nullable private Config currentConfig;
     @Nullable private Tunnel currentTunnel;
@@ -68,7 +69,7 @@ public final class GoBackend implements Backend {
         alwaysOnCallback = cb;
     }
 
-    private static native String wgGetConfig(int handle);
+    @Nullable private static native String wgGetConfig(int handle);
 
     private static native int wgGetSocketV4(int handle);
 
@@ -115,19 +116,22 @@ public final class GoBackend implements Backend {
     @Override
     public Statistics getStatistics(final Tunnel tunnel) {
         final Statistics stats = new Statistics();
-        if (tunnel != currentTunnel) {
+        if (tunnel != currentTunnel || currentTunnelHandle == -1)
             return stats;
-        }
         final String config = wgGetConfig(currentTunnelHandle);
+        if (config == null)
+            return stats;
         Key key = null;
         long rx = 0;
         long tx = 0;
+        long latestHandshakeMSec = 0;
         for (final String line : config.split("\\n")) {
             if (line.startsWith("public_key=")) {
                 if (key != null)
-                    stats.add(key, rx, tx);
+                    stats.add(key, rx, tx, latestHandshakeMSec);
                 rx = 0;
                 tx = 0;
+                latestHandshakeMSec = 0;
                 try {
                     key = Key.fromHex(line.substring(11));
                 } catch (final KeyFormatException ignored) {
@@ -149,10 +153,26 @@ public final class GoBackend implements Backend {
                 } catch (final NumberFormatException ignored) {
                     tx = 0;
                 }
+            } else if (line.startsWith("last_handshake_time_sec=")) {
+                if (key == null)
+                    continue;
+                try {
+                    latestHandshakeMSec += Long.parseLong(line.substring(24)) * 1000;
+                } catch (final NumberFormatException ignored) {
+                    latestHandshakeMSec = 0;
+                }
+            } else if (line.startsWith("last_handshake_time_nsec=")) {
+                if (key == null)
+                    continue;
+                try {
+                    latestHandshakeMSec += Long.parseLong(line.substring(25)) / 1000000;
+                } catch (final NumberFormatException ignored) {
+                    latestHandshakeMSec = 0;
+                }
             }
         }
         if (key != null)
-            stats.add(key, rx, tx);
+            stats.add(key, rx, tx, latestHandshakeMSec);
         return stats;
     }
 
@@ -166,6 +186,24 @@ public final class GoBackend implements Backend {
         return wgVersion();
     }
 
+    /**
+     * Determines if the service is running in always-on VPN mode.
+     * @return {@link boolean} whether the service is running in always-on VPN mode.
+     */
+    @Override
+    public boolean isAlwaysOn() throws ExecutionException, InterruptedException, TimeoutException {
+        return vpnService.get(0, TimeUnit.NANOSECONDS).isAlwaysOn();
+    }
+
+    /**
+     * Determines if the service is running in always-on VPN lockdown mode.
+     * @return {@link boolean} whether the service is running in always-on VPN lockdown mode.
+     */
+    @Override
+    public boolean isLockdownEnabled() throws ExecutionException, InterruptedException, TimeoutException {
+        return vpnService.get(0, TimeUnit.NANOSECONDS).isLockdownEnabled();
+    }
+
     /**
      * Change the state of a given {@link Tunnel}, optionally applying a given {@link Config}.
      *
@@ -233,6 +271,25 @@ public final class GoBackend implements Backend {
                 return;
             }
 
+
+            dnsRetry: for (int i = 0; i < DNS_RESOLUTION_RETRIES; ++i) {
+                // Pre-resolve IPs so they're cached when building the userspace string
+                for (final Peer peer : config.getPeers()) {
+                    final InetEndpoint ep = peer.getEndpoint().orElse(null);
+                    if (ep == null)
+                        continue;
+                    if (ep.getResolved().orElse(null) == null) {
+                        if (i < DNS_RESOLUTION_RETRIES - 1) {
+                            Log.w(TAG, "DNS host \"" + ep.getHost() + "\" failed to resolve; trying again");
+                            Thread.sleep(1000);
+                            continue dnsRetry;
+                        } else
+                            throw new BackendException(Reason.DNS_RESOLUTION_FAILURE, ep.getHost());
+                    }
+                }
+                break;
+            }
+
             // Build config
             final String goConfig = config.toWgUserspaceString();
 
@@ -252,6 +309,9 @@ public final class GoBackend implements Backend {
             for (final InetAddress addr : config.getInterface().getDnsServers())
                 builder.addDnsServer(addr.getHostAddress());
 
+            for (final String dnsSearchDomain : config.getInterface().getDnsSearchDomains())
+                builder.addSearchDomain(dnsSearchDomain);
+
             boolean sawDefaultRoute = false;
             for (final Peer peer : config.getPeers()) {
                 for (final InetNetwork addr : peer.getAllowedIps()) {
@@ -278,7 +338,7 @@ public final class GoBackend implements Backend {
             try (final ParcelFileDescriptor tun = builder.establish()) {
                 if (tun == null)
                     throw new BackendException(Reason.TUN_CREATION_ERROR);
-                Log.d(TAG, "Go backend v" + wgVersion());
+                Log.d(TAG, "Go backend " + wgVersion());
                 currentTunnelHandle = wgTurnOn(tunnel.getName(), tun.detachFd(), goConfig);
             }
             if (currentTunnelHandle < 0)
@@ -294,11 +354,14 @@ public final class GoBackend implements Backend {
                 Log.w(TAG, "Tunnel already down");
                 return;
             }
-
-            wgTurnOff(currentTunnelHandle);
+            int handleToClose = currentTunnelHandle;
             currentTunnel = null;
             currentTunnelHandle = -1;
             currentConfig = null;
+            wgTurnOff(handleToClose);
+            try {
+                vpnService.get(0, TimeUnit.NANOSECONDS).stopSelf();
+            } catch (final TimeoutException ignored) { }
         }
 
         tunnel.onStateChange(state);
@@ -312,35 +375,6 @@ public final class GoBackend implements Backend {
         void alwaysOnTriggered();
     }
 
-    // TODO: When we finally drop API 21 and move to API 24, delete this and replace with the ordinary CompletableFuture.
-    private static final class GhettoCompletableFuture<V> {
-        private final LinkedBlockingQueue<V> completion = new LinkedBlockingQueue<>(1);
-        private final FutureTask<V> result = new FutureTask<>(completion::peek);
-
-        public boolean complete(final V value) {
-            final boolean offered = completion.offer(value);
-            if (offered)
-                result.run();
-            return offered;
-        }
-
-        public V get() throws ExecutionException, InterruptedException {
-            return result.get();
-        }
-
-        public V get(final long timeout, final TimeUnit unit) throws ExecutionException, InterruptedException, TimeoutException {
-            return result.get(timeout, unit);
-        }
-
-        public boolean isDone() {
-            return !completion.isEmpty();
-        }
-
-        public GhettoCompletableFuture<V> newIncompleteFuture() {
-            return new GhettoCompletableFuture<>();
-        }
-    }
-
     /**
      * {@link android.net.VpnService} implementation for {@link GoBackend}
      */

tunnel/src/main/java/com/wireguard/android/backend/Statistics.java

@@ -1,41 +1,46 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
 package com.wireguard.android.backend;
 
 import android.os.SystemClock;
-import android.util.Pair;
 
 import com.wireguard.crypto.Key;
 import com.wireguard.util.NonNullForAll;
 
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Objects;
+
+import androidx.annotation.Nullable;
 
 /**
  * Class representing transfer statistics for a {@link Tunnel} instance.
  */
 @NonNullForAll
 public class Statistics {
-    private final Map<Key, Pair<Long, Long>> peerBytes = new HashMap<>();
+    public record PeerStats(long rxBytes, long txBytes, long latestHandshakeEpochMillis) { }
+    private final Map<Key, PeerStats> stats = new HashMap<>();
     private long lastTouched = SystemClock.elapsedRealtime();
 
     Statistics() {
     }
 
     /**
-     * Add a peer and its current data usage to the internal map.
+     * Add a peer and its current stats to the internal map.
      *
-     * @param key A WireGuard public key bound to a particular peer
-     * @param rx  The received traffic for the {@link com.wireguard.config.Peer} referenced by
-     *            the provided {@link Key}. This value is in bytes
-     * @param tx  The transmitted traffic for the {@link com.wireguard.config.Peer} referenced by
-     *            the provided {@link Key}. This value is in bytes.
+     * @param key               A WireGuard public key bound to a particular peer
+     * @param rxBytes           The received traffic for the {@link com.wireguard.config.Peer} referenced by
+     *                          the provided {@link Key}. This value is in bytes
+     * @param txBytes           The transmitted traffic for the {@link com.wireguard.config.Peer} referenced by
+     *                          the provided {@link Key}. This value is in bytes.
+     * @param latestHandshake   The timestamp of the latest handshake for the {@link com.wireguard.config.Peer}
+     *                          referenced by the provided {@link Key}. The value is in epoch milliseconds.
      */
-    void add(final Key key, final long rx, final long tx) {
-        peerBytes.put(key, Pair.create(rx, tx));
+    void add(final Key key, final long rxBytes, final long txBytes, final long latestHandshake) {
+        stats.put(key, new PeerStats(rxBytes, txBytes, latestHandshake));
         lastTouched = SystemClock.elapsedRealtime();
     }
 
@@ -49,31 +54,14 @@ public class Statistics {
     }
 
     /**
-     * Get the received traffic (in bytes) for the {@link com.wireguard.config.Peer} referenced by
-     * the provided {@link Key}
+     * Get the statistics for the {@link com.wireguard.config.Peer} referenced by the provided {@link Key}
      *
      * @param peer A {@link Key} representing a {@link com.wireguard.config.Peer}.
-     * @return a long representing the number of bytes received by this peer.
+     * @return a {@link PeerStats} representing various statistics about this peer.
      */
-    public long peerRx(final Key peer) {
-        final Pair<Long, Long> rxTx = peerBytes.get(peer);
-        if (rxTx == null)
-            return 0;
-        return rxTx.first;
-    }
-
-    /**
-     * Get the transmitted traffic (in bytes) for the {@link com.wireguard.config.Peer} referenced by
-     * the provided {@link Key}
-     *
-     * @param peer A {@link Key} representing a {@link com.wireguard.config.Peer}.
-     * @return a long representing the number of bytes transmitted by this peer.
-     */
-    public long peerTx(final Key peer) {
-        final Pair<Long, Long> rxTx = peerBytes.get(peer);
-        if (rxTx == null)
-            return 0;
-        return rxTx.second;
+    @Nullable
+    public PeerStats peer(final Key peer) {
+        return stats.get(peer);
     }
 
     /**
@@ -83,7 +71,7 @@ public class Statistics {
      * {@link com.wireguard.config.Peer}s
      */
     public Key[] peers() {
-        return peerBytes.keySet().toArray(new Key[0]);
+        return stats.keySet().toArray(new Key[0]);
     }
 
     /**
@@ -93,8 +81,8 @@ public class Statistics {
      */
     public long totalRx() {
         long rx = 0;
-        for (final Pair<Long, Long> val : peerBytes.values()) {
-            rx += val.first;
+        for (final PeerStats val : stats.values()) {
+            rx += val.rxBytes;
         }
         return rx;
     }
@@ -106,8 +94,8 @@ public class Statistics {
      */
     public long totalTx() {
         long tx = 0;
-        for (final Pair<Long, Long> val : peerBytes.values()) {
-            tx += val.second;
+        for (final PeerStats val : stats.values()) {
+            tx += val.txBytes;
         }
         return tx;
     }

tunnel/src/main/java/com/wireguard/android/backend/Tunnel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/android/backend/WgQuickBackend.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -20,6 +20,7 @@ import com.wireguard.util.NonNullForAll;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.nio.charset.StandardCharsets;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -53,6 +54,10 @@ public final class WgQuickBackend implements Backend {
         this.toolsInstaller = toolsInstaller;
     }
 
+    public static boolean hasKernelSupport() {
+        return new File("/sys/module/wireguard").exists();
+    }
+
     @Override
     public Set<String> getRunningTunnelNames() {
         final List<String> output = new ArrayList<>();
@@ -79,17 +84,17 @@ public final class WgQuickBackend implements Backend {
         final Statistics stats = new Statistics();
         final Collection<String> output = new ArrayList<>();
         try {
-            if (rootShell.run(output, String.format("wg show '%s' transfer", tunnel.getName())) != 0)
+            if (rootShell.run(output, String.format("wg show '%s' dump", tunnel.getName())) != 0)
                 return stats;
         } catch (final Exception ignored) {
             return stats;
         }
         for (final String line : output) {
             final String[] parts = line.split("\\t");
-            if (parts.length != 3)
+            if (parts.length != 8)
                 continue;
             try {
-                stats.add(Key.fromBase64(parts[0]), Long.parseLong(parts[1]), Long.parseLong(parts[2]));
+                stats.add(Key.fromBase64(parts[0]), Long.parseLong(parts[5]), Long.parseLong(parts[6]), Long.parseLong(parts[4]) * 1000);
             } catch (final Exception ignored) {
             }
         }
@@ -104,6 +109,16 @@ public final class WgQuickBackend implements Backend {
         return output.get(0);
     }
 
+    @Override
+    public boolean isAlwaysOn() {
+        return false;
+    }
+
+    @Override
+    public boolean isLockdownEnabled() {
+        return false;
+    }
+
     public void setMultipleTunnels(final boolean on) {
         multipleTunnels = on;
     }

tunnel/src/main/java/com/wireguard/android/util/ModuleLoader.java

@@ -1,211 +0,0 @@
-/*
- * Copyright © 2019-2020 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-
-package com.wireguard.android.util;
-
-import android.content.Context;
-import android.system.OsConstants;
-import android.util.Base64;
-
-import com.wireguard.android.util.RootShell.RootShellException;
-import com.wireguard.crypto.Ed25519;
-import com.wireguard.util.NonNullForAll;
-
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.HttpURLConnection;
-import java.net.URL;
-import java.nio.charset.StandardCharsets;
-import java.security.InvalidParameterException;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import androidx.annotation.Nullable;
-
-/**
- * Class that implements the logic for downloading and loading signed, prebuilt modules for
- * WireGuard into the running kernel.
- */
-@NonNullForAll
-@SuppressWarnings("MagicNumber")
-public class ModuleLoader {
-    private static final String MODULE_LIST_URL = "https://download.wireguard.com/android-module/modules.txt.sig";
-    private static final String MODULE_NAME = "wireguard-%s.ko";
-    private static final String MODULE_PUBLIC_KEY_BASE64 = "RWRmHuT9PSqtwfsLtEx+QS06BJtLgFYteL9WCNjH7yuyu5Y1DieSN7If";
-    private static final String MODULE_URL = "https://download.wireguard.com/android-module/%s";
-    private final File moduleDir;
-    private final RootShell rootShell;
-    private final File tmpDir;
-    private final String userAgent;
-
-    /**
-     * Public constructor for ModuleLoader
-     *
-     * @param context   A {@link Context} instance.
-     * @param rootShell A {@link RootShell} instance used to run elevated commands required for module
-     *                  loading.
-     * @param userAgent A {@link String} that represents the User-Agent string used for connections
-     *                  to the upstream server.
-     */
-    public ModuleLoader(final Context context, final RootShell rootShell, final String userAgent) {
-        moduleDir = new File(context.getCacheDir(), "kmod");
-        tmpDir = new File(context.getCacheDir(), "tmp");
-        this.rootShell = rootShell;
-        this.userAgent = userAgent;
-    }
-
-    /**
-     * Check whether a WireGuard module is already loaded into the kernel.
-     *
-     * @return boolean indicating if WireGuard is already enabled in the kernel.
-     */
-    public static boolean isModuleLoaded() {
-        return new File("/sys/module/wireguard").exists();
-    }
-
-    /**
-     * Download the correct WireGuard module for the device
-     *
-     * @return {@link OsConstants}.EXIT_SUCCESS if everything succeeds, ENOENT otherwise.
-     * @throws IOException              if the remote hash list was not found or empty.
-     * @throws RootShellException       if {@link RootShell} has a failure executing elevated commands.
-     * @throws NoSuchAlgorithmException if SHA256 algorithm is not available in device JDK.
-     */
-    public Integer download() throws IOException, RootShellException, NoSuchAlgorithmException {
-        final List<String> output = new ArrayList<>();
-        rootShell.run(output, "sha256sum /proc/version|cut -d ' ' -f 1");
-        if (output.size() != 1 || output.get(0).length() != 64)
-            throw new InvalidParameterException("Invalid sha256 of /proc/version");
-        final String moduleName = String.format(MODULE_NAME, output.get(0));
-        HttpURLConnection connection = (HttpURLConnection) new URL(MODULE_LIST_URL).openConnection();
-        connection.setRequestProperty("User-Agent", userAgent);
-        connection.connect();
-        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
-            throw new IOException("Hash list could not be found");
-        final byte[] input = new byte[1024 * 1024 * 3 /* 3MiB */];
-        int len;
-        try (final InputStream inputStream = connection.getInputStream()) {
-            len = inputStream.read(input);
-        }
-        if (len <= 0)
-            throw new IOException("Hash list was empty");
-        final Map<String, Sha256Digest> modules = verifySignedHashes(new String(input, 0, len, StandardCharsets.UTF_8));
-        if (modules == null)
-            throw new InvalidParameterException("The signature did not verify or invalid hash list format");
-        if (!modules.containsKey(moduleName))
-            return OsConstants.ENOENT;
-        connection = (HttpURLConnection) new URL(String.format(MODULE_URL, moduleName)).openConnection();
-        connection.setRequestProperty("User-Agent", userAgent);
-        connection.connect();
-        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
-            throw new IOException("Module file could not be found, despite being on hash list");
-
-        tmpDir.mkdirs();
-        moduleDir.mkdir();
-        File tempFile = null;
-        try {
-            tempFile = File.createTempFile("UNVERIFIED-", null, tmpDir);
-            final MessageDigest digest = MessageDigest.getInstance("SHA-256");
-            try (final InputStream inputStream = connection.getInputStream();
-                 final FileOutputStream outputStream = new FileOutputStream(tempFile)) {
-                int total = 0;
-                while ((len = inputStream.read(input)) > 0) {
-                    total += len;
-                    if (total > 1024 * 1024 * 15 /* 15 MiB */)
-                        throw new IOException("File too big");
-                    outputStream.write(input, 0, len);
-                    digest.update(input, 0, len);
-                }
-                outputStream.getFD().sync();
-            }
-            if (!Arrays.equals(digest.digest(), modules.get(moduleName).bytes))
-                throw new IOException("Incorrect file hash");
-
-            if (!tempFile.renameTo(new File(moduleDir, moduleName)))
-                throw new IOException("Unable to rename to final destination");
-        } finally {
-            if (tempFile != null)
-                tempFile.delete();
-        }
-        return OsConstants.EXIT_SUCCESS;
-    }
-
-    /**
-     * Load the downloaded module. ModuleLoader#download must be called before this.
-     *
-     * @throws IOException        if {@link RootShell} has a failure executing elevated commands.
-     * @throws RootShellException if {@link RootShell} has a failure executing elevated commands.
-     */
-    public void loadModule() throws IOException, RootShellException {
-        rootShell.run(null, String.format("insmod \"%s/wireguard-$(sha256sum /proc/version|cut -d ' ' -f 1).ko\"", moduleDir.getAbsolutePath()));
-    }
-
-    /**
-     * Check if the module might already exist in the app's data.
-     *
-     * @return boolean indicating whether downloadable module might exist already.
-     */
-    public boolean moduleMightExist() {
-        return moduleDir.exists() && moduleDir.isDirectory();
-    }
-
-    @Nullable
-    private Map<String, Sha256Digest> verifySignedHashes(final String signifyDigest) {
-        byte[] publicKeyBytes = Base64.decode(MODULE_PUBLIC_KEY_BASE64, Base64.DEFAULT);
-
-        if (publicKeyBytes == null || publicKeyBytes.length != 32 + 10 || publicKeyBytes[0] != 'E' || publicKeyBytes[1] != 'd')
-            return null;
-
-        final String[] lines = signifyDigest.split("\n", 3);
-        if (lines.length != 3)
-            return null;
-        if (!lines[0].startsWith("untrusted comment: "))
-            return null;
-
-        byte[] signatureBytes = Base64.decode(lines[1], Base64.DEFAULT);
-        if (signatureBytes == null || signatureBytes.length != 64 + 10)
-            return null;
-        for (int i = 0; i < 10; ++i) {
-            if (signatureBytes[i] != publicKeyBytes[i])
-                return null;
-        }
-        publicKeyBytes = Arrays.copyOfRange(publicKeyBytes, 10, 10 + 32);
-        signatureBytes = Arrays.copyOfRange(signatureBytes, 10, 10 + 64);
-        if (!Ed25519.verify(lines[2].getBytes(StandardCharsets.UTF_8), signatureBytes, publicKeyBytes))
-            return null;
-
-        final Map<String, Sha256Digest> hashes = new HashMap<>();
-        for (final String line : lines[2].split("\n")) {
-            final String[] components = line.split(" {2}", 2);
-            if (components.length != 2)
-                return null;
-            try {
-                hashes.put(components[1], new Sha256Digest(components[0]));
-            } catch (final Exception ignored) {
-                return null;
-            }
-        }
-        return hashes;
-    }
-
-    private static final class Sha256Digest {
-        private final byte[] bytes;
-
-        private Sha256Digest(final String hex) {
-            if (hex.length() != 64)
-                throw new InvalidParameterException("SHA256 hashes must be 32 bytes long");
-            bytes = new byte[32];
-            for (int i = 0; i < 32; ++i)
-                bytes[i] = (byte) Integer.parseInt(hex.substring(i * 2, i * 2 + 2), 16);
-        }
-    }
-}

tunnel/src/main/java/com/wireguard/android/util/RootShell.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -46,8 +46,8 @@ public class RootShell {
         final String packageName = context.getPackageName();
         if (packageName.contains("'"))
             throw new RuntimeException("Impossibly invalid package name contains a single quote");
-        preamble = String.format("export CALLING_PACKAGE=%s PATH=\"%s:$PATH\" TMPDIR='%s'; magisk --sqlite \"UPDATE policies SET notification=0, logging=0 WHERE package_name='%s'\" >/dev/null 2>&1; id -u\n",
-                packageName, localBinaryDir, localTemporaryDir, packageName);
+        preamble = String.format("export CALLING_PACKAGE='%s' PATH=\"%s:$PATH\" TMPDIR='%s'; magisk --sqlite \"UPDATE policies SET notification=0, logging=0 WHERE uid=%d\" >/dev/null 2>&1; id -u\n",
+                packageName, localBinaryDir, localTemporaryDir, android.os.Process.myUid());
     }
 
     private static boolean isExecutableInPath(final String name) {

tunnel/src/main/java/com/wireguard/android/util/SharedLibraryLoader.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/android/util/ToolsInstaller.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -145,7 +145,7 @@ public final class ToolsInstaller {
 
         script.append("trap 'rm -rf /data/adb/modules/wireguard' INT TERM EXIT; ");
         script.append(String.format("rm -rf /data/adb/modules/wireguard/; mkdir -p /data/adb/modules/wireguard%s; ", INSTALL_DIR));
-        script.append("printf 'name=WireGuard Command Line Tools\nversion=1.0\nversionCode=1\nauthor=zx2c4\ndescription=Command line tools for WireGuard\nminMagisk=1500\n' > /data/adb/modules/wireguard/module.prop; ");
+        script.append("printf 'id=wireguard\nname=WireGuard Command Line Tools\nversion=1.0\nversionCode=1\nauthor=zx2c4\ndescription=Command line tools for WireGuard\nminMagisk=1500\n' > /data/adb/modules/wireguard/module.prop; ");
         script.append("touch /data/adb/modules/wireguard/auto_mount; ");
         for (final String name : EXECUTABLES) {
             final File destination = new File("/data/adb/modules/wireguard" + INSTALL_DIR, name);

tunnel/src/main/java/com/wireguard/config/Attribute.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/config/BadConfigException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/config/Config.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/config/InetAddresses.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -23,6 +23,7 @@ import androidx.annotation.Nullable;
 public final class InetAddresses {
     @Nullable private static final Method PARSER_METHOD;
     private static final Pattern WONT_TOUCH_RESOLVER = Pattern.compile("^(((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:)))(%.+)?)|((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$");
+    private static final Pattern VALID_HOSTNAME = Pattern.compile("^(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\\.?$");
 
     static {
         Method m = null;
@@ -38,6 +39,16 @@ public final class InetAddresses {
     private InetAddresses() {
     }
 
+    /**
+     * Determines whether input is a valid DNS hostname.
+     *
+     * @param maybeHostname a string that is possibly a DNS hostname
+     * @return whether or not maybeHostname is a valid DNS hostname
+     */
+    public static boolean isHostname(final CharSequence maybeHostname) {
+        return VALID_HOSTNAME.matcher(maybeHostname).matches();
+    }
+
     /**
      * Parses a numeric IPv4 or IPv6 address without performing any DNS lookups.
      *

tunnel/src/main/java/com/wireguard/config/InetEndpoint.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/config/InetNetwork.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/config/Interface.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -40,6 +40,7 @@ public final class Interface {
 
     private final Set<InetNetwork> addresses;
     private final Set<InetAddress> dnsServers;
+    private final Set<String> dnsSearchDomains;
     private final Set<String> excludedApplications;
     private final Set<String> includedApplications;
     private final KeyPair keyPair;
@@ -50,6 +51,7 @@ public final class Interface {
         // Defensively copy to ensure immutability even if the Builder is reused.
         addresses = Collections.unmodifiableSet(new LinkedHashSet<>(builder.addresses));
         dnsServers = Collections.unmodifiableSet(new LinkedHashSet<>(builder.dnsServers));
+        dnsSearchDomains = Collections.unmodifiableSet(new LinkedHashSet<>(builder.dnsSearchDomains));
         excludedApplications = Collections.unmodifiableSet(new LinkedHashSet<>(builder.excludedApplications));
         includedApplications = Collections.unmodifiableSet(new LinkedHashSet<>(builder.includedApplications));
         keyPair = Objects.requireNonNull(builder.keyPair, "Interfaces must have a private key");
@@ -108,6 +110,7 @@ public final class Interface {
         final Interface other = (Interface) obj;
         return addresses.equals(other.addresses)
                 && dnsServers.equals(other.dnsServers)
+                && dnsSearchDomains.equals(other.dnsSearchDomains)
                 && excludedApplications.equals(other.excludedApplications)
                 && includedApplications.equals(other.includedApplications)
                 && keyPair.equals(other.keyPair)
@@ -135,6 +138,16 @@ public final class Interface {
         return dnsServers;
     }
 
+    /**
+     * Returns the set of DNS search domains associated with the interface.
+     *
+     * @return a set of strings
+     */
+    public Set<String> getDnsSearchDomains() {
+        // The collection is already immutable.
+        return dnsSearchDomains;
+    }
+
     /**
      * Returns the set of applications excluded from using the interface.
      *
@@ -222,6 +235,7 @@ public final class Interface {
             sb.append("Address = ").append(Attribute.join(addresses)).append('\n');
         if (!dnsServers.isEmpty()) {
             final List<String> dnsServerStrings = dnsServers.stream().map(InetAddress::getHostAddress).collect(Collectors.toList());
+            dnsServerStrings.addAll(dnsSearchDomains);
             sb.append("DNS = ").append(Attribute.join(dnsServerStrings)).append('\n');
         }
         if (!excludedApplications.isEmpty())
@@ -254,6 +268,8 @@ public final class Interface {
         // Defaults to an empty set.
         private final Set<InetAddress> dnsServers = new LinkedHashSet<>();
         // Defaults to an empty set.
+        private final Set<String> dnsSearchDomains = new LinkedHashSet<>();
+        // Defaults to an empty set.
         private final Set<String> excludedApplications = new LinkedHashSet<>();
         // Defaults to an empty set.
         private final Set<String> includedApplications = new LinkedHashSet<>();
@@ -284,6 +300,16 @@ public final class Interface {
             return this;
         }
 
+        public Builder addDnsSearchDomain(final String dnsSearchDomain) {
+            dnsSearchDomains.add(dnsSearchDomain);
+            return this;
+        }
+
+        public Builder addDnsSearchDomains(final Collection<String> dnsSearchDomains) {
+            this.dnsSearchDomains.addAll(dnsSearchDomains);
+            return this;
+        }
+
         public Interface build() throws BadConfigException {
             if (keyPair == null)
                 throw new BadConfigException(Section.INTERFACE, Location.PRIVATE_KEY,
@@ -326,8 +352,15 @@ public final class Interface {
 
         public Builder parseDnsServers(final CharSequence dnsServers) throws BadConfigException {
             try {
-                for (final String dnsServer : Attribute.split(dnsServers))
-                    addDnsServer(InetAddresses.parse(dnsServer));
+                for (final String dnsServer : Attribute.split(dnsServers)) {
+                    try {
+                        addDnsServer(InetAddresses.parse(dnsServer));
+                    } catch (final ParseException e) {
+                        if (e.getParsingClass() != InetAddress.class || !InetAddresses.isHostname(dnsServer))
+                            throw e;
+                        addDnsSearchDomain(dnsServer);
+                    }
+                }
                 return this;
             } catch (final ParseException e) {
                 throw new BadConfigException(Section.INTERFACE, Location.DNS, e);

tunnel/src/main/java/com/wireguard/config/ParseException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/config/Peer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/crypto/Curve25519.java

@@ -1,6 +1,6 @@
 /*
  * Copyright © 2016 Southern Storm Software, Pty Ltd.
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/crypto/Key.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/crypto/KeyFormatException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/crypto/KeyPair.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/main/java/com/wireguard/util/NonNullForAll.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/test/java/com/wireguard/config/BadConfigExceptionTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/test/java/com/wireguard/config/ConfigTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

tunnel/src/test/resources/invalid-value.conf

@@ -1,6 +1,6 @@
 [Interface]
 Address = 192.0.2.2/32,2001:db8:ffff:ffff:ffff:ffff:ffff:ffff/128
-DNS = 192.0.2.0,yes
+DNS = 192.0.2.0,invalid_value
 PrivateKey = TFlmmEUC7V7VtiDYLKsbP5rySTKLIZq1yn8lMqK83wo=
 [Peer]
 AllowedIPs = 0.0.0.0/0, ::0/0

tunnel/tools/CMakeLists.txt

@@ -1,34 +1,44 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+# Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
 
 cmake_minimum_required(VERSION 3.4.1)
+project("WireGuard")
 set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
-
-# Work around https://github.com/android-ndk/ndk/issues/602
-set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=gold")
+add_link_options(LINKER:--build-id=none)
+add_compile_options(-Wall -Werror)
 
 add_executable(libwg-quick.so wireguard-tools/src/wg-quick/android.c ndk-compat/compat.c)
-target_compile_options(libwg-quick.so PUBLIC -O3 -std=gnu11 -Wall -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DWG_PACKAGE_NAME=\"${ANDROID_PACKAGE_NAME}\")
+target_compile_options(libwg-quick.so PUBLIC -std=gnu11 -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DWG_PACKAGE_NAME=\"${ANDROID_PACKAGE_NAME}\")
 target_link_libraries(libwg-quick.so -ldl)
 
 file(GLOB WG_SOURCES wireguard-tools/src/*.c ndk-compat/compat.c)
 add_executable(libwg.so ${WG_SOURCES})
 target_include_directories(libwg.so PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/uapi/linux/" "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/")
-target_compile_options(libwg.so PUBLIC -O3 -std=gnu11 -D_GNU_SOURCE -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DHAVE_VISIBILITY_HIDDEN -DRUNSTATEDIR=\"/data/data/${ANDROID_PACKAGE_NAME}/cache\")
+target_compile_options(libwg.so PUBLIC -std=gnu11 -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DRUNSTATEDIR=\"/data/data/${ANDROID_PACKAGE_NAME}/cache\")
 
-add_custom_target(libwg-go.so WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/libwg-go" COMMENT "Building wireguard-go" VERBATIM COMMAND make
+add_custom_target(libwg-go.so WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/libwg-go" COMMENT "Building wireguard-go" VERBATIM COMMAND "${ANDROID_HOST_PREBUILTS}/bin/make"
     ANDROID_ARCH_NAME=${ANDROID_ARCH_NAME}
-    ANDROID_C_COMPILER=${ANDROID_C_COMPILER}
-    ANDROID_TOOLCHAIN_ROOT=${ANDROID_TOOLCHAIN_ROOT}
-    ANDROID_LLVM_TRIPLE=${ANDROID_LLVM_TRIPLE}
-    ANDROID_SYSROOT=${ANDROID_SYSROOT}
     ANDROID_PACKAGE_NAME=${ANDROID_PACKAGE_NAME}
     GRADLE_USER_HOME=${GRADLE_USER_HOME}
-    CFLAGS=${CMAKE_C_FLAGS}\ -Wno-unused-command-line-argument
-    LDFLAGS=${CMAKE_SHARED_LINKER_FLAGS}\ -fuse-ld=gold
+    CC=${CMAKE_C_COMPILER}
+    CFLAGS=${CMAKE_C_FLAGS}
+    LDFLAGS=${CMAKE_SHARED_LINKER_FLAGS}
+    SYSROOT=${CMAKE_SYSROOT}
+    TARGET=${CMAKE_C_COMPILER_TARGET}
     DESTDIR=${CMAKE_LIBRARY_OUTPUT_DIRECTORY}
     BUILDDIR=${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/../generated-src
 )
-# Hack to make it actually build as part of the default target
-add_dependencies(libwg.so libwg-go.so)
+
+# Strip unwanted ELF sections to prevent DT_FLAGS_1 warnings on old Android versions
+file(GLOB ELF_CLEANER_SOURCES elf-cleaner/*.c elf-cleaner/*.cpp)
+add_custom_target(elf-cleaner COMMENT "Building elf-cleaner" VERBATIM COMMAND cc
+        -O2 -DPACKAGE_NAME="elf-cleaner" -DPACKAGE_VERSION="" -DCOPYRIGHT=""
+        -o "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner" ${ELF_CLEANER_SOURCES}
+)
+add_custom_command(TARGET libwg.so POST_BUILD VERBATIM COMMAND "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner"
+        --api-level "${ANDROID_NATIVE_API_LEVEL}" "$<TARGET_FILE:libwg.so>")
+add_dependencies(libwg.so elf-cleaner)
+add_custom_command(TARGET libwg-quick.so POST_BUILD VERBATIM COMMAND "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner"
+        --api-level "${ANDROID_NATIVE_API_LEVEL}" "$<TARGET_FILE:libwg-quick.so>")
+add_dependencies(libwg-quick.so elf-cleaner)

tunnel/tools/libwg-go/Makefile

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+# Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
 
 BUILDDIR ?= $(CURDIR)/build
 DESTDIR ?= $(CURDIR)/out
@@ -12,19 +12,20 @@ NDK_GO_ARCH_MAP_arm64 := arm64
 NDK_GO_ARCH_MAP_mips := mipsx
 NDK_GO_ARCH_MAP_mips64 := mips64x
 
-CLANG_FLAGS := --target=$(ANDROID_LLVM_TRIPLE) --gcc-toolchain=$(ANDROID_TOOLCHAIN_ROOT) --sysroot=$(ANDROID_SYSROOT)
-export CGO_CFLAGS := $(CLANG_FLAGS) $(CFLAGS)
-export CGO_LDFLAGS := $(CLANG_FLAGS) $(LDFLAGS) -Wl,-soname=libwg-go.so
-export CC := $(ANDROID_C_COMPILER)
+comma := ,
+CLANG_FLAGS := --target=$(TARGET) --sysroot=$(SYSROOT)
+export CGO_CFLAGS := $(CLANG_FLAGS) $(subst -mthumb,-marm,$(CFLAGS))
+export CGO_LDFLAGS := $(CLANG_FLAGS) $(patsubst -Wl$(comma)--build-id=%,-Wl$(comma)--build-id=none,$(LDFLAGS)) -Wl,-soname=libwg-go.so
 export GOARCH := $(NDK_GO_ARCH_MAP_$(ANDROID_ARCH_NAME))
 export GOOS := android
 export CGO_ENABLED := 1
 
-GO_VERSION := 1.15.2
+GO_VERSION := 1.24.3
 GO_PLATFORM := $(shell uname -s | tr '[:upper:]' '[:lower:]')-$(NDK_GO_ARCH_MAP_$(shell uname -m))
 GO_TARBALL := go$(GO_VERSION).$(GO_PLATFORM).tar.gz
-GO_HASH_darwin-amd64 := 9bd39600d9fa1fa4a5ccce8761d249f7421cffe671376f791293c4138f3d7c62
-GO_HASH_linux-amd64 := b49fda1ca29a1946d6bb2a5a6982cf07ccd2aba849289508ee0f9918f6bb4552
+GO_HASH_darwin-amd64 := 13e6fe3fcf65689d77d40e633de1e31c6febbdbcb846eb05fc2434ed2213e92b
+GO_HASH_darwin-arm64 := 64a3fa22142f627e78fac3018ce3d4aeace68b743eff0afda8aae0411df5e4fb
+GO_HASH_linux-amd64 := 3333f6ea53afa971e9078895eaa4ac7204a8c6b5c68c10e6bc9a33e8e391bdd8
 
 default: $(DESTDIR)/libwg-go.so
 
@@ -46,6 +47,6 @@ $(BUILDDIR)/go-$(GO_VERSION)/.prepared: $(GRADLE_USER_HOME)/caches/golang/$(GO_T
 
 $(DESTDIR)/libwg-go.so: export PATH := $(BUILDDIR)/go-$(GO_VERSION)/bin/:$(PATH)
 $(DESTDIR)/libwg-go.so: $(BUILDDIR)/go-$(GO_VERSION)/.prepared go.mod
-	go build -tags linux -ldflags="-X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard" -v -trimpath -o "$@" -buildmode c-shared
+	go build -tags linux -ldflags="-X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard -buildid=" -v -trimpath -buildvcs=false -o "$@" -buildmode c-shared
 
 .DELETE_ON_ERROR:

tunnel/tools/libwg-go/api-android.go

@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: Apache-2.0
  *
- * Copyright (C) 2017-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ * Copyright © 2017-2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */
 
 package main
@@ -10,14 +10,13 @@ package main
 import "C"
 
 import (
-	"bufio"
-	"bytes"
-	"log"
+	"fmt"
 	"math"
 	"net"
 	"os"
 	"os/signal"
 	"runtime"
+	"runtime/debug"
 	"strings"
 	"unsafe"
 
@@ -29,13 +28,21 @@ import (
 )
 
 type AndroidLogger struct {
-	level         C.int
-	interfaceName string
+	level C.int
+	tag   *C.char
 }
 
-func (l AndroidLogger) Write(p []byte) (int, error) {
-	C.__android_log_write(l.level, C.CString("WireGuard/GoBackend/"+l.interfaceName), C.CString(string(p)))
-	return len(p), nil
+func cstring(s string) *C.char {
+	b, err := unix.BytePtrFromString(s)
+	if err != nil {
+		b := [1]C.char{}
+		return &b[0]
+	}
+	return (*C.char)(unsafe.Pointer(b))
+}
+
+func (l AndroidLogger) Printf(format string, args ...interface{}) {
+	C.__android_log_write(l.level, l.tag, cstring(fmt.Sprintf(format, args...)))
 }
 
 type TunnelHandle struct {
@@ -55,39 +62,38 @@ func init() {
 			select {
 			case <-signals:
 				n := runtime.Stack(buf, true)
+				if n == len(buf) {
+					n--
+				}
 				buf[n] = 0
-				C.__android_log_write(C.ANDROID_LOG_ERROR, C.CString("WireGuard/GoBackend/Stacktrace"), (*C.char)(unsafe.Pointer(&buf[0])))
+				C.__android_log_write(C.ANDROID_LOG_ERROR, cstring("WireGuard/GoBackend/Stacktrace"), (*C.char)(unsafe.Pointer(&buf[0])))
 			}
 		}
 	}()
 }
 
 //export wgTurnOn
-func wgTurnOn(ifnameRef string, tunFd int32, settings string) int32 {
-	interfaceName := string([]byte(ifnameRef))
-
+func wgTurnOn(interfaceName string, tunFd int32, settings string) int32 {
+	tag := cstring("WireGuard/GoBackend/" + interfaceName)
 	logger := &device.Logger{
-		Debug: log.New(&AndroidLogger{level: C.ANDROID_LOG_DEBUG, interfaceName: interfaceName}, "", 0),
-		Info:  log.New(&AndroidLogger{level: C.ANDROID_LOG_INFO, interfaceName: interfaceName}, "", 0),
-		Error: log.New(&AndroidLogger{level: C.ANDROID_LOG_ERROR, interfaceName: interfaceName}, "", 0),
+		Verbosef: AndroidLogger{level: C.ANDROID_LOG_DEBUG, tag: tag}.Printf,
+		Errorf:   AndroidLogger{level: C.ANDROID_LOG_ERROR, tag: tag}.Printf,
 	}
 
-	logger.Debug.Println("Debug log enabled")
-
 	tun, name, err := tun.CreateUnmonitoredTUNFromFD(int(tunFd))
 	if err != nil {
 		unix.Close(int(tunFd))
-		logger.Error.Println(err)
+		logger.Errorf("CreateUnmonitoredTUNFromFD: %v", err)
 		return -1
 	}
 
-	logger.Info.Println("Attaching to interface", name)
-	device := device.NewDevice(tun, logger)
+	logger.Verbosef("Attaching to interface %v", name)
+	device := device.NewDevice(tun, conn.NewStdNetBind(), logger)
 
-	setError := device.IpcSetOperation(bufio.NewReader(strings.NewReader(settings)))
-	if setError != nil {
+	err = device.IpcSet(settings)
+	if err != nil {
 		unix.Close(int(tunFd))
-		logger.Error.Println(setError)
+		logger.Errorf("IpcSet: %v", err)
 		return -1
 	}
 	device.DisableSomeRoamingForBrokenMobileSemantics()
@@ -96,12 +102,12 @@ func wgTurnOn(ifnameRef string, tunFd int32, settings string) int32 {
 
 	uapiFile, err := ipc.UAPIOpen(name)
 	if err != nil {
-		logger.Error.Println(err)
+		logger.Errorf("UAPIOpen: %v", err)
 	} else {
 		uapi, err = ipc.UAPIListen(name, uapiFile)
 		if err != nil {
 			uapiFile.Close()
-			logger.Error.Println(err)
+			logger.Errorf("UAPIListen: %v", err)
 		} else {
 			go func() {
 				for {
@@ -115,8 +121,14 @@ func wgTurnOn(ifnameRef string, tunFd int32, settings string) int32 {
 		}
 	}
 
-	device.Up()
-	logger.Info.Println("Device started")
+	err = device.Up()
+	if err != nil {
+		logger.Errorf("Unable to bring up device: %v", err)
+		uapiFile.Close()
+		device.Close()
+		return -1
+	}
+	logger.Verbosef("Device started")
 
 	var i int32
 	for i = 0; i < math.MaxInt32; i++ {
@@ -125,7 +137,9 @@ func wgTurnOn(ifnameRef string, tunFd int32, settings string) int32 {
 		}
 	}
 	if i == math.MaxInt32 {
-		unix.Close(int(tunFd))
+		logger.Errorf("Unable to find empty handle")
+		uapiFile.Close()
+		device.Close()
 		return -1
 	}
 	tunnelHandles[i] = TunnelHandle{device: device, uapi: uapi}
@@ -185,19 +199,29 @@ func wgGetConfig(tunnelHandle int32) *C.char {
 	if !ok {
 		return nil
 	}
-	settings := new(bytes.Buffer)
-	writer := bufio.NewWriter(settings)
-	err := handle.device.IpcGetOperation(writer)
+	settings, err := handle.device.IpcGet()
 	if err != nil {
 		return nil
 	}
-	writer.Flush()
-	return C.CString(settings.String())
+	return C.CString(settings)
 }
 
 //export wgVersion
 func wgVersion() *C.char {
-	return C.CString(device.WireGuardGoVersion)
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return C.CString("unknown")
+	}
+	for _, dep := range info.Deps {
+		if dep.Path == "golang.zx2c4.com/wireguard" {
+			parts := strings.Split(dep.Version, "-")
+			if len(parts) == 3 && len(parts[2]) == 12 {
+				return C.CString(parts[2][:7])
+			}
+			return C.CString(dep.Version)
+		}
+	}
+	return C.CString("unknown")
 }
 
 func main() {}

tunnel/tools/libwg-go/go.mod

@@ -1,10 +1,14 @@
 module golang.zx2c4.com/wireguard/android
 
-go 1.14
+go 1.23.1
 
 require (
-	golang.org/x/crypto v0.0.0-20201208171446-5f87f3452ae9 // indirect
-	golang.org/x/net v0.0.0-20201216054612-986b41b23924 // indirect
-	golang.org/x/sys v0.0.0-20201214210602-f9fddec55a1e
-	golang.zx2c4.com/wireguard v0.0.20201119-0.20201215171155-74008520cdd9
+	golang.org/x/sys v0.33.0
+	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
+)
+
+require (
+	golang.org/x/crypto v0.38.0 // indirect
+	golang.org/x/net v0.40.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 )

tunnel/tools/libwg-go/go.sum

@@ -1,24 +1,16 @@
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201124201722-c8d3bf9c5392/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20201208171446-5f87f3452ae9 h1:sYNJzB4J8toYPQTM6pAkcmBRgw9SnQKP9oXCHfgy604=
-golang.org/x/crypto v0.0.0-20201208171446-5f87f3452ae9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201216054612-986b41b23924 h1:QsnDpLLOKwHBBDa8nDws4DYNc/ryVW2vCpxCs09d4PY=
-golang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201126233918-771906719818/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201214210602-f9fddec55a1e h1:AyodaIpKjppX+cBfTASF2E1US3H2JFBj920Ot3rtDjs=
-golang.org/x/sys v0.0.0-20201214210602-f9fddec55a1e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.zx2c4.com/wireguard v0.0.20201119-0.20201215171155-74008520cdd9 h1:rdbSLajsO6nfT4NViHeB/6lMW4vaO1bfsTvmeDpYvVs=
-golang.zx2c4.com/wireguard v0.0.20201119-0.20201215171155-74008520cdd9/go.mod h1:ITsWNpkFv78VPB7f8MiyuxeEMcHR4jfxHGCJLPP3GHs=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
+golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c h1:m/r7OM+Y2Ty1sgBQ7Qb27VgIMBW8ZZhT4gLnUyDIhzI=
+gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=

tunnel/tools/libwg-go/goruntime-boottime-over-monotonic.diff

@@ -1,7 +1,8 @@
-From 1d1ba1da11afd73008c0e942db7621697055a6b6 Mon Sep 17 00:00:00 2001
+From 61f3ae8298d1c503cbc31539e0f3a73446c7db9d Mon Sep 17 00:00:00 2001
 From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-Date: Tue, 15 Sep 2020 13:39:22 +0200
-Subject: [PATCH] runtime: use CLOCK_BOOTTIME in nanotime on Linux
+Date: Tue, 21 Mar 2023 15:33:56 +0100
+Subject: [PATCH] [release-branch.go1.20] runtime: use CLOCK_BOOTTIME in
+ nanotime on Linux
 
 This makes timers account for having expired while a computer was
 asleep, which is quite common on mobile devices. Note that BOOTTIME is
@@ -21,17 +22,17 @@ Change-Id: I7b2a6ca0c5bc5fce57ec0eeafe7b68270b429321
  src/runtime/sys_linux_amd64.s   | 2 +-
  src/runtime/sys_linux_arm.s     | 4 ++--
  src/runtime/sys_linux_arm64.s   | 4 ++--
- src/runtime/sys_linux_mips64x.s | 2 +-
+ src/runtime/sys_linux_mips64x.s | 4 ++--
  src/runtime/sys_linux_mipsx.s   | 2 +-
  src/runtime/sys_linux_ppc64x.s  | 2 +-
  src/runtime/sys_linux_s390x.s   | 2 +-
- 8 files changed, 11 insertions(+), 11 deletions(-)
+ 8 files changed, 12 insertions(+), 12 deletions(-)
 
 diff --git a/src/runtime/sys_linux_386.s b/src/runtime/sys_linux_386.s
-index 5b9b638ad7..448ad8b2e6 100644
+index 12a294153d..17e3524b40 100644
 --- a/src/runtime/sys_linux_386.s
 +++ b/src/runtime/sys_linux_386.s
-@@ -339,13 +339,13 @@ noswitch:
+@@ -352,13 +352,13 @@ noswitch:
  
  	LEAL	8(SP), BX	// &ts (struct timespec)
  	MOVL	BX, 4(SP)
@@ -48,20 +49,20 @@ index 5b9b638ad7..448ad8b2e6 100644
  	INVOKE_SYSCALL
  
 diff --git a/src/runtime/sys_linux_amd64.s b/src/runtime/sys_linux_amd64.s
-index fe9c6bce85..4836a7c774 100644
+index c7a89ba536..01f0a6a26e 100644
 --- a/src/runtime/sys_linux_amd64.s
 +++ b/src/runtime/sys_linux_amd64.s
-@@ -311,7 +311,7 @@ noswitch:
- 	MOVQ	runtime·vdsoClockgettimeSym(SB), AX
- 	CMPQ	AX, $0
- 	JEQ	fallback
+@@ -255,7 +255,7 @@ noswitch:
+ 	SUBQ	$16, SP		// Space for results
+ 	ANDQ	$~15, SP	// Align for C code
+ 
 -	MOVL	$1, DI // CLOCK_MONOTONIC
 +	MOVL	$7, DI // CLOCK_BOOTTIME
  	LEAQ	0(SP), SI
- 	CALL	AX
- 	MOVQ	0(SP), AX	// sec
+ 	MOVQ	runtime·vdsoClockgettimeSym(SB), AX
+ 	CMPQ	AX, $0
 diff --git a/src/runtime/sys_linux_arm.s b/src/runtime/sys_linux_arm.s
-index 475f52344c..bb567abcf4 100644
+index 7b8c4f0e04..9798a1334e 100644
 --- a/src/runtime/sys_linux_arm.s
 +++ b/src/runtime/sys_linux_arm.s
 @@ -11,7 +11,7 @@
@@ -73,20 +74,20 @@ index 475f52344c..bb567abcf4 100644
  
  // for EABI, as we don't support OABI
  #define SYS_BASE 0x0
-@@ -366,7 +366,7 @@ noswitch:
- 	SUB	$24, R13	// Space for results
- 	BIC	$0x7, R13	// Align for C code
+@@ -374,7 +374,7 @@ finish:
  
+ // func nanotime1() int64
+ TEXT runtime·nanotime1(SB),NOSPLIT,$12-8
 -	MOVW	$CLOCK_MONOTONIC, R0
 +	MOVW	$CLOCK_BOOTTIME, R0
- 	MOVW	$8(R13), R1	// timespec
- 	MOVW	runtime·vdsoClockgettimeSym(SB), R2
- 	CMP	$0, R2
+ 	MOVW	$spec-12(SP), R1	// timespec
+ 
+ 	MOVW	runtime·vdsoClockgettimeSym(SB), R4
 diff --git a/src/runtime/sys_linux_arm64.s b/src/runtime/sys_linux_arm64.s
-index 198a5bacef..9715387f36 100644
+index 38ff6ac330..6b819c5441 100644
 --- a/src/runtime/sys_linux_arm64.s
 +++ b/src/runtime/sys_linux_arm64.s
-@@ -13,7 +13,7 @@
+@@ -14,7 +14,7 @@
  #define AT_FDCWD -100
  
  #define CLOCK_REALTIME 0
@@ -95,7 +96,7 @@ index 198a5bacef..9715387f36 100644
  
  #define SYS_exit		93
  #define SYS_read		63
-@@ -319,7 +319,7 @@ noswitch:
+@@ -338,7 +338,7 @@ noswitch:
  	BIC	$15, R1
  	MOVD	R1, RSP
  
@@ -105,10 +106,10 @@ index 198a5bacef..9715387f36 100644
  	CBZ	R2, fallback
  
 diff --git a/src/runtime/sys_linux_mips64x.s b/src/runtime/sys_linux_mips64x.s
-index afad056d06..2c9162b903 100644
+index 47f2da524d..a8b387f193 100644
 --- a/src/runtime/sys_linux_mips64x.s
 +++ b/src/runtime/sys_linux_mips64x.s
-@@ -304,7 +304,7 @@ noswitch:
+@@ -326,7 +326,7 @@ noswitch:
  	AND	$~15, R1	// Align for C code
  	MOVV	R1, R29
  
@@ -117,11 +118,20 @@ index afad056d06..2c9162b903 100644
  	MOVV	$0(R29), R5
  
  	MOVV	runtime·vdsoClockgettimeSym(SB), R25
+@@ -336,7 +336,7 @@ noswitch:
+ 	// see walltime for detail
+ 	BEQ	R2, R0, finish
+ 	MOVV	R0, runtime·vdsoClockgettimeSym(SB)
+-	MOVW	$1, R4 // CLOCK_MONOTONIC
++	MOVW	$7, R4 // CLOCK_BOOTTIME
+ 	MOVV	$0(R29), R5
+ 	JMP	fallback
+ 
 diff --git a/src/runtime/sys_linux_mipsx.s b/src/runtime/sys_linux_mipsx.s
-index fab2ab3892..f9af103594 100644
+index 5e6b6c1504..7f5fd2a80e 100644
 --- a/src/runtime/sys_linux_mipsx.s
 +++ b/src/runtime/sys_linux_mipsx.s
-@@ -238,7 +238,7 @@ TEXT runtime·walltime1(SB),NOSPLIT,$8-12
+@@ -243,7 +243,7 @@ TEXT runtime·walltime(SB),NOSPLIT,$8-12
  	RET
  
  TEXT runtime·nanotime1(SB),NOSPLIT,$8-8
@@ -131,11 +141,11 @@ index fab2ab3892..f9af103594 100644
  	MOVW	$SYS_clock_gettime, R2
  	SYSCALL
 diff --git a/src/runtime/sys_linux_ppc64x.s b/src/runtime/sys_linux_ppc64x.s
-index fd69ee70a5..ff6bc8355b 100644
+index d0427a4807..05ee9fede9 100644
 --- a/src/runtime/sys_linux_ppc64x.s
 +++ b/src/runtime/sys_linux_ppc64x.s
-@@ -249,7 +249,7 @@ fallback:
- 	JMP	finish
+@@ -298,7 +298,7 @@ fallback:
+ 	JMP	return
  
  TEXT runtime·nanotime1(SB),NOSPLIT,$16-8
 -	MOVD	$1, R3		// CLOCK_MONOTONIC
@@ -144,18 +154,18 @@ index fd69ee70a5..ff6bc8355b 100644
  	MOVD	R1, R15		// R15 is unchanged by C code
  	MOVD	g_m(g), R21	// R21 = m
 diff --git a/src/runtime/sys_linux_s390x.s b/src/runtime/sys_linux_s390x.s
-index c15a1d5364..f52c4d5098 100644
+index 1448670b91..7d2ee3231c 100644
 --- a/src/runtime/sys_linux_s390x.s
 +++ b/src/runtime/sys_linux_s390x.s
-@@ -207,7 +207,7 @@ TEXT runtime·walltime1(SB),NOSPLIT,$16
+@@ -296,7 +296,7 @@ fallback:
  	RET
  
- TEXT runtime·nanotime1(SB),NOSPLIT,$16
--	MOVW	$1, R2 // CLOCK_MONOTONIC
-+	MOVW	$7, R2 // CLOCK_BOOTTIME
- 	MOVD	$tp-16(SP), R3
- 	MOVW	$SYS_clock_gettime, R1
- 	SYSCALL
+ TEXT runtime·nanotime1(SB),NOSPLIT,$32-8
+-	MOVW	$1, R2			// CLOCK_MONOTONIC
++	MOVW	$7, R2			// CLOCK_BOOTTIME
+ 
+ 	MOVD	R15, R7			// Backup stack pointer
+ 
 -- 
-2.28.0
+2.17.1
 

tunnel/tools/libwg-go/jni.c

@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: Apache-2.0
  *
- * Copyright © 2017-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ * Copyright © 2017-2021 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */
 
 #include <jni.h>

tunnel/tools/ndk-compat/compat.c

@@ -1,64 +1,12 @@
 /* SPDX-License-Identifier: BSD
  *
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  *
  */
 
 #define FILE_IS_EMPTY
 
-#if defined(__ANDROID_API__) && __ANDROID_API__ < 18
-#undef FILE_IS_EMPTY
-#include <stdio.h>
-#include <stdlib.h>
-
-ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp)
-{
-	char *ptr, *eptr;
-
-	if (*buf == NULL || *bufsiz == 0) {
-		*bufsiz = BUFSIZ;
-		if ((*buf = malloc(*bufsiz)) == NULL)
-			return -1;
-	}
-
-	for (ptr = *buf, eptr = *buf + *bufsiz;;) {
-		int c = fgetc(fp);
-		if (c == -1) {
-			if (feof(fp)) {
-				ssize_t diff = (ssize_t)(ptr - *buf);
-				if (diff != 0) {
-					*ptr = '\0';
-					return diff;
-				}
-			}
-			return -1;
-		}
-		*ptr++ = c;
-		if (c == delimiter) {
-			*ptr = '\0';
-			return ptr - *buf;
-		}
-		if (ptr + 2 >= eptr) {
-			char *nbuf;
-			size_t nbufsiz = *bufsiz * 2;
-			ssize_t d = ptr - *buf;
-			if ((nbuf = realloc(*buf, nbufsiz)) == NULL)
-				return -1;
-			*buf = nbuf;
-			*bufsiz = nbufsiz;
-			eptr = nbuf + nbufsiz;
-			ptr = nbuf + d;
-		}
-	}
-}
-
-ssize_t getline(char **buf, size_t *bufsiz, FILE *fp)
-{
-	return getdelim(buf, bufsiz, '\n', fp);
-}
-#endif
-
-#if defined(__ANDROID_API__) && __ANDROID_API__ < 24
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 24
 #undef FILE_IS_EMPTY
 #include <string.h>
 

tunnel/tools/ndk-compat/compat.h

@@ -1,16 +1,10 @@
 /* SPDX-License-Identifier: BSD
  *
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  *
  */
 
-#if defined(__ANDROID_API__) && __ANDROID_API__ < 18
-#include <stdio.h>
-ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp);
-ssize_t getline(char **buf, size_t *bufsiz, FILE *fp);
-#endif
-
-#if defined(__ANDROID_API__) && __ANDROID_API__ < 24
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 24
 char *strchrnul(const char *s, int c);
 #endif
 

ui/build.gradle

@@ -1,88 +0,0 @@
-apply plugin: 'com.android.application'
-apply plugin: 'kotlin-android'
-apply plugin: 'kotlin-kapt'
-
-version wireguardVersionName
-group groupName
-
-// Create a variable called keystorePropertiesFile, and initialize it to your
-// keystore.properties file, in the rootProject folder.
-final def keystorePropertiesFile = rootProject.file("keystore.properties")
-
-android {
-    compileSdkVersion 30
-    buildFeatures.dataBinding = true
-    buildFeatures.viewBinding = true
-    defaultConfig {
-        applicationId 'com.wireguard.android'
-        minSdkVersion 21
-        targetSdkVersion 30
-        versionCode wireguardVersionCode
-        versionName wireguardVersionName
-        buildConfigField 'int', 'MIN_SDK_VERSION', "$minSdkVersion.apiLevel"
-    }
-    compileOptions {
-        sourceCompatibility JavaVersion.VERSION_1_8
-        targetCompatibility JavaVersion.VERSION_1_8
-        coreLibraryDesugaringEnabled = true
-    }
-    if (keystorePropertiesFile.exists()) {
-        final def keystoreProperties = new Properties()
-        keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
-
-        signingConfigs {
-            release {
-                keyAlias keystoreProperties['keyAlias']
-                keyPassword keystoreProperties['keyPassword']
-                storeFile rootProject.file(keystoreProperties['storeFile'])
-                storePassword keystoreProperties['storePassword']
-            }
-        }
-    }
-    buildTypes {
-        release {
-            if (keystorePropertiesFile.exists()) signingConfig signingConfigs.release
-            minifyEnabled true
-            proguardFiles "proguard-android-optimize.txt", "proguard-rules.pro"
-        }
-        debug {
-            applicationIdSuffix ".debug"
-            versionNameSuffix "-debug"
-        }
-    }
-    lintOptions {
-        disable('LongLogTag')
-    }
-}
-
-dependencies {
-    implementation project(":tunnel")
-    implementation "androidx.activity:activity-ktx:$activityVersion"
-    implementation "androidx.annotation:annotation:$annotationsVersion"
-    implementation "androidx.appcompat:appcompat:$appcompatVersion"
-    implementation "androidx.constraintlayout:constraintlayout:$constraintLayoutVersion"
-    implementation "androidx.coordinatorlayout:coordinatorlayout:$coordinatorLayoutVersion"
-    implementation "androidx.biometric:biometric:$biometricVersion"
-    implementation "androidx.core:core-ktx:$coreKtxVersion"
-    implementation "androidx.databinding:databinding-runtime:$agpVersion"
-    implementation "androidx.fragment:fragment-ktx:$fragmentVersion"
-    implementation "androidx.preference:preference-ktx:$preferenceVersion"
-    implementation "androidx.lifecycle:lifecycle-runtime-ktx:$lifecycleRuntimeKtxVersion"
-    implementation "androidx.datastore:datastore-preferences:$datastoreVersion"
-    implementation "com.google.android.material:material:$materialComponentsVersion"
-    implementation "com.journeyapps:zxing-android-embedded:$zxingEmbeddedVersion"
-    implementation "org.jetbrains.kotlinx:kotlinx-coroutines-core:$coroutinesVersion"
-    implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:$coroutinesVersion"
-    coreLibraryDesugaring "com.android.tools:desugar_jdk_libs:$desugarVersion"
-}
-
-tasks.withType(JavaCompile) {
-    options.compilerArgs << '-Xlint:unchecked'
-    options.deprecation = true
-}
-
-tasks.withType(org.jetbrains.kotlin.gradle.tasks.KotlinCompile).all {
-    kotlinOptions {
-        jvmTarget = JavaVersion.VERSION_1_8
-    }
-}

ui/build.gradle.kts

@@ -0,0 +1,93 @@
+@file:Suppress("UnstableApiUsage")
+
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+
+val pkg: String = providers.gradleProperty("wireguardPackageName").get()
+
+plugins {
+    alias(libs.plugins.android.application)
+    alias(libs.plugins.kotlin.android)
+    alias(libs.plugins.kotlin.kapt)
+}
+
+android {
+    compileSdk = 36
+    buildFeatures {
+        buildConfig = true
+        dataBinding = true
+        viewBinding = true
+    }
+    namespace = pkg
+    defaultConfig {
+        applicationId = pkg
+        minSdk = 24
+        targetSdk = 36
+        versionCode = providers.gradleProperty("wireguardVersionCode").get().toInt()
+        versionName = providers.gradleProperty("wireguardVersionName").get()
+        buildConfigField("int", "MIN_SDK_VERSION", minSdk.toString())
+    }
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+        isCoreLibraryDesugaringEnabled = true
+    }
+    buildTypes {
+        release {
+            isMinifyEnabled = true
+            isShrinkResources = true
+            proguardFiles("proguard-android-optimize.txt")
+            packaging {
+                resources {
+                    excludes += "DebugProbesKt.bin"
+                    excludes += "kotlin-tooling-metadata.json"
+                    excludes += "META-INF/*.version"
+                }
+            }
+        }
+        debug {
+            applicationIdSuffix = ".debug"
+            versionNameSuffix = "-debug"
+        }
+        create("googleplay") {
+            initWith(getByName("release"))
+            matchingFallbacks += "release"
+        }
+    }
+    androidResources {
+        generateLocaleConfig = true
+    }
+    lint {
+        disable += "LongLogTag"
+        warning += "MissingTranslation"
+        warning += "ImpliedQuantity"
+    }
+}
+
+dependencies {
+    implementation(project(":tunnel"))
+    implementation(libs.androidx.activity.ktx)
+    implementation(libs.androidx.annotation)
+    implementation(libs.androidx.appcompat)
+    implementation(libs.androidx.constraintlayout)
+    implementation(libs.androidx.coordinatorlayout)
+    implementation(libs.androidx.biometric)
+    implementation(libs.androidx.core.ktx)
+    implementation(libs.androidx.fragment.ktx)
+    implementation(libs.androidx.preference.ktx)
+    implementation(libs.androidx.lifecycle.runtime.ktx)
+    implementation(libs.androidx.datastore.preferences)
+    implementation(libs.google.material)
+    implementation(libs.zxing.android.embedded)
+    implementation(libs.kotlinx.coroutines.android)
+    coreLibraryDesugaring(libs.desugarJdkLibs)
+}
+
+tasks.withType<JavaCompile>().configureEach {
+    options.compilerArgs.add("-Xlint:unchecked")
+    options.isDeprecation = true
+}
+
+tasks.withType<KotlinCompile>().configureEach {
+    compilerOptions.jvmTarget = JvmTarget.JVM_17
+}

ui/proguard-android-optimize.txt

@@ -1,7 +1,6 @@
 -allowaccessmodification
--dontpreverify
 -dontusemixedcaseclassnames
--dontskipnonpubliclibraryclasses
+-dontobfuscate
 -verbose
 
 -keepattributes *Annotation*

ui/proguard-rules.pro

@@ -1,14 +0,0 @@
-# Squelch all warnings, they're harmless but ProGuard
-# escalates them as errors.
--dontwarn sun.misc.Unsafe
-
-# Fragment 1.2.4 allows Fragment classes to be obfuscated but
-# databinding references in XML seem to not be rewritten to
-# match, so we preserve the names as 1.2.3 did.
--if public class ** extends androidx.fragment.app.Fragment
--keep public class <1> {
-    public <init>();
-}
-
-# Don't obfuscate
--dontobfuscate

ui/src/debug/res/values/strings.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">WireGuard β</string>
+    <string name="app_name" translatable="false">WireGuard β</string>
 </resources>

ui/src/googleplay/AndroidManifest.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+  ~ Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
+  ~ SPDX-License-Identifier: Apache-2.0
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <uses-permission
+        android:name="android.permission.REQUEST_INSTALL_PACKAGES"
+        tools:node="remove" />
+</manifest>

ui/src/main/AndroidManifest.xml

@@ -1,12 +1,18 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?><!--
+  ~ Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
+  ~ SPDX-License-Identifier: Apache-2.0
+  -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools"
-    package="com.wireguard.android"
     android:installLocation="internalOnly">
 
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+    <uses-permission
+        android:name="android.permission.SYSTEM_ALERT_WINDOW"
+        android:minSdkVersion="34" />
     <uses-permission
         android:name="android.permission.WRITE_EXTERNAL_STORAGE"
         android:maxSdkVersion="28"
@@ -18,6 +24,9 @@
     <uses-feature
         android:name="android.software.leanback"
         android:required="false" />
+    <uses-feature
+        android:name="android.hardware.camera.any"
+        android:required="false" />
     <uses-feature
         android:name="android.hardware.camera"
         android:required="false" />
@@ -33,6 +42,7 @@
         android:name=".Application"
         android:allowBackup="false"
         android:banner="@mipmap/banner"
+        android:enableOnBackInvokedCallback="true"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
@@ -41,9 +51,12 @@
 
         <activity
             android:name=".activity.TunnelToggleActivity"
+            android:excludeFromRecents="true"
             android:theme="@style/NoBackgroundTheme" />
 
-        <activity android:name=".activity.MainActivity">
+        <activity
+            android:name=".activity.MainActivity"
+            android:exported="true">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
 
@@ -57,6 +70,7 @@
 
         <activity
             android:name=".activity.TvMainActivity"
+            android:exported="true"
             android:theme="@style/TvTheme">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
@@ -81,6 +95,7 @@
 
         <activity
             android:name=".activity.LogViewerActivity"
+            android:exported="false"
             android:label="@string/log_viewer_title">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
@@ -93,15 +108,26 @@
             android:exported="false"
             android:grantUriPermissions="true" />
 
-        <receiver android:name=".BootShutdownReceiver">
+        <receiver
+            android:name=".BootShutdownReceiver"
+            android:exported="true">
             <intent-filter>
                 <action android:name="android.intent.action.ACTION_SHUTDOWN" />
                 <action android:name="android.intent.action.BOOT_COMPLETED" />
             </intent-filter>
         </receiver>
 
+        <receiver
+            android:name=".updater.Updater$AppUpdatedReceiver"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
+            </intent-filter>
+        </receiver>
+
         <receiver
             android:name=".model.TunnelManager$IntentReceiver"
+            android:exported="true"
             android:permission="${applicationId}.permission.CONTROL_TUNNELS">
             <intent-filter>
                 <action android:name="com.wireguard.android.action.REFRESH_TUNNEL_STATES" />
@@ -112,6 +138,7 @@
 
         <service
             android:name=".QuickTileService"
+            android:exported="true"
             android:icon="@drawable/ic_tile"
             android:permission="android.permission.BIND_QUICK_SETTINGS_TILE">
 
@@ -122,6 +149,10 @@
             <meta-data
                 android:name="android.service.quicksettings.ACTIVE_TILE"
                 android:value="false" />
+
+            <meta-data
+                android:name="android.service.quicksettings.TOGGLEABLE_TILE"
+                android:value="true" />
         </service>
 
         <meta-data

ui/src/main/java/com/wireguard/android/Application.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android
@@ -12,15 +12,17 @@ import android.os.StrictMode.ThreadPolicy
 import android.os.StrictMode.VmPolicy
 import android.util.Log
 import androidx.appcompat.app.AppCompatDelegate
-import androidx.datastore.DataStore
-import androidx.datastore.preferences.Preferences
-import androidx.datastore.preferences.createDataStore
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.PreferenceDataStoreFactory
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.preferencesDataStoreFile
+import com.google.android.material.color.DynamicColors
 import com.wireguard.android.backend.Backend
 import com.wireguard.android.backend.GoBackend
 import com.wireguard.android.backend.WgQuickBackend
 import com.wireguard.android.configStore.FileConfigStore
 import com.wireguard.android.model.TunnelManager
-import com.wireguard.android.util.ModuleLoader
+import com.wireguard.android.updater.Updater
 import com.wireguard.android.util.RootShell
 import com.wireguard.android.util.ToolsInstaller
 import com.wireguard.android.util.UserKnobs
@@ -34,6 +36,7 @@ import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.flow.launchIn
 import kotlinx.coroutines.flow.onEach
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
 import java.lang.ref.WeakReference
 import java.util.Locale
 
@@ -41,7 +44,6 @@ class Application : android.app.Application() {
     private val futureBackend = CompletableDeferred<Backend>()
     private val coroutineScope = CoroutineScope(Job() + Dispatchers.Main.immediate)
     private var backend: Backend? = null
-    private lateinit var moduleLoader: ModuleLoader
     private lateinit var rootShell: RootShell
     private lateinit var preferencesDataStore: DataStore<Preferences>
     private lateinit var toolsInstaller: ToolsInstaller
@@ -57,27 +59,13 @@ class Application : android.app.Application() {
             startActivity(intent)
             System.exit(0)
         }
-        if (BuildConfig.DEBUG) {
-            StrictMode.setVmPolicy(VmPolicy.Builder().detectAll().penaltyLog().build())
-            StrictMode.setThreadPolicy(ThreadPolicy.Builder().detectAll().penaltyLog().build())
-        }
     }
 
     private suspend fun determineBackend(): Backend {
         var backend: Backend? = null
-        var didStartRootShell = false
-        if (!ModuleLoader.isModuleLoaded() && moduleLoader.moduleMightExist()) {
+        if (UserKnobs.enableKernelModule.first() && WgQuickBackend.hasKernelSupport()) {
             try {
                 rootShell.start()
-                didStartRootShell = true
-                moduleLoader.loadModule()
-            } catch (ignored: Exception) {
-            }
-        }
-        if (!UserKnobs.disableKernelModule.first() && ModuleLoader.isModuleLoaded()) {
-            try {
-                if (!didStartRootShell)
-                    rootShell.start()
                 val wgQuickBackend = WgQuickBackend(applicationContext, rootShell, toolsInstaller)
                 wgQuickBackend.setMultipleTunnels(UserKnobs.multipleTunnels.first())
                 backend = wgQuickBackend
@@ -97,15 +85,24 @@ class Application : android.app.Application() {
     override fun onCreate() {
         Log.i(TAG, USER_AGENT)
         super.onCreate()
+        DynamicColors.applyToActivitiesIfAvailable(this)
         rootShell = RootShell(applicationContext)
         toolsInstaller = ToolsInstaller(applicationContext, rootShell)
-        moduleLoader = ModuleLoader(applicationContext, rootShell, USER_AGENT)
-        preferencesDataStore = applicationContext.createDataStore(name = "settings")
+        preferencesDataStore = PreferenceDataStoreFactory.create { applicationContext.preferencesDataStoreFile("settings") }
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
-            coroutineScope.launch {
-                AppCompatDelegate.setDefaultNightMode(
-                        if (UserKnobs.darkTheme.first()) AppCompatDelegate.MODE_NIGHT_YES else AppCompatDelegate.MODE_NIGHT_NO)
+            runBlocking {
+                AppCompatDelegate.setDefaultNightMode(if (UserKnobs.darkTheme.first()) AppCompatDelegate.MODE_NIGHT_YES else AppCompatDelegate.MODE_NIGHT_NO)
             }
+            UserKnobs.darkTheme.onEach {
+                val newMode = if (it) {
+                    AppCompatDelegate.MODE_NIGHT_YES
+                } else {
+                    AppCompatDelegate.MODE_NIGHT_NO
+                }
+                if (AppCompatDelegate.getDefaultNightMode() != newMode) {
+                    AppCompatDelegate.setDefaultNightMode(newMode)
+                }
+            }.launchIn(coroutineScope)
         } else {
             AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM)
         }
@@ -119,6 +116,12 @@ class Application : android.app.Application() {
                 Log.e(TAG, Log.getStackTraceString(e))
             }
         }
+        Updater.monitorForUpdates()
+
+        if (BuildConfig.DEBUG) {
+            StrictMode.setVmPolicy(VmPolicy.Builder().detectAll().penaltyLog().build())
+            StrictMode.setThreadPolicy(ThreadPolicy.Builder().detectAll().penaltyLog().build())
+        }
     }
 
     override fun onTerminate() {
@@ -131,30 +134,20 @@ class Application : android.app.Application() {
         private const val TAG = "WireGuard/Application"
         private lateinit var weakSelf: WeakReference<Application>
 
-        @JvmStatic
         fun get(): Application {
             return weakSelf.get()!!
         }
 
-        @JvmStatic
         suspend fun getBackend() = get().futureBackend.await()
 
-        @JvmStatic
-        fun getModuleLoader() = get().moduleLoader
-
-        @JvmStatic
         fun getRootShell() = get().rootShell
 
-        @JvmStatic
         fun getPreferencesDataStore() = get().preferencesDataStore
 
-        @JvmStatic
         fun getToolsInstaller() = get().toolsInstaller
 
-        @JvmStatic
         fun getTunnelManager() = get().tunnelManager
 
-        @JvmStatic
         fun getCoroutineScope() = get().coroutineScope
     }
 

ui/src/main/java/com/wireguard/android/BootShutdownReceiver.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android
@@ -14,9 +14,9 @@ import kotlinx.coroutines.launch
 
 class BootShutdownReceiver : BroadcastReceiver() {
     override fun onReceive(context: Context, intent: Intent) {
+        val action = intent.action ?: return
         applicationScope.launch {
             if (Application.getBackend() !is WgQuickBackend) return@launch
-            val action = intent.action ?: return@launch
             val tunnelManager = Application.getTunnelManager()
             if (Intent.ACTION_BOOT_COMPLETED == action) {
                 Log.i(TAG, "Broadcast receiver restoring state (boot)")

ui/src/main/java/com/wireguard/android/QuickTileService.kt

@@ -1,15 +1,18 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android
 
+import android.app.PendingIntent
 import android.content.Intent
 import android.graphics.Bitmap
 import android.graphics.Canvas
 import android.graphics.drawable.Icon
+import android.net.Uri
 import android.os.Build
 import android.os.IBinder
+import android.provider.Settings
 import android.service.quicksettings.Tile
 import android.service.quicksettings.TileService
 import android.util.Log
@@ -29,7 +32,6 @@ import kotlinx.coroutines.launch
  * system framework as necessary to update the appearance of the tile in the system UI, and to
  * forward click events to the application.
  */
-@RequiresApi(Build.VERSION_CODES.N)
 class QuickTileService : TileService() {
     private val onStateChangedCallback = OnStateChangedCallback()
     private val onTunnelChangedCallback = OnTunnelChangedCallback()
@@ -49,32 +51,59 @@ class QuickTileService : TileService() {
     }
 
     override fun onClick() {
-        if (tunnel != null) {
-            unlockAndRun {
-                val tile = qsTile
-                if (tile != null) {
-                    tile.icon = if (tile.icon == iconOn) iconOff else iconOn
-                    tile.updateTile()
+        applicationScope.launch {
+            if (tunnel == null) {
+                Application.getTunnelManager().getTunnels()
+                updateTile()
+            }
+            when (val tunnel = tunnel) {
+                null -> {
+                    Log.d(TAG, "No tunnel set, so launching main activity")
+                    val intent = Intent(this@QuickTileService, MainActivity::class.java)
+                    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                        startActivityAndCollapse(PendingIntent.getActivity(this@QuickTileService, 0, intent, PendingIntent.FLAG_IMMUTABLE))
+                    } else {
+                        @Suppress("DEPRECATION")
+                        startActivityAndCollapse(intent)
+                    }
                 }
-                applicationScope.launch {
-                    try {
-                        tunnel!!.setStateAsync(Tunnel.State.TOGGLE)
-                        updateTile()
-                    } catch (_: Throwable) {
-                        val toggleIntent = Intent(this@QuickTileService, TunnelToggleActivity::class.java)
-                        toggleIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                        startActivity(toggleIntent)
+
+                else -> {
+                    unlockAndRun {
+                        applicationScope.launch {
+                            try {
+                                tunnel.setStateAsync(Tunnel.State.TOGGLE)
+                                updateTile()
+                            } catch (e: Throwable) {
+                                Log.d(TAG, "Failed to set state, so falling back", e)
+                                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE && !Settings.canDrawOverlays(this@QuickTileService)) {
+                                    Log.d(TAG, "Need overlay permissions")
+                                    val permissionIntent = Intent(Settings.ACTION_MANAGE_OVERLAY_PERMISSION, Uri.parse("package:$packageName"))
+                                    permissionIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                                    startActivityAndCollapse(
+                                        PendingIntent.getActivity(
+                                            this@QuickTileService,
+                                            0,
+                                            permissionIntent,
+                                            PendingIntent.FLAG_IMMUTABLE
+                                        )
+                                    )
+                                    return@launch
+                                }
+                                val toggleIntent = Intent(this@QuickTileService, TunnelToggleActivity::class.java)
+                                toggleIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                                startActivity(toggleIntent)
+                            }
+                        }
                     }
                 }
             }
-        } else {
-            val intent = Intent(this, MainActivity::class.java)
-            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-            startActivityAndCollapse(intent)
         }
     }
 
     override fun onCreate() {
+        isAdded = true
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
             iconOn = Icon.createWithResource(this, R.drawable.ic_tile)
             iconOff = iconOn
@@ -84,55 +113,64 @@ class QuickTileService : TileService() {
         icon.setAnimationEnabled(false) /* Unfortunately we can't have animations, since Icons are marshaled. */
         icon.setSlashed(false)
         var b = Bitmap.createBitmap(icon.intrinsicWidth, icon.intrinsicHeight, Bitmap.Config.ARGB_8888)
-                ?: return
         var c = Canvas(b)
         icon.setBounds(0, 0, c.width, c.height)
         icon.draw(c)
         iconOn = Icon.createWithBitmap(b)
         icon.setSlashed(true)
         b = Bitmap.createBitmap(icon.intrinsicWidth, icon.intrinsicHeight, Bitmap.Config.ARGB_8888)
-                ?: return
         c = Canvas(b)
         icon.setBounds(0, 0, c.width, c.height)
         icon.draw(c)
         iconOff = Icon.createWithBitmap(b)
     }
 
+    override fun onDestroy() {
+        super.onDestroy()
+        isAdded = false
+    }
+
     override fun onStartListening() {
         Application.getTunnelManager().addOnPropertyChangedCallback(onTunnelChangedCallback)
-        if (tunnel != null) tunnel!!.addOnPropertyChangedCallback(onStateChangedCallback)
+        tunnel?.addOnPropertyChangedCallback(onStateChangedCallback)
         updateTile()
     }
 
     override fun onStopListening() {
-        if (tunnel != null) tunnel!!.removeOnPropertyChangedCallback(onStateChangedCallback)
+        tunnel?.removeOnPropertyChangedCallback(onStateChangedCallback)
         Application.getTunnelManager().removeOnPropertyChangedCallback(onTunnelChangedCallback)
     }
 
+    override fun onTileAdded() {
+        isAdded = true
+    }
+
+    override fun onTileRemoved() {
+        isAdded = false
+    }
+
     private fun updateTile() {
         // Update the tunnel.
         val newTunnel = Application.getTunnelManager().lastUsedTunnel
         if (newTunnel != tunnel) {
-            if (tunnel != null) tunnel!!.removeOnPropertyChangedCallback(onStateChangedCallback)
+            tunnel?.removeOnPropertyChangedCallback(onStateChangedCallback)
             tunnel = newTunnel
-            if (tunnel != null) tunnel!!.addOnPropertyChangedCallback(onStateChangedCallback)
+            tunnel?.addOnPropertyChangedCallback(onStateChangedCallback)
         }
         // Update the tile contents.
-        val label: String
-        val state: Int
-        val tile = qsTile
-        if (tunnel != null) {
-            label = tunnel!!.name
-            state = if (tunnel!!.state == Tunnel.State.UP) Tile.STATE_ACTIVE else Tile.STATE_INACTIVE
-        } else {
-            label = getString(R.string.app_name)
-            state = Tile.STATE_INACTIVE
-        }
-        if (tile == null) return
-        tile.label = label
-        if (tile.state != state) {
-            tile.icon = if (state == Tile.STATE_ACTIVE) iconOn else iconOff
-            tile.state = state
+        val tile = qsTile ?: return
+
+        when (val tunnel = tunnel) {
+            null -> {
+                tile.label = getString(R.string.app_name)
+                tile.state = Tile.STATE_INACTIVE
+                tile.icon = iconOff
+            }
+            else -> {
+                tile.label = tunnel.name
+                tile.state = if (tunnel.state == Tunnel.State.UP) Tile.STATE_ACTIVE else Tile.STATE_INACTIVE
+                tile.icon = if (tunnel.state == Tunnel.State.UP) iconOn else iconOff
+            }
         }
         tile.updateTile()
     }
@@ -143,19 +181,23 @@ class QuickTileService : TileService() {
                 sender.removeOnPropertyChangedCallback(this)
                 return
             }
-            if (propertyId != 0 && propertyId != BR.state) return
+            if (propertyId != 0 && propertyId != BR.state)
+                return
             updateTile()
         }
     }
 
     private inner class OnTunnelChangedCallback : OnPropertyChangedCallback() {
         override fun onPropertyChanged(sender: Observable, propertyId: Int) {
-            if (propertyId != 0 && propertyId != BR.lastUsedTunnel) return
+            if (propertyId != 0 && propertyId != BR.lastUsedTunnel)
+                return
             updateTile()
         }
     }
 
     companion object {
         private const val TAG = "WireGuard/QuickTileService"
+        var isAdded: Boolean = false
+            private set
     }
 }

ui/src/main/java/com/wireguard/android/activity/BaseActivity.kt

@@ -1,28 +1,36 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.activity
 
 import android.os.Bundle
+import androidx.appcompat.app.AppCompatActivity
 import androidx.databinding.CallbackRegistry
 import androidx.databinding.CallbackRegistry.NotifierCallback
 import androidx.lifecycle.lifecycleScope
 import com.wireguard.android.Application
 import com.wireguard.android.model.ObservableTunnel
+import kotlinx.coroutines.launch
 
 /**
  * Base class for activities that need to remember the currently-selected tunnel.
  */
-abstract class BaseActivity : ThemeChangeAwareActivity() {
+abstract class BaseActivity : AppCompatActivity() {
     private val selectionChangeRegistry = SelectionChangeRegistry()
+    private var created = false
     var selectedTunnel: ObservableTunnel? = null
         set(value) {
             val oldTunnel = field
             if (oldTunnel == value) return
             field = value
-            onSelectedTunnelChanged(oldTunnel, value)
-            selectionChangeRegistry.notifyCallbacks(oldTunnel, 0, value)
+            if (created) {
+                if (!onSelectedTunnelChanged(oldTunnel, value)) {
+                    field = oldTunnel
+                } else {
+                    selectionChangeRegistry.notifyCallbacks(oldTunnel, 0, value)
+                }
+            }
         }
 
     fun addOnSelectedTunnelChangedListener(listener: OnSelectedTunnelChangedListener) {
@@ -30,17 +38,25 @@ abstract class BaseActivity : ThemeChangeAwareActivity() {
     }
 
     override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
         // Restore the saved tunnel if there is one; otherwise grab it from the arguments.
         val savedTunnelName = when {
             savedInstanceState != null -> savedInstanceState.getString(KEY_SELECTED_TUNNEL)
             intent != null -> intent.getStringExtra(KEY_SELECTED_TUNNEL)
             else -> null
         }
-        if (savedTunnelName != null)
-            lifecycleScope.launchWhenCreated { selectedTunnel = Application.getTunnelManager().getTunnels()[savedTunnelName] }
-
-        // The selected tunnel must be set before the superclass method recreates fragments.
-        super.onCreate(savedInstanceState)
+        if (savedTunnelName != null) {
+            lifecycleScope.launch {
+                val tunnel = Application.getTunnelManager().getTunnels()[savedTunnelName]
+                if (tunnel == null)
+                    created = true
+                selectedTunnel = tunnel
+                created = true
+            }
+        } else {
+            created = true
+        }
     }
 
     override fun onSaveInstanceState(outState: Bundle) {
@@ -48,10 +64,11 @@ abstract class BaseActivity : ThemeChangeAwareActivity() {
         super.onSaveInstanceState(outState)
     }
 
-    protected abstract fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?)
+    protected abstract fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?): Boolean
 
     fun removeOnSelectedTunnelChangedListener(
-            listener: OnSelectedTunnelChangedListener) {
+        listener: OnSelectedTunnelChangedListener
+    ) {
         selectionChangeRegistry.remove(listener)
     }
 
@@ -61,17 +78,17 @@ abstract class BaseActivity : ThemeChangeAwareActivity() {
 
     private class SelectionChangeNotifier : NotifierCallback<OnSelectedTunnelChangedListener, ObservableTunnel, ObservableTunnel>() {
         override fun onNotifyCallback(
-                listener: OnSelectedTunnelChangedListener,
-                oldTunnel: ObservableTunnel?,
-                ignored: Int,
-                newTunnel: ObservableTunnel?
+            listener: OnSelectedTunnelChangedListener,
+            oldTunnel: ObservableTunnel?,
+            ignored: Int,
+            newTunnel: ObservableTunnel?
         ) {
             listener.onSelectedTunnelChanged(oldTunnel, newTunnel)
         }
     }
 
     private class SelectionChangeRegistry :
-            CallbackRegistry<OnSelectedTunnelChangedListener, ObservableTunnel, ObservableTunnel>(SelectionChangeNotifier())
+        CallbackRegistry<OnSelectedTunnelChangedListener, ObservableTunnel, ObservableTunnel>(SelectionChangeNotifier())
 
     companion object {
         private const val KEY_SELECTED_TUNNEL = "selected_tunnel"

ui/src/main/java/com/wireguard/android/activity/LogViewerActivity.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -27,6 +27,7 @@ import android.view.View
 import android.view.ViewGroup
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
+import androidx.collection.CircularArray
 import androidx.core.app.ShareCompat
 import androidx.core.content.res.ResourcesCompat
 import androidx.lifecycle.lifecycleScope
@@ -40,6 +41,7 @@ import com.wireguard.android.R
 import com.wireguard.android.databinding.LogViewerActivityBinding
 import com.wireguard.android.util.DownloadsFileSaver
 import com.wireguard.android.util.ErrorMessages
+import com.wireguard.android.util.resolveAttribute
 import com.wireguard.crypto.KeyPair
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -61,8 +63,8 @@ import java.util.regex.Pattern
 class LogViewerActivity : AppCompatActivity() {
     private lateinit var binding: LogViewerActivityBinding
     private lateinit var logAdapter: LogEntryAdapter
-    private var logLines = arrayListOf<LogLine>()
-    private var rawLogLines = StringBuffer()
+    private var logLines = CircularArray<LogLine>()
+    private var rawLogLines = CircularArray<String>()
     private var recyclerView: RecyclerView? = null
     private var saveButton: MenuItem? = null
     private val year by lazy {
@@ -70,7 +72,7 @@ class LogViewerActivity : AppCompatActivity() {
         yearFormatter.format(Date())
     }
 
-    private val defaultColor by lazy { ResourcesCompat.getColor(resources, R.color.primary_text_color, theme) }
+    private val defaultColor by lazy { resolveAttribute(com.google.android.material.R.attr.colorOnSurface) }
 
     private val debugColor by lazy { ResourcesCompat.getColor(resources, R.color.debug_tag_color, theme) }
 
@@ -110,25 +112,27 @@ class LogViewerActivity : AppCompatActivity() {
         }
 
         binding.shareFab.setOnClickListener {
-            revokeLastUri()
-            val key = KeyPair().privateKey.toHex()
-            LOGS[key] = rawLogLines.toString().toByteArray(Charsets.UTF_8)
-            lastUri = Uri.parse("content://${BuildConfig.APPLICATION_ID}.exported-log/$key")
-            val shareIntent = ShareCompat.IntentBuilder.from(this)
+            lifecycleScope.launch {
+                revokeLastUri()
+                val key = KeyPair().privateKey.toHex()
+                LOGS[key] = rawLogBytes()
+                lastUri = Uri.parse("content://${BuildConfig.APPLICATION_ID}.exported-log/$key")
+                val shareIntent = ShareCompat.IntentBuilder(this@LogViewerActivity)
                     .setType("text/plain")
                     .setSubject(getString(R.string.log_export_subject))
                     .setStream(lastUri)
                     .setChooserTitle(R.string.log_export_title)
                     .createChooserIntent()
                     .addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
-            grantUriPermission("android", lastUri, Intent.FLAG_GRANT_READ_URI_PERMISSION)
-            revokeLastActivityResultLauncher.launch(shareIntent)
+                grantUriPermission("android", lastUri, Intent.FLAG_GRANT_READ_URI_PERMISSION)
+                revokeLastActivityResultLauncher.launch(shareIntent)
+            }
         }
     }
 
-    override fun onCreateOptionsMenu(menu: Menu?): Boolean {
+    override fun onCreateOptionsMenu(menu: Menu): Boolean {
         menuInflater.inflate(R.menu.log_viewer, menu)
-        saveButton = menu?.findItem(R.id.save_log)
+        saveButton = menu.findItem(R.id.save_log)
         return true
     }
 
@@ -138,24 +142,37 @@ class LogViewerActivity : AppCompatActivity() {
                 finish()
                 true
             }
+
             R.id.save_log -> {
                 saveButton?.isEnabled = false
                 lifecycleScope.launch { saveLog() }
                 true
             }
+
             else -> super.onOptionsItemSelected(item)
         }
     }
 
     private val downloadsFileSaver = DownloadsFileSaver(this)
 
+    private suspend fun rawLogBytes(): ByteArray {
+        val builder = StringBuilder()
+        withContext(Dispatchers.IO) {
+            for (i in 0 until rawLogLines.size()) {
+                builder.append(rawLogLines[i])
+                builder.append('\n')
+            }
+        }
+        return builder.toString().toByteArray(Charsets.UTF_8)
+    }
+
     private suspend fun saveLog() {
         var exception: Throwable? = null
         var outputFile: DownloadsFileSaver.DownloadsFile? = null
         withContext(Dispatchers.IO) {
             try {
                 outputFile = downloadsFileSaver.save("wireguard-log.txt", "text/plain", true)
-                outputFile?.outputStream?.write(rawLogLines.toString().toByteArray(Charsets.UTF_8))
+                outputFile?.outputStream?.write(rawLogBytes())
             } catch (e: Throwable) {
                 outputFile?.delete()
                 exception = e
@@ -164,12 +181,14 @@ class LogViewerActivity : AppCompatActivity() {
         saveButton?.isEnabled = true
         if (outputFile == null)
             return
-        Snackbar.make(findViewById(android.R.id.content),
-                if (exception == null) getString(R.string.log_export_success, outputFile?.fileName)
-                else getString(R.string.log_export_error, ErrorMessages[exception]),
-                if (exception == null) Snackbar.LENGTH_SHORT else Snackbar.LENGTH_LONG)
-                .setAnchorView(binding.shareFab)
-                .show()
+        Snackbar.make(
+            findViewById(android.R.id.content),
+            if (exception == null) getString(R.string.log_export_success, outputFile.fileName)
+            else getString(R.string.log_export_error, ErrorMessages[exception]),
+            if (exception == null) Snackbar.LENGTH_SHORT else Snackbar.LENGTH_LONG
+        )
+            .setAnchorView(binding.shareFab)
+            .show()
     }
 
     private suspend fun streamingLog() = withContext(Dispatchers.IO) {
@@ -184,40 +203,60 @@ class LogViewerActivity : AppCompatActivity() {
                 return@withContext
             }
             val stdout = BufferedReader(InputStreamReader(process!!.inputStream, StandardCharsets.UTF_8))
-            var haveScrolled = false
-            val start = System.nanoTime()
-            var startPeriod = start
+
+            var posStart = 0
+            var timeLastNotify = System.nanoTime()
+            var priorModified = false
+            val bufferedLogLines = arrayListOf<LogLine>()
+            var timeout = 1000000000L / 2 // The timeout is initially small so that the view gets populated immediately.
+            val MAX_LINES = (1 shl 16) - 1
+            val MAX_BUFFERED_LINES = (1 shl 14) - 1
+
             while (true) {
                 val line = stdout.readLine() ?: break
-                rawLogLines.append(line)
-                rawLogLines.append('\n')
+                if (rawLogLines.size() >= MAX_LINES)
+                    rawLogLines.popFirst()
+                rawLogLines.addLast(line)
                 val logLine = parseLine(line)
-                withContext(Dispatchers.Main.immediate) {
-                    if (logLine != null) {
-                        recyclerView?.let {
-                            val shouldScroll = haveScrolled && !it.canScrollVertically(1)
-                            logLines.add(logLine)
-                            if (haveScrolled) logAdapter.notifyDataSetChanged()
-                            if (shouldScroll)
-                                it.scrollToPosition(logLines.size - 1)
-                        }
-                    } else {
-                        /* TODO: I'd prefer for the next line to be:
-                         * logLines.lastOrNull()?.msg += "\n$line"
-                         * However, as of writing, that causes the kotlin compiler to freak out and crash, spewing bytecode.
-                         */
-                        logLines.lastOrNull()?.apply { msg += "\n$line" }
-                        if (haveScrolled) logAdapter.notifyDataSetChanged()
+                if (logLine != null) {
+                    bufferedLogLines.add(logLine)
+                } else {
+                    if (bufferedLogLines.isNotEmpty()) {
+                        bufferedLogLines.last().msg += "\n$line"
+                    } else if (!logLines.isEmpty()) {
+                        logLines[logLines.size() - 1].msg += "\n$line"
+                        priorModified = true
                     }
-                    if (!haveScrolled) {
-                        val end = System.nanoTime()
-                        val scroll = (end - start) > 1000000000L * 2.5 || !stdout.ready()
-                        if (logLines.isNotEmpty() && (scroll || (end - startPeriod) > 1000000000L / 4)) {
-                            logAdapter.notifyDataSetChanged()
-                            recyclerView?.scrollToPosition(logLines.size - 1)
-                            startPeriod = end
-                        }
-                        if (scroll) haveScrolled = true
+                }
+                val timeNow = System.nanoTime()
+                if (bufferedLogLines.size < MAX_BUFFERED_LINES && (timeNow - timeLastNotify) < timeout && stdout.ready())
+                    continue
+                timeout = 1000000000L * 5 / 2 // Increase the timeout after the initial view has something in it.
+                timeLastNotify = timeNow
+
+                withContext(Dispatchers.Main.immediate) {
+                    val isScrolledToBottomAlready = recyclerView?.canScrollVertically(1) == false
+                    if (priorModified) {
+                        logAdapter.notifyItemChanged(posStart - 1)
+                        priorModified = false
+                    }
+                    val fullLen = logLines.size() + bufferedLogLines.size
+                    if (fullLen >= MAX_LINES) {
+                        val numToRemove = fullLen - MAX_LINES + 1
+                        logLines.removeFromStart(numToRemove)
+                        logAdapter.notifyItemRangeRemoved(0, numToRemove)
+                        posStart -= numToRemove
+
+                    }
+                    for (bufferedLine in bufferedLogLines) {
+                        logLines.addLast(bufferedLine)
+                    }
+                    bufferedLogLines.clear()
+                    logAdapter.notifyItemRangeInserted(posStart, logLines.size() - posStart)
+                    posStart = logLines.size()
+
+                    if (isScrolledToBottomAlready) {
+                        recyclerView?.scrollToPosition(logLines.size() - 1)
                     }
                 }
             }
@@ -252,7 +291,8 @@ class LogViewerActivity : AppCompatActivity() {
          *
          * <pre>05-26 11:02:36.886 5689 5689 D AndroidRuntime: CheckJNI is OFF.</pre>
          */
-        private val THREADTIME_LINE: Pattern = Pattern.compile("^(\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}.\\d{3})(?:\\s+[0-9A-Za-z]+)?\\s+(\\d+)\\s+(\\d+)\\s+([A-Z])\\s+(.+?)\\s*: (.*)$")
+        private val THREADTIME_LINE: Pattern =
+            Pattern.compile("^(\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}.\\d{3})(?:\\s+[0-9A-Za-z]+)?\\s+(\\d+)\\s+(\\d+)\\s+([A-Z])\\s+(.+?)\\s*: (.*)$")
         private val LOGS: MutableMap<String, ByteArray> = ConcurrentHashMap()
         private const val TAG = "WireGuard/LogViewerActivity"
     }
@@ -263,7 +303,7 @@ class LogViewerActivity : AppCompatActivity() {
 
         private fun levelToColor(level: String): Int {
             return when (level) {
-                "D" -> debugColor
+                "V", "D" -> debugColor
                 "E" -> errorColor
                 "I" -> infoColor
                 "W" -> warningColor
@@ -271,11 +311,11 @@ class LogViewerActivity : AppCompatActivity() {
             }
         }
 
-        override fun getItemCount() = logLines.size
+        override fun getItemCount() = logLines.size()
 
         override fun onCreateViewHolder(parent: ViewGroup, viewType: Int): ViewHolder {
             val view = LayoutInflater.from(parent.context)
-                    .inflate(R.layout.log_viewer_entry, parent, false)
+                .inflate(R.layout.log_viewer_entry, parent, false)
             return ViewHolder(view)
         }
 
@@ -286,8 +326,10 @@ class LogViewerActivity : AppCompatActivity() {
             else
                 SpannableString("${line.tag}: ${line.msg}").apply {
                     setSpan(StyleSpan(BOLD), 0, "${line.tag}:".length, Spannable.SPAN_EXCLUSIVE_EXCLUSIVE)
-                    setSpan(ForegroundColorSpan(levelToColor(line.level)),
-                            0, "${line.tag}:".length, Spannable.SPAN_EXCLUSIVE_EXCLUSIVE)
+                    setSpan(
+                        ForegroundColorSpan(levelToColor(line.level)),
+                        0, "${line.tag}:".length, Spannable.SPAN_EXCLUSIVE_EXCLUSIVE
+                    )
                 }
             holder.layout.apply {
                 findViewById<MaterialTextView>(R.id.log_date).text = line.time.toString()
@@ -309,11 +351,11 @@ class LogViewerActivity : AppCompatActivity() {
         override fun insert(uri: Uri, values: ContentValues?): Uri? = null
 
         override fun query(uri: Uri, projection: Array<out String>?, selection: String?, selectionArgs: Array<out String>?, sortOrder: String?): Cursor? =
-                logForUri(uri)?.let {
-                    val m = MatrixCursor(arrayOf(android.provider.OpenableColumns.DISPLAY_NAME, android.provider.OpenableColumns.SIZE), 1)
-                    m.addRow(arrayOf("wireguard-log.txt", it.size.toLong()))
-                    m
-                }
+            logForUri(uri)?.let {
+                val m = MatrixCursor(arrayOf(android.provider.OpenableColumns.DISPLAY_NAME, android.provider.OpenableColumns.SIZE), 1)
+                m.addRow(arrayOf<Any>("wireguard-log.txt", it.size.toLong()))
+                m
+            }
 
         override fun onCreate(): Boolean = true
 
@@ -323,7 +365,8 @@ class LogViewerActivity : AppCompatActivity() {
 
         override fun getType(uri: Uri): String? = logForUri(uri)?.let { "text/plain" }
 
-        override fun getStreamTypes(uri: Uri, mimeTypeFilter: String): Array<String>? = getType(uri)?.let { if (compareMimeTypes(it, mimeTypeFilter)) arrayOf(it) else null }
+        override fun getStreamTypes(uri: Uri, mimeTypeFilter: String): Array<String>? =
+            getType(uri)?.let { if (compareMimeTypes(it, mimeTypeFilter)) arrayOf(it) else null }
 
         override fun openFile(uri: Uri, mode: String): ParcelFileDescriptor? {
             if (mode != "r") return null

ui/src/main/java/com/wireguard/android/activity/MainActivity.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.activity
@@ -9,6 +9,8 @@ import android.os.Bundle
 import android.view.Menu
 import android.view.MenuItem
 import android.view.View
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.addCallback
 import androidx.appcompat.app.ActionBar
 import androidx.fragment.app.FragmentManager
 import androidx.fragment.app.FragmentTransaction
@@ -26,27 +28,29 @@ import com.wireguard.android.model.ObservableTunnel
 class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener {
     private var actionBar: ActionBar? = null
     private var isTwoPaneLayout = false
+    private var backPressedCallback: OnBackPressedCallback? = null
 
-    override fun onBackPressed() {
+    private fun handleBackPressed() {
         val backStackEntries = supportFragmentManager.backStackEntryCount
         // If the two-pane layout does not have an editor open, going back should exit the app.
         if (isTwoPaneLayout && backStackEntries <= 1) {
             finish()
             return
         }
-        // Deselect the current tunnel on navigating back from the detail pane to the one-pane list.
-        if (!isTwoPaneLayout && backStackEntries == 1) {
+
+        if (backStackEntries >= 1)
             supportFragmentManager.popBackStack()
+
+        // Deselect the current tunnel on navigating back from the detail pane to the one-pane list.
+        if (backStackEntries == 1)
             selectedTunnel = null
-            return
-        }
-        super.onBackPressed()
     }
 
     override fun onBackStackChanged() {
+        val backStackEntries = supportFragmentManager.backStackEntryCount
+        backPressedCallback?.isEnabled = backStackEntries >= 1
         if (actionBar == null) return
         // Do not show the home menu when the two-pane layout is at the detail view (see above).
-        val backStackEntries = supportFragmentManager.backStackEntryCount
         val minBackStackEntries = if (isTwoPaneLayout) 2 else 1
         actionBar!!.setDisplayHomeAsUpEnabled(backStackEntries >= minBackStackEntries)
     }
@@ -57,6 +61,7 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
         actionBar = supportActionBar
         isTwoPaneLayout = findViewById<View?>(R.id.master_detail_wrapper) != null
         supportFragmentManager.addOnBackStackChangedListener(this)
+        backPressedCallback = onBackPressedDispatcher.addCallback(this) { handleBackPressed() }
         onBackStackChanged()
     }
 
@@ -69,12 +74,13 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
         return when (item.itemId) {
             android.R.id.home -> {
                 // The back arrow in the action bar should act the same as the back button.
-                onBackPressed()
+                onBackPressedDispatcher.onBackPressed()
                 true
             }
+
             R.id.menu_action_edit -> {
                 supportFragmentManager.commit {
-                    replace(R.id.detail_container, TunnelEditorFragment())
+                    replace(if (isTwoPaneLayout) R.id.detail_container else R.id.list_detail_container, TunnelEditorFragment())
                     setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
                     addToBackStack(null)
                 }
@@ -86,18 +92,25 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
                 startActivity(Intent(this, SettingsActivity::class.java))
                 true
             }
+
             else -> super.onOptionsItemSelected(item)
         }
     }
 
-    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?,
-                                         newTunnel: ObservableTunnel?) {
+    override fun onSelectedTunnelChanged(
+        oldTunnel: ObservableTunnel?,
+        newTunnel: ObservableTunnel?
+    ): Boolean {
         val fragmentManager = supportFragmentManager
+        if (fragmentManager.isStateSaved) {
+            return false
+        }
+
         val backStackEntries = fragmentManager.backStackEntryCount
         if (newTunnel == null) {
             // Clear everything off the back stack (all editors and detail fragments).
             fragmentManager.popBackStackImmediate(0, FragmentManager.POP_BACK_STACK_INCLUSIVE)
-            return
+            return true
         }
         if (backStackEntries == 2) {
             // Pop the editor off the back stack to reveal the detail fragment. Use the immediate
@@ -106,10 +119,11 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
         } else if (backStackEntries == 0) {
             // Create and show a new detail fragment.
             fragmentManager.commit {
-                add(R.id.detail_container, TunnelDetailFragment())
+                add(if (isTwoPaneLayout) R.id.detail_container else R.id.list_detail_container, TunnelDetailFragment())
                 setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
                 addToBackStack(null)
             }
         }
+        return true
     }
 }

ui/src/main/java/com/wireguard/android/activity/SettingsActivity.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.activity
@@ -7,17 +7,21 @@ package com.wireguard.android.activity
 import android.content.Intent
 import android.os.Build
 import android.os.Bundle
+import android.view.LayoutInflater
 import android.view.MenuItem
+import android.view.View
+import android.view.ViewGroup
+import androidx.appcompat.app.AppCompatActivity
 import androidx.fragment.app.commit
 import androidx.lifecycle.lifecycleScope
 import androidx.preference.Preference
 import androidx.preference.PreferenceFragmentCompat
 import com.wireguard.android.Application
+import com.wireguard.android.QuickTileService
 import com.wireguard.android.R
 import com.wireguard.android.backend.WgQuickBackend
 import com.wireguard.android.preference.PreferencesPreferenceDataStore
 import com.wireguard.android.util.AdminKnobs
-import com.wireguard.android.util.ModuleLoader
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
@@ -25,7 +29,7 @@ import kotlinx.coroutines.withContext
 /**
  * Interface for changing application-global persistent settings.
  */
-class SettingsActivity : ThemeChangeAwareActivity() {
+class SettingsActivity : AppCompatActivity() {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         if (supportFragmentManager.findFragmentById(android.R.id.content) == null) {
@@ -44,27 +48,38 @@ class SettingsActivity : ThemeChangeAwareActivity() {
     }
 
     class SettingsFragment : PreferenceFragmentCompat() {
+
+        // Since this is pretty much abandoned by androidx, it never got updated for proper EdgeToEdge support,
+        // which is enabled everywhere for API 35. So handle the insets manually here.
+        override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle?): View {
+            val view = super.onCreateView(inflater, container, savedInstanceState)
+            view.fitsSystemWindows = true
+            return view
+        }
+
         override fun onCreatePreferences(savedInstanceState: Bundle?, key: String?) {
             preferenceManager.preferenceDataStore = PreferencesPreferenceDataStore(lifecycleScope, Application.getPreferencesDataStore())
             addPreferencesFromResource(R.xml.preferences)
-            preferenceScreen.initialExpandedChildrenCount = 4
+            preferenceScreen.initialExpandedChildrenCount = 5
+
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU || QuickTileService.isAdded) {
+                val quickTile = preferenceManager.findPreference<Preference>("quick_tile")
+                quickTile?.parent?.removePreference(quickTile)
+                --preferenceScreen.initialExpandedChildrenCount
+            }
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
                 val darkTheme = preferenceManager.findPreference<Preference>("dark_theme")
                 darkTheme?.parent?.removePreference(darkTheme)
                 --preferenceScreen.initialExpandedChildrenCount
             }
-            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
-                val remoteApps = preferenceManager.findPreference<Preference>("allow_remote_control_intents")
-                remoteApps?.parent?.removePreference(remoteApps)
-            }
             if (AdminKnobs.disableConfigExport) {
                 val zipExporter = preferenceManager.findPreference<Preference>("zip_exporter")
                 zipExporter?.parent?.removePreference(zipExporter)
             }
             val wgQuickOnlyPrefs = arrayOf(
-                    preferenceManager.findPreference("tools_installer"),
-                    preferenceManager.findPreference("restore_on_boot"),
-                    preferenceManager.findPreference<Preference>("multiple_tunnels")
+                preferenceManager.findPreference("tools_installer"),
+                preferenceManager.findPreference("restore_on_boot"),
+                preferenceManager.findPreference<Preference>("multiple_tunnels")
             ).filterNotNull()
             wgQuickOnlyPrefs.forEach { it.isVisible = false }
             lifecycleScope.launch {
@@ -79,30 +94,19 @@ class SettingsActivity : ThemeChangeAwareActivity() {
                 startActivity(Intent(requireContext(), LogViewerActivity::class.java))
                 true
             }
-            val moduleInstaller = preferenceManager.findPreference<Preference>("module_downloader")
-            val kernelModuleDisabler = preferenceManager.findPreference<Preference>("kernel_module_disabler")
-            moduleInstaller?.isVisible = false
-            if (ModuleLoader.isModuleLoaded()) {
-                moduleInstaller?.parent?.removePreference(moduleInstaller)
+            val kernelModuleEnabler = preferenceManager.findPreference<Preference>("kernel_module_enabler")
+            if (WgQuickBackend.hasKernelSupport()) {
                 lifecycleScope.launch {
                     if (Application.getBackend() !is WgQuickBackend) {
                         try {
                             withContext(Dispatchers.IO) { Application.getRootShell().start() }
                         } catch (_: Throwable) {
-                            kernelModuleDisabler?.parent?.removePreference(kernelModuleDisabler)
+                            kernelModuleEnabler?.parent?.removePreference(kernelModuleEnabler)
                         }
                     }
                 }
             } else {
-                kernelModuleDisabler?.parent?.removePreference(kernelModuleDisabler)
-                lifecycleScope.launch {
-                    try {
-                        withContext(Dispatchers.IO) { Application.getRootShell().start() }
-                        moduleInstaller?.isVisible = true
-                    } catch (_: Throwable) {
-                        moduleInstaller?.parent?.removePreference(moduleInstaller)
-                    }
-                }
+                kernelModuleEnabler?.parent?.removePreference(kernelModuleEnabler)
             }
         }
     }

ui/src/main/java/com/wireguard/android/activity/ThemeChangeAwareActivity.kt

@@ -1,33 +0,0 @@
-/*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-package com.wireguard.android.activity
-
-import android.os.Build
-import android.os.Bundle
-import androidx.appcompat.app.AppCompatActivity
-import androidx.appcompat.app.AppCompatDelegate
-import androidx.lifecycle.lifecycleScope
-import com.wireguard.android.util.UserKnobs
-import kotlinx.coroutines.flow.launchIn
-import kotlinx.coroutines.flow.onEach
-
-abstract class ThemeChangeAwareActivity : AppCompatActivity() {
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
-            UserKnobs.darkTheme.onEach {
-                val newMode = if (it) {
-                    AppCompatDelegate.MODE_NIGHT_YES
-                } else {
-                    AppCompatDelegate.MODE_NIGHT_NO
-                }
-                if (AppCompatDelegate.getDefaultNightMode() != newMode) {
-                    AppCompatDelegate.setDefaultNightMode(newMode)
-                    recreate()
-                }
-            }.launchIn(lifecycleScope)
-        }
-    }
-}

ui/src/main/java/com/wireguard/android/activity/TunnelCreatorActivity.kt

@@ -1,12 +1,11 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.activity
 
 import android.os.Bundle
-import androidx.fragment.app.commit
-import com.wireguard.android.fragment.TunnelEditorFragment
+import com.wireguard.android.R
 import com.wireguard.android.model.ObservableTunnel
 
 /**
@@ -15,14 +14,11 @@ import com.wireguard.android.model.ObservableTunnel
 class TunnelCreatorActivity : BaseActivity() {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
-        if (supportFragmentManager.findFragmentById(android.R.id.content) == null) {
-            supportFragmentManager.commit {
-                add(android.R.id.content, TunnelEditorFragment())
-            }
-        }
+        setContentView(R.layout.tunnel_creator_activity)
     }
 
-    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?) {
+    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?): Boolean {
         finish()
+        return true
     }
 }

ui/src/main/java/com/wireguard/android/activity/TunnelToggleActivity.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.activity
@@ -22,9 +22,9 @@ import com.wireguard.android.backend.Tunnel
 import com.wireguard.android.util.ErrorMessages
 import kotlinx.coroutines.launch
 
-@RequiresApi(Build.VERSION_CODES.N)
 class TunnelToggleActivity : AppCompatActivity() {
-    private val permissionActivityResultLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { toggleTunnelWithPermissionsResult() }
+    private val permissionActivityResultLauncher =
+        registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { toggleTunnelWithPermissionsResult() }
 
     private fun toggleTunnelWithPermissionsResult() {
         val tunnel = Application.getTunnelManager().lastUsedTunnel ?: return
@@ -49,10 +49,14 @@ class TunnelToggleActivity : AppCompatActivity() {
         super.onCreate(savedInstanceState)
         lifecycleScope.launch {
             if (Application.getBackend() is GoBackend) {
-                val intent = GoBackend.VpnService.prepare(this@TunnelToggleActivity)
-                if (intent != null) {
-                    permissionActivityResultLauncher.launch(intent)
-                    return@launch
+                try {
+                    val intent = GoBackend.VpnService.prepare(this@TunnelToggleActivity)
+                    if (intent != null) {
+                        permissionActivityResultLauncher.launch(intent)
+                        return@launch
+                    }
+                } catch (e: Exception) {
+                    Toast.makeText(this@TunnelToggleActivity, ErrorMessages[e], Toast.LENGTH_LONG).show()
                 }
             }
             toggleTunnelWithPermissionsResult()

ui/src/main/java/com/wireguard/android/activity/TvMainActivity.kt

@@ -1,11 +1,14 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
 package com.wireguard.android.activity
 
 import android.Manifest
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.content.Intent
 import android.content.pm.PackageManager
 import android.net.Uri
 import android.os.Build
@@ -16,17 +19,21 @@ import android.os.storage.StorageVolume
 import android.util.Log
 import android.view.View
 import android.widget.Toast
+import androidx.activity.addCallback
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
+import androidx.appcompat.app.AppCompatDelegate
 import androidx.core.content.ContextCompat
 import androidx.core.content.getSystemService
 import androidx.core.view.forEach
 import androidx.databinding.DataBindingUtil
+import androidx.databinding.Observable
 import androidx.databinding.ObservableBoolean
 import androidx.databinding.ObservableField
 import androidx.lifecycle.lifecycleScope
 import androidx.recyclerview.widget.GridLayoutManager
 import androidx.recyclerview.widget.GridLayoutManager.SpanSizeLookup
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.wireguard.android.Application
 import com.wireguard.android.R
 import com.wireguard.android.backend.GoBackend
@@ -41,6 +48,8 @@ import com.wireguard.android.model.ObservableTunnel
 import com.wireguard.android.util.ErrorMessages
 import com.wireguard.android.util.QuantityFormatter
 import com.wireguard.android.util.TunnelImporter
+import com.wireguard.android.util.UserKnobs
+import com.wireguard.android.util.applicationScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
@@ -48,7 +57,27 @@ import kotlinx.coroutines.withContext
 import java.io.File
 
 class TvMainActivity : AppCompatActivity() {
-    private val tunnelFileImportResultLauncher = registerForActivityResult(ActivityResultContracts.GetContent()) { data ->
+    private val tunnelFileImportResultLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
+        override fun createIntent(context: Context, input: Array<String>): Intent {
+            val intent = super.createIntent(context, input)
+
+            /* AndroidTV now comes with stubs that do nothing but display a Toast less helpful than
+             * what we can do, so detect this and throw an exception that we can catch later. */
+            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
+            } else {
+                @Suppress("DEPRECATION")
+                context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
+            }
+            if (activitiesToResolveIntent.all {
+                    val name = it.activityInfo.packageName
+                    name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
+                }) {
+                throw ActivityNotFoundException()
+            }
+            return intent
+        }
+    }) { data ->
         if (data == null) return@registerForActivityResult
         lifecycleScope.launch {
             TunnelImporter.importTunnel(contentResolver, data) {
@@ -84,6 +113,14 @@ class TvMainActivity : AppCompatActivity() {
     private val filesRoot = ObservableField("")
 
     override fun onCreate(savedInstanceState: Bundle?) {
+        if (AppCompatDelegate.getDefaultNightMode() != AppCompatDelegate.MODE_NIGHT_YES) {
+            AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_YES)
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+                applicationScope.launch {
+                    UserKnobs.setDarkTheme(true)
+                }
+            }
+        }
         super.onCreate(savedInstanceState)
         binding = TvActivityBinding.inflate(layoutInflater)
         lifecycleScope.launch {
@@ -172,9 +209,18 @@ class TvMainActivity : AppCompatActivity() {
                 }
             } else {
                 try {
-                    tunnelFileImportResultLauncher.launch("*/*")
+                    tunnelFileImportResultLauncher.launch(arrayOf("*/*"))
                 } catch (_: Throwable) {
-                    Toast.makeText(this@TvMainActivity, getString(R.string.tv_no_file_picker), Toast.LENGTH_LONG).show()
+                    MaterialAlertDialogBuilder(binding.root.context).setMessage(R.string.tv_no_file_picker).setCancelable(false)
+                        .setPositiveButton(android.R.string.ok) { _, _ ->
+                            try {
+                                startActivity(Intent(Intent.ACTION_VIEW).apply {
+                                    data = Uri.parse("https://play.google.com/store/apps/details?id=com.cxinventor.file.explorer")
+                                    setPackage("com.android.vending")
+                                })
+                            } catch (_: Throwable) {
+                            }
+                        }.show()
                 }
             }
         }
@@ -185,6 +231,17 @@ class TvMainActivity : AppCompatActivity() {
                 binding.tunnelList.requestFocus()
             }
         }
+
+        val backPressedCallback = onBackPressedDispatcher.addCallback(this) { handleBackPressed() }
+        val updateBackPressedCallback = object : Observable.OnPropertyChangedCallback() {
+            override fun onPropertyChanged(sender: Observable?, propertyId: Int) {
+                backPressedCallback.isEnabled = isDeleting.get() || filesRoot.get()?.isNotEmpty() == true
+            }
+        }
+        isDeleting.addOnPropertyChangedCallback(updateBackPressedCallback)
+        filesRoot.addOnPropertyChangedCallback(updateBackPressedCallback)
+        backPressedCallback.isEnabled = false
+
         binding.executePendingBindings()
         setContentView(binding.root)
 
@@ -209,31 +266,14 @@ class TvMainActivity : AppCompatActivity() {
     private suspend fun makeStorageRoots(): Collection<KeyedFile> = withContext(Dispatchers.IO) {
         cachedRoots?.let { return@withContext it }
         val list = HashSet<KeyedFile>()
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
-            val storageManager: StorageManager = getSystemService() ?: return@withContext list
-            list.addAll(storageManager.storageVolumes.mapNotNull { volume ->
-                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-                    volume.directory?.let { KeyedFile(it, volume.getDescription(this@TvMainActivity)) }
-                } else {
-                    KeyedFile((StorageVolume::class.java.getMethod("getPathFile").invoke(volume) as File), volume.getDescription(this@TvMainActivity))
-                }
-            })
-        } else {
-            @Suppress("DEPRECATION")
-            list.add(KeyedFile(Environment.getExternalStorageDirectory()))
-            try {
-                File("/storage").listFiles()?.forEach {
-                    if (!it.isDirectory) return@forEach
-                    try {
-                        if (Environment.isExternalStorageRemovable(it)) {
-                            list.add(KeyedFile(it))
-                        }
-                    } catch (_: Throwable) {
-                    }
-                }
-            } catch (_: Throwable) {
+        val storageManager: StorageManager = getSystemService() ?: return@withContext list
+        list.addAll(storageManager.storageVolumes.mapNotNull { volume ->
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                volume.directory?.let { KeyedFile(it, volume.getDescription(this@TvMainActivity)) }
+            } else {
+                KeyedFile((StorageVolume::class.java.getMethod("getPathFile").invoke(volume) as File), volume.getDescription(this@TvMainActivity))
             }
-        }
+        })
         cachedRoots = list
         list
     }
@@ -298,7 +338,7 @@ class TvMainActivity : AppCompatActivity() {
         }
     }
 
-    override fun onBackPressed() {
+    private fun handleBackPressed() {
         when {
             isDeleting.get() -> {
                 isDeleting.set(false)
@@ -306,6 +346,7 @@ class TvMainActivity : AppCompatActivity() {
                     binding.tunnelList.requestFocus()
                 }
             }
+
             filesRoot.get()?.isNotEmpty() == true -> {
                 files.clear()
                 filesRoot.set("")
@@ -313,14 +354,13 @@ class TvMainActivity : AppCompatActivity() {
                     binding.tunnelList.requestFocus()
                 }
             }
-            else -> super.onBackPressed()
         }
     }
 
     private suspend fun updateStats() {
         binding.tunnelList.forEach { viewItem ->
             val listItem = DataBindingUtil.findBinding<TvTunnelListItemBinding>(viewItem)
-                    ?: return@forEach
+                ?: return@forEach
             try {
                 val tunnel = listItem.item!!
                 if (tunnel.state != Tunnel.State.UP || isDeleting.get()) {

ui/src/main/java/com/wireguard/android/configStore/ConfigStore.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.configStore

ui/src/main/java/com/wireguard/android/configStore/FileConfigStore.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.configStore
@@ -40,9 +40,9 @@ class FileConfigStore(private val context: Context) : ConfigStore {
 
     override fun enumerate(): Set<String> {
         return context.fileList()
-                .filter { it.endsWith(".conf") }
-                .map { it.substring(0, it.length - ".conf".length) }
-                .toSet()
+            .filter { it.endsWith(".conf") }
+            .map { it.substring(0, it.length - ".conf".length) }
+            .toSet()
     }
 
     private fun fileFor(name: String): File {

ui/src/main/java/com/wireguard/android/databinding/BindingAdapters.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.databinding
@@ -23,6 +23,7 @@ import com.wireguard.android.R
 import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler
 import com.wireguard.android.widget.ToggleSwitch
 import com.wireguard.android.widget.ToggleSwitch.OnBeforeCheckedChangeListener
+import com.wireguard.android.widget.TvCardView
 import com.wireguard.config.Attribute
 import com.wireguard.config.InetNetwork
 import java.net.InetAddress
@@ -46,9 +47,11 @@ object BindingAdapters {
 
     @JvmStatic
     @BindingAdapter("items", "layout", "fragment")
-    fun <E> setItems(view: LinearLayout,
-                     oldList: ObservableList<E>?, oldLayoutId: Int, @Suppress("UNUSED_PARAMETER") oldFragment: Fragment?,
-                     newList: ObservableList<E>?, newLayoutId: Int, newFragment: Fragment?) {
+    fun <E> setItems(
+        view: LinearLayout,
+        oldList: ObservableList<E>?, oldLayoutId: Int, @Suppress("UNUSED_PARAMETER") oldFragment: Fragment?,
+        newList: ObservableList<E>?, newLayoutId: Int, newFragment: Fragment?
+    ) {
         if (oldList === newList && oldLayoutId == newLayoutId)
             return
         var listener: ItemChangeListener<E>? = ListenerUtil.getListener(view, R.id.item_change_listener)
@@ -72,9 +75,11 @@ object BindingAdapters {
 
     @JvmStatic
     @BindingAdapter("items", "layout")
-    fun <E> setItems(view: LinearLayout,
-                     oldList: Iterable<E>?, oldLayoutId: Int,
-                     newList: Iterable<E>?, newLayoutId: Int) {
+    fun <E> setItems(
+        view: LinearLayout,
+        oldList: Iterable<E>?, oldLayoutId: Int,
+        newList: Iterable<E>?, newLayoutId: Int
+    ) {
         if (oldList === newList && oldLayoutId == newLayoutId)
             return
         view.removeAllViews()
@@ -92,11 +97,13 @@ object BindingAdapters {
 
     @JvmStatic
     @BindingAdapter(requireAll = false, value = ["items", "layout", "configurationHandler"])
-    fun <K, E : Keyed<out K>> setItems(view: RecyclerView,
-                                       oldList: ObservableKeyedArrayList<K, E>?, oldLayoutId: Int,
-                                       @Suppress("UNUSED_PARAMETER") oldRowConfigurationHandler: RowConfigurationHandler<*, *>?,
-                                       newList: ObservableKeyedArrayList<K, E>?, newLayoutId: Int,
-                                       newRowConfigurationHandler: RowConfigurationHandler<*, *>?) {
+    fun <K, E : Keyed<out K>> setItems(
+        view: RecyclerView,
+        oldList: ObservableKeyedArrayList<K, E>?, oldLayoutId: Int,
+        @Suppress("UNUSED_PARAMETER") oldRowConfigurationHandler: RowConfigurationHandler<*, *>?,
+        newList: ObservableKeyedArrayList<K, E>?, newLayoutId: Int,
+        newRowConfigurationHandler: RowConfigurationHandler<*, *>?
+    ) {
         if (view.layoutManager == null)
             view.layoutManager = LinearLayoutManager(view.context, RecyclerView.VERTICAL, false)
         if (oldList === newList && oldLayoutId == newLayoutId)
@@ -122,16 +129,20 @@ object BindingAdapters {
 
     @JvmStatic
     @BindingAdapter("onBeforeCheckedChanged")
-    fun setOnBeforeCheckedChanged(view: ToggleSwitch,
-                                  listener: OnBeforeCheckedChangeListener?) {
+    fun setOnBeforeCheckedChanged(
+        view: ToggleSwitch,
+        listener: OnBeforeCheckedChangeListener?
+    ) {
         view.setOnBeforeCheckedChangeListener(listener)
     }
 
     @JvmStatic
     @BindingAdapter("onFocusChange")
-    fun setOnFocusChange(view: EditText,
-                         listener: View.OnFocusChangeListener?) {
-        view.setOnFocusChangeListener(listener)
+    fun setOnFocusChange(
+        view: EditText,
+        listener: View.OnFocusChangeListener?
+    ) {
+        view.onFocusChangeListener = listener
     }
 
     @JvmStatic
@@ -152,6 +163,12 @@ object BindingAdapters {
         view.text = if (addresses != null) Attribute.join(addresses.map { it?.hostAddress }) else ""
     }
 
+    @JvmStatic
+    @BindingAdapter("android:text")
+    fun setStringSetText(view: TextView, strings: Iterable<String?>?) {
+        view.text = if (strings != null) Attribute.join(strings) else ""
+    }
+
     @JvmStatic
     fun tryParseInt(s: String?): Int {
         if (s == null)
@@ -162,4 +179,16 @@ object BindingAdapters {
             0
         }
     }
+
+    @JvmStatic
+    @BindingAdapter("isUp")
+    fun setIsUp(card: TvCardView, up: Boolean) {
+        card.isUp = up
+    }
+
+    @JvmStatic
+    @BindingAdapter("isDeleting")
+    fun setIsDeleting(card: TvCardView, deleting: Boolean) {
+        card.isDeleting = deleting
+    }
 }

ui/src/main/java/com/wireguard/android/databinding/ItemChangeListener.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.databinding
@@ -61,8 +61,10 @@ internal class ItemChangeListener<T>(private val container: ViewGroup, private v
             }
         }
 
-        override fun onItemRangeChanged(sender: ObservableList<T>, positionStart: Int,
-                                        itemCount: Int) {
+        override fun onItemRangeChanged(
+            sender: ObservableList<T>, positionStart: Int,
+            itemCount: Int
+        ) {
             val listener = weakListener.get()
             if (listener != null) {
                 for (i in positionStart until positionStart + itemCount) {
@@ -75,8 +77,10 @@ internal class ItemChangeListener<T>(private val container: ViewGroup, private v
             }
         }
 
-        override fun onItemRangeInserted(sender: ObservableList<T>, positionStart: Int,
-                                         itemCount: Int) {
+        override fun onItemRangeInserted(
+            sender: ObservableList<T>, positionStart: Int,
+            itemCount: Int
+        ) {
             val listener = weakListener.get()
             if (listener != null) {
                 for (i in positionStart until positionStart + itemCount)
@@ -86,8 +90,10 @@ internal class ItemChangeListener<T>(private val container: ViewGroup, private v
             }
         }
 
-        override fun onItemRangeMoved(sender: ObservableList<T>, fromPosition: Int,
-                                      toPosition: Int, itemCount: Int) {
+        override fun onItemRangeMoved(
+            sender: ObservableList<T>, fromPosition: Int,
+            toPosition: Int, itemCount: Int
+        ) {
             val listener = weakListener.get()
             if (listener != null) {
                 val views = arrayOfNulls<View>(itemCount)
@@ -99,8 +105,10 @@ internal class ItemChangeListener<T>(private val container: ViewGroup, private v
             }
         }
 
-        override fun onItemRangeRemoved(sender: ObservableList<T>, positionStart: Int,
-                                        itemCount: Int) {
+        override fun onItemRangeRemoved(
+            sender: ObservableList<T>, positionStart: Int,
+            itemCount: Int
+        ) {
             val listener = weakListener.get()
             if (listener != null) {
                 listener.container.removeViews(positionStart, itemCount)

ui/src/main/java/com/wireguard/android/databinding/Keyed.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.databinding

ui/src/main/java/com/wireguard/android/databinding/ObservableKeyedArrayList.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.databinding

ui/src/main/java/com/wireguard/android/databinding/ObservableKeyedRecyclerViewAdapter.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.databinding

ui/src/main/java/com/wireguard/android/databinding/ObservableSortedKeyedArrayList.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.databinding

ui/src/main/java/com/wireguard/android/fragment/AddTunnelsSheet.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.fragment
@@ -34,10 +34,6 @@ class AddTunnelsSheet : BottomSheetDialogFragment() {
         }
     }
 
-    override fun getTheme(): Int {
-        return R.style.BottomSheetDialogTheme
-    }
-
     override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle?): View? {
         if (savedInstanceState != null) dismiss()
         val view = inflater.inflate(R.layout.add_tunnels_bottom_sheet, container, false)
@@ -76,7 +72,7 @@ class AddTunnelsSheet : BottomSheetDialogFragment() {
             }
         })
         val gradientDrawable = GradientDrawable().apply {
-            setColor(requireContext().resolveAttribute(R.attr.colorBackground))
+            setColor(requireContext().resolveAttribute(com.google.android.material.R.attr.colorSurface))
         }
         view.background = gradientDrawable
     }

ui/src/main/java/com/wireguard/android/fragment/AppListDialogFragment.kt

@@ -1,11 +1,15 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.fragment
 
 import android.Manifest
 import android.app.Dialog
+import android.content.pm.PackageInfo
+import android.content.pm.PackageManager
+import android.content.pm.PackageManager.PackageInfoFlags
+import android.os.Build
 import android.os.Bundle
 import android.widget.Button
 import android.widget.Toast
@@ -15,6 +19,7 @@ import androidx.databinding.Observable
 import androidx.fragment.app.DialogFragment
 import androidx.fragment.app.setFragmentResult
 import androidx.lifecycle.lifecycleScope
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.google.android.material.tabs.TabLayout
 import com.wireguard.android.BR
 import com.wireguard.android.R
@@ -40,11 +45,12 @@ class AppListDialogFragment : DialogFragment() {
             try {
                 val applicationData: MutableList<ApplicationData> = ArrayList()
                 withContext(Dispatchers.IO) {
-                    val packageInfos = pm.getPackagesHoldingPermissions(arrayOf(Manifest.permission.INTERNET), 0)
+                    val packageInfos = getPackagesHoldingPermissions(pm, arrayOf(Manifest.permission.INTERNET))
                     packageInfos.forEach {
                         val packageName = it.packageName
-                        val appInfo = it.applicationInfo
-                        val appData = ApplicationData(appInfo.loadIcon(pm), appInfo.loadLabel(pm).toString(), packageName, currentlySelectedApps.contains(packageName))
+                        val appInfo = it.applicationInfo ?: return@forEach
+                        val appData =
+                            ApplicationData(appInfo.loadIcon(pm), appInfo.loadLabel(pm).toString(), packageName, currentlySelectedApps.contains(packageName))
                         applicationData.add(appData)
                         appData.addOnPropertyChangedCallback(object : Observable.OnPropertyChangedCallback() {
                             override fun onPropertyChanged(sender: Observable?, propertyId: Int) {
@@ -58,6 +64,7 @@ class AppListDialogFragment : DialogFragment() {
                 withContext(Dispatchers.Main.immediate) {
                     appData.clear()
                     appData.addAll(applicationData)
+                    setButtonText()
                 }
             } catch (e: Throwable) {
                 withContext(Dispatchers.Main.immediate) {
@@ -76,6 +83,15 @@ class AppListDialogFragment : DialogFragment() {
         initiallyExcluded = arguments?.getBoolean(KEY_IS_EXCLUDED) ?: true
     }
 
+    private fun getPackagesHoldingPermissions(pm: PackageManager, permissions: Array<String>): List<PackageInfo> {
+        return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            pm.getPackagesHoldingPermissions(permissions, PackageInfoFlags.of(0L))
+        } else {
+            @Suppress("DEPRECATION")
+            pm.getPackagesHoldingPermissions(permissions, 0)
+        }
+    }
+
     private fun setButtonText() {
         val numSelected = appData.count { it.isSelected }
         button?.text = if (numSelected == 0)
@@ -88,7 +104,7 @@ class AppListDialogFragment : DialogFragment() {
     }
 
     override fun onCreateDialog(savedInstanceState: Bundle?): Dialog {
-        val alertDialogBuilder = AlertDialog.Builder(requireActivity())
+        val alertDialogBuilder = MaterialAlertDialogBuilder(requireActivity())
         val binding = AppListDialogFragmentBinding.inflate(requireActivity().layoutInflater, null, false)
         binding.executePendingBindings()
         alertDialogBuilder.setView(binding.root)
@@ -128,10 +144,12 @@ class AppListDialogFragment : DialogFragment() {
                 selectedApps.add(data.packageName)
             }
         }
-        setFragmentResult(REQUEST_SELECTION, bundleOf(
+        setFragmentResult(
+            REQUEST_SELECTION, bundleOf(
                 KEY_SELECTED_APPS to selectedApps.toTypedArray(),
                 KEY_IS_EXCLUDED to (tabs?.selectedTabPosition == 0)
-        ))
+            )
+        )
         dismiss()
     }
 
@@ -139,6 +157,7 @@ class AppListDialogFragment : DialogFragment() {
         const val KEY_SELECTED_APPS = "selected_apps"
         const val KEY_IS_EXCLUDED = "is_excluded"
         const val REQUEST_SELECTION = "request_selection"
+
         fun newInstance(selectedApps: ArrayList<String?>?, isExcluded: Boolean): AppListDialogFragment {
             val extras = Bundle()
             extras.putStringArrayList(KEY_SELECTED_APPS, selectedApps)

ui/src/main/java/com/wireguard/android/fragment/BaseFragment.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.fragment
@@ -67,12 +67,20 @@ abstract class BaseFragment : Fragment(), OnSelectedTunnelChangedListener {
         val activity = activity ?: return
         activity.lifecycleScope.launch {
             if (Application.getBackend() is GoBackend) {
-                val intent = GoBackend.VpnService.prepare(activity)
-                if (intent != null) {
-                    pendingTunnel = tunnel
-                    pendingTunnelUp = checked
-                    permissionActivityResultLauncher.launch(intent)
-                    return@launch
+                try {
+                    val intent = GoBackend.VpnService.prepare(activity)
+                    if (intent != null) {
+                        pendingTunnel = tunnel
+                        pendingTunnelUp = checked
+                        permissionActivityResultLauncher.launch(intent)
+                        return@launch
+                    }
+                } catch (e: Throwable) {
+                    val message = activity.getString(R.string.error_prepare, ErrorMessages[e])
+                    Snackbar.make(view, message, Snackbar.LENGTH_LONG)
+                        .setAnchorView(view.findViewById(R.id.create_fab))
+                        .show()
+                    Log.e(TAG, message, e)
                 }
             }
             setTunnelStateWithPermissionsResult(tunnel, checked)
@@ -91,8 +99,8 @@ abstract class BaseFragment : Fragment(), OnSelectedTunnelChangedListener {
                 val view = view
                 if (view != null)
                     Snackbar.make(view, message, Snackbar.LENGTH_LONG)
-                            .setAnchorView(view.findViewById(R.id.create_fab))
-                            .show()
+                        .setAnchorView(view.findViewById(R.id.create_fab))
+                        .show()
                 else
                     Toast.makeText(activity, message, Toast.LENGTH_LONG).show()
                 Log.e(TAG, message, e)

ui/src/main/java/com/wireguard/android/fragment/ConfigNamingDialogFragment.kt

@@ -1,18 +1,15 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.fragment
 
 import android.app.Dialog
-import android.content.DialogInterface
 import android.os.Bundle
-import android.view.inputmethod.InputMethodManager
-import androidx.appcompat.app.AlertDialog
-import androidx.core.content.getSystemService
+import android.view.WindowManager
 import androidx.fragment.app.DialogFragment
 import androidx.lifecycle.lifecycleScope
-import com.google.android.material.textfield.TextInputEditText
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.wireguard.android.Application
 import com.wireguard.android.R
 import com.wireguard.android.databinding.ConfigNamingDialogFragmentBinding
@@ -26,7 +23,6 @@ import java.nio.charset.StandardCharsets
 class ConfigNamingDialogFragment : DialogFragment() {
     private var binding: ConfigNamingDialogFragmentBinding? = null
     private var config: Config? = null
-    private var imm: InputMethodManager? = null
 
     private fun createTunnelAndDismiss() {
         val binding = binding ?: return
@@ -42,11 +38,6 @@ class ConfigNamingDialogFragment : DialogFragment() {
         }
     }
 
-    override fun dismiss() {
-        setKeyboardVisible(false)
-        super.dismiss()
-    }
-
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         val configText = requireArguments().getString(KEY_CONFIG_TEXT)
@@ -63,51 +54,23 @@ class ConfigNamingDialogFragment : DialogFragment() {
 
     override fun onCreateDialog(savedInstanceState: Bundle?): Dialog {
         val activity = requireActivity()
-        imm = activity.getSystemService()
-        val alertDialogBuilder = AlertDialog.Builder(activity)
+        val alertDialogBuilder = MaterialAlertDialogBuilder(activity)
         alertDialogBuilder.setTitle(R.string.import_from_qr_code)
         binding = ConfigNamingDialogFragmentBinding.inflate(activity.layoutInflater, null, false)
         binding?.apply {
             executePendingBindings()
             alertDialogBuilder.setView(root)
         }
-        alertDialogBuilder.setPositiveButton(R.string.create_tunnel, null)
+        alertDialogBuilder.setPositiveButton(R.string.create_tunnel) { _, _ -> createTunnelAndDismiss() }
         alertDialogBuilder.setNegativeButton(R.string.cancel) { _, _ -> dismiss() }
-        return alertDialogBuilder.create().apply {
-            setOnShowListener {
-                findViewById<TextInputEditText>(R.id.tunnel_name_text)?.apply {
-                    setOnFocusChangeListener { v, _ ->
-                        v.post {
-                            imm?.showSoftInput(v, InputMethodManager.SHOW_IMPLICIT)
-                        }
-                    }
-                    requestFocus()
-                }
-            }
-        }
-    }
-
-    override fun onResume() {
-        super.onResume()
-        val dialog = dialog as AlertDialog?
-        if (dialog != null) {
-            dialog.getButton(DialogInterface.BUTTON_POSITIVE).setOnClickListener { createTunnelAndDismiss() }
-            setKeyboardVisible(true)
-        }
-    }
-
-    private fun setKeyboardVisible(visible: Boolean) {
-        if (visible) {
-            imm!!.toggleSoftInput(InputMethodManager.SHOW_FORCED, 0)
-        } else if (binding != null) {
-            imm!!.hideSoftInputFromWindow(binding!!.tunnelNameText.windowToken, 0)
-        }
+        val dialog = alertDialogBuilder.create()
+        dialog.window?.setSoftInputMode(WindowManager.LayoutParams.SOFT_INPUT_STATE_ALWAYS_VISIBLE)
+        return dialog
     }
 
     companion object {
         private const val KEY_CONFIG_TEXT = "config_text"
 
-        @JvmStatic
         fun newInstance(configText: String?): ConfigNamingDialogFragment {
             val extras = Bundle()
             extras.putString(KEY_CONFIG_TEXT, configText)

ui/src/main/java/com/wireguard/android/fragment/TunnelDetailFragment.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.fragment
@@ -8,9 +8,12 @@ import android.os.Bundle
 import android.view.LayoutInflater
 import android.view.Menu
 import android.view.MenuInflater
+import android.view.MenuItem
 import android.view.View
 import android.view.ViewGroup
+import androidx.core.view.MenuProvider
 import androidx.databinding.DataBindingUtil
+import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.lifecycleScope
 import com.wireguard.android.R
 import com.wireguard.android.backend.Tunnel
@@ -24,26 +27,32 @@ import kotlinx.coroutines.launch
 /**
  * Fragment that shows details about a specific tunnel.
  */
-class TunnelDetailFragment : BaseFragment() {
+class TunnelDetailFragment : BaseFragment(), MenuProvider {
     private var binding: TunnelDetailFragmentBinding? = null
     private var lastState = Tunnel.State.TOGGLE
     private var timerActive = true
 
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        setHasOptionsMenu(true)
+    override fun onMenuItemSelected(menuItem: MenuItem): Boolean {
+        return false
     }
 
-    override fun onCreateOptionsMenu(menu: Menu, inflater: MenuInflater) {
-        inflater.inflate(R.menu.tunnel_detail, menu)
+    override fun onCreateMenu(menu: Menu, menuInflater: MenuInflater) {
+        menuInflater.inflate(R.menu.tunnel_detail, menu)
     }
 
-    override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?,
-                              savedInstanceState: Bundle?): View? {
+    override fun onCreateView(
+        inflater: LayoutInflater, container: ViewGroup?,
+        savedInstanceState: Bundle?
+    ): View? {
         super.onCreateView(inflater, container, savedInstanceState)
         binding = TunnelDetailFragmentBinding.inflate(inflater, container, false)
         binding?.executePendingBindings()
-        return binding!!.root
+        return binding?.root
+    }
+
+    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
+        super.onViewCreated(view, savedInstanceState)
+        requireActivity().addMenuProvider(this, viewLifecycleOwner, Lifecycle.State.RESUMED)
     }
 
     override fun onDestroyView() {
@@ -103,25 +112,38 @@ class TunnelDetailFragment : BaseFragment() {
             val statistics = tunnel.getStatisticsAsync()
             for (i in 0 until binding.peersLayout.childCount) {
                 val peer: TunnelDetailPeerBinding = DataBindingUtil.getBinding(binding.peersLayout.getChildAt(i))
-                        ?: continue
+                    ?: continue
                 val publicKey = peer.item!!.publicKey
-                val rx = statistics.peerRx(publicKey)
-                val tx = statistics.peerTx(publicKey)
-                if (rx == 0L && tx == 0L) {
+                val peerStats = statistics.peer(publicKey)
+                if (peerStats == null || (peerStats.rxBytes == 0L && peerStats.txBytes == 0L)) {
                     peer.transferLabel.visibility = View.GONE
                     peer.transferText.visibility = View.GONE
-                    continue
+                } else {
+                    peer.transferText.text = getString(
+                        R.string.transfer_rx_tx,
+                        QuantityFormatter.formatBytes(peerStats.rxBytes),
+                        QuantityFormatter.formatBytes(peerStats.txBytes)
+                    )
+                    peer.transferLabel.visibility = View.VISIBLE
+                    peer.transferText.visibility = View.VISIBLE
+                }
+                if (peerStats == null || peerStats.latestHandshakeEpochMillis == 0L) {
+                    peer.latestHandshakeLabel.visibility = View.GONE
+                    peer.latestHandshakeText.visibility = View.GONE
+                } else {
+                    peer.latestHandshakeText.text = QuantityFormatter.formatEpochAgo(peerStats.latestHandshakeEpochMillis)
+                    peer.latestHandshakeLabel.visibility = View.VISIBLE
+                    peer.latestHandshakeText.visibility = View.VISIBLE
                 }
-                peer.transferText.text = getString(R.string.transfer_rx_tx, QuantityFormatter.formatBytes(rx), QuantityFormatter.formatBytes(tx))
-                peer.transferLabel.visibility = View.VISIBLE
-                peer.transferText.visibility = View.VISIBLE
             }
         } catch (e: Throwable) {
             for (i in 0 until binding.peersLayout.childCount) {
                 val peer: TunnelDetailPeerBinding = DataBindingUtil.getBinding(binding.peersLayout.getChildAt(i))
-                        ?: continue
+                    ?: continue
                 peer.transferLabel.visibility = View.GONE
                 peer.transferText.visibility = View.GONE
+                peer.latestHandshakeLabel.visibility = View.GONE
+                peer.latestHandshakeText.visibility = View.GONE
             }
         }
     }

ui/src/main/java/com/wireguard/android/fragment/TunnelEditorFragment.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.fragment
@@ -18,6 +18,9 @@ import android.view.WindowManager
 import android.view.inputmethod.InputMethodManager
 import android.widget.EditText
 import android.widget.Toast
+import androidx.core.os.BundleCompat
+import androidx.core.view.MenuProvider
+import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.lifecycleScope
 import com.google.android.material.snackbar.Snackbar
 import com.wireguard.android.Application
@@ -35,7 +38,7 @@ import kotlinx.coroutines.launch
 /**
  * Fragment for editing a WireGuard configuration.
  */
-class TunnelEditorFragment : BaseFragment() {
+class TunnelEditorFragment : BaseFragment(), MenuProvider {
     private var haveShownKeys = false
     private var binding: TunnelEditorFragmentBinding? = null
     private var tunnel: ObservableTunnel? = null
@@ -63,17 +66,14 @@ class TunnelEditorFragment : BaseFragment() {
         }
     }
 
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        setHasOptionsMenu(true)
+    override fun onCreateMenu(menu: Menu, menuInflater: MenuInflater) {
+        menuInflater.inflate(R.menu.config_editor, menu)
     }
 
-    override fun onCreateOptionsMenu(menu: Menu, inflater: MenuInflater) {
-        inflater.inflate(R.menu.config_editor, menu)
-    }
-
-    override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?,
-                              savedInstanceState: Bundle?): View? {
+    override fun onCreateView(
+        inflater: LayoutInflater, container: ViewGroup?,
+        savedInstanceState: Bundle?
+    ): View? {
         super.onCreateView(inflater, container, savedInstanceState)
         binding = TunnelEditorFragmentBinding.inflate(inflater, container, false)
         binding?.apply {
@@ -83,6 +83,11 @@ class TunnelEditorFragment : BaseFragment() {
         return binding?.root
     }
 
+    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
+        super.onViewCreated(view, savedInstanceState)
+        requireActivity().addMenuProvider(this, viewLifecycleOwner, Lifecycle.State.RESUMED)
+    }
+
     override fun onDestroyView() {
         activity?.window?.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
         binding = null
@@ -95,8 +100,10 @@ class TunnelEditorFragment : BaseFragment() {
         val focusedView = activity.currentFocus
         if (focusedView != null) {
             val inputManager = activity.getSystemService(Context.INPUT_METHOD_SERVICE) as? InputMethodManager
-            inputManager?.hideSoftInputFromWindow(focusedView.windowToken,
-                    InputMethodManager.HIDE_NOT_ALWAYS)
+            inputManager?.hideSoftInputFromWindow(
+                focusedView.windowToken,
+                InputMethodManager.HIDE_NOT_ALWAYS
+            )
         }
         parentFragmentManager.popBackStackImmediate()
 
@@ -105,8 +112,8 @@ class TunnelEditorFragment : BaseFragment() {
             selectedTunnel = tunnel
     }
 
-    override fun onOptionsItemSelected(item: MenuItem): Boolean {
-        if (item.itemId == R.id.menu_action_save) {
+    override fun onMenuItemSelected(menuItem: MenuItem): Boolean {
+        if (menuItem.itemId == R.id.menu_action_save) {
             binding ?: return false
             val newConfig = try {
                 binding!!.config!!.resolve()
@@ -130,6 +137,7 @@ class TunnelEditorFragment : BaseFragment() {
                             onTunnelCreated(null, e)
                         }
                     }
+
                     tunnel!!.name != binding!!.name -> {
                         Log.d(TAG, "Attempting to rename tunnel to " + binding!!.name)
                         try {
@@ -139,6 +147,7 @@ class TunnelEditorFragment : BaseFragment() {
                             onTunnelRenamed(tunnel!!, newConfig, e)
                         }
                     }
+
                     else -> {
                         Log.d(TAG, "Attempting to save config of " + tunnel!!.name)
                         try {
@@ -152,7 +161,7 @@ class TunnelEditorFragment : BaseFragment() {
             }
             return true
         }
-        return super.onOptionsItemSelected(item)
+        return false
     }
 
     @Suppress("UNUSED_PARAMETER")
@@ -194,8 +203,10 @@ class TunnelEditorFragment : BaseFragment() {
         super.onSaveInstanceState(outState)
     }
 
-    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?,
-                                         newTunnel: ObservableTunnel?) {
+    override fun onSelectedTunnelChanged(
+        oldTunnel: ObservableTunnel?,
+        newTunnel: ObservableTunnel?
+    ) {
         tunnel = newTunnel
         if (binding == null) return
         binding!!.config = ConfigProxy()
@@ -232,8 +243,10 @@ class TunnelEditorFragment : BaseFragment() {
         }
     }
 
-    private suspend fun onTunnelRenamed(renamedTunnel: ObservableTunnel, newConfig: Config,
-                                        throwable: Throwable?) {
+    private suspend fun onTunnelRenamed(
+        renamedTunnel: ObservableTunnel, newConfig: Config,
+        throwable: Throwable?
+    ) {
         val ctx = activity ?: Application.get()
         if (throwable == null) {
             val message = ctx.getString(R.string.tunnel_rename_success, renamedTunnel.name)
@@ -265,7 +278,7 @@ class TunnelEditorFragment : BaseFragment() {
             onSelectedTunnelChanged(null, selectedTunnel)
         } else {
             tunnel = selectedTunnel
-            val config: ConfigProxy = savedInstanceState.getParcelable(KEY_LOCAL_CONFIG)!!
+            val config = BundleCompat.getParcelable(savedInstanceState, KEY_LOCAL_CONFIG, ConfigProxy::class.java)!!
             val originalName = savedInstanceState.getString(KEY_ORIGINAL_NAME)
             if (tunnel != null && tunnel!!.name != originalName) onSelectedTunnelChanged(null, tunnel) else binding!!.config = config
         }
@@ -290,13 +303,16 @@ class TunnelEditorFragment : BaseFragment() {
                         haveShownKeys = true
                         showPrivateKey(edit)
                     }
+
                     is BiometricAuthenticator.Result.Failure -> {
                         Snackbar.make(
-                                binding!!.mainContainer,
-                                it.message,
-                                Snackbar.LENGTH_SHORT
+                            binding!!.mainContainer,
+                            it.message,
+                            Snackbar.LENGTH_SHORT
                         ).show()
                     }
+
+                    is BiometricAuthenticator.Result.Cancelled -> {}
                 }
             }
         } else {

ui/src/main/java/com/wireguard/android/fragment/TunnelListFragment.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.fragment
@@ -16,12 +16,16 @@ import android.view.ViewGroup
 import android.view.animation.Animation
 import android.view.animation.AnimationUtils
 import android.widget.Toast
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.addCallback
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
 import androidx.appcompat.view.ActionMode
 import androidx.lifecycle.lifecycleScope
 import com.google.android.material.snackbar.Snackbar
-import com.google.zxing.integration.android.IntentIntegrator
+import com.google.zxing.qrcode.QRCodeReader
+import com.journeyapps.barcodescanner.ScanContract
+import com.journeyapps.barcodescanner.ScanOptions
 import com.wireguard.android.Application
 import com.wireguard.android.R
 import com.wireguard.android.activity.TunnelCreatorActivity
@@ -29,15 +33,15 @@ import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter.RowC
 import com.wireguard.android.databinding.TunnelListFragmentBinding
 import com.wireguard.android.databinding.TunnelListItemBinding
 import com.wireguard.android.model.ObservableTunnel
+import com.wireguard.android.updater.SnackbarUpdateShower
 import com.wireguard.android.util.ErrorMessages
+import com.wireguard.android.util.QrCodeFromFileScanner
 import com.wireguard.android.util.TunnelImporter
 import com.wireguard.android.widget.MultiselectableRelativeLayout
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.async
 import kotlinx.coroutines.awaitAll
 import kotlinx.coroutines.launch
-import java.util.ArrayList
-import java.util.HashSet
 
 /**
  * Fragment containing a list of known WireGuard tunnels. It allows creating and deleting tunnels.
@@ -45,24 +49,40 @@ import java.util.HashSet
 class TunnelListFragment : BaseFragment() {
     private val actionModeListener = ActionModeListener()
     private var actionMode: ActionMode? = null
+    private var backPressedCallback: OnBackPressedCallback? = null
     private var binding: TunnelListFragmentBinding? = null
     private val tunnelFileImportResultLauncher = registerForActivityResult(ActivityResultContracts.GetContent()) { data ->
         if (data == null) return@registerForActivityResult
         val activity = activity ?: return@registerForActivityResult
         val contentResolver = activity.contentResolver ?: return@registerForActivityResult
         activity.lifecycleScope.launch {
-            TunnelImporter.importTunnel(contentResolver, data) { showSnackbar(it) }
+            if (QrCodeFromFileScanner.validContentType(contentResolver, data)) {
+                try {
+                    val qrCodeFromFileScanner = QrCodeFromFileScanner(contentResolver, QRCodeReader())
+                    val result = qrCodeFromFileScanner.scan(data)
+                    TunnelImporter.importTunnel(parentFragmentManager, result.text) { showSnackbar(it) }
+                } catch (e: Exception) {
+                    val error = ErrorMessages[e]
+                    val message = Application.get().resources.getString(R.string.import_error, error)
+                    Log.e(TAG, message, e)
+                    showSnackbar(message)
+                }
+            } else {
+                TunnelImporter.importTunnel(contentResolver, data) { showSnackbar(it) }
+            }
         }
     }
 
-    private val qrImportResultLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
-        val qrCode = IntentIntegrator.parseActivityResult(result.resultCode, result.data)?.contents
-                ?: return@registerForActivityResult
-        val activity = activity ?: return@registerForActivityResult
-        val fragManager = parentFragmentManager
-        activity.lifecycleScope.launch { TunnelImporter.importTunnel(fragManager, qrCode) { showSnackbar(it) } }
+    private val qrImportResultLauncher = registerForActivityResult(ScanContract()) { result ->
+        val qrCode = result.contents
+        val activity = activity
+        if (qrCode != null && activity != null) {
+            activity.lifecycleScope.launch { TunnelImporter.importTunnel(parentFragmentManager, qrCode) { showSnackbar(it) } }
+        }
     }
 
+    private val snackbarUpdateShower = SnackbarUpdateShower(this)
+
     override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
         super.onViewCreated(view, savedInstanceState)
         if (savedInstanceState != null) {
@@ -73,35 +93,46 @@ class TunnelListFragment : BaseFragment() {
         }
     }
 
-    override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?,
-                              savedInstanceState: Bundle?): View? {
+    override fun onCreateView(
+        inflater: LayoutInflater, container: ViewGroup?,
+        savedInstanceState: Bundle?
+    ): View? {
         super.onCreateView(inflater, container, savedInstanceState)
         binding = TunnelListFragmentBinding.inflate(inflater, container, false)
         val bottomSheet = AddTunnelsSheet()
         binding?.apply {
             createFab.setOnClickListener {
+                if (childFragmentManager.findFragmentByTag("BOTTOM_SHEET") != null)
+                    return@setOnClickListener
                 childFragmentManager.setFragmentResultListener(AddTunnelsSheet.REQUEST_KEY_NEW_TUNNEL, viewLifecycleOwner) { _, bundle ->
                     when (bundle.getString(AddTunnelsSheet.REQUEST_METHOD)) {
                         AddTunnelsSheet.REQUEST_CREATE -> {
                             startActivity(Intent(requireActivity(), TunnelCreatorActivity::class.java))
                         }
+
                         AddTunnelsSheet.REQUEST_IMPORT -> {
                             tunnelFileImportResultLauncher.launch("*/*")
                         }
+
                         AddTunnelsSheet.REQUEST_SCAN -> {
-                            qrImportResultLauncher.launch(IntentIntegrator(requireActivity())
+                            qrImportResultLauncher.launch(
+                                ScanOptions()
                                     .setOrientationLocked(false)
                                     .setBeepEnabled(false)
                                     .setPrompt(getString(R.string.qr_code_hint))
-                                    .createScanIntent())
+                            )
                         }
                     }
                 }
-                bottomSheet.show(childFragmentManager, "BOTTOM_SHEET")
+                bottomSheet.showNow(childFragmentManager, "BOTTOM_SHEET")
             }
             executePendingBindings()
+            snackbarUpdateShower.attach(mainContainer, createFab)
         }
-        return binding!!.root
+        backPressedCallback = requireActivity().onBackPressedDispatcher.addCallback(this) { actionMode?.finish() }
+        backPressedCallback?.isEnabled = false
+
+        return binding?.root
     }
 
     override fun onDestroyView() {
@@ -167,8 +198,8 @@ class TunnelListFragment : BaseFragment() {
         val binding = binding
         if (binding != null)
             Snackbar.make(binding.mainContainer, message, Snackbar.LENGTH_LONG)
-                    .setAnchorView(binding.createFab)
-                    .show()
+                .setAnchorView(binding.createFab)
+                .show()
         else
             Toast.makeText(activity ?: Application.get(), message, Toast.LENGTH_SHORT).show()
     }
@@ -210,6 +241,7 @@ class TunnelListFragment : BaseFragment() {
                     mode.finish()
                     true
                 }
+
                 R.id.menu_action_select_all -> {
                     lifecycleScope.launch {
                         val tunnels = Application.getTunnelManager().getTunnels()
@@ -219,12 +251,14 @@ class TunnelListFragment : BaseFragment() {
                     }
                     true
                 }
+
                 else -> false
             }
         }
 
         override fun onCreateActionMode(mode: ActionMode, menu: Menu): Boolean {
             actionMode = mode
+            backPressedCallback?.isEnabled = true
             if (activity != null) {
                 resources = activity!!.resources
             }
@@ -236,10 +270,11 @@ class TunnelListFragment : BaseFragment() {
 
         override fun onDestroyActionMode(mode: ActionMode) {
             actionMode = null
+            backPressedCallback?.isEnabled = false
             resources = null
             animateFab(binding?.createFab, true)
             checkedItems.clear()
-            binding!!.tunnelList.adapter!!.notifyDataSetChanged()
+            binding?.tunnelList?.adapter?.notifyDataSetChanged()
         }
 
         override fun onPrepareActionMode(mode: ActionMode, menu: Menu): Boolean {
@@ -255,7 +290,7 @@ class TunnelListFragment : BaseFragment() {
             }
             val adapter = if (binding == null) null else binding!!.tunnelList.adapter
             if (actionMode == null && !checkedItems.isEmpty() && activity != null) {
-                (activity as AppCompatActivity?)!!.startSupportActionMode(this)
+                (activity as AppCompatActivity).startSupportActionMode(this)
             } else if (actionMode != null && checkedItems.isEmpty()) {
                 actionMode!!.finish()
             }
@@ -282,7 +317,7 @@ class TunnelListFragment : BaseFragment() {
         private fun animateFab(view: View?, show: Boolean) {
             view ?: return
             val animation = AnimationUtils.loadAnimation(
-                    context, if (show) R.anim.scale_up else R.anim.scale_down
+                context, if (show) R.anim.scale_up else R.anim.scale_down
             )
             animation.setAnimationListener(object : Animation.AnimationListener {
                 override fun onAnimationRepeat(animation: Animation?) {

ui/src/main/java/com/wireguard/android/model/ApplicationData.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.model

ui/src/main/java/com/wireguard/android/model/ObservableTunnel.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.model
@@ -21,10 +21,10 @@ import kotlinx.coroutines.withContext
  * Encapsulates the volatile and nonvolatile state of a WireGuard tunnel.
  */
 class ObservableTunnel internal constructor(
-        private val manager: TunnelManager,
-        private var name: String,
-        config: Config?,
-        state: Tunnel.State
+    private val manager: TunnelManager,
+    private var name: String,
+    config: Config?,
+    state: Tunnel.State
 ) : BaseObservable(), Keyed<String>, Tunnel {
     override val key
         get() = name

ui/src/main/java/com/wireguard/android/model/TunnelComparator.kt

@@ -1,12 +1,10 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
 package com.wireguard.android.model
 
-import java.util.Locale
-
 object TunnelComparator : Comparator<String> {
     private class NaturalSortString(originalString: String) {
         class NaturalSortToken(val maybeString: String?, val maybeNumber: Int?) : Comparable<NaturalSortToken> {
@@ -29,7 +27,7 @@ object TunnelComparator : Comparator<String> {
         val tokens: MutableList<NaturalSortToken> = ArrayList()
 
         init {
-            for (s in NATURAL_SORT_DIGIT_FINDER.findAll(originalString.split(WHITESPACE_FINDER).joinToString(" ").toLowerCase(Locale.ENGLISH))) {
+            for (s in NATURAL_SORT_DIGIT_FINDER.findAll(originalString.split(WHITESPACE_FINDER).joinToString(" ").lowercase())) {
                 try {
                     val n = s.value.toInt()
                     tokens.add(NaturalSortToken(null, n))

ui/src/main/java/com/wireguard/android/model/TunnelManager.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.model
@@ -140,7 +140,8 @@ class TunnelManager(private val configStore: ConfigStore) : BaseObservable() {
         if (previouslyRunning.isEmpty()) return
         withContext(Dispatchers.IO) {
             try {
-                tunnelMap.filter { previouslyRunning.contains(it.name) }.map { async(Dispatchers.IO + SupervisorJob()) { setTunnelState(it, Tunnel.State.UP) } }.awaitAll()
+                tunnelMap.filter { previouslyRunning.contains(it.name) }.map { async(Dispatchers.IO + SupervisorJob()) { setTunnelState(it, Tunnel.State.UP) } }
+                    .awaitAll()
             } catch (e: Throwable) {
                 Log.e(TAG, Log.getStackTraceString(e))
             }
@@ -220,10 +221,9 @@ class TunnelManager(private val configStore: ConfigStore) : BaseObservable() {
                     manager.refreshTunnelStates()
                     return@launch
                 }
-                if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M || !UserKnobs.allowRemoteControlIntents.first())
+                if (!UserKnobs.allowRemoteControlIntents.first())
                     return@launch
-                val state: Tunnel.State
-                state = when (action) {
+                val state = when (action) {
                     "com.wireguard.android.action.SET_TUNNEL_UP" -> Tunnel.State.UP
                     "com.wireguard.android.action.SET_TUNNEL_DOWN" -> Tunnel.State.DOWN
                     else -> return@launch

ui/src/main/java/com/wireguard/android/preference/DonatePreference.kt

@@ -0,0 +1,43 @@
+/*
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.preference
+
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import android.util.AttributeSet
+import android.widget.Toast
+import androidx.preference.Preference
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
+import com.wireguard.android.R
+import com.wireguard.android.updater.Updater
+import com.wireguard.android.util.ErrorMessages
+import androidx.core.net.toUri
+
+class DonatePreference(context: Context, attrs: AttributeSet?) : Preference(context, attrs) {
+    override fun getSummary() = context.getString(R.string.donate_summary)
+
+    override fun getTitle() = context.getString(R.string.donate_title)
+
+    override fun onClick() {
+        /* Google Play Store forbids links to our donation page. */
+        if (Updater.installerIsGooglePlay(context)) {
+            MaterialAlertDialogBuilder(context)
+                .setTitle(R.string.donate_title)
+                .setMessage(R.string.donate_google_play_disappointment)
+                .show()
+            return
+        }
+
+        val intent = Intent(Intent.ACTION_VIEW)
+        intent.data = "https://www.wireguard.com/donations/".toUri()
+        try {
+            context.startActivity(intent)
+        } catch (e: Throwable) {
+            Toast.makeText(context, ErrorMessages[e], Toast.LENGTH_SHORT).show()
+        }
+    }
+}

ui/src/main/java/com/wireguard/android/preference/KernelModuleEnablerPreference.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.preference
@@ -26,7 +26,7 @@ import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import kotlin.system.exitProcess
 
-class KernelModuleDisablerPreference(context: Context, attrs: AttributeSet?) : Preference(context, attrs) {
+class KernelModuleEnablerPreference(context: Context, attrs: AttributeSet?) : Preference(context, attrs) {
     private var state = State.UNKNOWN
 
     init {
@@ -44,10 +44,10 @@ class KernelModuleDisablerPreference(context: Context, attrs: AttributeSet?) : P
         activity.lifecycleScope.launch {
             if (state == State.DISABLED) {
                 setState(State.ENABLING)
-                UserKnobs.setDisableKernelModule(false)
+                UserKnobs.setEnableKernelModule(true)
             } else if (state == State.ENABLED) {
                 setState(State.DISABLING)
-                UserKnobs.setDisableKernelModule(true)
+                UserKnobs.setEnableKernelModule(false)
             }
             val observableTunnels = Application.getTunnelManager().getTunnels()
             val downings = observableTunnels.map { async(SupervisorJob()) { it.setStateAsync(Tunnel.State.DOWN) } }
@@ -76,13 +76,13 @@ class KernelModuleDisablerPreference(context: Context, attrs: AttributeSet?) : P
 
     private enum class State(val titleResourceId: Int, val summaryResourceId: Int, val shouldEnableView: Boolean, val visible: Boolean) {
         UNKNOWN(0, 0, false, false),
-        ENABLED(R.string.module_disabler_enabled_title, R.string.module_disabler_enabled_summary, true, true),
-        DISABLED(R.string.module_disabler_disabled_title, R.string.module_disabler_disabled_summary, true, true),
-        ENABLING(R.string.module_disabler_disabled_title, R.string.success_application_will_restart, false, true),
-        DISABLING(R.string.module_disabler_enabled_title, R.string.success_application_will_restart, false, true);
+        ENABLED(R.string.module_enabler_enabled_title, R.string.module_enabler_enabled_summary, true, true),
+        DISABLED(R.string.module_enabler_disabled_title, R.string.module_enabler_disabled_summary, true, true),
+        ENABLING(R.string.module_enabler_disabled_title, R.string.success_application_will_restart, false, true),
+        DISABLING(R.string.module_enabler_enabled_title, R.string.success_application_will_restart, false, true);
     }
 
     companion object {
-        private const val TAG = "WireGuard/KernelModuleDisablerPreference"
+        private const val TAG = "WireGuard/KernelModuleEnablerPreference"
     }
 }

ui/src/main/java/com/wireguard/android/preference/ModuleDownloaderPreference.kt

@@ -1,70 +0,0 @@
-/*
- * Copyright © 2019 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-package com.wireguard.android.preference
-
-import android.content.Context
-import android.content.Intent
-import android.system.OsConstants
-import android.util.AttributeSet
-import android.widget.Toast
-import androidx.preference.Preference
-import com.wireguard.android.Application
-import com.wireguard.android.R
-import com.wireguard.android.activity.SettingsActivity
-import com.wireguard.android.util.ErrorMessages
-import com.wireguard.android.util.UserKnobs
-import com.wireguard.android.util.lifecycleScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.withContext
-import kotlin.system.exitProcess
-
-class ModuleDownloaderPreference(context: Context, attrs: AttributeSet?) : Preference(context, attrs) {
-    private var state = State.INITIAL
-    override fun getSummary() = context.getString(state.messageResourceId)
-
-    override fun getTitle() = context.getString(R.string.module_installer_title)
-
-    override fun onClick() {
-        setState(State.WORKING)
-        lifecycleScope.launch {
-            try {
-                when (withContext(Dispatchers.IO) { Application.getModuleLoader().download() }) {
-                    OsConstants.ENOENT -> setState(State.NOTFOUND)
-                    OsConstants.EXIT_SUCCESS -> {
-                        setState(State.SUCCESS)
-                        UserKnobs.setDisableKernelModule(null)
-                        withContext(Dispatchers.IO) {
-                            val restartIntent = Intent(context, SettingsActivity::class.java)
-                            restartIntent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP)
-                            restartIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                            Application.get().startActivity(restartIntent)
-                            exitProcess(0)
-                        }
-                    }
-                    else -> setState(State.FAILURE)
-                }
-            } catch (e: Throwable) {
-                setState(State.FAILURE)
-                Toast.makeText(context, ErrorMessages[e], Toast.LENGTH_LONG).show()
-            }
-        }
-    }
-
-    private fun setState(state: State) {
-        if (this.state == state) return
-        this.state = state
-        if (isEnabled != state.shouldEnableView) isEnabled = state.shouldEnableView
-        notifyChanged()
-    }
-
-    private enum class State(val messageResourceId: Int, val shouldEnableView: Boolean) {
-        INITIAL(R.string.module_installer_initial, true),
-        FAILURE(R.string.module_installer_error, true),
-        WORKING(R.string.module_installer_working, false),
-        SUCCESS(R.string.success_application_will_restart, false),
-        NOTFOUND(R.string.module_installer_not_found, false);
-    }
-}

ui/src/main/java/com/wireguard/android/preference/PreferencesPreferenceDataStore.kt

@@ -1,16 +1,19 @@
 /*
- * Copyright © 2020 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
 package com.wireguard.android.preference
 
-import androidx.datastore.DataStore
-import androidx.datastore.preferences.Preferences
-import androidx.datastore.preferences.edit
-import androidx.datastore.preferences.preferencesKey
-import androidx.datastore.preferences.preferencesSetKey
-import androidx.datastore.preferences.remove
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.booleanPreferencesKey
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.floatPreferencesKey
+import androidx.datastore.preferences.core.intPreferencesKey
+import androidx.datastore.preferences.core.longPreferencesKey
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.core.stringSetPreferencesKey
 import androidx.preference.PreferenceDataStore
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.flow.first
@@ -21,7 +24,7 @@ import kotlinx.coroutines.runBlocking
 class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope, private val dataStore: DataStore<Preferences>) : PreferenceDataStore() {
     override fun putString(key: String?, value: String?) {
         if (key == null) return
-        val pk = preferencesKey<String>(key)
+        val pk = stringPreferencesKey(key)
         coroutineScope.launch {
             dataStore.edit {
                 if (value == null) it.remove(pk)
@@ -32,7 +35,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun putStringSet(key: String?, values: Set<String?>?) {
         if (key == null) return
-        val pk = preferencesSetKey<String>(key)
+        val pk = stringSetPreferencesKey(key)
         val filteredValues = values?.filterNotNull()?.toSet()
         coroutineScope.launch {
             dataStore.edit {
@@ -44,7 +47,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun putInt(key: String?, value: Int) {
         if (key == null) return
-        val pk = preferencesKey<Int>(key)
+        val pk = intPreferencesKey(key)
         coroutineScope.launch {
             dataStore.edit {
                 it[pk] = value
@@ -54,7 +57,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun putLong(key: String?, value: Long) {
         if (key == null) return
-        val pk = preferencesKey<Long>(key)
+        val pk = longPreferencesKey(key)
         coroutineScope.launch {
             dataStore.edit {
                 it[pk] = value
@@ -64,7 +67,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun putFloat(key: String?, value: Float) {
         if (key == null) return
-        val pk = preferencesKey<Float>(key)
+        val pk = floatPreferencesKey(key)
         coroutineScope.launch {
             dataStore.edit {
                 it[pk] = value
@@ -74,7 +77,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun putBoolean(key: String?, value: Boolean) {
         if (key == null) return
-        val pk = preferencesKey<Boolean>(key)
+        val pk = booleanPreferencesKey(key)
         coroutineScope.launch {
             dataStore.edit {
                 it[pk] = value
@@ -84,7 +87,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun getString(key: String?, defValue: String?): String? {
         if (key == null) return defValue
-        val pk = preferencesKey<String>(key)
+        val pk = stringPreferencesKey(key)
         return runBlocking {
             dataStore.data.map { it[pk] ?: defValue }.first()
         }
@@ -92,7 +95,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun getStringSet(key: String?, defValues: Set<String?>?): Set<String?>? {
         if (key == null) return defValues
-        val pk = preferencesSetKey<String>(key)
+        val pk = stringSetPreferencesKey(key)
         return runBlocking {
             dataStore.data.map { it[pk] ?: defValues }.first()
         }
@@ -100,7 +103,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun getInt(key: String?, defValue: Int): Int {
         if (key == null) return defValue
-        val pk = preferencesKey<Int>(key)
+        val pk = intPreferencesKey(key)
         return runBlocking {
             dataStore.data.map { it[pk] ?: defValue }.first()
         }
@@ -108,7 +111,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun getLong(key: String?, defValue: Long): Long {
         if (key == null) return defValue
-        val pk = preferencesKey<Long>(key)
+        val pk = longPreferencesKey(key)
         return runBlocking {
             dataStore.data.map { it[pk] ?: defValue }.first()
         }
@@ -116,7 +119,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun getFloat(key: String?, defValue: Float): Float {
         if (key == null) return defValue
-        val pk = preferencesKey<Float>(key)
+        val pk = floatPreferencesKey(key)
         return runBlocking {
             dataStore.data.map { it[pk] ?: defValue }.first()
         }
@@ -124,7 +127,7 @@ class PreferencesPreferenceDataStore(private val coroutineScope: CoroutineScope,
 
     override fun getBoolean(key: String?, defValue: Boolean): Boolean {
         if (key == null) return defValue
-        val pk = preferencesKey<Boolean>(key)
+        val pk = booleanPreferencesKey(key)
         return runBlocking {
             dataStore.data.map { it[pk] ?: defValue }.first()
         }

ui/src/main/java/com/wireguard/android/preference/QuickTilePreference.kt

@@ -0,0 +1,50 @@
+/*
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.preference
+
+import android.app.StatusBarManager
+import android.content.ComponentName
+import android.content.Context
+import android.graphics.drawable.Icon
+import android.os.Build
+import android.util.AttributeSet
+import android.widget.Toast
+import androidx.annotation.RequiresApi
+import androidx.preference.Preference
+import com.wireguard.android.QuickTileService
+import com.wireguard.android.R
+
+@RequiresApi(Build.VERSION_CODES.TIRAMISU)
+class QuickTilePreference(context: Context, attrs: AttributeSet?) : Preference(context, attrs) {
+    override fun getSummary() = context.getString(R.string.quick_settings_tile_add_summary)
+
+    override fun getTitle() = context.getString(R.string.quick_settings_tile_add_title)
+
+    override fun onClick() {
+        val statusBarManager = context.getSystemService(StatusBarManager::class.java)
+        statusBarManager.requestAddTileService(
+            ComponentName(context, QuickTileService::class.java),
+            context.getString(R.string.quick_settings_tile_action),
+            Icon.createWithResource(context, R.drawable.ic_tile),
+            context.mainExecutor
+        ) {
+            when (it) {
+                StatusBarManager.TILE_ADD_REQUEST_RESULT_TILE_ALREADY_ADDED,
+                StatusBarManager.TILE_ADD_REQUEST_RESULT_TILE_ADDED -> {
+                    parent?.removePreference(this)
+                    --preferenceManager.preferenceScreen.initialExpandedChildrenCount
+                }
+                StatusBarManager.TILE_ADD_REQUEST_ERROR_MISMATCHED_PACKAGE,
+                StatusBarManager.TILE_ADD_REQUEST_ERROR_REQUEST_IN_PROGRESS,
+                StatusBarManager.TILE_ADD_REQUEST_ERROR_BAD_COMPONENT,
+                StatusBarManager.TILE_ADD_REQUEST_ERROR_NOT_CURRENT_USER,
+                StatusBarManager.TILE_ADD_REQUEST_ERROR_APP_NOT_IN_FOREGROUND,
+                StatusBarManager.TILE_ADD_REQUEST_ERROR_NO_STATUS_BAR_SERVICE ->
+                    Toast.makeText(context, context.getString(R.string.quick_settings_tile_add_failure, it), Toast.LENGTH_SHORT).show()
+            }
+        }
+    }
+}

ui/src/main/java/com/wireguard/android/preference/ToolsInstallerPreference.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2025 WireGuard LLC. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 package com.wireguard.android.preference