version: bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
ui: allow vetoing tunnel selection changes
2026-07-03 14:05:13 +02:00 · 2023-04-05 17:09:41 +02:00 · 2023-04-05 17:08:47 +02:00 · 2023-04-05 16:20:10 +02:00 · 2023-04-05 16:03:54 +02:00 · 2023-04-05 13:54:23 +02:00
182 changed files with 2427 additions and 791 deletions
@@ -1,3 +1,6 @@
 [submodule "tunnel/tools/wireguard-tools"]
 	path = tunnel/tools/wireguard-tools
 	url = https://git.zx2c4.com/wireguard-tools
+[submodule "tunnel/tools/elf-cleaner"]
+	path = tunnel/tools/elf-cleaner
+	url = https://github.com/termux/termux-elf-cleaner
@@ -66,9 +66,6 @@
      <option name="NAME_COUNT_TO_USE_STAR_IMPORT_FOR_MEMBERS" value="10" />
      <option name="CODE_STYLE_DEFAULTS" value="KOTLIN_OFFICIAL" />
    </JetCodeStyleSettings>
-    <XML>
-      <option name="XML_LEGACY_SETTINGS_IMPORTED" value="true" />
-    </XML>
    <codeStyleSettings language="JAVA">
      <option name="METHOD_ANNOTATION_WRAP" value="0" />
      <option name="FIELD_ANNOTATION_WRAP" value="0" />
@@ -1,21 +1,21 @@
 buildscript {
    ext {
-        activityVersion = '1.4.0'
-        annotationsVersion = '1.3.0'
-        appcompatVersion = '1.4.1'
+        activityVersion = '1.6.1'
+        annotationsVersion = '1.6.0'
+        appcompatVersion = '1.6.1'
        biometricVersion = '1.1.0'
        collectionVersion = '1.2.0'
-        constraintLayoutVersion = '2.1.3'
+        constraintLayoutVersion = '2.1.4'
        coordinatorLayoutVersion = '1.2.0'
-        coreKtxVersion = '1.7.0'
-        coroutinesVersion = '1.6.1'
+        coreKtxVersion = '1.10.0-rc01'
+        coroutinesVersion = '1.6.4'
        datastoreVersion = '1.0.0'
        desugarVersion = '1.1.5'
-        fragmentVersion = '1.4.1'
+        fragmentVersion = '1.5.5'
        jsr305Version = '3.0.2'
        junitVersion = '4.13.2'
-        lifecycleRuntimeKtxVersion = '2.4.1'
-        materialComponentsVersion = '1.5.0'
+        lifecycleRuntimeKtxVersion = '2.6.0'
+        materialComponentsVersion = '1.8.0'
        preferenceVersion = '1.2.0'
        zxingEmbeddedVersion = '4.3.0'

@@ -23,47 +23,10 @@ buildscript {
    }
 }

-plugins {
-    id "de.undercouch.download" version "5.0.4"
-}
-
-task downloadCrowdin(type: Download) {
-	src 'https://crowdin.com/backend/download/project/wireguard.zip'
-	dest file('build/translations.zip')
-	overwrite true
-}
-
-task cleanCrowdin(type: Delete) {
-	delete 'ui/src/main/res/values-*/strings.xml'
-}
-
-task extractCrowdin(type: Copy, dependsOn: ['downloadCrowdin', 'cleanCrowdin']) {
-	mustRunAfter 'downloadCrowdin'
-	from zipTree(file('build/translations.zip'))
-	into file('build/translations')
-	doFirst {
-		delete 'build/translations'
-	}
-}
-
-task crowdin(type: Copy, dependsOn: ['extractCrowdin']) {
-    mustRunAfter 'extractCrowdin'
-    from 'build/translations/wireguard-android/ui/src/main/res'
-    into 'ui/src/main/res/'
-    doLast {
-        delete 'build/translations'
-        delete 'build/translations.zip'
-    }
-}
-
-task clean(type: Delete) {
-    delete rootProject.buildDir
-}
-
 tasks {
    wrapper {
-        gradleVersion = "7.3.3"
-        distributionSha256Sum = "b586e04868a22fd817c8971330fec37e298f3242eb85c374181b12d637f80302"
+        gradleVersion = "8.0.2"
+        distributionSha256Sum = "ff7bf6a86f09b9b2c40bb8f48b25fc19cf2b2664fd1d220cd7ab833ec758d0d7"
    }
 }

@@ -18,9 +18,6 @@ org.gradle.jvmargs=-Xmx1536m
 # Turn off AP discovery in compile path to enable compile avoidance
 kapt.include.compile.classpath=false

-# Enable AndroidX
-android.useAndroidX=true
-
 # Enable non-transitive R class namespacing where each library only contains
 # references to the resources it declares instead of declarations plus all
 # transitive dependency references.
@@ -45,6 +42,8 @@ android.generateManifestClass=true
 android.experimental.enableSourceSetPathsMap=true
 # Use relative paths for better Gradle caching of library build tasks
 android.experimental.cacheCompileLibResources=true
+# Disable automatic creation of publishing components
+android.disableAutomaticComponentCreation=true

 # Default Android build features
 # Disable BuildConfig generation by default
@@ -1,6 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=b586e04868a22fd817c8971330fec37e298f3242eb85c374181b12d637f80302
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.3-bin.zip
+distributionSha256Sum=ff7bf6a86f09b9b2c40bb8f48b25fc19cf2b2664fd1d220cd7ab833ec758d0d7
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.0.2-bin.zip
+networkTimeout=10000
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
@@ -55,7 +55,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -80,10 +80,10 @@ do
    esac
 done

-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-APP_NAME="Gradle"
+# This is normally unused
+# shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit

 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
@@ -143,12 +143,16 @@ fi
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
    case $MAX_FD in #(
      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
        MAX_FD=$( ulimit -H -n ) ||
            warn "Could not query maximum file descriptor limit"
    esac
    case $MAX_FD in  #(
      '' | soft) :;; #(
      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
        ulimit -n "$MAX_FD" ||
            warn "Could not set maximum file descriptor limit to $MAX_FD"
    esac
@@ -205,6 +209,12 @@ set -- \
        org.gradle.wrapper.GradleWrapperMain \
        "$@"

+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
 # Use "xargs" to parse quoted args.
 #
 # With -n1 it outputs one arg per line, with the quotes and backslashes removed.
@@ -1,6 +1,6 @@
 pluginManagement {
-    def agpVersion = "7.1.3"
-    def kotlinVersion = "1.6.20"
+    def agpVersion = '7.4.2'
+    def kotlinVersion = "1.8.0"
    repositories {
        gradlePluginPortal()
        google()
@@ -6,14 +6,15 @@ version wireguardVersionName
 group groupName

 android {
-    compileSdkVersion 31
+    compileSdk 33
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }
+    namespace 'com.wireguard.android.tunnel'
    defaultConfig {
        minSdkVersion 21
-        targetSdkVersion 31
+        targetSdkVersion 33
        versionCode wireguardVersionCode
        versionName wireguardVersionName
    }
@@ -28,24 +29,36 @@ android {
        }
    }
    buildTypes {
+        all {
+            externalNativeBuild {
+                cmake {
+                    targets 'libwg-go.so', 'libwg.so', 'libwg-quick.so'
+                    arguments "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}"
+                }
+            }
+        }
        release {
            externalNativeBuild {
                cmake {
-                    arguments "-DANDROID_PACKAGE_NAME=${groupName}", "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}"
+                    arguments "-DANDROID_PACKAGE_NAME=${groupName}"
                }
            }
        }
        debug {
            externalNativeBuild {
                cmake {
-                    arguments "-DANDROID_PACKAGE_NAME=${groupName}.debug", "-DGRADLE_USER_HOME=${project.gradle.gradleUserHomeDir}"
+                    arguments "-DANDROID_PACKAGE_NAME=${groupName}.debug"
                }
            }
        }
    }
-    lintOptions {
-        disable('LongLogTag')
-        disable('NewApi') // Desugaring!
+    lint {
+        disable 'LongLogTag', 'NewApi'
+    }
+    publishing {
+        multipleVariants("release") {
+            allVariants()
+        }
    }
 }

@@ -1,16 +1,15 @@
 <!--
-  ~ Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+  ~ Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
  ~ SPDX-License-Identifier: Apache-2.0
  -->

-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="com.wireguard.android.tunnel">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">

    <application>
        <service
            android:name="com.wireguard.android.backend.GoBackend$VpnService"
            android:permission="android.permission.BIND_VPN_SERVICE"
-            android:exported="true">
+            android:exported="false">
            <intent-filter>
                <action android:name="android.net.VpnService" />
            </intent-filter>
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,6 +1,6 @@
 /*
 * Copyright © 2016 Southern Storm Software, Pty Ltd.
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,13 +1,11 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+# Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.

 cmake_minimum_required(VERSION 3.4.1)
 project("WireGuard")
 set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
-
-# Work around https://github.com/android-ndk/ndk/issues/602
-set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=gold")
+add_link_options(LINKER:--build-id=none)

 add_executable(libwg-quick.so wireguard-tools/src/wg-quick/android.c ndk-compat/compat.c)
 target_compile_options(libwg-quick.so PUBLIC -O3 -std=gnu11 -Wall -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DWG_PACKAGE_NAME=\"${ANDROID_PACKAGE_NAME}\")
@@ -18,18 +16,28 @@ add_executable(libwg.so ${WG_SOURCES})
 target_include_directories(libwg.so PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/uapi/linux/" "${CMAKE_CURRENT_SOURCE_DIR}/wireguard-tools/src/")
 target_compile_options(libwg.so PUBLIC -O3 -std=gnu11 -D_GNU_SOURCE -include ${CMAKE_CURRENT_SOURCE_DIR}/ndk-compat/compat.h -DHAVE_VISIBILITY_HIDDEN -DRUNSTATEDIR=\"/data/data/${ANDROID_PACKAGE_NAME}/cache\")

-add_custom_target(libwg-go.so WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/libwg-go" COMMENT "Building wireguard-go" VERBATIM COMMAND make
+add_custom_target(libwg-go.so WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/libwg-go" COMMENT "Building wireguard-go" VERBATIM COMMAND "${ANDROID_HOST_PREBUILTS}/bin/make"
    ANDROID_ARCH_NAME=${ANDROID_ARCH_NAME}
-    ANDROID_C_COMPILER=${ANDROID_C_COMPILER}
-    ANDROID_TOOLCHAIN_ROOT=${ANDROID_TOOLCHAIN_ROOT}
-    ANDROID_LLVM_TRIPLE=${ANDROID_LLVM_TRIPLE}
-    ANDROID_SYSROOT=${ANDROID_SYSROOT}
    ANDROID_PACKAGE_NAME=${ANDROID_PACKAGE_NAME}
    GRADLE_USER_HOME=${GRADLE_USER_HOME}
-    CFLAGS=${CMAKE_C_FLAGS}\ -Wno-unused-command-line-argument
-    LDFLAGS=${CMAKE_SHARED_LINKER_FLAGS}\ -fuse-ld=gold
+    CC=${CMAKE_C_COMPILER}
+    CFLAGS=${CMAKE_C_FLAGS}
+    LDFLAGS=${CMAKE_SHARED_LINKER_FLAGS}
+    SYSROOT=${CMAKE_SYSROOT}
+    TARGET=${CMAKE_C_COMPILER_TARGET}
    DESTDIR=${CMAKE_LIBRARY_OUTPUT_DIRECTORY}
    BUILDDIR=${CMAKE_LIBRARY_OUTPUT_DIRECTORY}/../generated-src
 )
-# Hack to make it actually build as part of the default target
-add_dependencies(libwg.so libwg-go.so)
+
+# Strip unwanted ELF sections to prevent DT_FLAGS_1 warnings on old Android versions
+file(GLOB ELF_CLEANER_SOURCES elf-cleaner/*.c elf-cleaner/*.cpp)
+add_custom_target(elf-cleaner COMMENT "Building elf-cleaner" VERBATIM COMMAND "${CMAKE_C_COMPILER}"
+        -O2 -DPACKAGE_NAME="elf-cleaner" -DPACKAGE_VERSION="" -DCOPYRIGHT=""
+        -o "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner" ${ELF_CLEANER_SOURCES}
+)
+add_custom_command(TARGET libwg.so POST_BUILD VERBATIM COMMAND "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner"
+        --api-level "${ANDROID_NATIVE_API_LEVEL}" "$<TARGET_FILE:libwg.so>")
+add_dependencies(libwg.so elf-cleaner)
+add_custom_command(TARGET libwg-quick.so POST_BUILD VERBATIM COMMAND "${CMAKE_CURRENT_BINARY_DIR}/elf-cleaner"
+        --api-level "${ANDROID_NATIVE_API_LEVEL}" "$<TARGET_FILE:libwg-quick.so>")
+add_dependencies(libwg-quick.so elf-cleaner)
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
-# Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+# Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.

 BUILDDIR ?= $(CURDIR)/build
 DESTDIR ?= $(CURDIR)/out
@@ -12,20 +12,20 @@ NDK_GO_ARCH_MAP_arm64 := arm64
 NDK_GO_ARCH_MAP_mips := mipsx
 NDK_GO_ARCH_MAP_mips64 := mips64x

-CLANG_FLAGS := --target=$(ANDROID_LLVM_TRIPLE) --gcc-toolchain=$(ANDROID_TOOLCHAIN_ROOT) --sysroot=$(ANDROID_SYSROOT)
-export CGO_CFLAGS := $(CLANG_FLAGS) $(CFLAGS)
-export CGO_LDFLAGS := $(CLANG_FLAGS) $(LDFLAGS) -Wl,-soname=libwg-go.so
-export CC := $(ANDROID_C_COMPILER)
+comma := ,
+CLANG_FLAGS := --target=$(TARGET) --sysroot=$(SYSROOT)
+export CGO_CFLAGS := $(CLANG_FLAGS) $(subst -mthumb,-marm,$(CFLAGS))
+export CGO_LDFLAGS := $(CLANG_FLAGS) $(patsubst -Wl$(comma)--build-id=%,-Wl$(comma)--build-id=none,$(LDFLAGS)) -Wl,-soname=libwg-go.so
 export GOARCH := $(NDK_GO_ARCH_MAP_$(ANDROID_ARCH_NAME))
 export GOOS := android
 export CGO_ENABLED := 1

-GO_VERSION := 1.18.2
+GO_VERSION := 1.20.2
 GO_PLATFORM := $(shell uname -s | tr '[:upper:]' '[:lower:]')-$(NDK_GO_ARCH_MAP_$(shell uname -m))
 GO_TARBALL := go$(GO_VERSION).$(GO_PLATFORM).tar.gz
-GO_HASH_darwin-amd64 := 1f5f539ce0baa8b65f196ee219abf73a7d9cf558ba9128cc0fe4833da18b04f2
-GO_HASH_darwin-arm64 := 6c7df9a2405f09aa9bab55c93c9c4ce41d3e58127d626bc1825ba5d0a0045d5c
-GO_HASH_linux-amd64 := e54bec97a1a5d230fc2f9ad0880fcbabb5888f30ed9666eca4a91c5a32e86cbc
+GO_HASH_darwin-amd64 := c93b8ced9517d07e1cd4c362c6e2d5242cb139e29b417a328fbf19aded08764c
+GO_HASH_darwin-arm64 := 7343c87f19e79c0063532e82e1c4d6f42175a32d99f7a4d15e658e88bf97f885
+GO_HASH_linux-amd64 := 4eaea32f59cde4dc635fbc42161031d13e1c780b87097f4b4234cfce671f1768

 default: $(DESTDIR)/libwg-go.so

@@ -47,6 +47,6 @@ $(BUILDDIR)/go-$(GO_VERSION)/.prepared: $(GRADLE_USER_HOME)/caches/golang/$(GO_T

 $(DESTDIR)/libwg-go.so: export PATH := $(BUILDDIR)/go-$(GO_VERSION)/bin/:$(PATH)
 $(DESTDIR)/libwg-go.so: $(BUILDDIR)/go-$(GO_VERSION)/.prepared go.mod
-	go build -tags linux -ldflags="-X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard" -v -trimpath -o "$@" -buildmode c-shared
+	go build -tags linux -ldflags="-X golang.zx2c4.com/wireguard/ipc.socketDirectory=/data/data/$(ANDROID_PACKAGE_NAME)/cache/wireguard -buildid=" -v -trimpath -o "$@" -buildmode c-shared

 .DELETE_ON_ERROR:
@@ -1,14 +1,14 @@
 module golang.zx2c4.com/wireguard/android

-go 1.18
+go 1.20

 require (
-	golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a
-	golang.zx2c4.com/wireguard v0.0.0-20220407013110-ef5c587f782d
+	golang.org/x/sys v0.6.0
+	golang.zx2c4.com/wireguard v0.0.0-20230223181233-21636207a675
 )

 require (
-	golang.org/x/crypto v0.0.0-20220516162934-403b01795ae8 // indirect
-	golang.org/x/net v0.0.0-20220516155154-20f960328961 // indirect
-	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
+	golang.org/x/crypto v0.7.0 // indirect
+	golang.org/x/net v0.8.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 )
@@ -1,10 +1,10 @@
-golang.org/x/crypto v0.0.0-20220516162934-403b01795ae8 h1:y+mHpWoQJNAHt26Nhh6JP7hvM71IRZureyvZhoVALIs=
-golang.org/x/crypto v0.0.0-20220516162934-403b01795ae8/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/net v0.0.0-20220516155154-20f960328961 h1:+W/iTMPG0EL7aW+/atntZwZrvSRIj3m3yX414dSULUU=
-golang.org/x/net v0.0.0-20220516155154-20f960328961/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a h1:N2T1jUrTQE9Re6TFF5PhvEHXHCguynGhKjWVsIUt5cY=
-golang.org/x/sys v0.0.0-20220513210249-45d2b4557a2a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 h1:Ug9qvr1myri/zFN6xL17LSCBGFDnphBBhzmILHsM5TY=
-golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
-golang.zx2c4.com/wireguard v0.0.0-20220407013110-ef5c587f782d h1:q4JksJ2n0fmbXC0Aj0eOs6E0AcPqnKglxWXWFqGD6x0=
-golang.zx2c4.com/wireguard v0.0.0-20220407013110-ef5c587f782d/go.mod h1:bVQfyl2sCM/QIIGHpWbFGfHPuDvqnCNkT6MQLTCjO/U=
+golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20230223181233-21636207a675 h1:/J/RVnr7ng4fWPRH3xa4WtBJ1Jp+Auu4YNLmGiPv5QU=
+golang.zx2c4.com/wireguard v0.0.0-20230223181233-21636207a675/go.mod h1:whfbyDBt09xhCYQWtO2+3UVjlaq6/9hDZrjg2ZE6SyA=
@@ -1,7 +1,8 @@
-From b83553d9f260ba20c6faaa52e6fe6f74309eb41a Mon Sep 17 00:00:00 2001
+From 61f3ae8298d1c503cbc31539e0f3a73446c7db9d Mon Sep 17 00:00:00 2001
 From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-Date: Mon, 22 Feb 2021 02:36:03 +0100
-Subject: [PATCH] runtime: use CLOCK_BOOTTIME in nanotime on Linux
+Date: Tue, 21 Mar 2023 15:33:56 +0100
+Subject: [PATCH] [release-branch.go1.20] runtime: use CLOCK_BOOTTIME in
+ nanotime on Linux

 This makes timers account for having expired while a computer was
 asleep, which is quite common on mobile devices. Note that BOOTTIME is
@@ -21,17 +22,17 @@ Change-Id: I7b2a6ca0c5bc5fce57ec0eeafe7b68270b429321
 src/runtime/sys_linux_amd64.s   | 2 +-
 src/runtime/sys_linux_arm.s     | 4 ++--
 src/runtime/sys_linux_arm64.s   | 4 ++--
- src/runtime/sys_linux_mips64x.s | 2 +-
+ src/runtime/sys_linux_mips64x.s | 4 ++--
 src/runtime/sys_linux_mipsx.s   | 2 +-
 src/runtime/sys_linux_ppc64x.s  | 2 +-
 src/runtime/sys_linux_s390x.s   | 2 +-
- 8 files changed, 11 insertions(+), 11 deletions(-)
+ 8 files changed, 12 insertions(+), 12 deletions(-)

 diff --git a/src/runtime/sys_linux_386.s b/src/runtime/sys_linux_386.s
-index 1e3a834812..78b6021fc7 100644
+index 12a294153d..17e3524b40 100644
 --- a/src/runtime/sys_linux_386.s
 +++ b/src/runtime/sys_linux_386.s
-@@ -337,13 +337,13 @@ noswitch:
+@@ -352,13 +352,13 @@ noswitch:
 
 	LEAL	8(SP), BX	// &ts (struct timespec)
 	MOVL	BX, 4(SP)
@@ -48,10 +49,10 @@ index 1e3a834812..78b6021fc7 100644
 	INVOKE_SYSCALL
 
 diff --git a/src/runtime/sys_linux_amd64.s b/src/runtime/sys_linux_amd64.s
-index 37cb8dad03..e8b730bcaa 100644
+index c7a89ba536..01f0a6a26e 100644
 --- a/src/runtime/sys_linux_amd64.s
 +++ b/src/runtime/sys_linux_amd64.s
-@@ -302,7 +302,7 @@ noswitch:
+@@ -255,7 +255,7 @@ noswitch:
 	SUBQ	$16, SP		// Space for results
 	ANDQ	$~15, SP	// Align for C code
 
@@ -61,7 +62,7 @@ index 37cb8dad03..e8b730bcaa 100644
 	MOVQ	runtime·vdsoClockgettimeSym(SB), AX
 	CMPQ	AX, $0
 diff --git a/src/runtime/sys_linux_arm.s b/src/runtime/sys_linux_arm.s
-index 475f52344c..bb567abcf4 100644
+index 7b8c4f0e04..9798a1334e 100644
 --- a/src/runtime/sys_linux_arm.s
 +++ b/src/runtime/sys_linux_arm.s
@@ -11,7 +11,7 @@
@@ -73,20 +74,20 @@ index 475f52344c..bb567abcf4 100644
 
 // for EABI, as we don't support OABI
 #define SYS_BASE 0x0
-@@ -366,7 +366,7 @@ noswitch:
- 	SUB	$24, R13	// Space for results
- 	BIC	$0x7, R13	// Align for C code
+@@ -374,7 +374,7 @@ finish:
 
+ // func nanotime1() int64
+ TEXT runtime·nanotime1(SB),NOSPLIT,$12-8
 -	MOVW	$CLOCK_MONOTONIC, R0
 +	MOVW	$CLOCK_BOOTTIME, R0
- 	MOVW	$8(R13), R1	// timespec
- 	MOVW	runtime·vdsoClockgettimeSym(SB), R2
- 	CMP	$0, R2
+ 	MOVW	$spec-12(SP), R1	// timespec
+ 
+ 	MOVW	runtime·vdsoClockgettimeSym(SB), R4
 diff --git a/src/runtime/sys_linux_arm64.s b/src/runtime/sys_linux_arm64.s
-index 198a5bacef..9715387f36 100644
+index 38ff6ac330..6b819c5441 100644
 --- a/src/runtime/sys_linux_arm64.s
 +++ b/src/runtime/sys_linux_arm64.s
-@@ -13,7 +13,7 @@
+@@ -14,7 +14,7 @@
 #define AT_FDCWD -100
 
 #define CLOCK_REALTIME 0
@@ -95,7 +96,7 @@ index 198a5bacef..9715387f36 100644
 
 #define SYS_exit		93
 #define SYS_read		63
-@@ -319,7 +319,7 @@ noswitch:
+@@ -338,7 +338,7 @@ noswitch:
 	BIC	$15, R1
 	MOVD	R1, RSP
 
@@ -105,10 +106,10 @@ index 198a5bacef..9715387f36 100644
 	CBZ	R2, fallback
 
 diff --git a/src/runtime/sys_linux_mips64x.s b/src/runtime/sys_linux_mips64x.s
-index c3e9f37694..e3879acd38 100644
+index 47f2da524d..a8b387f193 100644
 --- a/src/runtime/sys_linux_mips64x.s
 +++ b/src/runtime/sys_linux_mips64x.s
-@@ -312,7 +312,7 @@ noswitch:
+@@ -326,7 +326,7 @@ noswitch:
 	AND	$~15, R1	// Align for C code
 	MOVV	R1, R29
 
@@ -117,11 +118,20 @@ index c3e9f37694..e3879acd38 100644
 	MOVV	$0(R29), R5
 
 	MOVV	runtime·vdsoClockgettimeSym(SB), R25
+@@ -336,7 +336,7 @@ noswitch:
+ 	// see walltime for detail
+ 	BEQ	R2, R0, finish
+ 	MOVV	R0, runtime·vdsoClockgettimeSym(SB)
+-	MOVW	$1, R4 // CLOCK_MONOTONIC
+	MOVW	$7, R4 // CLOCK_BOOTTIME
+ 	MOVV	$0(R29), R5
+ 	JMP	fallback
+ 
 diff --git a/src/runtime/sys_linux_mipsx.s b/src/runtime/sys_linux_mipsx.s
-index fab2ab3892..f9af103594 100644
+index 5e6b6c1504..7f5fd2a80e 100644
 --- a/src/runtime/sys_linux_mipsx.s
 +++ b/src/runtime/sys_linux_mipsx.s
-@@ -238,7 +238,7 @@ TEXT runtime·walltime1(SB),NOSPLIT,$8-12
+@@ -243,7 +243,7 @@ TEXT runtime·walltime(SB),NOSPLIT,$8-12
 	RET
 
 TEXT runtime·nanotime1(SB),NOSPLIT,$8-8
@@ -131,11 +141,11 @@ index fab2ab3892..f9af103594 100644
 	MOVW	$SYS_clock_gettime, R2
 	SYSCALL
 diff --git a/src/runtime/sys_linux_ppc64x.s b/src/runtime/sys_linux_ppc64x.s
-index fd69ee70a5..ff6bc8355b 100644
+index d0427a4807..05ee9fede9 100644
 --- a/src/runtime/sys_linux_ppc64x.s
 +++ b/src/runtime/sys_linux_ppc64x.s
-@@ -249,7 +249,7 @@ fallback:
- 	JMP	finish
+@@ -298,7 +298,7 @@ fallback:
+ 	JMP	return
 
 TEXT runtime·nanotime1(SB),NOSPLIT,$16-8
 -	MOVD	$1, R3		// CLOCK_MONOTONIC
@@ -144,18 +154,18 @@ index fd69ee70a5..ff6bc8355b 100644
 	MOVD	R1, R15		// R15 is unchanged by C code
 	MOVD	g_m(g), R21	// R21 = m
 diff --git a/src/runtime/sys_linux_s390x.s b/src/runtime/sys_linux_s390x.s
-index c15a1d5364..f52c4d5098 100644
+index 1448670b91..7d2ee3231c 100644
 --- a/src/runtime/sys_linux_s390x.s
 +++ b/src/runtime/sys_linux_s390x.s
-@@ -207,7 +207,7 @@ TEXT runtime·walltime1(SB),NOSPLIT,$16
+@@ -296,7 +296,7 @@ fallback:
 	RET
 
- TEXT runtime·nanotime1(SB),NOSPLIT,$16
-	MOVW	$1, R2 // CLOCK_MONOTONIC
-+	MOVW	$7, R2 // CLOCK_BOOTTIME
- 	MOVD	$tp-16(SP), R3
- 	MOVW	$SYS_clock_gettime, R1
- 	SYSCALL
+ TEXT runtime·nanotime1(SB),NOSPLIT,$32-8
+-	MOVW	$1, R2			// CLOCK_MONOTONIC
+	MOVW	$7, R2			// CLOCK_BOOTTIME
+ 
+ 	MOVD	R15, R7			// Backup stack pointer
+ 
 -- 
-2.30.1
+2.17.1

@@ -1,12 +1,12 @@
 /* SPDX-License-Identifier: BSD
 *
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 *
 */

 #define FILE_IS_EMPTY

-#if defined(__ANDROID_API__) && __ANDROID_API__ < 18
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 18
 #undef FILE_IS_EMPTY
 #include <stdio.h>
 #include <stdlib.h>
@@ -58,7 +58,7 @@ ssize_t getline(char **buf, size_t *bufsiz, FILE *fp)
 }
 #endif

-#if defined(__ANDROID_API__) && __ANDROID_API__ < 24
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 24
 #undef FILE_IS_EMPTY
 #include <string.h>

@@ -1,16 +1,16 @@
 /* SPDX-License-Identifier: BSD
 *
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 *
 */

-#if defined(__ANDROID_API__) && __ANDROID_API__ < 18
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 18
 #include <stdio.h>
 ssize_t getdelim(char **buf, size_t *bufsiz, int delimiter, FILE *fp);
 ssize_t getline(char **buf, size_t *bufsiz, FILE *fp);
 #endif

-#if defined(__ANDROID_API__) && __ANDROID_API__ < 24
+#if defined(__ANDROID_MIN_SDK_VERSION__) && __ANDROID_MIN_SDK_VERSION__ < 24
 char *strchrnul(const char *s, int c);
 #endif

@@ -1,3 +1,5 @@
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+
 plugins {
    id 'com.android.application'
    id 'org.jetbrains.kotlin.android'
@@ -12,16 +14,17 @@ group groupName
 final def keystorePropertiesFile = rootProject.file("keystore.properties")

 android {
-    compileSdkVersion 31
+    compileSdk 33
    buildFeatures {
        buildConfig = true
        dataBinding = true
        viewBinding = true
    }
+    namespace = 'com.wireguard.android'
    defaultConfig {
        applicationId 'com.wireguard.android'
        minSdkVersion 21
-        targetSdkVersion 30
+        targetSdkVersion 33
        versionCode wireguardVersionCode
        versionName wireguardVersionName
        buildConfigField 'int', 'MIN_SDK_VERSION', "$minSdkVersion.apiLevel"
@@ -49,16 +52,19 @@ android {
            if (keystorePropertiesFile.exists()) signingConfig signingConfigs.release
            minifyEnabled true
            proguardFiles "proguard-android-optimize.txt", "proguard-rules.pro"
+            packagingOptions {
+                exclude "DebugProbesKt.bin"
+                exclude "kotlin-tooling-metadata.json"
+            }
        }
        debug {
            applicationIdSuffix ".debug"
            versionNameSuffix "-debug"
        }
    }
-    lintOptions {
-        disable('LongLogTag')
-        warning('MissingTranslation')
-        warning('ImpliedQuantity')
+    lint {
+        disable 'LongLogTag'
+        warning 'MissingTranslation', 'ImpliedQuantity'
    }
 }

@@ -82,14 +88,11 @@ dependencies {
    coreLibraryDesugaring "com.android.tools:desugar_jdk_libs:$desugarVersion"
 }

-tasks.withType(JavaCompile) {
+tasks.withType(JavaCompile).configureEach {
    options.compilerArgs << '-Xlint:unchecked'
    options.deprecation = true
 }

-tasks.withType(org.jetbrains.kotlin.gradle.tasks.KotlinCompile).all {
-    kotlinOptions {
-        jvmTarget = JavaVersion.VERSION_1_8
-        useIR = true
-    }
+tasks.withType(KotlinCompile).configureEach {
+    kotlinOptions.jvmTarget = JavaVersion.VERSION_1_8
 }
@@ -1,7 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
-    package="com.wireguard.android"
    android:installLocation="internalOnly">

    <uses-permission android:name="android.permission.CAMERA" />
@@ -21,6 +20,9 @@
    <uses-feature
        android:name="android.hardware.camera.any"
        android:required="false" />
+    <uses-feature
+        android:name="android.hardware.camera"
+        android:required="false" />

    <permission
        android:name="${applicationId}.permission.CONTROL_TUNNELS"
@@ -33,6 +35,7 @@
        android:name=".Application"
        android:allowBackup="false"
        android:banner="@mipmap/banner"
+        android:enableOnBackInvokedCallback="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
@@ -44,7 +47,7 @@
            android:theme="@style/NoBackgroundTheme"
            android:excludeFromRecents="true"/>

-        <activity android:name=".activity.MainActivity">
+        <activity android:name=".activity.MainActivity" android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

@@ -58,7 +61,8 @@

        <activity
            android:name=".activity.TvMainActivity"
-            android:theme="@style/TvTheme">
+            android:theme="@style/TvTheme"
+            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
@@ -82,7 +86,8 @@

        <activity
            android:name=".activity.LogViewerActivity"
-            android:label="@string/log_viewer_title">
+            android:label="@string/log_viewer_title"
+            android:exported="false">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
            </intent-filter>
@@ -94,7 +99,7 @@
            android:exported="false"
            android:grantUriPermissions="true" />

-        <receiver android:name=".BootShutdownReceiver">
+        <receiver android:name=".BootShutdownReceiver" android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
@@ -103,7 +108,8 @@

        <receiver
            android:name=".model.TunnelManager$IntentReceiver"
-            android:permission="${applicationId}.permission.CONTROL_TUNNELS">
+            android:permission="${applicationId}.permission.CONTROL_TUNNELS"
+            android:exported="true">
            <intent-filter>
                <action android:name="com.wireguard.android.action.REFRESH_TUNNEL_STATES" />
                <action android:name="com.wireguard.android.action.SET_TUNNEL_UP" />
@@ -114,7 +120,8 @@
        <service
            android:name=".QuickTileService"
            android:icon="@drawable/ic_tile"
-            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE">
+            android:permission="android.permission.BIND_QUICK_SETTINGS_TILE"
+            android:exported="true">

            <intent-filter>
                <action android:name="android.service.quicksettings.action.QS_TILE" />
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android
@@ -16,6 +16,7 @@ import androidx.datastore.core.DataStore
 import androidx.datastore.preferences.core.PreferenceDataStoreFactory
 import androidx.datastore.preferences.core.Preferences
 import androidx.datastore.preferences.preferencesDataStoreFile
+import com.google.android.material.color.DynamicColors
 import com.wireguard.android.backend.Backend
 import com.wireguard.android.backend.GoBackend
 import com.wireguard.android.backend.WgQuickBackend
@@ -34,6 +35,7 @@ import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.flow.launchIn
 import kotlinx.coroutines.flow.onEach
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
 import java.lang.ref.WeakReference
 import java.util.Locale

@@ -64,11 +66,9 @@ class Application : android.app.Application() {

    private suspend fun determineBackend(): Backend {
        var backend: Backend? = null
-        var didStartRootShell = false
        if (UserKnobs.enableKernelModule.first() && WgQuickBackend.hasKernelSupport()) {
            try {
-                if (!didStartRootShell)
-                    rootShell.start()
+                rootShell.start()
                val wgQuickBackend = WgQuickBackend(applicationContext, rootShell, toolsInstaller)
                wgQuickBackend.setMultipleTunnels(UserKnobs.multipleTunnels.first())
                backend = wgQuickBackend
@@ -88,14 +88,24 @@ class Application : android.app.Application() {
    override fun onCreate() {
        Log.i(TAG, USER_AGENT)
        super.onCreate()
+        DynamicColors.applyToActivitiesIfAvailable(this)
        rootShell = RootShell(applicationContext)
        toolsInstaller = ToolsInstaller(applicationContext, rootShell)
        preferencesDataStore = PreferenceDataStoreFactory.create { applicationContext.preferencesDataStoreFile("settings") }
        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
-            coroutineScope.launch {
-                AppCompatDelegate.setDefaultNightMode(
-                        if (UserKnobs.darkTheme.first()) AppCompatDelegate.MODE_NIGHT_YES else AppCompatDelegate.MODE_NIGHT_NO)
+            runBlocking {
+                AppCompatDelegate.setDefaultNightMode(if (UserKnobs.darkTheme.first()) AppCompatDelegate.MODE_NIGHT_YES else AppCompatDelegate.MODE_NIGHT_NO)
            }
+            UserKnobs.darkTheme.onEach {
+                val newMode = if (it) {
+                    AppCompatDelegate.MODE_NIGHT_YES
+                } else {
+                    AppCompatDelegate.MODE_NIGHT_NO
+                }
+                if (AppCompatDelegate.getDefaultNightMode() != newMode) {
+                    AppCompatDelegate.setDefaultNightMode(newMode)
+                }
+            }.launchIn(coroutineScope)
        } else {
            AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM)
        }
@@ -121,27 +131,20 @@ class Application : android.app.Application() {
        private const val TAG = "WireGuard/Application"
        private lateinit var weakSelf: WeakReference<Application>

-        @JvmStatic
        fun get(): Application {
            return weakSelf.get()!!
        }

-        @JvmStatic
        suspend fun getBackend() = get().futureBackend.await()

-        @JvmStatic
        fun getRootShell() = get().rootShell

-        @JvmStatic
        fun getPreferencesDataStore() = get().preferencesDataStore

-        @JvmStatic
        fun getToolsInstaller() = get().toolsInstaller

-        @JvmStatic
        fun getTunnelManager() = get().tunnelManager

-        @JvmStatic
        fun getCoroutineScope() = get().coroutineScope
    }

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android
@@ -1,28 +1,36 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.activity

 import android.os.Bundle
+import androidx.appcompat.app.AppCompatActivity
 import androidx.databinding.CallbackRegistry
 import androidx.databinding.CallbackRegistry.NotifierCallback
 import androidx.lifecycle.lifecycleScope
 import com.wireguard.android.Application
 import com.wireguard.android.model.ObservableTunnel
+import kotlinx.coroutines.launch

 /**
 * Base class for activities that need to remember the currently-selected tunnel.
 */
-abstract class BaseActivity : ThemeChangeAwareActivity() {
+abstract class BaseActivity : AppCompatActivity() {
    private val selectionChangeRegistry = SelectionChangeRegistry()
+    private var created = false
    var selectedTunnel: ObservableTunnel? = null
        set(value) {
            val oldTunnel = field
            if (oldTunnel == value) return
            field = value
-            onSelectedTunnelChanged(oldTunnel, value)
-            selectionChangeRegistry.notifyCallbacks(oldTunnel, 0, value)
+            if (created) {
+                if (!onSelectedTunnelChanged(oldTunnel, value)) {
+                    field = oldTunnel
+                } else {
+                    selectionChangeRegistry.notifyCallbacks(oldTunnel, 0, value)
+                }
+            }
        }

    fun addOnSelectedTunnelChangedListener(listener: OnSelectedTunnelChangedListener) {
@@ -30,17 +38,25 @@ abstract class BaseActivity : ThemeChangeAwareActivity() {
    }

    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
        // Restore the saved tunnel if there is one; otherwise grab it from the arguments.
        val savedTunnelName = when {
            savedInstanceState != null -> savedInstanceState.getString(KEY_SELECTED_TUNNEL)
            intent != null -> intent.getStringExtra(KEY_SELECTED_TUNNEL)
            else -> null
        }
-        if (savedTunnelName != null)
-            lifecycleScope.launchWhenCreated { selectedTunnel = Application.getTunnelManager().getTunnels()[savedTunnelName] }
-
-        // The selected tunnel must be set before the superclass method recreates fragments.
-        super.onCreate(savedInstanceState)
+        if (savedTunnelName != null) {
+            lifecycleScope.launch {
+                val tunnel = Application.getTunnelManager().getTunnels()[savedTunnelName]
+                if (tunnel == null)
+                    created = true
+                selectedTunnel = tunnel
+                created = true
+            }
+        } else {
+            created = true
+        }
    }

    override fun onSaveInstanceState(outState: Bundle) {
@@ -48,7 +64,7 @@ abstract class BaseActivity : ThemeChangeAwareActivity() {
        super.onSaveInstanceState(outState)
    }

-    protected abstract fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?)
+    protected abstract fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?): Boolean

    fun removeOnSelectedTunnelChangedListener(
            listener: OnSelectedTunnelChangedListener) {
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -27,6 +27,7 @@ import android.view.View
 import android.view.ViewGroup
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
+import androidx.collection.CircularArray
 import androidx.core.app.ShareCompat
 import androidx.core.content.res.ResourcesCompat
 import androidx.lifecycle.lifecycleScope
@@ -40,6 +41,7 @@ import com.wireguard.android.R
 import com.wireguard.android.databinding.LogViewerActivityBinding
 import com.wireguard.android.util.DownloadsFileSaver
 import com.wireguard.android.util.ErrorMessages
+import com.wireguard.android.util.resolveAttribute
 import com.wireguard.crypto.KeyPair
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -61,8 +63,8 @@ import java.util.regex.Pattern
 class LogViewerActivity : AppCompatActivity() {
    private lateinit var binding: LogViewerActivityBinding
    private lateinit var logAdapter: LogEntryAdapter
-    private var logLines = arrayListOf<LogLine>()
-    private var rawLogLines = StringBuffer()
+    private var logLines = CircularArray<LogLine>()
+    private var rawLogLines = CircularArray<String>()
    private var recyclerView: RecyclerView? = null
    private var saveButton: MenuItem? = null
    private val year by lazy {
@@ -70,7 +72,7 @@ class LogViewerActivity : AppCompatActivity() {
        yearFormatter.format(Date())
    }

-    private val defaultColor by lazy { ResourcesCompat.getColor(resources, R.color.primary_text_color, theme) }
+    private val defaultColor by lazy { resolveAttribute(com.google.android.material.R.attr.colorOnSurface) }

    private val debugColor by lazy { ResourcesCompat.getColor(resources, R.color.debug_tag_color, theme) }

@@ -112,7 +114,7 @@ class LogViewerActivity : AppCompatActivity() {
        binding.shareFab.setOnClickListener {
            revokeLastUri()
            val key = KeyPair().privateKey.toHex()
-            LOGS[key] = rawLogLines.toString().toByteArray(Charsets.UTF_8)
+            LOGS[key] = rawLogBytes()
            lastUri = Uri.parse("content://${BuildConfig.APPLICATION_ID}.exported-log/$key")
            val shareIntent = ShareCompat.IntentBuilder(this)
                    .setType("text/plain")
@@ -149,13 +151,24 @@ class LogViewerActivity : AppCompatActivity() {

    private val downloadsFileSaver = DownloadsFileSaver(this)

+    private fun rawLogBytes() : ByteArray {
+        val builder = StringBuilder()
+        for (i in 0 until rawLogLines.size()) {
+            builder.append(rawLogLines[i])
+            builder.append('\n')
+        }
+        val ret = builder.toString().toByteArray(Charsets.UTF_8)
+        builder.clear()
+        return ret
+    }
+
    private suspend fun saveLog() {
        var exception: Throwable? = null
        var outputFile: DownloadsFileSaver.DownloadsFile? = null
        withContext(Dispatchers.IO) {
            try {
                outputFile = downloadsFileSaver.save("wireguard-log.txt", "text/plain", true)
-                outputFile?.outputStream?.write(rawLogLines.toString().toByteArray(Charsets.UTF_8))
+                outputFile?.outputStream?.write(rawLogBytes())
            } catch (e: Throwable) {
                outputFile?.delete()
                exception = e
@@ -184,36 +197,60 @@ class LogViewerActivity : AppCompatActivity() {
                return@withContext
            }
            val stdout = BufferedReader(InputStreamReader(process!!.inputStream, StandardCharsets.UTF_8))
-            var haveScrolled = false
-            val start = System.nanoTime()
-            var startPeriod = start
+
+            var posStart = 0
+            var timeLastNotify = System.nanoTime()
+            var priorModified = false
+            val bufferedLogLines = arrayListOf<LogLine>()
+            var timeout = 1000000000L / 2 // The timeout is initially small so that the view gets populated immediately.
+            val MAX_LINES = (1 shl 17) - 1
+            val MAX_BUFFERED_LINES = (1 shl 14) - 1
+
            while (true) {
                val line = stdout.readLine() ?: break
-                rawLogLines.append(line)
-                rawLogLines.append('\n')
+                if (rawLogLines.size() >= MAX_LINES)
+                    rawLogLines.popFirst()
+                rawLogLines.addLast(line)
                val logLine = parseLine(line)
-                withContext(Dispatchers.Main.immediate) {
-                    if (logLine != null) {
-                        recyclerView?.let {
-                            val shouldScroll = haveScrolled && !it.canScrollVertically(1)
-                            logLines.add(logLine)
-                            if (haveScrolled) logAdapter.notifyDataSetChanged()
-                            if (shouldScroll)
-                                it.scrollToPosition(logLines.size - 1)
-                        }
-                    } else {
-                        logLines.lastOrNull()?.msg += "\n$line"
-                        if (haveScrolled) logAdapter.notifyDataSetChanged()
+                if (logLine != null) {
+                    bufferedLogLines.add(logLine)
+                } else {
+                    if (bufferedLogLines.isNotEmpty()) {
+                        bufferedLogLines.last().msg += "\n$line"
+                    } else if (!logLines.isEmpty) {
+                        logLines[logLines.size() - 1].msg += "\n$line"
+                        priorModified = true
                    }
-                    if (!haveScrolled) {
-                        val end = System.nanoTime()
-                        val scroll = (end - start) > 1000000000L * 2.5 || !stdout.ready()
-                        if (logLines.isNotEmpty() && (scroll || (end - startPeriod) > 1000000000L / 4)) {
-                            logAdapter.notifyDataSetChanged()
-                            recyclerView?.scrollToPosition(logLines.size - 1)
-                            startPeriod = end
-                        }
-                        if (scroll) haveScrolled = true
+                }
+                val timeNow = System.nanoTime()
+                if (bufferedLogLines.size < MAX_BUFFERED_LINES && (timeNow - timeLastNotify) < timeout && stdout.ready())
+                    continue
+                timeout = 1000000000L * 5 / 2 // Increase the timeout after the initial view has something in it.
+                timeLastNotify = timeNow
+
+                withContext(Dispatchers.Main.immediate) {
+                    val isScrolledToBottomAlready = recyclerView?.canScrollVertically(1) == false
+                    if (priorModified) {
+                        logAdapter.notifyItemChanged(posStart - 1)
+                        priorModified = false
+                    }
+                    val fullLen = logLines.size() + bufferedLogLines.size
+                    if (fullLen >= MAX_LINES) {
+                        val numToRemove = fullLen - MAX_LINES + 1
+                        logLines.removeFromStart(numToRemove)
+                        logAdapter.notifyItemRangeRemoved(0, numToRemove)
+                        posStart -= numToRemove
+
+                    }
+                    for (bufferedLine in bufferedLogLines) {
+                        logLines.addLast(bufferedLine)
+                    }
+                    bufferedLogLines.clear()
+                    logAdapter.notifyItemRangeInserted(posStart, logLines.size() - posStart)
+                    posStart = logLines.size()
+
+                    if (isScrolledToBottomAlready) {
+                        recyclerView?.scrollToPosition(logLines.size() - 1)
                    }
                }
            }
@@ -259,7 +296,7 @@ class LogViewerActivity : AppCompatActivity() {

        private fun levelToColor(level: String): Int {
            return when (level) {
-                "D" -> debugColor
+                "V", "D" -> debugColor
                "E" -> errorColor
                "I" -> infoColor
                "W" -> warningColor
@@ -267,7 +304,7 @@ class LogViewerActivity : AppCompatActivity() {
            }
        }

-        override fun getItemCount() = logLines.size
+        override fun getItemCount() = logLines.size()

        override fun onCreateViewHolder(parent: ViewGroup, viewType: Int): ViewHolder {
            val view = LayoutInflater.from(parent.context)
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.activity
@@ -9,6 +9,8 @@ import android.os.Bundle
 import android.view.Menu
 import android.view.MenuItem
 import android.view.View
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.addCallback
 import androidx.appcompat.app.ActionBar
 import androidx.fragment.app.FragmentManager
 import androidx.fragment.app.FragmentTransaction
@@ -26,27 +28,29 @@ import com.wireguard.android.model.ObservableTunnel
 class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener {
    private var actionBar: ActionBar? = null
    private var isTwoPaneLayout = false
+    private var backPressedCallback: OnBackPressedCallback? = null

-    override fun onBackPressed() {
+    private fun handleBackPressed() {
        val backStackEntries = supportFragmentManager.backStackEntryCount
        // If the two-pane layout does not have an editor open, going back should exit the app.
        if (isTwoPaneLayout && backStackEntries <= 1) {
            finish()
            return
        }
-        // Deselect the current tunnel on navigating back from the detail pane to the one-pane list.
-        if (!isTwoPaneLayout && backStackEntries == 1) {
+
+        if (backStackEntries >= 1)
            supportFragmentManager.popBackStack()
+
+        // Deselect the current tunnel on navigating back from the detail pane to the one-pane list.
+        if (backStackEntries == 1)
            selectedTunnel = null
-            return
-        }
-        super.onBackPressed()
    }

    override fun onBackStackChanged() {
+        val backStackEntries = supportFragmentManager.backStackEntryCount
+        backPressedCallback?.isEnabled = backStackEntries >= 1
        if (actionBar == null) return
        // Do not show the home menu when the two-pane layout is at the detail view (see above).
-        val backStackEntries = supportFragmentManager.backStackEntryCount
        val minBackStackEntries = if (isTwoPaneLayout) 2 else 1
        actionBar!!.setDisplayHomeAsUpEnabled(backStackEntries >= minBackStackEntries)
    }
@@ -57,6 +61,7 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
        actionBar = supportActionBar
        isTwoPaneLayout = findViewById<View?>(R.id.master_detail_wrapper) != null
        supportFragmentManager.addOnBackStackChangedListener(this)
+        backPressedCallback = onBackPressedDispatcher.addCallback(this) { handleBackPressed() }
        onBackStackChanged()
    }

@@ -69,7 +74,7 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
        return when (item.itemId) {
            android.R.id.home -> {
                // The back arrow in the action bar should act the same as the back button.
-                onBackPressed()
+                onBackPressedDispatcher.onBackPressed()
                true
            }
            R.id.menu_action_edit -> {
@@ -91,13 +96,17 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
    }

    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?,
-                                         newTunnel: ObservableTunnel?) {
+                                         newTunnel: ObservableTunnel?): Boolean {
        val fragmentManager = supportFragmentManager
+        if (fragmentManager.isStateSaved) {
+            return false
+        }
+
        val backStackEntries = fragmentManager.backStackEntryCount
        if (newTunnel == null) {
            // Clear everything off the back stack (all editors and detail fragments).
            fragmentManager.popBackStackImmediate(0, FragmentManager.POP_BACK_STACK_INCLUSIVE)
-            return
+            return true
        }
        if (backStackEntries == 2) {
            // Pop the editor off the back stack to reveal the detail fragment. Use the immediate
@@ -111,5 +120,6 @@ class MainActivity : BaseActivity(), FragmentManager.OnBackStackChangedListener
                addToBackStack(null)
            }
        }
+        return true
    }
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.activity
@@ -8,6 +8,7 @@ import android.content.Intent
 import android.os.Build
 import android.os.Bundle
 import android.view.MenuItem
+import androidx.appcompat.app.AppCompatActivity
 import androidx.fragment.app.commit
 import androidx.lifecycle.lifecycleScope
 import androidx.preference.Preference
@@ -24,7 +25,7 @@ import kotlinx.coroutines.withContext
 /**
 * Interface for changing application-global persistent settings.
 */
-class SettingsActivity : ThemeChangeAwareActivity() {
+class SettingsActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        if (supportFragmentManager.findFragmentById(android.R.id.content) == null) {
@@ -1,33 +0,0 @@
-/*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
- * SPDX-License-Identifier: Apache-2.0
- */
-package com.wireguard.android.activity
-
-import android.os.Build
-import android.os.Bundle
-import androidx.appcompat.app.AppCompatActivity
-import androidx.appcompat.app.AppCompatDelegate
-import androidx.lifecycle.lifecycleScope
-import com.wireguard.android.util.UserKnobs
-import kotlinx.coroutines.flow.launchIn
-import kotlinx.coroutines.flow.onEach
-
-abstract class ThemeChangeAwareActivity : AppCompatActivity() {
-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
-            UserKnobs.darkTheme.onEach {
-                val newMode = if (it) {
-                    AppCompatDelegate.MODE_NIGHT_YES
-                } else {
-                    AppCompatDelegate.MODE_NIGHT_NO
-                }
-                if (AppCompatDelegate.getDefaultNightMode() != newMode) {
-                    AppCompatDelegate.setDefaultNightMode(newMode)
-                    recreate()
-                }
-            }.launchIn(lifecycleScope)
-        }
-    }
-}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.activity
@@ -22,7 +22,8 @@ class TunnelCreatorActivity : BaseActivity() {
        }
    }

-    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?) {
+    override fun onSelectedTunnelChanged(oldTunnel: ObservableTunnel?, newTunnel: ObservableTunnel?): Boolean {
        finish()
+        return true
    }
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.activity
@@ -1,11 +1,14 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.activity

 import android.Manifest
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.content.Intent
 import android.content.pm.PackageManager
 import android.net.Uri
 import android.os.Build
@@ -16,17 +19,21 @@ import android.os.storage.StorageVolume
 import android.util.Log
 import android.view.View
 import android.widget.Toast
+import androidx.activity.addCallback
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
+import androidx.appcompat.app.AppCompatDelegate
 import androidx.core.content.ContextCompat
 import androidx.core.content.getSystemService
 import androidx.core.view.forEach
 import androidx.databinding.DataBindingUtil
+import androidx.databinding.Observable
 import androidx.databinding.ObservableBoolean
 import androidx.databinding.ObservableField
 import androidx.lifecycle.lifecycleScope
 import androidx.recyclerview.widget.GridLayoutManager
 import androidx.recyclerview.widget.GridLayoutManager.SpanSizeLookup
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.wireguard.android.Application
 import com.wireguard.android.R
 import com.wireguard.android.backend.GoBackend
@@ -41,6 +48,8 @@ import com.wireguard.android.model.ObservableTunnel
 import com.wireguard.android.util.ErrorMessages
 import com.wireguard.android.util.QuantityFormatter
 import com.wireguard.android.util.TunnelImporter
+import com.wireguard.android.util.UserKnobs
+import com.wireguard.android.util.applicationScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
@@ -48,7 +57,27 @@ import kotlinx.coroutines.withContext
 import java.io.File

 class TvMainActivity : AppCompatActivity() {
-    private val tunnelFileImportResultLauncher = registerForActivityResult(ActivityResultContracts.GetContent()) { data ->
+    private val tunnelFileImportResultLauncher = registerForActivityResult(object : ActivityResultContracts.GetContent() {
+        override fun createIntent(context: Context, input: String): Intent {
+            val intent = super.createIntent(context, input)
+
+            /* AndroidTV now comes with stubs that do nothing but display a Toast less helpful than
+             * what we can do, so detect this and throw an exception that we can catch later. */
+            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
+            } else {
+                @Suppress("DEPRECATION")
+                context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
+            }
+            if (activitiesToResolveIntent.all {
+                    val name = it.activityInfo.packageName
+                    name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
+                }) {
+                throw ActivityNotFoundException()
+            }
+            return intent
+        }
+    }) { data ->
        if (data == null) return@registerForActivityResult
        lifecycleScope.launch {
            TunnelImporter.importTunnel(contentResolver, data) {
@@ -84,6 +113,14 @@ class TvMainActivity : AppCompatActivity() {
    private val filesRoot = ObservableField("")

    override fun onCreate(savedInstanceState: Bundle?) {
+        if (AppCompatDelegate.getDefaultNightMode() != AppCompatDelegate.MODE_NIGHT_YES) {
+            AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_YES)
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+                applicationScope.launch {
+                    UserKnobs.setDarkTheme(true)
+                }
+            }
+        }
        super.onCreate(savedInstanceState)
        binding = TvActivityBinding.inflate(layoutInflater)
        lifecycleScope.launch {
@@ -174,7 +211,12 @@ class TvMainActivity : AppCompatActivity() {
                try {
                    tunnelFileImportResultLauncher.launch("*/*")
                } catch (_: Throwable) {
-                    Toast.makeText(this@TvMainActivity, getString(R.string.tv_no_file_picker), Toast.LENGTH_LONG).show()
+                    MaterialAlertDialogBuilder(binding.root.context).setMessage(R.string.tv_no_file_picker).setCancelable(false).setPositiveButton(android.R.string.ok) { _, _ ->
+                        try {
+                            startActivity(Intent(Intent.ACTION_VIEW, Uri.parse("market://webstoreredirect")))
+                        } catch (_: Throwable) {
+                        }
+                    }.show()
                }
            }
        }
@@ -185,6 +227,17 @@ class TvMainActivity : AppCompatActivity() {
                binding.tunnelList.requestFocus()
            }
        }
+
+        val backPressedCallback = onBackPressedDispatcher.addCallback(this) { handleBackPressed() }
+        val updateBackPressedCallback = object : Observable.OnPropertyChangedCallback() {
+            override fun onPropertyChanged(sender: Observable?, propertyId: Int) {
+                backPressedCallback.isEnabled = isDeleting.get() || filesRoot.get()?.isNotEmpty() == true
+            }
+        }
+        isDeleting.addOnPropertyChangedCallback(updateBackPressedCallback)
+        filesRoot.addOnPropertyChangedCallback(updateBackPressedCallback)
+        backPressedCallback.isEnabled = false
+
        binding.executePendingBindings()
        setContentView(binding.root)

@@ -298,7 +351,7 @@ class TvMainActivity : AppCompatActivity() {
        }
    }

-    override fun onBackPressed() {
+    private fun handleBackPressed() {
        when {
            isDeleting.get() -> {
                isDeleting.set(false)
@@ -313,7 +366,6 @@ class TvMainActivity : AppCompatActivity() {
                    binding.tunnelList.requestFocus()
                }
            }
-            else -> super.onBackPressed()
        }
    }

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.configStore
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.configStore
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.databinding
@@ -23,6 +23,7 @@ import com.wireguard.android.R
 import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler
 import com.wireguard.android.widget.ToggleSwitch
 import com.wireguard.android.widget.ToggleSwitch.OnBeforeCheckedChangeListener
+import com.wireguard.android.widget.TvCardView
 import com.wireguard.config.Attribute
 import com.wireguard.config.InetNetwork
 import java.net.InetAddress
@@ -168,4 +169,16 @@ object BindingAdapters {
            0
        }
    }
+
+    @JvmStatic
+    @BindingAdapter("isUp")
+    fun setIsUp(card: TvCardView, up: Boolean) {
+        card.isUp = up
+    }
+
+    @JvmStatic
+    @BindingAdapter("isDeleting")
+    fun setIsDeleting(card: TvCardView, deleting: Boolean) {
+        card.isDeleting = deleting
+    }
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.databinding
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.databinding
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.databinding
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.databinding
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.databinding
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.fragment
@@ -34,10 +34,6 @@ class AddTunnelsSheet : BottomSheetDialogFragment() {
        }
    }

-    override fun getTheme(): Int {
-        return R.style.BottomSheetDialogTheme
-    }
-
    override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle?): View? {
        if (savedInstanceState != null) dismiss()
        val view = inflater.inflate(R.layout.add_tunnels_bottom_sheet, container, false)
@@ -76,7 +72,7 @@ class AddTunnelsSheet : BottomSheetDialogFragment() {
            }
        })
        val gradientDrawable = GradientDrawable().apply {
-            setColor(requireContext().resolveAttribute(R.attr.colorBackground))
+            setColor(requireContext().resolveAttribute(com.google.android.material.R.attr.colorSurface))
        }
        view.background = gradientDrawable
    }
@@ -1,11 +1,15 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.fragment

 import android.Manifest
 import android.app.Dialog
+import android.content.pm.PackageInfo
+import android.content.pm.PackageManager
+import android.content.pm.PackageManager.PackageInfoFlags
+import android.os.Build
 import android.os.Bundle
 import android.widget.Button
 import android.widget.Toast
@@ -15,6 +19,7 @@ import androidx.databinding.Observable
 import androidx.fragment.app.DialogFragment
 import androidx.fragment.app.setFragmentResult
 import androidx.lifecycle.lifecycleScope
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.google.android.material.tabs.TabLayout
 import com.wireguard.android.BR
 import com.wireguard.android.R
@@ -40,7 +45,7 @@ class AppListDialogFragment : DialogFragment() {
            try {
                val applicationData: MutableList<ApplicationData> = ArrayList()
                withContext(Dispatchers.IO) {
-                    val packageInfos = pm.getPackagesHoldingPermissions(arrayOf(Manifest.permission.INTERNET), 0)
+                    val packageInfos = getPackagesHoldingPermissions(pm, arrayOf(Manifest.permission.INTERNET))
                    packageInfos.forEach {
                        val packageName = it.packageName
                        val appInfo = it.applicationInfo
@@ -59,6 +64,7 @@ class AppListDialogFragment : DialogFragment() {
                    appData.clear()
                    appData.addAll(applicationData)
                }
+                setButtonText()
            } catch (e: Throwable) {
                withContext(Dispatchers.Main.immediate) {
                    val error = ErrorMessages[e]
@@ -76,6 +82,15 @@ class AppListDialogFragment : DialogFragment() {
        initiallyExcluded = arguments?.getBoolean(KEY_IS_EXCLUDED) ?: true
    }

+    private fun getPackagesHoldingPermissions(pm: PackageManager, permissions: Array<String>): List<PackageInfo> {
+        return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            pm.getPackagesHoldingPermissions(permissions, PackageInfoFlags.of(0L))
+        } else {
+            @Suppress("DEPRECATION")
+            pm.getPackagesHoldingPermissions(permissions, 0)
+        }
+    }
+
    private fun setButtonText() {
        val numSelected = appData.count { it.isSelected }
        button?.text = if (numSelected == 0)
@@ -88,7 +103,7 @@ class AppListDialogFragment : DialogFragment() {
    }

    override fun onCreateDialog(savedInstanceState: Bundle?): Dialog {
-        val alertDialogBuilder = AlertDialog.Builder(requireActivity())
+        val alertDialogBuilder = MaterialAlertDialogBuilder(requireActivity())
        val binding = AppListDialogFragmentBinding.inflate(requireActivity().layoutInflater, null, false)
        binding.executePendingBindings()
        alertDialogBuilder.setView(binding.root)
@@ -139,6 +154,7 @@ class AppListDialogFragment : DialogFragment() {
        const val KEY_SELECTED_APPS = "selected_apps"
        const val KEY_IS_EXCLUDED = "is_excluded"
        const val REQUEST_SELECTION = "request_selection"
+
        fun newInstance(selectedApps: ArrayList<String?>?, isExcluded: Boolean): AppListDialogFragment {
            val extras = Bundle()
            extras.putStringArrayList(KEY_SELECTED_APPS, selectedApps)
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.fragment
@@ -67,12 +67,20 @@ abstract class BaseFragment : Fragment(), OnSelectedTunnelChangedListener {
        val activity = activity ?: return
        activity.lifecycleScope.launch {
            if (Application.getBackend() is GoBackend) {
-                val intent = GoBackend.VpnService.prepare(activity)
-                if (intent != null) {
-                    pendingTunnel = tunnel
-                    pendingTunnelUp = checked
-                    permissionActivityResultLauncher.launch(intent)
-                    return@launch
+                try {
+                    val intent = GoBackend.VpnService.prepare(activity)
+                    if (intent != null) {
+                        pendingTunnel = tunnel
+                        pendingTunnelUp = checked
+                        permissionActivityResultLauncher.launch(intent)
+                        return@launch
+                    }
+                } catch (e: Throwable) {
+                    val message = activity.getString(R.string.error_prepare, ErrorMessages[e])
+                    Snackbar.make(view, message, Snackbar.LENGTH_LONG)
+                        .setAnchorView(view.findViewById(R.id.create_fab))
+                        .show()
+                    Log.e(TAG, message, e)
                }
            }
            setTunnelStateWithPermissionsResult(tunnel, checked)
@@ -1,18 +1,15 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.fragment

 import android.app.Dialog
-import android.content.DialogInterface
 import android.os.Bundle
-import android.view.inputmethod.InputMethodManager
-import androidx.appcompat.app.AlertDialog
-import androidx.core.content.getSystemService
+import android.view.WindowManager
 import androidx.fragment.app.DialogFragment
 import androidx.lifecycle.lifecycleScope
-import com.google.android.material.textfield.TextInputEditText
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.wireguard.android.Application
 import com.wireguard.android.R
 import com.wireguard.android.databinding.ConfigNamingDialogFragmentBinding
@@ -26,7 +23,6 @@ import java.nio.charset.StandardCharsets
 class ConfigNamingDialogFragment : DialogFragment() {
    private var binding: ConfigNamingDialogFragmentBinding? = null
    private var config: Config? = null
-    private var imm: InputMethodManager? = null

    private fun createTunnelAndDismiss() {
        val binding = binding ?: return
@@ -41,12 +37,6 @@ class ConfigNamingDialogFragment : DialogFragment() {
            }
        }
    }
-
-    override fun dismiss() {
-        setKeyboardVisible(false)
-        super.dismiss()
-    }
-
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        val configText = requireArguments().getString(KEY_CONFIG_TEXT)
@@ -63,51 +53,23 @@ class ConfigNamingDialogFragment : DialogFragment() {

    override fun onCreateDialog(savedInstanceState: Bundle?): Dialog {
        val activity = requireActivity()
-        imm = activity.getSystemService()
-        val alertDialogBuilder = AlertDialog.Builder(activity)
+        val alertDialogBuilder = MaterialAlertDialogBuilder(activity)
        alertDialogBuilder.setTitle(R.string.import_from_qr_code)
        binding = ConfigNamingDialogFragmentBinding.inflate(activity.layoutInflater, null, false)
        binding?.apply {
            executePendingBindings()
            alertDialogBuilder.setView(root)
        }
-        alertDialogBuilder.setPositiveButton(R.string.create_tunnel, null)
+        alertDialogBuilder.setPositiveButton(R.string.create_tunnel) { _, _ -> createTunnelAndDismiss() }
        alertDialogBuilder.setNegativeButton(R.string.cancel) { _, _ -> dismiss() }
-        return alertDialogBuilder.create().apply {
-            setOnShowListener {
-                findViewById<TextInputEditText>(R.id.tunnel_name_text)?.apply {
-                    setOnFocusChangeListener { v, _ ->
-                        v.post {
-                            imm?.showSoftInput(v, InputMethodManager.SHOW_IMPLICIT)
-                        }
-                    }
-                    requestFocus()
-                }
-            }
-        }
-    }
-
-    override fun onResume() {
-        super.onResume()
-        val dialog = dialog as AlertDialog?
-        if (dialog != null) {
-            dialog.getButton(DialogInterface.BUTTON_POSITIVE).setOnClickListener { createTunnelAndDismiss() }
-            setKeyboardVisible(true)
-        }
-    }
-
-    private fun setKeyboardVisible(visible: Boolean) {
-        if (visible) {
-            imm!!.toggleSoftInput(InputMethodManager.SHOW_FORCED, 0)
-        } else if (binding != null) {
-            imm!!.hideSoftInputFromWindow(binding!!.tunnelNameText.windowToken, 0)
-        }
+        val dialog = alertDialogBuilder.create()
+        dialog.window?.setSoftInputMode(WindowManager.LayoutParams.SOFT_INPUT_STATE_ALWAYS_VISIBLE)
+        return dialog
    }

    companion object {
        private const val KEY_CONFIG_TEXT = "config_text"

-        @JvmStatic
        fun newInstance(configText: String?): ConfigNamingDialogFragment {
            val extras = Bundle()
            extras.putString(KEY_CONFIG_TEXT, configText)
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.fragment
@@ -8,9 +8,12 @@ import android.os.Bundle
 import android.view.LayoutInflater
 import android.view.Menu
 import android.view.MenuInflater
+import android.view.MenuItem
 import android.view.View
 import android.view.ViewGroup
+import androidx.core.view.MenuProvider
 import androidx.databinding.DataBindingUtil
+import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.lifecycleScope
 import com.wireguard.android.R
 import com.wireguard.android.backend.Tunnel
@@ -24,18 +27,17 @@ import kotlinx.coroutines.launch
 /**
 * Fragment that shows details about a specific tunnel.
 */
-class TunnelDetailFragment : BaseFragment() {
+class TunnelDetailFragment : BaseFragment(), MenuProvider {
    private var binding: TunnelDetailFragmentBinding? = null
    private var lastState = Tunnel.State.TOGGLE
    private var timerActive = true

-    override fun onCreate(savedInstanceState: Bundle?) {
-        super.onCreate(savedInstanceState)
-        setHasOptionsMenu(true)
+    override fun onMenuItemSelected(menuItem: MenuItem): Boolean {
+        return false
    }

-    override fun onCreateOptionsMenu(menu: Menu, inflater: MenuInflater) {
-        inflater.inflate(R.menu.tunnel_detail, menu)
+    override fun onCreateMenu(menu: Menu, menuInflater: MenuInflater) {
+        menuInflater.inflate(R.menu.tunnel_detail, menu)
    }

    override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?,
@@ -46,6 +48,11 @@ class TunnelDetailFragment : BaseFragment() {
        return binding?.root
    }

+    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
+        super.onViewCreated(view, savedInstanceState)
+        requireActivity().addMenuProvider(this, viewLifecycleOwner, Lifecycle.State.RESUMED)
+    }
+
    override fun onDestroyView() {
        binding = null
        super.onDestroyView()
@@ -1,10 +1,11 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.fragment

 import android.content.Context
+import android.os.Build
 import android.os.Bundle
 import android.text.InputType
 import android.util.Log
@@ -18,6 +19,9 @@ import android.view.WindowManager
 import android.view.inputmethod.InputMethodManager
 import android.widget.EditText
 import android.widget.Toast
+import androidx.core.os.BundleCompat
+import androidx.core.view.MenuProvider
+import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.lifecycleScope
 import com.google.android.material.snackbar.Snackbar
 import com.wireguard.android.Application
@@ -35,7 +39,7 @@ import kotlinx.coroutines.launch
 /**
 * Fragment for editing a WireGuard configuration.
 */
-class TunnelEditorFragment : BaseFragment() {
+class TunnelEditorFragment : BaseFragment(), MenuProvider {
    private var haveShownKeys = false
    private var binding: TunnelEditorFragmentBinding? = null
    private var tunnel: ObservableTunnel? = null
@@ -65,11 +69,10 @@ class TunnelEditorFragment : BaseFragment() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
-        setHasOptionsMenu(true)
    }

-    override fun onCreateOptionsMenu(menu: Menu, inflater: MenuInflater) {
-        inflater.inflate(R.menu.config_editor, menu)
+    override fun onCreateMenu(menu: Menu, menuInflater: MenuInflater) {
+        menuInflater.inflate(R.menu.config_editor, menu)
    }

    override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?,
@@ -83,6 +86,11 @@ class TunnelEditorFragment : BaseFragment() {
        return binding?.root
    }

+    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
+        super.onViewCreated(view, savedInstanceState)
+        requireActivity().addMenuProvider(this, viewLifecycleOwner, Lifecycle.State.RESUMED)
+    }
+
    override fun onDestroyView() {
        activity?.window?.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
        binding = null
@@ -105,8 +113,8 @@ class TunnelEditorFragment : BaseFragment() {
            selectedTunnel = tunnel
    }

-    override fun onOptionsItemSelected(item: MenuItem): Boolean {
-        if (item.itemId == R.id.menu_action_save) {
+    override fun onMenuItemSelected(menuItem: MenuItem): Boolean {
+        if (menuItem.itemId == R.id.menu_action_save) {
            binding ?: return false
            val newConfig = try {
                binding!!.config!!.resolve()
@@ -152,7 +160,7 @@ class TunnelEditorFragment : BaseFragment() {
            }
            return true
        }
-        return super.onOptionsItemSelected(item)
+        return false
    }

    @Suppress("UNUSED_PARAMETER")
@@ -265,7 +273,7 @@ class TunnelEditorFragment : BaseFragment() {
            onSelectedTunnelChanged(null, selectedTunnel)
        } else {
            tunnel = selectedTunnel
-            val config: ConfigProxy = savedInstanceState.getParcelable(KEY_LOCAL_CONFIG)!!
+            val config = BundleCompat.getParcelable(savedInstanceState, KEY_LOCAL_CONFIG, ConfigProxy::class.java)!!
            val originalName = savedInstanceState.getString(KEY_ORIGINAL_NAME)
            if (tunnel != null && tunnel!!.name != originalName) onSelectedTunnelChanged(null, tunnel) else binding!!.config = config
        }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.fragment
@@ -16,6 +16,8 @@ import android.view.ViewGroup
 import android.view.animation.Animation
 import android.view.animation.AnimationUtils
 import android.widget.Toast
+import androidx.activity.OnBackPressedCallback
+import androidx.activity.addCallback
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
 import androidx.appcompat.view.ActionMode
@@ -39,8 +41,6 @@ import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.async
 import kotlinx.coroutines.awaitAll
 import kotlinx.coroutines.launch
-import java.util.ArrayList
-import java.util.HashSet

 /**
 * Fragment containing a list of known WireGuard tunnels. It allows creating and deleting tunnels.
@@ -48,6 +48,7 @@ import java.util.HashSet
 class TunnelListFragment : BaseFragment() {
    private val actionModeListener = ActionModeListener()
    private var actionMode: ActionMode? = null
+    private var backPressedCallback: OnBackPressedCallback? = null
    private var binding: TunnelListFragmentBinding? = null
    private val tunnelFileImportResultLauncher = registerForActivityResult(ActivityResultContracts.GetContent()) { data ->
        if (data == null) return@registerForActivityResult
@@ -61,7 +62,7 @@ class TunnelListFragment : BaseFragment() {
                    TunnelImporter.importTunnel(parentFragmentManager, result.text) { showSnackbar(it) }
                } catch (e: Exception) {
                    val error = ErrorMessages[e]
-                    val message = requireContext().getString(R.string.import_error, error)
+                    val message = Application.get().resources.getString(R.string.import_error, error)
                    Log.e(TAG, message, e)
                    showSnackbar(message)
                }
@@ -96,6 +97,8 @@ class TunnelListFragment : BaseFragment() {
        val bottomSheet = AddTunnelsSheet()
        binding?.apply {
            createFab.setOnClickListener {
+                if (childFragmentManager.findFragmentByTag("BOTTOM_SHEET") != null)
+                    return@setOnClickListener
                childFragmentManager.setFragmentResultListener(AddTunnelsSheet.REQUEST_KEY_NEW_TUNNEL, viewLifecycleOwner) { _, bundle ->
                    when (bundle.getString(AddTunnelsSheet.REQUEST_METHOD)) {
                        AddTunnelsSheet.REQUEST_CREATE -> {
@@ -112,10 +115,13 @@ class TunnelListFragment : BaseFragment() {
                        }
                    }
                }
-                bottomSheet.show(childFragmentManager, "BOTTOM_SHEET")
+                bottomSheet.showNow(childFragmentManager, "BOTTOM_SHEET")
            }
            executePendingBindings()
        }
+        backPressedCallback = requireActivity().onBackPressedDispatcher.addCallback(this) { actionMode?.finish() }
+        backPressedCallback?.isEnabled = false
+
        return binding?.root
    }

@@ -240,6 +246,7 @@ class TunnelListFragment : BaseFragment() {

        override fun onCreateActionMode(mode: ActionMode, menu: Menu): Boolean {
            actionMode = mode
+            backPressedCallback?.isEnabled = true
            if (activity != null) {
                resources = activity!!.resources
            }
@@ -251,6 +258,7 @@ class TunnelListFragment : BaseFragment() {

        override fun onDestroyActionMode(mode: ActionMode) {
            actionMode = null
+            backPressedCallback?.isEnabled = false
            resources = null
            animateFab(binding?.createFab, true)
            checkedItems.clear()
@@ -270,7 +278,7 @@ class TunnelListFragment : BaseFragment() {
            }
            val adapter = if (binding == null) null else binding!!.tunnelList.adapter
            if (actionMode == null && !checkedItems.isEmpty() && activity != null) {
-                (activity as AppCompatActivity?)!!.startSupportActionMode(this)
+                (activity as AppCompatActivity).startSupportActionMode(this)
            } else if (actionMode != null && checkedItems.isEmpty()) {
                actionMode!!.finish()
            }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.model
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.model
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.model
@@ -0,0 +1,55 @@
+/*
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.preference
+
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import android.os.Build
+import android.util.AttributeSet
+import android.widget.Toast
+import androidx.preference.Preference
+import com.google.android.material.dialog.MaterialAlertDialogBuilder
+import com.wireguard.android.R
+import com.wireguard.android.util.ErrorMessages
+
+class DonatePreference(context: Context, attrs: AttributeSet?) : Preference(context, attrs) {
+    override fun getSummary() = context.getString(R.string.donate_summary)
+
+    override fun getTitle() = context.getString(R.string.donate_title)
+
+    override fun onClick() {
+        val installer = try {
+            val packageName = context.packageName
+            val pm = context.packageManager
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                pm.getInstallSourceInfo(packageName).installingPackageName ?: ""
+            } else {
+                @Suppress("DEPRECATION")
+                pm.getInstallerPackageName(packageName) ?: ""
+            }
+        } catch (_: Throwable) {
+            ""
+        }
+
+        /* Google Play Store forbids links to our donation page. */
+        if (installer == "com.android.vending") {
+            MaterialAlertDialogBuilder(context)
+                .setTitle(R.string.donate_title)
+                .setMessage(R.string.donate_google_play_disappointment)
+                .show()
+            return
+        }
+
+        val intent = Intent(Intent.ACTION_VIEW)
+        intent.data = Uri.parse("https://www.wireguard.com/donations/")
+        try {
+            context.startActivity(intent)
+        } catch (e: Throwable) {
+            Toast.makeText(context, ErrorMessages[e], Toast.LENGTH_SHORT).show()
+        }
+    }
+}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.preference
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.preference
@@ -1,14 +1,14 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.preference

-import android.content.ActivityNotFoundException
 import android.content.Context
 import android.content.Intent
 import android.net.Uri
 import android.util.AttributeSet
+import android.widget.Toast
 import androidx.preference.Preference
 import com.wireguard.android.Application
 import com.wireguard.android.BuildConfig
@@ -16,6 +16,7 @@ import com.wireguard.android.R
 import com.wireguard.android.backend.Backend
 import com.wireguard.android.backend.GoBackend
 import com.wireguard.android.backend.WgQuickBackend
+import com.wireguard.android.util.ErrorMessages
 import com.wireguard.android.util.lifecycleScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -33,7 +34,8 @@ class VersionPreference(context: Context, attrs: AttributeSet?) : Preference(con
        intent.data = Uri.parse("https://www.wireguard.com/")
        try {
            context.startActivity(intent)
-        } catch (_: ActivityNotFoundException) {
+        } catch (e: Throwable) {
+            Toast.makeText(context, ErrorMessages[e], Toast.LENGTH_SHORT).show()
        }
    }

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.preference
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.util
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.util
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.util
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2022 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -41,6 +41,12 @@ object UserKnobs {
            it[DARK_THEME] ?: false
        }

+    suspend fun setDarkTheme(on: Boolean) {
+        Application.getPreferencesDataStore().edit {
+            it[DARK_THEME] = on
+        }
+    }
+
    private val ALLOW_REMOTE_CONTROL_INTENTS = booleanPreferencesKey("allow_remote_control_intents")
    val allowRemoteControlIntents: Flow<Boolean>
        get() = Application.getPreferencesDataStore().data.map {
@@ -1,25 +1,30 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.viewmodel

+import android.os.Build
 import android.os.Parcel
 import android.os.Parcelable
+import androidx.core.os.ParcelCompat
 import androidx.databinding.ObservableArrayList
 import androidx.databinding.ObservableList
 import com.wireguard.config.BadConfigException
 import com.wireguard.config.Config
 import com.wireguard.config.Peer
-import java.util.ArrayList

 class ConfigProxy : Parcelable {
    val `interface`: InterfaceProxy
    val peers: ObservableList<PeerProxy> = ObservableArrayList()

    private constructor(parcel: Parcel) {
-        `interface` = parcel.readParcelable(InterfaceProxy::class.java.classLoader)!!
-        parcel.readTypedList(peers, PeerProxy.CREATOR)
+        `interface` = ParcelCompat.readParcelable(parcel, InterfaceProxy::class.java.classLoader, InterfaceProxy::class.java) ?: InterfaceProxy()
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            ParcelCompat.readParcelableList(parcel, peers, PeerProxy::class.java.classLoader, PeerProxy::class.java)
+        } else {
+            parcel.readTypedList(peers, PeerProxy.CREATOR)
+        }
        peers.forEach { it.bind(this) }
    }

@@ -57,7 +62,11 @@ class ConfigProxy : Parcelable {

    override fun writeToParcel(dest: Parcel, flags: Int) {
        dest.writeParcelable(`interface`, flags)
-        dest.writeTypedList(peers)
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            dest.writeParcelableList(peers, flags)
+        } else {
+            dest.writeTypedList(peers)
+        }
    }

    private class ConfigProxyCreator : Parcelable.Creator<ConfigProxy> {
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.viewmodel
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.viewmodel
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.widget
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.widget
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.widget
@@ -1,6 +1,6 @@
 /*
 * Copyright © 2018 The Android Open Source Project
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.widget
@@ -1,6 +1,6 @@
 /*
 * Copyright © 2013 The Android Open Source Project
- * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
+ * Copyright © 2017-2023 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */
 package com.wireguard.android.widget
@@ -8,9 +8,9 @@ package com.wireguard.android.widget
 import android.content.Context
 import android.os.Parcelable
 import android.util.AttributeSet
-import android.widget.Switch
+import com.google.android.material.materialswitch.MaterialSwitch

-class ToggleSwitch @JvmOverloads constructor(context: Context?, attrs: AttributeSet? = null) : Switch(context, attrs) {
+class ToggleSwitch @JvmOverloads constructor(context: Context, attrs: AttributeSet? = null) : MaterialSwitch(context, attrs) {
    private var isRestoringState = false
    private var listener: OnBeforeCheckedChangeListener? = null
    override fun onRestoreInstanceState(state: Parcelable) {
--- a/Show More
+++ b/Show More