fix: pass provisioning profiles explicitly when exporting Apple archives

* feat: upload iOS and macOS NE builds to TestFlight on version tags

* chore: bump version

.github/actions/apple-setup-provisioning-profile/action.yml

@@ -14,7 +14,6 @@ runs:
     - name: Setup provisioning profile
       shell: bash
       run: |
-        PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
         TEMP_FILE=$(mktemp)
 
         echo "${{ inputs.provisioning_profile_base64 }}" | base64 --decode > "$TEMP_FILE"
@@ -26,6 +25,12 @@ runs:
           exit 1
         fi
 
-        mkdir -p "$PROFILES_DIR"
-        mv "$TEMP_FILE" "$PROFILES_DIR/$PROFILE_UUID.mobileprovision"
-        echo "Installed profile: $PROFILE_UUID"
+        PROFILE_EXTENSION=mobileprovision
+        grep -aq "<string>OSX</string>" "$TEMP_FILE" && PROFILE_EXTENSION=provisionprofile
+
+        for PROFILES_DIR in "$HOME/Library/MobileDevice/Provisioning Profiles" "$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"; do
+          mkdir -p "$PROFILES_DIR"
+          cp "$TEMP_FILE" "$PROFILES_DIR/$PROFILE_UUID.$PROFILE_EXTENSION"
+        done
+        rm -f "$TEMP_FILE"
+        echo "Installed profile: $PROFILE_UUID.$PROFILE_EXTENSION"

.github/release-notes.md

@@ -0,0 +1,23 @@
+## Version differences
+
+### Android
+* For Android version 11 and higher, you need to use .apk that start with - AmneziaVPN_${VERSION}_android11+
+* For Android version 9-10, you need to use .apk that start with - AmneziaVPN_${VERSION}_android9-10
+* ***The app version for Android 7 and 8 is temporarily unavailable***
+
+### macOS
+!!! The previous version (4.8.8.2 and lower) of the application (installed via the .dmg installer) must be uninstalled via “move to bin” in the applications folder
+
+* For macOS version 13 and higher, you need to use .pkg - AmneziaVPN_${VERSION}_macos.pkg
+* ***The app version for macOS 10.15 - 12, is temporarily unavailable***
+
+### Linux
+For Ubuntu you need to install xcb plugin:
+apt install libxcb-cursor0 libxcb-xinerama0 libxcb-icccm4 libxcb-keysyms1 libopengl0 libxkbcommon-x11-0
+
+## Changelog
+
+### General
+* Improve stability
+
+**Full Changelog**: https://github.com/amnezia-vpn/amnezia-client/compare/${PREVIOUS_TAG}...${VERSION}

.github/workflows/deploy.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - '**'
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+.[0-9]+'
 
 env:
   QT_MIRROR: https://mirrors.ocf.berkeley.edu/qt/ # https://download.qt.io/static/mirrorlist/
@@ -375,7 +377,7 @@ jobs:
     - name: 'Setup xcode'
       uses: maxim-lobanov/setup-xcode@v1
       with:
-        xcode-version: '26.0'
+        xcode-version: '26.4'
 
     - name: 'Install desktop Qt'
       uses: jurplel/install-qt-action@v3
@@ -415,12 +417,24 @@ jobs:
         APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
         APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
         APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
+        CONFIGURE_ONLY: ${{ startsWith(github.ref, 'refs/tags/') && 'true' || '' }}
+      shell: bash
       run: |
-        sh deploy/build.sh -t ios | \
-          sed -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/d' | \
-          sed -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/d' | \
-          sed -e '/-DPROD_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DPROD_AGW_PUBLIC_KEY/d' | \
-          sed -e '/-DDEV_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DDEV_AGW_PUBLIC_KEY/d'
+        sh deploy/build.sh -t ios | sed -f deploy/hide_secrets.sed
+
+    - name: 'Archive for App Store'
+      if: startsWith(github.ref, 'refs/tags/')
+      working-directory: deploy
+      shell: bash
+      run: fastlane ios archive 2>&1 | sed -f hide_secrets.sed
+
+    - name: 'Upload App Store package'
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/ios/AmneziaVPN.ipa
+        archive: false
+        retention-days: 7
 
 # ------------------------------------------------------
 
@@ -629,12 +643,7 @@ jobs:
 
     env:
       QT_VERSION: 6.10.1
-
-      MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
-
-      MAC_APP_CERT_CERT: ${{ secrets.MAC_APP_CERT_CERT }}
-      MAC_SIGNER_ID: ${{ secrets.MAC_SIGNER_ID }}
-      MAC_APP_CERT_PW: ${{ secrets.MAC_APP_CERT_PW }}
+      KEYCHAIN_PASSWORD: ""
 
       PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
       PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
@@ -652,13 +661,37 @@ jobs:
         submodules: 'true'
         fetch-depth: 10
 
-    - uses: ./.github/actions/apple-setup-provisioning-profile
+    - uses: ./.github/actions/apple-setup-keychain
+      id: setup-keychain
       with:
-        provisioning_profile_base64: ${{ secrets.MAC_APP_PROVISIONING_PROFILE }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
 
-    - uses: ./.github/actions/apple-setup-provisioning-profile
+    - name: 'Install signing certificate'
+      uses: ./.github/actions/apple-install-cert
       with:
-        provisioning_profile_base64: ${{ secrets.MAC_NE_PROVISIONING_PROFILE }}
+        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+        cert-base64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }}
+        cert-password: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }}
+
+    - name: 'Install installer certificate'
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: ./.github/actions/apple-install-cert
+      with:
+        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+        cert-base64: ${{ secrets.MAC_APPSTORE_INSTALLER_CERT_BASE64 }}
+        cert-password: ${{ secrets.MAC_APPSTORE_INSTALLER_CERT_PASSWORD }}
+
+    - name: 'Install app provisioning profile'
+      uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.APPSTORE_CONNECT_MAC_PROVISIONING }}
+
+    - name: 'Install NE provisioning profile'
+      uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.APPSTORE_CONNECT_MAC_NE_PROVISIONING }}
 
     - name: 'Setup xcode'
       uses: maxim-lobanov/setup-xcode@v1
@@ -677,18 +710,6 @@ jobs:
         set-env: 'true'
         extra: '--base ${{ env.QT_MIRROR }}'
 
-    - name: 'Install go'
-      uses: actions/setup-go@v5
-      with:
-        go-version: '1.24'
-        cache: false
-
-    - name: 'Setup gomobile'
-      run: |
-          export PATH=$PATH:~/go/bin
-          go install golang.org/x/mobile/cmd/gomobile@latest
-          gomobile init
-
     - name: 'Setup python'
       uses: actions/setup-python@v6
       with:
@@ -698,15 +719,32 @@ jobs:
       run: pip install "conan==2.28.0"
 
     - name: 'Build project'
-      run: |
-        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos/bin"
-        bash deploy/build_macos_ne.sh
+      env:
+        QT_INSTALL_DIR: ${{ runner.temp }}
+        CONFIGURE_ONLY: ${{ startsWith(github.ref, 'refs/tags/') && 'true' || '' }}
+      shell: bash
+      run: deploy/build.sh -t macos-ne | sed -f deploy/hide_secrets.sed
 
     - name: 'Upload unpacked artifact'
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
       uses: actions/upload-artifact@v4
       with:
         name: AmneziaVPN_MacOS_unpacked
-        path: deploy/build/client/AmneziaVPN.app
+        path: deploy/build/client/Release/AmneziaVPN.app
+        retention-days: 7
+
+    - name: 'Archive for App Store'
+      if: startsWith(github.ref, 'refs/tags/')
+      working-directory: deploy
+      shell: bash
+      run: fastlane mac archive 2>&1 | sed -f hide_secrets.sed
+
+    - name: 'Upload App Store package'
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/osx/AmneziaVPN.pkg
+        archive: false
         retention-days: 7
 
 # ------------------------------------------------------
@@ -802,6 +840,8 @@ jobs:
       APP_ANDROID_MIN_SDK: ${{ matrix.min_sdk }}
       APP_ANDROID_MAX_SDK: ${{ matrix.max_sdk }}
       APP_ANDROID_VERSION_CODE_OFFSET: ${{ matrix.version_code_offset }}
+      CMAKE_C_COMPILER_LAUNCHER: ccache
+      CMAKE_CXX_COMPILER_LAUNCHER: ccache
       PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
       PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
       FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
@@ -896,6 +936,12 @@ jobs:
     - name: 'Install conan'
       run: pip install "conan==2.28.0"
 
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2
+      with:
+        key: android-${{ matrix.label }}
+        max-size: 1G
+
     - name: 'Decode keystore secret to file'
       env:
         KEYSTORE_BASE64: ${{ secrets.ANDROID_RELEASE_KEYSTORE_BASE64 }}
@@ -933,8 +979,7 @@ jobs:
         fi
 
         for abi in arm64-v8a armeabi-v7a x86 x86_64; do
-          deploy/build.sh -t android --sign --abi ${abi} --build ./deploy/build/${abi}
-          mv deploy/build/${abi}/client/android-build/AmneziaVPN.apk \
+          mv deploy/build/client/android-build/build/outputs/apk/oss/release/*-${abi}-release.apk \
              $OUT/AmneziaVPN_${VERSION}_${LABEL}_${abi}.apk
         done
 
@@ -953,9 +998,9 @@ jobs:
         OUT=deploy/artifacts
         VERSION=$(grep CMAKE_PROJECT_VERSION:STATIC deploy/build/CMakeCache.txt | cut -d= -f2)
 
-        deploy/build.sh -t android --sign --aab --play --build ./deploy/build/play
+        deploy/build.sh -t android --sign --aab --play
 
-        mv deploy/build/play/client/android-build/build/outputs/bundle/playRelease/android-build-play-release.aab \
+        mv deploy/build/client/android-build/build/outputs/bundle/playRelease/android-build-play-release.aab \
            $OUT/AmneziaVPN_${VERSION}_${LABEL}_play.aab
 
     - name: 'Upload universal APK'
@@ -1647,3 +1692,126 @@ jobs:
           disable-animations: true
           script: bash ci_run_android_tests.sh
 
+# ------------------------------------------------------
+
+  Pre-Release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [Build-Linux-Ubuntu, Build-Windows, Build-iOS, Build-MacOS, Build-MacOS-NE, Build-Android]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+    - name: 'Get release notes template'
+      uses: actions/checkout@v4
+      with:
+        sparse-checkout: .github/release-notes.md
+        sparse-checkout-cone-mode: false
+
+    - name: 'Download Android APKs'
+      uses: actions/download-artifact@v8
+      with:
+        pattern: 'AmneziaVPN_*_{android11+,android9-10}_{arm64-v8a,armeabi-v7a,x86,x86_64}.apk'
+        path: dist
+        merge-multiple: true
+
+    - name: 'Download desktop installers'
+      uses: actions/download-artifact@v8
+      with:
+        pattern: 'AmneziaVPN_*_{linux_x64.run,macos_x64.pkg}'
+        path: dist
+        merge-multiple: true
+
+    - name: 'Publish pre-release'
+      env:
+        GH_TOKEN: ${{ github.token }}
+        TAG: ${{ github.ref_name }}
+      run: |
+        ls -l dist
+        if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+          gh release upload "$TAG" dist/* --repo "$GITHUB_REPOSITORY" --clobber
+        else
+          export VERSION="$TAG"
+          export PREVIOUS_TAG=$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName -q .tagName)
+          envsubst '$VERSION $PREVIOUS_TAG' < .github/release-notes.md > release-notes.md
+
+          gh release create "$TAG" dist/* --repo "$GITHUB_REPOSITORY" \
+            --title "$TAG" --notes-file release-notes.md --draft --prerelease --verify-tag
+        fi
+
+# ------------------------------------------------------
+
+  TestFlight:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [Build-Linux-Ubuntu, Build-Windows, Build-iOS, Build-MacOS, Build-MacOS-NE, Build-Android]
+    runs-on: macos-26
+
+    env:
+      APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
+      APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
+      APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
+
+    defaults:
+      run:
+        working-directory: deploy
+        shell: bash
+
+    steps:
+    - name: 'Get fastlane config'
+      uses: actions/checkout@v4
+      with:
+        sparse-checkout: |
+          deploy/fastlane
+          deploy/hide_secrets.sed
+        sparse-checkout-cone-mode: false
+
+    - name: 'Download iOS package'
+      uses: actions/download-artifact@v8
+      with:
+        name: AmneziaVPN.ipa
+        path: deploy/build/ios
+
+    - name: 'Download macOS package'
+      uses: actions/download-artifact@v8
+      with:
+        name: AmneziaVPN.pkg
+        path: deploy/build/osx
+
+    - name: 'Upload iOS build to TestFlight'
+      run: fastlane ios testflight_upload 2>&1 | sed -f hide_secrets.sed
+
+    - name: 'Upload macOS build to TestFlight'
+      run: fastlane mac testflight_upload 2>&1 | sed -f hide_secrets.sed
+
+# ------------------------------------------------------
+
+  Google-Play:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [Build-Linux-Ubuntu, Build-Windows, Build-iOS, Build-MacOS, Build-MacOS-NE, Build-Android]
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: deploy
+        shell: bash
+
+    steps:
+    - name: 'Get fastlane config'
+      uses: actions/checkout@v4
+      with:
+        sparse-checkout: |
+          deploy/fastlane
+          deploy/hide_secrets.sed
+        sparse-checkout-cone-mode: false
+
+    - name: 'Download Play AABs'
+      uses: actions/download-artifact@v8
+      with:
+        pattern: 'AmneziaVPN_*_play.aab'
+        path: deploy/build/android
+        merge-multiple: true
+
+    - name: 'Upload to Google Play beta'
+      env:
+        GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+      run: fastlane android play_upload 2>&1 | sed -f hide_secrets.sed

.gitignore

@@ -83,6 +83,7 @@ client/.DS_Store
 ._.DS_Store
 ._*
 *.dmg
+deploy/data/macos/pf/amn.400.allowPIA.conf
 
 # tmp files
 *.*~

.gitmodules

@@ -4,11 +4,10 @@
 [submodule "client/3rd/SortFilterProxyModel"]
 	path = client/3rd/SortFilterProxyModel
 	url = https://github.com/mitchcurtis/SortFilterProxyModel.git
+[submodule "client/3rd/amneziawg-apple"]
+	path = client/3rd/amneziawg-apple
+	url = https://github.com/amnezia-vpn/amneziawg-apple
 [submodule "client/3rd/qtgamepad"]
 	path = client/3rd/qtgamepad
 	url = https://github.com/amnezia-vpn/qtgamepad.git
 	branch = 6.6
-[submodule "cmake/cmake-conan"]
-	path = cmake/cmake-conan
-	url = https://github.com/amnezia-vpn/cmake-conan
-	branch = develop2

CMakeLists.txt

@@ -1,21 +1,18 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)
 
-set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(PROJECT AmneziaVPN)
 if(NOT AMNEZIAVPN_VERSION)
-    set(AMNEZIAVPN_VERSION 5.2.0.0 CACHE STRING "Client app version")
+    set(AMNEZIAVPN_VERSION 5.1.1.4 CACHE STRING "Client app version")
 endif()
 
 set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
-include(${CMAKE_SOURCE_DIR}/cmake/cmake-conan/conan_bootstrap.cmake)
-execute_process(
-    COMMAND ${CONAN_COMMAND} remote add recipes "https://artifactory.amnezia.org/artifactory/api/conan/recipes" --force -vquiet
-)
 set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
     ${CMAKE_SOURCE_DIR}/cmake/platform_settings.cmake
-    ${CMAKE_SOURCE_DIR}/cmake/cmake-conan/conan_provider.cmake
+    ${CMAKE_SOURCE_DIR}/cmake/recipes_bootstrap.cmake
+    ${CMAKE_SOURCE_DIR}/cmake/conan_provider.cmake
     CACHE STRING "" FORCE)
 
 project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION}
@@ -37,13 +34,48 @@ set(RELEASE_DATE "${CURRENT_DATE}")
 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
 
 # bump by 2 on every release, because we're releasing two versions on the play store
-set(APP_ANDROID_VERSION_CODE 2190)
+set(APP_ANDROID_VERSION_CODE 2192)
 if(DEFINED APP_ANDROID_VERSION_CODE_OFFSET)
     math(EXPR APP_ANDROID_VERSION_CODE "${APP_ANDROID_VERSION_CODE} + ${APP_ANDROID_VERSION_CODE_OFFSET}")
 endif()
 
+if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
+    set(MZ_PLATFORM_NAME "linux")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Windows")
+    set(MZ_PLATFORM_NAME "windows")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Darwin")
+    set(MZ_PLATFORM_NAME "macos")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Android")
+    set(MZ_PLATFORM_NAME "android")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "iOS")
+    set(MZ_PLATFORM_NAME "ios")
+elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Emscripten")
+    set(MZ_PLATFORM_NAME "wasm")
+endif()
+
 set(QT_BUILD_TOOLS_WHEN_CROSS_COMPILING ON)
 
+if(APPLE AND NOT IOS)
+    if(CMAKE_BUILD_TYPE STREQUAL "Debug")
+        set(AMN_PF_RULE_IDENTITY "user { root }")
+    else()
+        set(AMN_PF_RULE_IDENTITY "group { amnvpn }")
+    endif()
+
+    configure_file(
+        "${CMAKE_CURRENT_SOURCE_DIR}/deploy/data/pf-templates/amn.400.allowPIA.conf.in"
+        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
+        @ONLY
+    )
+
+    file(COPY_FILE
+        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
+        "${CMAKE_CURRENT_SOURCE_DIR}/deploy/data/macos/pf/amn.400.allowPIA.conf"
+        ONLY_IF_DIFFERENT
+    )
+endif()
+
+
 add_subdirectory(client)
 
 if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)

client/CMakeLists.txt

@@ -74,6 +74,7 @@ target_compile_definitions(${PROJECT} PRIVATE
 
 if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
     qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_interface.rep)
+    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_interface.rep)
 endif()
 
 qt6_add_resources(QRC ${QRC}
@@ -150,6 +151,10 @@ else()
     message("MACOS_NE is OFF")
 endif()
 
+include_directories(mozilla)
+include_directories(mozilla/shared)
+include_directories(mozilla/models)
+
 configure_file(${CMAKE_CURRENT_LIST_DIR}/../version.h.in ${CMAKE_CURRENT_BINARY_DIR}/version.h)
 file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/core/utils)
 configure_file(
@@ -172,6 +177,10 @@ configure_file(
     @ONLY
 )
 
+if(CMAKE_BUILD_TYPE STREQUAL "Debug")
+    target_compile_definitions(${PROJECT} PRIVATE "MZ_DEBUG")
+endif()
+
 if(WIN32)
     configure_file(
         ${CMAKE_CURRENT_LIST_DIR}/platforms/windows/amneziavpn.rc.in
@@ -235,6 +244,7 @@ endif()
 list(APPEND SOURCES ${CMAKE_CURRENT_LIST_DIR}/main.cpp)
 
 target_link_libraries(${PROJECT} PRIVATE ${LIBS})
+target_compile_definitions(${PROJECT} PRIVATE "MZ_$<UPPER_CASE:${MZ_PLATFORM_NAME}>")
 
 target_sources(${PROJECT} PRIVATE ${SOURCES} ${HEADERS} ${RESOURCES} ${QRC} ${I18NQRC})
 
@@ -294,11 +304,32 @@ install(SCRIPT ${QT_DEPLOY_SCRIPT}
 )
 
 if (APPLE AND NOT IOS AND NOT MACOS_NE)
+    list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/macos/update-resolv-conf.sh")
     set_target_properties(${PROJECT} PROPERTIES
         XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED "NO"
         XCODE_ATTRIBUTE_CODE_SIGNING_REQUIRED "NO"
     )
 endif()
+if (LINUX AND NOT ANDROID)
+    list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/linux/update-resolv-conf.sh")
+endif()
+
+if(OVPN_SCRIPTS)
+    add_custom_command(TARGET ${PROJECT} POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E copy_if_different
+        ${OVPN_SCRIPTS}
+        "$<TARGET_FILE_DIR:${PROJECT}>"
+    )
+
+    install(FILES ${OVPN_SCRIPTS}
+        DESTINATION ${CMAKE_INSTALL_BINDIR}
+        COMPONENT AmneziaVPN
+        PERMISSIONS
+            OWNER_READ OWNER_EXECUTE
+            GROUP_READ GROUP_EXECUTE
+            WORLD_READ WORLD_EXECUTE
+    )
+endif()
 
 if(AMNEZIA_BUILD_TESTS)
     add_subdirectory(tests)

client/android/AndroidManifest.xml

@@ -153,8 +153,34 @@
         </activity>
 
         <service
-            android:name=".XtunService"
-            android:process=":amneziaVpnService"
+            android:name=".AwgService"
+            android:process=":amneziaAwgService"
+            android:permission="android.permission.BIND_VPN_SERVICE"
+            android:foregroundServiceType="systemExempted"
+            android:exported="false"
+            tools:ignore="ForegroundServicePermission">
+
+            <intent-filter>
+                <action android:name="android.net.VpnService" />
+            </intent-filter>
+        </service>
+
+        <service
+            android:name=".OpenVpnService"
+            android:process=":amneziaOpenVpnService"
+            android:permission="android.permission.BIND_VPN_SERVICE"
+            android:foregroundServiceType="systemExempted"
+            android:exported="false"
+            tools:ignore="ForegroundServicePermission">
+
+            <intent-filter>
+                <action android:name="android.net.VpnService" />
+            </intent-filter>
+        </service>
+
+        <service
+            android:name=".XrayService"
+            android:process=":amneziaXrayService"
             android:permission="android.permission.BIND_VPN_SERVICE"
             android:foregroundServiceType="systemExempted"
             android:exported="false"

client/android/awg/build.gradle.kts

@@ -0,0 +1,18 @@
+plugins {
+    id(libs.plugins.android.library.get().pluginId)
+    id(libs.plugins.kotlin.android.get().pluginId)
+}
+
+kotlin {
+    jvmToolchain(17)
+}
+
+android {
+    namespace = "org.amnezia.vpn.protocol.awg"
+}
+
+dependencies {
+    compileOnly(project(":utils"))
+    compileOnly(project(":protocolApi"))
+    implementation(project(":wireguard"))
+}

client/android/awg/src/main/kotlin/Awg.kt

@@ -0,0 +1,21 @@
+package org.amnezia.vpn.protocol.awg
+
+import org.amnezia.vpn.protocol.wireguard.Wireguard
+import org.amnezia.vpn.protocol.wireguard.WireguardConfig
+import org.json.JSONObject
+
+class Awg : Wireguard() {
+
+    override val ifName: String = "awg0"
+
+    override fun parseConfig(config: JSONObject): WireguardConfig {
+        val configData = config.getJSONObject("awg_config_data")
+        return WireguardConfig.build {
+            setUseProtocolExtension(true)
+            configExtensionParameters(configData)
+            configWireguard(config, configData)
+            configSplitTunneling(config)
+            configAppSplitTunneling(config)
+        }
+    }
+}

client/android/build.gradle.kts

@@ -54,6 +54,7 @@ android {
             storePassword = providers.environmentVariable("QT_ANDROID_KEYSTORE_STORE_PASS").orNull
             keyAlias = providers.environmentVariable("QT_ANDROID_KEYSTORE_ALIAS").orNull
             keyPassword = providers.environmentVariable("QT_ANDROID_KEYSTORE_STORE_PASS").orNull
+            enableV3Signing = true
         }
     }
 
@@ -111,7 +112,7 @@ android {
             isEnable = abiList.size > 1
             reset()
             include(*abiList.toTypedArray())
-            isUniversalApk = false
+            isUniversalApk = true
         }
     }
 
@@ -122,7 +123,8 @@ android {
             outputs.map { it as BaseVariantOutputImpl }
                 .forEach { output ->
                     if (output.outputFileName.endsWith(".apk")) {
-                        output.outputFileName = "$outputBaseName-${buildType.name}.apk"
+                        output.outputFileName = listOfNotNull(outputBaseName, output.getFilter("ABI"), buildType.name)
+                            .joinToString("-", postfix = ".apk")
                     }
                 }
         }
@@ -143,14 +145,15 @@ android {
             val base = outputBaseName.ifEmpty { "android-build" }
             val unsignedSuffix = if (buildTypeName == "release") "-unsigned" else ""
 
+            val universalOutput = outputs.map { it as BaseVariantOutputImpl }.first { it.getFilter("ABI") == null }
+
             packageApplicationProvider.configure {
                 doLast {
                     val srcDir = layout.buildDirectory.dir("outputs/apk/oss/$buildTypeName").get().asFile
                     val dstDir = layout.buildDirectory.dir("outputs/apk").get().asFile
                     dstDir.mkdirs()
-                    srcDir.listFiles()?.filter { it.name.endsWith(".apk") }?.forEach { apk ->
-                        apk.copyTo(File(dstDir, "$base-$buildTypeName$unsignedSuffix.apk"), overwrite = true)
-                    }
+                    File(srcDir, universalOutput.outputFileName)
+                        .copyTo(File(dstDir, "$base-$buildTypeName$unsignedSuffix.apk"), overwrite = true)
                 }
             }
 
@@ -177,7 +180,10 @@ dependencies {
     implementation(project(":qt"))
     implementation(project(":utils"))
     implementation(project(":protocolApi"))
-    implementation(project(":xtun"))
+    implementation(project(":wireguard"))
+    implementation(project(":awg"))
+    implementation(project(":openvpn"))
+    implementation(project(":xray"))
     implementation(libs.androidx.core)
     implementation(libs.androidx.activity)
     implementation(libs.androidx.fragment)

client/android/gradle/libs.versions.toml

@@ -13,7 +13,6 @@ androidx-datastore = "1.1.1"
 kotlinx-coroutines = "1.8.1"
 kotlinx-serialization = "1.6.3"
 google-mlkit = "17.3.0"
-amnezia-xtun = "0.0.1"
 
 [libraries]
 android-billing = { module = "com.android.billingclient:billing-ktx", version.ref = "android-billing" }
@@ -31,7 +30,6 @@ androidx-datastore = { module = "androidx.datastore:datastore-preferences", vers
 kotlinx-coroutines = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-android", version.ref = "kotlinx-coroutines" }
 kotlinx-serialization-protobuf = { module = "org.jetbrains.kotlinx:kotlinx-serialization-protobuf", version.ref = "kotlinx-serialization" }
 google-mlkit = { module = "com.google.mlkit:barcode-scanning", version.ref = "google-mlkit" }
-amnezia-xtun = { module = "org.amnezia:xtun", version.ref = "amnezia-xtun" }
 
 [bundles]
 androidx-camera = [

client/android/openvpn/build.gradle.kts

@@ -8,12 +8,11 @@ kotlin {
 }
 
 android {
-    namespace = "org.amnezia.vpn.protocol.xtun"
+    namespace = "org.amnezia.vpn.protocol.openvpn"
 }
 
 dependencies {
     compileOnly(project(":utils"))
     compileOnly(project(":protocolApi"))
     implementation(libs.kotlinx.coroutines)
-    implementation(libs.amnezia.xtun)
 }

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_Config.java

@@ -0,0 +1,417 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_Config {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_Config(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_Config obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_Config obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_Config(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setContent(String value) {
+    ovpncliJNI.ClientAPI_Config_content_set(swigCPtr, this, value);
+  }
+
+  public String getContent() {
+    return ovpncliJNI.ClientAPI_Config_content_get(swigCPtr, this);
+  }
+
+  public void setContentList(SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t value) {
+    ovpncliJNI.ClientAPI_Config_contentList_set(swigCPtr, this, SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t.getCPtr(value));
+  }
+
+  public SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t getContentList() {
+    long cPtr = ovpncliJNI.ClientAPI_Config_contentList_get(swigCPtr, this);
+    return (cPtr == 0) ? null : new SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t(cPtr, false);
+  }
+
+  public void setGuiVersion(String value) {
+    ovpncliJNI.ClientAPI_Config_guiVersion_set(swigCPtr, this, value);
+  }
+
+  public String getGuiVersion() {
+    return ovpncliJNI.ClientAPI_Config_guiVersion_get(swigCPtr, this);
+  }
+
+  public void setSsoMethods(String value) {
+    ovpncliJNI.ClientAPI_Config_ssoMethods_set(swigCPtr, this, value);
+  }
+
+  public String getSsoMethods() {
+    return ovpncliJNI.ClientAPI_Config_ssoMethods_get(swigCPtr, this);
+  }
+
+  public void setHwAddrOverride(String value) {
+    ovpncliJNI.ClientAPI_Config_hwAddrOverride_set(swigCPtr, this, value);
+  }
+
+  public String getHwAddrOverride() {
+    return ovpncliJNI.ClientAPI_Config_hwAddrOverride_get(swigCPtr, this);
+  }
+
+  public void setPlatformVersion(String value) {
+    ovpncliJNI.ClientAPI_Config_platformVersion_set(swigCPtr, this, value);
+  }
+
+  public String getPlatformVersion() {
+    return ovpncliJNI.ClientAPI_Config_platformVersion_get(swigCPtr, this);
+  }
+
+  public void setServerOverride(String value) {
+    ovpncliJNI.ClientAPI_Config_serverOverride_set(swigCPtr, this, value);
+  }
+
+  public String getServerOverride() {
+    return ovpncliJNI.ClientAPI_Config_serverOverride_get(swigCPtr, this);
+  }
+
+  public void setPortOverride(String value) {
+    ovpncliJNI.ClientAPI_Config_portOverride_set(swigCPtr, this, value);
+  }
+
+  public String getPortOverride() {
+    return ovpncliJNI.ClientAPI_Config_portOverride_get(swigCPtr, this);
+  }
+
+  public void setProtoOverride(String value) {
+    ovpncliJNI.ClientAPI_Config_protoOverride_set(swigCPtr, this, value);
+  }
+
+  public String getProtoOverride() {
+    return ovpncliJNI.ClientAPI_Config_protoOverride_get(swigCPtr, this);
+  }
+
+  public void setProtoVersionOverride(int value) {
+    ovpncliJNI.ClientAPI_Config_protoVersionOverride_set(swigCPtr, this, value);
+  }
+
+  public int getProtoVersionOverride() {
+    return ovpncliJNI.ClientAPI_Config_protoVersionOverride_get(swigCPtr, this);
+  }
+
+  public void setAllowUnusedAddrFamilies(String value) {
+    ovpncliJNI.ClientAPI_Config_allowUnusedAddrFamilies_set(swigCPtr, this, value);
+  }
+
+  public String getAllowUnusedAddrFamilies() {
+    return ovpncliJNI.ClientAPI_Config_allowUnusedAddrFamilies_get(swigCPtr, this);
+  }
+
+  public void setConnTimeout(int value) {
+    ovpncliJNI.ClientAPI_Config_connTimeout_set(swigCPtr, this, value);
+  }
+
+  public int getConnTimeout() {
+    return ovpncliJNI.ClientAPI_Config_connTimeout_get(swigCPtr, this);
+  }
+
+  public void setTunPersist(boolean value) {
+    ovpncliJNI.ClientAPI_Config_tunPersist_set(swigCPtr, this, value);
+  }
+
+  public boolean getTunPersist() {
+    return ovpncliJNI.ClientAPI_Config_tunPersist_get(swigCPtr, this);
+  }
+
+  public void setGoogleDnsFallback(boolean value) {
+    ovpncliJNI.ClientAPI_Config_googleDnsFallback_set(swigCPtr, this, value);
+  }
+
+  public boolean getGoogleDnsFallback() {
+    return ovpncliJNI.ClientAPI_Config_googleDnsFallback_get(swigCPtr, this);
+  }
+
+  public void setSynchronousDnsLookup(boolean value) {
+    ovpncliJNI.ClientAPI_Config_synchronousDnsLookup_set(swigCPtr, this, value);
+  }
+
+  public boolean getSynchronousDnsLookup() {
+    return ovpncliJNI.ClientAPI_Config_synchronousDnsLookup_get(swigCPtr, this);
+  }
+
+  public void setAutologinSessions(boolean value) {
+    ovpncliJNI.ClientAPI_Config_autologinSessions_set(swigCPtr, this, value);
+  }
+
+  public boolean getAutologinSessions() {
+    return ovpncliJNI.ClientAPI_Config_autologinSessions_get(swigCPtr, this);
+  }
+
+  public void setRetryOnAuthFailed(boolean value) {
+    ovpncliJNI.ClientAPI_Config_retryOnAuthFailed_set(swigCPtr, this, value);
+  }
+
+  public boolean getRetryOnAuthFailed() {
+    return ovpncliJNI.ClientAPI_Config_retryOnAuthFailed_get(swigCPtr, this);
+  }
+
+  public void setExternalPkiAlias(String value) {
+    ovpncliJNI.ClientAPI_Config_externalPkiAlias_set(swigCPtr, this, value);
+  }
+
+  public String getExternalPkiAlias() {
+    return ovpncliJNI.ClientAPI_Config_externalPkiAlias_get(swigCPtr, this);
+  }
+
+  public void setDisableClientCert(boolean value) {
+    ovpncliJNI.ClientAPI_Config_disableClientCert_set(swigCPtr, this, value);
+  }
+
+  public boolean getDisableClientCert() {
+    return ovpncliJNI.ClientAPI_Config_disableClientCert_get(swigCPtr, this);
+  }
+
+  public void setSslDebugLevel(int value) {
+    ovpncliJNI.ClientAPI_Config_sslDebugLevel_set(swigCPtr, this, value);
+  }
+
+  public int getSslDebugLevel() {
+    return ovpncliJNI.ClientAPI_Config_sslDebugLevel_get(swigCPtr, this);
+  }
+
+  public void setCompressionMode(String value) {
+    ovpncliJNI.ClientAPI_Config_compressionMode_set(swigCPtr, this, value);
+  }
+
+  public String getCompressionMode() {
+    return ovpncliJNI.ClientAPI_Config_compressionMode_get(swigCPtr, this);
+  }
+
+  public void setPrivateKeyPassword(String value) {
+    ovpncliJNI.ClientAPI_Config_privateKeyPassword_set(swigCPtr, this, value);
+  }
+
+  public String getPrivateKeyPassword() {
+    return ovpncliJNI.ClientAPI_Config_privateKeyPassword_get(swigCPtr, this);
+  }
+
+  public void setDefaultKeyDirection(int value) {
+    ovpncliJNI.ClientAPI_Config_defaultKeyDirection_set(swigCPtr, this, value);
+  }
+
+  public int getDefaultKeyDirection() {
+    return ovpncliJNI.ClientAPI_Config_defaultKeyDirection_get(swigCPtr, this);
+  }
+
+  public void setTlsVersionMinOverride(String value) {
+    ovpncliJNI.ClientAPI_Config_tlsVersionMinOverride_set(swigCPtr, this, value);
+  }
+
+  public String getTlsVersionMinOverride() {
+    return ovpncliJNI.ClientAPI_Config_tlsVersionMinOverride_get(swigCPtr, this);
+  }
+
+  public void setTlsCertProfileOverride(String value) {
+    ovpncliJNI.ClientAPI_Config_tlsCertProfileOverride_set(swigCPtr, this, value);
+  }
+
+  public String getTlsCertProfileOverride() {
+    return ovpncliJNI.ClientAPI_Config_tlsCertProfileOverride_get(swigCPtr, this);
+  }
+
+  public void setTlsCipherList(String value) {
+    ovpncliJNI.ClientAPI_Config_tlsCipherList_set(swigCPtr, this, value);
+  }
+
+  public String getTlsCipherList() {
+    return ovpncliJNI.ClientAPI_Config_tlsCipherList_get(swigCPtr, this);
+  }
+
+  public void setTlsCiphersuitesList(String value) {
+    ovpncliJNI.ClientAPI_Config_tlsCiphersuitesList_set(swigCPtr, this, value);
+  }
+
+  public String getTlsCiphersuitesList() {
+    return ovpncliJNI.ClientAPI_Config_tlsCiphersuitesList_get(swigCPtr, this);
+  }
+
+  public void setPeerInfo(SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t value) {
+    ovpncliJNI.ClientAPI_Config_peerInfo_set(swigCPtr, this, SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t.getCPtr(value));
+  }
+
+  public SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t getPeerInfo() {
+    long cPtr = ovpncliJNI.ClientAPI_Config_peerInfo_get(swigCPtr, this);
+    return (cPtr == 0) ? null : new SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t(cPtr, false);
+  }
+
+  public void setProxyHost(String value) {
+    ovpncliJNI.ClientAPI_Config_proxyHost_set(swigCPtr, this, value);
+  }
+
+  public String getProxyHost() {
+    return ovpncliJNI.ClientAPI_Config_proxyHost_get(swigCPtr, this);
+  }
+
+  public void setProxyPort(String value) {
+    ovpncliJNI.ClientAPI_Config_proxyPort_set(swigCPtr, this, value);
+  }
+
+  public String getProxyPort() {
+    return ovpncliJNI.ClientAPI_Config_proxyPort_get(swigCPtr, this);
+  }
+
+  public void setProxyUsername(String value) {
+    ovpncliJNI.ClientAPI_Config_proxyUsername_set(swigCPtr, this, value);
+  }
+
+  public String getProxyUsername() {
+    return ovpncliJNI.ClientAPI_Config_proxyUsername_get(swigCPtr, this);
+  }
+
+  public void setProxyPassword(String value) {
+    ovpncliJNI.ClientAPI_Config_proxyPassword_set(swigCPtr, this, value);
+  }
+
+  public String getProxyPassword() {
+    return ovpncliJNI.ClientAPI_Config_proxyPassword_get(swigCPtr, this);
+  }
+
+  public void setProxyAllowCleartextAuth(boolean value) {
+    ovpncliJNI.ClientAPI_Config_proxyAllowCleartextAuth_set(swigCPtr, this, value);
+  }
+
+  public boolean getProxyAllowCleartextAuth() {
+    return ovpncliJNI.ClientAPI_Config_proxyAllowCleartextAuth_get(swigCPtr, this);
+  }
+
+  public void setAltProxy(boolean value) {
+    ovpncliJNI.ClientAPI_Config_altProxy_set(swigCPtr, this, value);
+  }
+
+  public boolean getAltProxy() {
+    return ovpncliJNI.ClientAPI_Config_altProxy_get(swigCPtr, this);
+  }
+
+  public void setDco(boolean value) {
+    ovpncliJNI.ClientAPI_Config_dco_set(swigCPtr, this, value);
+  }
+
+  public boolean getDco() {
+    return ovpncliJNI.ClientAPI_Config_dco_get(swigCPtr, this);
+  }
+
+  public void setEcho(boolean value) {
+    ovpncliJNI.ClientAPI_Config_echo_set(swigCPtr, this, value);
+  }
+
+  public boolean getEcho() {
+    return ovpncliJNI.ClientAPI_Config_echo_get(swigCPtr, this);
+  }
+
+  public void setInfo(boolean value) {
+    ovpncliJNI.ClientAPI_Config_info_set(swigCPtr, this, value);
+  }
+
+  public boolean getInfo() {
+    return ovpncliJNI.ClientAPI_Config_info_get(swigCPtr, this);
+  }
+
+  public void setAllowLocalLanAccess(boolean value) {
+    ovpncliJNI.ClientAPI_Config_allowLocalLanAccess_set(swigCPtr, this, value);
+  }
+
+  public boolean getAllowLocalLanAccess() {
+    return ovpncliJNI.ClientAPI_Config_allowLocalLanAccess_get(swigCPtr, this);
+  }
+
+  public void setClockTickMS(long value) {
+    ovpncliJNI.ClientAPI_Config_clockTickMS_set(swigCPtr, this, value);
+  }
+
+  public long getClockTickMS() {
+    return ovpncliJNI.ClientAPI_Config_clockTickMS_get(swigCPtr, this);
+  }
+
+  public void setGremlinConfig(String value) {
+    ovpncliJNI.ClientAPI_Config_gremlinConfig_set(swigCPtr, this, value);
+  }
+
+  public String getGremlinConfig() {
+    return ovpncliJNI.ClientAPI_Config_gremlinConfig_get(swigCPtr, this);
+  }
+
+  public void setUsePluggableTransports(boolean value) {
+    ovpncliJNI.ClientAPI_Config_usePluggableTransports_set(swigCPtr, this, value);
+  }
+
+  public boolean getUsePluggableTransports() {
+    return ovpncliJNI.ClientAPI_Config_usePluggableTransports_get(swigCPtr, this);
+  }
+
+  public void setWintun(boolean value) {
+    ovpncliJNI.ClientAPI_Config_wintun_set(swigCPtr, this, value);
+  }
+
+  public boolean getWintun() {
+    return ovpncliJNI.ClientAPI_Config_wintun_get(swigCPtr, this);
+  }
+
+  public void setAllowLocalDnsResolvers(boolean value) {
+    ovpncliJNI.ClientAPI_Config_allowLocalDnsResolvers_set(swigCPtr, this, value);
+  }
+
+  public boolean getAllowLocalDnsResolvers() {
+    return ovpncliJNI.ClientAPI_Config_allowLocalDnsResolvers_get(swigCPtr, this);
+  }
+
+  public void setEnableLegacyAlgorithms(boolean value) {
+    ovpncliJNI.ClientAPI_Config_enableLegacyAlgorithms_set(swigCPtr, this, value);
+  }
+
+  public boolean getEnableLegacyAlgorithms() {
+    return ovpncliJNI.ClientAPI_Config_enableLegacyAlgorithms_get(swigCPtr, this);
+  }
+
+  public void setEnableNonPreferredDCAlgorithms(boolean value) {
+    ovpncliJNI.ClientAPI_Config_enableNonPreferredDCAlgorithms_set(swigCPtr, this, value);
+  }
+
+  public boolean getEnableNonPreferredDCAlgorithms() {
+    return ovpncliJNI.ClientAPI_Config_enableNonPreferredDCAlgorithms_get(swigCPtr, this);
+  }
+
+  public ClientAPI_Config() {
+    this(ovpncliJNI.new_ClientAPI_Config(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ConnectionInfo.java

@@ -0,0 +1,151 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ConnectionInfo {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_ConnectionInfo(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ConnectionInfo obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ConnectionInfo obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ConnectionInfo(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setDefined(boolean value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_defined_set(swigCPtr, this, value);
+  }
+
+  public boolean getDefined() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_defined_get(swigCPtr, this);
+  }
+
+  public void setUser(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_user_set(swigCPtr, this, value);
+  }
+
+  public String getUser() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_user_get(swigCPtr, this);
+  }
+
+  public void setServerHost(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_serverHost_set(swigCPtr, this, value);
+  }
+
+  public String getServerHost() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_serverHost_get(swigCPtr, this);
+  }
+
+  public void setServerPort(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_serverPort_set(swigCPtr, this, value);
+  }
+
+  public String getServerPort() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_serverPort_get(swigCPtr, this);
+  }
+
+  public void setServerProto(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_serverProto_set(swigCPtr, this, value);
+  }
+
+  public String getServerProto() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_serverProto_get(swigCPtr, this);
+  }
+
+  public void setServerIp(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_serverIp_set(swigCPtr, this, value);
+  }
+
+  public String getServerIp() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_serverIp_get(swigCPtr, this);
+  }
+
+  public void setVpnIp4(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_vpnIp4_set(swigCPtr, this, value);
+  }
+
+  public String getVpnIp4() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_vpnIp4_get(swigCPtr, this);
+  }
+
+  public void setVpnIp6(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_vpnIp6_set(swigCPtr, this, value);
+  }
+
+  public String getVpnIp6() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_vpnIp6_get(swigCPtr, this);
+  }
+
+  public void setGw4(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_gw4_set(swigCPtr, this, value);
+  }
+
+  public String getGw4() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_gw4_get(swigCPtr, this);
+  }
+
+  public void setGw6(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_gw6_set(swigCPtr, this, value);
+  }
+
+  public String getGw6() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_gw6_get(swigCPtr, this);
+  }
+
+  public void setClientIp(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_clientIp_set(swigCPtr, this, value);
+  }
+
+  public String getClientIp() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_clientIp_get(swigCPtr, this);
+  }
+
+  public void setTunName(String value) {
+    ovpncliJNI.ClientAPI_ConnectionInfo_tunName_set(swigCPtr, this, value);
+  }
+
+  public String getTunName() {
+    return ovpncliJNI.ClientAPI_ConnectionInfo_tunName_get(swigCPtr, this);
+  }
+
+  public ClientAPI_ConnectionInfo() {
+    this(ovpncliJNI.new_ClientAPI_ConnectionInfo(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_DynamicChallenge.java

@@ -0,0 +1,87 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_DynamicChallenge {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_DynamicChallenge(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_DynamicChallenge obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_DynamicChallenge obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_DynamicChallenge(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setChallenge(String value) {
+    ovpncliJNI.ClientAPI_DynamicChallenge_challenge_set(swigCPtr, this, value);
+  }
+
+  public String getChallenge() {
+    return ovpncliJNI.ClientAPI_DynamicChallenge_challenge_get(swigCPtr, this);
+  }
+
+  public void setEcho(boolean value) {
+    ovpncliJNI.ClientAPI_DynamicChallenge_echo_set(swigCPtr, this, value);
+  }
+
+  public boolean getEcho() {
+    return ovpncliJNI.ClientAPI_DynamicChallenge_echo_get(swigCPtr, this);
+  }
+
+  public void setResponseRequired(boolean value) {
+    ovpncliJNI.ClientAPI_DynamicChallenge_responseRequired_set(swigCPtr, this, value);
+  }
+
+  public boolean getResponseRequired() {
+    return ovpncliJNI.ClientAPI_DynamicChallenge_responseRequired_get(swigCPtr, this);
+  }
+
+  public void setStateID(String value) {
+    ovpncliJNI.ClientAPI_DynamicChallenge_stateID_set(swigCPtr, this, value);
+  }
+
+  public String getStateID() {
+    return ovpncliJNI.ClientAPI_DynamicChallenge_stateID_get(swigCPtr, this);
+  }
+
+  public ClientAPI_DynamicChallenge() {
+    this(ovpncliJNI.new_ClientAPI_DynamicChallenge(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_EvalConfig.java

@@ -0,0 +1,184 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_EvalConfig {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_EvalConfig(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_EvalConfig obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_EvalConfig obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_EvalConfig(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setError(boolean value) {
+    ovpncliJNI.ClientAPI_EvalConfig_error_set(swigCPtr, this, value);
+  }
+
+  public boolean getError() {
+    return ovpncliJNI.ClientAPI_EvalConfig_error_get(swigCPtr, this);
+  }
+
+  public void setMessage(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_message_set(swigCPtr, this, value);
+  }
+
+  public String getMessage() {
+    return ovpncliJNI.ClientAPI_EvalConfig_message_get(swigCPtr, this);
+  }
+
+  public void setUserlockedUsername(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_userlockedUsername_set(swigCPtr, this, value);
+  }
+
+  public String getUserlockedUsername() {
+    return ovpncliJNI.ClientAPI_EvalConfig_userlockedUsername_get(swigCPtr, this);
+  }
+
+  public void setProfileName(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_profileName_set(swigCPtr, this, value);
+  }
+
+  public String getProfileName() {
+    return ovpncliJNI.ClientAPI_EvalConfig_profileName_get(swigCPtr, this);
+  }
+
+  public void setFriendlyName(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_friendlyName_set(swigCPtr, this, value);
+  }
+
+  public String getFriendlyName() {
+    return ovpncliJNI.ClientAPI_EvalConfig_friendlyName_get(swigCPtr, this);
+  }
+
+  public void setAutologin(boolean value) {
+    ovpncliJNI.ClientAPI_EvalConfig_autologin_set(swigCPtr, this, value);
+  }
+
+  public boolean getAutologin() {
+    return ovpncliJNI.ClientAPI_EvalConfig_autologin_get(swigCPtr, this);
+  }
+
+  public void setExternalPki(boolean value) {
+    ovpncliJNI.ClientAPI_EvalConfig_externalPki_set(swigCPtr, this, value);
+  }
+
+  public boolean getExternalPki() {
+    return ovpncliJNI.ClientAPI_EvalConfig_externalPki_get(swigCPtr, this);
+  }
+
+  public void setStaticChallenge(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_staticChallenge_set(swigCPtr, this, value);
+  }
+
+  public String getStaticChallenge() {
+    return ovpncliJNI.ClientAPI_EvalConfig_staticChallenge_get(swigCPtr, this);
+  }
+
+  public void setStaticChallengeEcho(boolean value) {
+    ovpncliJNI.ClientAPI_EvalConfig_staticChallengeEcho_set(swigCPtr, this, value);
+  }
+
+  public boolean getStaticChallengeEcho() {
+    return ovpncliJNI.ClientAPI_EvalConfig_staticChallengeEcho_get(swigCPtr, this);
+  }
+
+  public void setPrivateKeyPasswordRequired(boolean value) {
+    ovpncliJNI.ClientAPI_EvalConfig_privateKeyPasswordRequired_set(swigCPtr, this, value);
+  }
+
+  public boolean getPrivateKeyPasswordRequired() {
+    return ovpncliJNI.ClientAPI_EvalConfig_privateKeyPasswordRequired_get(swigCPtr, this);
+  }
+
+  public void setAllowPasswordSave(boolean value) {
+    ovpncliJNI.ClientAPI_EvalConfig_allowPasswordSave_set(swigCPtr, this, value);
+  }
+
+  public boolean getAllowPasswordSave() {
+    return ovpncliJNI.ClientAPI_EvalConfig_allowPasswordSave_get(swigCPtr, this);
+  }
+
+  public void setRemoteHost(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_remoteHost_set(swigCPtr, this, value);
+  }
+
+  public String getRemoteHost() {
+    return ovpncliJNI.ClientAPI_EvalConfig_remoteHost_get(swigCPtr, this);
+  }
+
+  public void setRemotePort(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_remotePort_set(swigCPtr, this, value);
+  }
+
+  public String getRemotePort() {
+    return ovpncliJNI.ClientAPI_EvalConfig_remotePort_get(swigCPtr, this);
+  }
+
+  public void setRemoteProto(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_remoteProto_set(swigCPtr, this, value);
+  }
+
+  public String getRemoteProto() {
+    return ovpncliJNI.ClientAPI_EvalConfig_remoteProto_get(swigCPtr, this);
+  }
+
+  public void setServerList(ClientAPI_ServerEntryVector value) {
+    ovpncliJNI.ClientAPI_EvalConfig_serverList_set(swigCPtr, this, ClientAPI_ServerEntryVector.getCPtr(value), value);
+  }
+
+  public ClientAPI_ServerEntryVector getServerList() {
+    long cPtr = ovpncliJNI.ClientAPI_EvalConfig_serverList_get(swigCPtr, this);
+    return (cPtr == 0) ? null : new ClientAPI_ServerEntryVector(cPtr, false);
+  }
+
+  public void setWindowsDriver(String value) {
+    ovpncliJNI.ClientAPI_EvalConfig_windowsDriver_set(swigCPtr, this, value);
+  }
+
+  public String getWindowsDriver() {
+    return ovpncliJNI.ClientAPI_EvalConfig_windowsDriver_get(swigCPtr, this);
+  }
+
+  public ClientAPI_EvalConfig() {
+    this(ovpncliJNI.new_ClientAPI_EvalConfig(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_Event.java

@@ -0,0 +1,87 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_Event {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_Event(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_Event obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_Event obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_Event(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setError(boolean value) {
+    ovpncliJNI.ClientAPI_Event_error_set(swigCPtr, this, value);
+  }
+
+  public boolean getError() {
+    return ovpncliJNI.ClientAPI_Event_error_get(swigCPtr, this);
+  }
+
+  public void setFatal(boolean value) {
+    ovpncliJNI.ClientAPI_Event_fatal_set(swigCPtr, this, value);
+  }
+
+  public boolean getFatal() {
+    return ovpncliJNI.ClientAPI_Event_fatal_get(swigCPtr, this);
+  }
+
+  public void setName(String value) {
+    ovpncliJNI.ClientAPI_Event_name_set(swigCPtr, this, value);
+  }
+
+  public String getName() {
+    return ovpncliJNI.ClientAPI_Event_name_get(swigCPtr, this);
+  }
+
+  public void setInfo(String value) {
+    ovpncliJNI.ClientAPI_Event_info_set(swigCPtr, this, value);
+  }
+
+  public String getInfo() {
+    return ovpncliJNI.ClientAPI_Event_info_get(swigCPtr, this);
+  }
+
+  public ClientAPI_Event() {
+    this(ovpncliJNI.new_ClientAPI_Event(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ExternalPKIBase.java

@@ -0,0 +1,55 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ExternalPKIBase {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_ExternalPKIBase(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ExternalPKIBase obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ExternalPKIBase obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ExternalPKIBase(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public boolean sign(String data, SWIGTYPE_p_std__string sig, String algorithm) {
+    return ovpncliJNI.ClientAPI_ExternalPKIBase_sign(swigCPtr, this, data, SWIGTYPE_p_std__string.getCPtr(sig), algorithm);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ExternalPKICertRequest.java

@@ -0,0 +1,71 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ExternalPKICertRequest extends ClientAPI_ExternalPKIRequestBase {
+  private transient long swigCPtr;
+
+  protected ClientAPI_ExternalPKICertRequest(long cPtr, boolean cMemoryOwn) {
+    super(ovpncliJNI.ClientAPI_ExternalPKICertRequest_SWIGUpcast(cPtr), cMemoryOwn);
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ExternalPKICertRequest obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ExternalPKICertRequest obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ExternalPKICertRequest(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+    super.delete();
+  }
+
+  public void setCert(String value) {
+    ovpncliJNI.ClientAPI_ExternalPKICertRequest_cert_set(swigCPtr, this, value);
+  }
+
+  public String getCert() {
+    return ovpncliJNI.ClientAPI_ExternalPKICertRequest_cert_get(swigCPtr, this);
+  }
+
+  public void setSupportingChain(String value) {
+    ovpncliJNI.ClientAPI_ExternalPKICertRequest_supportingChain_set(swigCPtr, this, value);
+  }
+
+  public String getSupportingChain() {
+    return ovpncliJNI.ClientAPI_ExternalPKICertRequest_supportingChain_get(swigCPtr, this);
+  }
+
+  public ClientAPI_ExternalPKICertRequest() {
+    this(ovpncliJNI.new_ClientAPI_ExternalPKICertRequest(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ExternalPKIRequestBase.java

@@ -0,0 +1,87 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ExternalPKIRequestBase {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_ExternalPKIRequestBase(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ExternalPKIRequestBase obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ExternalPKIRequestBase obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ExternalPKIRequestBase(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setError(boolean value) {
+    ovpncliJNI.ClientAPI_ExternalPKIRequestBase_error_set(swigCPtr, this, value);
+  }
+
+  public boolean getError() {
+    return ovpncliJNI.ClientAPI_ExternalPKIRequestBase_error_get(swigCPtr, this);
+  }
+
+  public void setErrorText(String value) {
+    ovpncliJNI.ClientAPI_ExternalPKIRequestBase_errorText_set(swigCPtr, this, value);
+  }
+
+  public String getErrorText() {
+    return ovpncliJNI.ClientAPI_ExternalPKIRequestBase_errorText_get(swigCPtr, this);
+  }
+
+  public void setInvalidAlias(boolean value) {
+    ovpncliJNI.ClientAPI_ExternalPKIRequestBase_invalidAlias_set(swigCPtr, this, value);
+  }
+
+  public boolean getInvalidAlias() {
+    return ovpncliJNI.ClientAPI_ExternalPKIRequestBase_invalidAlias_get(swigCPtr, this);
+  }
+
+  public void setAlias(String value) {
+    ovpncliJNI.ClientAPI_ExternalPKIRequestBase_alias_set(swigCPtr, this, value);
+  }
+
+  public String getAlias() {
+    return ovpncliJNI.ClientAPI_ExternalPKIRequestBase_alias_get(swigCPtr, this);
+  }
+
+  public ClientAPI_ExternalPKIRequestBase() {
+    this(ovpncliJNI.new_ClientAPI_ExternalPKIRequestBase(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ExternalPKISignRequest.java

@@ -0,0 +1,79 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ExternalPKISignRequest extends ClientAPI_ExternalPKIRequestBase {
+  private transient long swigCPtr;
+
+  protected ClientAPI_ExternalPKISignRequest(long cPtr, boolean cMemoryOwn) {
+    super(ovpncliJNI.ClientAPI_ExternalPKISignRequest_SWIGUpcast(cPtr), cMemoryOwn);
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ExternalPKISignRequest obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ExternalPKISignRequest obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ExternalPKISignRequest(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+    super.delete();
+  }
+
+  public void setData(String value) {
+    ovpncliJNI.ClientAPI_ExternalPKISignRequest_data_set(swigCPtr, this, value);
+  }
+
+  public String getData() {
+    return ovpncliJNI.ClientAPI_ExternalPKISignRequest_data_get(swigCPtr, this);
+  }
+
+  public void setSig(String value) {
+    ovpncliJNI.ClientAPI_ExternalPKISignRequest_sig_set(swigCPtr, this, value);
+  }
+
+  public String getSig() {
+    return ovpncliJNI.ClientAPI_ExternalPKISignRequest_sig_get(swigCPtr, this);
+  }
+
+  public void setAlgorithm(String value) {
+    ovpncliJNI.ClientAPI_ExternalPKISignRequest_algorithm_set(swigCPtr, this, value);
+  }
+
+  public String getAlgorithm() {
+    return ovpncliJNI.ClientAPI_ExternalPKISignRequest_algorithm_get(swigCPtr, this);
+  }
+
+  public ClientAPI_ExternalPKISignRequest() {
+    this(ovpncliJNI.new_ClientAPI_ExternalPKISignRequest(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_InterfaceStats.java

@@ -0,0 +1,103 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_InterfaceStats {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_InterfaceStats(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_InterfaceStats obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_InterfaceStats obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_InterfaceStats(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setBytesIn(long value) {
+    ovpncliJNI.ClientAPI_InterfaceStats_bytesIn_set(swigCPtr, this, value);
+  }
+
+  public long getBytesIn() {
+    return ovpncliJNI.ClientAPI_InterfaceStats_bytesIn_get(swigCPtr, this);
+  }
+
+  public void setPacketsIn(long value) {
+    ovpncliJNI.ClientAPI_InterfaceStats_packetsIn_set(swigCPtr, this, value);
+  }
+
+  public long getPacketsIn() {
+    return ovpncliJNI.ClientAPI_InterfaceStats_packetsIn_get(swigCPtr, this);
+  }
+
+  public void setErrorsIn(long value) {
+    ovpncliJNI.ClientAPI_InterfaceStats_errorsIn_set(swigCPtr, this, value);
+  }
+
+  public long getErrorsIn() {
+    return ovpncliJNI.ClientAPI_InterfaceStats_errorsIn_get(swigCPtr, this);
+  }
+
+  public void setBytesOut(long value) {
+    ovpncliJNI.ClientAPI_InterfaceStats_bytesOut_set(swigCPtr, this, value);
+  }
+
+  public long getBytesOut() {
+    return ovpncliJNI.ClientAPI_InterfaceStats_bytesOut_get(swigCPtr, this);
+  }
+
+  public void setPacketsOut(long value) {
+    ovpncliJNI.ClientAPI_InterfaceStats_packetsOut_set(swigCPtr, this, value);
+  }
+
+  public long getPacketsOut() {
+    return ovpncliJNI.ClientAPI_InterfaceStats_packetsOut_get(swigCPtr, this);
+  }
+
+  public void setErrorsOut(long value) {
+    ovpncliJNI.ClientAPI_InterfaceStats_errorsOut_set(swigCPtr, this, value);
+  }
+
+  public long getErrorsOut() {
+    return ovpncliJNI.ClientAPI_InterfaceStats_errorsOut_get(swigCPtr, this);
+  }
+
+  public ClientAPI_InterfaceStats() {
+    this(ovpncliJNI.new_ClientAPI_InterfaceStats(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_KeyValue.java

@@ -0,0 +1,75 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_KeyValue {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_KeyValue(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_KeyValue obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_KeyValue obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_KeyValue(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public ClientAPI_KeyValue() {
+    this(ovpncliJNI.new_ClientAPI_KeyValue__SWIG_0(), true);
+  }
+
+  public ClientAPI_KeyValue(String key_arg, String value_arg) {
+    this(ovpncliJNI.new_ClientAPI_KeyValue__SWIG_1(key_arg, value_arg), true);
+  }
+
+  public void setKey(String value) {
+    ovpncliJNI.ClientAPI_KeyValue_key_set(swigCPtr, this, value);
+  }
+
+  public String getKey() {
+    return ovpncliJNI.ClientAPI_KeyValue_key_get(swigCPtr, this);
+  }
+
+  public void setValue(String value) {
+    ovpncliJNI.ClientAPI_KeyValue_value_set(swigCPtr, this, value);
+  }
+
+  public String getValue() {
+    return ovpncliJNI.ClientAPI_KeyValue_value_get(swigCPtr, this);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_LLVector.java

@@ -0,0 +1,156 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_LLVector extends java.util.AbstractList<Long> implements java.util.RandomAccess {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_LLVector(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_LLVector obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_LLVector obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_LLVector(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public ClientAPI_LLVector(long[] initialElements) {
+    this();
+    reserve(initialElements.length);
+
+    for (long element : initialElements) {
+      add(element);
+    }
+  }
+
+  public ClientAPI_LLVector(Iterable<Long> initialElements) {
+    this();
+    for (long element : initialElements) {
+      add(element);
+    }
+  }
+
+  public Long get(int index) {
+    return doGet(index);
+  }
+
+  public Long set(int index, Long e) {
+    return doSet(index, e);
+  }
+
+  public boolean add(Long e) {
+    modCount++;
+    doAdd(e);
+    return true;
+  }
+
+  public void add(int index, Long e) {
+    modCount++;
+    doAdd(index, e);
+  }
+
+  public Long remove(int index) {
+    modCount++;
+    return doRemove(index);
+  }
+
+  protected void removeRange(int fromIndex, int toIndex) {
+    modCount++;
+    doRemoveRange(fromIndex, toIndex);
+  }
+
+  public int size() {
+    return doSize();
+  }
+
+  public ClientAPI_LLVector() {
+    this(ovpncliJNI.new_ClientAPI_LLVector__SWIG_0(), true);
+  }
+
+  public ClientAPI_LLVector(ClientAPI_LLVector other) {
+    this(ovpncliJNI.new_ClientAPI_LLVector__SWIG_1(ClientAPI_LLVector.getCPtr(other), other), true);
+  }
+
+  public long capacity() {
+    return ovpncliJNI.ClientAPI_LLVector_capacity(swigCPtr, this);
+  }
+
+  public void reserve(long n) {
+    ovpncliJNI.ClientAPI_LLVector_reserve(swigCPtr, this, n);
+  }
+
+  public boolean isEmpty() {
+    return ovpncliJNI.ClientAPI_LLVector_isEmpty(swigCPtr, this);
+  }
+
+  public void clear() {
+    ovpncliJNI.ClientAPI_LLVector_clear(swigCPtr, this);
+  }
+
+  public ClientAPI_LLVector(int count, long value) {
+    this(ovpncliJNI.new_ClientAPI_LLVector__SWIG_2(count, value), true);
+  }
+
+  private int doSize() {
+    return ovpncliJNI.ClientAPI_LLVector_doSize(swigCPtr, this);
+  }
+
+  private void doAdd(long x) {
+    ovpncliJNI.ClientAPI_LLVector_doAdd__SWIG_0(swigCPtr, this, x);
+  }
+
+  private void doAdd(int index, long x) {
+    ovpncliJNI.ClientAPI_LLVector_doAdd__SWIG_1(swigCPtr, this, index, x);
+  }
+
+  private long doRemove(int index) {
+    return ovpncliJNI.ClientAPI_LLVector_doRemove(swigCPtr, this, index);
+  }
+
+  private long doGet(int index) {
+    return ovpncliJNI.ClientAPI_LLVector_doGet(swigCPtr, this, index);
+  }
+
+  private long doSet(int index, long val) {
+    return ovpncliJNI.ClientAPI_LLVector_doSet(swigCPtr, this, index, val);
+  }
+
+  private void doRemoveRange(int fromIndex, int toIndex) {
+    ovpncliJNI.ClientAPI_LLVector_doRemoveRange(swigCPtr, this, fromIndex, toIndex);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_LogInfo.java

@@ -0,0 +1,67 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_LogInfo {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_LogInfo(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_LogInfo obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_LogInfo obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_LogInfo(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public ClientAPI_LogInfo() {
+    this(ovpncliJNI.new_ClientAPI_LogInfo__SWIG_0(), true);
+  }
+
+  public ClientAPI_LogInfo(String str) {
+    this(ovpncliJNI.new_ClientAPI_LogInfo__SWIG_1(str), true);
+  }
+
+  public void setText(String value) {
+    ovpncliJNI.ClientAPI_LogInfo_text_set(swigCPtr, this, value);
+  }
+
+  public String getText() {
+    return ovpncliJNI.ClientAPI_LogInfo_text_get(swigCPtr, this);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_MergeConfig.java

@@ -0,0 +1,96 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_MergeConfig {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_MergeConfig(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_MergeConfig obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_MergeConfig obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_MergeConfig(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setStatus(String value) {
+    ovpncliJNI.ClientAPI_MergeConfig_status_set(swigCPtr, this, value);
+  }
+
+  public String getStatus() {
+    return ovpncliJNI.ClientAPI_MergeConfig_status_get(swigCPtr, this);
+  }
+
+  public void setErrorText(String value) {
+    ovpncliJNI.ClientAPI_MergeConfig_errorText_set(swigCPtr, this, value);
+  }
+
+  public String getErrorText() {
+    return ovpncliJNI.ClientAPI_MergeConfig_errorText_get(swigCPtr, this);
+  }
+
+  public void setBasename(String value) {
+    ovpncliJNI.ClientAPI_MergeConfig_basename_set(swigCPtr, this, value);
+  }
+
+  public String getBasename() {
+    return ovpncliJNI.ClientAPI_MergeConfig_basename_get(swigCPtr, this);
+  }
+
+  public void setProfileContent(String value) {
+    ovpncliJNI.ClientAPI_MergeConfig_profileContent_set(swigCPtr, this, value);
+  }
+
+  public String getProfileContent() {
+    return ovpncliJNI.ClientAPI_MergeConfig_profileContent_get(swigCPtr, this);
+  }
+
+  public void setRefPathList(ClientAPI_StringVec value) {
+    ovpncliJNI.ClientAPI_MergeConfig_refPathList_set(swigCPtr, this, ClientAPI_StringVec.getCPtr(value), value);
+  }
+
+  public ClientAPI_StringVec getRefPathList() {
+    long cPtr = ovpncliJNI.ClientAPI_MergeConfig_refPathList_get(swigCPtr, this);
+    return (cPtr == 0) ? null : new ClientAPI_StringVec(cPtr, false);
+  }
+
+  public ClientAPI_MergeConfig() {
+    this(ovpncliJNI.new_ClientAPI_MergeConfig(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_OpenVPNClient.java

@@ -0,0 +1,171 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_OpenVPNClient extends ClientAPI_TunBuilderBase {
+  private transient long swigCPtr;
+
+  protected ClientAPI_OpenVPNClient(long cPtr, boolean cMemoryOwn) {
+    super(ovpncliJNI.ClientAPI_OpenVPNClient_SWIGUpcast(cPtr), cMemoryOwn);
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_OpenVPNClient obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_OpenVPNClient obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_OpenVPNClient(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+    super.delete();
+  }
+
+  protected void swigDirectorDisconnect() {
+    swigCMemOwn = false;
+    delete();
+  }
+
+  public void swigReleaseOwnership() {
+    swigCMemOwn = false;
+    ovpncliJNI.ClientAPI_OpenVPNClient_change_ownership(this, swigCPtr, false);
+  }
+
+  public void swigTakeOwnership() {
+    swigCMemOwn = true;
+    ovpncliJNI.ClientAPI_OpenVPNClient_change_ownership(this, swigCPtr, true);
+  }
+
+  public ClientAPI_OpenVPNClient() {
+    this(ovpncliJNI.new_ClientAPI_OpenVPNClient(), true);
+    ovpncliJNI.ClientAPI_OpenVPNClient_director_connect(this, swigCPtr, true, true);
+  }
+
+  public ClientAPI_EvalConfig eval_config(ClientAPI_Config arg0) {
+    return new ClientAPI_EvalConfig(ovpncliJNI.ClientAPI_OpenVPNClient_eval_config(swigCPtr, this, ClientAPI_Config.getCPtr(arg0), arg0), true);
+  }
+
+  public ClientAPI_Status provide_creds(ClientAPI_ProvideCreds arg0) {
+    return new ClientAPI_Status(ovpncliJNI.ClientAPI_OpenVPNClient_provide_creds(swigCPtr, this, ClientAPI_ProvideCreds.getCPtr(arg0), arg0), true);
+  }
+
+  public boolean socket_protect(int socket, String remote, boolean ipv6) {
+    return (getClass() == ClientAPI_OpenVPNClient.class) ? ovpncliJNI.ClientAPI_OpenVPNClient_socket_protect(swigCPtr, this, socket, remote, ipv6) : ovpncliJNI.ClientAPI_OpenVPNClient_socket_protectSwigExplicitClientAPI_OpenVPNClient(swigCPtr, this, socket, remote, ipv6);
+  }
+
+  public ClientAPI_Status connect() {
+    return new ClientAPI_Status(ovpncliJNI.ClientAPI_OpenVPNClient_connect(swigCPtr, this), true);
+  }
+
+  public ClientAPI_ConnectionInfo connection_info() {
+    return new ClientAPI_ConnectionInfo(ovpncliJNI.ClientAPI_OpenVPNClient_connection_info(swigCPtr, this), true);
+  }
+
+  public boolean session_token(ClientAPI_SessionToken tok) {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_session_token(swigCPtr, this, ClientAPI_SessionToken.getCPtr(tok), tok);
+  }
+
+  public void stop() {
+    ovpncliJNI.ClientAPI_OpenVPNClient_stop(swigCPtr, this);
+  }
+
+  public void pause(String reason) {
+    ovpncliJNI.ClientAPI_OpenVPNClient_pause(swigCPtr, this, reason);
+  }
+
+  public void resume() {
+    ovpncliJNI.ClientAPI_OpenVPNClient_resume(swigCPtr, this);
+  }
+
+  public void reconnect(int seconds) {
+    ovpncliJNI.ClientAPI_OpenVPNClient_reconnect(swigCPtr, this, seconds);
+  }
+
+  public boolean pause_on_connection_timeout() {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_pause_on_connection_timeout(swigCPtr, this);
+  }
+
+  public static int stats_n() {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_stats_n();
+  }
+
+  public static String stats_name(int index) {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_stats_name(index);
+  }
+
+  public long stats_value(int index) {
+    return ovpncliJNI.ClientAPI_OpenVPNClient_stats_value(swigCPtr, this, index);
+  }
+
+  public ClientAPI_LLVector stats_bundle() {
+    return new ClientAPI_LLVector(ovpncliJNI.ClientAPI_OpenVPNClient_stats_bundle(swigCPtr, this), true);
+  }
+
+  public ClientAPI_InterfaceStats tun_stats() {
+    return new ClientAPI_InterfaceStats(ovpncliJNI.ClientAPI_OpenVPNClient_tun_stats(swigCPtr, this), true);
+  }
+
+  public ClientAPI_TransportStats transport_stats() {
+    return new ClientAPI_TransportStats(ovpncliJNI.ClientAPI_OpenVPNClient_transport_stats(swigCPtr, this), true);
+  }
+
+  public void post_cc_msg(String msg) {
+    ovpncliJNI.ClientAPI_OpenVPNClient_post_cc_msg(swigCPtr, this, msg);
+  }
+
+  public void event(ClientAPI_Event arg0) {
+    ovpncliJNI.ClientAPI_OpenVPNClient_event(swigCPtr, this, ClientAPI_Event.getCPtr(arg0), arg0);
+  }
+
+  public void log(ClientAPI_LogInfo arg0) {
+    ovpncliJNI.ClientAPI_OpenVPNClient_log(swigCPtr, this, ClientAPI_LogInfo.getCPtr(arg0), arg0);
+  }
+
+  public void external_pki_cert_request(ClientAPI_ExternalPKICertRequest arg0) {
+    ovpncliJNI.ClientAPI_OpenVPNClient_external_pki_cert_request(swigCPtr, this, ClientAPI_ExternalPKICertRequest.getCPtr(arg0), arg0);
+  }
+
+  public void external_pki_sign_request(ClientAPI_ExternalPKISignRequest arg0) {
+    ovpncliJNI.ClientAPI_OpenVPNClient_external_pki_sign_request(swigCPtr, this, ClientAPI_ExternalPKISignRequest.getCPtr(arg0), arg0);
+  }
+
+  public boolean remote_override_enabled() {
+    return (getClass() == ClientAPI_OpenVPNClient.class) ? ovpncliJNI.ClientAPI_OpenVPNClient_remote_override_enabled(swigCPtr, this) : ovpncliJNI.ClientAPI_OpenVPNClient_remote_override_enabledSwigExplicitClientAPI_OpenVPNClient(swigCPtr, this);
+  }
+
+  public void remote_override(ClientAPI_RemoteOverride arg0) {
+    if (getClass() == ClientAPI_OpenVPNClient.class) ovpncliJNI.ClientAPI_OpenVPNClient_remote_override(swigCPtr, this, ClientAPI_RemoteOverride.getCPtr(arg0), arg0); else ovpncliJNI.ClientAPI_OpenVPNClient_remote_overrideSwigExplicitClientAPI_OpenVPNClient(swigCPtr, this, ClientAPI_RemoteOverride.getCPtr(arg0), arg0);
+  }
+
+  public void clock_tick() {
+    if (getClass() == ClientAPI_OpenVPNClient.class) ovpncliJNI.ClientAPI_OpenVPNClient_clock_tick(swigCPtr, this); else ovpncliJNI.ClientAPI_OpenVPNClient_clock_tickSwigExplicitClientAPI_OpenVPNClient(swigCPtr, this);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_OpenVPNClientHelper.java

@@ -0,0 +1,87 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_OpenVPNClientHelper {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_OpenVPNClientHelper(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_OpenVPNClientHelper obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_OpenVPNClientHelper obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_OpenVPNClientHelper(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public ClientAPI_OpenVPNClientHelper() {
+    this(ovpncliJNI.new_ClientAPI_OpenVPNClientHelper(), true);
+  }
+
+  public ClientAPI_MergeConfig merge_config(String path, boolean follow_references) {
+    return new ClientAPI_MergeConfig(ovpncliJNI.ClientAPI_OpenVPNClientHelper_merge_config(swigCPtr, this, path, follow_references), true);
+  }
+
+  public ClientAPI_MergeConfig merge_config_string(String config_content) {
+    return new ClientAPI_MergeConfig(ovpncliJNI.ClientAPI_OpenVPNClientHelper_merge_config_string(swigCPtr, this, config_content), true);
+  }
+
+  public ClientAPI_EvalConfig eval_config(ClientAPI_Config config) {
+    return new ClientAPI_EvalConfig(ovpncliJNI.ClientAPI_OpenVPNClientHelper_eval_config(swigCPtr, this, ClientAPI_Config.getCPtr(config), config), true);
+  }
+
+  public static int max_profile_size() {
+    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_max_profile_size();
+  }
+
+  public static boolean parse_dynamic_challenge(String cookie, ClientAPI_DynamicChallenge dc) {
+    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_parse_dynamic_challenge(cookie, ClientAPI_DynamicChallenge.getCPtr(dc), dc);
+  }
+
+  public String crypto_self_test() {
+    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_crypto_self_test(swigCPtr, this);
+  }
+
+  public static String platform() {
+    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_platform();
+  }
+
+  public static String copyright() {
+    return ovpncliJNI.ClientAPI_OpenVPNClientHelper_copyright();
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ProvideCreds.java

@@ -0,0 +1,119 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ProvideCreds {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_ProvideCreds(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ProvideCreds obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ProvideCreds obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ProvideCreds(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setUsername(String value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_username_set(swigCPtr, this, value);
+  }
+
+  public String getUsername() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_username_get(swigCPtr, this);
+  }
+
+  public void setPassword(String value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_password_set(swigCPtr, this, value);
+  }
+
+  public String getPassword() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_password_get(swigCPtr, this);
+  }
+
+  public void setHttp_proxy_user(String value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_http_proxy_user_set(swigCPtr, this, value);
+  }
+
+  public String getHttp_proxy_user() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_http_proxy_user_get(swigCPtr, this);
+  }
+
+  public void setHttp_proxy_pass(String value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_http_proxy_pass_set(swigCPtr, this, value);
+  }
+
+  public String getHttp_proxy_pass() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_http_proxy_pass_get(swigCPtr, this);
+  }
+
+  public void setResponse(String value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_response_set(swigCPtr, this, value);
+  }
+
+  public String getResponse() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_response_get(swigCPtr, this);
+  }
+
+  public void setDynamicChallengeCookie(String value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_dynamicChallengeCookie_set(swigCPtr, this, value);
+  }
+
+  public String getDynamicChallengeCookie() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_dynamicChallengeCookie_get(swigCPtr, this);
+  }
+
+  public void setReplacePasswordWithSessionID(boolean value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_replacePasswordWithSessionID_set(swigCPtr, this, value);
+  }
+
+  public boolean getReplacePasswordWithSessionID() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_replacePasswordWithSessionID_get(swigCPtr, this);
+  }
+
+  public void setCachePassword(boolean value) {
+    ovpncliJNI.ClientAPI_ProvideCreds_cachePassword_set(swigCPtr, this, value);
+  }
+
+  public boolean getCachePassword() {
+    return ovpncliJNI.ClientAPI_ProvideCreds_cachePassword_get(swigCPtr, this);
+  }
+
+  public ClientAPI_ProvideCreds() {
+    this(ovpncliJNI.new_ClientAPI_ProvideCreds(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_RemoteOverride.java

@@ -0,0 +1,95 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_RemoteOverride {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_RemoteOverride(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_RemoteOverride obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_RemoteOverride obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_RemoteOverride(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setHost(String value) {
+    ovpncliJNI.ClientAPI_RemoteOverride_host_set(swigCPtr, this, value);
+  }
+
+  public String getHost() {
+    return ovpncliJNI.ClientAPI_RemoteOverride_host_get(swigCPtr, this);
+  }
+
+  public void setIp(String value) {
+    ovpncliJNI.ClientAPI_RemoteOverride_ip_set(swigCPtr, this, value);
+  }
+
+  public String getIp() {
+    return ovpncliJNI.ClientAPI_RemoteOverride_ip_get(swigCPtr, this);
+  }
+
+  public void setPort(String value) {
+    ovpncliJNI.ClientAPI_RemoteOverride_port_set(swigCPtr, this, value);
+  }
+
+  public String getPort() {
+    return ovpncliJNI.ClientAPI_RemoteOverride_port_get(swigCPtr, this);
+  }
+
+  public void setProto(String value) {
+    ovpncliJNI.ClientAPI_RemoteOverride_proto_set(swigCPtr, this, value);
+  }
+
+  public String getProto() {
+    return ovpncliJNI.ClientAPI_RemoteOverride_proto_get(swigCPtr, this);
+  }
+
+  public void setError(String value) {
+    ovpncliJNI.ClientAPI_RemoteOverride_error_set(swigCPtr, this, value);
+  }
+
+  public String getError() {
+    return ovpncliJNI.ClientAPI_RemoteOverride_error_get(swigCPtr, this);
+  }
+
+  public ClientAPI_RemoteOverride() {
+    this(ovpncliJNI.new_ClientAPI_RemoteOverride(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ServerEntry.java

@@ -0,0 +1,71 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ServerEntry {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_ServerEntry(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ServerEntry obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ServerEntry obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ServerEntry(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setServer(String value) {
+    ovpncliJNI.ClientAPI_ServerEntry_server_set(swigCPtr, this, value);
+  }
+
+  public String getServer() {
+    return ovpncliJNI.ClientAPI_ServerEntry_server_get(swigCPtr, this);
+  }
+
+  public void setFriendlyName(String value) {
+    ovpncliJNI.ClientAPI_ServerEntry_friendlyName_set(swigCPtr, this, value);
+  }
+
+  public String getFriendlyName() {
+    return ovpncliJNI.ClientAPI_ServerEntry_friendlyName_get(swigCPtr, this);
+  }
+
+  public ClientAPI_ServerEntry() {
+    this(ovpncliJNI.new_ClientAPI_ServerEntry(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_ServerEntryVector.java

@@ -0,0 +1,156 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_ServerEntryVector extends java.util.AbstractList<ClientAPI_ServerEntry> implements java.util.RandomAccess {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_ServerEntryVector(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_ServerEntryVector obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_ServerEntryVector obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_ServerEntryVector(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public ClientAPI_ServerEntryVector(ClientAPI_ServerEntry[] initialElements) {
+    this();
+    reserve(initialElements.length);
+
+    for (ClientAPI_ServerEntry element : initialElements) {
+      add(element);
+    }
+  }
+
+  public ClientAPI_ServerEntryVector(Iterable<ClientAPI_ServerEntry> initialElements) {
+    this();
+    for (ClientAPI_ServerEntry element : initialElements) {
+      add(element);
+    }
+  }
+
+  public ClientAPI_ServerEntry get(int index) {
+    return doGet(index);
+  }
+
+  public ClientAPI_ServerEntry set(int index, ClientAPI_ServerEntry e) {
+    return doSet(index, e);
+  }
+
+  public boolean add(ClientAPI_ServerEntry e) {
+    modCount++;
+    doAdd(e);
+    return true;
+  }
+
+  public void add(int index, ClientAPI_ServerEntry e) {
+    modCount++;
+    doAdd(index, e);
+  }
+
+  public ClientAPI_ServerEntry remove(int index) {
+    modCount++;
+    return doRemove(index);
+  }
+
+  protected void removeRange(int fromIndex, int toIndex) {
+    modCount++;
+    doRemoveRange(fromIndex, toIndex);
+  }
+
+  public int size() {
+    return doSize();
+  }
+
+  public ClientAPI_ServerEntryVector() {
+    this(ovpncliJNI.new_ClientAPI_ServerEntryVector__SWIG_0(), true);
+  }
+
+  public ClientAPI_ServerEntryVector(ClientAPI_ServerEntryVector other) {
+    this(ovpncliJNI.new_ClientAPI_ServerEntryVector__SWIG_1(ClientAPI_ServerEntryVector.getCPtr(other), other), true);
+  }
+
+  public long capacity() {
+    return ovpncliJNI.ClientAPI_ServerEntryVector_capacity(swigCPtr, this);
+  }
+
+  public void reserve(long n) {
+    ovpncliJNI.ClientAPI_ServerEntryVector_reserve(swigCPtr, this, n);
+  }
+
+  public boolean isEmpty() {
+    return ovpncliJNI.ClientAPI_ServerEntryVector_isEmpty(swigCPtr, this);
+  }
+
+  public void clear() {
+    ovpncliJNI.ClientAPI_ServerEntryVector_clear(swigCPtr, this);
+  }
+
+  public ClientAPI_ServerEntryVector(int count, ClientAPI_ServerEntry value) {
+    this(ovpncliJNI.new_ClientAPI_ServerEntryVector__SWIG_2(count, ClientAPI_ServerEntry.getCPtr(value), value), true);
+  }
+
+  private int doSize() {
+    return ovpncliJNI.ClientAPI_ServerEntryVector_doSize(swigCPtr, this);
+  }
+
+  private void doAdd(ClientAPI_ServerEntry x) {
+    ovpncliJNI.ClientAPI_ServerEntryVector_doAdd__SWIG_0(swigCPtr, this, ClientAPI_ServerEntry.getCPtr(x), x);
+  }
+
+  private void doAdd(int index, ClientAPI_ServerEntry x) {
+    ovpncliJNI.ClientAPI_ServerEntryVector_doAdd__SWIG_1(swigCPtr, this, index, ClientAPI_ServerEntry.getCPtr(x), x);
+  }
+
+  private ClientAPI_ServerEntry doRemove(int index) {
+    return new ClientAPI_ServerEntry(ovpncliJNI.ClientAPI_ServerEntryVector_doRemove(swigCPtr, this, index), true);
+  }
+
+  private ClientAPI_ServerEntry doGet(int index) {
+    return new ClientAPI_ServerEntry(ovpncliJNI.ClientAPI_ServerEntryVector_doGet(swigCPtr, this, index), false);
+  }
+
+  private ClientAPI_ServerEntry doSet(int index, ClientAPI_ServerEntry val) {
+    return new ClientAPI_ServerEntry(ovpncliJNI.ClientAPI_ServerEntryVector_doSet(swigCPtr, this, index, ClientAPI_ServerEntry.getCPtr(val), val), true);
+  }
+
+  private void doRemoveRange(int fromIndex, int toIndex) {
+    ovpncliJNI.ClientAPI_ServerEntryVector_doRemoveRange(swigCPtr, this, fromIndex, toIndex);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_SessionToken.java

@@ -0,0 +1,71 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_SessionToken {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_SessionToken(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_SessionToken obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_SessionToken obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_SessionToken(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setUsername(String value) {
+    ovpncliJNI.ClientAPI_SessionToken_username_set(swigCPtr, this, value);
+  }
+
+  public String getUsername() {
+    return ovpncliJNI.ClientAPI_SessionToken_username_get(swigCPtr, this);
+  }
+
+  public void setSession_id(String value) {
+    ovpncliJNI.ClientAPI_SessionToken_session_id_set(swigCPtr, this, value);
+  }
+
+  public String getSession_id() {
+    return ovpncliJNI.ClientAPI_SessionToken_session_id_get(swigCPtr, this);
+  }
+
+  public ClientAPI_SessionToken() {
+    this(ovpncliJNI.new_ClientAPI_SessionToken(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_Status.java

@@ -0,0 +1,79 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_Status {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_Status(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_Status obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_Status obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_Status(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setError(boolean value) {
+    ovpncliJNI.ClientAPI_Status_error_set(swigCPtr, this, value);
+  }
+
+  public boolean getError() {
+    return ovpncliJNI.ClientAPI_Status_error_get(swigCPtr, this);
+  }
+
+  public void setStatus(String value) {
+    ovpncliJNI.ClientAPI_Status_status_set(swigCPtr, this, value);
+  }
+
+  public String getStatus() {
+    return ovpncliJNI.ClientAPI_Status_status_get(swigCPtr, this);
+  }
+
+  public void setMessage(String value) {
+    ovpncliJNI.ClientAPI_Status_message_set(swigCPtr, this, value);
+  }
+
+  public String getMessage() {
+    return ovpncliJNI.ClientAPI_Status_message_get(swigCPtr, this);
+  }
+
+  public ClientAPI_Status() {
+    this(ovpncliJNI.new_ClientAPI_Status(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_StringVec.java

@@ -0,0 +1,156 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_StringVec extends java.util.AbstractList<String> implements java.util.RandomAccess {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_StringVec(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_StringVec obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_StringVec obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_StringVec(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public ClientAPI_StringVec(String[] initialElements) {
+    this();
+    reserve(initialElements.length);
+
+    for (String element : initialElements) {
+      add(element);
+    }
+  }
+
+  public ClientAPI_StringVec(Iterable<String> initialElements) {
+    this();
+    for (String element : initialElements) {
+      add(element);
+    }
+  }
+
+  public String get(int index) {
+    return doGet(index);
+  }
+
+  public String set(int index, String e) {
+    return doSet(index, e);
+  }
+
+  public boolean add(String e) {
+    modCount++;
+    doAdd(e);
+    return true;
+  }
+
+  public void add(int index, String e) {
+    modCount++;
+    doAdd(index, e);
+  }
+
+  public String remove(int index) {
+    modCount++;
+    return doRemove(index);
+  }
+
+  protected void removeRange(int fromIndex, int toIndex) {
+    modCount++;
+    doRemoveRange(fromIndex, toIndex);
+  }
+
+  public int size() {
+    return doSize();
+  }
+
+  public ClientAPI_StringVec() {
+    this(ovpncliJNI.new_ClientAPI_StringVec__SWIG_0(), true);
+  }
+
+  public ClientAPI_StringVec(ClientAPI_StringVec other) {
+    this(ovpncliJNI.new_ClientAPI_StringVec__SWIG_1(ClientAPI_StringVec.getCPtr(other), other), true);
+  }
+
+  public long capacity() {
+    return ovpncliJNI.ClientAPI_StringVec_capacity(swigCPtr, this);
+  }
+
+  public void reserve(long n) {
+    ovpncliJNI.ClientAPI_StringVec_reserve(swigCPtr, this, n);
+  }
+
+  public boolean isEmpty() {
+    return ovpncliJNI.ClientAPI_StringVec_isEmpty(swigCPtr, this);
+  }
+
+  public void clear() {
+    ovpncliJNI.ClientAPI_StringVec_clear(swigCPtr, this);
+  }
+
+  public ClientAPI_StringVec(int count, String value) {
+    this(ovpncliJNI.new_ClientAPI_StringVec__SWIG_2(count, value), true);
+  }
+
+  private int doSize() {
+    return ovpncliJNI.ClientAPI_StringVec_doSize(swigCPtr, this);
+  }
+
+  private void doAdd(String x) {
+    ovpncliJNI.ClientAPI_StringVec_doAdd__SWIG_0(swigCPtr, this, x);
+  }
+
+  private void doAdd(int index, String x) {
+    ovpncliJNI.ClientAPI_StringVec_doAdd__SWIG_1(swigCPtr, this, index, x);
+  }
+
+  private String doRemove(int index) {
+    return ovpncliJNI.ClientAPI_StringVec_doRemove(swigCPtr, this, index);
+  }
+
+  private String doGet(int index) {
+    return ovpncliJNI.ClientAPI_StringVec_doGet(swigCPtr, this, index);
+  }
+
+  private String doSet(int index, String val) {
+    return ovpncliJNI.ClientAPI_StringVec_doSet(swigCPtr, this, index, val);
+  }
+
+  private void doRemoveRange(int fromIndex, int toIndex) {
+    ovpncliJNI.ClientAPI_StringVec_doRemoveRange(swigCPtr, this, fromIndex, toIndex);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_TransportStats.java

@@ -0,0 +1,95 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_TransportStats {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_TransportStats(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_TransportStats obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_TransportStats obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_TransportStats(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public void setBytesIn(long value) {
+    ovpncliJNI.ClientAPI_TransportStats_bytesIn_set(swigCPtr, this, value);
+  }
+
+  public long getBytesIn() {
+    return ovpncliJNI.ClientAPI_TransportStats_bytesIn_get(swigCPtr, this);
+  }
+
+  public void setBytesOut(long value) {
+    ovpncliJNI.ClientAPI_TransportStats_bytesOut_set(swigCPtr, this, value);
+  }
+
+  public long getBytesOut() {
+    return ovpncliJNI.ClientAPI_TransportStats_bytesOut_get(swigCPtr, this);
+  }
+
+  public void setPacketsIn(long value) {
+    ovpncliJNI.ClientAPI_TransportStats_packetsIn_set(swigCPtr, this, value);
+  }
+
+  public long getPacketsIn() {
+    return ovpncliJNI.ClientAPI_TransportStats_packetsIn_get(swigCPtr, this);
+  }
+
+  public void setPacketsOut(long value) {
+    ovpncliJNI.ClientAPI_TransportStats_packetsOut_set(swigCPtr, this, value);
+  }
+
+  public long getPacketsOut() {
+    return ovpncliJNI.ClientAPI_TransportStats_packetsOut_get(swigCPtr, this);
+  }
+
+  public void setLastPacketReceived(int value) {
+    ovpncliJNI.ClientAPI_TransportStats_lastPacketReceived_set(swigCPtr, this, value);
+  }
+
+  public int getLastPacketReceived() {
+    return ovpncliJNI.ClientAPI_TransportStats_lastPacketReceived_get(swigCPtr, this);
+  }
+
+  public ClientAPI_TransportStats() {
+    this(ovpncliJNI.new_ClientAPI_TransportStats(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ClientAPI_TunBuilderBase.java

@@ -0,0 +1,151 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ClientAPI_TunBuilderBase {
+  private transient long swigCPtr;
+  protected transient boolean swigCMemOwn;
+
+  protected ClientAPI_TunBuilderBase(long cPtr, boolean cMemoryOwn) {
+    swigCMemOwn = cMemoryOwn;
+    swigCPtr = cPtr;
+  }
+
+  protected static long getCPtr(ClientAPI_TunBuilderBase obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(ClientAPI_TunBuilderBase obj) {
+    long ptr = 0;
+    if (obj != null) {
+      if (!obj.swigCMemOwn)
+        throw new RuntimeException("Cannot release ownership as memory is not owned");
+      ptr = obj.swigCPtr;
+      obj.swigCMemOwn = false;
+      obj.delete();
+    }
+    return ptr;
+  }
+
+  @SuppressWarnings("deprecation")
+  protected void finalize() {
+    delete();
+  }
+
+  public synchronized void delete() {
+    if (swigCPtr != 0) {
+      if (swigCMemOwn) {
+        swigCMemOwn = false;
+        ovpncliJNI.delete_ClientAPI_TunBuilderBase(swigCPtr);
+      }
+      swigCPtr = 0;
+    }
+  }
+
+  public boolean tun_builder_new() {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_new(swigCPtr, this);
+  }
+
+  public boolean tun_builder_set_layer(int layer) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_layer(swigCPtr, this, layer);
+  }
+
+  public boolean tun_builder_set_remote_address(String address, boolean ipv6) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_remote_address(swigCPtr, this, address, ipv6);
+  }
+
+  public boolean tun_builder_add_address(String address, int prefix_length, String gateway, boolean ipv6, boolean net30) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_add_address(swigCPtr, this, address, prefix_length, gateway, ipv6, net30);
+  }
+
+  public boolean tun_builder_set_route_metric_default(int metric) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_route_metric_default(swigCPtr, this, metric);
+  }
+
+  public boolean tun_builder_reroute_gw(boolean ipv4, boolean ipv6, long flags) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_reroute_gw(swigCPtr, this, ipv4, ipv6, flags);
+  }
+
+  public boolean tun_builder_add_route(String address, int prefix_length, int metric, boolean ipv6) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_add_route(swigCPtr, this, address, prefix_length, metric, ipv6);
+  }
+
+  public boolean tun_builder_exclude_route(String address, int prefix_length, int metric, boolean ipv6) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_exclude_route(swigCPtr, this, address, prefix_length, metric, ipv6);
+  }
+
+  public boolean tun_builder_add_dns_server(String address, boolean ipv6) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_add_dns_server(swigCPtr, this, address, ipv6);
+  }
+
+  public boolean tun_builder_add_search_domain(String domain) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_add_search_domain(swigCPtr, this, domain);
+  }
+
+  public boolean tun_builder_set_mtu(int mtu) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_mtu(swigCPtr, this, mtu);
+  }
+
+  public boolean tun_builder_set_session_name(String name) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_session_name(swigCPtr, this, name);
+  }
+
+  public boolean tun_builder_add_proxy_bypass(String bypass_host) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_add_proxy_bypass(swigCPtr, this, bypass_host);
+  }
+
+  public boolean tun_builder_set_proxy_auto_config_url(String url) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_proxy_auto_config_url(swigCPtr, this, url);
+  }
+
+  public boolean tun_builder_set_proxy_http(String host, int port) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_proxy_http(swigCPtr, this, host, port);
+  }
+
+  public boolean tun_builder_set_proxy_https(String host, int port) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_proxy_https(swigCPtr, this, host, port);
+  }
+
+  public boolean tun_builder_add_wins_server(String address) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_add_wins_server(swigCPtr, this, address);
+  }
+
+  public boolean tun_builder_set_allow_family(int af, boolean allow) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_allow_family(swigCPtr, this, af, allow);
+  }
+
+  public boolean tun_builder_set_adapter_domain_suffix(String name) {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_set_adapter_domain_suffix(swigCPtr, this, name);
+  }
+
+  public int tun_builder_establish() {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_establish(swigCPtr, this);
+  }
+
+  public boolean tun_builder_persist() {
+    return ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_persist(swigCPtr, this);
+  }
+
+  public ClientAPI_StringVec tun_builder_get_local_networks(boolean ipv6) {
+    return new ClientAPI_StringVec(ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_get_local_networks(swigCPtr, this, ipv6), true);
+  }
+
+  public void tun_builder_establish_lite() {
+    ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_establish_lite(swigCPtr, this);
+  }
+
+  public void tun_builder_teardown(boolean disconnect) {
+    ovpncliJNI.ClientAPI_TunBuilderBase_tun_builder_teardown(swigCPtr, this, disconnect);
+  }
+
+  public ClientAPI_TunBuilderBase() {
+    this(ovpncliJNI.new_ClientAPI_TunBuilderBase(), true);
+  }
+
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/SWIGTYPE_p_std__string.java

@@ -0,0 +1,30 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class SWIGTYPE_p_std__string {
+  private transient long swigCPtr;
+
+  protected SWIGTYPE_p_std__string(long cPtr, @SuppressWarnings("unused") boolean futureUse) {
+    swigCPtr = cPtr;
+  }
+
+  protected SWIGTYPE_p_std__string() {
+    swigCPtr = 0;
+  }
+
+  protected static long getCPtr(SWIGTYPE_p_std__string obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(SWIGTYPE_p_std__string obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+}
+

client/android/openvpn/src/main/java/net/openvpn/ovpn3/SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t.java

@@ -0,0 +1,30 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t {
+  private transient long swigCPtr;
+
+  protected SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t(long cPtr, @SuppressWarnings("unused") boolean futureUse) {
+    swigCPtr = cPtr;
+  }
+
+  protected SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t() {
+    swigCPtr = 0;
+  }
+
+  protected static long getCPtr(SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+
+  protected static long swigRelease(SWIGTYPE_p_std__vectorT_openvpn__ClientAPI__KeyValue_t obj) {
+    return (obj == null) ? 0 : obj.swigCPtr;
+  }
+}
+

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ovpncli.java

@@ -0,0 +1,12 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ovpncli {
+}

client/android/openvpn/src/main/java/net/openvpn/ovpn3/ovpncliJNI.java

@@ -0,0 +1,532 @@
+/* ----------------------------------------------------------------------------
+ * This file was automatically generated by SWIG (https://www.swig.org).
+ * Version 4.1.1
+ *
+ * Do not make changes to this file unless you know what you are doing - modify
+ * the SWIG interface file instead.
+ * ----------------------------------------------------------------------------- */
+
+package net.openvpn.ovpn3;
+
+public class ovpncliJNI {
+  public final static native long new_ClientAPI_ServerEntryVector__SWIG_0();
+  public final static native long new_ClientAPI_ServerEntryVector__SWIG_1(long jarg1, ClientAPI_ServerEntryVector jarg1_);
+  public final static native long ClientAPI_ServerEntryVector_capacity(long jarg1, ClientAPI_ServerEntryVector jarg1_);
+  public final static native void ClientAPI_ServerEntryVector_reserve(long jarg1, ClientAPI_ServerEntryVector jarg1_, long jarg2);
+  public final static native boolean ClientAPI_ServerEntryVector_isEmpty(long jarg1, ClientAPI_ServerEntryVector jarg1_);
+  public final static native void ClientAPI_ServerEntryVector_clear(long jarg1, ClientAPI_ServerEntryVector jarg1_);
+  public final static native long new_ClientAPI_ServerEntryVector__SWIG_2(int jarg1, long jarg2, ClientAPI_ServerEntry jarg2_);
+  public final static native int ClientAPI_ServerEntryVector_doSize(long jarg1, ClientAPI_ServerEntryVector jarg1_);
+  public final static native void ClientAPI_ServerEntryVector_doAdd__SWIG_0(long jarg1, ClientAPI_ServerEntryVector jarg1_, long jarg2, ClientAPI_ServerEntry jarg2_);
+  public final static native void ClientAPI_ServerEntryVector_doAdd__SWIG_1(long jarg1, ClientAPI_ServerEntryVector jarg1_, int jarg2, long jarg3, ClientAPI_ServerEntry jarg3_);
+  public final static native long ClientAPI_ServerEntryVector_doRemove(long jarg1, ClientAPI_ServerEntryVector jarg1_, int jarg2);
+  public final static native long ClientAPI_ServerEntryVector_doGet(long jarg1, ClientAPI_ServerEntryVector jarg1_, int jarg2);
+  public final static native long ClientAPI_ServerEntryVector_doSet(long jarg1, ClientAPI_ServerEntryVector jarg1_, int jarg2, long jarg3, ClientAPI_ServerEntry jarg3_);
+  public final static native void ClientAPI_ServerEntryVector_doRemoveRange(long jarg1, ClientAPI_ServerEntryVector jarg1_, int jarg2, int jarg3);
+  public final static native void delete_ClientAPI_ServerEntryVector(long jarg1);
+  public final static native long new_ClientAPI_LLVector__SWIG_0();
+  public final static native long new_ClientAPI_LLVector__SWIG_1(long jarg1, ClientAPI_LLVector jarg1_);
+  public final static native long ClientAPI_LLVector_capacity(long jarg1, ClientAPI_LLVector jarg1_);
+  public final static native void ClientAPI_LLVector_reserve(long jarg1, ClientAPI_LLVector jarg1_, long jarg2);
+  public final static native boolean ClientAPI_LLVector_isEmpty(long jarg1, ClientAPI_LLVector jarg1_);
+  public final static native void ClientAPI_LLVector_clear(long jarg1, ClientAPI_LLVector jarg1_);
+  public final static native long new_ClientAPI_LLVector__SWIG_2(int jarg1, long jarg2);
+  public final static native int ClientAPI_LLVector_doSize(long jarg1, ClientAPI_LLVector jarg1_);
+  public final static native void ClientAPI_LLVector_doAdd__SWIG_0(long jarg1, ClientAPI_LLVector jarg1_, long jarg2);
+  public final static native void ClientAPI_LLVector_doAdd__SWIG_1(long jarg1, ClientAPI_LLVector jarg1_, int jarg2, long jarg3);
+  public final static native long ClientAPI_LLVector_doRemove(long jarg1, ClientAPI_LLVector jarg1_, int jarg2);
+  public final static native long ClientAPI_LLVector_doGet(long jarg1, ClientAPI_LLVector jarg1_, int jarg2);
+  public final static native long ClientAPI_LLVector_doSet(long jarg1, ClientAPI_LLVector jarg1_, int jarg2, long jarg3);
+  public final static native void ClientAPI_LLVector_doRemoveRange(long jarg1, ClientAPI_LLVector jarg1_, int jarg2, int jarg3);
+  public final static native void delete_ClientAPI_LLVector(long jarg1);
+  public final static native long new_ClientAPI_StringVec__SWIG_0();
+  public final static native long new_ClientAPI_StringVec__SWIG_1(long jarg1, ClientAPI_StringVec jarg1_);
+  public final static native long ClientAPI_StringVec_capacity(long jarg1, ClientAPI_StringVec jarg1_);
+  public final static native void ClientAPI_StringVec_reserve(long jarg1, ClientAPI_StringVec jarg1_, long jarg2);
+  public final static native boolean ClientAPI_StringVec_isEmpty(long jarg1, ClientAPI_StringVec jarg1_);
+  public final static native void ClientAPI_StringVec_clear(long jarg1, ClientAPI_StringVec jarg1_);
+  public final static native long new_ClientAPI_StringVec__SWIG_2(int jarg1, String jarg2);
+  public final static native int ClientAPI_StringVec_doSize(long jarg1, ClientAPI_StringVec jarg1_);
+  public final static native void ClientAPI_StringVec_doAdd__SWIG_0(long jarg1, ClientAPI_StringVec jarg1_, String jarg2);
+  public final static native void ClientAPI_StringVec_doAdd__SWIG_1(long jarg1, ClientAPI_StringVec jarg1_, int jarg2, String jarg3);
+  public final static native String ClientAPI_StringVec_doRemove(long jarg1, ClientAPI_StringVec jarg1_, int jarg2);
+  public final static native String ClientAPI_StringVec_doGet(long jarg1, ClientAPI_StringVec jarg1_, int jarg2);
+  public final static native String ClientAPI_StringVec_doSet(long jarg1, ClientAPI_StringVec jarg1_, int jarg2, String jarg3);
+  public final static native void ClientAPI_StringVec_doRemoveRange(long jarg1, ClientAPI_StringVec jarg1_, int jarg2, int jarg3);
+  public final static native void delete_ClientAPI_StringVec(long jarg1);
+  public final static native boolean ClientAPI_ExternalPKIBase_sign(long jarg1, ClientAPI_ExternalPKIBase jarg1_, String jarg2, long jarg3, String jarg4);
+  public final static native void delete_ClientAPI_ExternalPKIBase(long jarg1);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_new(long jarg1, ClientAPI_TunBuilderBase jarg1_);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_layer(long jarg1, ClientAPI_TunBuilderBase jarg1_, int jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_remote_address(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, boolean jarg3);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_add_address(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, int jarg3, String jarg4, boolean jarg5, boolean jarg6);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_route_metric_default(long jarg1, ClientAPI_TunBuilderBase jarg1_, int jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_reroute_gw(long jarg1, ClientAPI_TunBuilderBase jarg1_, boolean jarg2, boolean jarg3, long jarg4);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_add_route(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, int jarg3, int jarg4, boolean jarg5);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_exclude_route(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, int jarg3, int jarg4, boolean jarg5);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_add_dns_server(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, boolean jarg3);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_add_search_domain(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_mtu(long jarg1, ClientAPI_TunBuilderBase jarg1_, int jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_session_name(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_add_proxy_bypass(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_proxy_auto_config_url(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_proxy_http(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, int jarg3);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_proxy_https(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2, int jarg3);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_add_wins_server(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_allow_family(long jarg1, ClientAPI_TunBuilderBase jarg1_, int jarg2, boolean jarg3);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_set_adapter_domain_suffix(long jarg1, ClientAPI_TunBuilderBase jarg1_, String jarg2);
+  public final static native int ClientAPI_TunBuilderBase_tun_builder_establish(long jarg1, ClientAPI_TunBuilderBase jarg1_);
+  public final static native boolean ClientAPI_TunBuilderBase_tun_builder_persist(long jarg1, ClientAPI_TunBuilderBase jarg1_);
+  public final static native long ClientAPI_TunBuilderBase_tun_builder_get_local_networks(long jarg1, ClientAPI_TunBuilderBase jarg1_, boolean jarg2);
+  public final static native void ClientAPI_TunBuilderBase_tun_builder_establish_lite(long jarg1, ClientAPI_TunBuilderBase jarg1_);
+  public final static native void ClientAPI_TunBuilderBase_tun_builder_teardown(long jarg1, ClientAPI_TunBuilderBase jarg1_, boolean jarg2);
+  public final static native void delete_ClientAPI_TunBuilderBase(long jarg1);
+  public final static native long new_ClientAPI_TunBuilderBase();
+  public final static native void ClientAPI_ServerEntry_server_set(long jarg1, ClientAPI_ServerEntry jarg1_, String jarg2);
+  public final static native String ClientAPI_ServerEntry_server_get(long jarg1, ClientAPI_ServerEntry jarg1_);
+  public final static native void ClientAPI_ServerEntry_friendlyName_set(long jarg1, ClientAPI_ServerEntry jarg1_, String jarg2);
+  public final static native String ClientAPI_ServerEntry_friendlyName_get(long jarg1, ClientAPI_ServerEntry jarg1_);
+  public final static native long new_ClientAPI_ServerEntry();
+  public final static native void delete_ClientAPI_ServerEntry(long jarg1);
+  public final static native void ClientAPI_EvalConfig_error_set(long jarg1, ClientAPI_EvalConfig jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_EvalConfig_error_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_message_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_message_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_userlockedUsername_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_userlockedUsername_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_profileName_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_profileName_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_friendlyName_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_friendlyName_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_autologin_set(long jarg1, ClientAPI_EvalConfig jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_EvalConfig_autologin_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_externalPki_set(long jarg1, ClientAPI_EvalConfig jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_EvalConfig_externalPki_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_staticChallenge_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_staticChallenge_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_staticChallengeEcho_set(long jarg1, ClientAPI_EvalConfig jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_EvalConfig_staticChallengeEcho_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_privateKeyPasswordRequired_set(long jarg1, ClientAPI_EvalConfig jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_EvalConfig_privateKeyPasswordRequired_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_allowPasswordSave_set(long jarg1, ClientAPI_EvalConfig jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_EvalConfig_allowPasswordSave_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_remoteHost_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_remoteHost_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_remotePort_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_remotePort_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_remoteProto_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_remoteProto_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_serverList_set(long jarg1, ClientAPI_EvalConfig jarg1_, long jarg2, ClientAPI_ServerEntryVector jarg2_);
+  public final static native long ClientAPI_EvalConfig_serverList_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native void ClientAPI_EvalConfig_windowsDriver_set(long jarg1, ClientAPI_EvalConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_EvalConfig_windowsDriver_get(long jarg1, ClientAPI_EvalConfig jarg1_);
+  public final static native long new_ClientAPI_EvalConfig();
+  public final static native void delete_ClientAPI_EvalConfig(long jarg1);
+  public final static native void ClientAPI_ProvideCreds_username_set(long jarg1, ClientAPI_ProvideCreds jarg1_, String jarg2);
+  public final static native String ClientAPI_ProvideCreds_username_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native void ClientAPI_ProvideCreds_password_set(long jarg1, ClientAPI_ProvideCreds jarg1_, String jarg2);
+  public final static native String ClientAPI_ProvideCreds_password_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native void ClientAPI_ProvideCreds_http_proxy_user_set(long jarg1, ClientAPI_ProvideCreds jarg1_, String jarg2);
+  public final static native String ClientAPI_ProvideCreds_http_proxy_user_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native void ClientAPI_ProvideCreds_http_proxy_pass_set(long jarg1, ClientAPI_ProvideCreds jarg1_, String jarg2);
+  public final static native String ClientAPI_ProvideCreds_http_proxy_pass_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native void ClientAPI_ProvideCreds_response_set(long jarg1, ClientAPI_ProvideCreds jarg1_, String jarg2);
+  public final static native String ClientAPI_ProvideCreds_response_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native void ClientAPI_ProvideCreds_dynamicChallengeCookie_set(long jarg1, ClientAPI_ProvideCreds jarg1_, String jarg2);
+  public final static native String ClientAPI_ProvideCreds_dynamicChallengeCookie_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native void ClientAPI_ProvideCreds_replacePasswordWithSessionID_set(long jarg1, ClientAPI_ProvideCreds jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_ProvideCreds_replacePasswordWithSessionID_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native void ClientAPI_ProvideCreds_cachePassword_set(long jarg1, ClientAPI_ProvideCreds jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_ProvideCreds_cachePassword_get(long jarg1, ClientAPI_ProvideCreds jarg1_);
+  public final static native long new_ClientAPI_ProvideCreds();
+  public final static native void delete_ClientAPI_ProvideCreds(long jarg1);
+  public final static native void ClientAPI_SessionToken_username_set(long jarg1, ClientAPI_SessionToken jarg1_, String jarg2);
+  public final static native String ClientAPI_SessionToken_username_get(long jarg1, ClientAPI_SessionToken jarg1_);
+  public final static native void ClientAPI_SessionToken_session_id_set(long jarg1, ClientAPI_SessionToken jarg1_, String jarg2);
+  public final static native String ClientAPI_SessionToken_session_id_get(long jarg1, ClientAPI_SessionToken jarg1_);
+  public final static native long new_ClientAPI_SessionToken();
+  public final static native void delete_ClientAPI_SessionToken(long jarg1);
+  public final static native void ClientAPI_DynamicChallenge_challenge_set(long jarg1, ClientAPI_DynamicChallenge jarg1_, String jarg2);
+  public final static native String ClientAPI_DynamicChallenge_challenge_get(long jarg1, ClientAPI_DynamicChallenge jarg1_);
+  public final static native void ClientAPI_DynamicChallenge_echo_set(long jarg1, ClientAPI_DynamicChallenge jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_DynamicChallenge_echo_get(long jarg1, ClientAPI_DynamicChallenge jarg1_);
+  public final static native void ClientAPI_DynamicChallenge_responseRequired_set(long jarg1, ClientAPI_DynamicChallenge jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_DynamicChallenge_responseRequired_get(long jarg1, ClientAPI_DynamicChallenge jarg1_);
+  public final static native void ClientAPI_DynamicChallenge_stateID_set(long jarg1, ClientAPI_DynamicChallenge jarg1_, String jarg2);
+  public final static native String ClientAPI_DynamicChallenge_stateID_get(long jarg1, ClientAPI_DynamicChallenge jarg1_);
+  public final static native long new_ClientAPI_DynamicChallenge();
+  public final static native void delete_ClientAPI_DynamicChallenge(long jarg1);
+  public final static native long new_ClientAPI_KeyValue__SWIG_0();
+  public final static native long new_ClientAPI_KeyValue__SWIG_1(String jarg1, String jarg2);
+  public final static native void ClientAPI_KeyValue_key_set(long jarg1, ClientAPI_KeyValue jarg1_, String jarg2);
+  public final static native String ClientAPI_KeyValue_key_get(long jarg1, ClientAPI_KeyValue jarg1_);
+  public final static native void ClientAPI_KeyValue_value_set(long jarg1, ClientAPI_KeyValue jarg1_, String jarg2);
+  public final static native String ClientAPI_KeyValue_value_get(long jarg1, ClientAPI_KeyValue jarg1_);
+  public final static native void delete_ClientAPI_KeyValue(long jarg1);
+  public final static native void ClientAPI_Config_content_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_content_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_contentList_set(long jarg1, ClientAPI_Config jarg1_, long jarg2);
+  public final static native long ClientAPI_Config_contentList_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_guiVersion_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_guiVersion_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_ssoMethods_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_ssoMethods_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_hwAddrOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_hwAddrOverride_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_platformVersion_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_platformVersion_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_serverOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_serverOverride_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_portOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_portOverride_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_protoOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_protoOverride_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_protoVersionOverride_set(long jarg1, ClientAPI_Config jarg1_, int jarg2);
+  public final static native int ClientAPI_Config_protoVersionOverride_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_allowUnusedAddrFamilies_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_allowUnusedAddrFamilies_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_connTimeout_set(long jarg1, ClientAPI_Config jarg1_, int jarg2);
+  public final static native int ClientAPI_Config_connTimeout_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_tunPersist_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_tunPersist_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_googleDnsFallback_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_googleDnsFallback_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_synchronousDnsLookup_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_synchronousDnsLookup_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_autologinSessions_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_autologinSessions_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_retryOnAuthFailed_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_retryOnAuthFailed_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_externalPkiAlias_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_externalPkiAlias_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_disableClientCert_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_disableClientCert_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_sslDebugLevel_set(long jarg1, ClientAPI_Config jarg1_, int jarg2);
+  public final static native int ClientAPI_Config_sslDebugLevel_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_compressionMode_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_compressionMode_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_privateKeyPassword_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_privateKeyPassword_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_defaultKeyDirection_set(long jarg1, ClientAPI_Config jarg1_, int jarg2);
+  public final static native int ClientAPI_Config_defaultKeyDirection_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_tlsVersionMinOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_tlsVersionMinOverride_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_tlsCertProfileOverride_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_tlsCertProfileOverride_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_tlsCipherList_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_tlsCipherList_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_tlsCiphersuitesList_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_tlsCiphersuitesList_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_peerInfo_set(long jarg1, ClientAPI_Config jarg1_, long jarg2);
+  public final static native long ClientAPI_Config_peerInfo_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_proxyHost_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_proxyHost_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_proxyPort_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_proxyPort_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_proxyUsername_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_proxyUsername_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_proxyPassword_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_proxyPassword_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_proxyAllowCleartextAuth_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_proxyAllowCleartextAuth_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_altProxy_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_altProxy_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_dco_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_dco_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_echo_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_echo_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_info_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_info_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_allowLocalLanAccess_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_allowLocalLanAccess_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_clockTickMS_set(long jarg1, ClientAPI_Config jarg1_, long jarg2);
+  public final static native long ClientAPI_Config_clockTickMS_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_gremlinConfig_set(long jarg1, ClientAPI_Config jarg1_, String jarg2);
+  public final static native String ClientAPI_Config_gremlinConfig_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_usePluggableTransports_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_usePluggableTransports_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_wintun_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_wintun_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_allowLocalDnsResolvers_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_allowLocalDnsResolvers_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_enableLegacyAlgorithms_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_enableLegacyAlgorithms_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native void ClientAPI_Config_enableNonPreferredDCAlgorithms_set(long jarg1, ClientAPI_Config jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Config_enableNonPreferredDCAlgorithms_get(long jarg1, ClientAPI_Config jarg1_);
+  public final static native long new_ClientAPI_Config();
+  public final static native void delete_ClientAPI_Config(long jarg1);
+  public final static native void ClientAPI_Event_error_set(long jarg1, ClientAPI_Event jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Event_error_get(long jarg1, ClientAPI_Event jarg1_);
+  public final static native void ClientAPI_Event_fatal_set(long jarg1, ClientAPI_Event jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Event_fatal_get(long jarg1, ClientAPI_Event jarg1_);
+  public final static native void ClientAPI_Event_name_set(long jarg1, ClientAPI_Event jarg1_, String jarg2);
+  public final static native String ClientAPI_Event_name_get(long jarg1, ClientAPI_Event jarg1_);
+  public final static native void ClientAPI_Event_info_set(long jarg1, ClientAPI_Event jarg1_, String jarg2);
+  public final static native String ClientAPI_Event_info_get(long jarg1, ClientAPI_Event jarg1_);
+  public final static native long new_ClientAPI_Event();
+  public final static native void delete_ClientAPI_Event(long jarg1);
+  public final static native void ClientAPI_ConnectionInfo_defined_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_ConnectionInfo_defined_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_user_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_user_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_serverHost_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_serverHost_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_serverPort_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_serverPort_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_serverProto_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_serverProto_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_serverIp_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_serverIp_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_vpnIp4_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_vpnIp4_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_vpnIp6_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_vpnIp6_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_gw4_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_gw4_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_gw6_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_gw6_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_clientIp_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_clientIp_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native void ClientAPI_ConnectionInfo_tunName_set(long jarg1, ClientAPI_ConnectionInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_ConnectionInfo_tunName_get(long jarg1, ClientAPI_ConnectionInfo jarg1_);
+  public final static native long new_ClientAPI_ConnectionInfo();
+  public final static native void delete_ClientAPI_ConnectionInfo(long jarg1);
+  public final static native void ClientAPI_Status_error_set(long jarg1, ClientAPI_Status jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_Status_error_get(long jarg1, ClientAPI_Status jarg1_);
+  public final static native void ClientAPI_Status_status_set(long jarg1, ClientAPI_Status jarg1_, String jarg2);
+  public final static native String ClientAPI_Status_status_get(long jarg1, ClientAPI_Status jarg1_);
+  public final static native void ClientAPI_Status_message_set(long jarg1, ClientAPI_Status jarg1_, String jarg2);
+  public final static native String ClientAPI_Status_message_get(long jarg1, ClientAPI_Status jarg1_);
+  public final static native long new_ClientAPI_Status();
+  public final static native void delete_ClientAPI_Status(long jarg1);
+  public final static native long new_ClientAPI_LogInfo__SWIG_0();
+  public final static native long new_ClientAPI_LogInfo__SWIG_1(String jarg1);
+  public final static native void ClientAPI_LogInfo_text_set(long jarg1, ClientAPI_LogInfo jarg1_, String jarg2);
+  public final static native String ClientAPI_LogInfo_text_get(long jarg1, ClientAPI_LogInfo jarg1_);
+  public final static native void delete_ClientAPI_LogInfo(long jarg1);
+  public final static native void ClientAPI_InterfaceStats_bytesIn_set(long jarg1, ClientAPI_InterfaceStats jarg1_, long jarg2);
+  public final static native long ClientAPI_InterfaceStats_bytesIn_get(long jarg1, ClientAPI_InterfaceStats jarg1_);
+  public final static native void ClientAPI_InterfaceStats_packetsIn_set(long jarg1, ClientAPI_InterfaceStats jarg1_, long jarg2);
+  public final static native long ClientAPI_InterfaceStats_packetsIn_get(long jarg1, ClientAPI_InterfaceStats jarg1_);
+  public final static native void ClientAPI_InterfaceStats_errorsIn_set(long jarg1, ClientAPI_InterfaceStats jarg1_, long jarg2);
+  public final static native long ClientAPI_InterfaceStats_errorsIn_get(long jarg1, ClientAPI_InterfaceStats jarg1_);
+  public final static native void ClientAPI_InterfaceStats_bytesOut_set(long jarg1, ClientAPI_InterfaceStats jarg1_, long jarg2);
+  public final static native long ClientAPI_InterfaceStats_bytesOut_get(long jarg1, ClientAPI_InterfaceStats jarg1_);
+  public final static native void ClientAPI_InterfaceStats_packetsOut_set(long jarg1, ClientAPI_InterfaceStats jarg1_, long jarg2);
+  public final static native long ClientAPI_InterfaceStats_packetsOut_get(long jarg1, ClientAPI_InterfaceStats jarg1_);
+  public final static native void ClientAPI_InterfaceStats_errorsOut_set(long jarg1, ClientAPI_InterfaceStats jarg1_, long jarg2);
+  public final static native long ClientAPI_InterfaceStats_errorsOut_get(long jarg1, ClientAPI_InterfaceStats jarg1_);
+  public final static native long new_ClientAPI_InterfaceStats();
+  public final static native void delete_ClientAPI_InterfaceStats(long jarg1);
+  public final static native void ClientAPI_TransportStats_bytesIn_set(long jarg1, ClientAPI_TransportStats jarg1_, long jarg2);
+  public final static native long ClientAPI_TransportStats_bytesIn_get(long jarg1, ClientAPI_TransportStats jarg1_);
+  public final static native void ClientAPI_TransportStats_bytesOut_set(long jarg1, ClientAPI_TransportStats jarg1_, long jarg2);
+  public final static native long ClientAPI_TransportStats_bytesOut_get(long jarg1, ClientAPI_TransportStats jarg1_);
+  public final static native void ClientAPI_TransportStats_packetsIn_set(long jarg1, ClientAPI_TransportStats jarg1_, long jarg2);
+  public final static native long ClientAPI_TransportStats_packetsIn_get(long jarg1, ClientAPI_TransportStats jarg1_);
+  public final static native void ClientAPI_TransportStats_packetsOut_set(long jarg1, ClientAPI_TransportStats jarg1_, long jarg2);
+  public final static native long ClientAPI_TransportStats_packetsOut_get(long jarg1, ClientAPI_TransportStats jarg1_);
+  public final static native void ClientAPI_TransportStats_lastPacketReceived_set(long jarg1, ClientAPI_TransportStats jarg1_, int jarg2);
+  public final static native int ClientAPI_TransportStats_lastPacketReceived_get(long jarg1, ClientAPI_TransportStats jarg1_);
+  public final static native long new_ClientAPI_TransportStats();
+  public final static native void delete_ClientAPI_TransportStats(long jarg1);
+  public final static native void ClientAPI_MergeConfig_status_set(long jarg1, ClientAPI_MergeConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_MergeConfig_status_get(long jarg1, ClientAPI_MergeConfig jarg1_);
+  public final static native void ClientAPI_MergeConfig_errorText_set(long jarg1, ClientAPI_MergeConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_MergeConfig_errorText_get(long jarg1, ClientAPI_MergeConfig jarg1_);
+  public final static native void ClientAPI_MergeConfig_basename_set(long jarg1, ClientAPI_MergeConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_MergeConfig_basename_get(long jarg1, ClientAPI_MergeConfig jarg1_);
+  public final static native void ClientAPI_MergeConfig_profileContent_set(long jarg1, ClientAPI_MergeConfig jarg1_, String jarg2);
+  public final static native String ClientAPI_MergeConfig_profileContent_get(long jarg1, ClientAPI_MergeConfig jarg1_);
+  public final static native void ClientAPI_MergeConfig_refPathList_set(long jarg1, ClientAPI_MergeConfig jarg1_, long jarg2, ClientAPI_StringVec jarg2_);
+  public final static native long ClientAPI_MergeConfig_refPathList_get(long jarg1, ClientAPI_MergeConfig jarg1_);
+  public final static native long new_ClientAPI_MergeConfig();
+  public final static native void delete_ClientAPI_MergeConfig(long jarg1);
+  public final static native void ClientAPI_ExternalPKIRequestBase_error_set(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_ExternalPKIRequestBase_error_get(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_);
+  public final static native void ClientAPI_ExternalPKIRequestBase_errorText_set(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_, String jarg2);
+  public final static native String ClientAPI_ExternalPKIRequestBase_errorText_get(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_);
+  public final static native void ClientAPI_ExternalPKIRequestBase_invalidAlias_set(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_, boolean jarg2);
+  public final static native boolean ClientAPI_ExternalPKIRequestBase_invalidAlias_get(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_);
+  public final static native void ClientAPI_ExternalPKIRequestBase_alias_set(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_, String jarg2);
+  public final static native String ClientAPI_ExternalPKIRequestBase_alias_get(long jarg1, ClientAPI_ExternalPKIRequestBase jarg1_);
+  public final static native long new_ClientAPI_ExternalPKIRequestBase();
+  public final static native void delete_ClientAPI_ExternalPKIRequestBase(long jarg1);
+  public final static native void ClientAPI_ExternalPKICertRequest_cert_set(long jarg1, ClientAPI_ExternalPKICertRequest jarg1_, String jarg2);
+  public final static native String ClientAPI_ExternalPKICertRequest_cert_get(long jarg1, ClientAPI_ExternalPKICertRequest jarg1_);
+  public final static native void ClientAPI_ExternalPKICertRequest_supportingChain_set(long jarg1, ClientAPI_ExternalPKICertRequest jarg1_, String jarg2);
+  public final static native String ClientAPI_ExternalPKICertRequest_supportingChain_get(long jarg1, ClientAPI_ExternalPKICertRequest jarg1_);
+  public final static native long new_ClientAPI_ExternalPKICertRequest();
+  public final static native void delete_ClientAPI_ExternalPKICertRequest(long jarg1);
+  public final static native void ClientAPI_ExternalPKISignRequest_data_set(long jarg1, ClientAPI_ExternalPKISignRequest jarg1_, String jarg2);
+  public final static native String ClientAPI_ExternalPKISignRequest_data_get(long jarg1, ClientAPI_ExternalPKISignRequest jarg1_);
+  public final static native void ClientAPI_ExternalPKISignRequest_sig_set(long jarg1, ClientAPI_ExternalPKISignRequest jarg1_, String jarg2);
+  public final static native String ClientAPI_ExternalPKISignRequest_sig_get(long jarg1, ClientAPI_ExternalPKISignRequest jarg1_);
+  public final static native void ClientAPI_ExternalPKISignRequest_algorithm_set(long jarg1, ClientAPI_ExternalPKISignRequest jarg1_, String jarg2);
+  public final static native String ClientAPI_ExternalPKISignRequest_algorithm_get(long jarg1, ClientAPI_ExternalPKISignRequest jarg1_);
+  public final static native long new_ClientAPI_ExternalPKISignRequest();
+  public final static native void delete_ClientAPI_ExternalPKISignRequest(long jarg1);
+  public final static native void ClientAPI_RemoteOverride_host_set(long jarg1, ClientAPI_RemoteOverride jarg1_, String jarg2);
+  public final static native String ClientAPI_RemoteOverride_host_get(long jarg1, ClientAPI_RemoteOverride jarg1_);
+  public final static native void ClientAPI_RemoteOverride_ip_set(long jarg1, ClientAPI_RemoteOverride jarg1_, String jarg2);
+  public final static native String ClientAPI_RemoteOverride_ip_get(long jarg1, ClientAPI_RemoteOverride jarg1_);
+  public final static native void ClientAPI_RemoteOverride_port_set(long jarg1, ClientAPI_RemoteOverride jarg1_, String jarg2);
+  public final static native String ClientAPI_RemoteOverride_port_get(long jarg1, ClientAPI_RemoteOverride jarg1_);
+  public final static native void ClientAPI_RemoteOverride_proto_set(long jarg1, ClientAPI_RemoteOverride jarg1_, String jarg2);
+  public final static native String ClientAPI_RemoteOverride_proto_get(long jarg1, ClientAPI_RemoteOverride jarg1_);
+  public final static native void ClientAPI_RemoteOverride_error_set(long jarg1, ClientAPI_RemoteOverride jarg1_, String jarg2);
+  public final static native String ClientAPI_RemoteOverride_error_get(long jarg1, ClientAPI_RemoteOverride jarg1_);
+  public final static native long new_ClientAPI_RemoteOverride();
+  public final static native void delete_ClientAPI_RemoteOverride(long jarg1);
+  public final static native long new_ClientAPI_OpenVPNClientHelper();
+  public final static native void delete_ClientAPI_OpenVPNClientHelper(long jarg1);
+  public final static native long ClientAPI_OpenVPNClientHelper_merge_config(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_, String jarg2, boolean jarg3);
+  public final static native long ClientAPI_OpenVPNClientHelper_merge_config_string(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_, String jarg2);
+  public final static native long ClientAPI_OpenVPNClientHelper_eval_config(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_, long jarg2, ClientAPI_Config jarg2_);
+  public final static native int ClientAPI_OpenVPNClientHelper_max_profile_size();
+  public final static native boolean ClientAPI_OpenVPNClientHelper_parse_dynamic_challenge(String jarg1, long jarg2, ClientAPI_DynamicChallenge jarg2_);
+  public final static native String ClientAPI_OpenVPNClientHelper_crypto_self_test(long jarg1, ClientAPI_OpenVPNClientHelper jarg1_);
+  public final static native String ClientAPI_OpenVPNClientHelper_platform();
+  public final static native String ClientAPI_OpenVPNClientHelper_copyright();
+  public final static native long new_ClientAPI_OpenVPNClient();
+  public final static native void delete_ClientAPI_OpenVPNClient(long jarg1);
+  public final static native long ClientAPI_OpenVPNClient_eval_config(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_Config jarg2_);
+  public final static native long ClientAPI_OpenVPNClient_provide_creds(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_ProvideCreds jarg2_);
+  public final static native boolean ClientAPI_OpenVPNClient_socket_protect(long jarg1, ClientAPI_OpenVPNClient jarg1_, int jarg2, String jarg3, boolean jarg4);
+  public final static native boolean ClientAPI_OpenVPNClient_socket_protectSwigExplicitClientAPI_OpenVPNClient(long jarg1, ClientAPI_OpenVPNClient jarg1_, int jarg2, String jarg3, boolean jarg4);
+  public final static native long ClientAPI_OpenVPNClient_connect(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native long ClientAPI_OpenVPNClient_connection_info(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native boolean ClientAPI_OpenVPNClient_session_token(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_SessionToken jarg2_);
+  public final static native void ClientAPI_OpenVPNClient_stop(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native void ClientAPI_OpenVPNClient_pause(long jarg1, ClientAPI_OpenVPNClient jarg1_, String jarg2);
+  public final static native void ClientAPI_OpenVPNClient_resume(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native void ClientAPI_OpenVPNClient_reconnect(long jarg1, ClientAPI_OpenVPNClient jarg1_, int jarg2);
+  public final static native boolean ClientAPI_OpenVPNClient_pause_on_connection_timeout(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native int ClientAPI_OpenVPNClient_stats_n();
+  public final static native String ClientAPI_OpenVPNClient_stats_name(int jarg1);
+  public final static native long ClientAPI_OpenVPNClient_stats_value(long jarg1, ClientAPI_OpenVPNClient jarg1_, int jarg2);
+  public final static native long ClientAPI_OpenVPNClient_stats_bundle(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native long ClientAPI_OpenVPNClient_tun_stats(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native long ClientAPI_OpenVPNClient_transport_stats(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native void ClientAPI_OpenVPNClient_post_cc_msg(long jarg1, ClientAPI_OpenVPNClient jarg1_, String jarg2);
+  public final static native void ClientAPI_OpenVPNClient_event(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_Event jarg2_);
+  public final static native void ClientAPI_OpenVPNClient_log(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_LogInfo jarg2_);
+  public final static native void ClientAPI_OpenVPNClient_external_pki_cert_request(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_ExternalPKICertRequest jarg2_);
+  public final static native void ClientAPI_OpenVPNClient_external_pki_sign_request(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_ExternalPKISignRequest jarg2_);
+  public final static native boolean ClientAPI_OpenVPNClient_remote_override_enabled(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native boolean ClientAPI_OpenVPNClient_remote_override_enabledSwigExplicitClientAPI_OpenVPNClient(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native void ClientAPI_OpenVPNClient_remote_override(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_RemoteOverride jarg2_);
+  public final static native void ClientAPI_OpenVPNClient_remote_overrideSwigExplicitClientAPI_OpenVPNClient(long jarg1, ClientAPI_OpenVPNClient jarg1_, long jarg2, ClientAPI_RemoteOverride jarg2_);
+  public final static native void ClientAPI_OpenVPNClient_clock_tick(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native void ClientAPI_OpenVPNClient_clock_tickSwigExplicitClientAPI_OpenVPNClient(long jarg1, ClientAPI_OpenVPNClient jarg1_);
+  public final static native void ClientAPI_OpenVPNClient_director_connect(ClientAPI_OpenVPNClient obj, long cptr, boolean mem_own, boolean weak_global);
+  public final static native void ClientAPI_OpenVPNClient_change_ownership(ClientAPI_OpenVPNClient obj, long cptr, boolean take_or_release);
+  public final static native long ClientAPI_ExternalPKICertRequest_SWIGUpcast(long jarg1);
+  public final static native long ClientAPI_ExternalPKISignRequest_SWIGUpcast(long jarg1);
+  public final static native long ClientAPI_OpenVPNClient_SWIGUpcast(long jarg1);
+
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_new(ClientAPI_OpenVPNClient jself) {
+    return jself.tun_builder_new();
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_layer(ClientAPI_OpenVPNClient jself, int layer) {
+    return jself.tun_builder_set_layer(layer);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_remote_address(ClientAPI_OpenVPNClient jself, String address, boolean ipv6) {
+    return jself.tun_builder_set_remote_address(address, ipv6);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_add_address(ClientAPI_OpenVPNClient jself, String address, int prefix_length, String gateway, boolean ipv6, boolean net30) {
+    return jself.tun_builder_add_address(address, prefix_length, gateway, ipv6, net30);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_route_metric_default(ClientAPI_OpenVPNClient jself, int metric) {
+    return jself.tun_builder_set_route_metric_default(metric);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_reroute_gw(ClientAPI_OpenVPNClient jself, boolean ipv4, boolean ipv6, long flags) {
+    return jself.tun_builder_reroute_gw(ipv4, ipv6, flags);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_add_route(ClientAPI_OpenVPNClient jself, String address, int prefix_length, int metric, boolean ipv6) {
+    return jself.tun_builder_add_route(address, prefix_length, metric, ipv6);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_exclude_route(ClientAPI_OpenVPNClient jself, String address, int prefix_length, int metric, boolean ipv6) {
+    return jself.tun_builder_exclude_route(address, prefix_length, metric, ipv6);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_add_dns_server(ClientAPI_OpenVPNClient jself, String address, boolean ipv6) {
+    return jself.tun_builder_add_dns_server(address, ipv6);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_add_search_domain(ClientAPI_OpenVPNClient jself, String domain) {
+    return jself.tun_builder_add_search_domain(domain);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_mtu(ClientAPI_OpenVPNClient jself, int mtu) {
+    return jself.tun_builder_set_mtu(mtu);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_session_name(ClientAPI_OpenVPNClient jself, String name) {
+    return jself.tun_builder_set_session_name(name);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_add_proxy_bypass(ClientAPI_OpenVPNClient jself, String bypass_host) {
+    return jself.tun_builder_add_proxy_bypass(bypass_host);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_proxy_auto_config_url(ClientAPI_OpenVPNClient jself, String url) {
+    return jself.tun_builder_set_proxy_auto_config_url(url);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_proxy_http(ClientAPI_OpenVPNClient jself, String host, int port) {
+    return jself.tun_builder_set_proxy_http(host, port);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_proxy_https(ClientAPI_OpenVPNClient jself, String host, int port) {
+    return jself.tun_builder_set_proxy_https(host, port);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_add_wins_server(ClientAPI_OpenVPNClient jself, String address) {
+    return jself.tun_builder_add_wins_server(address);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_allow_family(ClientAPI_OpenVPNClient jself, int af, boolean allow) {
+    return jself.tun_builder_set_allow_family(af, allow);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_set_adapter_domain_suffix(ClientAPI_OpenVPNClient jself, String name) {
+    return jself.tun_builder_set_adapter_domain_suffix(name);
+  }
+  public static int SwigDirector_ClientAPI_OpenVPNClient_tun_builder_establish(ClientAPI_OpenVPNClient jself) {
+    return jself.tun_builder_establish();
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_tun_builder_persist(ClientAPI_OpenVPNClient jself) {
+    return jself.tun_builder_persist();
+  }
+  public static long SwigDirector_ClientAPI_OpenVPNClient_tun_builder_get_local_networks(ClientAPI_OpenVPNClient jself, boolean ipv6) {
+    return ClientAPI_StringVec.getCPtr(jself.tun_builder_get_local_networks(ipv6));
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_tun_builder_establish_lite(ClientAPI_OpenVPNClient jself) {
+    jself.tun_builder_establish_lite();
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_tun_builder_teardown(ClientAPI_OpenVPNClient jself, boolean disconnect) {
+    jself.tun_builder_teardown(disconnect);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_socket_protect(ClientAPI_OpenVPNClient jself, int socket, String remote, boolean ipv6) {
+    return jself.socket_protect(socket, remote, ipv6);
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_pause_on_connection_timeout(ClientAPI_OpenVPNClient jself) {
+    return jself.pause_on_connection_timeout();
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_event(ClientAPI_OpenVPNClient jself, long arg0) {
+    jself.event(new ClientAPI_Event(arg0, false));
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_log(ClientAPI_OpenVPNClient jself, long arg0) {
+    jself.log(new ClientAPI_LogInfo(arg0, false));
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_external_pki_cert_request(ClientAPI_OpenVPNClient jself, long arg0) {
+    jself.external_pki_cert_request(new ClientAPI_ExternalPKICertRequest(arg0, false));
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_external_pki_sign_request(ClientAPI_OpenVPNClient jself, long arg0) {
+    jself.external_pki_sign_request(new ClientAPI_ExternalPKISignRequest(arg0, false));
+  }
+  public static boolean SwigDirector_ClientAPI_OpenVPNClient_remote_override_enabled(ClientAPI_OpenVPNClient jself) {
+    return jself.remote_override_enabled();
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_remote_override(ClientAPI_OpenVPNClient jself, long arg0) {
+    jself.remote_override(new ClientAPI_RemoteOverride(arg0, false));
+  }
+  public static void SwigDirector_ClientAPI_OpenVPNClient_clock_tick(ClientAPI_OpenVPNClient jself) {
+    jself.clock_tick();
+  }
+
+  private final static native void swig_module_init();
+  static {
+    swig_module_init();
+  }
+}

client/android/openvpn/src/main/kotlin/org/amnezia/vpn/protocol/openvpn/OpenVpn.kt

@@ -0,0 +1,122 @@
+package org.amnezia.vpn.protocol.openvpn
+
+import android.net.VpnService.Builder
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.launch
+import net.openvpn.ovpn3.ClientAPI_Config
+import org.amnezia.vpn.protocol.BadConfigException
+import org.amnezia.vpn.protocol.Protocol
+import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTED
+import org.amnezia.vpn.protocol.Statistics
+import org.amnezia.vpn.protocol.VpnStartException
+import org.amnezia.vpn.util.LibraryLoader.loadSharedLibrary
+import org.amnezia.vpn.util.net.InetNetwork
+import org.amnezia.vpn.util.net.getLocalNetworks
+import org.amnezia.vpn.util.net.parseInetAddress
+import org.json.JSONObject
+
+open class OpenVpn : Protocol() {
+
+    private var openVpnClient: OpenVpnClient? = null
+    private lateinit var scope: CoroutineScope
+
+    override val statistics: Statistics
+        get() {
+            openVpnClient?.let { client ->
+                val stats = client.transport_stats()
+                return Statistics.build {
+                    setRxBytes(stats.bytesIn)
+                    setTxBytes(stats.bytesOut)
+                }
+            }
+            return Statistics.EMPTY_STATISTICS
+        }
+
+    override fun internalInit() {
+        if (!isInitialized) {
+            loadSharedLibrary(context, "ovpn3")
+            loadSharedLibrary(context, "ovpnutil")
+        }
+        if (this::scope.isInitialized) {
+            scope.cancel()
+        }
+        scope = CoroutineScope(Dispatchers.IO)
+    }
+
+    override suspend fun startVpn(config: JSONObject, vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        val configBuilder = OpenVpnConfig.Builder()
+
+        openVpnClient = OpenVpnClient(
+            configBuilder = configBuilder,
+            state = state,
+            getLocalNetworks = { ipv6 -> getLocalNetworks(context, ipv6) },
+            establish = makeEstablish(vpnBuilder),
+            protect = protect,
+            onError = onError
+        )
+
+        try {
+            openVpnClient?.let { client ->
+                val openVpnConfig = parseConfig(config)
+                val evalConfig = client.eval_config(openVpnConfig)
+                if (evalConfig.error) {
+                    throw BadConfigException("OpenVPN config parse error: ${evalConfig.message}")
+                }
+
+                // exclude remote server ip from vpn routes
+                val remoteServer = config.getString("hostName")
+                val remoteServerAddress = InetNetwork(parseInetAddress(remoteServer))
+                configBuilder.excludeRoute(remoteServerAddress)
+
+                configPluggableTransport(configBuilder, config)
+                configBuilder.configSplitTunneling(config)
+                configBuilder.configAppSplitTunneling(config)
+
+                scope.launch {
+                    val status = client.connect()
+                    if (status.error) {
+                        state.value = DISCONNECTED
+                        onError("OpenVpn connect() error: ${status.status}: ${status.message}")
+                    }
+                }
+            }
+        } catch (e: Exception) {
+            openVpnClient = null
+            throw e
+        }
+    }
+
+    override fun stopVpn() {
+        openVpnClient?.stop()
+        openVpnClient = null
+    }
+
+    override fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        openVpnClient?.let {
+            it.establish = makeEstablish(vpnBuilder)
+            it.reconnect(0)
+        }
+    }
+
+    protected open fun parseConfig(config: JSONObject): ClientAPI_Config {
+        val openVpnConfig = ClientAPI_Config()
+        openVpnConfig.content = config.getJSONObject("openvpn_config_data").getString("config")
+        return openVpnConfig
+    }
+
+    protected open fun configPluggableTransport(configBuilder: OpenVpnConfig.Builder, config: JSONObject) {}
+
+    private fun makeEstablish(vpnBuilder: Builder): (OpenVpnConfig.Builder) -> Int = { configBuilder ->
+        val openVpnConfig = configBuilder.build()
+        buildVpnInterface(openVpnConfig, vpnBuilder)
+
+        vpnBuilder.establish().use { tunFd ->
+            if (tunFd == null) {
+                throw VpnStartException("Create VPN interface: permission not granted or revoked")
+            }
+            return@use tunFd.detachFd()
+        }
+    }
+}

client/android/openvpn/src/main/kotlin/org/amnezia/vpn/protocol/openvpn/OpenVpnClient.kt

@@ -0,0 +1,426 @@
+package org.amnezia.vpn.protocol.openvpn
+
+import android.net.ProxyInfo
+import android.os.Build
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.getAndUpdate
+import net.openvpn.ovpn3.ClientAPI_Config
+import net.openvpn.ovpn3.ClientAPI_EvalConfig
+import net.openvpn.ovpn3.ClientAPI_Event
+import net.openvpn.ovpn3.ClientAPI_LogInfo
+import net.openvpn.ovpn3.ClientAPI_OpenVPNClient
+import net.openvpn.ovpn3.ClientAPI_Status
+import net.openvpn.ovpn3.ClientAPI_StringVec
+import net.openvpn.ovpn3.ClientAPI_TransportStats
+import org.amnezia.vpn.protocol.ProtocolState
+import org.amnezia.vpn.protocol.ProtocolState.CONNECTED
+import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTED
+import org.amnezia.vpn.protocol.ProtocolState.RECONNECTING
+import org.amnezia.vpn.util.Log
+import org.amnezia.vpn.util.net.InetNetwork
+import org.amnezia.vpn.util.net.parseInetAddress
+
+private const val TAG = "OpenVpnClient"
+private const val EMULATED_EXCLUDE_ROUTES = (1 shl 16)
+
+class OpenVpnClient(
+    private val configBuilder: OpenVpnConfig.Builder,
+    private val state: MutableStateFlow<ProtocolState>,
+    private val getLocalNetworks: (Boolean) -> List<InetNetwork>,
+    internal var establish: (OpenVpnConfig.Builder) -> Int,
+    private val protect: (Int) -> Boolean,
+    private val onError: (String) -> Unit
+) : ClientAPI_OpenVPNClient() {
+
+    /**************************************************************************
+     * Tun builder callbacks
+     **************************************************************************/
+
+    // Tun builder methods, loosely based on the Android VpnService.Builder
+    // abstraction.  These methods comprise an abstraction layer that
+    // allows the OpenVPN C++ core to call out to external methods for
+    // establishing the tunnel, adding routes, etc.
+
+    // All methods returning bool use the return
+    // value to indicate success (true) or fail (false).
+    // tun_builder_new() should be called first, then arbitrary setter methods,
+    // and finally tun_builder_establish to return the socket descriptor
+    // for the session.  IP addresses are pre-validated before being passed to
+    // these methods.
+    // This interface is based on Android's VpnService.Builder.
+
+    // Callback to construct a new tun builder
+    // Should be called first.
+    override fun tun_builder_new(): Boolean {
+        Log.d(TAG, "tun_builder_new")
+        configBuilder.clearAddresses()
+        return true
+    }
+
+    // Callback to set MTU of the VPN interface
+    // Never called more than once per tun_builder session.
+    override fun tun_builder_set_mtu(mtu: Int): Boolean {
+        Log.d(TAG, "tun_builder_set_mtu: $mtu")
+        configBuilder.setMtu(mtu)
+        return true
+    }
+
+    // Callback to add network address to VPN interface
+    // May be called more than once per tun_builder session
+    override fun tun_builder_add_address(
+        address: String, prefix_length: Int,
+        gateway: String, ipv6: Boolean, net30: Boolean
+    ): Boolean {
+        Log.d(TAG, "tun_builder_add_address: $address, $prefix_length, $gateway, $ipv6, $net30")
+        configBuilder.addAddress(InetNetwork(address, prefix_length))
+        return true
+    }
+
+    // Callback to add route to VPN interface
+    // May be called more than once per tun_builder session
+    // metric is optional and should be ignored if < 0
+    override fun tun_builder_add_route(address: String, prefix_length: Int, metric: Int, ipv6: Boolean): Boolean {
+        Log.d(TAG, "tun_builder_add_route: $address, $prefix_length, $metric, $ipv6")
+        if (address == "remote_host") return false
+        configBuilder.addRoute(InetNetwork(address, prefix_length))
+        return true
+    }
+
+    // Callback to exclude route from VPN interface
+    // May be called more than once per tun_builder session
+    // metric is optional and should be ignored if < 0
+    override fun tun_builder_exclude_route(address: String, prefix_length: Int, metric: Int, ipv6: Boolean): Boolean {
+        Log.d(TAG, "tun_builder_exclude_route: $address, $prefix_length, $metric, $ipv6")
+        configBuilder.excludeRoute(InetNetwork(address, prefix_length))
+        return true
+    }
+
+    // Callback to add DNS server to VPN interface
+    // May be called more than once per tun_builder session
+    // If reroute_dns is true, all DNS traffic should be routed over the
+    // tunnel, while if false, only DNS traffic that matches an added search
+    // domain should be routed.
+    // Guaranteed to be called after tun_builder_reroute_gw.
+    override fun tun_builder_add_dns_server(address: String, ipv6: Boolean): Boolean {
+        Log.d(TAG, "tun_builder_add_dns_server: $address, $ipv6")
+        configBuilder.addDnsServer(parseInetAddress(address))
+        return true
+    }
+
+    // Optional callback that indicates whether traffic of a certain
+    // address family (AF_INET or AF_INET6) should be
+    // blocked or allowed, to prevent unencrypted packet leakage when
+    // the tunnel is IPv4-only/IPv6-only, but the local machine
+    // has connectivity with the other protocol to the internet.
+    // Controlled by "block-ipv6" and block-ipv6 config var.
+    // If addresses are added for a family this setting should be
+    // ignored for that family
+    // See also Android's VPNService.Builder.allowFamily method
+    /* override fun tun_builder_set_allow_family(af: Int, allow: Boolean): Boolean {
+        Log.d(TAG, "tun_builder_set_allow_family: $af, $allow")
+        return true
+    } */
+
+    // Callback to set address of remote server
+    // Never called more than once per tun_builder session.
+    override fun tun_builder_set_remote_address(address: String, ipv6: Boolean): Boolean {
+        Log.d(TAG, "tun_builder_set_remote_address: $address, $ipv6")
+        return true
+    }
+
+    // Optional callback that indicates OSI layer, should be 2 or 3.
+    // Defaults to 3.
+    override fun tun_builder_set_layer(layer: Int): Boolean {
+        Log.d(TAG, "tun_builder_set_layer: $layer")
+        return layer == 3
+    }
+
+    // Callback to set the session name
+    // Never called more than once per tun_builder session.
+    override fun tun_builder_set_session_name(name: String): Boolean {
+        Log.d(TAG, "tun_builder_set_session_name: $name")
+        return true
+    }
+
+    // Callback to establish the VPN tunnel, returning a file descriptor
+    // to the tunnel, which the caller will henceforth own.  Returns -1
+    // if the tunnel could not be established.
+    // Always called last after tun_builder session has been configured.
+    override fun tun_builder_establish(): Int {
+        Log.d(TAG, "tun_builder_establish")
+        return establish(configBuilder)
+    }
+
+    // Callback to reroute default gateway to VPN interface.
+    // ipv4 is true if the default route to be added should be IPv4.
+    // ipv6 is true if the default route to be added should be IPv6.
+    // flags are defined in RGWFlags (rgwflags.hpp).
+    // Never called more than once per tun_builder session.
+    override fun tun_builder_reroute_gw(ipv4: Boolean, ipv6: Boolean, flags: Long): Boolean {
+        Log.d(TAG, "tun_builder_reroute_gw: $ipv4, $ipv6, $flags")
+        if ((flags and EMULATED_EXCLUDE_ROUTES.toLong()) != 0L) return true
+        if (ipv4) {
+            configBuilder.addRoute(InetNetwork("0.0.0.0", 0))
+        }
+        if (ipv6) {
+            configBuilder.addRoute(InetNetwork("::", 0))
+        }
+        return true
+    }
+
+    // Callback to add search domain to DNS resolver
+    // May be called more than once per tun_builder session
+    // See tun_builder_add_dns_server above for description of
+    // reroute_dns parameter.
+    // Guaranteed to be called after tun_builder_reroute_gw.
+    override fun tun_builder_add_search_domain(domain: String): Boolean {
+        Log.d(TAG, "tun_builder_add_search_domain: $domain")
+        configBuilder.setSearchDomain(domain)
+        return true
+    }
+
+    // Callback to set the HTTP proxy
+    // Never called more than once per tun_builder session.
+    override fun tun_builder_set_proxy_http(host: String, port: Int): Boolean {
+        Log.d(TAG, "tun_builder_set_proxy_http: $host, $port")
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            try {
+                configBuilder.setHttpProxy(ProxyInfo.buildDirectProxy(host, port))
+            } catch (e: Exception) {
+                Log.e(TAG, "Could not set proxy: ${e.message}")
+                return false
+            }
+        }
+        return true
+    }
+
+    // Callback to set the HTTPS proxy
+    // Never called more than once per tun_builder session.
+    override fun tun_builder_set_proxy_https(host: String, port: Int): Boolean {
+        Log.d(TAG, "tun_builder_set_proxy_https: $host, $port")
+        return false
+    }
+
+    // When the exclude local network option is enabled this
+    // function is called to get a list of local networks so routes
+    // to exclude them from the VPN network are generated
+    // This should be a list of CIDR networks (e.g. 192.168.0.0/24)
+    override fun tun_builder_get_local_networks(ipv6: Boolean): ClientAPI_StringVec {
+        Log.d(TAG, "tun_builder_get_local_networks: $ipv6")
+        val networks = ClientAPI_StringVec()
+        for (address in getLocalNetworks(ipv6)) {
+            networks.add(address.toString())
+        }
+        return networks
+    }
+
+    // Optional callback to set default value for route metric.
+    // Guaranteed to be called before other methods that deal
+    // with routes such as tun_builder_add_route and
+    // tun_builder_reroute_gw.  Route metric is ignored
+    // if < 0.
+    /* override fun tun_builder_set_route_metric_default(metric: Int): Boolean {
+        Log.d(TAG, "tun_builder_set_route_metric_default: $metric")
+        return super.tun_builder_set_route_metric_default(metric)
+    } */
+
+    // Callback to add a host which should bypass the proxy
+    // May be called more than once per tun_builder session
+    /* override fun tun_builder_add_proxy_bypass(bypass_host: String): Boolean {
+        Log.d(TAG, "tun_builder_add_proxy_bypass: $bypass_host")
+        return super.tun_builder_add_proxy_bypass(bypass_host)
+    } */
+
+    // Callback to set the proxy "Auto Config URL"
+    // Never called more than once per tun_builder session.
+    /* override fun tun_builder_set_proxy_auto_config_url(url: String): Boolean {
+        Log.d(TAG, "tun_builder_set_proxy_auto_config_url: $url")
+        return super.tun_builder_set_proxy_auto_config_url(url)
+    } */
+
+    // Callback to add Windows WINS server to VPN interface.
+    // WINS server addresses are always IPv4.
+    // May be called more than once per tun_builder session.
+    // Guaranteed to be called after tun_builder_reroute_gw.
+    /* override fun tun_builder_add_wins_server(address: String): Boolean {
+        Log.d(TAG, "tun_builder_add_wins_server: $address")
+        return super.tun_builder_add_wins_server(address)
+    } */
+
+    // Optional callback to set a DNS suffix on tun/tap adapter.
+    // Currently only implemented on Windows, where it will
+    // set the "Connection-specific DNS Suffix" property on
+    // the TAP driver.
+    /* override fun tun_builder_set_adapter_domain_suffix(name: String): Boolean {
+        Log.d(TAG, "tun_builder_set_adapter_domain_suffix: $name")
+        return super.tun_builder_set_adapter_domain_suffix(name)
+    } */
+
+    // Return true if tun interface may be persisted, i.e. rolled
+    // into a new session with properties untouched.  This method
+    // is only called after all other tests of persistence
+    // allowability succeed, therefore it can veto persistence.
+    // If persistence is ultimately enabled,
+    // tun_builder_establish_lite() will be called.  Otherwise,
+    // tun_builder_establish() will be called.
+    /* override fun tun_builder_persist(): Boolean {
+        Log.d(TAG, "tun_builder_persist")
+        return super.tun_builder_persist()
+    } */
+
+    // Indicates a reconnection with persisted tun state.
+    /* override fun tun_builder_establish_lite() {
+        Log.d(TAG, "tun_builder_establish_lite")
+        super.tun_builder_establish_lite()
+    } */
+
+    // Indicates that tunnel is being torn down.
+    // If disconnect == true, then the teardown is occurring
+    // prior to final disconnect.
+    /* override fun tun_builder_teardown(disconnect: Boolean) {
+        Log.d(TAG, "tun_builder_teardown: $disconnect")
+        super.tun_builder_teardown(disconnect)
+    } */
+
+    /**************************************************************************
+     * Connection control methods
+     **************************************************************************/
+
+    // Parse OpenVPN configuration file.
+    override fun eval_config(arg0: ClientAPI_Config): ClientAPI_EvalConfig {
+        Log.d(TAG, "eval_config")
+        return super.eval_config(arg0)
+    }
+
+    // Primary VPN client connect method, doesn't return until disconnect.
+    // Should be called by a worker thread.  This method will make callbacks
+    // to event() and log() functions.  Make sure to call eval_config()
+    // and possibly provide_creds() as well before this function.
+    override fun connect(): ClientAPI_Status {
+        Log.d(TAG, "connect")
+        return super.connect()
+    }
+
+    // Callback to "protect" a socket from being routed through the tunnel.
+    // Will be called from the thread executing connect().
+    // The remote and ipv6 are the remote host this socket will connect to
+    override fun socket_protect(socket: Int, remote: String, ipv6: Boolean): Boolean {
+        Log.d(TAG, "socket_protect: $socket, $remote, $ipv6")
+        return protect(socket)
+    }
+
+    // Stop the client.  Only meaningful when connect() is running.
+    // May be called asynchronously from a different thread
+    // when connect() is running.
+    override fun stop() {
+        Log.d(TAG, "stop")
+        super.stop()
+    }
+
+    // Pause the client -- useful to avoid continuous reconnection attempts
+    // when network is down.  May be called from a different thread
+    // when connect() is running.
+    override fun pause(reason: String) {
+        Log.d(TAG, "pause: $reason")
+        super.pause(reason)
+    }
+
+    // Resume the client after it has been paused.  May be called from a
+    // different thread when connect() is running.
+    override fun resume() {
+        Log.d(TAG, "resume")
+        super.resume()
+    }
+
+    // Do a disconnect/reconnect cycle n seconds from now.  May be called
+    // from a different thread when connect() is running.
+    override fun reconnect(seconds: Int) {
+        Log.d(TAG, "reconnect: $seconds")
+        super.reconnect(seconds)
+    }
+
+    // When a connection is close to timeout, the core will call this
+    // method.  If it returns false, the core will disconnect with a
+    // CONNECTION_TIMEOUT event.  If true, the core will enter a PAUSE
+    // state.
+    override fun pause_on_connection_timeout(): Boolean {
+        Log.d(TAG, "pause_on_connection_timeout")
+        return false
+    }
+
+    // Return information about the most recent connection.  Should be called
+    // after an event of type "CONNECTED".
+    /* override fun connection_info(): ClientAPI_ConnectionInfo {
+        Log.d(TAG, "connection_info")
+        return super.connection_info()
+    } */
+
+    /**************************************************************************
+     * Status callbacks
+     **************************************************************************/
+
+    // Callback for delivering events during connect() call.
+    // Will be called from the thread executing connect().
+    override fun event(event: ClientAPI_Event) {
+        val name = event.name
+        val info = event.info
+        Log.d(TAG, "OpenVpn event: $name: $info")
+        when (name) {
+            "COMPRESSION_ENABLED", "WARN" -> Log.w(TAG, "$name: $info")
+            "CONNECTED" -> state.value = CONNECTED
+            "DISCONNECTED" -> state.value = DISCONNECTED
+            "RECONNECTING" -> {
+                state.getAndUpdate { state ->
+                    if (state == DISCONNECTED || state == CONNECTED) RECONNECTING
+                    else state
+                }
+            }
+        }
+        if (event.error || event.fatal) {
+            state.value = DISCONNECTED
+            onError("OpenVpn ${if (event.error) "ERROR" else "FATAL"}: $name: $info")
+        }
+    }
+
+    // Callback for logging.
+    // Will be called from the thread executing connect().
+    override fun log(arg0: ClientAPI_LogInfo) {
+        arg0.text.dropLastWhile { it == '\n' }.let {
+            Log.d(TAG, "OpenVpnLog: $it")
+        }
+    }
+
+    /**************************************************************************
+     * Stats methods
+     **************************************************************************/
+
+    // return transport stats only
+    override fun transport_stats(): ClientAPI_TransportStats {
+        Log.d(TAG, "transport_stats")
+        return super.transport_stats()
+    }
+
+    // return a stats value, index should be >= 0 and < stats_n()
+    /* override fun stats_value(index: Int): Long {
+        Log.d(TAG, "stats_value: $index")
+        return super.stats_value(index)
+    } */
+
+    // return all stats in a bundle
+    /* override fun stats_bundle(): ClientAPI_LLVector {
+        Log.d(TAG, "stats_bundle")
+        return super.stats_bundle()
+    } */
+
+    // return tun stats only
+    /* override fun tun_stats(): ClientAPI_InterfaceStats {
+        Log.d(TAG, "tun_stats")
+        return super.tun_stats()
+    } */
+
+    // post control channel message
+    /* override fun post_cc_msg(msg: String) {
+        Log.d(TAG, "post_cc_msg: $msg")
+        super.post_cc_msg(msg)
+    } */
+}

client/android/openvpn/src/main/kotlin/org/amnezia/vpn/protocol/openvpn/OpenVpnConfig.kt

@@ -0,0 +1,20 @@
+package org.amnezia.vpn.protocol.openvpn
+
+import org.amnezia.vpn.protocol.ProtocolConfig
+
+private const val OPENVPN_DEFAULT_MTU = 1500
+
+class OpenVpnConfig private constructor(
+    protocolConfigBuilder: ProtocolConfig.Builder
+) : ProtocolConfig(protocolConfigBuilder) {
+
+    class Builder : ProtocolConfig.Builder(false) {
+        override var mtu: Int = OPENVPN_DEFAULT_MTU
+
+        override fun build(): OpenVpnConfig = configBuild().run { OpenVpnConfig(this@Builder) }
+    }
+
+    companion object {
+        inline fun build(block: Builder.() -> Unit): OpenVpnConfig = Builder().apply(block).build()
+    }
+}

client/android/protocolApi/src/main/kotlin/Exceptions.kt

@@ -5,3 +5,4 @@ sealed class ProtocolException(message: String? = null, cause: Throwable? = null
 class BadConfigException(message: String? = null, cause: Throwable? = null) : ProtocolException(message, cause)
 
 class VpnStartException(message: String? = null, cause: Throwable? = null) : ProtocolException(message, cause)
+class VpnException(message: String? = null, cause: Throwable? = null) : ProtocolException(message, cause)

client/android/protocolApi/src/main/kotlin/Protocol.kt

@@ -5,6 +5,7 @@ import android.net.IpPrefix
 import android.net.VpnService
 import android.net.VpnService.Builder
 import android.os.Build
+import android.system.OsConstants
 import androidx.annotation.RequiresApi
 import kotlinx.coroutines.flow.MutableStateFlow
 import org.amnezia.vpn.util.Log
@@ -21,6 +22,7 @@ private const val SPLIT_TUNNEL_EXCLUDE = 2
 
 abstract class Protocol {
 
+    abstract val statistics: Statistics
     protected lateinit var context: Context
     protected lateinit var state: MutableStateFlow<ProtocolState>
     protected lateinit var onError: (String) -> Unit
@@ -43,6 +45,12 @@ abstract class Protocol {
     abstract fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean)
 
     protected fun ProtocolConfig.Builder.configSplitTunneling(config: JSONObject) {
+        if (!allowSplitTunneling) {
+            Log.i(TAG, "Global address split tunneling is prohibited, " +
+                "only tunneling from the protocol config is used")
+            return
+        }
+
         val splitTunnelType = config.optInt("splitTunnelType")
         if (splitTunnelType == SPLIT_TUNNEL_DISABLE) return
         val splitTunnelSites = config.getJSONArray("splitTunnelSites")
@@ -95,6 +103,11 @@ abstract class Protocol {
             }
         }
 
+        config.searchDomain?.let {
+            Log.d(TAG, "addSearchDomain: $it")
+            vpnBuilder.addSearchDomain(it)
+        }
+
         for ((inetNetwork, include) in config.routes) {
             if (include) {
                 Log.d(TAG, "addRoute: $inetNetwork")
@@ -122,6 +135,19 @@ abstract class Protocol {
         Log.d(TAG, "setMtu: ${config.mtu}")
         vpnBuilder.setMtu(config.mtu)
 
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            config.httpProxy?.let {
+                Log.d(TAG, "setHttpProxy: $it")
+                vpnBuilder.setHttpProxy(it)
+            }
+        }
+
+        if (config.allowAllAF) {
+            Log.d(TAG, "allowFamily")
+            vpnBuilder.allowFamily(OsConstants.AF_INET)
+            vpnBuilder.allowFamily(OsConstants.AF_INET6)
+        }
+
         Log.d(TAG, "setBlocking: ${config.blockingMode}")
         vpnBuilder.setBlocking(config.blockingMode)
         vpnBuilder.setUnderlyingNetworks(null)

client/android/protocolApi/src/main/kotlin/ProtocolConfig.kt

@@ -1,6 +1,8 @@
 package org.amnezia.vpn.protocol
 
+import android.net.ProxyInfo
 import android.os.Build
+import androidx.annotation.RequiresApi
 import java.net.InetAddress
 import org.amnezia.vpn.util.net.InetNetwork
 import org.amnezia.vpn.util.net.IpRange
@@ -9,11 +11,14 @@ import org.amnezia.vpn.util.net.IpRangeSet
 open class ProtocolConfig protected constructor(
     val addresses: Set<InetNetwork>,
     val dnsServers: Set<InetAddress>,
+    val searchDomain: String?,
     val routes: Set<Route>,
     val includedAddresses: Set<InetNetwork>,
     val excludedAddresses: Set<InetNetwork>,
     val includedApplications: Set<String>,
     val excludedApplications: Set<String>,
+    val httpProxy: ProxyInfo?,
+    val allowAllAF: Boolean,
     val blockingMode: Boolean,
     val mtu: Int
 ) {
@@ -21,11 +26,14 @@ open class ProtocolConfig protected constructor(
     protected constructor(builder: Builder) : this(
         builder.addresses,
         builder.dnsServers,
+        builder.searchDomain,
         builder.routes,
         builder.includedAddresses,
         builder.excludedAddresses,
         builder.includedApplications,
         builder.excludedApplications,
+        builder.httpProxy,
+        builder.allowAllAF,
         builder.blockingMode,
         builder.mtu
     )
@@ -39,9 +47,21 @@ open class ProtocolConfig protected constructor(
         internal val includedApplications: MutableSet<String> = hashSetOf()
         internal val excludedApplications: MutableSet<String> = hashSetOf()
 
+        internal var searchDomain: String? = null
+            private set
+
+        internal var httpProxy: ProxyInfo? = null
+            private set
+
+        internal var allowAllAF: Boolean = false
+            private set
+
         internal var blockingMode: Boolean = blockingMode
             private set
 
+        internal var allowSplitTunneling: Boolean = true
+            private set
+
         open var mtu: Int = 0
             protected set
 
@@ -52,6 +72,8 @@ open class ProtocolConfig protected constructor(
         fun addDnsServer(dnsServer: InetAddress) = apply { this.dnsServers += dnsServer }
         fun addDnsServers(dnsServers: Collection<InetAddress>) = apply { this.dnsServers += dnsServers }
 
+        fun setSearchDomain(domain: String) = apply { this.searchDomain = domain }
+
         fun addRoute(route: InetNetwork) = apply { this.routes += Route(route, true) }
         fun addRoutes(routes: Collection<InetNetwork>) = apply { this.routes += routes.map { Route(it, true) } }
 
@@ -80,8 +102,15 @@ open class ProtocolConfig protected constructor(
         fun excludeApplication(application: String) = apply { this.excludedApplications += application }
         fun excludeApplications(applications: Collection<String>) = apply { this.excludedApplications += applications }
 
+        @RequiresApi(Build.VERSION_CODES.Q)
+        fun setHttpProxy(httpProxy: ProxyInfo) = apply { this.httpProxy = httpProxy }
+
+        fun setAllowAllAF(allowAllAF: Boolean) = apply { this.allowAllAF = allowAllAF }
+
         fun setBlockingMode(blockingMode: Boolean) = apply { this.blockingMode = blockingMode }
 
+        fun disableSplitTunneling() = apply { this.allowSplitTunneling = false }
+
         fun setMtu(mtu: Int) = apply { this.mtu = mtu }
 
         private fun processSplitTunneling() {

client/android/protocolApi/src/main/kotlin/Statistics.kt

@@ -0,0 +1,50 @@
+package org.amnezia.vpn.protocol
+
+import android.os.Bundle
+
+private const val RX_BYTES_KEY = "rxBytes"
+private const val TX_BYTES_KEY = "txBytes"
+
+@Suppress("DataClassPrivateConstructor")
+data class Statistics private constructor(
+    val rxBytes: Long = 0L,
+    val txBytes: Long = 0L
+) {
+
+    private constructor(builder: Builder) : this(builder.rxBytes, builder.txBytes)
+
+    @Suppress("SuspiciousEqualsCombination")
+    fun isEmpty(): Boolean = this === EMPTY_STATISTICS || this == EMPTY_STATISTICS
+
+    class Builder {
+        var rxBytes: Long = 0L
+            private set
+
+        var txBytes: Long = 0L
+            private set
+
+        fun setRxBytes(rxBytes: Long) = apply { this.rxBytes = rxBytes }
+        fun setTxBytes(txBytes: Long) = apply { this.txBytes = txBytes }
+
+        fun build(): Statistics =
+            if (rxBytes + txBytes == 0L) EMPTY_STATISTICS
+            else Statistics(this)
+    }
+
+    companion object {
+        val EMPTY_STATISTICS: Statistics = Statistics()
+
+        inline fun build(block: Builder.() -> Unit): Statistics = Builder().apply(block).build()
+    }
+}
+
+fun Bundle.putStatistics(statistics: Statistics) {
+    putLong(RX_BYTES_KEY, statistics.rxBytes)
+    putLong(TX_BYTES_KEY, statistics.txBytes)
+}
+
+fun Bundle.getStatistics(): Statistics =
+    Statistics.build {
+        setRxBytes(getLong(RX_BYTES_KEY))
+        setTxBytes(getLong(TX_BYTES_KEY))
+    }

client/android/settings.gradle.kts

@@ -16,7 +16,6 @@ dependencyResolutionManagement {
     repositories {
         google()
         mavenCentral()
-        maven("https://maven.amnezia.org/releases")
     }
 }
 
@@ -33,7 +32,11 @@ include(":qt")
 include(":utils")
 include(":billing")
 include(":protocolApi")
-include(":xtun")
+include(":wireguard")
+include(":awg")
+include(":openvpn")
+include(":xray")
+include(":xray:libXray")
 
 // get values from gradle or local properties
 val androidBuildToolsVersion: String by gradleProperties

client/android/src/org/amnezia/vpn/AmneziaActivity.kt

@@ -58,8 +58,10 @@ import kotlinx.coroutines.async
 import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.runBlocking
+import org.amnezia.vpn.protocol.getStatistics
 import org.amnezia.vpn.protocol.getStatus
 import org.amnezia.vpn.qt.QtAndroidController
+import org.amnezia.vpn.util.LibraryLoader.loadSharedLibrary
 import org.amnezia.vpn.util.Log
 import org.amnezia.vpn.util.Prefs
 import org.json.JSONException
@@ -122,6 +124,12 @@ class AmneziaActivity : QtActivity() {
                         }
                     }
 
+                    ServiceEvent.STATISTICS_UPDATE -> {
+                        msg.data?.getStatistics()?.let { (rxBytes, txBytes) ->
+                            QtAndroidController.onStatisticsUpdate(rxBytes, txBytes)
+                        }
+                    }
+
                     ServiceEvent.ERROR -> {
                         msg.data?.getString(MSG_ERROR)?.let { error ->
                             Log.e(TAG, "From VpnService: $error")
@@ -181,6 +189,7 @@ class AmneziaActivity : QtActivity() {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         Log.d(TAG, "Create Amnezia activity")
+        loadLibs()
 
         // Configure window for edge-to-edge display
         configureWindowForEdgeToEdge()
@@ -209,6 +218,14 @@ class AmneziaActivity : QtActivity() {
         pendingOpenFileUri?.let { outState.putString(KEY_PENDING_OPEN_FILE_URI, it) }
     }
 
+    private fun loadLibs() {
+        listOf(
+            "rsapss"
+        ).forEach {
+            loadSharedLibrary(this.applicationContext, it)
+        }
+    }
+
     private fun registerBroadcastReceivers() {
         notificationStateReceiver = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
             registerBroadcastReceiver(
@@ -633,13 +650,12 @@ class AmneziaActivity : QtActivity() {
 
     private fun getVpnProto(vpnConfig: String): VpnProto? = try {
         require(vpnConfig.isNotBlank()) { "Blank VPN config" }
-        JSONObject(vpnConfig)
-        VpnProto.XTUN
+        VpnProto.get(JSONObject(vpnConfig).getString("protocol"))
     } catch (e: JSONException) {
         Log.e(TAG, "Invalid VPN config json format: ${e.message}")
         null
     } catch (e: IllegalArgumentException) {
-        Log.e(TAG, "Invalid VPN config: ${e.message}")
+        Log.e(TAG, "Protocol not found: ${e.message}")
         null
     }
 

client/android/src/org/amnezia/vpn/AmneziaVpnService.kt

@@ -47,8 +47,10 @@ import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTED
 import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTING
 import org.amnezia.vpn.protocol.ProtocolState.RECONNECTING
 import org.amnezia.vpn.protocol.ProtocolState.UNKNOWN
+import org.amnezia.vpn.protocol.VpnException
 import org.amnezia.vpn.protocol.VpnStartException
 import org.amnezia.vpn.protocol.putStatus
+import org.amnezia.vpn.util.LoadLibraryException
 import org.amnezia.vpn.util.Log
 import org.amnezia.vpn.util.Prefs
 import org.amnezia.vpn.util.net.NetworkState
@@ -70,6 +72,7 @@ const val AFTER_PERMISSION_CHECK = "AFTER_PERMISSION_CHECK"
 private const val PREFS_CONFIG_KEY = "LAST_CONF"
 private const val PREFS_SERVER_NAME = "LAST_SERVER_NAME"
 private const val PREFS_SERVER_INDEX = "LAST_SERVER_INDEX"
+// private const val STATISTICS_SENDING_TIMEOUT = 1000L
 private const val TRAFFIC_STATS_UPDATE_TIMEOUT = 1000L
 private const val DISCONNECT_TIMEOUT = 5000L
 private const val STOP_SERVICE_TIMEOUT = 5000L
@@ -97,6 +100,7 @@ open class AmneziaVpnService : VpnService() {
     private var connectionJob: Job? = null
     private var disconnectionJob: Job? = null
     private var trafficStatsUpdateJob: Job? = null
+    // private var statisticsSendingJob: Job? = null
     private lateinit var networkState: NetworkState
     private lateinit var trafficStats: TrafficStats
     private var controlReceiver: BroadcastReceiver? = null
@@ -105,6 +109,9 @@ open class AmneziaVpnService : VpnService() {
     private var screenOffReceiver: BroadcastReceiver? = null
     private val clientMessengers = ConcurrentHashMap<Messenger, IpcMessenger>()
 
+    private val isActivityConnected
+        get() = clientMessengers.any { it.value.name == ACTIVITY_MESSENGER_NAME }
+
     private val connectionExceptionHandler = CoroutineExceptionHandler { _, e ->
         connectionJob?.cancel()
         connectionJob = null
@@ -113,11 +120,14 @@ open class AmneziaVpnService : VpnService() {
         protocolState.value = DISCONNECTED
         when (e) {
             is IllegalArgumentException,
-            is VpnStartException -> onError(e.message ?: e.toString())
+            is VpnStartException,
+            is VpnException -> onError(e.message ?: e.toString())
 
             is JSONException,
             is BadConfigException -> onError("VPN config format error: ${e.message}")
 
+            is LoadLibraryException -> onError("${e.message}. Caused: ${e.cause?.message}")
+
             is UnknownHostException -> onError("Unknown host")
 
             else -> throw e
@@ -135,11 +145,13 @@ open class AmneziaVpnService : VpnService() {
                         val messenger = IpcMessenger(msg.replyTo, clientName)
                         clientMessengers[msg.replyTo] = messenger
                         Log.d(TAG, "Messenger client '$clientName' was registered")
+                        // if (clientName == ACTIVITY_MESSENGER_NAME && isConnected) launchSendingStatistics()
                     }
 
                     Action.UNREGISTER_CLIENT -> {
                         clientMessengers.remove(msg.replyTo)?.let {
                             Log.d(TAG, "Messenger client '${it.name}' was unregistered")
+                            // if (it.name == ACTIVITY_MESSENGER_NAME) stopSendingStatistics()
                         }
                     }
 
@@ -369,22 +381,26 @@ open class AmneziaVpnService : VpnService() {
                 when (protocolState) {
                     CONNECTED -> {
                         networkState.bindNetworkListener()
+                        // if (isActivityConnected) launchSendingStatistics()
                         launchTrafficStatsUpdate()
                     }
 
                     DISCONNECTED -> {
                         networkState.unbindNetworkListener()
                         stopTrafficStatsUpdateJob()
+                        // stopSendingStatistics()
                         if (!isServiceBound) stopService()
                     }
 
                     DISCONNECTING -> {
                         networkState.unbindNetworkListener()
                         stopTrafficStatsUpdateJob()
+                        // stopSendingStatistics()
                     }
 
                     RECONNECTING -> {
                         stopTrafficStatsUpdateJob()
+                        // stopSendingStatistics()
                     }
 
                     CONNECTING, UNKNOWN -> {}
@@ -393,6 +409,27 @@ open class AmneziaVpnService : VpnService() {
         }
     }
 
+/*  @MainThread
+    private fun launchSendingStatistics() {
+        if (isServiceBound && isConnected) {
+            statisticsSendingJob = mainScope.launch {
+                while (true) {
+                    clientMessenger.send {
+                        ServiceEvent.STATISTICS_UPDATE.packToMessage {
+                            putStatistics(protocol?.statistics ?: Statistics.EMPTY_STATISTICS)
+                        }
+                    }
+                    delay(STATISTICS_SENDING_TIMEOUT)
+                }
+            }
+        }
+    }
+
+    @MainThread
+    private fun stopSendingStatistics() {
+        statisticsSendingJob?.cancel()
+    } */
+
     @MainThread
     private fun enableNotification() {
         registerScreenStateBroadcastReceivers()
@@ -467,7 +504,13 @@ open class AmneziaVpnService : VpnService() {
             return
         }
 
-        vpnProto = VpnProto.XTUN
+        try {
+            vpnProto = VpnProto.get(config.getString("protocol"))
+        } catch (e: Exception) {
+            onError("Invalid VPN config: ${e.message}")
+            protocolState.value = DISCONNECTED
+            return
+        }
 
         protocolState.value = CONNECTING
 

client/android/src/org/amnezia/vpn/AwgService.kt

@@ -0,0 +1,3 @@
+package org.amnezia.vpn
+
+class AwgService : AmneziaVpnService()

client/android/src/org/amnezia/vpn/IpcMessage.kt

@@ -22,6 +22,7 @@ sealed interface IpcMessage {
 enum class ServiceEvent : IpcMessage {
     STATUS_CHANGED,
     STATUS,
+    STATISTICS_UPDATE,
     ERROR
 }
 

client/android/src/org/amnezia/vpn/OpenVpnService.kt

@@ -0,0 +1,3 @@
+package org.amnezia.vpn
+
+class OpenVpnService : AmneziaVpnService()

client/android/src/org/amnezia/vpn/VpnProto.kt

@@ -1,20 +1,54 @@
 package org.amnezia.vpn
 
 import org.amnezia.vpn.protocol.Protocol
-import org.amnezia.vpn.protocol.VPN_SESSION_NAME
-import org.amnezia.vpn.protocol.xtun.Xtun
+import org.amnezia.vpn.protocol.awg.Awg
+import org.amnezia.vpn.protocol.openvpn.OpenVpn
+import org.amnezia.vpn.protocol.wireguard.Wireguard
+import org.amnezia.vpn.protocol.xray.Xray
 
 enum class VpnProto(
     val label: String,
     val processName: String,
     val serviceClass: Class<out AmneziaVpnService>
 ) {
-    XTUN(
-        VPN_SESSION_NAME,
-        "org.amnezia.vpn:amneziaVpnService",
-        XtunService::class.java
+    WIREGUARD(
+        "WireGuard",
+        "org.amnezia.vpn:amneziaAwgService",
+        AwgService::class.java
     ) {
-        override fun createProtocol(): Protocol = Xtun()
+        override fun createProtocol(): Protocol = Wireguard()
+    },
+
+    AWG(
+        "AmneziaWG",
+        "org.amnezia.vpn:amneziaAwgService",
+        AwgService::class.java
+    ) {
+        override fun createProtocol(): Protocol = Awg()
+    },
+
+    OPENVPN(
+        "OpenVPN",
+        "org.amnezia.vpn:amneziaOpenVpnService",
+        OpenVpnService::class.java
+    ) {
+        override fun createProtocol(): Protocol = OpenVpn()
+    },
+
+    XRAY(
+        "XRay",
+        "org.amnezia.vpn:amneziaXrayService",
+        XrayService::class.java
+    ) {
+        override fun createProtocol(): Protocol = Xray.instance
+    },
+
+    SSXRAY(
+        "SSXRay",
+        "org.amnezia.vpn:amneziaXrayService",
+        XrayService::class.java
+    ) {
+        override fun createProtocol(): Protocol = Xray.instance
     };
 
     private var _protocol: Protocol? = null
@@ -25,4 +59,8 @@ enum class VpnProto(
         }
 
     protected abstract fun createProtocol(): Protocol
+
+    companion object {
+        fun get(protocolName: String): VpnProto = VpnProto.valueOf(protocolName.uppercase())
+    }
 }

client/android/src/org/amnezia/vpn/XrayService.kt

@@ -0,0 +1,3 @@
+package org.amnezia.vpn
+
+class XrayService : AmneziaVpnService()

client/android/src/org/amnezia/vpn/XtunService.kt

@@ -1,3 +0,0 @@
-package org.amnezia.vpn
-
-class XtunService : AmneziaVpnService()

client/android/src/org/amnezia/vpn/qt/QtAndroidController.kt

@@ -19,6 +19,7 @@ object QtAndroidController {
     external fun onVpnPermissionRejected()
     external fun onNotificationStateChanged()
     external fun onVpnStateChanged(stateCode: Int)
+    external fun onStatisticsUpdate(rxBytes: Long, txBytes: Long)
 
     external fun onFileOpened(uri: String)
     external fun onFileSaved(success: Boolean, cancelled: Boolean)

client/android/utils/src/main/kotlin/JsonExt.kt

@@ -1,6 +1,9 @@
 package org.amnezia.vpn.util
 
 import org.json.JSONArray
+import org.json.JSONObject
 
 inline fun <reified T> JSONArray.asSequence(): Sequence<T> =
     (0..<length()).asSequence().map { get(it) as T }
+
+fun JSONObject.optStringOrNull(name: String) = optString(name).ifEmpty { null }

client/android/utils/src/main/kotlin/LibraryLoader.kt

@@ -0,0 +1,66 @@
+package org.amnezia.vpn.util
+
+import android.annotation.SuppressLint
+import android.content.Context
+import android.os.Build
+import java.io.File
+import java.io.FileOutputStream
+import java.util.zip.ZipFile
+
+private const val TAG = "LibraryLoader"
+
+object LibraryLoader {
+    private fun extractLibrary(context: Context, libraryName: String, destination: File): Boolean {
+        Log.d(TAG, "Extracting library: $libraryName")
+        val apks = hashSetOf<String>()
+        context.applicationInfo.run {
+            sourceDir?.let { apks += it }
+            splitSourceDirs?.let { apks += it }
+        }
+        for (abi in Build.SUPPORTED_ABIS) {
+            for (apk in apks) {
+                ZipFile(File(apk), ZipFile.OPEN_READ).use { zipFile ->
+                    val mappedName = System.mapLibraryName(libraryName)
+                    val libraryZipPath = listOf("lib", abi, mappedName).joinToString(File.separator)
+                    val zipEntry = zipFile.getEntry(libraryZipPath)
+                    zipEntry?.let {
+                        Log.d(TAG, "Extracting apk:/$libraryZipPath to ${destination.absolutePath}")
+                        FileOutputStream(destination).use { outStream ->
+                            zipFile.getInputStream(zipEntry).use { inStream ->
+                                inStream.copyTo(outStream, 32 * 1024)
+                                outStream.fd.sync()
+                            }
+                        }
+                    }
+                    return true
+                }
+            }
+        }
+        return false
+    }
+
+    @SuppressLint("UnsafeDynamicallyLoadedCode")
+    fun loadSharedLibrary(context: Context, libraryName: String) {
+        Log.d(TAG, "Loading library: $libraryName")
+        try {
+            System.loadLibrary(libraryName)
+            return
+        } catch (_: UnsatisfiedLinkError) {
+            Log.w(TAG, "Failed to load library, try to extract it from apk")
+        }
+        var tempFile: File? = null
+        try {
+            tempFile = File.createTempFile("lib", ".so", context.codeCacheDir)
+            if (extractLibrary(context, libraryName, tempFile)) {
+                System.load(tempFile.absolutePath)
+                return
+            }
+        } catch (e: Exception) {
+            throw LoadLibraryException("Failed to load library apk: $libraryName", e)
+        } finally {
+            tempFile?.delete()
+        }
+    }
+}
+
+class LoadLibraryException(message: String? = null, cause: Throwable? = null) : Exception(message, cause)

client/android/utils/src/main/kotlin/net/InetEndpoint.kt

@@ -0,0 +1,22 @@
+package org.amnezia.vpn.util.net
+
+import java.net.Inet4Address
+import java.net.InetAddress
+
+data class InetEndpoint(val address: InetAddress, val port: Int) {
+
+    override fun toString(): String = if (address is Inet4Address) {
+        "${address.ip}:$port"
+    } else {
+        "[${address.ip}]:$port"
+    }
+
+    companion object {
+        fun parse(data: String): InetEndpoint {
+            val i = data.lastIndexOf(':')
+            val address = parseInetAddress(data.substring(0, i))
+            val port = data.substring(i + 1).toInt()
+            return InetEndpoint(address, port)
+        }
+    }
+}

client/android/utils/src/main/kotlin/net/NetworkUtils.kt

@@ -11,6 +11,30 @@ import java.net.Inet4Address
 import java.net.Inet6Address
 import java.net.InetAddress
 
+fun getLocalNetworks(context: Context, ipv6: Boolean): List<InetNetwork> {
+    val connectivityManager = context.getSystemService<ConnectivityManager>()!!
+    connectivityManager.activeNetwork?.let { network ->
+        val netCapabilities = connectivityManager.getNetworkCapabilities(network)
+        val linkProperties = connectivityManager.getLinkProperties(network)
+        if (linkProperties == null ||
+            netCapabilities == null ||
+            netCapabilities.hasTransport(NetworkCapabilities.TRANSPORT_VPN) ||
+            netCapabilities.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR)
+        ) return emptyList()
+
+        val addresses = mutableListOf<InetNetwork>()
+
+        for (linkAddress in linkProperties.linkAddresses) {
+            val address = linkAddress.address
+            if ((!ipv6 && address is Inet4Address) || (ipv6 && address is Inet6Address)) {
+                addresses += InetNetwork(address, linkAddress.prefixLength)
+            }
+        }
+        return addresses
+    }
+    return emptyList()
+}
+
 fun parseInetAddress(address: String): InetAddress = InetAddress.getByName(address)
 
 private val parseNumericAddressCompat: (String) -> InetAddress =

client/android/wireguard/build.gradle.kts

@@ -0,0 +1,18 @@
+plugins {
+    id(libs.plugins.android.library.get().pluginId)
+    id(libs.plugins.kotlin.android.get().pluginId)
+}
+
+kotlin {
+    jvmToolchain(17)
+}
+
+android {
+    namespace = "org.amnezia.vpn.protocol.wireguard"
+}
+
+dependencies {
+    compileOnly(project(":utils"))
+    compileOnly(project(":protocolApi"))
+    implementation(libs.kotlinx.coroutines)
+}

client/android/wireguard/src/main/kotlin/org/amnezia/awg/GoBackend.kt

@@ -0,0 +1,10 @@
+package org.amnezia.awg
+
+object GoBackend {
+    external fun awgGetConfig(handle: Int): String?
+    external fun awgGetSocketV4(handle: Int): Int
+    external fun awgGetSocketV6(handle: Int): Int
+    external fun awgTurnOff(handle: Int)
+    external fun awgTurnOn(ifName: String, tunFd: Int, settings: String): Int
+    external fun awgVersion(): String
+}

client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/Wireguard.kt

@@ -0,0 +1,251 @@
+package org.amnezia.vpn.protocol.wireguard
+
+import android.net.VpnService.Builder
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import org.amnezia.awg.GoBackend
+import org.amnezia.vpn.protocol.Protocol
+import org.amnezia.vpn.protocol.ProtocolState.CONNECTED
+import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTED
+import org.amnezia.vpn.protocol.Statistics
+import org.amnezia.vpn.protocol.VpnException
+import org.amnezia.vpn.protocol.VpnStartException
+import org.amnezia.vpn.util.LibraryLoader.loadSharedLibrary
+import org.amnezia.vpn.util.Log
+import org.amnezia.vpn.util.asSequence
+import org.amnezia.vpn.util.net.InetEndpoint
+import org.amnezia.vpn.util.net.InetNetwork
+import org.amnezia.vpn.util.net.parseInetAddress
+import org.amnezia.vpn.util.optStringOrNull
+import org.json.JSONObject
+
+private const val TAG = "Wireguard"
+
+open class Wireguard : Protocol() {
+
+    private var tunnelHandle: Int = -1
+    private var config: WireguardConfig? = null // save config for reconnect
+    protected open val ifName: String = "amn0"
+    private lateinit var scope: CoroutineScope
+    private var statusJob: Job? = null
+
+    override val statistics: Statistics
+        get() {
+            if (tunnelHandle == -1) return Statistics.EMPTY_STATISTICS
+            val config = GoBackend.awgGetConfig(tunnelHandle) ?: return Statistics.EMPTY_STATISTICS
+            return Statistics.build {
+                var optsCount = 0
+                config.splitToSequence("\n").forEach { line ->
+                    with(line) {
+                        when {
+                            startsWith("rx_bytes=") -> setRxBytes(substring(9).toLong()).also { ++optsCount }
+                            startsWith("tx_bytes=") -> setTxBytes(substring(9).toLong()).also { ++optsCount }
+                            else -> {}
+                        }
+                    }
+                    if (optsCount == 2) return@forEach
+                }
+            }
+        }
+
+    override fun internalInit() {
+        if (!isInitialized) loadSharedLibrary(context, "wg-go")
+        if (this::scope.isInitialized) {
+            scope.cancel()
+        }
+        scope = CoroutineScope(Dispatchers.IO)
+    }
+
+    override suspend fun startVpn(config: JSONObject, vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        val wireguardConfig = parseConfig(config)
+        start(wireguardConfig, vpnBuilder, protect)
+        this.config = wireguardConfig
+    }
+
+    protected open fun parseConfig(config: JSONObject): WireguardConfig {
+        val configData = config.getJSONObject("wireguard_config_data")
+        return WireguardConfig.build {
+            configWireguard(config, configData)
+            configSplitTunneling(config)
+            configAppSplitTunneling(config)
+        }
+    }
+
+    protected fun WireguardConfig.Builder.configWireguard(config: JSONObject, configData: JSONObject) {
+        configData.getString("client_ip").split(",").map { address ->
+            InetNetwork.parse(address.trim())
+        }.forEach(::addAddress)
+
+        config.optStringOrNull("dns1")?.let { dns ->
+            addDnsServer(parseInetAddress(dns.trim()))
+        }
+
+        config.optStringOrNull("dns2")?.let { dns ->
+            addDnsServer(parseInetAddress(dns.trim()))
+        }
+
+        val defRoutes = hashSetOf(
+            InetNetwork("0.0.0.0", 0),
+            InetNetwork("::", 0)
+        )
+        val routes = hashSetOf<InetNetwork>()
+        configData.getJSONArray("allowed_ips").asSequence<String>().map { route ->
+            InetNetwork.parse(route.trim())
+        }.forEach(routes::add)
+        // if the allowed IPs list contains at least one non-default route, disable global split tunneling
+        if (routes.any { it !in defRoutes }) disableSplitTunneling()
+        addRoutes(routes)
+
+        configData.optStringOrNull("mtu")?.let { setMtu(it.toInt()) }
+
+        val host = configData.getString("hostName").let { parseInetAddress(it.trim()) }
+        val port = configData.getInt("port")
+        setEndpoint(InetEndpoint(host, port))
+
+        if (configData.optBoolean("isObfuscationEnabled")) {
+            setUseProtocolExtension(true)
+            configExtensionParameters(configData)
+        }
+
+        configData.optStringOrNull("persistent_keep_alive")?.let { setPersistentKeepalive(it) }
+        configData.getString("client_priv_key").let { setPrivateKeyHex(it.base64ToHex()) }
+        configData.getString("server_pub_key").let { setPublicKeyHex(it.base64ToHex()) }
+        configData.optStringOrNull("psk_key")?.let { setPreSharedKeyHex(it.base64ToHex()) }
+    }
+
+    protected fun WireguardConfig.Builder.configExtensionParameters(configData: JSONObject) {
+        configData.optStringOrNull("Jc")?.let { setJc(it.toInt()) }
+        configData.optStringOrNull("Jmin")?.let { setJmin(it.toInt()) }
+        configData.optStringOrNull("Jmax")?.let { setJmax(it.toInt()) }
+        configData.optStringOrNull("S1")?.let { setS1(it.toInt()) }
+        configData.optStringOrNull("S2")?.let { setS2(it.toInt()) }
+        configData.optStringOrNull("S3")?.let { setS3(it.toInt()) }
+        configData.optStringOrNull("S4")?.let { setS4(it.toInt()) }
+        configData.optStringOrNull("H1")?.trim()?.let { if (it.isNotEmpty()) setH1(it) }
+        configData.optStringOrNull("H2")?.trim()?.let { if (it.isNotEmpty()) setH2(it) }
+        configData.optStringOrNull("H3")?.trim()?.let { if (it.isNotEmpty()) setH3(it) }
+        configData.optStringOrNull("H4")?.trim()?.let { if (it.isNotEmpty()) setH4(it) }
+        configData.optStringOrNull("I1")?.let { setI1(it) }
+        configData.optStringOrNull("I2")?.let { setI2(it) }
+        configData.optStringOrNull("I3")?.let { setI3(it) }
+        configData.optStringOrNull("I4")?.let { setI4(it) }
+        configData.optStringOrNull("I5")?.let { setI5(it) }
+        configData.optStringOrNull("HeaderProtectionKey")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setHeaderProtectionKey(it.base64ToHex()) }
+        configData.optStringOrNull("ContentPaddingAddition")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setContentPaddingAddition(it) }
+        configData.optStringOrNull("RekeyAfterTime")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setRekeyAfterTime(it) }
+        configData.optStringOrNull("RekeyTimeout")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setRekeyTimeout(it) }
+        configData.optStringOrNull("RejectAfterTime")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setRejectAfterTime(it) }
+        configData.optStringOrNull("KeepaliveTimeout")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setKeepaliveTimeout(it) }
+        configData.optStringOrNull("MaxHandshakeAttempts")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setMaxHandshakeAttempts(it) }
+        configData.optStringOrNull("RandomTrailers")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setRandomTrailers(it) }
+        configData.optStringOrNull("DisableCookies")?.trim()?.takeIf { it.isNotEmpty() }
+            ?.let { setDisableCookies(it) }
+    }
+
+    private fun start(
+        config: WireguardConfig,
+        vpnBuilder: Builder,
+        protect: (Int) -> Boolean,
+        stopExistingVpn: Boolean = false
+    ) {
+        if (!stopExistingVpn && tunnelHandle != -1) {
+            Log.w(TAG, "Tunnel already up")
+            return
+        }
+
+        buildVpnInterface(config, vpnBuilder)
+
+        vpnBuilder.establish().use { tunFd ->
+            if (stopExistingVpn && tunnelHandle != -1) {
+                turnOffVpn()
+            }
+            if (tunFd == null) {
+                throw VpnStartException("Create VPN interface: permission not granted or revoked")
+            }
+            Log.i(TAG, "awg-go backend ${GoBackend.awgVersion()}")
+            tunnelHandle = GoBackend.awgTurnOn(ifName, tunFd.detachFd(), config.toWgUserspaceString())
+        }
+
+        if (tunnelHandle < 0) {
+            tunnelHandle = -1
+            throw VpnStartException("Wireguard tunnel creation error")
+        }
+
+        if (!protect(GoBackend.awgGetSocketV4(tunnelHandle)) || !protect(GoBackend.awgGetSocketV6(tunnelHandle))) {
+            GoBackend.awgTurnOff(tunnelHandle)
+            tunnelHandle = -1
+            throw VpnStartException("Protect VPN interface: permission not granted or revoked")
+        }
+        launchStatusJob()
+    }
+
+    private fun launchStatusJob() {
+        Log.d(TAG, "Launch status job")
+        statusJob = scope.launch {
+            while (true) {
+                val lastHandshake = getLastHandshake()
+                Log.v(TAG, "lastHandshake=$lastHandshake")
+                if (lastHandshake == 0L) {
+                    delay(1000)
+                    continue
+                }
+                if (lastHandshake == -2L || lastHandshake > 0L) state.value = CONNECTED
+                else if (lastHandshake == -1L) state.value = DISCONNECTED
+                statusJob = null
+                break
+            }
+        }
+    }
+
+    private fun getLastHandshake(): Long {
+        if (tunnelHandle == -1) {
+            Log.e(TAG, "Trying to get config of a non-existent tunnel")
+            return -1
+        }
+        val config = GoBackend.awgGetConfig(tunnelHandle)
+        if (config == null) {
+            Log.e(TAG, "Failed to get tunnel config")
+            return -2
+        }
+        val lastHandshake = config.lines().find { it.startsWith("last_handshake_time_sec=") }?.substring(24)?.toLong()
+        if (lastHandshake == null) {
+            Log.e(TAG, "Failed to get last_handshake_time_sec")
+            return -2
+        }
+        return lastHandshake
+    }
+
+    private fun turnOffVpn() {
+        statusJob?.cancel()
+        statusJob = null
+        val handleToClose = tunnelHandle
+        tunnelHandle = -1
+        GoBackend.awgTurnOff(handleToClose)
+    }
+
+    override fun stopVpn() {
+        if (tunnelHandle == -1) {
+            Log.w(TAG, "Tunnel already down")
+            return
+        }
+        turnOffVpn()
+        state.value = DISCONNECTED
+    }
+
+    override fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        val config = this.config ?: throw VpnException("Reconnect config is empty")
+        start(config, vpnBuilder, protect, true)
+    }
+}

client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/WireguardConfig.kt

@@ -0,0 +1,242 @@
+package org.amnezia.vpn.protocol.wireguard
+
+import android.util.Base64
+import org.amnezia.vpn.protocol.BadConfigException
+import org.amnezia.vpn.protocol.ProtocolConfig
+import org.amnezia.vpn.util.net.InetEndpoint
+
+private const val WIREGUARD_DEFAULT_MTU = 1280
+
+open class WireguardConfig protected constructor(
+    protocolConfigBuilder: ProtocolConfig.Builder,
+    val endpoint: InetEndpoint,
+    val persistentKeepalive: String?,
+    val publicKeyHex: String,
+    val preSharedKeyHex: String?,
+    val privateKeyHex: String,
+    val useProtocolExtension: Boolean,
+    val jc: Int?,
+    val jmin: Int?,
+    val jmax: Int?,
+    val s1: Int?,
+    val s2: Int?,
+    val s3: Int?,
+    val s4: Int?,
+    val h1: String?,
+    val h2: String?,
+    val h3: String?,
+    val h4: String?,
+    var i1: String?,
+    var i2: String?,
+    var i3: String?,
+    var i4: String?,
+    var i5: String?,
+    val headerProtectionKeyHex: String?,
+    val contentPaddingAddition: String?,
+    val rekeyAfterTime: String?,
+    val rekeyTimeout: String?,
+    val rejectAfterTime: String?,
+    val keepaliveTimeout: String?,
+    val maxHandshakeAttempts: String?,
+    val randomTrailers: String?,
+    val disableCookies: String?,
+) : ProtocolConfig(protocolConfigBuilder) {
+
+    protected constructor(builder: Builder) : this(
+        builder,
+        builder.endpoint,
+        builder.persistentKeepalive,
+        builder.publicKeyHex,
+        builder.preSharedKeyHex,
+        builder.privateKeyHex,
+        builder.useProtocolExtension,
+        builder.jc,
+        builder.jmin,
+        builder.jmax,
+        builder.s1,
+        builder.s2,
+        builder.s3,
+        builder.s4,
+        builder.h1,
+        builder.h2,
+        builder.h3,
+        builder.h4,
+        builder.i1,
+        builder.i2,
+        builder.i3,
+        builder.i4,
+        builder.i5,
+        builder.headerProtectionKeyHex,
+        builder.contentPaddingAddition,
+        builder.rekeyAfterTime,
+        builder.rekeyTimeout,
+        builder.rejectAfterTime,
+        builder.keepaliveTimeout,
+        builder.maxHandshakeAttempts,
+        builder.randomTrailers,
+        builder.disableCookies,
+    )
+
+    fun toWgUserspaceString(): String = with(StringBuilder()) {
+        appendDeviceLine(this)
+        appendLine("replace_peers=true")
+        appendPeerLine(this)
+        return this.toString()
+    }
+
+    open fun appendDeviceLine(sb: StringBuilder) = with(sb) {
+        appendLine("private_key=$privateKeyHex")
+        if (useProtocolExtension) {
+            validateProtocolExtensionParameters()
+            appendLine("jc=$jc")
+            appendLine("jmin=$jmin")
+            appendLine("jmax=$jmax")
+            appendLine("s1=$s1")
+            appendLine("s2=$s2")
+            s3?.let { appendLine("s3=$it") }
+            s4?.let { appendLine("s4=$it") }
+            appendLine("h1=$h1")
+            appendLine("h2=$h2")
+            appendLine("h3=$h3")
+            appendLine("h4=$h4")
+            i1?.let { appendLine("i1=$it") }
+            i2?.let { appendLine("i2=$it") }
+            i3?.let { appendLine("i3=$it") }
+            i4?.let { appendLine("i4=$it") }
+            i5?.let { appendLine("i5=$it") }
+        }
+        headerProtectionKeyHex?.takeIf { it.isNotEmpty() }?.let { appendLine("header_protection_key=$it") }
+        contentPaddingAddition?.takeIf { it.isNotEmpty() }?.let { appendLine("content_padding_addition=$it") }
+        rekeyAfterTime?.takeIf { it.isNotEmpty() }?.let { appendLine("rekey_after_time=$it") }
+        rekeyTimeout?.takeIf { it.isNotEmpty() }?.let { appendLine("rekey_timeout=$it") }
+        rejectAfterTime?.takeIf { it.isNotEmpty() }?.let { appendLine("reject_after_time=$it") }
+        keepaliveTimeout?.takeIf { it.isNotEmpty() }?.let { appendLine("keepalive_timeout=$it") }
+        maxHandshakeAttempts?.takeIf { it.isNotEmpty() }?.let { appendLine("max_handshake_attempts=$it") }
+        randomTrailers?.takeIf { it.isNotEmpty() }?.let { appendLine("random_trailers=${it.toUapiBool()}") }
+        disableCookies?.takeIf { it.isNotEmpty() }?.let { appendLine("disable_cookies=${it.toUapiBool()}") }
+    }
+
+    private fun validateProtocolExtensionParameters() {
+        if (jc == null) throw BadConfigException("Parameter jc is undefined")
+        if (jmin == null) throw BadConfigException("Parameter jmin is undefined")
+        if (jmax == null) throw BadConfigException("Parameter jmax is undefined")
+        if (s1 == null) throw BadConfigException("Parameter s1 is undefined")
+        if (s2 == null) throw BadConfigException("Parameter s2 is undefined")
+        if (h1 == null) throw BadConfigException("Parameter h1 is undefined")
+        if (h2 == null) throw BadConfigException("Parameter h2 is undefined")
+        if (h3 == null) throw BadConfigException("Parameter h3 is undefined")
+        if (h4 == null) throw BadConfigException("Parameter h4 is undefined")
+    }
+
+    open fun appendPeerLine(sb: StringBuilder) = with(sb) {
+        appendLine("public_key=$publicKeyHex")
+        routes.filter { it.include }.forEach { route ->
+            appendLine("allowed_ip=${route.inetNetwork}")
+        }
+        appendLine("endpoint=$endpoint")
+        if (!persistentKeepalive.isNullOrEmpty() && persistentKeepalive != "0")
+            appendLine("persistent_keepalive_interval=$persistentKeepalive")
+        if (preSharedKeyHex != null)
+            appendLine("preshared_key=$preSharedKeyHex")
+    }
+
+    open class Builder : ProtocolConfig.Builder(true) {
+        internal lateinit var endpoint: InetEndpoint
+            private set
+
+        internal var persistentKeepalive: String? = null
+            private set
+
+        internal lateinit var publicKeyHex: String
+            private set
+
+        internal var preSharedKeyHex: String? = null
+            private set
+
+        internal lateinit var privateKeyHex: String
+            private set
+
+        override var mtu: Int = WIREGUARD_DEFAULT_MTU
+
+        internal var useProtocolExtension: Boolean = false
+
+        internal var jc: Int? = null
+        internal var jmin: Int? = null
+        internal var jmax: Int? = null
+        internal var s1: Int? = null
+        internal var s2: Int? = null
+        internal var s3: Int? = null
+        internal var s4: Int? = null
+        internal var h1: String? = null
+        internal var h2: String? = null
+        internal var h3: String? = null
+        internal var h4: String? = null
+        internal var i1: String? = null
+        internal var i2: String? = null
+        internal var i3: String? = null
+        internal var i4: String? = null
+        internal var i5: String? = null
+        internal var headerProtectionKeyHex: String? = null
+        internal var contentPaddingAddition: String? = null
+        internal var rekeyAfterTime: String? = null
+        internal var rekeyTimeout: String? = null
+        internal var rejectAfterTime: String? = null
+        internal var keepaliveTimeout: String? = null
+        internal var maxHandshakeAttempts: String? = null
+        internal var randomTrailers: String? = null
+        internal var disableCookies: String? = null
+
+        fun setEndpoint(endpoint: InetEndpoint) = apply { this.endpoint = endpoint }
+
+        fun setPersistentKeepalive(persistentKeepalive: String) = apply { this.persistentKeepalive = persistentKeepalive }
+
+        fun setPublicKeyHex(publicKeyHex: String) = apply { this.publicKeyHex = publicKeyHex }
+
+        fun setPreSharedKeyHex(preSharedKeyHex: String) = apply { this.preSharedKeyHex = preSharedKeyHex }
+
+        fun setPrivateKeyHex(privateKeyHex: String) = apply { this.privateKeyHex = privateKeyHex }
+
+        fun setUseProtocolExtension(useProtocolExtension: Boolean) = apply { this.useProtocolExtension = useProtocolExtension }
+
+        fun setJc(jc: Int) = apply { this.jc = jc }
+        fun setJmin(jmin: Int) = apply { this.jmin = jmin }
+        fun setJmax(jmax: Int) = apply { this.jmax = jmax }
+        fun setS1(s1: Int) = apply { this.s1 = s1 }
+        fun setS2(s2: Int) = apply { this.s2 = s2 }
+        fun setS3(s3: Int) = apply { this.s3 = s3 }
+        fun setS4(s4: Int) = apply { this.s4 = s4 }
+        fun setH1(h1: String) = apply { this.h1 = h1 }
+        fun setH2(h2: String) = apply { this.h2 = h2 }
+        fun setH3(h3: String) = apply { this.h3 = h3 }
+        fun setH4(h4: String) = apply { this.h4 = h4 }
+        fun setI1(i1: String) = apply { this.i1 = i1 }
+        fun setI2(i2: String) = apply { this.i2 = i2 }
+        fun setI3(i3: String) = apply { this.i3 = i3 }
+        fun setI4(i4: String) = apply { this.i4 = i4 }
+        fun setI5(i5: String) = apply { this.i5 = i5 }
+        fun setHeaderProtectionKey(headerProtectionKeyHex: String) = apply { this.headerProtectionKeyHex = headerProtectionKeyHex }
+        fun setContentPaddingAddition(contentPaddingAddition: String) = apply { this.contentPaddingAddition = contentPaddingAddition }
+        fun setRekeyAfterTime(rekeyAfterTime: String) = apply { this.rekeyAfterTime = rekeyAfterTime }
+        fun setRekeyTimeout(rekeyTimeout: String) = apply { this.rekeyTimeout = rekeyTimeout }
+        fun setRejectAfterTime(rejectAfterTime: String) = apply { this.rejectAfterTime = rejectAfterTime }
+        fun setKeepaliveTimeout(keepaliveTimeout: String) = apply { this.keepaliveTimeout = keepaliveTimeout }
+        fun setMaxHandshakeAttempts(maxHandshakeAttempts: String) = apply { this.maxHandshakeAttempts = maxHandshakeAttempts }
+        fun setRandomTrailers(randomTrailers: String) = apply { this.randomTrailers = randomTrailers }
+        fun setDisableCookies(disableCookies: String) = apply { this.disableCookies = disableCookies }
+
+        override fun build(): WireguardConfig = configBuild().run { WireguardConfig(this@Builder) }
+    }
+
+    companion object {
+        inline fun build(block: Builder.() -> Unit): WireguardConfig = Builder().apply(block).build()
+    }
+}
+
+@OptIn(ExperimentalStdlibApi::class)
+internal fun String.base64ToHex(): String = Base64.decode(this, Base64.DEFAULT).toHexString()
+
+/** Converts awg-quick on/off (and 0/1/true/false) to UAPI 1/0 for amneziawg-go ParseBool. */
+internal fun String.toUapiBool(): String = when (trim().lowercase()) {
+    "on", "1", "true", "t", "yes" -> "1"
+    else -> "0"
+}

client/android/xray/build.gradle.kts

@@ -0,0 +1,19 @@
+plugins {
+    id(libs.plugins.android.library.get().pluginId)
+    id(libs.plugins.kotlin.android.get().pluginId)
+}
+
+kotlin {
+    jvmToolchain(17)
+}
+
+android {
+    namespace = "org.amnezia.vpn.protocol.xray"
+}
+
+dependencies {
+    compileOnly(project(":utils"))
+    compileOnly(project(":protocolApi"))
+    implementation(project(":xray:libXray"))
+    implementation(libs.kotlinx.coroutines)
+}

client/android/xray/libXray/build.gradle.kts

@@ -0,0 +1,6 @@
+@file:Suppress("UnstableApiUsage")
+
+configurations {
+    maybeCreate("default")
+}
+artifacts.add("default", file("libxray.aar"))

client/android/xray/src/main/kotlin/Xray.kt

@@ -0,0 +1,254 @@
+package org.amnezia.vpn.protocol.xray
+
+import android.content.Context
+import android.net.VpnService.Builder
+import java.io.File
+import java.io.IOException
+import java.net.InetAddress
+import java.net.ServerSocket
+import java.util.UUID
+import go.Seq
+import org.amnezia.vpn.protocol.BadConfigException
+import org.amnezia.vpn.protocol.Protocol
+import org.amnezia.vpn.protocol.ProtocolState.CONNECTED
+import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTED
+import org.amnezia.vpn.protocol.Statistics
+import org.amnezia.vpn.protocol.VpnStartException
+import org.amnezia.vpn.protocol.xray.libXray.DialerController
+import org.amnezia.vpn.protocol.xray.libXray.LibXray
+import org.amnezia.vpn.protocol.xray.libXray.Logger
+import org.amnezia.vpn.protocol.xray.libXray.Tun2SocksConfig
+import org.amnezia.vpn.util.Log
+import org.amnezia.vpn.util.net.InetNetwork
+import org.amnezia.vpn.util.net.ip
+import org.amnezia.vpn.util.net.parseInetAddress
+import org.json.JSONArray
+import org.json.JSONObject
+
+private const val TAG = "Xray"
+private const val LIBXRAY_TAG = "libXray"
+
+private fun findSocksInboundIndex(inbounds: JSONArray): Int {
+    for (i in 0 until inbounds.length()) {
+        val o = inbounds.optJSONObject(i) ?: continue
+        if (o.optString("protocol").equals("socks", ignoreCase = true)) {
+            return i
+        }
+    }
+    return -1
+}
+
+private fun acquireFreeLocalPort(): Int {
+    try {
+        ServerSocket(0, 1, InetAddress.getByName("127.0.0.1")).use { return it.localPort }
+    } catch (e: Exception) {
+        throw VpnStartException(
+            "Failed to acquire free TCP port on 127.0.0.1 for SOCKS inbound: ${e.message}"
+        )
+    }
+}
+
+class Xray : Protocol() {
+
+    private var isRunning: Boolean = false
+    override val statistics: Statistics = Statistics.EMPTY_STATISTICS
+
+    override fun internalInit() {
+        Seq.setContext(context)
+        if (!isInitialized) {
+            LibXray.initLogger(object : Logger {
+                override fun warning(s: String) = Log.w(LIBXRAY_TAG, s)
+
+                override fun error(s: String) = Log.e(LIBXRAY_TAG, s)
+
+                override fun write(msg: ByteArray): Long {
+                    Log.w(LIBXRAY_TAG, String(msg))
+                    return msg.size.toLong()
+                }
+            }).isNotNullOrBlank { err ->
+                Log.w(TAG, "Failed to initialize logger: $err")
+            }
+        }
+    }
+
+    override suspend fun startVpn(config: JSONObject, vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        if (isRunning) {
+            Log.w(TAG, "XRay already running")
+            return
+        }
+
+        val xrayConfigData = config.optJSONObject("xray_config_data")
+            ?: config.optJSONObject("ssxray_config_data")
+            ?: throw BadConfigException("config_data not found")
+        val xrayJsonConfig = JSONObject(xrayConfigData.optString("config"))
+
+        // Inject SOCKS5 auth before starting xray. Re-uses existing credentials if present.
+        ensureInboundAuth(xrayJsonConfig)
+        val xrayConfig = parseConfig(config, xrayJsonConfig)
+
+        var xrayJsonConfigString = xrayJsonConfig.toString()
+        config.getString("hostName").let { hostName ->
+            val ipAddress = parseInetAddress(hostName).ip
+            if (hostName != ipAddress) {
+                xrayJsonConfigString = xrayJsonConfigString.replace(hostName, ipAddress)
+            }
+        }
+
+        start(xrayConfig, xrayJsonConfigString, vpnBuilder, protect)
+        state.value = CONNECTED
+        isRunning = true
+    }
+
+    private fun parseConfig(config: JSONObject, xrayJsonConfig: JSONObject): XrayConfig {
+        return XrayConfig.build {
+            addAddress(XrayConfig.DEFAULT_IPV4_ADDRESS)
+
+            config.optString("dns1").let {
+                if (it.isNotBlank()) addDnsServer(parseInetAddress(it))
+            }
+
+            config.optString("dns2").let {
+                if (it.isNotBlank()) addDnsServer(parseInetAddress(it))
+            }
+
+            addRoute(InetNetwork("0.0.0.0", 0))
+            addRoute(InetNetwork("2000::0", 3))
+            config.getString("hostName").let {
+                excludeRoute(InetNetwork(it, 32))
+            }
+
+            config.optString("mtu").let {
+                if (it.isNotBlank()) setMtu(it.toInt())
+            }
+
+            val inbounds = xrayJsonConfig.getJSONArray("inbounds")
+            val socksIdx = findSocksInboundIndex(inbounds)
+            if (socksIdx < 0) {
+                throw BadConfigException("socks inbound not found")
+            }
+            val socksConfig = inbounds.getJSONObject(socksIdx)
+            socksConfig.getInt("port").let { setSocksPort(it) }
+
+            val socksSettings = socksConfig.optJSONObject("settings")
+            val accounts = socksSettings?.optJSONArray("accounts")
+            if (accounts != null && accounts.length() > 0) {
+                val account = accounts.getJSONObject(0)
+                setSocksUser(account.optString("user"))
+                setSocksPass(account.optString("pass"))
+            }
+
+            configSplitTunneling(config)
+            configAppSplitTunneling(config)
+        }
+    }
+
+    private fun start(config: XrayConfig, configJson: String, vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        buildVpnInterface(config, vpnBuilder)
+
+        DialerController { protect(it.toInt()) }.also {
+            LibXray.registerDialerController(it).isNotNullOrBlank { err ->
+                throw VpnStartException("Failed to register dialer controller: $err")
+            }
+            LibXray.registerListenerController(it).isNotNullOrBlank { err ->
+                throw VpnStartException("Failed to register listener controller: $err")
+            }
+        }
+
+        vpnBuilder.establish().use { tunFd ->
+            if (tunFd == null) {
+                throw VpnStartException("Create VPN interface: permission not granted or revoked")
+            }
+            Log.d(TAG, "Run tun2Socks")
+            runTun2Socks(config, tunFd.detachFd())
+
+            Log.d(TAG, "Run XRay")
+            Log.i(TAG, "xray ${LibXray.xrayVersion()}")
+            val assetsPath = context.getDir("assets", Context.MODE_PRIVATE).absolutePath
+            LibXray.initXray(assetsPath)
+            val geoDir = File(assetsPath, "geo").absolutePath
+            val configPath = File(context.cacheDir, "config.json")
+            Log.v(TAG, "xray.location.asset: $geoDir")
+            Log.v(TAG, "config: $configPath")
+            try {
+                configPath.writeText(configJson)
+            } catch (e: IOException) {
+                LibXray.stopTun2Socks()
+                throw VpnStartException("Failed to write xray config: ${e.message}")
+            }
+            LibXray.runXray(geoDir, configPath.absolutePath, config.maxMemory).isNotNullOrBlank { err ->
+                LibXray.stopTun2Socks()
+                throw VpnStartException("Failed to start xray: $err")
+            }
+        }
+    }
+
+    override fun stopVpn() {
+        LibXray.stopXray().isNotNullOrBlank { err ->
+            Log.e(TAG, "Failed to stop XRay: $err")
+        }
+        LibXray.stopTun2Socks().isNotNullOrBlank { err ->
+            Log.e(TAG, "Failed to stop tun2Socks: $err")
+        }
+
+        isRunning = false
+        state.value = DISCONNECTED
+    }
+
+    override fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        state.value = CONNECTED
+    }
+
+    private fun runTun2Socks(config: XrayConfig, fd: Int) {
+        val proxyUrl = "socks5://${config.socksUser}:${config.socksPass}@127.0.0.1:${config.socksPort}"
+        val tun2SocksConfig = Tun2SocksConfig().apply {
+            mtu = config.mtu.toLong()
+            proxy = proxyUrl
+            device = "fd://$fd"
+            logLevel = "warn"
+        }
+        LibXray.startTun2Socks(tun2SocksConfig, fd.toLong()).isNotNullOrBlank { err ->
+            throw VpnStartException("Failed to start tun2socks: $err")
+        }
+    }
+
+    // Ensures SOCKS5 auth is present on the socks inbound settings.
+    // Re-uses existing credentials if already configured; otherwise generates random ones.
+    private fun ensureInboundAuth(xrayConfig: JSONObject) {
+        val inbounds = xrayConfig.optJSONArray("inbounds") ?: return
+        val socksIdx = findSocksInboundIndex(inbounds)
+        if (socksIdx < 0) return
+
+        val inbound = inbounds.getJSONObject(socksIdx)
+        inbound.put("port", acquireFreeLocalPort())
+        val settings = inbound.optJSONObject("settings") ?: JSONObject().also { inbound.put("settings", it) }
+        val accounts = settings.optJSONArray("accounts")
+        if (accounts != null && accounts.length() > 0) {
+            val account = accounts.getJSONObject(0)
+            if (account.optString("user").isNotEmpty() && account.optString("pass").isNotEmpty()) {
+                // Ensure auth mode is enforced even for imported configs that had accounts
+                // but auth: "noauth" (or no auth field).
+                settings.put("auth", "password")
+                inbound.put("settings", settings)
+                inbounds.put(socksIdx, inbound)
+                return
+            }
+        }
+
+        val user = UUID.randomUUID().toString().replace("-", "").substring(0, 16)
+        val pass = UUID.randomUUID().toString().replace("-", "")
+        settings.put("auth", "password")
+        settings.put("accounts", JSONArray().put(JSONObject().put("user", user).put("pass", pass)))
+        inbound.put("settings", settings)
+        inbounds.put(socksIdx, inbound)
+    }
+
+    companion object {
+        val instance: Xray by lazy { Xray() }
+    }
+}
+
+private fun String?.isNotNullOrBlank(block: (String) -> Unit) {
+    if (!this.isNullOrBlank()) {
+        block(this)
+    }
+}

client/android/xray/src/main/kotlin/XrayConfig.kt

@@ -0,0 +1,56 @@
+package org.amnezia.vpn.protocol.xray
+
+import org.amnezia.vpn.protocol.ProtocolConfig
+import org.amnezia.vpn.util.net.InetNetwork
+
+private const val XRAY_DEFAULT_MTU = 1500
+private const val XRAY_DEFAULT_MAX_MEMORY: Long = 50 shl 20 // 50 MB
+
+class XrayConfig protected constructor(
+    protocolConfigBuilder: ProtocolConfig.Builder,
+    val socksPort: Int,
+    val socksUser: String,
+    val socksPass: String,
+    val maxMemory: Long,
+) : ProtocolConfig(protocolConfigBuilder) {
+
+    protected constructor(builder: Builder) : this(
+        builder,
+        builder.socksPort,
+        builder.socksUser,
+        builder.socksPass,
+        builder.maxMemory
+    )
+
+    class Builder : ProtocolConfig.Builder(false) {
+        internal var socksPort: Int = 0
+            private set
+
+        internal var socksUser: String = ""
+            private set
+
+        internal var socksPass: String = ""
+            private set
+
+        internal var maxMemory: Long = XRAY_DEFAULT_MAX_MEMORY
+            private set
+
+        override var mtu: Int = XRAY_DEFAULT_MTU
+
+        fun setSocksPort(port: Int) = apply { socksPort = port }
+
+        fun setSocksUser(user: String) = apply { socksUser = user }
+
+        fun setSocksPass(pass: String) = apply { socksPass = pass }
+
+        fun setMaxMemory(maxMemory: Long) = apply { this.maxMemory = maxMemory }
+
+        override fun build(): XrayConfig = configBuild().run { XrayConfig(this@Builder) }
+    }
+
+    companion object {
+        internal val DEFAULT_IPV4_ADDRESS: InetNetwork = InetNetwork("10.0.42.2", 30)
+
+        inline fun build(block: Builder.() -> Unit): XrayConfig = Builder().apply(block).build()
+    }
+}

client/android/xtun/src/main/kotlin/org/amnezia/vpn/protocol/xtun/Xtun.kt

@@ -1,117 +0,0 @@
-package org.amnezia.vpn.protocol.xtun
-
-import android.net.VpnService.Builder
-import org.amnezia.vpn.protocol.BadConfigException
-import org.amnezia.vpn.protocol.Protocol
-import org.amnezia.vpn.protocol.ProtocolConfig
-import org.amnezia.vpn.protocol.ProtocolState.CONNECTED
-import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTED
-import org.amnezia.vpn.protocol.ProtocolState.RECONNECTING
-import org.amnezia.vpn.protocol.VpnStartException
-import org.amnezia.vpn.util.Log
-import org.amnezia.vpn.util.asSequence
-import org.amnezia.vpn.util.net.InetNetwork
-import org.amnezia.vpn.util.net.parseInetAddress
-import org.amnezia.xtun.XtunException
-import org.amnezia.xtun.XtunProxy
-import org.amnezia.xtun.XtunTunnel
-import org.json.JSONObject
-
-private const val TAG = "Xtun"
-
-private const val DEFAULT_MTU = 1280
-private const val STATUS_CONNECTED = 2
-
-private val INTERFACE_ADDRESSES = listOf(InetNetwork("172.19.0.1", 30), InetNetwork("fdfe:dcba:9876::1", 126))
-
-class Xtun : Protocol() {
-
-    private var proxy: XtunProxy? = null
-    private var tunnel: XtunTunnel? = null
-    @Volatile
-    private var isTunnelConnected = false
-
-    override fun internalInit() {}
-
-    override suspend fun startVpn(config: JSONObject, vpnBuilder: Builder, protect: (Int) -> Boolean) {
-        val proto = when (config.optString("proto")) {
-            "awg" -> XtunProxy.Proto.AWG
-            "xray" -> XtunProxy.Proto.XRAY
-            else -> throw BadConfigException("The protocol is not supported by xtun")
-        }
-
-        try {
-            val newProxy = XtunProxy(
-                proto,
-                config.getString("config"),
-                { socket -> protect(socket) },
-                { log -> Log.d(TAG, log) },
-                ::onStatus
-            )
-            proxy = newProxy
-            val newTunnel = XtunTunnel(
-                { dns, routes, mtu -> createTun(config, vpnBuilder, dns, routes, mtu) },
-                INTERFACE_ADDRESSES.map { it.toString() }.toTypedArray()
-            )
-            tunnel = newTunnel
-            newTunnel.attachProxy(newProxy)
-            newTunnel.start()
-        } catch (e: XtunException) {
-            close()
-            throw VpnStartException("xtun: ${e.message}", e)
-        }
-    }
-
-    override fun stopVpn() {
-        close()
-        state.value = DISCONNECTED
-    }
-
-    override fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean) {
-        tunnel?.networkChanged()
-        if (isTunnelConnected) state.value = CONNECTED
-    }
-
-    private fun onStatus(status: Int) {
-        Log.d(TAG, "xtun status: $status")
-        isTunnelConnected = status == STATUS_CONNECTED
-        if (isTunnelConnected) {
-            state.value = CONNECTED
-        } else if (state.value == CONNECTED) {
-            state.value = RECONNECTING
-        }
-    }
-
-    private fun createTun(config: JSONObject, vpnBuilder: Builder, dns: Array<String>, routes: Array<String>, mtu: Int): Int {
-        val dnsServers = dns.ifEmpty { config.getJSONArray("dns").asSequence<String>().toList().toTypedArray() }
-        val protocolConfig = ProtocolConfig.build(blockingMode = true) {
-            addAddresses(INTERFACE_ADDRESSES)
-            addDnsServers(dnsServers.map(::parseInetAddress))
-            addRoutes(routes.map { InetNetwork.parse(it) })
-            setMtu(if (mtu > 0) mtu else config.optInt("mtu").takeIf { it > 0 } ?: DEFAULT_MTU)
-            configSplitTunneling(config)
-            configAppSplitTunneling(config)
-        }
-        buildVpnInterface(protocolConfig, vpnBuilder)
-
-        val tunFd = vpnBuilder.establish()
-        if (tunFd == null) {
-            Log.e(TAG, "Create VPN interface: permission not granted or revoked")
-            return -1
-        }
-        return tunFd.detachFd()
-    }
-
-    private fun close() {
-        isTunnelConnected = false
-        val currentTunnel = tunnel
-        val currentProxy = proxy
-        tunnel = null
-        proxy = null
-        if (currentTunnel != null && currentProxy != null) {
-            currentTunnel.detachProxy(currentProxy)
-        }
-        currentTunnel?.close()
-        currentProxy?.close()
-    }
-}

client/cmake/android.cmake

@@ -36,16 +36,37 @@ link_directories(${CMAKE_CURRENT_SOURCE_DIR}/platforms/android)
 set(HEADERS ${HEADERS}
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_controller.h
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_utils.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/core/protocols/androidVpnProtocol.h
     ${CMAKE_CURRENT_SOURCE_DIR}/core/utils/installedAppsImageProvider.h
 )
 
 set(SOURCES ${SOURCES}
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_controller.cpp
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_utils.cpp
+    ${CMAKE_CURRENT_SOURCE_DIR}/core/protocols/androidVpnProtocol.cpp
     ${CMAKE_CURRENT_SOURCE_DIR}/core/utils/installedAppsImageProvider.cpp
 )
 
 
+find_package(awg-android REQUIRED)
+set_property(TARGET ${PROJECT} APPEND PROPERTY QT_ANDROID_EXTRA_LIBS
+    $<TARGET_FILE:amnezia::awg-android>
+    ${AMNEZIA_ANDROID_LIBWG_PATH}
+    ${AMNEZIA_ANDROID_LIBWG_QUICK_PATH}
+)
+
+find_package(amnezia-libxray REQUIRED)
+file(COPY ${AMNEZIA_LIBXRAY_PATH} DESTINATION ${CMAKE_CURRENT_SOURCE_DIR}/android/xray/libXray)
+
+find_package(openvpn-pt-android REQUIRED)
+get_filename_component(OPENVPN_PT_ANDROID_LIB_DIR ${OPENVPN_PT_ANDROID_LIBCK_OVPN_PLUGIN_PATH} DIRECTORY)
+set_property(TARGET ${PROJECT} APPEND PROPERTY QT_ANDROID_EXTRA_LIBS
+    ${OPENVPN_PT_ANDROID_LIBCK_OVPN_PLUGIN_PATH}
+    ${OPENVPN_PT_ANDROID_LIB_DIR}/libovpn3.so
+    ${OPENVPN_PT_ANDROID_LIB_DIR}/libovpnutil.so
+    ${OPENVPN_PT_ANDROID_LIB_DIR}/librsapss.so
+)
+
 set(APP_ANDROID_PACKAGE_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/android)
 
 if(APP_ANDROID_MAX_SDK)

client/cmake/branding/ios.cmake

@@ -32,14 +32,14 @@ endif()
 
 # -- signing
 if(NOT CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER)
-    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS app provisioning profile specifier for release")
+    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.amneziaVPN" CACHE STRING "iOS app provisioning profile specifier for release")
 endif()
 if(NOT CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG)
-    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS app provisioning profile specifier for debug")
+    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.amneziaVPN" CACHE STRING "iOS app provisioning profile specifier for debug")
 endif()
 if(NOT CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER)
-    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS network extension provisioning profile specifier for release")
+    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.amneziaVPN.NE" CACHE STRING "iOS network extension provisioning profile specifier for release")
 endif()
 if(NOT CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER_DEBUG)
-    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS network extension provisioning profile specifier for debug")
+    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.amneziaVPN.NE" CACHE STRING "iOS network extension provisioning profile specifier for debug")
 endif()

client/cmake/branding/macos.cmake

@@ -24,7 +24,7 @@ endif()
 
 # -- signing
 if(NOT CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER)
-    set(CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER "distr macos.org.amnezia.AmneziaVPN" CACHE STRING "macOS app provisioning profile specifier for release")
+    set(CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER "distr macos.org.amnezia.amneziaVPN" CACHE STRING "macOS app provisioning profile specifier for release")
 endif()
 if(NOT CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG)
     set(CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev macos.org.amnezia.AmneziaVPN" CACHE STRING "macOS app provisioning profile specifier for debug")

client/cmake/ios.cmake

@@ -43,6 +43,7 @@ set(SOURCES ${SOURCES}
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ioscontextmenu.mm
+    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/AmneziaSceneDelegateHooks.mm
@@ -112,8 +113,11 @@ target_compile_options(${PROJECT} PRIVATE
     -DVPN_NE_BUNDLEID=\"${BUILD_IOS_APP_IDENTIFIER}.network-extension\"
 )
 
+set(WG_APPLE_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/3rd/amneziawg-apple/Sources)
+
 target_sources(${PROJECT} PRIVATE
 #    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosvpnprotocol.swift
+    ${WG_APPLE_SOURCE_DIR}/WireGuardKitC/x25519.c
     ${CLIENT_ROOT_DIR}/platforms/ios/LogController.swift
     ${CLIENT_ROOT_DIR}/platforms/ios/Log.swift
     ${CLIENT_GROUP_IDENTIFIER_SWIFT_FILE}

client/cmake/macos_ne.cmake

@@ -43,6 +43,7 @@ set_source_files_properties(${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_contro
 set(SOURCES ${SOURCES}
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.mm
+    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
     ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
 )
@@ -108,7 +109,10 @@ target_compile_options(${PROJECT} PRIVATE
     -DVPN_NE_BUNDLEID=\"${BUILD_IOS_APP_IDENTIFIER}.network-extension\"
 )
 
+set(WG_APPLE_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/3rd/amneziawg-apple/Sources)
+
 target_sources(${PROJECT} PRIVATE
+    ${WG_APPLE_SOURCE_DIR}/WireGuardKitC/x25519.c
     ${CLIENT_ROOT_DIR}/platforms/ios/LogController.swift
     ${CLIENT_ROOT_DIR}/platforms/ios/Log.swift
     ${CLIENT_GROUP_IDENTIFIER_SWIFT_FILE}
@@ -152,6 +156,12 @@ message(${QtCore_location})
 
 get_filename_component(QT_BIN_DIR_DETECTED "${QtCore_location}/../../../../../bin" ABSOLUTE)
 
+set(MACDEPLOYQT_ARGS -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR})
+if(Qt6_VERSION VERSION_GREATER_EQUAL 6.11)
+    list(APPEND MACDEPLOYQT_ARGS -no-codesign)
+endif()
+
+# $<TARGET_BUNDLE_DIR> points to the build tree; xcodebuild archive builds the bundle elsewhere
 add_custom_command(TARGET ${PROJECT} POST_BUILD
-    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:${PROJECT}> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR} -no-codesign
+    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt \${TARGET_BUILD_DIR}/\${WRAPPER_NAME} ${MACDEPLOYQT_ARGS}
 )

client/cmake/sources.cmake

@@ -76,7 +76,16 @@ set(HEADERS ${HEADERS}
     ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.h
     ${CLIENT_ROOT_DIR}/core/utils/swiftBridge.h
     ${CLIENT_ROOT_DIR}/core/utils/utilities.h
-    ${CLIENT_ROOT_DIR}/core/utils/tunnelSettings.h
+    ${CLIENT_ROOT_DIR}/core/utils/managementServer.h
+    ${CLIENT_ROOT_DIR}/core/utils/constants.h
+)
+
+# Mozilla headres
+set(HEADERS ${HEADERS}
+    ${CLIENT_ROOT_DIR}/mozilla/models/server.h
+    ${CLIENT_ROOT_DIR}/mozilla/shared/ipaddress.h
+    ${CLIENT_ROOT_DIR}/mozilla/shared/leakdetector.h
+    ${CLIENT_ROOT_DIR}/mozilla/controllerimpl.h
 )
 
 if(NOT IOS AND NOT MACOS_NE)
@@ -136,6 +145,7 @@ set(SOURCES ${SOURCES}
     ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.cpp
     ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.cpp
     ${CLIENT_ROOT_DIR}/ui/utils/mtProxyPublicHostInput.cpp
+    ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.cpp
     ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.cpp
     ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.cpp
     ${CLIENT_ROOT_DIR}/core/utils/payloadSender.cpp
@@ -157,7 +167,14 @@ set(SOURCES ${SOURCES}
     ${CLIENT_ROOT_DIR}/core/utils/serverConfigUtils.cpp
     ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.cpp
     ${CLIENT_ROOT_DIR}/core/utils/utilities.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/tunnelSettings.cpp
+    ${CLIENT_ROOT_DIR}/core/utils/managementServer.cpp
+)
+
+# Mozilla sources
+set(SOURCES ${SOURCES}
+    ${CLIENT_ROOT_DIR}/mozilla/models/server.cpp
+    ${CLIENT_ROOT_DIR}/mozilla/shared/ipaddress.cpp
+    ${CLIENT_ROOT_DIR}/mozilla/shared/leakdetector.cpp
 )
 
 if(NOT IOS AND NOT MACOS_NE)
@@ -253,6 +270,14 @@ set(SOURCES ${SOURCES}
 )
 
 if(WIN32)
+    set(HEADERS ${HEADERS}
+        ${CLIENT_ROOT_DIR}/core/protocols/ikev2VpnProtocolWindows.h
+    )
+
+    set(SOURCES ${SOURCES}
+        ${CLIENT_ROOT_DIR}/core/protocols/ikev2VpnProtocolWindows.cpp
+    )
+
     set(RESOURCES ${RESOURCES}
         ${CMAKE_CURRENT_BINARY_DIR}/amneziavpn.rc
     )
@@ -265,11 +290,21 @@ if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
     set(HEADERS ${HEADERS}
         ${CLIENT_ROOT_DIR}/core/utils/ipcClient.h
         ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.h
+        ${CLIENT_ROOT_DIR}/core/protocols/openVpnProtocol.h
+        ${CLIENT_ROOT_DIR}/core/protocols/wireGuardProtocol.h
+        ${CLIENT_ROOT_DIR}/core/protocols/xrayProtocol.h
+        ${CLIENT_ROOT_DIR}/core/protocols/awgProtocol.h
+        ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.h
     )
 
     set(SOURCES ${SOURCES}
         ${CLIENT_ROOT_DIR}/core/utils/ipcClient.cpp
+        ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.cpp
         ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.cpp
+        ${CLIENT_ROOT_DIR}/core/protocols/openVpnProtocol.cpp
+        ${CLIENT_ROOT_DIR}/core/protocols/wireGuardProtocol.cpp
+        ${CLIENT_ROOT_DIR}/core/protocols/xrayProtocol.cpp
+        ${CLIENT_ROOT_DIR}/core/protocols/awgProtocol.cpp
     )
 endif()
 

client/cmake/xtunApple.cmake

@@ -1,18 +0,0 @@
-set(XTUN_APPLE_VERSION 0.0.1)
-set(XTUN_APPLE_SHA256 375f21371749a96ee13a02b5e830268388ff45d69349ce3fe6efeab90c405130)
-set(XTUN_APPLE_DIR ${CMAKE_BINARY_DIR}/xtun-apple/${XTUN_APPLE_VERSION})
-set(XTUN_APPLE_XCFRAMEWORK ${XTUN_APPLE_DIR}/Xtun.xcframework)
-
-if(NOT EXISTS ${XTUN_APPLE_XCFRAMEWORK})
-    file(DOWNLOAD
-        https://github.com/amnezia-vpn/xtun-swift/releases/download/${XTUN_APPLE_VERSION}/Xtun.xcframework.zip
-        ${XTUN_APPLE_DIR}/Xtun.xcframework.zip
-        EXPECTED_HASH SHA256=${XTUN_APPLE_SHA256}
-        STATUS XTUN_APPLE_DOWNLOAD_STATUS
-    )
-    list(GET XTUN_APPLE_DOWNLOAD_STATUS 0 XTUN_APPLE_DOWNLOAD_CODE)
-    if(NOT XTUN_APPLE_DOWNLOAD_CODE EQUAL 0)
-        message(FATAL_ERROR "Failed to download Xtun.xcframework: ${XTUN_APPLE_DOWNLOAD_STATUS}")
-    endif()
-    file(ARCHIVE_EXTRACT INPUT ${XTUN_APPLE_DIR}/Xtun.xcframework.zip DESTINATION ${XTUN_APPLE_DIR})
-endif()

client/core/configurators/awgConfigurator.cpp

@@ -66,6 +66,8 @@ ProtocolConfig AwgConfigurator::createConfig(const ServerCredentials &credential
     newClientConfig.nativeConfig = awgConfig;
     newClientConfig.hostName = wgConfig->clientConfig->hostName;
     newClientConfig.port = wgConfig->clientConfig->port;
+    newClientConfig.cascadeEndpoint = wgConfig->clientConfig->cascadeEndpoint;
+    newClientConfig.cascadePort = wgConfig->clientConfig->cascadePort;
     newClientConfig.clientIp = wgConfig->clientConfig->clientIp;
     newClientConfig.clientPrivateKey = wgConfig->clientConfig->clientPrivateKey;
     newClientConfig.clientPublicKey = wgConfig->clientConfig->clientPublicKey;

client/core/configurators/openVpnConfigurator.cpp

@@ -129,7 +129,7 @@ ProtocolConfig OpenVpnConfigurator::createConfig(const ServerCredentials &creden
         config.replace("</tls-auth>", "");
     }
 
-#ifndef Q_OS_WIN
+#ifndef MZ_WINDOWS
     config.replace("block-outside-dns", "");
 #endif
 
@@ -177,10 +177,17 @@ ProtocolConfig OpenVpnConfigurator::processConfigWithLocalSettings(const Connect
         }
     }
 
-#ifndef Q_OS_WIN
+#ifndef MZ_WINDOWS
     config.replace("block-outside-dns", "");
 #endif
 
+#if (defined(MZ_MACOS) || defined(MZ_LINUX))
+    config.append(QString("\nscript-security 2\n"
+                         "up %1/update-resolv-conf.sh\n"
+                         "down %1/update-resolv-conf.sh\n")
+                  .arg(qApp->applicationDirPath()));
+#endif
+
     protocolConfig.setNativeConfig(config);
     return protocolConfig;
 }

client/core/configurators/wireguardConfigurator.cpp

@@ -266,6 +266,11 @@ ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &cred
     clientConfig.nativeConfig = config;
     clientConfig.hostName = connData.host;
     clientConfig.port = connData.port.toInt();
+    if (wireguardServerConfig) {
+        clientConfig.setCascade(wireguardServerConfig->cascadeEndpoint, wireguardServerConfig->cascadePort);
+    } else if (awgServerConfig) {
+        clientConfig.setCascade(awgServerConfig->cascadeEndpoint, awgServerConfig->cascadePort);
+    }
     clientConfig.clientIp = connData.clientIP;
     clientConfig.clientPrivateKey = connData.clientPrivKey;
     clientConfig.clientPublicKey = connData.clientPubKey;

client/core/configurators/xrayConfigurator.cpp

@@ -34,6 +34,7 @@ namespace {
         return amnezia::xrayEffective::security(srv);
     }
 
+    // Desktop applies this in XrayProtocol::start(); iOS/Android pass JSON straight to libxray — same fixes here.
     void sanitizeXrayNativeConfig(amnezia::ProtocolConfig &pc)
     {
         const QString before = pc.nativeConfig();

client/core/controllers/connect-flow-sequence.plantuml

@@ -1,29 +0,0 @@
-@startuml
-participant AmneziaVPN
-participant "VPN Backend\n(Gateway API)" as Backend
-participant Worker
-
-AmneziaVPN -> AmneziaVPN : Нажатие кнопки «Подключить»
-activate AmneziaVPN
-
-AmneziaVPN -> AmneziaVPN : Проверка наличия вторичного\nконфига 
-
-alt Конфиг отсутствует
-    AmneziaVPN -> Backend : POST v1/config\n(запрос вторичного конфига)
-    Backend --> AmneziaVPN : Конфиг сервера
-    AmneziaVPN -> AmneziaVPN : Сохранение конфига
-else Конфиг есть, но срок жизни истёк (expires_at)
-    AmneziaVPN -> Backend : POST v1/config\n(обновление конфига)
-    Backend --> AmneziaVPN : Новый конфиг сервера
-    AmneziaVPN -> AmneziaVPN : Обновление конфига
-else Конфиг актуален
-    note right : Пропуск запроса к бекенду
-end
-
-AmneziaVPN -> Worker : Подключение по VPN протоколу
-activate Worker
-Worker --> AmneziaVPN : Туннель установлен
-deactivate Worker
-
-deactivate AmneziaVPN
-@enduml

client/core/controllers/connectionController.cpp

@@ -32,6 +32,9 @@ ConnectionController::ConnectionController(SecureServersRepository* serversRepos
     connect(this, &ConnectionController::openConnectionRequested, m_vpnConnection, &VpnConnection::connectToVpn, Qt::QueuedConnection);
     connect(this, &ConnectionController::closeConnectionRequested, m_vpnConnection, &VpnConnection::disconnectFromVpn, Qt::QueuedConnection);
     connect(this, &ConnectionController::killSwitchModeChangedRequested, m_vpnConnection, &VpnConnection::onKillSwitchModeChanged, Qt::QueuedConnection);
+#ifdef Q_OS_ANDROID
+    connect(this, &ConnectionController::restoreConnectionRequested, m_vpnConnection, &VpnConnection::restoreConnection, Qt::QueuedConnection);
+#endif
 }
 
 bool ConnectionController::isConnected() const
@@ -229,6 +232,15 @@ void ConnectionController::closeConnection()
     }
 }
 
+#ifdef Q_OS_ANDROID
+void ConnectionController::restoreConnection()
+{
+    if (m_vpnConnection) {
+        emit restoreConnectionRequested();
+    }
+}
+#endif
+
 void ConnectionController::onKillSwitchModeChanged(bool enabled)
 {
     if (m_vpnConnection) {
@@ -277,6 +289,15 @@ QJsonObject ConnectionController::createConnectionConfiguration(const QPair<QStr
                     ContainerUtils::isAwgContainer(container) ? protocols::awg::defaultMtu :
                     protocols::wireguard::defaultMtu;
         }
+
+        const QString cascadeEndpoint = vpnConfigData.value(configKey::cascadeEndpoint).toString();
+        if (!cascadeEndpoint.isEmpty()) {
+            vpnConfigData[configKey::hostName] = cascadeEndpoint;
+        }
+        const QString cascadePort = vpnConfigData.value(configKey::cascadePort).toString();
+        if (!cascadePort.isEmpty()) {
+            vpnConfigData[configKey::port] = cascadePort.toInt();
+        }
     }
 
     vpnConfiguration.insert(ProtocolUtils::key_proto_config_data(proto), vpnConfigData);

client/core/controllers/connectionController.h

@@ -40,6 +40,10 @@ public:
 
     void closeConnection();
 
+#ifdef Q_OS_ANDROID
+    void restoreConnection();
+#endif
+
     void onKillSwitchModeChanged(bool enabled);
 
     ErrorCode lastConnectionError() const;
@@ -65,6 +69,10 @@ signals:
     void closeConnectionRequested();
     void killSwitchModeChangedRequested(bool enabled);
 
+#ifdef Q_OS_ANDROID
+    void restoreConnectionRequested();
+#endif
+
 private:
     ErrorCode defaultContainerForServer(const QString &serverId, DockerContainer &container) const;
 

client/core/controllers/coreSignalHandlers.cpp

@@ -491,6 +491,10 @@ void CoreSignalHandlers::initAndroidSettingsHandler()
 void CoreSignalHandlers::initAndroidConnectionHandler()
 {
 #ifdef Q_OS_ANDROID
+    connect(AndroidController::instance(), &AndroidController::initConnectionState, this, [this](Vpn::ConnectionState state) {
+        m_coreController->m_connectionUiController->onConnectionStateChanged(state);
+        m_coreController->m_connectionController->restoreConnection();
+    });
     connect(AndroidController::instance(), &AndroidController::importConfigFromOutside, this, [this](QString data) {
         emit m_coreController->m_pageController->goToPageHome();
         m_coreController->m_importController->extractConfigFromData(data);

client/core/controllers/gateway-proxy-encryption-activity.plantuml

@@ -1,90 +0,0 @@
-@startuml
-start
-
-partition "**1. Request payload formation for Gateway**" {
-    :Generate session keys for AES encryption (key, iv, salt);
-    :Encrypt request data with AES;
-    :Encrypt session keys with Gateway public key (RSA);
-    :Assemble request payload:\nencrypted keys + encrypted data;
-}
-
-:Send HTTP POST to Gateway;
-
-if (Response successful?) then (yes)
-    :Decode response using session keys;
-    :Return data to caller;
-    stop
-else (error)
-    :Decode response body;
-    
-    partition "**2. Error analysis**" {
-        note right
-            Response body (when decrypted successfully)
-            contains http_status and error message.
-            
-            **Handled errors**:
-            • 404 + "No active configuration found for"
-            • 404 + "No non-revoked public key found for"
-            • 404 + "Account not found."
-            • 501 + "client version update is required"
-            • 409 Conflict
-        end note
-        
-        if (Handled error?) then (no)
-        else (yes)
-            :Return error to user;
-            stop
-        endif
-    }
-    
-    partition "**3. Obtaining proxy list**" {
-        :Build proxy storage list;
-        note right
-            **Storage list formation:**
-            For each baseUrl:
-            • baseUrl + base64url("endpoints-{service_type}-{user_country_code}") + ".json"
-            • baseUrl + "endpoints.json" (generic list)
-            Specific first, then generic.
-        end note
-        while (Proxy list obtained?) is (no)
-            :HTTPS GET to storage;
-            if (Encrypted list received?) then (yes)
-                note right
-                    **Proxy list decryption:**
-                    Data encrypted with AES.
-                    Key and IV derived from hash
-                    of Gateway public key (SHA512):
-                    first 64 hex chars — key, next 32 — IV.
-                end note
-                :Decrypt AES proxy list;
-            else (no)
-                if (All storages exhausted) then (no)
-                    :Next storage;
-                else (yes)
-                    :Return original error to user;
-                    stop
-                endif
-            endif
-        endwhile (yes)
-    }
-    
-    partition "**4. Bypass via proxy**" {
-        while (Proxy in list) is (yes)
-            :Check proxy availability (/lmbd-health);
-            if (Proxy responds?) then (yes)
-                :Send request via proxy\n(same payload);
-                :Decode response;
-                if (Response successful) then (yes)
-                    :Return data to caller;
-                    stop
-                endif
-            endif
-            :Next proxy;
-        endwhile (all exhausted)
-    }
-    
-    :Return error with last failed request to user;
-    stop
-endif
-
-@enduml

client/core/controllers/gatewayController.cpp

@@ -222,10 +222,9 @@ void GatewayController::prepareRequest()
         return;
     }
     IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
-        QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRanges(ips);
+        QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(ips);
         if (!reply.waitForFinished(1000) || !reply.returnValue()) {
-            qWarning()
-                    << "GatewayController::prepareRequest(): Failed to execute remote addKillSwitchAllowedRanges call";
+            qWarning() << "GatewayController::prepareRequest(): Failed to execute remote addKillSwitchAllowedRange call";
         }
     });
 #endif

client/core/controllers/localProxyController.cpp

@@ -436,55 +436,58 @@ bool LocalProxyController::startXrayEngine(const QString &config)
         return false;
     }
 
-    const bool started = IpcClient::withInterface(
-            [&](QSharedPointer<IpcInterfaceReplica> iface) {
-                auto localProxyUp = iface->localProxyUp(config);
-                return localProxyUp.waitForFinished() && localProxyUp.returnValue();
+    const qint64 token = IpcClient::withInterface(
+            [&](QSharedPointer<IpcInterfaceReplica> iface) -> qint64 {
+                auto xrayStart = iface->xrayStartOwned(config);
+                if (!xrayStart.waitForFinished()) {
+                    return 0;
+                }
+                return xrayStart.returnValue();
             },
-            []() { return false; });
+            []() -> qint64 { return 0; });
 
-    if (!started) {
-        qWarning() << "Failed to start local proxy via IPC";
+    if (token == 0) {
+        qWarning() << "Failed to start Xray via IPC";
         return false;
     }
 
-    m_isXrayEngineStarted = true;
+    m_xrayToken = token;
     return true;
 }
 
 bool LocalProxyController::stopXrayEngine()
 {
-    if (!m_isXrayEngineStarted) {
+    if (m_xrayToken == 0) {
         return true;
     }
 
     const bool stopped = IpcClient::withInterface(
-            [](QSharedPointer<IpcInterfaceReplica> iface) {
-                auto localProxyDown = iface->localProxyDown();
-                return localProxyDown.waitForFinished() && localProxyDown.returnValue();
+            [this](QSharedPointer<IpcInterfaceReplica> iface) {
+                auto xrayStop = iface->xrayStopOwned(m_xrayToken);
+                return xrayStop.waitForFinished() && xrayStop.returnValue();
             },
             []() { return false; });
 
     if (!stopped) {
-        qWarning() << "Failed to stop local proxy via IPC";
+        qWarning() << "Failed to stop Xray via IPC";
         return false;
     }
 
-    m_isXrayEngineStarted = false;
-    qDebug() << "Local proxy stopped";
+    m_xrayToken = 0;
+    qDebug() << "Xray stopped";
     return true;
 }
 
 bool LocalProxyController::isXrayEngineRunning() const
 {
-    if (!m_isXrayEngineStarted) {
+    if (m_xrayToken == 0) {
         return false;
     }
 
     return IpcClient::withInterface(
-            [](QSharedPointer<IpcInterfaceReplica> iface) {
-                auto isRunning = iface->isLocalProxyRunning();
-                return isRunning.waitForFinished() && isRunning.returnValue();
+            [this](QSharedPointer<IpcInterfaceReplica> iface) {
+                auto currentToken = iface->xrayCurrentToken();
+                return currentToken.waitForFinished() && currentToken.returnValue() == m_xrayToken;
             },
             []() { return false; });
 }

client/core/controllers/localProxyController.h

@@ -77,7 +77,7 @@ private:
     bool m_isEnabled = false;
     QHttpServer *m_httpServer = nullptr;
     quint16 m_apiPort = 0;
-    bool m_isXrayEngineStarted = false;
+    qint64 m_xrayToken = 0;
     quint16 m_appliedProxyPort = 0;
     int m_activePort = 0;
 };

client/core/controllers/selfhosted/installController.cpp

@@ -1244,7 +1244,7 @@ ErrorCode InstallController::isServerDpkgBusy(const ServerCredentials &credentia
             if (stdOut.isEmpty()) {
                 return ErrorCode::NoError;
             } else {
-#ifdef QT_DEBUG
+#ifdef MZ_DEBUG
                 qDebug().noquote() << stdOut;
 #endif
                 emit serverIsBusy(true);

client/core/controllers/updateController.cpp

@@ -5,8 +5,6 @@
 #include <QJsonDocument>
 #include <QJsonObject>
 #include <QNetworkReply>
-#include <QStandardPaths>
-#include <QTemporaryDir>
 #include <QTimer>
 #include <QUrl>
 

client/core/installers/installerBase.cpp

@@ -1,5 +1,8 @@
 #include "installerBase.h"
 
+#include <QRandomGenerator>
+#include <iterator>
+
 #include "core/utils/containerEnum.h"
 #include "core/utils/containers/containerUtils.h"
 #include "core/utils/protocolEnum.h"
@@ -85,8 +88,10 @@ ContainerConfig InstallerBase::createBaseConfig(DockerContainer container, int p
             srv.transport = protocols::xray::defaultTransport;
             srv.security = protocols::xray::defaultSecurity;
             srv.flow = protocols::xray::defaultFlow;
-            srv.site = protocols::xray::defaultSite;
-            srv.sni = protocols::xray::defaultSni;
+            const int siteIndex =
+                    QRandomGenerator::global()->bounded(static_cast<int>(std::size(protocols::xray::defaultSites)));
+            srv.site = protocols::xray::defaultSites[siteIndex];
+            srv.sni = srv.site;
             srv.alpn = protocols::xray::defaultAlpn;
             srv.fingerprint = protocols::xray::defaultFingerprint;
             config.protocolConfig = xrayConfig;

client/core/models/protocols/awgProtocolConfig.cpp

@@ -72,6 +72,12 @@ QJsonObject AwgServerConfig::toJson() const
     if (!port.isEmpty()) {
         obj[configKey::port] = this->port;
     }
+    if (!cascadeEndpoint.isEmpty()) {
+        obj[configKey::cascadeEndpoint] = cascadeEndpoint;
+    }
+    if (!cascadePort.isEmpty()) {
+        obj[configKey::cascadePort] = cascadePort;
+    }
     if (!transportProto.isEmpty()) {
         obj[configKey::transportProto] = transportProto;
     }
@@ -166,6 +172,8 @@ AwgServerConfig AwgServerConfig::fromJson(const QJsonObject& json)
     AwgServerConfig config;
     
     config.port = json.value(configKey::port).toString();
+    config.cascadeEndpoint = json.value(configKey::cascadeEndpoint).toString();
+    config.cascadePort = json.value(configKey::cascadePort).toString();
     config.transportProto = json.value(configKey::transportProto).toString();
     config.protocolVersion = json.value(configKey::protocolVersion).toString();
     config.subnetAddress = json.value(configKey::subnetAddress).toString();
@@ -218,6 +226,12 @@ QJsonObject AwgClientConfig::toJson() const
     if (port > 0) {
         obj[configKey::port] = port;
     }
+    if (!cascadeEndpoint.isEmpty()) {
+        obj[configKey::cascadeEndpoint] = cascadeEndpoint;
+    }
+    if (!cascadePort.isEmpty()) {
+        obj[configKey::cascadePort] = cascadePort;
+    }
     if (!clientIp.isEmpty()) {
         obj[configKey::clientIp] = clientIp;
     }
@@ -333,6 +347,14 @@ QJsonObject AwgClientConfig::toJson() const
     return obj;
 }
 
+void AwgClientConfig::setCascade(const QString &newEndpoint, const QString &newPort)
+{
+    cascadeEndpoint = newEndpoint;
+    cascadePort = newPort;
+    nativeConfig = replaceWireGuardEndpoint(nativeConfig, newEndpoint.isEmpty() ? hostName : newEndpoint,
+                                            newPort.isEmpty() ? port : newPort.toInt());
+}
+
 AwgClientConfig AwgClientConfig::fromJson(const QJsonObject& json)
 {
     AwgClientConfig config;
@@ -340,6 +362,8 @@ AwgClientConfig AwgClientConfig::fromJson(const QJsonObject& json)
     config.nativeConfig = json.value(configKey::config).toString();
     config.hostName = json.value(configKey::hostName).toString();
     config.port = json.value(configKey::port).toInt(0);
+    config.cascadeEndpoint = json.value(configKey::cascadeEndpoint).toString();
+    config.cascadePort = json.value(configKey::cascadePort).toString();
     config.clientIp = json.value(configKey::clientIp).toString();
     config.clientPrivateKey = json.value(configKey::clientPrivKey).toString();
     config.clientPublicKey = json.value(configKey::clientPubKey).toString();

client/core/models/protocols/awgProtocolConfig.h

@@ -19,6 +19,8 @@ namespace AwgConstant
 
 struct AwgServerConfig {
     QString port;
+    QString cascadeEndpoint;
+    QString cascadePort;
     QString transportProto;
     QString protocolVersion;
     QString subnetAddress;
@@ -61,6 +63,8 @@ struct AwgClientConfig {
     QString nativeConfig;
     QString hostName;
     int port;
+    QString cascadeEndpoint;
+    QString cascadePort;
     QString clientIp;
     QString clientPrivateKey;
     QString clientPublicKey;
@@ -95,6 +99,9 @@ struct AwgClientConfig {
     QString maxHandshakeAttempts;
     QString randomTrailers;
     QString disableCookies;
+
+    void setCascade(const QString &newEndpoint, const QString &newPort);
+
     QJsonObject toJson() const;
     static AwgClientConfig fromJson(const QJsonObject& json);
 };

client/core/models/protocols/wireGuardProtocolConfig.cpp

@@ -20,6 +20,12 @@ QJsonObject WireGuardServerConfig::toJson() const
     if (!port.isEmpty()) {
         obj[configKey::port] = port;
     }
+    if (!cascadeEndpoint.isEmpty()) {
+        obj[configKey::cascadeEndpoint] = cascadeEndpoint;
+    }
+    if (!cascadePort.isEmpty()) {
+        obj[configKey::cascadePort] = cascadePort;
+    }
     if (!transportProto.isEmpty()) {
         obj[configKey::transportProto] = transportProto;
     }
@@ -45,6 +51,8 @@ WireGuardServerConfig WireGuardServerConfig::fromJson(const QJsonObject& json)
     WireGuardServerConfig config;
     
     config.port = json.value(configKey::port).toString();
+    config.cascadeEndpoint = json.value(configKey::cascadeEndpoint).toString();
+    config.cascadePort = json.value(configKey::cascadePort).toString();
     config.transportProto = json.value(configKey::transportProto).toString();
     config.subnetAddress = json.value(configKey::subnetAddress).toString();
     config.subnetMask = json.value(configKey::subnetMask).toString();
@@ -73,6 +81,12 @@ QJsonObject WireGuardClientConfig::toJson() const
     if (port > 0) {
         obj[configKey::port] = port;
     }
+    if (!cascadeEndpoint.isEmpty()) {
+        obj[configKey::cascadeEndpoint] = cascadeEndpoint;
+    }
+    if (!cascadePort.isEmpty()) {
+        obj[configKey::cascadePort] = cascadePort;
+    }
     if (!clientIp.isEmpty()) {
         obj[configKey::clientIp] = clientIp;
     }
@@ -119,6 +133,14 @@ QJsonObject WireGuardClientConfig::toJson() const
     return obj;
 }
 
+void WireGuardClientConfig::setCascade(const QString &newEndpoint, const QString &newPort)
+{
+    cascadeEndpoint = newEndpoint;
+    cascadePort = newPort;
+    nativeConfig = replaceWireGuardEndpoint(nativeConfig, newEndpoint.isEmpty() ? hostName : newEndpoint,
+                                            newPort.isEmpty() ? port : newPort.toInt());
+}
+
 WireGuardClientConfig WireGuardClientConfig::fromJson(const QJsonObject& json)
 {
     WireGuardClientConfig config;
@@ -126,6 +148,8 @@ WireGuardClientConfig WireGuardClientConfig::fromJson(const QJsonObject& json)
     config.nativeConfig = json.value(configKey::config).toString();
     config.hostName = json.value(configKey::hostName).toString();
     config.port = json.value(configKey::port).toInt(0);
+    config.cascadeEndpoint = json.value(configKey::cascadeEndpoint).toString();
+    config.cascadePort = json.value(configKey::cascadePort).toString();
     config.clientIp = json.value(configKey::clientIp).toString();
     config.clientPrivateKey = json.value(configKey::clientPrivKey).toString();
     config.clientPublicKey = json.value(configKey::clientPubKey).toString();

client/core/models/protocols/wireGuardProtocolConfig.h

@@ -12,6 +12,8 @@ namespace amnezia
 
 struct WireGuardServerConfig {
     QString port;
+    QString cascadeEndpoint;
+    QString cascadePort;
     QString transportProto;
     QString subnetAddress;
     QString subnetMask;
@@ -28,6 +30,8 @@ struct WireGuardClientConfig {
     QString nativeConfig;
     QString hostName;
     int port;
+    QString cascadeEndpoint;
+    QString cascadePort;
     QString clientIp;
     QString clientPrivateKey;
     QString clientPublicKey;
@@ -41,6 +45,8 @@ struct WireGuardClientConfig {
     QMap<QString, QString> awgParams;
     bool isObfuscationEnabled = false;
 
+    void setCascade(const QString &newEndpoint, const QString &newPort);
+
     QJsonObject toJson() const;
     static WireGuardClientConfig fromJson(const QJsonObject& json);
 };

client/core/models/protocols/xrayProtocolConfig.cpp

@@ -354,9 +354,6 @@ void XrayServerConfig::applyDefaults(bool fillFlowDefault)
         transportProto = ProtocolUtils::transportProtoToString(ProtocolUtils::defaultTransportProto(Proto::Xray),
                                                                Proto::Xray);
     }
-    if (site.isEmpty()) {
-        site = protocols::xray::defaultSite;
-    }
     if (transport.isEmpty()) {
         transport = protocols::xray::defaultTransport;
     }
@@ -367,7 +364,7 @@ void XrayServerConfig::applyDefaults(bool fillFlowDefault)
         flow = protocols::xray::defaultFlow;
     }
     if (sni.isEmpty()) {
-        sni = site.isEmpty() ? QString::fromLatin1(protocols::xray::defaultSni) : site;
+        sni = site;
     }
     if (alpn.isEmpty()) {
         alpn = protocols::xray::defaultAlpn;
@@ -569,7 +566,7 @@ QJsonObject XrayServerConfig::streamSettingsJson(XrayStreamSide side) const
 
     if (securityEff == QLatin1String(px::securityTls)) {
         QJsonObject tlsSettings;
-        tlsSettings[px::serverName] = sni.isEmpty() ? QString::fromLatin1(px::defaultSni) : sni;
+        tlsSettings[px::serverName] = sni;
         const QString alpnEff = alpn.isEmpty() ? QString::fromLatin1(px::defaultAlpn) : alpn;
         QJsonArray alpnArray;
         for (const QString &a : alpnEff.split(QLatin1Char(','))) {
@@ -598,7 +595,7 @@ QJsonObject XrayServerConfig::streamSettingsJson(XrayStreamSide side) const
     if (clientSide && securityEff == QLatin1String(px::securityReality)) {
         QJsonObject realitySettings;
         realitySettings[px::fingerprint] = fingerprintEff;
-        realitySettings[px::serverName] = sni.isEmpty() ? QString::fromLatin1(px::defaultSni) : sni;
+        realitySettings[px::serverName] = sni;
         streamSettings[px::realitySettings] = realitySettings;
     }
 
@@ -1139,11 +1136,10 @@ QJsonObject XrayServerConfig::toServerInboundJson(const XrayServerInboundInputs
 
     QJsonObject streamSettings = serverStreamSettings();
     if (xrayEffective::security(*this) == QLatin1String(px::securityReality)) {
-        const QString siteEff = site.isEmpty() ? QString::fromLatin1(px::defaultSite) : site;
         QJsonObject realitySettings;
-        realitySettings[px::dest] = siteEff + QStringLiteral(":443");
+        realitySettings[px::dest] = site + QStringLiteral(":443");
         realitySettings[px::privateKey] = inputs.realityPrivateKey;
-        realitySettings[px::serverNames] = QJsonArray { sni.isEmpty() ? siteEff : sni };
+        realitySettings[px::serverNames] = QJsonArray { sni.isEmpty() ? site : sni };
         realitySettings[px::shortIds] = QJsonArray { inputs.realityShortId };
         streamSettings[px::realitySettings] = realitySettings;
     }
@@ -1323,10 +1319,9 @@ QJsonObject XrayServerConfig::serverView() const
     view[px::streamSettings] = serverStreamSettings();
 
     if (xrayEffective::security(*this) == QLatin1String(px::securityReality)) {
-        const QString siteEff = site.isEmpty() ? QString::fromLatin1(px::defaultSite) : site;
         QJsonObject reality;
-        reality[px::dest] = siteEff;
-        reality[px::serverName] = sni.isEmpty() ? siteEff : sni;
+        reality[px::dest] = site;
+        reality[px::serverName] = sni.isEmpty() ? site : sni;
         view[QStringLiteral("reality")] = reality;
     }