version: bump

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Rework timer in tunnel detail
2026-06-02 06:23:39 +02:00 · 2020-01-23 16:12:26 +01:00 · 2020-01-23 16:12:26 +01:00 · 2020-01-23 16:10:34 +01:00 · 2020-01-23 16:10:34 +01:00 · 2020-01-23 13:46:29 +01:00
162 changed files with 7447 additions and 3903 deletions
@@ -6,10 +6,13 @@
 /captures/
 /local.properties
 .DS_Store
-.externalNativeBuild/
+.cxx/
 Thumbs.db
 build/
 *.apk
 *.class
 *.dex
 *.iml
+*.jks
+keystore.properties
+package-info.java
@@ -1,9 +1,6 @@
 [submodule "app/tools/libmnl"]
 	path = app/tools/libmnl
 	url = https://git.netfilter.org/libmnl/
-[submodule "app/tools/wireguard"]
-	path = app/tools/wireguard
-	url = https://git.zx2c4.com/WireGuard
-[submodule "app/tools/wireguard-go"]
-	path = app/tools/wireguard-go
-	url = https://git.zx2c4.com/wireguard-go
+[submodule "app/tools/wireguard-tools"]
+	path = app/tools/wireguard-tools
+	url = https://git.zx2c4.com/wireguard-tools
@@ -29,16 +29,13 @@
        <emptyLine />
      </value>
    </option>
-    <option name="RIGHT_MARGIN" value="100" />
    <AndroidXmlCodeStyleSettings>
-      <option name="USE_CUSTOM_SETTINGS" value="true" />
+      <option name="ARRANGEMENT_SETTINGS_MIGRATED_TO_191" value="true" />
    </AndroidXmlCodeStyleSettings>
    <JavaCodeStyleSettings>
-      <option name="CLASS_COUNT_TO_USE_IMPORT_ON_DEMAND" value="99" />
-      <option name="NAMES_COUNT_TO_USE_IMPORT_ON_DEMAND" value="99" />
-      <option name="PACKAGES_TO_USE_IMPORT_ON_DEMAND">
-        <value />
-      </option>
+      <option name="GENERATE_FINAL_LOCALS" value="true" />
+      <option name="GENERATE_FINAL_PARAMETERS" value="true" />
+      <option name="INSERT_INNER_CLASS_IMPORTS" value="true" />
      <option name="IMPORT_LAYOUT_TABLE">
        <value>
          <package name="android" withSubpackages="true" static="false" />
@@ -62,38 +59,12 @@
        </value>
      </option>
    </JavaCodeStyleSettings>
-    <Objective-C-extensions>
-      <file>
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Import" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Macro" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Typedef" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Enum" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Constant" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Global" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Struct" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="FunctionPredecl" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Function" />
-      </file>
-      <class>
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Property" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="Synthesize" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="InitMethod" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="StaticMethod" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="InstanceMethod" />
-        <option name="com.jetbrains.cidr.lang.util.OCDeclarationKind" value="DeallocMethod" />
-      </class>
-      <extensions>
-        <pair source="cpp" header="h" fileNamingConvention="NONE" />
-        <pair source="c" header="h" fileNamingConvention="NONE" />
-      </extensions>
-    </Objective-C-extensions>
    <XML>
-      <option name="XML_KEEP_LINE_BREAKS" value="false" />
-      <option name="XML_ALIGN_ATTRIBUTES" value="false" />
-      <option name="XML_SPACE_INSIDE_EMPTY_TAG" value="true" />
      <option name="XML_LEGACY_SETTINGS_IMPORTED" value="true" />
    </XML>
    <codeStyleSettings language="JAVA">
+      <option name="METHOD_ANNOTATION_WRAP" value="0" />
+      <option name="FIELD_ANNOTATION_WRAP" value="0" />
      <arrangement>
        <groups />
        <rules>
@@ -380,7 +351,6 @@
      </arrangement>
    </codeStyleSettings>
    <codeStyleSettings language="XML">
-      <option name="FORCE_REARRANGE_MODE" value="1" />
      <indentOptions>
        <option name="CONTINUATION_INDENT_SIZE" value="4" />
      </indentOptions>
@@ -391,6 +361,7 @@
              <match>
                <AND>
                  <NAME>xmlns:android</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>^$</XML_NAMESPACE>
                </AND>
              </match>
@@ -401,6 +372,7 @@
              <match>
                <AND>
                  <NAME>xmlns:.*</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>^$</XML_NAMESPACE>
                </AND>
              </match>
@@ -412,6 +384,7 @@
              <match>
                <AND>
                  <NAME>.*:id</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
                </AND>
              </match>
@@ -422,6 +395,7 @@
              <match>
                <AND>
                  <NAME>.*:name</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
                </AND>
              </match>
@@ -432,6 +406,7 @@
              <match>
                <AND>
                  <NAME>name</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>^$</XML_NAMESPACE>
                </AND>
              </match>
@@ -442,6 +417,7 @@
              <match>
                <AND>
                  <NAME>style</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>^$</XML_NAMESPACE>
                </AND>
              </match>
@@ -452,6 +428,7 @@
              <match>
                <AND>
                  <NAME>.*</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>^$</XML_NAMESPACE>
                </AND>
              </match>
@@ -462,64 +439,12 @@
            <rule>
              <match>
                <AND>
-                  <NAME>.*:layout_width</NAME>
+                  <NAME>.*</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
                </AND>
              </match>
-            </rule>
-          </section>
-          <section>
-            <rule>
-              <match>
-                <AND>
-                  <NAME>.*:layout_height</NAME>
-                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
-                </AND>
-              </match>
-            </rule>
-          </section>
-          <section>
-            <rule>
-              <match>
-                <AND>
-                  <NAME>.*:layout_.*</NAME>
-                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
-                </AND>
-              </match>
-              <order>BY_NAME</order>
-            </rule>
-          </section>
-          <section>
-            <rule>
-              <match>
-                <AND>
-                  <NAME>.*:width</NAME>
-                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
-                </AND>
-              </match>
-              <order>BY_NAME</order>
-            </rule>
-          </section>
-          <section>
-            <rule>
-              <match>
-                <AND>
-                  <NAME>.*:height</NAME>
-                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
-                </AND>
-              </match>
-              <order>BY_NAME</order>
-            </rule>
-          </section>
-          <section>
-            <rule>
-              <match>
-                <AND>
-                  <NAME>.*</NAME>
-                  <XML_NAMESPACE>http://schemas.android.com/apk/res/android</XML_NAMESPACE>
-                </AND>
-              </match>
-              <order>BY_NAME</order>
+              <order>ANDROID_ATTRIBUTE_ORDER</order>
            </rule>
          </section>
          <section>
@@ -527,6 +452,7 @@
              <match>
                <AND>
                  <NAME>.*</NAME>
+                  <XML_ATTRIBUTE />
                  <XML_NAMESPACE>.*</XML_NAMESPACE>
                </AND>
              </match>
@@ -1,6 +1,6 @@
 <component name="CopyrightManager">
  <copyright>
-    <option name="notice" value="Copyright © &amp;#36;today.year Firstname Lastname &lt;email@example.org&gt;&#10;SPDX-License-Identifier:" />
+    <option name="notice" value="Copyright © &amp;#36;today.year WireGuard LLC. All Rights Reserved.&#10;SPDX-License-Identifier: Apache-2.0" />
    <option name="myName" value="Default" />
  </copyright>
 </component>
@@ -1,6 +0,0 @@
-<component name="CopyrightManager">
-  <copyright>
-    <option name="myName" value="GPL-2.0-or-later" />
-    <option name="notice" value="Copyright © &amp;#36;today.year Firstname Lastname &lt;email@example.com&gt;&#10;SPDX-License-Identifier: GPL-2.0-or-later" />
-  </copyright>
-</component>
@@ -1,3 +1,3 @@
 <component name="CopyrightManager">
-  <settings default="GPL-2.0-or-later" />
-</component>
+  <settings default="Default" />
+</component>
@@ -150,7 +150,6 @@
    <inspection_tool class="FieldMayBeFinal" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="FieldMayBeStatic" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="FieldMustBeInitialized" enabled="true" level="ERROR" enabled_by_default="true" />
-    <inspection_tool class="FieldNotUsedInToString" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="FinalMethodInFinalClass" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="FloatingPointEquality" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ForLoopReplaceableByWhile" enabled="true" level="WARNING" enabled_by_default="true">
@@ -386,7 +385,6 @@
      <option name="ignorePrivateMethods" value="true" />
    </inspection_tool>
    <inspection_tool class="ReturnOfDateField" enabled="false" level="WARNING" enabled_by_default="false" />
-    <inspection_tool class="ReturnOfInnerClass" enabled="true" level="WARNING" enabled_by_default="true" />
    <inspection_tool class="ScalarTypeRequired" enabled="true" level="ERROR" enabled_by_default="true" />
    <inspection_tool class="SerializableClassInSecureContext" enabled="false" level="WARNING" enabled_by_default="false" />
    <inspection_tool class="SetReplaceableByEnumSet" enabled="true" level="WARNING" enabled_by_default="true" />
@@ -1,338 +1,202 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 2, June 1991

- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/

-                            Preamble
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
+   1. Definitions.

-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.

-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.

-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.

-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.

-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.

-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.

-  The precise terms and conditions for copying, distribution and
-modification follow.
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).

-                    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.

-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."

-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.

-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.

-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.

-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:

-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and

-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and

-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and

-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.

-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.

-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.

-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.

-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.

-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.

-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.

-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
+   END OF TERMS AND CONDITIONS

-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
+   APPENDIX: How to apply the Apache License to your work.

-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.

-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
+   Copyright [yyyy] [name of copyright owner]

-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at

-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
+       http://www.apache.org/licenses/LICENSE-2.0

-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-                            NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License version 2
-    as published by the Free Software Foundation.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -7,25 +7,7 @@ This is an Android GUI for [WireGuard](https://www.wireguard.com/). It [opportun
 ## Building

 ```
-$ git clone https://git.zx2c4.com/wireguard-android
+$ git clone --recurse-submodules https://git.zx2c4.com/wireguard-android
 $ cd wireguard-android
-$ git submodule init
-$ git submodule update
 $ ./gradlew assembleRelease
 ```
-
-## License
-
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
@@ -1,27 +1,63 @@
 apply plugin: 'com.android.application'
+apply from: 'nonnull.gradle'
+
+// Create a variable called keystorePropertiesFile, and initialize it to your
+// keystore.properties file, in the rootProject folder.
+final def keystorePropertiesFile = rootProject.file("keystore.properties")

 android {
-    buildToolsVersion '27.0.3'
-    buildTypes {
-        release {
-            minifyEnabled true
-            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
-        }
-    }
+    buildToolsVersion '29.0.2'
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }
-    compileSdkVersion 27
-    dataBinding {
-        enabled true
-    }
+    compileSdkVersion 29
+    dataBinding.enabled true
    defaultConfig {
        applicationId 'com.wireguard.android'
        minSdkVersion 21
-        targetSdkVersion 27
-        versionCode 419
-        versionName '0.0.20180529'
+        targetSdkVersion 29
+        versionCode 462
+        versionName '0.0.20200123'
+        buildConfigField 'int', 'MIN_SDK_VERSION', "$minSdkVersion.apiLevel"
+    }
+    // If the keystore file exists
+    if (keystorePropertiesFile.exists()) {
+        // Initialize a new Properties() object called keystoreProperties.
+        final def keystoreProperties = new Properties()
+
+        // Load your keystore.properties file into the keystoreProperties object.
+        keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
+
+        signingConfigs {
+            release {
+                keyAlias keystoreProperties['keyAlias']
+                keyPassword keystoreProperties['keyPassword']
+                storeFile file(keystoreProperties['storeFile'])
+                storePassword keystoreProperties['storePassword']
+            }
+        }
+    }
+    buildTypes {
+        release {
+            if (keystorePropertiesFile.exists()) signingConfig signingConfigs.release
+            externalNativeBuild {
+                cmake {
+                    arguments "-DANDROID_PACKAGE_NAME=${android.defaultConfig.applicationId}"
+                }
+            }
+            minifyEnabled true
+            proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro"
+        }
+        debug {
+            applicationIdSuffix ".debug"
+            versionNameSuffix "-debug"
+            externalNativeBuild {
+                cmake {
+                    arguments "-DANDROID_PACKAGE_NAME=${android.defaultConfig.applicationId}${applicationIdSuffix}"
+                }
+            }
+        }
    }
    externalNativeBuild {
        cmake {
@@ -29,24 +65,37 @@ android {
        }
    }
 }
+
 ext {
-    databindingVersion = '3.1.2'
-    supportLibsVersion = '27.1.1'
-    daggerVersion = '2.14.1'
-    streamsupportVersion = '1.6.0'
+    annotationsVersion = '1.1.0'
+    appcompatVersion = '1.1.0'
+    cardviewVersion = '1.0.0'
+    databindingVersion = '3.5.3'
+    materialComponentsVersion = '1.0.0'
+    jsr305Version = '3.0.2'
+    preferenceVersion = '1.1.0'
+    streamsupportVersion = '1.7.1'
+    threetenabpVersion = '1.2.1'
+    // ZXING switched minSdk to 24 so we cannot upgrade to 4.0.2 without following suit.
+    // If you choose to upgrade to minSDK 24 then you should also disable Jetifier from
+    // gradle.properties.
+    zxingEmbeddedVersion = '3.6.0'
+    eddsaVersion = '0.3.0'
 }

 dependencies {
-    annotationProcessor "com.google.dagger:dagger-compiler:$daggerVersion"
-    implementation "com.android.databinding:library:$databindingVersion"
-    implementation "com.android.support:appcompat-v7:$supportLibsVersion"
-    implementation "com.android.support:cardview-v7:$supportLibsVersion"
-    implementation "com.android.support:design:$supportLibsVersion"
-    implementation "com.android.support:preference-v14:$supportLibsVersion"
-    implementation "com.android.support:support-annotations:$supportLibsVersion"
-    implementation "com.google.dagger:dagger:$daggerVersion"
+    implementation "androidx.annotation:annotation:$annotationsVersion"
+    implementation "androidx.appcompat:appcompat:$appcompatVersion"
+    implementation "androidx.cardview:cardview:$cardviewVersion"
+    implementation "androidx.databinding:databinding-runtime:$databindingVersion"
+    implementation "androidx.preference:preference:$preferenceVersion"
+    implementation "com.google.android.material:material:$materialComponentsVersion"
+    implementation "com.google.code.findbugs:jsr305:$jsr305Version"
+    implementation "com.jakewharton.threetenabp:threetenabp:$threetenabpVersion"
+    implementation "com.journeyapps:zxing-android-embedded:$zxingEmbeddedVersion"
    implementation "net.sourceforge.streamsupport:android-retrofuture:$streamsupportVersion"
    implementation "net.sourceforge.streamsupport:android-retrostreams:$streamsupportVersion"
+    implementation "net.i2p.crypto:eddsa:$eddsaVersion"
 }

 tasks.withType(JavaCompile) {
@@ -0,0 +1,87 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+task generateNonNullJavaFiles(dependsOn: "assembleDebug", type: Copy) {
+    group = "Copying"
+    description = "Generate package-info.java classes"
+
+    def basePackage = "com" + File.separatorChar + "wireguard"
+    def mainSrcPhrase = "src" + File.separatorChar + "main" + File.separatorChar +
+            "java" + File.separatorChar
+    def mainTestSrcPhrase = "src" + File.separatorChar + "test" + File.separatorChar +
+            "java" + File.separatorChar
+    def mainAndroidTestSrcPhrase = "src" + File.separatorChar + "androidTest" + File.separatorChar +
+            "java" + File.separatorChar
+
+    def sourceDir = file( "${projectDir}" + File.separatorChar + "src" + File.separatorChar +
+            "main" + File.separatorChar + "java" + File.separatorChar +
+            basePackage )
+    def testSourceDir = file( "${projectDir}" + File.separatorChar + "src" + File.separatorChar +
+            "test" + File.separatorChar + "java" + File.separatorChar +
+            basePackage)
+    def androidTestSourceDir = file( "${projectDir}" + File.separatorChar + "src" + File
+            .separatorChar +
+            "androidTest" + File.separatorChar + "java" + File.separatorChar +
+            basePackage )
+
+    generateInfoFiles(sourceDir, mainSrcPhrase);
+    sourceDir.eachDirRecurse { dir ->
+        generateInfoFiles(dir, mainSrcPhrase)
+    }
+    if (file(testSourceDir).exists()) {
+        generateInfoFiles(testSourceDir, mainTestSrcPhrase);
+        testSourceDir.eachDirRecurse { dir ->
+            generateInfoFiles(dir, mainTestSrcPhrase)
+        }
+    }
+    if (file(androidTestSourceDir).exists()) {
+        generateInfoFiles(androidTestSourceDir, mainAndroidTestSrcPhrase);
+        androidTestSourceDir.eachDirRecurse { dir ->
+            generateInfoFiles(dir, mainAndroidTestSrcPhrase)
+        }
+    }
+    println "[SUCCESS] NonNull generator: package-info.java files checked"
+}
+
+private void generateInfoFiles(File dir, String mainSrcPhrase) {
+    def infoFileContentHeader = getFileContentHeader();
+    def infoFileContentFooter = getFileContentFooter();
+    def infoFilePath = dir.getAbsolutePath() + File.separatorChar + "package-info.java"
+
+    //file(infoFilePath).delete(); //do not use in production code
+    if (!file(infoFilePath).exists()) {
+        def infoFileContentPackage = getFileContentPackage(dir.getAbsolutePath(), mainSrcPhrase);
+        new File(infoFilePath).write(infoFileContentHeader +
+                infoFileContentPackage + infoFileContentFooter)
+        println "[dir] " + infoFilePath + "  created";
+    }
+}
+
+def getFileContentPackage(String path, String mainSrcPhrase) {
+    def mainSrcPhraseIndex = path.indexOf(mainSrcPhrase)
+    def output = path.substring(mainSrcPhraseIndex)
+
+    // Win hotfix
+    if (System.properties['os.name'].toLowerCase().contains('windows')) {
+        output = output.replace("\\", "/")
+        mainSrcPhrase = mainSrcPhrase.replace("\\", "/")
+    }
+
+    return "package " + output.replaceAll(mainSrcPhrase, "").replaceAll(
+                "/", ".") + ";\n"
+}
+
+def getFileContentHeader() {
+    return  "/**\n" +
+            " * Make all method parameters @NonNull by default.\n" +
+            " */\n" +
+            "@NonNullForAll\n"
+}
+
+def getFileContentFooter() {
+    return  "\n" +
+            "import com.wireguard.util.NonNullForAll;\n"
+}
+
@@ -1,26 +1,3 @@
-# Add project specific ProGuard rules here.
-# By default, the flags in this file are appended to flags specified
-# in /opt/android-sdk/tools/proguard/proguard-android.txt
-# You can edit the include path and order by changing the proguardFiles
-# directive in build.gradle.
-#
-# For more details, see
-#   http://developer.android.com/guide/developing/tools/proguard.html
-
-# Add any project specific keep options here:
-
-# If your project uses WebView with JS, uncomment the following
-# and specify the fully qualified class name to the JavaScript interface
-# class:
-#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
-#   public *;
-#}
-
-# Uncomment this to preserve the line number information for
-# debugging stack traces.
-#-keepattributes SourceFile,LineNumberTable
-
-# If you keep the line number information, uncomment this to
-# hide the original source file name.
-#-renamesourcefileattribute SourceFile
+# Squelch all warnings, they're harmless but ProGuard
+# escalates them as errors.
 -dontwarn sun.misc.Unsafe
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">WireGuard β</string>
+</resources>
@@ -4,14 +4,23 @@
    package="com.wireguard.android"
    android:installLocation="internalOnly">

+    <uses-permission android:name="android.permission.CAMERA" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

+    <uses-feature android:name="android.hardware.touchscreen" android:required="false"/>
+
+    <permission
+        android:name="${applicationId}.permission.CONTROL_TUNNELS"
+        android:description="@string/permission_description"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/permission_label"
+        android:protectionLevel="dangerous" />
+
    <application
        android:name=".Application"
        android:allowBackup="false"
-        android:extractNativeLibs="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
@@ -19,12 +28,12 @@
        android:theme="@style/AppTheme"
        tools:ignore="UnusedAttribute">

+        <activity android:name=".activity.TunnelToggleActivity" android:theme="@style/NoBackgroundTheme"/>
        <activity android:name=".activity.MainActivity">
-
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
-
                <category android:name="android.intent.category.LAUNCHER" />
+                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
            </intent-filter>

            <intent-filter>
@@ -35,14 +44,18 @@
        <activity
            android:name=".activity.SettingsActivity"
            android:label="@string/settings"
-            android:parentActivityName=".activity.MainActivity"
-            android:theme="@style/SettingsTheme" />
+            android:parentActivityName=".activity.MainActivity" />

        <activity
            android:name=".activity.TunnelCreatorActivity"
            android:label="@string/create_activity_title"
            android:parentActivityName=".activity.MainActivity" />

+        <activity
+            android:name="com.journeyapps.barcodescanner.CaptureActivity"
+            android:screenOrientation="fullSensor"
+            tools:replace="screenOrientation" />
+
        <receiver android:name=".BootShutdownReceiver">
            <intent-filter>
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
@@ -50,9 +63,13 @@
            </intent-filter>
        </receiver>

-        <receiver android:name=".backend.WgQuickBackend$WgQuickChangeReceiver">
+        <receiver
+            android:name=".model.TunnelManager$IntentReceiver"
+            android:permission="${applicationId}.permission.CONTROL_TUNNELS">
            <intent-filter>
-                <action android:name="com.wireguard.android.WGQUICK_CHANGE" />
+                <action android:name="com.wireguard.android.action.REFRESH_TUNNEL_STATES" />
+                <action android:name="com.wireguard.android.action.SET_TUNNEL_UP" />
+                <action android:name="com.wireguard.android.action.SET_TUNNEL_DOWN" />
            </intent-filter>
        </receiver>

@@ -1,141 +1,160 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android;

 import android.content.Context;
+import android.content.Intent;
 import android.content.SharedPreferences;
 import android.os.AsyncTask;
+import android.os.Build;
 import android.os.Handler;
 import android.os.Looper;
-import android.preference.PreferenceManager;
+import android.util.Log;
+
+import androidx.preference.PreferenceManager;
+import androidx.annotation.Nullable;
+import androidx.appcompat.app.AppCompatDelegate;

 import com.wireguard.android.backend.Backend;
 import com.wireguard.android.backend.GoBackend;
 import com.wireguard.android.backend.WgQuickBackend;
-import com.wireguard.android.configStore.ConfigStore;
 import com.wireguard.android.configStore.FileConfigStore;
 import com.wireguard.android.model.TunnelManager;
 import com.wireguard.android.util.AsyncWorker;
+import com.wireguard.android.util.ModuleLoader;
 import com.wireguard.android.util.RootShell;
 import com.wireguard.android.util.ToolsInstaller;

-import java.io.File;
-import java.util.concurrent.Executor;
+import java.lang.ref.WeakReference;
+import java.util.Locale;

-import javax.inject.Qualifier;
-import javax.inject.Scope;
-
-import dagger.Component;
-import dagger.Module;
-import dagger.Provides;
-
-/**
- * Base context for the WireGuard Android application. This class (instantiated once during the
- * application lifecycle) maintains and mediates access to the global state of the application.
- */
+import java9.util.concurrent.CompletableFuture;

 public class Application extends android.app.Application {
-    private static ApplicationComponent component;
+    private static final String TAG = "WireGuard/" + Application.class.getSimpleName();
+    public static final String USER_AGENT;

-    public static ApplicationComponent getComponent() {
-        if (component == null)
-            throw new IllegalStateException("Application instance not yet created");
-        return component;
+    static {
+        String preferredAbi = "unknown ABI";
+        if (Build.SUPPORTED_ABIS.length > 0)
+            preferredAbi = Build.SUPPORTED_ABIS[0];
+        USER_AGENT = String.format(Locale.ENGLISH, "WireGuard/%s (Android %d; %s; %s; %s %s; %s)", BuildConfig.VERSION_NAME, Build.VERSION.SDK_INT, preferredAbi, Build.BOARD, Build.MANUFACTURER, Build.MODEL, Build.FINGERPRINT);
+    }
+
+    @SuppressWarnings("NullableProblems") private static WeakReference<Application> weakSelf;
+    private final CompletableFuture<Backend> futureBackend = new CompletableFuture<>();
+    @SuppressWarnings("NullableProblems") private AsyncWorker asyncWorker;
+    @Nullable private Backend backend;
+    @SuppressWarnings("NullableProblems") private RootShell rootShell;
+    @SuppressWarnings("NullableProblems") private SharedPreferences sharedPreferences;
+    @SuppressWarnings("NullableProblems") private ToolsInstaller toolsInstaller;
+    @SuppressWarnings("NullableProblems") private ModuleLoader moduleLoader;
+    @SuppressWarnings("NullableProblems") private TunnelManager tunnelManager;
+
+    public Application() {
+        weakSelf = new WeakReference<>(this);
+    }
+
+    public static Application get() {
+        return weakSelf.get();
+    }
+
+    public static AsyncWorker getAsyncWorker() {
+        return get().asyncWorker;
+    }
+
+    public static Backend getBackend() {
+        final Application app = get();
+        synchronized (app.futureBackend) {
+            if (app.backend == null) {
+                Backend backend = null;
+                boolean didStartRootShell = false;
+                if (!app.moduleLoader.isModuleLoaded() && app.moduleLoader.moduleMightExist()) {
+                    try {
+                        app.rootShell.start();
+                        didStartRootShell = true;
+                        app.moduleLoader.loadModule();
+                    } catch (final Exception ignored) {
+                    }
+                }
+                if (app.moduleLoader.isModuleLoaded()) {
+                    try {
+                        if (!didStartRootShell)
+                            app.rootShell.start();
+                        backend = new WgQuickBackend(app.getApplicationContext());
+                    } catch (final Exception ignored) {
+                    }
+                }
+                if (backend == null)
+                    backend = new GoBackend(app.getApplicationContext());
+                app.backend = backend;
+            }
+            return app.backend;
+        }
+    }
+
+    public static CompletableFuture<Backend> getBackendAsync() {
+        return get().futureBackend;
+    }
+
+    public static RootShell getRootShell() {
+        return get().rootShell;
+    }
+
+    public static SharedPreferences getSharedPreferences() {
+        return get().sharedPreferences;
+    }
+
+    public static ToolsInstaller getToolsInstaller() {
+        return get().toolsInstaller;
+    }
+    public static ModuleLoader getModuleLoader() {
+        return get().moduleLoader;
+    }
+
+    public static TunnelManager getTunnelManager() {
+        return get().tunnelManager;
+    }
+
+    @Override
+    protected void attachBaseContext(final Context context) {
+        super.attachBaseContext(context);
+
+        if (BuildConfig.MIN_SDK_VERSION > Build.VERSION.SDK_INT) {
+            final Intent intent = new Intent(Intent.ACTION_MAIN);
+            intent.addCategory(Intent.CATEGORY_HOME);
+            intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            startActivity(intent);
+            System.exit(0);
+        }
    }

    @Override
    public void onCreate() {
+        Log.i(TAG, USER_AGENT);
        super.onCreate();
-        component = DaggerApplication_ApplicationComponent.builder()
-                .applicationModule(new ApplicationModule(this))
-                .build();
-        component.getTunnelManager().onCreate();
-    }

-    @ApplicationScope
-    @Component(modules = ApplicationModule.class)
-    public interface ApplicationComponent {
-        AsyncWorker getAsyncWorker();
+        asyncWorker = new AsyncWorker(AsyncTask.SERIAL_EXECUTOR, new Handler(Looper.getMainLooper()));
+        rootShell = new RootShell(getApplicationContext());
+        toolsInstaller = new ToolsInstaller(getApplicationContext());
+        moduleLoader = new ModuleLoader(getApplicationContext());

-        Class getBackendType();
-
-        ToolsInstaller getToolsInstaller();
-
-        TunnelManager getTunnelManager();
-    }
-
-    @Qualifier
-    public @interface ApplicationContext {
-    }
-
-    @Qualifier
-    public @interface ApplicationHandler {
-    }
-
-    @Scope
-    public @interface ApplicationScope {
-    }
-
-    @Module
-    public static final class ApplicationModule {
-        private final Context context;
-
-        private ApplicationModule(final Application application) {
-            context = application.getApplicationContext();
+        sharedPreferences = PreferenceManager.getDefaultSharedPreferences(getApplicationContext());
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+            AppCompatDelegate.setDefaultNightMode(
+                    sharedPreferences.getBoolean("dark_theme", false) ?
+                            AppCompatDelegate.MODE_NIGHT_YES : AppCompatDelegate.MODE_NIGHT_NO);
+        } else {
+            AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM);
        }

-        @ApplicationScope
-        @Provides
-        public static Backend getBackend(@ApplicationContext final Context context,
-                                         final RootShell rootShell,
-                                         final ToolsInstaller toolsInstaller) {
-            if (new File("/sys/module/wireguard").exists())
-                return new WgQuickBackend(context, rootShell, toolsInstaller);
-            else
-                return new GoBackend(context);
-        }
+        tunnelManager = new TunnelManager(new FileConfigStore(getApplicationContext()));
+        tunnelManager.onCreate();

-        @ApplicationScope
-        @Provides
-        public static Class getBackendType(final Backend backend) {
-            return backend.getClass();
-        }
-
-        @ApplicationScope
-        @Provides
-        public static ConfigStore getConfigStore(@ApplicationContext final Context context) {
-            return new FileConfigStore(context);
-        }
-
-
-        @ApplicationScope
-        @Provides
-        public static Executor getExecutor() {
-            return AsyncTask.SERIAL_EXECUTOR;
-        }
-
-        @ApplicationHandler
-        @ApplicationScope
-        @Provides
-        public static Handler getHandler() {
-            return new Handler(Looper.getMainLooper());
-        }
-
-        @ApplicationScope
-        @Provides
-        public static SharedPreferences getPreferences(@ApplicationContext final Context context) {
-            return PreferenceManager.getDefaultSharedPreferences(context);
-        }
-
-        @ApplicationContext
-        @ApplicationScope
-        @Provides
-        public Context getContext() {
-            return context;
-        }
+        asyncWorker.supplyAsync(Application::getBackend).thenAccept(futureBackend::complete);
    }
 }
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android;
@@ -20,19 +19,20 @@ public class BootShutdownReceiver extends BroadcastReceiver {

    @Override
    public void onReceive(final Context context, final Intent intent) {
-        if (Application.getComponent().getBackendType() != WgQuickBackend.class) {
-            return;
-        }
-        final String action = intent.getAction();
-        if (action == null)
-            return;
-        final TunnelManager tunnelManager = Application.getComponent().getTunnelManager();
-        if (Intent.ACTION_BOOT_COMPLETED.equals(action)) {
-            Log.i(TAG, "Broadcast receiver restoring state (boot)");
-            tunnelManager.restoreState(false).whenComplete(ExceptionLoggers.D);
-        } else if (Intent.ACTION_SHUTDOWN.equals(action)) {
-            Log.i(TAG, "Broadcast receiver saving state (shutdown)");
-            tunnelManager.saveState();
-        }
+        Application.getBackendAsync().thenAccept(backend -> {
+            if (!(backend instanceof WgQuickBackend))
+                return;
+            final String action = intent.getAction();
+            if (action == null)
+                return;
+            final TunnelManager tunnelManager = Application.getTunnelManager();
+            if (Intent.ACTION_BOOT_COMPLETED.equals(action)) {
+                Log.i(TAG, "Broadcast receiver restoring state (boot)");
+                tunnelManager.restoreState(false).whenComplete(ExceptionLoggers.D);
+            } else if (Intent.ACTION_SHUTDOWN.equals(action)) {
+                Log.i(TAG, "Broadcast receiver saving state (shutdown)");
+                tunnelManager.saveState();
+            }
+        });
    }
 }
@@ -1,27 +1,29 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android;

-import android.annotation.TargetApi;
 import android.content.Intent;
-import android.databinding.Observable;
-import android.databinding.Observable.OnPropertyChangedCallback;
+import androidx.databinding.Observable;
+import androidx.databinding.Observable.OnPropertyChangedCallback;
+import android.graphics.Bitmap;
+import android.graphics.Canvas;
 import android.graphics.drawable.Icon;
 import android.os.Build;
+import android.os.IBinder;
 import android.service.quicksettings.Tile;
 import android.service.quicksettings.TileService;
+import androidx.annotation.Nullable;
+import androidx.annotation.RequiresApi;
 import android.util.Log;
-import android.widget.Toast;

 import com.wireguard.android.activity.MainActivity;
+import com.wireguard.android.activity.TunnelToggleActivity;
 import com.wireguard.android.model.Tunnel;
 import com.wireguard.android.model.Tunnel.State;
-import com.wireguard.android.model.TunnelManager;
-import com.wireguard.android.util.ExceptionLoggers;
+import com.wireguard.android.widget.SlashDrawable;

 import java.util.Objects;

@@ -31,19 +33,48 @@ import java.util.Objects;
 * forward click events to the application.
 */

-@TargetApi(Build.VERSION_CODES.N)
+@RequiresApi(Build.VERSION_CODES.N)
 public class QuickTileService extends TileService {
    private static final String TAG = "WireGuard/" + QuickTileService.class.getSimpleName();

    private final OnStateChangedCallback onStateChangedCallback = new OnStateChangedCallback();
    private final OnTunnelChangedCallback onTunnelChangedCallback = new OnTunnelChangedCallback();
-    private Tunnel tunnel;
-    private TunnelManager tunnelManager;
+    @Nullable private Icon iconOff;
+    @Nullable private Icon iconOn;
+    @Nullable private Tunnel tunnel;
+
+    /* This works around an annoying unsolved frameworks bug some people are hitting. */
+    @Override
+    @Nullable
+    public IBinder onBind(final Intent intent) {
+        IBinder ret = null;
+        try {
+            ret = super.onBind(intent);
+        } catch (final Exception e) {
+            Log.d(TAG, "Failed to bind to TileService", e);
+        }
+        return ret;
+    }

    @Override
    public void onClick() {
        if (tunnel != null) {
-            tunnel.setState(State.TOGGLE).whenComplete(this::onToggleFinished);
+            unlockAndRun(() -> {
+                final Tile tile = getQsTile();
+                if (tile != null) {
+                    tile.setIcon(tile.getIcon() == iconOn ? iconOff : iconOn);
+                    tile.updateTile();
+                }
+                tunnel.setState(State.TOGGLE).whenComplete((v, t) -> {
+                    if (t == null) {
+                        updateTile();
+                    } else {
+                        final Intent toggleIntent = new Intent(this, TunnelToggleActivity.class);
+                        toggleIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                        startActivity(toggleIntent);
+                    }
+                });
+            });
        } else {
            final Intent intent = new Intent(this, MainActivity.class);
            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
@@ -53,13 +84,29 @@ public class QuickTileService extends TileService {

    @Override
    public void onCreate() {
-        super.onCreate();
-        tunnelManager = Application.getComponent().getTunnelManager();
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
+            iconOff = iconOn = Icon.createWithResource(this, R.drawable.ic_tile);
+            return;
+        }
+        final SlashDrawable icon = new SlashDrawable(getResources().getDrawable(R.drawable.ic_tile, Application.get().getTheme()));
+        icon.setAnimationEnabled(false); /* Unfortunately we can't have animations, since Icons are marshaled. */
+        icon.setSlashed(false);
+        Bitmap b = Bitmap.createBitmap(icon.getIntrinsicWidth(), icon.getIntrinsicHeight(), Bitmap.Config.ARGB_8888);
+        Canvas c = new Canvas(b);
+        icon.setBounds(0, 0, c.getWidth(), c.getHeight());
+        icon.draw(c);
+        iconOn = Icon.createWithBitmap(b);
+        icon.setSlashed(true);
+        b = Bitmap.createBitmap(icon.getIntrinsicWidth(), icon.getIntrinsicHeight(), Bitmap.Config.ARGB_8888);
+        c = new Canvas(b);
+        icon.setBounds(0, 0, c.getWidth(), c.getHeight());
+        icon.draw(c);
+        iconOff = Icon.createWithBitmap(b);
    }

    @Override
    public void onStartListening() {
-        tunnelManager.addOnPropertyChangedCallback(onTunnelChangedCallback);
+        Application.getTunnelManager().addOnPropertyChangedCallback(onTunnelChangedCallback);
        if (tunnel != null)
            tunnel.addOnPropertyChangedCallback(onStateChangedCallback);
        updateTile();
@@ -69,22 +116,12 @@ public class QuickTileService extends TileService {
    public void onStopListening() {
        if (tunnel != null)
            tunnel.removeOnPropertyChangedCallback(onStateChangedCallback);
-        tunnelManager.removeOnPropertyChangedCallback(onTunnelChangedCallback);
-    }
-
-    private void onToggleFinished(@SuppressWarnings("unused") final State state,
-                                  final Throwable throwable) {
-        if (throwable == null)
-            return;
-        final String error = ExceptionLoggers.unwrapMessage(throwable);
-        final String message = getString(R.string.toggle_error, error);
-        Log.e(TAG, message, throwable);
-        Toast.makeText(this, message, Toast.LENGTH_LONG).show();
+        Application.getTunnelManager().removeOnPropertyChangedCallback(onTunnelChangedCallback);
    }

    private void updateTile() {
        // Update the tunnel.
-        final Tunnel newTunnel = tunnelManager.getLastUsedTunnel();
+        final Tunnel newTunnel = Application.getTunnelManager().getLastUsedTunnel();
        if (newTunnel != tunnel) {
            if (tunnel != null)
                tunnel.removeOnPropertyChangedCallback(onStateChangedCallback);
@@ -107,10 +144,7 @@ public class QuickTileService extends TileService {
            return;
        tile.setLabel(label);
        if (tile.getState() != state) {
-            // The icon must be changed every time the state changes, or the shade will not change.
-            final Integer iconResource = state == Tile.STATE_ACTIVE ? R.drawable.ic_tile
-                    : R.drawable.ic_tile_disabled;
-            tile.setIcon(Icon.createWithResource(this, iconResource));
+            tile.setIcon(state == Tile.STATE_ACTIVE ? iconOn : iconOff);
            tile.setState(state);
        }
        tile.updateTile();
@@ -1,21 +1,17 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.activity;

-import android.content.Intent;
-import android.databinding.CallbackRegistry;
-import android.databinding.CallbackRegistry.NotifierCallback;
+import androidx.databinding.CallbackRegistry;
+import androidx.databinding.CallbackRegistry.NotifierCallback;
 import android.os.Bundle;
-import android.support.v7.app.AppCompatActivity;
+import androidx.annotation.Nullable;

 import com.wireguard.android.Application;
-import com.wireguard.android.backend.GoBackend;
 import com.wireguard.android.model.Tunnel;
-import com.wireguard.android.model.TunnelManager;

 import java.util.Objects;

@@ -23,43 +19,38 @@ import java.util.Objects;
 * Base class for activities that need to remember the currently-selected tunnel.
 */

-public abstract class BaseActivity extends AppCompatActivity {
+public abstract class BaseActivity extends ThemeChangeAwareActivity {
    private static final String KEY_SELECTED_TUNNEL = "selected_tunnel";

    private final SelectionChangeRegistry selectionChangeRegistry = new SelectionChangeRegistry();
-    private Tunnel selectedTunnel;
+    @Nullable private Tunnel selectedTunnel;

-    public void addOnSelectedTunnelChangedListener(
-            final OnSelectedTunnelChangedListener listener) {
+    public void addOnSelectedTunnelChangedListener(final OnSelectedTunnelChangedListener listener) {
        selectionChangeRegistry.add(listener);
    }

+    @Nullable
    public Tunnel getSelectedTunnel() {
        return selectedTunnel;
    }

    @Override
-    protected void onCreate(final Bundle savedInstanceState) {
+    protected void onCreate(@Nullable final Bundle savedInstanceState) {
        // Restore the saved tunnel if there is one; otherwise grab it from the arguments.
-        String savedTunnelName = null;
+        final String savedTunnelName;
        if (savedInstanceState != null)
            savedTunnelName = savedInstanceState.getString(KEY_SELECTED_TUNNEL);
        else if (getIntent() != null)
            savedTunnelName = getIntent().getStringExtra(KEY_SELECTED_TUNNEL);
-        if (savedTunnelName != null) {
-            final TunnelManager tunnelManager = Application.getComponent().getTunnelManager();
-            selectedTunnel = tunnelManager.getTunnels().get(savedTunnelName);
-        }
+        else
+            savedTunnelName = null;
+
+        if (savedTunnelName != null)
+            Application.getTunnelManager().getTunnels()
+                    .thenAccept(tunnels -> setSelectedTunnel(tunnels.get(savedTunnelName)));

        // The selected tunnel must be set before the superclass method recreates fragments.
        super.onCreate(savedInstanceState);
-
-        if (Application.getComponent().getBackendType() == GoBackend.class) {
-            final Intent intent = GoBackend.VpnService.prepare(this);
-            if (intent != null) {
-                startActivityForResult(intent, 0);
-            }
-        }
    }

    @Override
@@ -69,14 +60,14 @@ public abstract class BaseActivity extends AppCompatActivity {
        super.onSaveInstanceState(outState);
    }

-    protected abstract void onSelectedTunnelChanged(Tunnel oldTunnel, Tunnel newTunnel);
+    protected abstract void onSelectedTunnelChanged(@Nullable Tunnel oldTunnel, @Nullable Tunnel newTunnel);

    public void removeOnSelectedTunnelChangedListener(
            final OnSelectedTunnelChangedListener listener) {
        selectionChangeRegistry.remove(listener);
    }

-    public void setSelectedTunnel(final Tunnel tunnel) {
+    public void setSelectedTunnel(@Nullable final Tunnel tunnel) {
        final Tunnel oldTunnel = selectedTunnel;
        if (Objects.equals(oldTunnel, tunnel))
            return;
@@ -86,7 +77,7 @@ public abstract class BaseActivity extends AppCompatActivity {
    }

    public interface OnSelectedTunnelChangedListener {
-        void onSelectedTunnelChanged(Tunnel oldTunnel, Tunnel newTunnel);
+        void onSelectedTunnelChanged(@Nullable Tunnel oldTunnel, @Nullable Tunnel newTunnel);
    }

    private static final class SelectionChangeNotifier
@@ -1,19 +1,21 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.activity;

+import android.annotation.SuppressLint;
 import android.content.Intent;
 import android.os.Bundle;
-import android.support.v4.app.Fragment;
-import android.support.v4.app.FragmentManager;
-import android.support.v4.app.FragmentTransaction;
-import android.util.Log;
+import androidx.annotation.Nullable;
+import androidx.fragment.app.FragmentManager;
+import androidx.fragment.app.FragmentTransaction;
+import androidx.appcompat.app.ActionBar;
 import android.view.Menu;
 import android.view.MenuItem;
+import android.view.View;
+import android.widget.LinearLayout;

 import com.wireguard.android.R;
 import com.wireguard.android.fragment.TunnelDetailFragment;
@@ -21,80 +23,63 @@ import com.wireguard.android.fragment.TunnelEditorFragment;
 import com.wireguard.android.fragment.TunnelListFragment;
 import com.wireguard.android.model.Tunnel;

-import java9.util.stream.Stream;
-
 /**
 * CRUD interface for WireGuard tunnels. This activity serves as the main entry point to the
 * WireGuard application, and contains several fragments for listing, viewing details of, and
 * editing the configuration and interface state of WireGuard tunnels.
 */

-public class MainActivity extends BaseActivity {
-    private static final String KEY_STATE = "fragment_state";
-    private static final String TAG = "WireGuard/" + MainActivity.class.getSimpleName();
-    private State state = State.EMPTY;
-
-    private boolean moveToState(final State nextState) {
-        if (state == nextState)
-            return false;
-        final FragmentManager fragmentManager = getSupportFragmentManager();
-        Log.i(TAG, "Moving from " + state.name() + " to " + nextState.name());
-        if (nextState.layer > state.layer + 1) {
-            moveToState(State.ofLayer(state.layer + 1));
-            moveToState(nextState);
-            return true;
-        } else if (nextState.layer == state.layer + 1) {
-            final Fragment fragment = Fragment.instantiate(this, nextState.fragment);
-            final FragmentTransaction transaction = fragmentManager.beginTransaction()
-                    .replace(R.id.master_fragment, fragment)
-                    .setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE);
-            if (state.layer > 0)
-                transaction.addToBackStack(null);
-            transaction.commit();
-        } else if (nextState.layer == state.layer - 1) {
-            if (fragmentManager.getBackStackEntryCount() == 0)
-                return false;
-            fragmentManager.popBackStack();
-        } else if (nextState.layer < state.layer - 1) {
-            moveToState(State.ofLayer(state.layer - 1));
-            moveToState(nextState);
-            return true;
-        }
-        state = nextState;
-        if (state.layer <= State.LIST.layer)
-            setSelectedTunnel(null);
-        updateActionBar();
-        return true;
-    }
+public class MainActivity extends BaseActivity
+        implements FragmentManager.OnBackStackChangedListener {
+    @Nullable private ActionBar actionBar;
+    private boolean isTwoPaneLayout;
+    @Nullable private TunnelListFragment listFragment;

    @Override
    public void onBackPressed() {
-        TunnelListFragment fragment = null;
-        try {
-            fragment =
-                    ((TunnelListFragment)
-                            getSupportFragmentManager().getFragments().get(0));
-        } catch (final ClassCastException ignored) {
+        final int backStackEntries = getSupportFragmentManager().getBackStackEntryCount();
+        // If the action menu is visible and expanded, collapse it instead of navigating back.
+        if (isTwoPaneLayout || backStackEntries == 0) {
+            if (listFragment != null && listFragment.collapseActionMenu())
+                return;
        }
-        if (fragment == null || !(fragment.collapseActionMenu())) {
-            if (!moveToState(State.ofLayer(state.layer - 1)))
-                super.onBackPressed();
+        // If the two-pane layout does not have an editor open, going back should exit the app.
+        if (isTwoPaneLayout && backStackEntries <= 1) {
+            finish();
+            return;
        }
+        // Deselect the current tunnel on navigating back from the detail pane to the one-pane list.
+        if (!isTwoPaneLayout && backStackEntries == 1) {
+            setSelectedTunnel(null);
+            return;
+        }
+        super.onBackPressed();
    }

+    @Override public void onBackStackChanged() {
+        if (actionBar == null)
+            return;
+        // Do not show the home menu when the two-pane layout is at the detail view (see above).
+        final int backStackEntries = getSupportFragmentManager().getBackStackEntryCount();
+        final int minBackStackEntries = isTwoPaneLayout ? 2 : 1;
+        actionBar.setDisplayHomeAsUpEnabled(backStackEntries >= minBackStackEntries);
+    }
+
+    // We use onTouchListener here to avoid the UI click sound, hence
+    // calling View#performClick defeats the purpose of it.
+    @SuppressLint("ClickableViewAccessibility")
    @Override
-    protected void onCreate(final Bundle savedInstanceState) {
+    protected void onCreate(@Nullable final Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.main_activity);
-        if (savedInstanceState != null && savedInstanceState.getString(KEY_STATE) != null)
-            state = State.valueOf(savedInstanceState.getString(KEY_STATE));
-        if (state == State.EMPTY) {
-            State initialState = getSelectedTunnel() != null ? State.DETAIL : State.LIST;
-            if (getIntent() != null && getIntent().getStringExtra(KEY_STATE) != null)
-                initialState = State.valueOf(getIntent().getStringExtra(KEY_STATE));
-            moveToState(initialState);
-        }
-        updateActionBar();
+        actionBar = getSupportActionBar();
+        isTwoPaneLayout = findViewById(R.id.master_detail_wrapper) instanceof LinearLayout;
+        listFragment = (TunnelListFragment) getSupportFragmentManager().findFragmentByTag("LIST");
+        getSupportFragmentManager().addOnBackStackChangedListener(this);
+        onBackStackChanged();
+        final View actionBarView = findViewById(R.id.action_bar);
+        if (actionBarView != null)
+            actionBarView.setOnTouchListener((v, e) -> listFragment != null && listFragment.collapseActionMenu());
    }

    @Override
@@ -108,11 +93,14 @@ public class MainActivity extends BaseActivity {
        switch (item.getItemId()) {
            case android.R.id.home:
                // The back arrow in the action bar should act the same as the back button.
-                moveToState(State.ofLayer(state.layer - 1));
+                onBackPressed();
                return true;
            case R.id.menu_action_edit:
-                if (getSelectedTunnel() != null)
-                    moveToState(State.EDITOR);
+                getSupportFragmentManager().beginTransaction()
+                        .replace(R.id.detail_container, new TunnelEditorFragment())
+                        .setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
+                        .addToBackStack(null)
+                        .commit();
                return true;
            case R.id.menu_action_save:
                // This menu item is handled by the editor fragment.
@@ -126,38 +114,26 @@ public class MainActivity extends BaseActivity {
    }

    @Override
-    protected void onSaveInstanceState(final Bundle outState) {
-        outState.putString(KEY_STATE, state.name());
-        super.onSaveInstanceState(outState);
-    }
-
-
-    @Override
-    protected void onSelectedTunnelChanged(final Tunnel oldTunnel, final Tunnel newTunnel) {
-        moveToState(newTunnel != null ? State.DETAIL : State.LIST);
-    }
-
-    private void updateActionBar() {
-        if (getSupportActionBar() != null)
-            getSupportActionBar().setDisplayHomeAsUpEnabled(state.layer > State.LIST.layer);
-    }
-
-    private enum State {
-        EMPTY(null, 0),
-        LIST(TunnelListFragment.class, 1),
-        DETAIL(TunnelDetailFragment.class, 2),
-        EDITOR(TunnelEditorFragment.class, 3);
-
-        private final String fragment;
-        private final int layer;
-
-        State(final Class<? extends Fragment> fragment, final int layer) {
-            this.fragment = fragment != null ? fragment.getName() : null;
-            this.layer = layer;
+    protected void onSelectedTunnelChanged(@Nullable final Tunnel oldTunnel,
+                                           @Nullable final Tunnel newTunnel) {
+        final FragmentManager fragmentManager = getSupportFragmentManager();
+        final int backStackEntries = fragmentManager.getBackStackEntryCount();
+        if (newTunnel == null) {
+            // Clear everything off the back stack (all editors and detail fragments).
+            fragmentManager.popBackStackImmediate(0, FragmentManager.POP_BACK_STACK_INCLUSIVE);
+            return;
        }
-
-        private static State ofLayer(final int layer) {
-            return Stream.of(State.values()).filter(s -> s.layer == layer).findFirst().get();
+        if (backStackEntries == 2) {
+            // Pop the editor off the back stack to reveal the detail fragment. Use the immediate
+            // method to avoid the editor picking up the new tunnel while it is still visible.
+            fragmentManager.popBackStackImmediate();
+        } else if (backStackEntries == 0) {
+            // Create and show a new detail fragment.
+            fragmentManager.beginTransaction()
+                    .add(R.id.detail_container, new TunnelDetailFragment())
+                    .setTransition(FragmentTransaction.TRANSIT_FRAGMENT_FADE)
+                    .addToBackStack(null)
+                    .commit();
        }
    }
 }
@@ -1,19 +1,20 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.activity;

 import android.content.pm.PackageManager;
+import android.os.Build;
 import android.os.Bundle;
-import android.support.annotation.NonNull;
-import android.support.v4.app.ActivityCompat;
-import android.support.v4.content.ContextCompat;
-import android.support.v7.app.AppCompatActivity;
-import android.support.v7.preference.Preference;
-import android.support.v7.preference.PreferenceFragmentCompat;
+import androidx.annotation.Nullable;
+import androidx.core.app.ActivityCompat;
+import androidx.core.content.ContextCompat;
+import androidx.preference.Preference;
+import androidx.preference.PreferenceFragmentCompat;
+import androidx.preference.PreferenceScreen;
+import android.util.SparseArray;
 import android.view.MenuItem;

 import com.wireguard.android.Application;
@@ -22,16 +23,14 @@ import com.wireguard.android.backend.WgQuickBackend;

 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;

 /**
 * Interface for changing application-global persistent settings.
 */

-public class SettingsActivity extends AppCompatActivity {
-    private final Map<Integer, PermissionRequestCallback> permissionRequestCallbacks = new HashMap<>();
+public class SettingsActivity extends ThemeChangeAwareActivity {
+    private final SparseArray<PermissionRequestCallback> permissionRequestCallbacks = new SparseArray<>();
    private int permissionRequestCounter;

    public void ensurePermissions(final String[] permissions, final PermissionRequestCallback cb) {
@@ -54,7 +53,7 @@ public class SettingsActivity extends AppCompatActivity {
    }

    @Override
-    protected void onCreate(final Bundle savedInstanceState) {
+    protected void onCreate(@Nullable final Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        if (getSupportFragmentManager().findFragmentById(android.R.id.content) == null) {
            getSupportFragmentManager().beginTransaction()
@@ -76,8 +75,8 @@ public class SettingsActivity extends AppCompatActivity {

    @Override
    public void onRequestPermissionsResult(final int requestCode,
-                                           @NonNull final String[] permissions,
-                                           @NonNull final int[] grantResults) {
+                                           final String[] permissions,
+                                           final int[] grantResults) {
        final PermissionRequestCallback f = permissionRequestCallbacks.get(requestCode);
        if (f != null) {
            permissionRequestCallbacks.remove(requestCode);
@@ -93,11 +92,36 @@ public class SettingsActivity extends AppCompatActivity {
        @Override
        public void onCreatePreferences(final Bundle savedInstanceState, final String key) {
            addPreferencesFromResource(R.xml.preferences);
-            if (Application.getComponent().getBackendType() != WgQuickBackend.class) {
-                Preference pref = getPreferenceManager().findPreference("tools_installer");
-                getPreferenceScreen().removePreference(pref);
-                pref = getPreferenceManager().findPreference("restore_on_boot");
-                getPreferenceScreen().removePreference(pref);
+            final PreferenceScreen screen = getPreferenceScreen();
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+                screen.removePreference(getPreferenceManager().findPreference("dark_theme"));
+
+            final Preference wgQuickOnlyPrefs[] = {
+                    getPreferenceManager().findPreference("tools_installer"),
+                    getPreferenceManager().findPreference("restore_on_boot")
+            };
+            for (final Preference pref : wgQuickOnlyPrefs)
+                pref.setVisible(false);
+            Application.getBackendAsync().thenAccept(backend -> {
+                for (final Preference pref : wgQuickOnlyPrefs) {
+                    if (backend instanceof WgQuickBackend)
+                        pref.setVisible(true);
+                    else
+                        screen.removePreference(pref);
+                }
+            });
+
+            final Preference moduleInstaller = getPreferenceManager().findPreference("module_downloader");
+            moduleInstaller.setVisible(false);
+            if (Application.getModuleLoader().isModuleLoaded()) {
+                screen.removePreference(moduleInstaller);
+            } else {
+                Application.getAsyncWorker().runAsync(Application.getRootShell()::start).whenComplete((v, e) -> {
+                    if (e == null)
+                        moduleInstaller.setVisible(true);
+                    else
+                        screen.removePreference(moduleInstaller);
+                });
            }
        }
    }
@@ -0,0 +1,82 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.activity;
+
+import android.content.SharedPreferences;
+import android.content.res.Resources;
+import android.os.Build;
+import android.os.Bundle;
+import androidx.annotation.Nullable;
+import androidx.appcompat.app.AppCompatActivity;
+import androidx.appcompat.app.AppCompatDelegate;
+import android.util.Log;
+
+import com.wireguard.android.Application;
+
+import java.lang.reflect.Field;
+
+public abstract class ThemeChangeAwareActivity extends AppCompatActivity implements SharedPreferences.OnSharedPreferenceChangeListener {
+    private static final String TAG = "WireGuard/" + ThemeChangeAwareActivity.class.getSimpleName();
+    private static boolean lastDarkMode;
+    @Nullable private static Resources lastResources;
+
+    private static synchronized void invalidateDrawableCache(final Resources resources, final boolean darkMode) {
+        if (resources == lastResources && darkMode == lastDarkMode)
+            return;
+
+        try {
+            Field f;
+            Object o = resources;
+            try {
+                f = o.getClass().getDeclaredField("mResourcesImpl");
+                f.setAccessible(true);
+                o = f.get(o);
+            } catch (final Exception ignored) {
+            }
+            f = o.getClass().getDeclaredField("mDrawableCache");
+            f.setAccessible(true);
+            o = f.get(o);
+            try {
+                o.getClass().getMethod("onConfigurationChange", int.class).invoke(o, -1);
+            } catch (final Exception ignored) {
+                o.getClass().getMethod("clear").invoke(o);
+            }
+        } catch (final Exception e) {
+            Log.e(TAG, "Failed to flush drawable cache", e);
+        }
+
+        lastResources = resources;
+        lastDarkMode = darkMode;
+    }
+
+
+    @Override
+    protected void onCreate(@Nullable final Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
+            Application.getSharedPreferences().registerOnSharedPreferenceChangeListener(this);
+    }
+
+    @Override
+    protected void onDestroy() {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
+            Application.getSharedPreferences().unregisterOnSharedPreferenceChangeListener(this);
+        super.onDestroy();
+    }
+
+    @Override
+    public void onSharedPreferenceChanged(final SharedPreferences sharedPreferences, final String key) {
+        if ("dark_theme".equals(key)) {
+            final boolean darkMode = sharedPreferences.getBoolean(key, false);
+            AppCompatDelegate.setDefaultNightMode(
+                    sharedPreferences.getBoolean(key, false) ?
+                            AppCompatDelegate.MODE_NIGHT_YES :
+                            AppCompatDelegate.MODE_NIGHT_NO);
+            invalidateDrawableCache(getResources(), darkMode);
+            recreate();
+        }
+    }
+}
@@ -1,12 +1,12 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.activity;

 import android.os.Bundle;
+import androidx.annotation.Nullable;

 import com.wireguard.android.fragment.TunnelEditorFragment;
 import com.wireguard.android.model.Tunnel;
@@ -18,7 +18,7 @@ import com.wireguard.android.model.Tunnel;
 public class TunnelCreatorActivity extends BaseActivity {
    @Override
    @SuppressWarnings("UnnecessaryFullyQualifiedName")
-    protected void onCreate(final Bundle savedInstanceState) {
+    protected void onCreate(@Nullable final Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        if (getSupportFragmentManager().findFragmentById(android.R.id.content) == null) {
            getSupportFragmentManager().beginTransaction()
@@ -28,7 +28,7 @@ public class TunnelCreatorActivity extends BaseActivity {
    }

    @Override
-    protected void onSelectedTunnelChanged(final Tunnel oldTunnel, final Tunnel newTunnel) {
+    protected void onSelectedTunnelChanged(@Nullable final Tunnel oldTunnel, @Nullable final Tunnel newTunnel) {
        finish();
    }
 }
@@ -0,0 +1,51 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.activity;
+
+import androidx.annotation.Nullable;
+import androidx.annotation.RequiresApi;
+import androidx.appcompat.app.AppCompatActivity;
+
+import android.content.ComponentName;
+import android.os.Bundle;
+import android.os.Build;
+import android.service.quicksettings.TileService;
+import android.util.Log;
+import android.widget.Toast;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.QuickTileService;
+import com.wireguard.android.R;
+import com.wireguard.android.model.Tunnel;
+import com.wireguard.android.model.Tunnel.State;
+import com.wireguard.android.util.ErrorMessages;
+
+@RequiresApi(Build.VERSION_CODES.N)
+public class TunnelToggleActivity extends AppCompatActivity {
+    private static final String TAG = "WireGuard/" + TunnelToggleActivity.class.getSimpleName();
+
+    @Override
+    protected void onCreate(@Nullable final Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        final Tunnel tunnel = Application.getTunnelManager().getLastUsedTunnel();
+        if (tunnel == null)
+            return;
+        tunnel.setState(State.TOGGLE).whenComplete((v, t) -> {
+            TileService.requestListeningState(this, new ComponentName(this, QuickTileService.class));
+            onToggleFinished(t);
+            finishAffinity();
+        });
+    }
+
+    private void onToggleFinished(@Nullable final Throwable throwable) {
+        if (throwable == null)
+            return;
+        final String error = ErrorMessages.get(throwable);
+        final String message = getString(R.string.toggle_error, error);
+        Log.e(TAG, message, throwable);
+        Toast.makeText(this, message, Toast.LENGTH_LONG).show();
+    }
+}
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.backend;
@@ -53,6 +52,21 @@ public interface Backend {
     */
    Statistics getStatistics(Tunnel tunnel) throws Exception;

+    /**
+     * Determine type name of underlying backend.
+     *
+     * @return Type name
+     */
+    String getTypePrettyName();
+
+    /**
+     * Determine version of underlying backend.
+     *
+     * @return The version of the backend.
+     * @throws Exception
+     */
+    String getVersion() throws Exception;
+
    /**
     * Set the state of a tunnel.
     *
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.backend;
@@ -10,10 +9,12 @@ import android.app.PendingIntent;
 import android.content.Context;
 import android.content.Intent;
 import android.os.ParcelFileDescriptor;
-import android.support.v4.util.ArraySet;
+import androidx.annotation.Nullable;
+import androidx.collection.ArraySet;
 import android.util.Log;

 import com.wireguard.android.Application;
+import com.wireguard.android.R;
 import com.wireguard.android.activity.MainActivity;
 import com.wireguard.android.model.Tunnel;
 import com.wireguard.android.model.Tunnel.State;
@@ -21,14 +22,14 @@ import com.wireguard.android.model.Tunnel.Statistics;
 import com.wireguard.android.util.ExceptionLoggers;
 import com.wireguard.android.util.SharedLibraryLoader;
 import com.wireguard.config.Config;
-import com.wireguard.config.IPCidr;
-import com.wireguard.config.Interface;
+import com.wireguard.config.InetNetwork;
 import com.wireguard.config.Peer;
-import com.wireguard.crypto.KeyEncoding;
+import com.wireguard.crypto.Key;
+import com.wireguard.crypto.KeyFormatException;

 import java.net.InetAddress;
 import java.util.Collections;
-import java.util.Formatter;
+import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
@@ -40,7 +41,7 @@ public final class GoBackend implements Backend {
    private static CompletableFuture<VpnService> vpnService = new CompletableFuture<>();

    private final Context context;
-    private Tunnel currentTunnel;
+    @Nullable private Tunnel currentTunnel;
    private int currentTunnelHandle = -1;

    public GoBackend(final Context context) {
@@ -48,6 +49,8 @@ public final class GoBackend implements Backend {
        this.context = context;
    }

+    private static native String wgGetConfig(int handle);
+
    private static native int wgGetSocketV4(int handle);

    private static native int wgGetSocketV6(int handle);
@@ -56,6 +59,8 @@ public final class GoBackend implements Backend {

    private static native int wgTurnOn(String ifName, int tunFd, String settings);

+    private static native String wgVersion();
+
    @Override
    public Config applyConfig(final Tunnel tunnel, final Config config) throws Exception {
        if (tunnel.getState() == State.UP) {
@@ -89,7 +94,55 @@ public final class GoBackend implements Backend {

    @Override
    public Statistics getStatistics(final Tunnel tunnel) {
-        return new Statistics();
+        final Statistics stats = new Statistics();
+        if (tunnel != currentTunnel) {
+            return stats;
+        }
+        final String config = wgGetConfig(currentTunnelHandle);
+        Key key = null;
+        long rx = 0, tx = 0;
+        for (final String line : config.split("\\n")) {
+            if (line.startsWith("public_key=")) {
+                if (key != null)
+                    stats.add(key, rx, tx);
+                rx = 0;
+                tx = 0;
+                try {
+                    key = Key.fromHex(line.substring(11));
+                } catch (final KeyFormatException ignored) {
+                    key = null;
+                }
+            } else if (line.startsWith("rx_bytes=")) {
+                if (key == null)
+                    continue;
+                try {
+                    rx = Long.parseLong(line.substring(9));
+                } catch (final NumberFormatException ignored) {
+                    rx = 0;
+                }
+            } else if (line.startsWith("tx_bytes=")) {
+                if (key == null)
+                    continue;
+                try {
+                    tx = Long.parseLong(line.substring(9));
+                } catch (final NumberFormatException ignored) {
+                    tx = 0;
+                }
+            }
+        }
+        if (key != null)
+            stats.add(key, rx, tx);
+        return stats;
+    }
+
+    @Override
+    public String getTypePrettyName() {
+        return context.getString(R.string.type_name_go_userspace);
+    }
+
+    @Override
+    public String getVersion() {
+        return wgVersion();
    }

    @Override
@@ -100,20 +153,22 @@ public final class GoBackend implements Backend {
        if (state == originalState)
            return originalState;
        if (state == State.UP && currentTunnel != null)
-            throw new IllegalStateException("Only one userspace tunnel can run at a time");
+            throw new IllegalStateException(context.getString(R.string.multiple_tunnels_error));
        Log.d(TAG, "Changing tunnel " + tunnel.getName() + " to state " + state);
        setStateInternal(tunnel, tunnel.getConfig(), state);
        return getState(tunnel);
    }

-    private void setStateInternal(final Tunnel tunnel, final Config config, final State state)
+    private void setStateInternal(final Tunnel tunnel, @Nullable final Config config, final State state)
            throws Exception {

        if (state == State.UP) {
            Log.i(TAG, "Bringing tunnel up");

+            Objects.requireNonNull(config, context.getString(R.string.no_config_error));
+
            if (VpnService.prepare(context) != null)
-                throw new Exception("VPN service not authorized by user");
+                throw new Exception(context.getString(R.string.vpn_not_authorized_error));

            final VpnService service;
            if (!vpnService.isDone())
@@ -122,7 +177,7 @@ public final class GoBackend implements Backend {
            try {
                service = vpnService.get(2, TimeUnit.SECONDS);
            } catch (final TimeoutException e) {
-                throw new Exception("Unable to start Android VPN service", e);
+                throw new Exception(context.getString(R.string.vpn_start_error), e);
            }

            if (currentTunnelHandle != -1) {
@@ -131,29 +186,7 @@ public final class GoBackend implements Backend {
            }

            // Build config
-            final Interface iface = config.getInterface();
-            final String goConfig;
-            try (Formatter fmt = new Formatter(new StringBuilder())) {
-                fmt.format("replace_peers=true\n");
-                if (iface.getPrivateKey() != null)
-                    fmt.format("private_key=%s\n", KeyEncoding.keyToHex(KeyEncoding.keyFromBase64(iface.getPrivateKey())));
-                if (iface.getListenPort() != 0)
-                    fmt.format("listen_port=%d\n", config.getInterface().getListenPort());
-                for (final Peer peer : config.getPeers()) {
-                    if (peer.getPublicKey() != null)
-                        fmt.format("public_key=%s\n", KeyEncoding.keyToHex(KeyEncoding.keyFromBase64(peer.getPublicKey())));
-                    if (peer.getPreSharedKey() != null)
-                        fmt.format("preshared_key=%s\n", KeyEncoding.keyToHex(KeyEncoding.keyFromBase64(peer.getPreSharedKey())));
-                    if (peer.getEndpoint() != null)
-                        fmt.format("endpoint=%s\n", peer.getResolvedEndpointString());
-                    if (peer.getPersistentKeepalive() != 0)
-                        fmt.format("persistent_keepalive_interval=%d\n", peer.getPersistentKeepalive());
-                    for (final IPCidr addr : peer.getAllowedIPs()) {
-                        fmt.format("allowed_ip=%s\n", addr.toString());
-                    }
-                }
-                goConfig = fmt.toString();
-            }
+            final String goConfig = config.toWgUserspaceString();

            // Create the vpn tunnel with android API
            final VpnService.Builder builder = service.getBuilder();
@@ -163,33 +196,35 @@ public final class GoBackend implements Backend {
            configureIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            builder.setConfigureIntent(PendingIntent.getActivity(context, 0, configureIntent, 0));

-            for (final IPCidr addr : config.getInterface().getAddresses())
-                builder.addAddress(addr.getAddress(), addr.getCidr());
+            for (final String excludedApplication : config.getInterface().getExcludedApplications())
+                builder.addDisallowedApplication(excludedApplication);

-            for (final InetAddress addr : config.getInterface().getDnses())
+            for (final InetNetwork addr : config.getInterface().getAddresses())
+                builder.addAddress(addr.getAddress(), addr.getMask());
+
+            for (final InetAddress addr : config.getInterface().getDnsServers())
                builder.addDnsServer(addr.getHostAddress());

            for (final Peer peer : config.getPeers()) {
-                for (final IPCidr addr : peer.getAllowedIPs())
-                    builder.addRoute(addr.getAddress(), addr.getCidr());
+                for (final InetNetwork addr : peer.getAllowedIps())
+                    builder.addRoute(addr.getAddress(), addr.getMask());
            }

-            int mtu = config.getInterface().getMtu();
-            if (mtu == 0)
-                mtu = 1280;
-            builder.setMtu(mtu);
+            builder.setMtu(config.getInterface().getMtu().orElse(1280));

            builder.setBlocking(true);
-            final ParcelFileDescriptor tun = builder.establish();
-            if (tun == null)
-                throw new Exception("Unable to create tun device");
-
-            currentTunnelHandle = wgTurnOn(tunnel.getName(), tun.detachFd(), goConfig);
+            try (final ParcelFileDescriptor tun = builder.establish()) {
+                if (tun == null)
+                    throw new Exception(context.getString(R.string.tun_create_error));
+                Log.d(TAG, "Go backend v" + wgVersion());
+                currentTunnelHandle = wgTurnOn(tunnel.getName(), tun.detachFd(), goConfig);
+            }
            if (currentTunnelHandle < 0)
-                throw new Exception("Unable to turn tunnel on (wgTurnOn return " + currentTunnelHandle + ')');
+                throw new Exception(context.getString(R.string.tunnel_on_error, currentTunnelHandle));

            currentTunnel = tunnel;

+            service.setUnderlyingNetworks(null);
            service.protect(wgGetSocketV4(currentTunnelHandle));
            service.protect(wgGetSocketV6(currentTunnelHandle));
        } else {
@@ -224,22 +259,26 @@ public final class GoBackend implements Backend {

        @Override
        public void onDestroy() {
-            for (final Tunnel tunnel : Application.getComponent().getTunnelManager().getTunnels()) {
-                if (tunnel != null && tunnel.getState() != State.DOWN)
-                    tunnel.setState(State.DOWN);
-            }
+            Application.getTunnelManager().getTunnels().thenAccept(tunnels -> {
+                for (final Tunnel tunnel : tunnels) {
+                    if (tunnel != null && tunnel.getState() != State.DOWN)
+                        tunnel.setState(State.DOWN);
+                }
+            });
+
            vpnService = vpnService.newIncompleteFuture();
            super.onDestroy();
        }

        @Override
-        public int onStartCommand(Intent intent, int flags, int startId) {
+        public int onStartCommand(@Nullable final Intent intent, final int flags, final int startId) {
            vpnService.complete(this);
            if (intent == null || intent.getComponent() == null || !intent.getComponent().getPackageName().equals(getPackageName())) {
                Log.d(TAG, "Service started by Always-on VPN feature");
-                Application.getComponent().getTunnelManager().restoreState(true).whenComplete(ExceptionLoggers.D);
+                Application.getTunnelManager().restoreState(true).whenComplete(ExceptionLoggers.D);
            }
            return super.onStartCommand(intent, flags, startId);
        }
+
    }
 }
@@ -1,30 +1,31 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.backend;

-import android.content.BroadcastReceiver;
 import android.content.Context;
-import android.content.Intent;
+import androidx.annotation.Nullable;
 import android.util.Log;

 import com.wireguard.android.Application;
+import com.wireguard.android.R;
 import com.wireguard.android.model.Tunnel;
 import com.wireguard.android.model.Tunnel.State;
 import com.wireguard.android.model.Tunnel.Statistics;
-import com.wireguard.android.util.RootShell;
-import com.wireguard.android.util.ToolsInstaller;
 import com.wireguard.config.Config;
+import com.wireguard.crypto.Key;

 import java.io.File;
 import java.io.FileOutputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
+import java.util.Locale;
+import java.util.Objects;
 import java.util.Set;

 import java9.util.stream.Collectors;
@@ -38,14 +39,11 @@ public final class WgQuickBackend implements Backend {
    private static final String TAG = "WireGuard/" + WgQuickBackend.class.getSimpleName();

    private final File localTemporaryDir;
-    private final RootShell rootShell;
-    private final ToolsInstaller toolsInstaller;
+    private final Context context;

-    public WgQuickBackend(final Context context, final RootShell rootShell,
-                          final ToolsInstaller toolsInstaller) {
+    public WgQuickBackend(final Context context) {
        localTemporaryDir = new File(context.getCacheDir(), "tmp");
-        this.rootShell = rootShell;
-        this.toolsInstaller = toolsInstaller;
+        this.context = context;
    }

    @Override
@@ -69,8 +67,8 @@ public final class WgQuickBackend implements Backend {
        final List<String> output = new ArrayList<>();
        // Don't throw an exception here or nothing will show up in the UI.
        try {
-            toolsInstaller.ensureToolsAvailable();
-            if (rootShell.run(output, "wg show interfaces") != 0 || output.isEmpty())
+            Application.getToolsInstaller().ensureToolsAvailable();
+            if (Application.getRootShell().run(output, "wg show interfaces") != 0 || output.isEmpty())
                return Collections.emptySet();
        } catch (final Exception e) {
            Log.w(TAG, "Unable to enumerate running tunnels", e);
@@ -87,7 +85,38 @@ public final class WgQuickBackend implements Backend {

    @Override
    public Statistics getStatistics(final Tunnel tunnel) {
-        return new Statistics();
+        final Statistics stats = new Statistics();
+        final Collection<String> output = new ArrayList<>();
+        try {
+            if (Application.getRootShell().run(output, String.format("wg show '%s' transfer", tunnel.getName())) != 0)
+                return stats;
+        } catch (final Exception ignored) {
+            return stats;
+        }
+        for (final String line : output) {
+            final String[] parts = line.split("\\t");
+            if (parts.length != 3)
+                continue;
+            try {
+                stats.add(Key.fromBase64(parts[0]), Long.parseLong(parts[1]), Long.parseLong(parts[2]));
+            } catch (final Exception ignored) {
+            }
+        }
+        return stats;
+    }
+
+    @Override
+    public String getTypePrettyName() {
+        return context.getString(R.string.type_name_kernel_module);
+    }
+
+    @Override
+    public String getVersion() throws Exception {
+        final List<String> output = new ArrayList<>();
+        if (Application.getRootShell()
+                .run(output, "cat /sys/module/wireguard/version") != 0 || output.isEmpty())
+            throw new Exception(context.getString(R.string.module_version_error));
+        return output.get(0);
    }

    @Override
@@ -98,31 +127,26 @@ public final class WgQuickBackend implements Backend {
        if (state == originalState)
            return originalState;
        Log.d(TAG, "Changing tunnel " + tunnel.getName() + " to state " + state);
-        toolsInstaller.ensureToolsAvailable();
+        Application.getToolsInstaller().ensureToolsAvailable();
        setStateInternal(tunnel, tunnel.getConfig(), state);
        return getState(tunnel);
    }

-    private void setStateInternal(final Tunnel tunnel, final Config config, final State state)
-            throws Exception {
+    private void setStateInternal(final Tunnel tunnel, @Nullable final Config config, final State state) throws Exception {
+        Objects.requireNonNull(config, "Trying to set state with a null config");
+
        final File tempFile = new File(localTemporaryDir, tunnel.getName() + ".conf");
-        try (FileOutputStream stream = new FileOutputStream(tempFile, false)) {
-            stream.write(config.toString().getBytes(StandardCharsets.UTF_8));
+        try (final FileOutputStream stream = new FileOutputStream(tempFile, false)) {
+            stream.write(config.toWgQuickString().getBytes(StandardCharsets.UTF_8));
        }
-        final String command = String.format("wg-quick %s '%s'",
-                state.toString().toLowerCase(), tempFile.getAbsolutePath());
-        final int result = rootShell.run(null, command);
+        String command = String.format("wg-quick %s '%s'",
+                state.toString().toLowerCase(Locale.ENGLISH), tempFile.getAbsolutePath());
+        if (state == State.UP)
+            command = "cat /sys/module/wireguard/version && " + command;
+        final int result = Application.getRootShell().run(null, command);
        // noinspection ResultOfMethodCallIgnored
        tempFile.delete();
        if (result != 0)
-            throw new Exception("Unable to configure tunnel (wg-quick returned " + result + ')');
-    }
-
-    public static final class WgQuickChangeReceiver extends BroadcastReceiver {
-        @Override
-        public void onReceive(final Context context, final Intent intent) {
-            Log.d(TAG, "Refreshing tunnel states");
-            Application.getComponent().getTunnelManager().refreshTunnelStates();
-        }
+            throw new Exception(context.getString(R.string.tunnel_config_error, result));
    }
 }
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.configStore;
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.configStore;
@@ -9,7 +8,8 @@ package com.wireguard.android.configStore;
 import android.content.Context;
 import android.util.Log;

-import com.wireguard.android.Application.ApplicationContext;
+import com.wireguard.android.R;
+import com.wireguard.config.BadConfigException;
 import com.wireguard.config.Config;

 import java.io.File;
@@ -32,7 +32,7 @@ public final class FileConfigStore implements ConfigStore {

    private final Context context;

-    public FileConfigStore(@ApplicationContext final Context context) {
+    public FileConfigStore(final Context context) {
        this.context = context;
    }

@@ -41,9 +41,9 @@ public final class FileConfigStore implements ConfigStore {
        Log.d(TAG, "Creating configuration for tunnel " + name);
        final File file = fileFor(name);
        if (!file.createNewFile())
-            throw new IOException("Configuration file " + file.getName() + " already exists");
-        try (FileOutputStream stream = new FileOutputStream(file, false)) {
-            stream.write(config.toString().getBytes(StandardCharsets.UTF_8));
+            throw new IOException(context.getString(R.string.config_file_exists_error, file.getName()));
+        try (final FileOutputStream stream = new FileOutputStream(file, false)) {
+            stream.write(config.toWgQuickString().getBytes(StandardCharsets.UTF_8));
        }
        return config;
    }
@@ -53,7 +53,7 @@ public final class FileConfigStore implements ConfigStore {
        Log.d(TAG, "Deleting configuration for tunnel " + name);
        final File file = fileFor(name);
        if (!file.delete())
-            throw new IOException("Cannot delete configuration file " + file.getName());
+            throw new IOException(context.getString(R.string.config_delete_error, file.getName()));
    }

    @Override
@@ -69,9 +69,9 @@ public final class FileConfigStore implements ConfigStore {
    }

    @Override
-    public Config load(final String name) throws IOException {
-        try (FileInputStream stream = new FileInputStream(fileFor(name))) {
-            return Config.from(stream);
+    public Config load(final String name) throws BadConfigException, IOException {
+        try (final FileInputStream stream = new FileInputStream(fileFor(name))) {
+            return Config.parse(stream);
        }
    }

@@ -81,11 +81,11 @@ public final class FileConfigStore implements ConfigStore {
        final File file = fileFor(name);
        final File replacementFile = fileFor(replacement);
        if (!replacementFile.createNewFile())
-            throw new IOException("Configuration for " + replacement + " already exists");
+            throw new IOException(context.getString(R.string.config_exists_error, replacement));
        if (!file.renameTo(replacementFile)) {
            if (!replacementFile.delete())
                Log.w(TAG, "Couldn't delete marker file for new name " + replacement);
-            throw new IOException("Cannot rename configuration file " + file.getName());
+            throw new IOException(context.getString(R.string.config_rename_error, file.getName()));
        }
    }

@@ -94,9 +94,9 @@ public final class FileConfigStore implements ConfigStore {
        Log.d(TAG, "Saving configuration for tunnel " + name);
        final File file = fileFor(name);
        if (!file.isFile())
-            throw new FileNotFoundException("Configuration file " + file.getName() + " not found");
-        try (FileOutputStream stream = new FileOutputStream(file, false)) {
-            stream.write(config.toString().getBytes(StandardCharsets.UTF_8));
+            throw new FileNotFoundException(context.getString(R.string.config_not_found_error, file.getName()));
+        try (final FileOutputStream stream = new FileOutputStream(file, false)) {
+            stream.write(config.toWgQuickString().getBytes(StandardCharsets.UTF_8));
        }
        return config;
    }
@@ -1,24 +1,34 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.databinding;

-import android.databinding.BindingAdapter;
-import android.databinding.ObservableList;
-import android.databinding.adapters.ListenerUtil;
+import androidx.databinding.BindingAdapter;
+import androidx.databinding.DataBindingUtil;
+import androidx.databinding.ObservableList;
+import androidx.databinding.ViewDataBinding;
+import androidx.databinding.adapters.ListenerUtil;
+import androidx.annotation.Nullable;
+import androidx.recyclerview.widget.LinearLayoutManager;
+import androidx.recyclerview.widget.RecyclerView;
 import android.text.InputFilter;
+import android.view.LayoutInflater;
 import android.widget.LinearLayout;
-import android.widget.ListView;
 import android.widget.TextView;

+import com.wireguard.android.BR;
 import com.wireguard.android.R;
-import com.wireguard.android.util.Keyed;
+import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler;
 import com.wireguard.android.util.ObservableKeyedList;
 import com.wireguard.android.widget.ToggleSwitch;
 import com.wireguard.android.widget.ToggleSwitch.OnBeforeCheckedChangeListener;
+import com.wireguard.config.Attribute;
+import com.wireguard.config.InetNetwork;
+import com.wireguard.util.Keyed;
+
+import java9.util.Optional;

 /**
 * Static methods for use by generated code in the Android data binding library.
@@ -41,9 +51,10 @@ public final class BindingAdapters {
    }

    @BindingAdapter({"items", "layout"})
-    public static <E> void setItems(final LinearLayout view,
-                                    final ObservableList<E> oldList, final int oldLayoutId,
-                                    final ObservableList<E> newList, final int newLayoutId) {
+    public static <E>
+    void setItems(final LinearLayout view,
+                  @Nullable final ObservableList<E> oldList, final int oldLayoutId,
+                  @Nullable final ObservableList<E> newList, final int newLayoutId) {
        if (oldList == newList && oldLayoutId == newLayoutId)
            return;
        ItemChangeListener<E> listener = ListenerUtil.getListener(view, R.id.item_change_listener);
@@ -66,15 +77,41 @@ public final class BindingAdapters {
    }

    @BindingAdapter({"items", "layout"})
+    public static <E>
+    void setItems(final LinearLayout view,
+                  @Nullable final Iterable<E> oldList, final int oldLayoutId,
+                  @Nullable final Iterable<E> newList, final int newLayoutId) {
+        if (oldList == newList && oldLayoutId == newLayoutId)
+            return;
+        view.removeAllViews();
+        if (newList == null)
+            return;
+        final LayoutInflater layoutInflater = LayoutInflater.from(view.getContext());
+        for (final E item : newList) {
+            final ViewDataBinding binding =
+                    DataBindingUtil.inflate(layoutInflater, newLayoutId, view, false);
+            binding.setVariable(BR.collection, newList);
+            binding.setVariable(BR.item, item);
+            binding.executePendingBindings();
+            view.addView(binding.getRoot());
+        }
+    }
+
+    @BindingAdapter(requireAll = false, value = {"items", "layout", "configurationHandler"})
    public static <K, E extends Keyed<? extends K>>
-    void setItems(final ListView view,
-                  final ObservableKeyedList<K, E> oldList, final int oldLayoutId,
-                  final ObservableKeyedList<K, E> newList, final int newLayoutId) {
+    void setItems(final RecyclerView view,
+                  @Nullable final ObservableKeyedList<K, E> oldList, final int oldLayoutId,
+                  final RowConfigurationHandler oldRowConfigurationHandler,
+                  @Nullable final ObservableKeyedList<K, E> newList, final int newLayoutId,
+                  final RowConfigurationHandler newRowConfigurationHandler) {
+        if (view.getLayoutManager() == null)
+            view.setLayoutManager(new LinearLayoutManager(view.getContext(), RecyclerView.VERTICAL, false));
+
        if (oldList == newList && oldLayoutId == newLayoutId)
            return;
        // The ListAdapter interface is not generic, so this cannot be checked.
-        @SuppressWarnings("unchecked") ObservableKeyedListAdapter<K, E> adapter =
-                (ObservableKeyedListAdapter<K, E>) view.getAdapter();
+        @SuppressWarnings("unchecked") ObservableKeyedRecyclerViewAdapter<K, E> adapter =
+                (ObservableKeyedRecyclerViewAdapter<K, E>) view.getAdapter();
        // If the layout changes, any existing adapter must be replaced.
        if (adapter != null && oldList != null && oldLayoutId != newLayoutId) {
            adapter.setList(null);
@@ -84,9 +121,11 @@ public final class BindingAdapters {
        if (newList == null || newLayoutId == 0)
            return;
        if (adapter == null) {
-            adapter = new ObservableKeyedListAdapter<>(view.getContext(), newLayoutId, newList);
+            adapter = new ObservableKeyedRecyclerViewAdapter<>(view.getContext(), newLayoutId, newList);
            view.setAdapter(adapter);
        }
+
+        adapter.setRowConfigurationHandler(newRowConfigurationHandler);
        // Either the list changed, or this is an entirely new listener because the layout changed.
        adapter.setList(newList);
    }
@@ -96,4 +135,14 @@ public final class BindingAdapters {
                                                 final OnBeforeCheckedChangeListener listener) {
        view.setOnBeforeCheckedChangeListener(listener);
    }
+
+    @BindingAdapter("android:text")
+    public static void setText(final TextView view, final Optional<?> text) {
+        view.setText(text.map(Object::toString).orElse(""));
+    }
+
+    @BindingAdapter("android:text")
+    public static void setText(final TextView view, @Nullable final Iterable<InetNetwork> networks) {
+        view.setText(networks != null ? Attribute.join(networks) : "");
+    }
 }
@@ -1,14 +1,14 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.databinding;

-import android.databinding.DataBindingUtil;
-import android.databinding.ObservableList;
-import android.databinding.ViewDataBinding;
+import androidx.databinding.DataBindingUtil;
+import androidx.databinding.ObservableList;
+import androidx.databinding.ViewDataBinding;
+import androidx.annotation.Nullable;
 import android.view.LayoutInflater;
 import android.view.View;
 import android.view.ViewGroup;
@@ -16,6 +16,7 @@ import android.view.ViewGroup;
 import com.wireguard.android.BR;

 import java.lang.ref.WeakReference;
+import java.util.Objects;

 /**
 * Helper class for binding an ObservableList to the children of a ViewGroup.
@@ -26,7 +27,7 @@ class ItemChangeListener<T> {
    private final ViewGroup container;
    private final int layoutId;
    private final LayoutInflater layoutInflater;
-    private ObservableList<T> list;
+    @Nullable private ObservableList<T> list;

    ItemChangeListener(final ViewGroup container, final int layoutId) {
        this.container = container;
@@ -34,17 +35,21 @@ class ItemChangeListener<T> {
        layoutInflater = LayoutInflater.from(container.getContext());
    }

-    private View getView(final int position, final View convertView) {
-        ViewDataBinding binding = DataBindingUtil.getBinding(convertView);
-        if (binding == null)
+    private View getView(final int position, @Nullable final View convertView) {
+        ViewDataBinding binding = convertView != null ? DataBindingUtil.getBinding(convertView) : null;
+        if (binding == null) {
            binding = DataBindingUtil.inflate(layoutInflater, layoutId, container, false);
+        }
+
+        Objects.requireNonNull(list, "Trying to get a view while list is still null");
+
        binding.setVariable(BR.collection, list);
        binding.setVariable(BR.item, list.get(position));
        binding.executePendingBindings();
        return binding.getRoot();
    }

-    void setList(final ObservableList<T> newList) {
+    void setList(@Nullable final ObservableList<T> newList) {
        if (list != null)
            list.removeOnListChangedCallback(callback);
        list = newList;
@@ -1,84 +1,91 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.databinding;

 import android.content.Context;
-import android.databinding.DataBindingUtil;
-import android.databinding.ObservableList;
-import android.databinding.ViewDataBinding;
+import androidx.databinding.DataBindingUtil;
+import androidx.databinding.ObservableList;
+import androidx.databinding.ViewDataBinding;
+import androidx.annotation.Nullable;
+import androidx.recyclerview.widget.RecyclerView;
+import androidx.recyclerview.widget.RecyclerView.Adapter;
 import android.view.LayoutInflater;
-import android.view.View;
 import android.view.ViewGroup;
-import android.widget.BaseAdapter;

 import com.wireguard.android.BR;
-import com.wireguard.android.util.Keyed;
 import com.wireguard.android.util.ObservableKeyedList;
+import com.wireguard.util.Keyed;

 import java.lang.ref.WeakReference;

 /**
- * A generic {@code ListAdapter} backed by a {@code ObservableKeyedList}.
+ * A generic {@code RecyclerView.Adapter} backed by a {@code ObservableKeyedList}.
 */

-class ObservableKeyedListAdapter<K, E extends Keyed<? extends K>> extends BaseAdapter {
+public class ObservableKeyedRecyclerViewAdapter<K, E extends Keyed<? extends K>> extends Adapter<ObservableKeyedRecyclerViewAdapter.ViewHolder> {
+
    private final OnListChangedCallback<E> callback = new OnListChangedCallback<>(this);
    private final int layoutId;
    private final LayoutInflater layoutInflater;
-    private ObservableKeyedList<K, E> list;
+    @Nullable private ObservableKeyedList<K, E> list;
+    @Nullable private RowConfigurationHandler rowConfigurationHandler;

-    ObservableKeyedListAdapter(final Context context, final int layoutId,
-                               final ObservableKeyedList<K, E> list) {
+    ObservableKeyedRecyclerViewAdapter(final Context context, final int layoutId,
+                                       final ObservableKeyedList<K, E> list) {
        this.layoutId = layoutId;
        layoutInflater = LayoutInflater.from(context);
        setList(list);
    }

-    @Override
-    public int getCount() {
-        return list != null ? list.size() : 0;
-    }
-
-    @Override
-    public E getItem(final int position) {
+    @Nullable
+    private E getItem(final int position) {
        if (list == null || position < 0 || position >= list.size())
            return null;
        return list.get(position);
    }

+    @Override
+    public int getItemCount() {
+        return list != null ? list.size() : 0;
+    }
+
    @Override
    public long getItemId(final int position) {
        final K key = getKey(position);
        return key != null ? key.hashCode() : -1;
    }

+    @Nullable
    private K getKey(final int position) {
        final E item = getItem(position);
        return item != null ? item.getKey() : null;
    }

+    @SuppressWarnings("unchecked")
    @Override
-    public View getView(final int position, final View convertView, final ViewGroup parent) {
-        ViewDataBinding binding = DataBindingUtil.getBinding(convertView);
-        if (binding == null)
-            binding = DataBindingUtil.inflate(layoutInflater, layoutId, parent, false);
-        binding.setVariable(BR.collection, list);
-        binding.setVariable(BR.key, getKey(position));
-        binding.setVariable(BR.item, getItem(position));
-        binding.executePendingBindings();
-        return binding.getRoot();
+    public void onBindViewHolder(final ViewHolder holder, final int position) {
+        holder.binding.setVariable(BR.collection, list);
+        holder.binding.setVariable(BR.key, getKey(position));
+        holder.binding.setVariable(BR.item, getItem(position));
+        holder.binding.executePendingBindings();
+
+        if (rowConfigurationHandler != null) {
+            final E item = getItem(position);
+            if (item != null) {
+                rowConfigurationHandler.onConfigureRow(holder.binding, item, position);
+            }
+        }
    }

    @Override
-    public boolean hasStableIds() {
-        return true;
+    public ViewHolder onCreateViewHolder(final ViewGroup parent, final int viewType) {
+        return new ViewHolder(DataBindingUtil.inflate(layoutInflater, layoutId, parent, false));
    }

-    void setList(final ObservableKeyedList<K, E> newList) {
+    void setList(@Nullable final ObservableKeyedList<K, E> newList) {
        if (list != null)
            list.removeOnListChangedCallback(callback);
        list = newList;
@@ -88,18 +95,26 @@ class ObservableKeyedListAdapter<K, E extends Keyed<? extends K>> extends BaseAd
        notifyDataSetChanged();
    }

+    void setRowConfigurationHandler(final RowConfigurationHandler rowConfigurationHandler) {
+        this.rowConfigurationHandler = rowConfigurationHandler;
+    }
+
+    public interface RowConfigurationHandler<B extends ViewDataBinding, T> {
+        void onConfigureRow(B binding, T item, int position);
+    }
+
    private static final class OnListChangedCallback<E extends Keyed<?>>
            extends ObservableList.OnListChangedCallback<ObservableList<E>> {

-        private final WeakReference<ObservableKeyedListAdapter<?, E>> weakAdapter;
+        private final WeakReference<ObservableKeyedRecyclerViewAdapter<?, E>> weakAdapter;

-        private OnListChangedCallback(final ObservableKeyedListAdapter<?, E> adapter) {
+        private OnListChangedCallback(final ObservableKeyedRecyclerViewAdapter<?, E> adapter) {
            weakAdapter = new WeakReference<>(adapter);
        }

        @Override
        public void onChanged(final ObservableList<E> sender) {
-            final ObservableKeyedListAdapter adapter = weakAdapter.get();
+            final ObservableKeyedRecyclerViewAdapter adapter = weakAdapter.get();
            if (adapter != null)
                adapter.notifyDataSetChanged();
            else
@@ -130,4 +145,15 @@ class ObservableKeyedListAdapter<K, E extends Keyed<? extends K>> extends BaseAd
            onChanged(sender);
        }
    }
+
+    public static class ViewHolder extends RecyclerView.ViewHolder {
+        final ViewDataBinding binding;
+
+        public ViewHolder(final ViewDataBinding binding) {
+            super(binding.getRoot());
+
+            this.binding = binding;
+        }
+    }
+
 }
@@ -0,0 +1,133 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.fragment;
+
+import android.app.Activity;
+import android.app.Dialog;
+import android.content.DialogInterface;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.content.pm.ResolveInfo;
+import android.os.Bundle;
+import androidx.annotation.Nullable;
+import androidx.fragment.app.DialogFragment;
+import androidx.fragment.app.Fragment;
+import androidx.appcompat.app.AlertDialog;
+import android.widget.Toast;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.R;
+import com.wireguard.android.databinding.AppListDialogFragmentBinding;
+import com.wireguard.android.model.ApplicationData;
+import com.wireguard.android.util.ErrorMessages;
+import com.wireguard.android.util.ObservableKeyedArrayList;
+import com.wireguard.android.util.ObservableKeyedList;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import java9.util.Comparators;
+
+public class AppListDialogFragment extends DialogFragment {
+
+    private static final String KEY_EXCLUDED_APPS = "excludedApps";
+    private final ObservableKeyedList<String, ApplicationData> appData = new ObservableKeyedArrayList<>();
+    @Nullable private List<String> currentlyExcludedApps;
+
+    public static <T extends Fragment & AppExclusionListener>
+    AppListDialogFragment newInstance(final ArrayList<String> excludedApps, final T target) {
+        final Bundle extras = new Bundle();
+        extras.putStringArrayList(KEY_EXCLUDED_APPS, excludedApps);
+        final AppListDialogFragment fragment = new AppListDialogFragment();
+        fragment.setTargetFragment(target, 0);
+        fragment.setArguments(extras);
+        return fragment;
+    }
+
+    private void loadData() {
+        final Activity activity = getActivity();
+        if (activity == null) {
+            return;
+        }
+
+        final PackageManager pm = activity.getPackageManager();
+        Application.getAsyncWorker().supplyAsync(() -> {
+            final Intent launcherIntent = new Intent(Intent.ACTION_MAIN, null);
+            launcherIntent.addCategory(Intent.CATEGORY_LAUNCHER);
+            final List<ResolveInfo> resolveInfos = pm.queryIntentActivities(launcherIntent, 0);
+
+            final List<ApplicationData> appData = new ArrayList<>();
+            for (ResolveInfo resolveInfo : resolveInfos) {
+                String packageName = resolveInfo.activityInfo.packageName;
+                appData.add(new ApplicationData(resolveInfo.loadIcon(pm), resolveInfo.loadLabel(pm).toString(), packageName, currentlyExcludedApps.contains(packageName)));
+            }
+
+            Collections.sort(appData, Comparators.comparing(ApplicationData::getName, String.CASE_INSENSITIVE_ORDER));
+            return appData;
+        }).whenComplete(((data, throwable) -> {
+            if (data != null) {
+                appData.clear();
+                appData.addAll(data);
+            } else {
+                final String error = ErrorMessages.get(throwable);
+                final String message = activity.getString(R.string.error_fetching_apps, error);
+                Toast.makeText(activity, message, Toast.LENGTH_LONG).show();
+                dismissAllowingStateLoss();
+            }
+        }));
+    }
+
+    @Override
+    public void onCreate(@Nullable final Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        currentlyExcludedApps = getArguments().getStringArrayList(KEY_EXCLUDED_APPS);
+    }
+
+    @Override
+    public Dialog onCreateDialog(@Nullable final Bundle savedInstanceState) {
+        final AlertDialog.Builder alertDialogBuilder = new AlertDialog.Builder(getActivity());
+        alertDialogBuilder.setTitle(R.string.excluded_applications);
+
+        final AppListDialogFragmentBinding binding = AppListDialogFragmentBinding.inflate(getActivity().getLayoutInflater(), null, false);
+        binding.executePendingBindings();
+        alertDialogBuilder.setView(binding.getRoot());
+
+        alertDialogBuilder.setPositiveButton(R.string.set_exclusions, (dialog, which) -> setExclusionsAndDismiss());
+        alertDialogBuilder.setNegativeButton(R.string.cancel, (dialog, which) -> dialog.dismiss());
+        alertDialogBuilder.setNeutralButton(R.string.deselect_all, (dialog, which) -> {
+        });
+
+        binding.setFragment(this);
+        binding.setAppData(appData);
+
+        loadData();
+
+        final AlertDialog dialog = alertDialogBuilder.create();
+        dialog.setOnShowListener(d -> dialog.getButton(DialogInterface.BUTTON_NEUTRAL).setOnClickListener(view -> {
+            for (final ApplicationData app : appData)
+                app.setExcludedFromTunnel(false);
+        }));
+        return dialog;
+    }
+
+    void setExclusionsAndDismiss() {
+        final List<String> excludedApps = new ArrayList<>();
+        for (final ApplicationData data : appData) {
+            if (data.isExcludedFromTunnel()) {
+                excludedApps.add(data.getPackageName());
+            }
+        }
+
+        ((AppExclusionListener) getTargetFragment()).onExcludedAppsSelected(excludedApps);
+        dismiss();
+    }
+
+    public interface AppExclusionListener {
+        void onExcludedAppsSelected(List<String> excludedApps);
+    }
+
+}
@@ -1,17 +1,31 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.fragment;

 import android.content.Context;
-import android.support.v4.app.Fragment;
+import android.content.Intent;
+import androidx.databinding.DataBindingUtil;
+import androidx.databinding.ViewDataBinding;
+import androidx.annotation.Nullable;
+import com.google.android.material.snackbar.Snackbar;
+import androidx.fragment.app.Fragment;
+import android.util.Log;
+import android.view.View;
+import android.widget.Toast;

+import com.wireguard.android.Application;
+import com.wireguard.android.R;
 import com.wireguard.android.activity.BaseActivity;
 import com.wireguard.android.activity.BaseActivity.OnSelectedTunnelChangedListener;
+import com.wireguard.android.backend.GoBackend;
+import com.wireguard.android.databinding.TunnelDetailFragmentBinding;
+import com.wireguard.android.databinding.TunnelListItemBinding;
 import com.wireguard.android.model.Tunnel;
+import com.wireguard.android.model.Tunnel.State;
+import com.wireguard.android.util.ErrorMessages;

 /**
 * Base class for fragments that need to know the currently-selected tunnel. Only does anything when
@@ -19,12 +33,29 @@ import com.wireguard.android.model.Tunnel;
 */

 public abstract class BaseFragment extends Fragment implements OnSelectedTunnelChangedListener {
-    private BaseActivity activity;
+    private static final int REQUEST_CODE_VPN_PERMISSION = 23491;
+    private static final String TAG = "WireGuard/" + BaseFragment.class.getSimpleName();
+    @Nullable private BaseActivity activity;
+    @Nullable private Tunnel pendingTunnel;
+    @Nullable private Boolean pendingTunnelUp;

+    @Nullable
    protected Tunnel getSelectedTunnel() {
        return activity != null ? activity.getSelectedTunnel() : null;
    }

+    @Override
+    public void onActivityResult(final int requestCode, final int resultCode, @Nullable final Intent data) {
+        super.onActivityResult(requestCode, resultCode, data);
+
+        if (requestCode == REQUEST_CODE_VPN_PERMISSION) {
+            if (pendingTunnel != null && pendingTunnelUp != null)
+                setTunnelStateWithPermissionsResult(pendingTunnel, pendingTunnelUp);
+            pendingTunnel = null;
+            pendingTunnelUp = null;
+        }
+    }
+
    @Override
    public void onAttach(final Context context) {
        super.onAttach(context);
@@ -44,8 +75,52 @@ public abstract class BaseFragment extends Fragment implements OnSelectedTunnelC
        super.onDetach();
    }

-    protected void setSelectedTunnel(final Tunnel tunnel) {
+    protected void setSelectedTunnel(@Nullable final Tunnel tunnel) {
        if (activity != null)
            activity.setSelectedTunnel(tunnel);
    }
+
+    public void setTunnelState(final View view, final boolean checked) {
+        final ViewDataBinding binding = DataBindingUtil.findBinding(view);
+        final Tunnel tunnel;
+        if (binding instanceof TunnelDetailFragmentBinding)
+            tunnel = ((TunnelDetailFragmentBinding) binding).getTunnel();
+        else if (binding instanceof TunnelListItemBinding)
+            tunnel = ((TunnelListItemBinding) binding).getItem();
+        else
+            return;
+        if (tunnel == null)
+            return;
+
+        Application.getBackendAsync().thenAccept(backend -> {
+            if (backend instanceof GoBackend) {
+                final Intent intent = GoBackend.VpnService.prepare(view.getContext());
+                if (intent != null) {
+                    pendingTunnel = tunnel;
+                    pendingTunnelUp = checked;
+                    startActivityForResult(intent, REQUEST_CODE_VPN_PERMISSION);
+                    return;
+                }
+            }
+
+            setTunnelStateWithPermissionsResult(tunnel, checked);
+        });
+    }
+
+    private void setTunnelStateWithPermissionsResult(final Tunnel tunnel, final boolean checked) {
+        tunnel.setState(State.of(checked)).whenComplete((state, throwable) -> {
+            if (throwable == null)
+                return;
+            final String error = ErrorMessages.get(throwable);
+            final int messageResId = checked ? R.string.error_up : R.string.error_down;
+            final String message = getContext().getString(messageResId, error);
+            final View view = getView();
+            if (view != null)
+                Snackbar.make(view, message, Snackbar.LENGTH_LONG).show();
+            else
+                Toast.makeText(getContext(), message, Toast.LENGTH_LONG).show();
+            Log.e(TAG, message, throwable);
+        });
+    }
+
 }
@@ -0,0 +1,118 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.fragment;
+
+import android.app.Activity;
+import android.app.Dialog;
+import android.content.Context;
+import android.content.DialogInterface;
+import android.os.Bundle;
+import androidx.annotation.Nullable;
+import androidx.fragment.app.DialogFragment;
+import androidx.appcompat.app.AlertDialog;
+import android.view.inputmethod.InputMethodManager;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.R;
+import com.wireguard.android.databinding.ConfigNamingDialogFragmentBinding;
+import com.wireguard.config.BadConfigException;
+import com.wireguard.config.Config;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Objects;
+
+public class ConfigNamingDialogFragment extends DialogFragment {
+    private static final String KEY_CONFIG_TEXT = "config_text";
+
+    @Nullable private ConfigNamingDialogFragmentBinding binding;
+    @Nullable private Config config;
+    @Nullable private InputMethodManager imm;
+
+    public static ConfigNamingDialogFragment newInstance(final String configText) {
+        final Bundle extras = new Bundle();
+        extras.putString(KEY_CONFIG_TEXT, configText);
+        final ConfigNamingDialogFragment fragment = new ConfigNamingDialogFragment();
+        fragment.setArguments(extras);
+        return fragment;
+    }
+
+    private void createTunnelAndDismiss() {
+        if (binding != null) {
+            final String name = binding.tunnelNameText.getText().toString();
+
+            Application.getTunnelManager().create(name, config).whenComplete((tunnel, throwable) -> {
+                if (tunnel != null) {
+                    dismiss();
+                } else {
+                    binding.tunnelNameTextLayout.setError(throwable.getMessage());
+                }
+            });
+        }
+    }
+
+    @Override
+    public void dismiss() {
+        setKeyboardVisible(false);
+        super.dismiss();
+    }
+
+    @Override
+    public void onCreate(@Nullable final Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        final Bundle arguments = getArguments();
+        final String configText = arguments.getString(KEY_CONFIG_TEXT);
+        final byte[] configBytes = configText.getBytes(StandardCharsets.UTF_8);
+        try {
+            config = Config.parse(new ByteArrayInputStream(configBytes));
+        } catch (final BadConfigException | IOException e) {
+            throw new IllegalArgumentException("Invalid config passed to " + getClass().getSimpleName(), e);
+        }
+    }
+
+    @Override
+    public Dialog onCreateDialog(final Bundle savedInstanceState) {
+        final Activity activity = Objects.requireNonNull(getActivity());
+
+        imm = (InputMethodManager) activity.getSystemService(Context.INPUT_METHOD_SERVICE);
+
+        final AlertDialog.Builder alertDialogBuilder = new AlertDialog.Builder(activity);
+        alertDialogBuilder.setTitle(R.string.import_from_qr_code);
+
+        binding = ConfigNamingDialogFragmentBinding.inflate(activity.getLayoutInflater(), null, false);
+        binding.executePendingBindings();
+        alertDialogBuilder.setView(binding.getRoot());
+
+        alertDialogBuilder.setPositiveButton(R.string.create_tunnel, null);
+        alertDialogBuilder.setNegativeButton(R.string.cancel, (dialog, which) -> dismiss());
+
+        return alertDialogBuilder.create();
+    }
+
+    @Override public void onResume() {
+        super.onResume();
+
+        final AlertDialog dialog = (AlertDialog) getDialog();
+        if (dialog != null) {
+            dialog.getButton(DialogInterface.BUTTON_POSITIVE).setOnClickListener(v -> createTunnelAndDismiss());
+
+            setKeyboardVisible(true);
+        }
+    }
+
+    private void setKeyboardVisible(final boolean visible) {
+        Objects.requireNonNull(imm);
+
+        if (visible) {
+            imm.toggleSoftInput(InputMethodManager.SHOW_FORCED, 0);
+        } else if (binding != null) {
+            imm.hideSoftInputFromWindow(binding.tunnelNameText.getWindowToken(), 0);
+        }
+    }
+
+}
@@ -1,58 +0,0 @@
-/*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-package com.wireguard.android.fragment;
-
-import android.content.Context;
-import android.databinding.DataBindingUtil;
-import android.databinding.ViewDataBinding;
-import android.support.design.widget.Snackbar;
-import android.util.Log;
-import android.view.View;
-
-import com.wireguard.android.R;
-import com.wireguard.android.databinding.TunnelDetailFragmentBinding;
-import com.wireguard.android.databinding.TunnelListItemBinding;
-import com.wireguard.android.model.Tunnel;
-import com.wireguard.android.model.Tunnel.State;
-import com.wireguard.android.util.ExceptionLoggers;
-
-/**
- * Helper method shared by TunnelListFragment and TunnelDetailFragment.
- */
-
-public final class TunnelController {
-    private static final String TAG = "WireGuard/" + TunnelController.class.getSimpleName();
-
-    private TunnelController() {
-        // Prevent instantiation.
-    }
-
-    public static void setTunnelState(final View view, final boolean checked) {
-        final ViewDataBinding binding = DataBindingUtil.findBinding(view);
-        final Tunnel tunnel;
-        if (binding instanceof TunnelDetailFragmentBinding)
-            tunnel = ((TunnelDetailFragmentBinding) binding).getTunnel();
-        else if (binding instanceof TunnelListItemBinding)
-            tunnel = ((TunnelListItemBinding) binding).getItem();
-        else
-            tunnel = null;
-        if (tunnel == null) {
-            Log.e(TAG, "setChecked() from a null tunnel", new IllegalStateException("No tunnel"));
-            return;
-        }
-        tunnel.setState(State.of(checked)).whenComplete((state, throwable) -> {
-            if (throwable == null)
-                return;
-            final Context context = view.getContext();
-            final String error = ExceptionLoggers.unwrapMessage(throwable);
-            final int messageResId = checked ? R.string.error_up : R.string.error_down;
-            final String message = context.getString(messageResId, error);
-            Snackbar.make(view, message, Snackbar.LENGTH_LONG).show();
-            Log.e(TAG, message, throwable);
-        });
-    }
-}
@@ -1,13 +1,14 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.fragment;

 import android.os.Bundle;
-import android.support.annotation.NonNull;
+import androidx.annotation.Nullable;
+import androidx.databinding.DataBindingUtil;
+
 import android.view.LayoutInflater;
 import android.view.Menu;
 import android.view.MenuInflater;
@@ -16,22 +17,25 @@ import android.view.ViewGroup;

 import com.wireguard.android.R;
 import com.wireguard.android.databinding.TunnelDetailFragmentBinding;
+import com.wireguard.android.databinding.TunnelDetailPeerBinding;
 import com.wireguard.android.model.Tunnel;
-import com.wireguard.config.Config;
+import com.wireguard.android.model.Tunnel.State;
+import com.wireguard.crypto.Key;
+
+import java.util.Timer;
+import java.util.TimerTask;

 /**
 * Fragment that shows details about a specific tunnel.
 */

 public class TunnelDetailFragment extends BaseFragment {
-    private TunnelDetailFragmentBinding binding;
-
-    private void onConfigLoaded(final String name, final Config config) {
-        binding.setConfig(new Config.Observable(config, name));
-    }
+    @Nullable private TunnelDetailFragmentBinding binding;
+    @Nullable private Timer timer;
+    @Nullable private State lastState = State.TOGGLE;

    @Override
-    public void onCreate(final Bundle savedInstanceState) {
+    public void onCreate(@Nullable final Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setHasOptionsMenu(true);
    }
@@ -42,8 +46,29 @@ public class TunnelDetailFragment extends BaseFragment {
    }

    @Override
-    public View onCreateView(@NonNull final LayoutInflater inflater, final ViewGroup container,
-                             final Bundle savedInstanceState) {
+    public void onStop() {
+        super.onStop();
+        if (timer != null) {
+            timer.cancel();
+            timer = null;
+        }
+    }
+
+    @Override
+    public void onResume() {
+        super.onResume();
+        timer = new Timer();
+        timer.scheduleAtFixedRate(new TimerTask() {
+            @Override
+            public void run() {
+                updateStats();
+            }
+        }, 0, 1000);
+    }
+
+    @Override
+    public View onCreateView(final LayoutInflater inflater, @Nullable final ViewGroup container,
+                             @Nullable final Bundle savedInstanceState) {
        super.onCreateView(inflater, container, savedInstanceState);
        binding = TunnelDetailFragmentBinding.inflate(inflater, container, false);
        binding.executePendingBindings();
@@ -57,19 +82,78 @@ public class TunnelDetailFragment extends BaseFragment {
    }

    @Override
-    public void onSelectedTunnelChanged(final Tunnel oldTunnel, final Tunnel newTunnel) {
+    public void onSelectedTunnelChanged(@Nullable final Tunnel oldTunnel, @Nullable final Tunnel newTunnel) {
        if (binding == null)
            return;
        binding.setTunnel(newTunnel);
        if (newTunnel == null)
            binding.setConfig(null);
        else
-            newTunnel.getConfigAsync().thenAccept(a -> onConfigLoaded(newTunnel.getName(), a));
+            newTunnel.getConfigAsync().thenAccept(binding::setConfig);
+        lastState = State.TOGGLE;
+        updateStats();
    }

    @Override
-    public void onViewStateRestored(final Bundle savedInstanceState) {
+    public void onViewStateRestored(@Nullable final Bundle savedInstanceState) {
+        if (binding == null) {
+            return;
+        }
+
+        binding.setFragment(this);
        onSelectedTunnelChanged(null, getSelectedTunnel());
        super.onViewStateRestored(savedInstanceState);
    }
+
+    private String formatBytes(final long bytes) {
+        if (bytes < 1024)
+            return getContext().getString(R.string.transfer_bytes, bytes);
+        else if (bytes < 1024*1024)
+            return getContext().getString(R.string.transfer_kibibytes, bytes/1024.0);
+        else if (bytes < 1024*1024*1024)
+            return getContext().getString(R.string.transfer_mibibytes, bytes/(1024.0*1024.0));
+        else if (bytes < 1024*1024*1024*1024)
+            return getContext().getString(R.string.transfer_gibibytes, bytes/(1024.0*1024.0*1024.0));
+        return getContext().getString(R.string.transfer_tibibytes, bytes/(1024.0*1024.0*1024.0)/1024.0);
+    }
+
+    private void updateStats() {
+        if (binding == null || !isResumed())
+            return;
+        final Tunnel tunnel = binding.getTunnel();
+        if (tunnel == null)
+            return;
+        final State state = tunnel.getState();
+        if (state != State.UP && lastState == state)
+            return;
+        lastState = state;
+        tunnel.getStatisticsAsync().whenComplete((statistics, throwable) -> {
+            if (throwable != null) {
+                for (int i = 0; i < binding.peersLayout.getChildCount(); ++i) {
+                    final TunnelDetailPeerBinding peer = DataBindingUtil.getBinding(binding.peersLayout.getChildAt(i));
+                    if (peer == null)
+                        continue;
+                    peer.transferLabel.setVisibility(View.GONE);
+                    peer.transferText.setVisibility(View.GONE);
+                }
+                return;
+            }
+            for (int i = 0; i < binding.peersLayout.getChildCount(); ++i) {
+                final TunnelDetailPeerBinding peer = DataBindingUtil.getBinding(binding.peersLayout.getChildAt(i));
+                if (peer == null)
+                    continue;
+                final Key publicKey = peer.getItem().getPublicKey();
+                final long rx = statistics.peerRx(publicKey);
+                final long tx = statistics.peerTx(publicKey);
+                if (rx == 0 && tx == 0) {
+                    peer.transferLabel.setVisibility(View.GONE);
+                    peer.transferText.setVisibility(View.GONE);
+                    continue;
+                }
+                peer.transferText.setText(getContext().getString(R.string.transfer_rx_tx, formatBytes(rx), formatBytes(tx)));
+                peer.transferLabel.setVisibility(View.VISIBLE);
+                peer.transferText.setVisibility(View.VISIBLE);
+            }
+        });
+    }
 }
@@ -1,16 +1,17 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.fragment;

 import android.app.Activity;
 import android.content.Context;
+import androidx.databinding.ObservableList;
 import android.os.Bundle;
-import android.support.annotation.NonNull;
-import android.support.design.widget.Snackbar;
+import androidx.annotation.Nullable;
+import com.google.android.material.snackbar.Snackbar;
+import androidx.fragment.app.FragmentManager;
 import android.util.Log;
 import android.view.LayoutInflater;
 import android.view.Menu;
@@ -24,29 +25,37 @@ import android.widget.Toast;
 import com.wireguard.android.Application;
 import com.wireguard.android.R;
 import com.wireguard.android.databinding.TunnelEditorFragmentBinding;
+import com.wireguard.android.fragment.AppListDialogFragment.AppExclusionListener;
 import com.wireguard.android.model.Tunnel;
 import com.wireguard.android.model.TunnelManager;
-import com.wireguard.android.util.ExceptionLoggers;
+import com.wireguard.android.util.ErrorMessages;
+import com.wireguard.android.viewmodel.ConfigProxy;
 import com.wireguard.config.Config;

+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
 /**
 * Fragment for editing a WireGuard configuration.
 */

-public class TunnelEditorFragment extends BaseFragment {
+public class TunnelEditorFragment extends BaseFragment implements AppExclusionListener {
    private static final String KEY_LOCAL_CONFIG = "local_config";
    private static final String KEY_ORIGINAL_NAME = "original_name";
    private static final String TAG = "WireGuard/" + TunnelEditorFragment.class.getSimpleName();

-    private TunnelEditorFragmentBinding binding;
-    private Tunnel tunnel;
+    @Nullable private TunnelEditorFragmentBinding binding;
+    @Nullable private Tunnel tunnel;

-    private void onConfigLoaded(final String name, final Config config) {
-        binding.setConfig(new Config.Observable(config, name));
+    private void onConfigLoaded(final Config config) {
+        if (binding != null) {
+            binding.setConfig(new ConfigProxy(config));
+        }
    }

    private void onConfigSaved(final Tunnel savedTunnel,
-                               final Throwable throwable) {
+                               @Nullable final Throwable throwable) {
        final String message;
        if (throwable == null) {
            message = getString(R.string.config_save_success, savedTunnel.getName());
@@ -54,7 +63,7 @@ public class TunnelEditorFragment extends BaseFragment {
            Toast.makeText(getContext(), message, Toast.LENGTH_SHORT).show();
            onFinished();
        } else {
-            final String error = ExceptionLoggers.unwrapMessage(throwable);
+            final String error = ErrorMessages.get(throwable);
            message = getString(R.string.config_save_error, savedTunnel.getName(), error);
            Log.e(TAG, message, throwable);
            if (binding != null) {
@@ -64,7 +73,7 @@ public class TunnelEditorFragment extends BaseFragment {
    }

    @Override
-    public void onCreate(final Bundle savedInstanceState) {
+    public void onCreate(@Nullable final Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setHasOptionsMenu(true);
    }
@@ -75,8 +84,8 @@ public class TunnelEditorFragment extends BaseFragment {
    }

    @Override
-    public View onCreateView(@NonNull final LayoutInflater inflater, final ViewGroup container,
-                             final Bundle savedInstanceState) {
+    public View onCreateView(final LayoutInflater inflater, @Nullable final ViewGroup container,
+                             @Nullable final Bundle savedInstanceState) {
        super.onCreateView(inflater, container, savedInstanceState);
        binding = TunnelEditorFragmentBinding.inflate(inflater, container, false);
        binding.executePendingBindings();
@@ -89,6 +98,15 @@ public class TunnelEditorFragment extends BaseFragment {
        super.onDestroyView();
    }

+    @Override
+    public void onExcludedAppsSelected(final List<String> excludedApps) {
+        Objects.requireNonNull(binding, "Tried to set excluded apps while no view was loaded");
+        final ObservableList<String> excludedApplications =
+                binding.getConfig().getInterface().getExcludedApplications();
+        excludedApplications.clear();
+        excludedApplications.addAll(excludedApps);
+    }
+
    private void onFinished() {
        // Hide the keyboard; it rarely goes away on its own.
        final Activity activity = getActivity();
@@ -103,6 +121,7 @@ public class TunnelEditorFragment extends BaseFragment {
        }
        // Tell the activity to finish itself or go back to the detail view.
        getActivity().runOnUiThread(() -> {
+            // TODO(smaeul): Remove this hack when fixing the Config ViewModel
            // The selected tunnel has to actually change, but we have to remember this one.
            final Tunnel savedTunnel = tunnel;
            if (savedTunnel == getSelectedTunnel())
@@ -115,25 +134,27 @@ public class TunnelEditorFragment extends BaseFragment {
    public boolean onOptionsItemSelected(final MenuItem item) {
        switch (item.getItemId()) {
            case R.id.menu_action_save:
-                final Config newConfig = new Config();
+                if (binding == null)
+                    return false;
+                final Config newConfig;
                try {
-                    binding.getConfig().commitData(newConfig);
+                    newConfig = binding.getConfig().resolve();
                } catch (final Exception e) {
-                    final String error = ExceptionLoggers.unwrapMessage(e);
-                    final String tunnelName = tunnel == null ? binding.getConfig().getName() : tunnel.getName();
+                    final String error = ErrorMessages.get(e);
+                    final String tunnelName = tunnel == null ? binding.getName() : tunnel.getName();
                    final String message = getString(R.string.config_save_error, tunnelName, error);
                    Log.e(TAG, message, e);
                    Snackbar.make(binding.mainContainer, error, Snackbar.LENGTH_LONG).show();
                    return false;
                }
                if (tunnel == null) {
-                    Log.d(TAG, "Attempting to create new tunnel " + binding.getConfig().getName());
-                    final TunnelManager manager = Application.getComponent().getTunnelManager();
-                    manager.create(binding.getConfig().getName(), newConfig)
+                    Log.d(TAG, "Attempting to create new tunnel " + binding.getName());
+                    final TunnelManager manager = Application.getTunnelManager();
+                    manager.create(binding.getName(), newConfig)
                            .whenComplete(this::onTunnelCreated);
-                } else if (!tunnel.getName().equals(binding.getConfig().getName())) {
-                    Log.d(TAG, "Attempting to rename tunnel to " + binding.getConfig().getName());
-                    tunnel.setName(binding.getConfig().getName())
+                } else if (!tunnel.getName().equals(binding.getName())) {
+                    Log.d(TAG, "Attempting to rename tunnel to " + binding.getName());
+                    tunnel.setName(binding.getName())
                            .whenComplete((a, b) -> onTunnelRenamed(tunnel, newConfig, b));
                } else {
                    Log.d(TAG, "Attempting to save config of " + tunnel.getName());
@@ -146,24 +167,39 @@ public class TunnelEditorFragment extends BaseFragment {
        }
    }

+    public void onRequestSetExcludedApplications(@SuppressWarnings("unused") final View view) {
+        final FragmentManager fragmentManager = getFragmentManager();
+        if (fragmentManager != null && binding != null) {
+            final ArrayList<String> excludedApps = new ArrayList<>(binding.getConfig().getInterface().getExcludedApplications());
+            final AppListDialogFragment fragment = AppListDialogFragment.newInstance(excludedApps, this);
+            fragment.show(fragmentManager, null);
+        }
+    }
+
    @Override
-    public void onSaveInstanceState(@NonNull final Bundle outState) {
-        outState.putParcelable(KEY_LOCAL_CONFIG, binding.getConfig());
+    public void onSaveInstanceState(final Bundle outState) {
+        if (binding != null)
+            outState.putParcelable(KEY_LOCAL_CONFIG, binding.getConfig());
        outState.putString(KEY_ORIGINAL_NAME, tunnel == null ? null : tunnel.getName());
        super.onSaveInstanceState(outState);
    }

    @Override
-    public void onSelectedTunnelChanged(final Tunnel oldTunnel, final Tunnel newTunnel) {
+    public void onSelectedTunnelChanged(@Nullable final Tunnel oldTunnel,
+                                        @Nullable final Tunnel newTunnel) {
        tunnel = newTunnel;
        if (binding == null)
            return;
-        binding.setConfig(new Config.Observable(null, null));
-        if (tunnel != null)
-            tunnel.getConfigAsync().thenAccept(a -> onConfigLoaded(tunnel.getName(), a));
+        binding.setConfig(new ConfigProxy());
+        if (tunnel != null) {
+            binding.setName(tunnel.getName());
+            tunnel.getConfigAsync().thenAccept(this::onConfigLoaded);
+        } else {
+            binding.setName("");
+        }
    }

-    private void onTunnelCreated(final Tunnel newTunnel, final Throwable throwable) {
+    private void onTunnelCreated(final Tunnel newTunnel, @Nullable final Throwable throwable) {
        final String message;
        if (throwable == null) {
            tunnel = newTunnel;
@@ -172,7 +208,7 @@ public class TunnelEditorFragment extends BaseFragment {
            Toast.makeText(getContext(), message, Toast.LENGTH_SHORT).show();
            onFinished();
        } else {
-            final String error = ExceptionLoggers.unwrapMessage(throwable);
+            final String error = ErrorMessages.get(throwable);
            message = getString(R.string.tunnel_create_error, error);
            Log.e(TAG, message, throwable);
            if (binding != null) {
@@ -182,7 +218,7 @@ public class TunnelEditorFragment extends BaseFragment {
    }

    private void onTunnelRenamed(final Tunnel renamedTunnel, final Config newConfig,
-                                 final Throwable throwable) {
+                                 @Nullable final Throwable throwable) {
        final String message;
        if (throwable == null) {
            message = getString(R.string.tunnel_rename_success, renamedTunnel.getName());
@@ -191,7 +227,7 @@ public class TunnelEditorFragment extends BaseFragment {
            Log.d(TAG, "Attempting to save config of renamed tunnel " + tunnel.getName());
            renamedTunnel.setConfig(newConfig).whenComplete((a, b) -> onConfigSaved(renamedTunnel, b));
        } else {
-            final String error = ExceptionLoggers.unwrapMessage(throwable);
+            final String error = ErrorMessages.get(throwable);
            message = getString(R.string.tunnel_rename_error, error);
            Log.e(TAG, message, throwable);
            if (binding != null) {
@@ -201,12 +237,18 @@ public class TunnelEditorFragment extends BaseFragment {
    }

    @Override
-    public void onViewStateRestored(final Bundle savedInstanceState) {
+    public void onViewStateRestored(@Nullable final Bundle savedInstanceState) {
+        if (binding == null) {
+            return;
+        }
+
+        binding.setFragment(this);
+
        if (savedInstanceState == null) {
            onSelectedTunnelChanged(null, getSelectedTunnel());
        } else {
            tunnel = getSelectedTunnel();
-            final Config.Observable config = savedInstanceState.getParcelable(KEY_LOCAL_CONFIG);
+            final ConfigProxy config = savedInstanceState.getParcelable(KEY_LOCAL_CONFIG);
            final String originalName = savedInstanceState.getString(KEY_ORIGINAL_NAME);
            if (tunnel != null && !tunnel.getName().equals(originalName))
                onSelectedTunnelChanged(null, tunnel);
@@ -216,4 +258,5 @@ public class TunnelEditorFragment extends BaseFragment {

        super.onViewStateRestored(savedInstanceState);
    }
+
 }
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.fragment;
@@ -15,48 +14,50 @@ import android.database.Cursor;
 import android.net.Uri;
 import android.os.Bundle;
 import android.provider.OpenableColumns;
-import android.support.annotation.NonNull;
-import android.support.design.widget.Snackbar;
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+import com.google.android.material.snackbar.Snackbar;
+import androidx.fragment.app.FragmentManager;
+import androidx.appcompat.app.AppCompatActivity;
+import androidx.appcompat.view.ActionMode;
+import androidx.recyclerview.widget.RecyclerView;
 import android.util.Log;
-import android.util.SparseBooleanArray;
-import android.view.ActionMode;
 import android.view.LayoutInflater;
 import android.view.Menu;
 import android.view.MenuItem;
-import android.view.MotionEvent;
 import android.view.View;
-import android.view.View.OnTouchListener;
 import android.view.ViewGroup;
-import android.widget.AbsListView;
-import android.widget.AbsListView.MultiChoiceModeListener;
-import android.widget.AdapterView;
-import android.widget.AdapterView.OnItemClickListener;
-import android.widget.AdapterView.OnItemLongClickListener;

+import com.google.zxing.integration.android.IntentIntegrator;
+import com.google.zxing.integration.android.IntentResult;
 import com.wireguard.android.Application;
-import com.wireguard.android.Application.ApplicationComponent;
 import com.wireguard.android.R;
 import com.wireguard.android.activity.TunnelCreatorActivity;
+import com.wireguard.android.databinding.ObservableKeyedRecyclerViewAdapter;
 import com.wireguard.android.databinding.TunnelListFragmentBinding;
+import com.wireguard.android.databinding.TunnelListItemBinding;
 import com.wireguard.android.model.Tunnel;
-import com.wireguard.android.model.TunnelManager;
-import com.wireguard.android.util.AsyncWorker;
-import com.wireguard.android.util.ExceptionLoggers;
+import com.wireguard.android.util.ErrorMessages;
+import com.wireguard.android.widget.MultiselectableRelativeLayout;
+import com.wireguard.android.widget.fab.FloatingActionsMenuRecyclerViewScrollListener;
+import com.wireguard.config.BadConfigException;
 import com.wireguard.config.Config;

 import java.io.BufferedReader;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.InputStreamReader;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Locale;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;

 import java9.util.concurrent.CompletableFuture;
-import java9.util.stream.Collectors;
-import java9.util.stream.IntStream;
 import java9.util.stream.StreamSupport;

 /**
@@ -67,30 +68,41 @@ public class TunnelListFragment extends BaseFragment {
    private static final int REQUEST_IMPORT = 1;
    private static final String TAG = "WireGuard/" + TunnelListFragment.class.getSimpleName();

-    private final MultiChoiceModeListener actionModeListener = new ActionModeListener();
-    private final ListViewCallbacks listViewCallbacks = new ListViewCallbacks();
-    private ActionMode actionMode;
-    private AsyncWorker asyncWorker;
-    private TunnelListFragmentBinding binding;
-    private TunnelManager tunnelManager;
+    private final ActionModeListener actionModeListener = new ActionModeListener();
+    @Nullable private ActionMode actionMode;
+    @Nullable private TunnelListFragmentBinding binding;

    public boolean collapseActionMenu() {
-        if (binding.createMenu.isExpanded()) {
+        if (binding != null && binding.createMenu.isExpanded()) {
            binding.createMenu.collapse();
            return true;
        }
        return false;
    }

-    private void importTunnel(final Uri uri) {
+    private void importTunnel(@NonNull final String configText) {
+        try {
+            // Ensure the config text is parseable before proceeding…
+            Config.parse(new ByteArrayInputStream(configText.getBytes(StandardCharsets.UTF_8)));
+
+            // Config text is valid, now create the tunnel…
+            final FragmentManager fragmentManager = getFragmentManager();
+            if (fragmentManager != null)
+                ConfigNamingDialogFragment.newInstance(configText).show(fragmentManager, null);
+        } catch (final BadConfigException | IOException e) {
+            onTunnelImportFinished(Collections.emptyList(), Collections.singletonList(e));
+        }
+    }
+
+    private void importTunnel(@Nullable final Uri uri) {
        final Activity activity = getActivity();
-        if (activity == null)
+        if (activity == null || uri == null)
            return;
        final ContentResolver contentResolver = activity.getContentResolver();

        final Collection<CompletableFuture<Tunnel>> futureTunnels = new ArrayList<>();
        final List<Throwable> throwables = new ArrayList<>();
-        asyncWorker.supplyAsync(() -> {
+        Application.getAsyncWorker().supplyAsync(() -> {
            final String[] columns = {OpenableColumns.DISPLAY_NAME};
            String name = null;
            try (Cursor cursor = contentResolver.query(uri, columns,
@@ -103,18 +115,18 @@ public class TunnelListFragment extends BaseFragment {
            int idx = name.lastIndexOf('/');
            if (idx >= 0) {
                if (idx >= name.length() - 1)
-                    throw new IllegalArgumentException("Illegal file name: " + name);
+                    throw new IllegalArgumentException(getResources().getString(R.string.illegal_filename_error, name));
                name = name.substring(idx + 1);
            }
-            boolean isZip = name.toLowerCase().endsWith(".zip");
-            if (name.toLowerCase().endsWith(".conf"))
+            boolean isZip = name.toLowerCase(Locale.ENGLISH).endsWith(".zip");
+            if (name.toLowerCase(Locale.ENGLISH).endsWith(".conf"))
                name = name.substring(0, name.length() - ".conf".length());
            else if (!isZip)
-                throw new IllegalArgumentException("File must be .conf or .zip");
+                throw new IllegalArgumentException(getResources().getString(R.string.bad_extension_error));

            if (isZip) {
-                try (ZipInputStream zip = new ZipInputStream(contentResolver.openInputStream(uri))) {
-                    BufferedReader reader = new BufferedReader(new InputStreamReader(zip, StandardCharsets.UTF_8));
+                try (ZipInputStream zip = new ZipInputStream(contentResolver.openInputStream(uri));
+                     BufferedReader reader = new BufferedReader(new InputStreamReader(zip))) {
                    ZipEntry entry;
                    while ((entry = zip.getNextEntry()) != null) {
                        if (entry.isDirectory())
@@ -126,30 +138,30 @@ public class TunnelListFragment extends BaseFragment {
                                continue;
                            name = name.substring(name.lastIndexOf('/') + 1);
                        }
-                        if (name.toLowerCase().endsWith(".conf"))
+                        if (name.toLowerCase(Locale.ENGLISH).endsWith(".conf"))
                            name = name.substring(0, name.length() - ".conf".length());
                        else
                            continue;
                        Config config = null;
                        try {
-                            config = Config.from(reader);
+                            config = Config.parse(reader);
                        } catch (Exception e) {
                            throwables.add(e);
                        }
                        if (config != null)
-                            futureTunnels.add(tunnelManager.create(name, config).toCompletableFuture());
+                            futureTunnels.add(Application.getTunnelManager().create(name, config).toCompletableFuture());
                    }
                }
            } else {
-                futureTunnels.add(tunnelManager.create(name,
-                        Config.from(contentResolver.openInputStream(uri))).toCompletableFuture());
+                futureTunnels.add(Application.getTunnelManager().create(name,
+                        Config.parse(contentResolver.openInputStream(uri))).toCompletableFuture());
            }

            if (futureTunnels.isEmpty()) {
                if (throwables.size() == 1)
                    throw throwables.get(0);
                else if (throwables.isEmpty())
-                    throw new IllegalArgumentException("No configurations found");
+                    throw new IllegalArgumentException(getResources().getString(R.string.no_configs_error));
            }

            return CompletableFuture.allOf(futureTunnels.toArray(new CompletableFuture[futureTunnels.size()]));
@@ -176,34 +188,51 @@ public class TunnelListFragment extends BaseFragment {
    }

    @Override
-    public void onActivityResult(final int requestCode, final int resultCode, final Intent data) {
+    public void onActivityCreated(@Nullable final Bundle savedInstanceState) {
+        super.onActivityCreated(savedInstanceState);
+
+        if (savedInstanceState != null) {
+            final Collection<Integer> checkedItems = savedInstanceState.getIntegerArrayList("CHECKED_ITEMS");
+            if (checkedItems != null) {
+                for (final Integer i : checkedItems)
+                    actionModeListener.setItemChecked(i, true);
+            }
+        }
+    }
+
+    @Override
+    public void onActivityResult(final int requestCode, final int resultCode, @Nullable final Intent data) {
        switch (requestCode) {
            case REQUEST_IMPORT:
-                if (resultCode == Activity.RESULT_OK)
+                if (resultCode == Activity.RESULT_OK && data != null)
                    importTunnel(data.getData());
                return;
+            case IntentIntegrator.REQUEST_CODE:
+                final IntentResult result = IntentIntegrator.parseActivityResult(requestCode, resultCode, data);
+                if (result != null && result.getContents() != null) {
+                    importTunnel(result.getContents());
+                }
+                return;
            default:
                super.onActivityResult(requestCode, resultCode, data);
        }
    }

+    @SuppressWarnings("deprecation")
+    @SuppressLint("ClickableViewAccessibility")
    @Override
-    public void onCreate(final Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        final ApplicationComponent applicationComponent = Application.getComponent();
-        asyncWorker = applicationComponent.getAsyncWorker();
-        tunnelManager = applicationComponent.getTunnelManager();
-    }
-
-    @Override
-    public View onCreateView(@NonNull final LayoutInflater inflater, final ViewGroup container,
-                             final Bundle savedInstanceState) {
+    public View onCreateView(@NonNull final LayoutInflater inflater, @Nullable final ViewGroup container,
+                             @Nullable final Bundle savedInstanceState) {
        super.onCreateView(inflater, container, savedInstanceState);
        binding = TunnelListFragmentBinding.inflate(inflater, container, false);
-        binding.tunnelList.setMultiChoiceModeListener(actionModeListener);
-        binding.tunnelList.setOnItemClickListener(listViewCallbacks);
-        binding.tunnelList.setOnItemLongClickListener(listViewCallbacks);
-        binding.tunnelList.setOnTouchListener(listViewCallbacks);
+
+        binding.tunnelList.setOnTouchListener((view, motionEvent) -> {
+            if (binding != null) {
+                binding.createMenu.collapse();
+            }
+            return false;
+        });
+        binding.tunnelList.setOnScrollListener(new FloatingActionsMenuRecyclerViewScrollListener(binding.createMenu));
        binding.executePendingBindings();
        return binding.getRoot();
    }
@@ -214,6 +243,14 @@ public class TunnelListFragment extends BaseFragment {
        super.onDestroyView();
    }

+    @Override
+    public void onPause() {
+        if (binding != null) {
+            binding.createMenu.collapse();
+        }
+        super.onPause();
+    }
+
    public void onRequestCreateConfig(@SuppressWarnings("unused") final View view) {
        startActivity(new Intent(getActivity(), TunnelCreatorActivity.class));
        if (binding != null)
@@ -229,17 +266,42 @@ public class TunnelListFragment extends BaseFragment {
            binding.createMenu.collapse();
    }

-    @Override
-    public void onSelectedTunnelChanged(final Tunnel oldTunnel, final Tunnel newTunnel) {
-        // Do nothing.
+    public void onRequestScanQRCode(@SuppressWarnings("unused") final View view) {
+        final IntentIntegrator intentIntegrator = IntentIntegrator.forSupportFragment(this);
+        intentIntegrator.setOrientationLocked(false);
+        intentIntegrator.setBeepEnabled(false);
+        intentIntegrator.setPrompt(getString(R.string.qr_code_hint));
+        intentIntegrator.initiateScan(Collections.singletonList(IntentIntegrator.QR_CODE));
+
+        if (binding != null)
+            binding.createMenu.collapse();
    }

-    private void onTunnelDeletionFinished(final Integer count, final Throwable throwable) {
+    @Override
+    public void onSaveInstanceState(final Bundle outState) {
+        super.onSaveInstanceState(outState);
+
+        outState.putIntegerArrayList("CHECKED_ITEMS", actionModeListener.getCheckedItems());
+    }
+
+    @Override
+    public void onSelectedTunnelChanged(@Nullable final Tunnel oldTunnel, @Nullable final Tunnel newTunnel) {
+        if (binding == null)
+            return;
+        Application.getTunnelManager().getTunnels().thenAccept(tunnels -> {
+            if (newTunnel != null)
+                viewForTunnel(newTunnel, tunnels).setSingleSelected(true);
+            if (oldTunnel != null)
+                viewForTunnel(oldTunnel, tunnels).setSingleSelected(false);
+        });
+    }
+
+    private void onTunnelDeletionFinished(final Integer count, @Nullable final Throwable throwable) {
        final String message;
        if (throwable == null) {
            message = getResources().getQuantityString(R.plurals.delete_success, count, count);
        } else {
-            final String error = ExceptionLoggers.unwrapMessage(throwable);
+            final String error = ErrorMessages.get(throwable);
            message = getResources().getQuantityString(R.plurals.delete_error, count, count, error);
            Log.e(TAG, message, throwable);
        }
@@ -252,7 +314,7 @@ public class TunnelListFragment extends BaseFragment {
        String message = null;

        for (final Throwable throwable : throwables) {
-            final String error = ExceptionLoggers.unwrapMessage(throwable);
+            final String error = ErrorMessages.get(throwable);
            message = getString(R.string.import_error, error);
            Log.e(TAG, message, throwable);
        }
@@ -269,45 +331,82 @@ public class TunnelListFragment extends BaseFragment {
                    tunnels.size() + throwables.size(),
                    tunnels.size(), tunnels.size() + throwables.size());

-        if (binding != null) {
+        if (binding != null)
            Snackbar.make(binding.mainContainer, message, Snackbar.LENGTH_LONG).show();
-        }
    }

    @Override
-    public void onViewStateRestored(final Bundle savedInstanceState) {
+    public void onViewStateRestored(@Nullable final Bundle savedInstanceState) {
        super.onViewStateRestored(savedInstanceState);
+
+        if (binding == null) {
+            return;
+        }
+
        binding.setFragment(this);
-        binding.setTunnels(tunnelManager.getTunnels());
+        Application.getTunnelManager().getTunnels().thenAccept(binding::setTunnels);
+        binding.setRowConfigurationHandler((ObservableKeyedRecyclerViewAdapter.RowConfigurationHandler<TunnelListItemBinding, Tunnel>) (binding, tunnel, position) -> {
+            binding.setFragment(this);
+            binding.getRoot().setOnClickListener(clicked -> {
+                if (actionMode == null) {
+                    setSelectedTunnel(tunnel);
+                } else {
+                    actionModeListener.toggleItemChecked(position);
+                }
+            });
+            binding.getRoot().setOnLongClickListener(clicked -> {
+                actionModeListener.toggleItemChecked(position);
+                return true;
+            });
+
+            if (actionMode != null)
+                ((MultiselectableRelativeLayout) binding.getRoot()).setMultiSelected(actionModeListener.checkedItems.contains(position));
+            else
+                ((MultiselectableRelativeLayout) binding.getRoot()).setSingleSelected(getSelectedTunnel() == tunnel);
+        });
    }

-    private final class ActionModeListener implements MultiChoiceModeListener {
-        private Resources resources;
-        private AbsListView tunnelList;
+    private MultiselectableRelativeLayout viewForTunnel(final Tunnel tunnel, final List tunnels) {
+        return (MultiselectableRelativeLayout) binding.tunnelList.findViewHolderForAdapterPosition(tunnels.indexOf(tunnel)).itemView;
+    }

-        private IntStream getCheckedPositions() {
-            final SparseBooleanArray checkedItemPositions = tunnelList.getCheckedItemPositions();
-            return IntStream.range(0, checkedItemPositions.size())
-                    .filter(checkedItemPositions::valueAt)
-                    .map(checkedItemPositions::keyAt);
+    private final class ActionModeListener implements ActionMode.Callback {
+        private final Collection<Integer> checkedItems = new HashSet<>();
+
+        @Nullable private Resources resources;
+
+        public ArrayList<Integer> getCheckedItems() {
+            return new ArrayList<>(checkedItems);
        }

        @Override
        public boolean onActionItemClicked(final ActionMode mode, final MenuItem item) {
            switch (item.getItemId()) {
                case R.id.menu_action_delete:
-                    // Must operate in two steps: positions change once we start deleting things.
-                    final List<Tunnel> tunnelsToDelete = getCheckedPositions()
-                            .mapToObj(pos -> (Tunnel) tunnelList.getItemAtPosition(pos))
-                            .collect(Collectors.toList());
-                    final CompletableFuture[] futures = StreamSupport.stream(tunnelsToDelete)
-                            .map(Tunnel::delete)
-                            .toArray(CompletableFuture[]::new);
-                    CompletableFuture.allOf(futures)
-                            .thenApply(x -> futures.length)
-                            .whenComplete(TunnelListFragment.this::onTunnelDeletionFinished);
+                    final Iterable<Integer> copyCheckedItems = new HashSet<>(checkedItems);
+                    Application.getTunnelManager().getTunnels().thenAccept(tunnels -> {
+                        final Collection<Tunnel> tunnelsToDelete = new ArrayList<>();
+                        for (final Integer position : copyCheckedItems)
+                            tunnelsToDelete.add(tunnels.get(position));
+
+                        final CompletableFuture[] futures = StreamSupport.stream(tunnelsToDelete)
+                                .map(Tunnel::delete)
+                                .toArray(CompletableFuture[]::new);
+                        CompletableFuture.allOf(futures)
+                                .thenApply(x -> futures.length)
+                                .whenComplete(TunnelListFragment.this::onTunnelDeletionFinished);
+
+                    });
+                    checkedItems.clear();
                    mode.finish();
                    return true;
+                case R.id.menu_action_select_all:
+                    Application.getTunnelManager().getTunnels().thenAccept(tunnels -> {
+                        for (int i = 0; i < tunnels.size(); ++i) {
+                            setItemChecked(i, true);
+                        }
+                    });
+                    return true;
                default:
                    return false;
            }
@@ -316,10 +415,11 @@ public class TunnelListFragment extends BaseFragment {
        @Override
        public boolean onCreateActionMode(final ActionMode mode, final Menu menu) {
            actionMode = mode;
-            if (getActivity() != null)
+            if (getActivity() != null) {
                resources = getActivity().getResources();
-            tunnelList = binding.tunnelList;
+            }
            mode.getMenuInflater().inflate(R.menu.tunnel_list_action_mode, menu);
+            binding.tunnelList.getAdapter().notifyDataSetChanged();
            return true;
        }

@@ -327,12 +427,8 @@ public class TunnelListFragment extends BaseFragment {
        public void onDestroyActionMode(final ActionMode mode) {
            actionMode = null;
            resources = null;
-        }
-
-        @Override
-        public void onItemCheckedStateChanged(final ActionMode mode, final int position,
-                                              final long id, final boolean checked) {
-            updateTitle(mode);
+            checkedItems.clear();
+            binding.tunnelList.getAdapter().notifyDataSetChanged();
        }

        @Override
@@ -341,36 +437,43 @@ public class TunnelListFragment extends BaseFragment {
            return false;
        }

-        private void updateTitle(final ActionMode mode) {
-            final int count = (int) getCheckedPositions().count();
-            mode.setTitle(resources.getQuantityString(R.plurals.delete_title, count, count));
+        void setItemChecked(final int position, final boolean checked) {
+            if (checked) {
+                checkedItems.add(position);
+            } else {
+                checkedItems.remove(position);
+            }
+
+            final RecyclerView.Adapter adapter = binding == null ? null : binding.tunnelList.getAdapter();
+
+            if (actionMode == null && !checkedItems.isEmpty() && getActivity() != null) {
+                ((AppCompatActivity) getActivity()).startSupportActionMode(this);
+            } else if (actionMode != null && checkedItems.isEmpty()) {
+                actionMode.finish();
+            }
+
+            if (adapter != null)
+                adapter.notifyItemChanged(position);
+
+            updateTitle(actionMode);
+        }
+
+        void toggleItemChecked(final int position) {
+            setItemChecked(position, !checkedItems.contains(position));
+        }
+
+        private void updateTitle(@Nullable final ActionMode mode) {
+            if (mode == null) {
+                return;
+            }
+
+            final int count = checkedItems.size();
+            if (count == 0) {
+                mode.setTitle("");
+            } else {
+                mode.setTitle(resources.getQuantityString(R.plurals.delete_title, count, count));
+            }
        }
    }

-    private final class ListViewCallbacks
-            implements OnItemClickListener, OnItemLongClickListener, OnTouchListener {
-        @Override
-        public void onItemClick(final AdapterView<?> parent, final View view,
-                                final int position, final long id) {
-            setSelectedTunnel((Tunnel) parent.getItemAtPosition(position));
-        }
-
-        @Override
-        public boolean onItemLongClick(final AdapterView<?> parent, final View view,
-                                       final int position, final long id) {
-            if (actionMode != null)
-                return false;
-            if (binding != null)
-                binding.tunnelList.setItemChecked(position, true);
-            return true;
-        }
-
-        @Override
-        @SuppressLint("ClickableViewAccessibility")
-        public boolean onTouch(final View view, final MotionEvent motionEvent) {
-            if (binding != null)
-                binding.createMenu.collapse();
-            return false;
-        }
-    }
 }
@@ -0,0 +1,54 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.model;
+
+import androidx.databinding.BaseObservable;
+import androidx.databinding.Bindable;
+import android.graphics.drawable.Drawable;
+
+import com.wireguard.android.BR;
+import com.wireguard.util.Keyed;
+
+public class ApplicationData extends BaseObservable implements Keyed<String> {
+    private final Drawable icon;
+    private final String name;
+    private final String packageName;
+    private boolean excludedFromTunnel;
+
+    public ApplicationData(final Drawable icon, final String name, final String packageName, final boolean excludedFromTunnel) {
+        this.icon = icon;
+        this.name = name;
+        this.packageName = packageName;
+        this.excludedFromTunnel = excludedFromTunnel;
+    }
+
+    public Drawable getIcon() {
+        return icon;
+    }
+
+    @Override
+    public String getKey() {
+        return name;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public String getPackageName() {
+        return packageName;
+    }
+
+    @Bindable
+    public boolean isExcludedFromTunnel() {
+        return excludedFromTunnel;
+    }
+
+    public void setExcludedFromTunnel(final boolean excludedFromTunnel) {
+        this.excludedFromTunnel = excludedFromTunnel;
+        notifyPropertyChanged(BR.excludedFromTunnel);
+    }
+}
@@ -1,21 +1,25 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.model;

-import android.databinding.BaseObservable;
-import android.databinding.Bindable;
-import android.support.annotation.NonNull;
-import android.support.annotation.Nullable;
+import android.os.SystemClock;
+import android.util.Pair;
+
+import androidx.databinding.BaseObservable;
+import androidx.databinding.Bindable;
+import androidx.annotation.Nullable;

 import com.wireguard.android.BR;
 import com.wireguard.android.util.ExceptionLoggers;
-import com.wireguard.android.util.Keyed;
 import com.wireguard.config.Config;
+import com.wireguard.crypto.Key;
+import com.wireguard.util.Keyed;

+import java.util.HashMap;
+import java.util.Map;
 import java.util.regex.Pattern;

 import java9.util.concurrent.CompletableFuture;
@@ -30,20 +34,20 @@ public class Tunnel extends BaseObservable implements Keyed<String> {
    private static final Pattern NAME_PATTERN = Pattern.compile("[a-zA-Z0-9_=+.-]{1,15}");

    private final TunnelManager manager;
-    private Config config;
+    @Nullable private Config config;
    private String name;
    private State state;
-    private Statistics statistics;
+    @Nullable private Statistics statistics;

-    Tunnel(@NonNull final TunnelManager manager, @NonNull final String name,
-           @Nullable final Config config, @NonNull final State state) {
+    Tunnel(final TunnelManager manager, final String name,
+           @Nullable final Config config, final State state) {
        this.manager = manager;
        this.name = name;
        this.config = config;
        this.state = state;
    }

-    public static boolean isNameInvalid(@NonNull final CharSequence name) {
+    public static boolean isNameInvalid(final CharSequence name) {
        return !NAME_PATTERN.matcher(name).matches();
    }

@@ -52,6 +56,7 @@ public class Tunnel extends BaseObservable implements Keyed<String> {
    }

    @Bindable
+    @Nullable
    public Config getConfig() {
        if (config == null)
            manager.getTunnelConfig(this).whenComplete(ExceptionLoggers.E);
@@ -80,21 +85,20 @@ public class Tunnel extends BaseObservable implements Keyed<String> {
    }

    public CompletionStage<State> getStateAsync() {
-        return manager.getTunnelState(this);
+        return TunnelManager.getTunnelState(this);
    }

    @Bindable
+    @Nullable
    public Statistics getStatistics() {
-        // FIXME: Check age of statistics.
-        if (statistics == null)
-            manager.getTunnelStatistics(this).whenComplete(ExceptionLoggers.E);
+        if (statistics == null || statistics.isStale())
+            TunnelManager.getTunnelStatistics(this).whenComplete(ExceptionLoggers.E);
        return statistics;
    }

    public CompletionStage<Statistics> getStatisticsAsync() {
-        // FIXME: Check age of statistics.
-        if (statistics == null)
-            return manager.getTunnelStatistics(this);
+        if (statistics == null || statistics.isStale())
+            return TunnelManager.getTunnelStatistics(this);
        return CompletableFuture.completedFuture(statistics);
    }

@@ -118,25 +122,26 @@ public class Tunnel extends BaseObservable implements Keyed<String> {
        return state;
    }

-    Statistics onStatisticsChanged(final Statistics statistics) {
+    @Nullable
+    Statistics onStatisticsChanged(@Nullable final Statistics statistics) {
        this.statistics = statistics;
        notifyPropertyChanged(BR.statistics);
        return statistics;
    }

-    public CompletionStage<Config> setConfig(@NonNull final Config config) {
+    public CompletionStage<Config> setConfig(final Config config) {
        if (!config.equals(this.config))
            return manager.setTunnelConfig(this, config);
        return CompletableFuture.completedFuture(this.config);
    }

-    public CompletionStage<String> setName(@NonNull final String name) {
+    public CompletionStage<String> setName(final String name) {
        if (!name.equals(this.name))
            return manager.setTunnelName(this, name);
        return CompletableFuture.completedFuture(this.name);
    }

-    public CompletionStage<State> setState(@NonNull final State state) {
+    public CompletionStage<State> setState(final State state) {
        if (state != this.state)
            return manager.setTunnelState(this, state);
        return CompletableFuture.completedFuture(this.state);
@@ -153,5 +158,48 @@ public class Tunnel extends BaseObservable implements Keyed<String> {
    }

    public static class Statistics extends BaseObservable {
+        private long lastTouched = SystemClock.elapsedRealtime();
+        private final Map<Key, Pair<Long, Long>> peerBytes = new HashMap<>();
+
+        public void add(final Key key, final long rx, final long tx) {
+            peerBytes.put(key, Pair.create(rx, tx));
+            lastTouched = SystemClock.elapsedRealtime();
+        }
+
+        private boolean isStale() {
+            return SystemClock.elapsedRealtime() - lastTouched > 900;
+        }
+
+        public Key[] peers() {
+            return peerBytes.keySet().toArray(new Key[0]);
+        }
+
+        public long peerRx(final Key peer) {
+            if (!peerBytes.containsKey(peer))
+                return 0;
+            return peerBytes.get(peer).first;
+        }
+
+        public long peerTx(final Key peer) {
+            if (!peerBytes.containsKey(peer))
+                return 0;
+            return peerBytes.get(peer).second;
+        }
+
+        public long totalRx() {
+            long rx = 0;
+            for (final Pair<Long, Long> val : peerBytes.values()) {
+                rx += val.first;
+            }
+            return rx;
+        }
+
+        public long totalTx() {
+            long tx = 0;
+            for (final Pair<Long, Long> val : peerBytes.values()) {
+                tx += val.second;
+            }
+            return tx;
+        }
    }
 }
@@ -1,25 +1,24 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.model;

-import android.content.SharedPreferences;
-import android.databinding.BaseObservable;
-import android.databinding.Bindable;
-import android.support.annotation.NonNull;
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+import androidx.databinding.BaseObservable;
+import androidx.databinding.Bindable;
+import androidx.annotation.Nullable;

-import com.wireguard.android.Application.ApplicationScope;
+import com.wireguard.android.Application;
 import com.wireguard.android.BR;
-import com.wireguard.android.backend.Backend;
+import com.wireguard.android.R;
 import com.wireguard.android.configStore.ConfigStore;
 import com.wireguard.android.model.Tunnel.State;
 import com.wireguard.android.model.Tunnel.Statistics;
-import com.wireguard.android.util.AsyncWorker;
 import com.wireguard.android.util.ExceptionLoggers;
-import com.wireguard.android.util.ObservableKeyedList;
 import com.wireguard.android.util.ObservableSortedKeyedArrayList;
 import com.wireguard.android.util.ObservableSortedKeyedList;
 import com.wireguard.config.Config;
@@ -29,8 +28,6 @@ import java.util.Collection;
 import java.util.Comparator;
 import java.util.Set;

-import javax.inject.Inject;
-
 import java9.util.Comparators;
 import java9.util.concurrent.CompletableFuture;
 import java9.util.concurrent.CompletionStage;
@@ -41,7 +38,6 @@ import java9.util.stream.StreamSupport;
 * Maintains and mediates changes to the set of available WireGuard tunnels,
 */

-@ApplicationScope
 public final class TunnelManager extends BaseObservable {
    private static final Comparator<String> COMPARATOR = Comparators.<String>thenComparing(
            String.CASE_INSENSITIVE_ORDER, Comparators.naturalOrder());
@@ -49,39 +45,42 @@ public final class TunnelManager extends BaseObservable {
    private static final String KEY_RESTORE_ON_BOOT = "restore_on_boot";
    private static final String KEY_RUNNING_TUNNELS = "enabled_configs";

-    private final AsyncWorker asyncWorker;
-    private final Backend backend;
+    private final CompletableFuture<ObservableSortedKeyedList<String, Tunnel>> completableTunnels = new CompletableFuture<>();
    private final ConfigStore configStore;
-    private final SharedPreferences preferences;
-    private final ObservableSortedKeyedList<String, Tunnel> tunnels =
-            new ObservableSortedKeyedArrayList<>(COMPARATOR);
-    private Tunnel lastUsedTunnel;
+    private final Context context = Application.get();
+    private final ArrayList<CompletableFuture<Void>> delayedLoadRestoreTunnels = new ArrayList<>();
+    private final ObservableSortedKeyedList<String, Tunnel> tunnels = new ObservableSortedKeyedArrayList<>(COMPARATOR);
    private boolean haveLoaded;
-    private ArrayList<CompletableFuture<Void>> delayedLoadRestoreTunnels = new ArrayList<>();
+    @Nullable private Tunnel lastUsedTunnel;

-    @Inject
-    public TunnelManager(final AsyncWorker asyncWorker, final Backend backend,
-                         final ConfigStore configStore, final SharedPreferences preferences) {
-        this.asyncWorker = asyncWorker;
-        this.backend = backend;
+    public TunnelManager(final ConfigStore configStore) {
        this.configStore = configStore;
-        this.preferences = preferences;
    }

-    private Tunnel addToList(final String name, final Config config, final State state) {
+    static CompletionStage<State> getTunnelState(final Tunnel tunnel) {
+        return Application.getAsyncWorker().supplyAsync(() -> Application.getBackend().getState(tunnel))
+                .thenApply(tunnel::onStateChanged);
+    }
+
+    static CompletionStage<Statistics> getTunnelStatistics(final Tunnel tunnel) {
+        return Application.getAsyncWorker().supplyAsync(() -> Application.getBackend().getStatistics(tunnel))
+                .thenApply(tunnel::onStatisticsChanged);
+    }
+
+    private Tunnel addToList(final String name, @Nullable final Config config, final State state) {
        final Tunnel tunnel = new Tunnel(this, name, config, state);
        tunnels.add(tunnel);
        return tunnel;
    }

-    public CompletionStage<Tunnel> create(@NonNull final String name, final Config config) {
+    public CompletionStage<Tunnel> create(final String name, @Nullable final Config config) {
        if (Tunnel.isNameInvalid(name))
-            return CompletableFuture.failedFuture(new IllegalArgumentException("Invalid name"));
+            return CompletableFuture.failedFuture(new IllegalArgumentException(context.getString(R.string.tunnel_error_invalid_name)));
        if (tunnels.containsKey(name)) {
-            final String message = "Tunnel " + name + " already exists";
+            final String message = context.getString(R.string.tunnel_error_already_exists, name);
            return CompletableFuture.failedFuture(new IllegalArgumentException(message));
        }
-        return asyncWorker.supplyAsync(() -> configStore.create(name, config))
+        return Application.getAsyncWorker().supplyAsync(() -> configStore.create(name, config))
                .thenApply(savedConfig -> addToList(name, savedConfig, State.DOWN));
    }

@@ -92,14 +91,14 @@ public final class TunnelManager extends BaseObservable {
        if (wasLastUsed)
            setLastUsedTunnel(null);
        tunnels.remove(tunnel);
-        return asyncWorker.runAsync(() -> {
+        return Application.getAsyncWorker().runAsync(() -> {
            if (originalState == State.UP)
-                backend.setState(tunnel, State.DOWN);
+                Application.getBackend().setState(tunnel, State.DOWN);
            try {
                configStore.delete(tunnel.getName());
            } catch (final Exception e) {
                if (originalState == State.UP)
-                    backend.setState(tunnel, State.UP);
+                    Application.getBackend().setState(tunnel, State.UP);
                // Re-throw the exception to fail the completion.
                throw e;
            }
@@ -114,32 +113,23 @@ public final class TunnelManager extends BaseObservable {
    }

    @Bindable
+    @Nullable
    public Tunnel getLastUsedTunnel() {
        return lastUsedTunnel;
    }

    CompletionStage<Config> getTunnelConfig(final Tunnel tunnel) {
-        return asyncWorker.supplyAsync(() -> configStore.load(tunnel.getName()))
+        return Application.getAsyncWorker().supplyAsync(() -> configStore.load(tunnel.getName()))
                .thenApply(tunnel::onConfigChanged);
    }

-    CompletionStage<State> getTunnelState(final Tunnel tunnel) {
-        return asyncWorker.supplyAsync(() -> backend.getState(tunnel))
-                .thenApply(tunnel::onStateChanged);
-    }
-
-    CompletionStage<Statistics> getTunnelStatistics(final Tunnel tunnel) {
-        return asyncWorker.supplyAsync(() -> backend.getStatistics(tunnel))
-                .thenApply(tunnel::onStatisticsChanged);
-    }
-
-    public ObservableKeyedList<String, Tunnel> getTunnels() {
-        return tunnels;
+    public CompletableFuture<ObservableSortedKeyedList<String, Tunnel>> getTunnels() {
+        return completableTunnels;
    }

    public void onCreate() {
-        asyncWorker.supplyAsync(configStore::enumerate)
-                .thenAcceptBoth(asyncWorker.supplyAsync(backend::enumerate), this::onTunnelsLoaded)
+        Application.getAsyncWorker().supplyAsync(configStore::enumerate)
+                .thenAcceptBoth(Application.getAsyncWorker().supplyAsync(() -> Application.getBackend().enumerate()), this::onTunnelsLoaded)
                .whenComplete(ExceptionLoggers.E);
    }

@@ -147,10 +137,10 @@ public final class TunnelManager extends BaseObservable {
    private void onTunnelsLoaded(final Iterable<String> present, final Collection<String> running) {
        for (final String name : present)
            addToList(name, null, running.contains(name) ? State.UP : State.DOWN);
-        final String lastUsedName = preferences.getString(KEY_LAST_USED_TUNNEL, null);
+        final String lastUsedName = Application.getSharedPreferences().getString(KEY_LAST_USED_TUNNEL, null);
        if (lastUsedName != null)
            setLastUsedTunnel(tunnels.get(lastUsedName));
-        CompletableFuture<Void> toComplete[];
+        final CompletableFuture<Void>[] toComplete;
        synchronized (delayedLoadRestoreTunnels) {
            haveLoaded = true;
            toComplete = delayedLoadRestoreTunnels.toArray(new CompletableFuture[delayedLoadRestoreTunnels.size()]);
@@ -164,10 +154,12 @@ public final class TunnelManager extends BaseObservable {
                    f.completeExceptionally(t);
            }
        });
+
+        completableTunnels.complete(tunnels);
    }

    public void refreshTunnelStates() {
-        asyncWorker.supplyAsync(backend::enumerate)
+        Application.getAsyncWorker().supplyAsync(() -> Application.getBackend().enumerate())
                .thenAccept(running -> {
                    for (final Tunnel tunnel : tunnels)
                        tunnel.onStateChanged(running.contains(tunnel.getName()) ? State.UP : State.DOWN);
@@ -175,17 +167,17 @@ public final class TunnelManager extends BaseObservable {
                .whenComplete(ExceptionLoggers.E);
    }

-    public CompletionStage<Void> restoreState(boolean force) {
-        if (!force && !preferences.getBoolean(KEY_RESTORE_ON_BOOT, false))
+    public CompletionStage<Void> restoreState(final boolean force) {
+        if (!force && !Application.getSharedPreferences().getBoolean(KEY_RESTORE_ON_BOOT, false))
            return CompletableFuture.completedFuture(null);
        synchronized (delayedLoadRestoreTunnels) {
            if (!haveLoaded) {
-                CompletableFuture<Void> f = new CompletableFuture<>();
+                final CompletableFuture<Void> f = new CompletableFuture<>();
                delayedLoadRestoreTunnels.add(f);
                return f;
            }
        }
-        final Set<String> previouslyRunning = preferences.getStringSet(KEY_RUNNING_TUNNELS, null);
+        final Set<String> previouslyRunning = Application.getSharedPreferences().getStringSet(KEY_RUNNING_TUNNELS, null);
        if (previouslyRunning == null)
            return CompletableFuture.completedFuture(null);
        return CompletableFuture.allOf(StreamSupport.stream(tunnels)
@@ -199,32 +191,32 @@ public final class TunnelManager extends BaseObservable {
                .filter(tunnel -> tunnel.getState() == State.UP)
                .map(Tunnel::getName)
                .collect(Collectors.toUnmodifiableSet());
-        preferences.edit().putStringSet(KEY_RUNNING_TUNNELS, runningTunnels).apply();
+        Application.getSharedPreferences().edit().putStringSet(KEY_RUNNING_TUNNELS, runningTunnels).apply();
    }

-    private void setLastUsedTunnel(final Tunnel tunnel) {
+    private void setLastUsedTunnel(@Nullable final Tunnel tunnel) {
        if (tunnel == lastUsedTunnel)
            return;
        lastUsedTunnel = tunnel;
        notifyPropertyChanged(BR.lastUsedTunnel);
        if (tunnel != null)
-            preferences.edit().putString(KEY_LAST_USED_TUNNEL, tunnel.getName()).apply();
+            Application.getSharedPreferences().edit().putString(KEY_LAST_USED_TUNNEL, tunnel.getName()).apply();
        else
-            preferences.edit().remove(KEY_LAST_USED_TUNNEL).apply();
+            Application.getSharedPreferences().edit().remove(KEY_LAST_USED_TUNNEL).apply();
    }

    CompletionStage<Config> setTunnelConfig(final Tunnel tunnel, final Config config) {
-        return asyncWorker.supplyAsync(() -> {
-            final Config appliedConfig = backend.applyConfig(tunnel, config);
+        return Application.getAsyncWorker().supplyAsync(() -> {
+            final Config appliedConfig = Application.getBackend().applyConfig(tunnel, config);
            return configStore.save(tunnel.getName(), appliedConfig);
        }).thenApply(tunnel::onConfigChanged);
    }

    CompletionStage<String> setTunnelName(final Tunnel tunnel, final String name) {
        if (Tunnel.isNameInvalid(name))
-            return CompletableFuture.failedFuture(new IllegalArgumentException("Invalid name"));
+            return CompletableFuture.failedFuture(new IllegalArgumentException(context.getString(R.string.tunnel_error_invalid_name)));
        if (tunnels.containsKey(name)) {
-            final String message = "Tunnel " + name + " already exists";
+            final String message = context.getString(R.string.tunnel_error_already_exists, name);
            return CompletableFuture.failedFuture(new IllegalArgumentException(message));
        }
        final State originalState = tunnel.getState();
@@ -233,13 +225,13 @@ public final class TunnelManager extends BaseObservable {
        if (wasLastUsed)
            setLastUsedTunnel(null);
        tunnels.remove(tunnel);
-        return asyncWorker.supplyAsync(() -> {
+        return Application.getAsyncWorker().supplyAsync(() -> {
            if (originalState == State.UP)
-                backend.setState(tunnel, State.DOWN);
+                Application.getBackend().setState(tunnel, State.DOWN);
            configStore.rename(tunnel.getName(), name);
            final String newName = tunnel.onNameChanged(name);
            if (originalState == State.UP)
-                backend.setState(tunnel, State.UP);
+                Application.getBackend().setState(tunnel, State.UP);
            return newName;
        }).whenComplete((newName, e) -> {
            // On failure, we don't know what state the tunnel might be in. Fix that.
@@ -255,7 +247,7 @@ public final class TunnelManager extends BaseObservable {
    CompletionStage<State> setTunnelState(final Tunnel tunnel, final State state) {
        // Ensure the configuration is loaded before trying to use it.
        return tunnel.getConfigAsync().thenCompose(x ->
-                asyncWorker.supplyAsync(() -> backend.setState(tunnel, state))
+                Application.getAsyncWorker().supplyAsync(() -> Application.getBackend().setState(tunnel, state))
        ).whenComplete((newState, e) -> {
            // Ensure onStateChanged is always called (failure or not), and with the correct state.
            tunnel.onStateChanged(e == null ? newState : tunnel.getState());
@@ -264,4 +256,45 @@ public final class TunnelManager extends BaseObservable {
            saveState();
        });
    }
+
+    public static final class IntentReceiver extends BroadcastReceiver {
+        @Override
+        public void onReceive(final Context context, @Nullable final Intent intent) {
+            final TunnelManager manager = Application.getTunnelManager();
+            if (intent == null)
+                return;
+            final String action = intent.getAction();
+            if (action == null)
+                return;
+
+            if ("com.wireguard.android.action.REFRESH_TUNNEL_STATES".equals(action)) {
+                manager.refreshTunnelStates();
+                return;
+            }
+
+            /* We disable the below, for now, as the security model of allowing this
+             * might take a bit more consideration.
+             */
+            if (true)
+                return;
+
+            final State state;
+            if ("com.wireguard.android.action.SET_TUNNEL_UP".equals(action))
+                state = State.UP;
+            else if ("com.wireguard.android.action.SET_TUNNEL_DOWN".equals(action))
+                state = State.DOWN;
+            else
+                return;
+
+            final String tunnelName = intent.getStringExtra("tunnel");
+            if (tunnelName == null)
+                return;
+            manager.getTunnels().thenAccept(tunnels -> {
+                final Tunnel tunnel = tunnels.get(tunnelName);
+                if (tunnel == null)
+                    return;
+                manager.setTunnelState(tunnel, state);
+            });
+        }
+    }
 }
@@ -0,0 +1,112 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.preference;
+
+import android.Manifest;
+import android.content.Context;
+import android.content.pm.PackageManager;
+import androidx.annotation.Nullable;
+import com.google.android.material.snackbar.Snackbar;
+import androidx.preference.Preference;
+
+import android.util.AttributeSet;
+import android.util.Log;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.R;
+import com.wireguard.android.util.DownloadsFileSaver;
+import com.wireguard.android.util.DownloadsFileSaver.DownloadsFile;
+import com.wireguard.android.util.ErrorMessages;
+import com.wireguard.android.util.FragmentUtils;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+/**
+ * Preference implementing a button that asynchronously exports logs.
+ */
+
+public class LogExporterPreference extends Preference {
+    private static final String TAG = "WireGuard/" + LogExporterPreference.class.getSimpleName();
+
+    @Nullable private String exportedFilePath;
+
+    public LogExporterPreference(final Context context, final AttributeSet attrs) {
+        super(context, attrs);
+    }
+
+    private void exportLog() {
+        Application.getAsyncWorker().supplyAsync(() -> {
+            DownloadsFile outputFile = DownloadsFileSaver.save(getContext(), "wireguard-log.txt", "text/plain", true);
+            try {
+                final Process process = Runtime.getRuntime().exec(new String[]{
+                        "logcat", "-b", "all", "-d", "-v", "threadtime", "*:V"});
+                try (final BufferedReader stdout = new BufferedReader(new InputStreamReader(process.getInputStream()));
+                     final BufferedReader stderr = new BufferedReader(new InputStreamReader(process.getErrorStream())))
+                {
+                    String line;
+                    while ((line = stdout.readLine()) != null) {
+                        outputFile.getOutputStream().write(line.getBytes());
+                        outputFile.getOutputStream().write('\n');
+                    }
+                    outputFile.getOutputStream().close();
+                    stdout.close();
+                    if (process.waitFor() != 0) {
+                        final StringBuilder errors = new StringBuilder();
+                        errors.append(R.string.logcat_error);
+                        while ((line = stderr.readLine()) != null)
+                            errors.append(line);
+                        throw new Exception(errors.toString());
+                    }
+                }
+            } catch (final Exception e) {
+                outputFile.delete();
+                throw e;
+            }
+            return outputFile.getFileName();
+        }).whenComplete(this::exportLogComplete);
+    }
+
+    private void exportLogComplete(final String filePath, @Nullable final Throwable throwable) {
+        if (throwable != null) {
+            final String error = ErrorMessages.get(throwable);
+            final String message = getContext().getString(R.string.log_export_error, error);
+            Log.e(TAG, message, throwable);
+            Snackbar.make(
+                    FragmentUtils.getPrefActivity(this).findViewById(android.R.id.content),
+                    message, Snackbar.LENGTH_LONG).show();
+            setEnabled(true);
+        } else {
+            exportedFilePath = filePath;
+            notifyChanged();
+        }
+    }
+
+    @Override
+    public CharSequence getSummary() {
+        return exportedFilePath == null ?
+                getContext().getString(R.string.log_export_summary) :
+                getContext().getString(R.string.log_export_success, exportedFilePath);
+    }
+
+    @Override
+    public CharSequence getTitle() {
+        return getContext().getString(R.string.log_export_title);
+    }
+
+    @Override
+    protected void onClick() {
+        FragmentUtils.getPrefActivity(this).ensurePermissions(
+                new String[]{Manifest.permission.WRITE_EXTERNAL_STORAGE},
+                (permissions, granted) -> {
+                    if (granted.length > 0 && granted[0] == PackageManager.PERMISSION_GRANTED) {
+                        setEnabled(false);
+                        exportLog();
+                    }
+                });
+    }
+
+}
@@ -0,0 +1,91 @@
+/*
+ * Copyright © 2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.preference;
+
+import android.content.Context;
+import android.content.Intent;
+import android.system.OsConstants;
+import android.util.AttributeSet;
+import android.widget.Toast;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.R;
+import com.wireguard.android.util.ModuleLoader;
+import com.wireguard.android.util.ToolsInstaller;
+
+import androidx.annotation.Nullable;
+import androidx.preference.Preference;
+
+public class ModuleDownloaderPreference extends Preference {
+    private State state = State.INITIAL;
+
+    public ModuleDownloaderPreference(final Context context, final AttributeSet attrs) {
+        super(context, attrs);
+    }
+
+    @Override
+    public CharSequence getSummary() {
+        return getContext().getString(state.messageResourceId);
+    }
+
+    @Override
+    public CharSequence getTitle() {
+        return getContext().getString(R.string.module_installer_title);
+    }
+
+    @Override
+    protected void onClick() {
+        setState(State.WORKING);
+        Application.getAsyncWorker().supplyAsync(Application.getModuleLoader()::download).whenComplete(this::onDownloadResult);
+    }
+
+    private void onDownloadResult(final Integer result, @Nullable final Throwable throwable) {
+        if (throwable != null) {
+            setState(State.FAILURE);
+            Toast.makeText(getContext(), throwable.getMessage(), Toast.LENGTH_LONG).show();
+        } else if (result == OsConstants.ENOENT)
+            setState(State.NOTFOUND);
+        else if (result == OsConstants.EXIT_SUCCESS) {
+            setState(State.SUCCESS);
+            Application.getAsyncWorker().runAsync(() -> {
+                Thread.sleep(1000 * 5);
+                Intent i = getContext().getPackageManager().getLaunchIntentForPackage(getContext().getPackageName());
+                if (i == null)
+                    return;
+                i.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
+                i.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                Application.get().startActivity(i);
+                System.exit(0);
+            });
+        } else
+            setState(State.FAILURE);
+    }
+
+    private void setState(final State state) {
+        if (this.state == state)
+            return;
+        this.state = state;
+        if (isEnabled() != state.shouldEnableView)
+            setEnabled(state.shouldEnableView);
+        notifyChanged();
+    }
+
+    private enum State {
+        INITIAL(R.string.module_installer_initial, true),
+        FAILURE(R.string.module_installer_error, true),
+        WORKING(R.string.module_installer_working, false),
+        SUCCESS(R.string.module_installer_success, false),
+        NOTFOUND(R.string.module_installer_not_found, false);
+
+        private final int messageResourceId;
+        private final boolean shouldEnableView;
+
+        State(final int messageResourceId, final boolean shouldEnableView) {
+            this.messageResourceId = messageResourceId;
+            this.shouldEnableView = shouldEnableView;
+        }
+    }
+}
@@ -1,21 +1,17 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.preference;

 import android.content.Context;
-import android.support.annotation.NonNull;
-import android.support.v7.preference.Preference;
-import android.system.OsConstants;
+import androidx.annotation.Nullable;
+import androidx.preference.Preference;
 import android.util.AttributeSet;

 import com.wireguard.android.Application;
-import com.wireguard.android.Application.ApplicationComponent;
 import com.wireguard.android.R;
-import com.wireguard.android.util.AsyncWorker;
 import com.wireguard.android.util.ToolsInstaller;

 /**
@@ -24,16 +20,10 @@ import com.wireguard.android.util.ToolsInstaller;
 */

 public class ToolsInstallerPreference extends Preference {
-    private final AsyncWorker asyncWorker;
-    private final ToolsInstaller toolsInstaller;
    private State state = State.INITIAL;

-    @SuppressWarnings({"SameParameterValue", "WeakerAccess"})
    public ToolsInstallerPreference(final Context context, final AttributeSet attrs) {
        super(context, attrs);
-        final ApplicationComponent applicationComponent = Application.getComponent();
-        asyncWorker = applicationComponent.getAsyncWorker();
-        toolsInstaller = applicationComponent.getToolsInstaller();
    }

    @Override
@@ -49,34 +39,40 @@ public class ToolsInstallerPreference extends Preference {
    @Override
    public void onAttached() {
        super.onAttached();
-        asyncWorker.supplyAsync(toolsInstaller::areInstalled).whenComplete(this::onCheckResult);
+        Application.getAsyncWorker().supplyAsync(Application.getToolsInstaller()::areInstalled).whenComplete(this::onCheckResult);
    }

-    private void onCheckResult(final Integer result, final Throwable throwable) {
-        setState(throwable == null && result == OsConstants.EALREADY ?
-                State.ALREADY : State.INITIAL);
+    private void onCheckResult(final int state, @Nullable final Throwable throwable) {
+        if (throwable != null || state == ToolsInstaller.ERROR)
+            setState(State.INITIAL);
+        else if ((state & ToolsInstaller.YES) == ToolsInstaller.YES)
+            setState(State.ALREADY);
+        else if ((state & (ToolsInstaller.MAGISK | ToolsInstaller.NO)) == (ToolsInstaller.MAGISK | ToolsInstaller.NO))
+            setState(State.INITIAL_MAGISK);
+        else if ((state & (ToolsInstaller.SYSTEM | ToolsInstaller.NO)) == (ToolsInstaller.SYSTEM | ToolsInstaller.NO))
+            setState(State.INITIAL_SYSTEM);
+        else
+            setState(State.INITIAL);
    }

    @Override
    protected void onClick() {
        setState(State.WORKING);
-        asyncWorker.supplyAsync(toolsInstaller::install).whenComplete(this::onInstallResult);
+        Application.getAsyncWorker().supplyAsync(Application.getToolsInstaller()::install).whenComplete(this::onInstallResult);
    }

-    private void onInstallResult(final Integer result, final Throwable throwable) {
-        final State nextState;
+    private void onInstallResult(final Integer result, @Nullable final Throwable throwable) {
        if (throwable != null)
-            nextState = State.FAILURE;
-        else if (result == OsConstants.EXIT_SUCCESS)
-            nextState = State.SUCCESS;
-        else if (result == OsConstants.EALREADY)
-            nextState = State.ALREADY;
+            setState(State.FAILURE);
+        else if ((result & (ToolsInstaller.YES | ToolsInstaller.MAGISK)) == (ToolsInstaller.YES | ToolsInstaller.MAGISK))
+            setState(State.SUCCESS_MAGISK);
+        else if ((result & (ToolsInstaller.YES | ToolsInstaller.SYSTEM)) == (ToolsInstaller.YES | ToolsInstaller.SYSTEM))
+            setState(State.SUCCESS_SYSTEM);
        else
-            nextState = State.FAILURE;
-        setState(nextState);
+            setState(State.FAILURE);
    }

-    private void setState(@NonNull final State state) {
+    private void setState(final State state) {
        if (this.state == state)
            return;
        this.state = state;
@@ -86,11 +82,14 @@ public class ToolsInstallerPreference extends Preference {
    }

    private enum State {
+        INITIAL(R.string.tools_installer_initial, true),
        ALREADY(R.string.tools_installer_already, false),
        FAILURE(R.string.tools_installer_failure, true),
-        INITIAL(R.string.tools_installer_initial, true),
-        SUCCESS(R.string.tools_installer_success, false),
-        WORKING(R.string.tools_installer_working, false);
+        WORKING(R.string.tools_installer_working, false),
+        INITIAL_SYSTEM(R.string.tools_installer_initial_system, true),
+        SUCCESS_SYSTEM(R.string.tools_installer_success_system, false),
+        INITIAL_MAGISK(R.string.tools_installer_initial_magisk, true),
+        SUCCESS_MAGISK(R.string.tools_installer_success_magisk, false);

        private final int messageResourceId;
        private final boolean shouldEnableView;
@@ -0,0 +1,60 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.preference;
+
+import android.content.ActivityNotFoundException;
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import androidx.annotation.Nullable;
+import androidx.preference.Preference;
+import android.util.AttributeSet;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.BuildConfig;
+import com.wireguard.android.R;
+
+import java.util.Locale;
+
+public class VersionPreference extends Preference {
+    @Nullable private String versionSummary;
+
+    public VersionPreference(final Context context, final AttributeSet attrs) {
+        super(context, attrs);
+
+        Application.getBackendAsync().thenAccept(backend -> {
+            versionSummary = getContext().getString(R.string.version_summary_checking, backend.getTypePrettyName().toLowerCase(Locale.ENGLISH));
+            Application.getAsyncWorker().supplyAsync(backend::getVersion).whenComplete((version, exception) -> {
+                versionSummary = exception == null
+                        ? getContext().getString(R.string.version_summary, backend.getTypePrettyName(), version)
+                        : getContext().getString(R.string.version_summary_unknown, backend.getTypePrettyName().toLowerCase(Locale.ENGLISH));
+                notifyChanged();
+            });
+        });
+    }
+
+    @Nullable
+    @Override
+    public CharSequence getSummary() {
+        return versionSummary;
+    }
+
+    @Override
+    public CharSequence getTitle() {
+        return getContext().getString(R.string.version_title, BuildConfig.VERSION_NAME);
+    }
+
+    @Override
+    protected void onClick() {
+        final Intent intent = new Intent(Intent.ACTION_VIEW);
+        intent.setData(Uri.parse("https://www.wireguard.com/"));
+        try {
+            getContext().startActivity(intent);
+        } catch (final ActivityNotFoundException ignored) {
+        }
+    }
+
+}
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.preference;
@@ -9,26 +8,21 @@ package com.wireguard.android.preference;
 import android.Manifest;
 import android.content.Context;
 import android.content.pm.PackageManager;
-import android.os.Environment;
-import android.support.design.widget.Snackbar;
-import android.support.v7.preference.Preference;
+import androidx.annotation.Nullable;
+import com.google.android.material.snackbar.Snackbar;
+import androidx.preference.Preference;
 import android.util.AttributeSet;
 import android.util.Log;
-import android.view.ContextThemeWrapper;

 import com.wireguard.android.Application;
-import com.wireguard.android.Application.ApplicationComponent;
 import com.wireguard.android.R;
-import com.wireguard.android.activity.SettingsActivity;
 import com.wireguard.android.model.Tunnel;
-import com.wireguard.android.model.TunnelManager;
-import com.wireguard.android.util.AsyncWorker;
-import com.wireguard.android.util.ExceptionLoggers;
+import com.wireguard.android.util.DownloadsFileSaver;
+import com.wireguard.android.util.DownloadsFileSaver.DownloadsFile;
+import com.wireguard.android.util.ErrorMessages;
+import com.wireguard.android.util.FragmentUtils;
 import com.wireguard.config.Config;

-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
@@ -44,73 +38,56 @@ import java9.util.concurrent.CompletableFuture;
 public class ZipExporterPreference extends Preference {
    private static final String TAG = "WireGuard/" + ZipExporterPreference.class.getSimpleName();

-    private final AsyncWorker asyncWorker;
-    private final TunnelManager tunnelManager;
-    private String exportedFilePath;
+    @Nullable private String exportedFilePath;

-    @SuppressWarnings({"SameParameterValue", "WeakerAccess"})
    public ZipExporterPreference(final Context context, final AttributeSet attrs) {
        super(context, attrs);
-        final ApplicationComponent applicationComponent = Application.getComponent();
-        asyncWorker = applicationComponent.getAsyncWorker();
-        tunnelManager = applicationComponent.getTunnelManager();
-    }
-
-    private static SettingsActivity getPrefActivity(final Preference preference) {
-        final Context context = preference.getContext();
-        if (context instanceof ContextThemeWrapper) {
-            if (((ContextThemeWrapper) context).getBaseContext() instanceof SettingsActivity) {
-                return ((SettingsActivity) ((ContextThemeWrapper) context).getBaseContext());
-            }
-        }
-        return null;
    }

    private void exportZip() {
-        final List<Tunnel> tunnels = new ArrayList<>(tunnelManager.getTunnels());
+        Application.getTunnelManager().getTunnels().thenAccept(this::exportZip);
+    }
+
+    private void exportZip(final List<Tunnel> tunnels) {
        final List<CompletableFuture<Config>> futureConfigs = new ArrayList<>(tunnels.size());
        for (final Tunnel tunnel : tunnels)
            futureConfigs.add(tunnel.getConfigAsync().toCompletableFuture());
        if (futureConfigs.isEmpty()) {
-            exportZipComplete(null, new IllegalArgumentException("No tunnels exist"));
+            exportZipComplete(null, new IllegalArgumentException(
+                    getContext().getString(R.string.no_tunnels_error)));
            return;
        }
        CompletableFuture.allOf(futureConfigs.toArray(new CompletableFuture[futureConfigs.size()]))
-                .whenComplete((ignored1, exception) -> asyncWorker.supplyAsync(() -> {
+                .whenComplete((ignored1, exception) -> Application.getAsyncWorker().supplyAsync(() -> {
                    if (exception != null)
                        throw exception;
-                    final File path = Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS);
-                    final File file = new File(path, "wireguard-export.zip");
-                    if (!path.isDirectory() && !path.mkdirs())
-                        throw new IOException("Cannot create output directory");
-                    try (ZipOutputStream zip = new ZipOutputStream(new FileOutputStream(file))) {
+                    DownloadsFile outputFile = DownloadsFileSaver.save(getContext(), "wireguard-export.zip", "application/zip", true);
+                    try (ZipOutputStream zip = new ZipOutputStream(outputFile.getOutputStream())) {
                        for (int i = 0; i < futureConfigs.size(); ++i) {
                            zip.putNextEntry(new ZipEntry(tunnels.get(i).getName() + ".conf"));
                            zip.write(futureConfigs.get(i).getNow(null).
-                                    toString().getBytes(StandardCharsets.UTF_8));
+                                    toWgQuickString().getBytes(StandardCharsets.UTF_8));
                        }
                        zip.closeEntry();
-                        zip.close();
-                    } catch (Exception e) {
-                        // noinspection ResultOfMethodCallIgnored
-                        file.delete();
+                    } catch (final Exception e) {
+                        outputFile.delete();
                        throw e;
                    }
-                    return file.getAbsolutePath();
+                    return outputFile.getFileName();
                }).whenComplete(this::exportZipComplete));
    }

-    private void exportZipComplete(final String filePath, final Throwable throwable) {
+    private void exportZipComplete(@Nullable final String filePath, @Nullable final Throwable throwable) {
        if (throwable != null) {
-            final String error = ExceptionLoggers.unwrapMessage(throwable);
-            final String message = getContext().getString(R.string.export_error, error);
+            final String error = ErrorMessages.get(throwable);
+            final String message = getContext().getString(R.string.zip_export_error, error);
            Log.e(TAG, message, throwable);
            Snackbar.make(
-                    getPrefActivity(this).findViewById(android.R.id.content),
+                    FragmentUtils.getPrefActivity(this).findViewById(android.R.id.content),
                    message, Snackbar.LENGTH_LONG).show();
+            setEnabled(true);
        } else {
            exportedFilePath = filePath;
-            setEnabled(false);
            notifyChanged();
        }
    }
@@ -118,22 +95,24 @@ public class ZipExporterPreference extends Preference {
    @Override
    public CharSequence getSummary() {
        return exportedFilePath == null ?
-                getContext().getString(R.string.export_summary) :
-                getContext().getString(R.string.export_success, exportedFilePath);
+                getContext().getString(R.string.zip_export_summary) :
+                getContext().getString(R.string.zip_export_success, exportedFilePath);
    }

    @Override
    public CharSequence getTitle() {
-        return getContext().getString(R.string.zip_exporter_title);
+        return getContext().getString(R.string.zip_export_title);
    }

    @Override
    protected void onClick() {
-        getPrefActivity(this).ensurePermissions(
+        FragmentUtils.getPrefActivity(this).ensurePermissions(
                new String[]{Manifest.permission.WRITE_EXTERNAL_STORAGE},
                (permissions, granted) -> {
-                    if (granted.length > 0 && granted[0] == PackageManager.PERMISSION_GRANTED)
+                    if (granted.length > 0 && granted[0] == PackageManager.PERMISSION_GRANTED) {
+                        setEnabled(false);
                        exportZip();
+                    }
                });
    }

@@ -1,20 +1,14 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

 import android.os.Handler;

-import com.wireguard.android.Application.ApplicationHandler;
-import com.wireguard.android.Application.ApplicationScope;
-
 import java.util.concurrent.Executor;

-import javax.inject.Inject;
-
 import java9.util.concurrent.CompletableFuture;
 import java9.util.concurrent.CompletionStage;

@@ -22,13 +16,11 @@ import java9.util.concurrent.CompletionStage;
 * Helper class for running asynchronous tasks and ensuring they are completed on the main thread.
 */

-@ApplicationScope
 public class AsyncWorker {
    private final Executor executor;
    private final Handler handler;

-    @Inject
-    AsyncWorker(final Executor executor, @ApplicationHandler final Handler handler) {
+    public AsyncWorker(final Executor executor, final Handler handler) {
        this.executor = executor;
        this.handler = handler;
    }
@@ -1,7 +1,6 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;
@@ -9,7 +8,7 @@ package com.wireguard.android.util;
 import android.content.ClipData;
 import android.content.ClipboardManager;
 import android.content.Context;
-import android.support.design.widget.Snackbar;
+import com.google.android.material.snackbar.Snackbar;
 import android.view.View;
 import android.widget.TextView;

@@ -0,0 +1,98 @@
+/*
+ * Copyright © 2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.util;
+
+import android.content.ContentResolver;
+import android.content.ContentValues;
+import android.content.Context;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Build;
+import android.os.Environment;
+import android.provider.MediaStore;
+import android.provider.MediaStore.MediaColumns;
+
+import com.wireguard.android.R;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+
+public class DownloadsFileSaver {
+
+    public static class DownloadsFile {
+        private Context context;
+        private OutputStream outputStream;
+        private String fileName;
+        private Uri uri;
+
+        private DownloadsFile(final Context context, final OutputStream outputStream, final String fileName, final Uri uri) {
+            this.context = context;
+            this.outputStream = outputStream;
+            this.fileName = fileName;
+            this.uri = uri;
+        }
+
+        public OutputStream getOutputStream() { return outputStream; }
+        public String getFileName() { return fileName; }
+
+        public void delete() {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+                context.getContentResolver().delete(uri, null, null);
+            else
+                new File(fileName).delete();
+        }
+    }
+
+    public static DownloadsFile save(final Context context, final String name, final String mimeType, final boolean overwriteExisting) throws Exception {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            final ContentResolver contentResolver = context.getContentResolver();
+            if (overwriteExisting)
+                contentResolver.delete(MediaStore.Downloads.EXTERNAL_CONTENT_URI, String.format("%s = ?", MediaColumns.DISPLAY_NAME), new String[]{name});
+            final ContentValues contentValues = new ContentValues();
+            contentValues.put(MediaColumns.DISPLAY_NAME, name);
+            contentValues.put(MediaColumns.MIME_TYPE, mimeType);
+            final Uri contentUri = contentResolver.insert(MediaStore.Downloads.EXTERNAL_CONTENT_URI, contentValues);
+            if (contentUri == null)
+                throw new IOException(context.getString(R.string.create_downloads_file_error));
+            final OutputStream contentStream = contentResolver.openOutputStream(contentUri);
+            if (contentStream == null)
+                throw new IOException(context.getString(R.string.create_downloads_file_error));
+            @SuppressWarnings("deprecation")
+            Cursor cursor = contentResolver.query(contentUri, new String[]{MediaColumns.DATA}, null, null, null);
+            String path = null;
+            if (cursor != null) {
+                try {
+                    if (cursor.moveToFirst())
+                        path = cursor.getString(0);
+                } finally {
+                    cursor.close();
+                }
+            }
+            if (path == null) {
+                path = "Download/";
+                cursor = contentResolver.query(contentUri, new String[]{MediaColumns.DISPLAY_NAME}, null, null, null);
+                if (cursor != null) {
+                    try {
+                        if (cursor.moveToFirst())
+                            path += cursor.getString(0);
+                    } finally {
+                        cursor.close();
+                    }
+                }
+            }
+            return new DownloadsFile(context, contentStream, path, contentUri);
+        } else {
+            @SuppressWarnings("deprecation")
+            final File path = Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_DOWNLOADS);
+            final File file = new File(path, name);
+            if (!path.isDirectory() && !path.mkdirs())
+                throw new IOException(context.getString(R.string.create_output_dir_error));
+            return new DownloadsFile(context, new FileOutputStream(file), file.getAbsolutePath(), null);
+        }
+    }
+}
@@ -0,0 +1,130 @@
+/*
+ * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.util;
+
+import android.content.res.Resources;
+import androidx.annotation.Nullable;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.R;
+import com.wireguard.config.BadConfigException;
+import com.wireguard.config.BadConfigException.Location;
+import com.wireguard.config.BadConfigException.Reason;
+import com.wireguard.config.InetEndpoint;
+import com.wireguard.config.InetNetwork;
+import com.wireguard.config.ParseException;
+import com.wireguard.crypto.Key.Format;
+import com.wireguard.crypto.KeyFormatException;
+import com.wireguard.crypto.KeyFormatException.Type;
+
+import java.net.InetAddress;
+import java.util.EnumMap;
+import java.util.Map;
+
+import java9.util.Maps;
+
+public final class ErrorMessages {
+    private static final Map<Reason, Integer> BCE_REASON_MAP = new EnumMap<>(Maps.of(
+            Reason.INVALID_KEY, R.string.bad_config_reason_invalid_key,
+            Reason.INVALID_NUMBER, R.string.bad_config_reason_invalid_number,
+            Reason.INVALID_VALUE, R.string.bad_config_reason_invalid_value,
+            Reason.MISSING_ATTRIBUTE, R.string.bad_config_reason_missing_attribute,
+            Reason.MISSING_SECTION, R.string.bad_config_reason_missing_section,
+            Reason.MISSING_VALUE, R.string.bad_config_reason_missing_value,
+            Reason.SYNTAX_ERROR, R.string.bad_config_reason_syntax_error,
+            Reason.UNKNOWN_ATTRIBUTE, R.string.bad_config_reason_unknown_attribute,
+            Reason.UNKNOWN_SECTION, R.string.bad_config_reason_unknown_section
+    ));
+    private static final Map<Format, Integer> KFE_FORMAT_MAP = new EnumMap<>(Maps.of(
+            Format.BASE64, R.string.key_length_explanation_base64,
+            Format.BINARY, R.string.key_length_explanation_binary,
+            Format.HEX, R.string.key_length_explanation_hex
+    ));
+    private static final Map<Type, Integer> KFE_TYPE_MAP = new EnumMap<>(Maps.of(
+            Type.CONTENTS, R.string.key_contents_error,
+            Type.LENGTH, R.string.key_length_error
+    ));
+    private static final Map<Class, Integer> PE_CLASS_MAP = Maps.of(
+            InetAddress.class, R.string.parse_error_inet_address,
+            InetEndpoint.class, R.string.parse_error_inet_endpoint,
+            InetNetwork.class, R.string.parse_error_inet_network,
+            Integer.class, R.string.parse_error_integer
+    );
+
+    private ErrorMessages() {
+        // Prevent instantiation
+    }
+
+    public static String get(@Nullable final Throwable throwable) {
+        final Resources resources = Application.get().getResources();
+        if (throwable == null)
+            return resources.getString(R.string.unknown_error);
+        final Throwable rootCause = rootCause(throwable);
+        final String message;
+        if (rootCause instanceof BadConfigException) {
+            final BadConfigException bce = (BadConfigException) rootCause;
+            final String reason = getBadConfigExceptionReason(resources, bce);
+            final String context = bce.getLocation() == Location.TOP_LEVEL ?
+                    resources.getString(R.string.bad_config_context_top_level,
+                            bce.getSection().getName()) :
+                    resources.getString(R.string.bad_config_context,
+                            bce.getSection().getName(),
+                            bce.getLocation().getName());
+            final String explanation = getBadConfigExceptionExplanation(resources, bce);
+            message = resources.getString(R.string.bad_config_error, reason, context) + explanation;
+        } else if (rootCause.getMessage() != null) {
+            message = rootCause.getMessage();
+        } else {
+            final String errorType = rootCause.getClass().getSimpleName();
+            message = resources.getString(R.string.generic_error, errorType);
+        }
+        return message;
+    }
+
+    private static String getBadConfigExceptionExplanation(final Resources resources,
+                                                           final BadConfigException bce) {
+        if (bce.getCause() instanceof KeyFormatException) {
+            final KeyFormatException kfe = (KeyFormatException) bce.getCause();
+            if (kfe.getType() == Type.LENGTH)
+                return resources.getString(KFE_FORMAT_MAP.get(kfe.getFormat()));
+        } else if (bce.getCause() instanceof ParseException) {
+            final ParseException pe = (ParseException) bce.getCause();
+            if (pe.getMessage() != null)
+                return ": " + pe.getMessage();
+        } else if (bce.getLocation() == Location.LISTEN_PORT) {
+            return resources.getString(R.string.bad_config_explanation_udp_port);
+        } else if (bce.getLocation() == Location.MTU) {
+            return resources.getString(R.string.bad_config_explanation_positive_number);
+        } else if (bce.getLocation() == Location.PERSISTENT_KEEPALIVE) {
+            return resources.getString(R.string.bad_config_explanation_pka);
+        }
+        return "";
+    }
+
+    private static String getBadConfigExceptionReason(final Resources resources,
+                                                      final BadConfigException bce) {
+        if (bce.getCause() instanceof KeyFormatException) {
+            final KeyFormatException kfe = (KeyFormatException) bce.getCause();
+            return resources.getString(KFE_TYPE_MAP.get(kfe.getType()));
+        } else if (bce.getCause() instanceof ParseException) {
+            final ParseException pe = (ParseException) bce.getCause();
+            final String type = resources.getString(PE_CLASS_MAP.containsKey(pe.getParsingClass()) ?
+                    PE_CLASS_MAP.get(pe.getParsingClass()) : R.string.parse_error_generic);
+            return resources.getString(R.string.parse_error_reason, type, pe.getText());
+        }
+        return resources.getString(BCE_REASON_MAP.get(bce.getReason()), bce.getText());
+    }
+
+    private static Throwable rootCause(final Throwable throwable) {
+        Throwable cause = throwable;
+        while (cause.getCause() != null) {
+            if (cause instanceof BadConfigException)
+                break;
+            cause = cause.getCause();
+        }
+        return cause;
+    }
+}
@@ -1,14 +1,13 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

-import android.support.annotation.NonNull;
+import androidx.annotation.Nullable;
 import android.util.Log;
-import java9.util.concurrent.CompletionException;
+
 import java9.util.function.BiConsumer;

 /**
@@ -21,30 +20,14 @@ public enum ExceptionLoggers implements BiConsumer<Object, Throwable> {
    E(Log.ERROR);

    private static final String TAG = "WireGuard/" + ExceptionLoggers.class.getSimpleName();
-
    private final int priority;

    ExceptionLoggers(final int priority) {
        this.priority = priority;
    }

-    public static Throwable unwrap(final Throwable throwable) {
-        if (throwable instanceof CompletionException && throwable.getCause() != null)
-            return throwable.getCause();
-        return throwable;
-    }
-
-    @NonNull
-    public static String unwrapMessage(Throwable throwable) {
-        throwable = unwrap(throwable);
-        final String message = throwable.getMessage();
-        if (message != null)
-            return message;
-        return throwable.getClass().getSimpleName();
-    }
-
    @Override
-    public void accept(final Object result, final Throwable throwable) {
+    public void accept(final Object result, @Nullable final Throwable throwable) {
        if (throwable != null)
            Log.println(Log.ERROR, TAG, Log.getStackTraceString(throwable));
        else if (priority <= Log.DEBUG)
@@ -0,0 +1,27 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.wireguard.android.util;
+
+import android.content.Context;
+import androidx.preference.Preference;
+import android.view.ContextThemeWrapper;
+
+import com.wireguard.android.activity.SettingsActivity;
+
+public final class FragmentUtils {
+    private FragmentUtils() {
+        // Prevent instantiation
+    }
+
+    public static SettingsActivity getPrefActivity(final Preference preference) {
+        final Context context = preference.getContext();
+        if (context instanceof ContextThemeWrapper) {
+            if (context instanceof SettingsActivity) {
+                return ((SettingsActivity) context);
+            }
+        }
+        return null;
+    }
+}
@@ -1,15 +0,0 @@
-/*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-package com.wireguard.android.util;
-
-/**
- * Interface for objects that have a identifying key of the given type.
- */
-
-public interface Keyed<K> {
-    K getKey();
-}
@@ -0,0 +1,183 @@
+/*
+ * Copyright © 2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.util;
+
+import android.content.Context;
+import android.system.OsConstants;
+import android.util.Base64;
+
+import com.wireguard.android.Application;
+import com.wireguard.android.util.RootShell.NoRootException;
+
+import net.i2p.crypto.eddsa.EdDSAEngine;
+import net.i2p.crypto.eddsa.EdDSAPublicKey;
+import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable;
+import net.i2p.crypto.eddsa.spec.EdDSAParameterSpec;
+import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidParameterException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.Signature;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.annotation.Nullable;
+
+public class ModuleLoader {
+    private static final String MODULE_PUBLIC_KEY_BASE64 = "RWRmHuT9PSqtwfsLtEx+QS06BJtLgFYteL9WCNjH7yuyu5Y1DieSN7If";
+    private static final String MODULE_LIST_URL = "https://download.wireguard.com/android-module/modules.txt.sig";
+    private static final String MODULE_URL = "https://download.wireguard.com/android-module/%s";
+    private static final String MODULE_NAME = "wireguard-%s.ko";
+
+    private final File moduleDir;
+    private final File tmpDir;
+
+    public ModuleLoader(final Context context) {
+        moduleDir = new File(context.getCacheDir(), "kmod");
+        tmpDir = new File(context.getCacheDir(), "tmp");
+    }
+
+    public boolean moduleMightExist() {
+        return moduleDir.exists() && moduleDir.isDirectory();
+    }
+
+    public void loadModule() throws IOException, NoRootException {
+        Application.getRootShell().run(null, String.format("insmod \"%s/wireguard-$(sha256sum /proc/version|cut -d ' ' -f 1).ko\"", moduleDir.getAbsolutePath()));
+    }
+
+    public boolean isModuleLoaded() {
+        return new File("/sys/module/wireguard").exists();
+    }
+
+    private static final class Sha256Digest {
+        private byte[] bytes;
+        private Sha256Digest(final String hex) {
+            if (hex.length() != 64)
+                throw new InvalidParameterException("SHA256 hashes must be 32 bytes long");
+            bytes = new byte[32];
+            for (int i = 0; i < 32; ++i)
+                bytes[i] = (byte)Integer.parseInt(hex.substring(i * 2, i * 2 + 2), 16);
+        }
+    }
+
+    @Nullable
+    private Map<String, Sha256Digest> verifySignedHashes(final String signifyDigest) {
+        final byte[] publicKeyBytes = Base64.decode(MODULE_PUBLIC_KEY_BASE64, Base64.DEFAULT);
+
+        if (publicKeyBytes == null || publicKeyBytes.length != 32 + 10 || publicKeyBytes[0] != 'E' || publicKeyBytes[1] != 'd')
+            return null;
+
+        final String[] lines = signifyDigest.split("\n", 3);
+        if (lines.length != 3)
+            return null;
+        if (!lines[0].startsWith("untrusted comment: "))
+            return null;
+
+        final byte[] signatureBytes = Base64.decode(lines[1], Base64.DEFAULT);
+        if (signatureBytes == null || signatureBytes.length != 64 + 10)
+            return null;
+        for (int i = 0; i < 10; ++i) {
+            if (signatureBytes[i] != publicKeyBytes[i])
+                return null;
+        }
+
+        try {
+            EdDSAParameterSpec parameterSpec = EdDSANamedCurveTable.getByName(EdDSANamedCurveTable.ED_25519);
+            Signature signature = new EdDSAEngine(MessageDigest.getInstance(parameterSpec.getHashAlgorithm()));
+            byte[] rawPublicKeyBytes = new byte[32];
+            System.arraycopy(publicKeyBytes, 10, rawPublicKeyBytes, 0, 32);
+            signature.initVerify(new EdDSAPublicKey(new EdDSAPublicKeySpec(rawPublicKeyBytes, parameterSpec)));
+            signature.update(lines[2].getBytes(StandardCharsets.UTF_8));
+            if (!signature.verify(signatureBytes, 10, 64))
+                return null;
+        } catch (final Exception ignored) {
+            return null;
+        }
+
+        Map<String, Sha256Digest> hashes = new HashMap<>();
+        for (final String line : lines[2].split("\n")) {
+            final String[] components = line.split("  ", 2);
+            if (components.length != 2)
+                return null;
+            try {
+                hashes.put(components[1], new Sha256Digest(components[0]));
+            } catch (final Exception ignored) {
+                return null;
+            }
+        }
+        return hashes;
+    }
+
+    public Integer download() throws IOException, NoRootException, NoSuchAlgorithmException {
+        final List<String> output = new ArrayList<>();
+        Application.getRootShell().run(output, "sha256sum /proc/version|cut -d ' ' -f 1");
+        if (output.size() != 1 || output.get(0).length() != 64)
+            throw new InvalidParameterException("Invalid sha256 of /proc/version");
+        final String moduleName = String.format(MODULE_NAME, output.get(0));
+        HttpURLConnection connection = (HttpURLConnection)new URL(MODULE_LIST_URL).openConnection();
+        connection.setRequestProperty("User-Agent", Application.USER_AGENT);
+        connection.connect();
+        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
+            throw new IOException("Hash list could not be found");
+        byte[] input = new byte[1024 * 1024 * 3 /* 3MiB */];
+        int len;
+        try (final InputStream inputStream = connection.getInputStream()) {
+            len = inputStream.read(input);
+        }
+        if (len <= 0)
+            throw new IOException("Hash list was empty");
+        final Map<String, Sha256Digest> modules = verifySignedHashes(new String(input, 0, len, StandardCharsets.UTF_8));
+        if (modules == null)
+            throw new InvalidParameterException("The signature did not verify or invalid hash list format");
+        if (!modules.containsKey(moduleName))
+            return OsConstants.ENOENT;
+        connection = (HttpURLConnection)new URL(String.format(MODULE_URL, moduleName)).openConnection();
+        connection.setRequestProperty("User-Agent", Application.USER_AGENT);
+        connection.connect();
+        if (connection.getResponseCode() != HttpURLConnection.HTTP_OK)
+            throw new IOException("Module file could not be found, despite being on hash list");
+
+        tmpDir.mkdirs();
+        moduleDir.mkdir();
+        File tempFile = null;
+        try {
+            tempFile = File.createTempFile("UNVERIFIED-", null, tmpDir);
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            try (final InputStream inputStream = connection.getInputStream();
+                 final FileOutputStream outputStream = new FileOutputStream(tempFile)) {
+                int total = 0;
+                while ((len = inputStream.read(input)) > 0) {
+                    total += len;
+                    if (total > 1024 * 1024 * 15 /* 15 MiB */)
+                        throw new IOException("File too big");
+                    outputStream.write(input, 0, len);
+                    digest.update(input, 0, len);
+                }
+                outputStream.getFD().sync();
+            }
+            if (!Arrays.equals(digest.digest(), modules.get(moduleName).bytes))
+                throw new IOException("Incorrect file hash");
+
+            if (!tempFile.renameTo(new File(moduleDir, moduleName)))
+                throw new IOException("Unable to rename to final destination");
+        } finally {
+            if (tempFile != null)
+                tempFile.delete();
+        }
+        return OsConstants.EXIT_SUCCESS;
+    }
+}
@@ -1,13 +1,14 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

-import android.databinding.ObservableArrayList;
-import android.support.annotation.NonNull;
+import androidx.databinding.ObservableArrayList;
+import androidx.annotation.Nullable;
+
+import com.wireguard.util.Keyed;

 import java.util.Collection;
 import java.util.ListIterator;
@@ -23,28 +24,28 @@ import java.util.Objects;
 public class ObservableKeyedArrayList<K, E extends Keyed<? extends K>>
        extends ObservableArrayList<E> implements ObservableKeyedList<K, E> {
    @Override
-    public boolean add(final E e) {
+    public boolean add(@Nullable final E e) {
        if (e == null)
            throw new NullPointerException("Trying to add a null element");
        return super.add(e);
    }

    @Override
-    public void add(final int index, final E e) {
+    public void add(final int index, @Nullable final E e) {
        if (e == null)
            throw new NullPointerException("Trying to add a null element");
        super.add(index, e);
    }

    @Override
-    public boolean addAll(@NonNull final Collection<? extends E> c) {
+    public boolean addAll(final Collection<? extends E> c) {
        if (c.contains(null))
            throw new NullPointerException("Trying to add a collection with null element(s)");
        return super.addAll(c);
    }

    @Override
-    public boolean addAll(final int index, @NonNull final Collection<? extends E> c) {
+    public boolean addAll(final int index, final Collection<? extends E> c) {
        if (c.contains(null))
            throw new NullPointerException("Trying to add a collection with null element(s)");
        return super.addAll(index, c);
@@ -63,12 +64,14 @@ public class ObservableKeyedArrayList<K, E extends Keyed<? extends K>>
        return indexOfKey(key) >= 0;
    }

+    @Nullable
    @Override
    public E get(final K key) {
        final int index = indexOfKey(key);
        return index >= 0 ? get(index) : null;
    }

+    @Nullable
    @Override
    public E getLast(final K key) {
        final int index = lastIndexOfKey(key);
@@ -98,7 +101,7 @@ public class ObservableKeyedArrayList<K, E extends Keyed<? extends K>>
    }

    @Override
-    public E set(final int index, final E e) {
+    public E set(final int index, @Nullable final E e) {
        if (e == null)
            throw new NullPointerException("Trying to set a null key");
        return super.set(index, e);
@@ -1,12 +1,14 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

-import android.databinding.ObservableList;
+import androidx.databinding.ObservableList;
+
+import com.wireguard.util.Keyed;
+import com.wireguard.util.KeyedList;

 /**
 * A list that is both keyed and observable.
@@ -1,12 +1,14 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

-import android.support.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+import com.wireguard.util.Keyed;
+import com.wireguard.util.SortedKeyedList;

 import java.util.AbstractList;
 import java.util.Collection;
@@ -26,7 +28,7 @@ import java.util.Spliterator;

 public class ObservableSortedKeyedArrayList<K, E extends Keyed<? extends K>>
        extends ObservableKeyedArrayList<K, E> implements ObservableSortedKeyedList<K, E> {
-    private final Comparator<? super K> comparator;
+    @Nullable private final Comparator<? super K> comparator;
    private final transient KeyList<K, E> keyList = new KeyList<>(this);

    @SuppressWarnings("WeakerAccess")
@@ -72,7 +74,7 @@ public class ObservableSortedKeyedArrayList<K, E extends Keyed<? extends K>>
    }

    @Override
-    public boolean addAll(@NonNull final Collection<? extends E> c) {
+    public boolean addAll(final Collection<? extends E> c) {
        boolean didChange = false;
        for (final E e : c)
            if (add(e))
@@ -81,12 +83,13 @@ public class ObservableSortedKeyedArrayList<K, E extends Keyed<? extends K>>
    }

    @Override
-    public boolean addAll(int index, @NonNull final Collection<? extends E> c) {
+    public boolean addAll(int index, final Collection<? extends E> c) {
        for (final E e : c)
            add(index++, e);
        return true;
    }

+    @Nullable
    @Override
    public Comparator<? super K> comparator() {
        return comparator;
@@ -125,7 +128,6 @@ public class ObservableSortedKeyedArrayList<K, E extends Keyed<? extends K>>
    }

    @Override
-    @NonNull
    public Set<K> keySet() {
        return keyList;
    }
@@ -165,7 +167,6 @@ public class ObservableSortedKeyedArrayList<K, E extends Keyed<? extends K>>
    }

    @Override
-    @NonNull
    public Collection<E> values() {
        return this;
    }
@@ -1,11 +1,13 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

+import com.wireguard.util.Keyed;
+import com.wireguard.util.SortedKeyedList;
+
 /**
 * A list that is both sorted/keyed and observable.
 */
@@ -1,16 +1,15 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

 import android.content.Context;
+import androidx.annotation.Nullable;
 import android.util.Log;

-import com.wireguard.android.Application.ApplicationContext;
-import com.wireguard.android.Application.ApplicationScope;
+import com.wireguard.android.BuildConfig;
 import com.wireguard.android.R;

 import java.io.BufferedReader;
@@ -23,35 +22,32 @@ import java.nio.charset.StandardCharsets;
 import java.util.Collection;
 import java.util.UUID;

-import javax.inject.Inject;
-
 /**
 * Helper class for running commands as root.
 */

-@ApplicationScope
 public class RootShell {
    private static final String SU = "su";
    private static final String TAG = "WireGuard/" + RootShell.class.getSimpleName();

+    private final Context context;
    private final String deviceNotRootedMessage;
    private final File localBinaryDir;
    private final File localTemporaryDir;
    private final Object lock = new Object();
    private final String preamble;
-    private Process process;
-    private BufferedReader stderr;
-    private OutputStreamWriter stdin;
-    private BufferedReader stdout;
+    @Nullable private Process process;
+    @Nullable private BufferedReader stderr;
+    @Nullable private OutputStreamWriter stdin;
+    @Nullable private BufferedReader stdout;

-    @Inject
-    public RootShell(@ApplicationContext final Context context) {
+    public RootShell(final Context context) {
        deviceNotRootedMessage = context.getString(R.string.error_root);
-        final File cacheDir = context.getCacheDir();
-        localBinaryDir = new File(cacheDir, "bin");
-        localTemporaryDir = new File(cacheDir, "tmp");
-        preamble = String.format("export CALLING_PACKAGE=com.wireguard.android PATH=\"%s:$PATH\" TMPDIR='%s'; id -u\n",
-                localBinaryDir, localTemporaryDir);
+        localBinaryDir = new File(context.getCodeCacheDir(), "bin");
+        localTemporaryDir = new File(context.getCacheDir(), "tmp");
+        preamble = String.format("export CALLING_PACKAGE=%s PATH=\"%s:$PATH\" TMPDIR='%s'; id -u\n",
+                BuildConfig.APPLICATION_ID, localBinaryDir, localTemporaryDir);
+        this.context = context;
    }

    private static boolean isExecutableInPath(final String name) {
@@ -86,7 +82,7 @@ public class RootShell {
     * @param command Command to run as root.
     * @return The exit value of the command.
     */
-    public int run(final Collection<String> output, final String command)
+    public int run(@Nullable final Collection<String> output, final String command)
            throws IOException, NoRootException {
        synchronized (lock) {
            /* Start inside synchronized block to prevent a concurrent call to stop(). */
@@ -126,9 +122,9 @@ public class RootShell {
                }
            }
            if (markersSeen != 4)
-                throw new IOException("Expected 4 markers, received " + markersSeen);
+                throw new IOException(context.getString(R.string.shell_marker_count_error, markersSeen));
            if (errnoStdout != errnoStderr)
-                throw new IOException("Unable to read exit status");
+                throw new IOException(context.getString(R.string.shell_exit_status_read_error));
            Log.v(TAG, "exit: " + errnoStdout);
            return errnoStdout;
        }
@@ -141,9 +137,9 @@ public class RootShell {
            if (isRunning())
                return;
            if (!localBinaryDir.isDirectory() && !localBinaryDir.mkdirs())
-                throw new FileNotFoundException("Could not create local binary directory");
+                throw new FileNotFoundException(context.getString(R.string.create_bin_dir_error));
            if (!localTemporaryDir.isDirectory() && !localTemporaryDir.mkdirs())
-                throw new FileNotFoundException("Could not create local temporary directory");
+                throw new FileNotFoundException(context.getString(R.string.create_temp_dir_error));
            try {
                final ProcessBuilder builder = new ProcessBuilder().command(SU);
                builder.environment().put("LC_ALL", "C");
@@ -173,7 +169,7 @@ public class RootShell {
                        if (line.contains("Permission denied"))
                            throw new NoRootException(deviceNotRootedMessage);
                    }
-                    throw new IOException("Shell failed to start: " + process.exitValue());
+                    throw new IOException(context.getString(R.string.shell_start_error, process.exitValue()));
                }
            } catch (final IOException | NoRootException e) {
                stop();
@@ -1,6 +1,6 @@
 /*
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;
@@ -13,8 +13,11 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.util.zip.ZipFile;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.HashSet;
 import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;

 public final class SharedLibraryLoader {
    private static final String TAG = "WireGuard/" + SharedLibraryLoader.class.getSimpleName();
@@ -22,50 +25,66 @@ public final class SharedLibraryLoader {
    private SharedLibraryLoader() {
    }

-    public static final void loadSharedLibrary(final Context context, final String libName) {
+    public static boolean extractLibrary(final Context context, final String libName, final File destination) throws IOException {
+        final Collection<String> apks = new HashSet<>();
+        if (context.getApplicationInfo().sourceDir != null)
+            apks.add(context.getApplicationInfo().sourceDir);
+        if (context.getApplicationInfo().splitSourceDirs != null)
+            apks.addAll(Arrays.asList(context.getApplicationInfo().splitSourceDirs));
+
+        for (final String abi : Build.SUPPORTED_ABIS) {
+            for (final String apk : apks) {
+                final ZipFile zipFile;
+                try {
+                    zipFile = new ZipFile(new File(apk), ZipFile.OPEN_READ);
+                } catch (final IOException e) {
+                    throw new RuntimeException(e);
+                }
+
+                final String mappedLibName = System.mapLibraryName(libName);
+                final byte[] buffer = new byte[1024 * 32];
+                final String libZipPath = "lib" + File.separatorChar + abi + File.separatorChar + mappedLibName;
+                final ZipEntry zipEntry = zipFile.getEntry(libZipPath);
+                if (zipEntry == null)
+                    continue;
+                Log.d(TAG, "Extracting apk:/" + libZipPath + " to " + destination.getAbsolutePath());
+                try (final FileOutputStream out = new FileOutputStream(destination);
+                     final InputStream in = zipFile.getInputStream(zipEntry)) {
+                    int len;
+                    while ((len = in.read(buffer)) != -1) {
+                        out.write(buffer, 0, len);
+                    }
+                    out.getFD().sync();
+                }
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public static void loadSharedLibrary(final Context context, final String libName) {
        Throwable noAbiException;
        try {
            System.loadLibrary(libName);
            return;
-        } catch (UnsatisfiedLinkError e) {
+        } catch (final UnsatisfiedLinkError e) {
            Log.d(TAG, "Failed to load library normally, so attempting to extract from apk", e);
            noAbiException = e;
        }
-
-        final ZipFile zipFile;
+        File f = null;
        try {
-            zipFile = new ZipFile(new File(context.getApplicationInfo().sourceDir), ZipFile.OPEN_READ);
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-
-        final String mappedLibName = System.mapLibraryName(libName);
-        byte buffer[] = new byte[1024 * 32];
-        for (final String abi : Build.SUPPORTED_ABIS) {
-            final String libZipPath = "lib" + File.separatorChar + abi + File.separatorChar + mappedLibName;
-            final ZipEntry zipEntry = zipFile.getEntry(libZipPath);
-            if (zipEntry == null)
-                continue;
-            File f = null;
-            try {
-                f = File.createTempFile("lib", ".so", context.getCacheDir());
-                Log.d(TAG, "Extracting apk:/" + libZipPath + " to " + f.getAbsolutePath() + " and loading");
-                FileOutputStream out = new FileOutputStream(f);
-                InputStream in = zipFile.getInputStream(zipEntry);
-                int len;
-                while ((len = in.read(buffer)) != -1) {
-                    out.write(buffer, 0, len);
-                }
-                out.close();
+            f = File.createTempFile("lib", ".so", context.getCodeCacheDir());
+            if (extractLibrary(context, libName, f)) {
                System.load(f.getAbsolutePath());
                return;
-            } catch (Exception e) {
-                Log.d(TAG, "Failed to load library apk:/" + libZipPath, e);
-                noAbiException = e;
-            } finally {
-                if (f != null)
-                    f.delete();
            }
+        } catch (final Exception e) {
+            Log.d(TAG, "Failed to load library apk:/" + libName, e);
+            noAbiException = e;
+        } finally {
+            if (f != null)
+                // noinspection ResultOfMethodCallIgnored
+                f.delete();
        }
        if (noAbiException instanceof RuntimeException)
            throw (RuntimeException) noAbiException;
@@ -1,17 +1,18 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.util;

 import android.content.Context;
+import androidx.annotation.Nullable;
 import android.system.OsConstants;
 import android.util.Log;

-import com.wireguard.android.Application.ApplicationContext;
-import com.wireguard.android.Application.ApplicationScope;
+import com.wireguard.android.Application;
+import com.wireguard.android.BuildConfig;
+import com.wireguard.android.R;
 import com.wireguard.android.util.RootShell.NoRootException;

 import java.io.File;
@@ -20,123 +21,164 @@ import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;

-import javax.inject.Inject;
-
 /**
 * Helper to install WireGuard tools to the system partition.
 */

-@ApplicationScope
 public final class ToolsInstaller {
-    private static final String[][] EXECUTABLES = {
-            {"libwg.so", "wg"},
-            {"libwg-quick.so", "wg-quick"},
-    };
+    public static final int ERROR = 0x0;
+    public static final int MAGISK = 0x4;
+    public static final int NO = 0x2;
+    public static final int SYSTEM = 0x8;
+    public static final int YES = 0x1;
+    private static final String[] EXECUTABLES = {"wg", "wg-quick"};
    private static final File[] INSTALL_DIRS = {
            new File("/system/xbin"),
            new File("/system/bin"),
    };
-    private static final File INSTALL_DIR = getInstallDir();
+    @Nullable private static final File INSTALL_DIR = getInstallDir();
    private static final String TAG = "WireGuard/" + ToolsInstaller.class.getSimpleName();

+    private final Context context;
    private final File localBinaryDir;
    private final Object lock = new Object();
-    private final File nativeLibraryDir;
-    private final RootShell rootShell;
-    private Boolean areToolsAvailable;
+    @Nullable private Boolean areToolsAvailable;
+    @Nullable private Boolean installAsMagiskModule;

-    @Inject
-    public ToolsInstaller(@ApplicationContext final Context context, final RootShell rootShell) {
-        localBinaryDir = new File(context.getCacheDir(), "bin");
-        nativeLibraryDir = new File(context.getApplicationInfo().nativeLibraryDir);
-        this.rootShell = rootShell;
+    public ToolsInstaller(final Context context) {
+        localBinaryDir = new File(context.getCodeCacheDir(), "bin");
+        this.context = context;
    }

+    @Nullable
    private static File getInstallDir() {
        final String path = System.getenv("PATH");
        if (path == null)
            return INSTALL_DIRS[0];
        final List<String> paths = Arrays.asList(path.split(":"));
-        for (final File dir : INSTALL_DIRS)
+        for (final File dir : INSTALL_DIRS) {
            if (paths.contains(dir.getPath()) && dir.isDirectory())
                return dir;
+        }
        return null;
    }

    public int areInstalled() throws NoRootException {
        if (INSTALL_DIR == null)
-            return OsConstants.ENOENT;
+            return ERROR;
        final StringBuilder script = new StringBuilder();
-        for (final String[] names : EXECUTABLES) {
+        for (final String name : EXECUTABLES) {
            script.append(String.format("cmp -s '%s' '%s' && ",
-                    new File(nativeLibraryDir, names[0]),
-                    new File(INSTALL_DIR, names[1])));
+                    new File(localBinaryDir, name).getAbsolutePath(),
+                    new File(INSTALL_DIR, name).getAbsolutePath()));
        }
        script.append("exit ").append(OsConstants.EALREADY).append(';');
        try {
-            return rootShell.run(null, script.toString());
+            final int ret = Application.getRootShell().run(null, script.toString());
+            if (ret == OsConstants.EALREADY)
+                return willInstallAsMagiskModule() ? YES | MAGISK : YES | SYSTEM;
+            else
+                return willInstallAsMagiskModule() ? NO | MAGISK : NO | SYSTEM;
        } catch (final IOException ignored) {
-            return OsConstants.EXIT_FAILURE;
+            return ERROR;
        }
    }

-    public void ensureToolsAvailable() throws FileNotFoundException, NoRootException {
+    public void ensureToolsAvailable() throws FileNotFoundException {
        synchronized (lock) {
            if (areToolsAvailable == null) {
-                final int ret = symlink();
-                if (ret == OsConstants.EALREADY) {
-                    Log.d(TAG, "Tools were already symlinked into our private binary dir");
+                try {
+                    Log.d(TAG, extract() ? "Tools are now extracted into our private binary dir" :
+                            "Tools were already extracted into our private binary dir");
                    areToolsAvailable = true;
-                } else if (ret == OsConstants.EXIT_SUCCESS) {
-                    Log.d(TAG, "Tools are now symlinked into our private binary dir");
-                    areToolsAvailable = true;
-                } else {
-                    Log.e(TAG, "For some reason, wg and wg-quick are not available at all");
+                } catch (final IOException e) {
+                    Log.e(TAG, "The wg and wg-quick tools are not available", e);
                    areToolsAvailable = false;
                }
            }
            if (!areToolsAvailable)
-                throw new FileNotFoundException("Required tools unavailable");
+                throw new FileNotFoundException(
+                        context.getString(R.string.tools_unavailable_error));
        }
    }

-    public int install() throws NoRootException {
+    public int install() throws NoRootException, IOException {
+        return willInstallAsMagiskModule() ? installMagisk() : installSystem();
+    }
+
+    private int installMagisk() throws NoRootException, IOException {
+        extract();
+        final StringBuilder script = new StringBuilder("set -ex; ");
+
+        script.append("trap 'rm -rf /sbin/.magisk/img/wireguard' INT TERM EXIT; ");
+        script.append(String.format("rm -rf /sbin/.magisk/img/wireguard/; mkdir -p /sbin/.magisk/img/wireguard%s; ", INSTALL_DIR));
+        script.append(String.format("printf 'name=WireGuard Command Line Tools\nversion=%s\nversionCode=%s\nauthor=zx2c4\ndescription=Command line tools for WireGuard\nminMagisk=1500\n' > /sbin/.magisk/img/wireguard/module.prop; ", BuildConfig.VERSION_NAME, BuildConfig.VERSION_CODE));
+        script.append("touch /sbin/.magisk/img/wireguard/auto_mount; ");
+        for (final String name : EXECUTABLES) {
+            final File destination = new File("/sbin/.magisk/img/wireguard" + INSTALL_DIR, name);
+            script.append(String.format("cp '%s' '%s'; chmod 755 '%s'; chcon 'u:object_r:system_file:s0' '%s' || true; ",
+                    new File(localBinaryDir, name), destination, destination, destination));
+        }
+        script.append("trap - INT TERM EXIT;");
+
+        try {
+            return Application.getRootShell().run(null, script.toString()) == 0 ? YES | MAGISK : ERROR;
+        } catch (final IOException ignored) {
+            return ERROR;
+        }
+    }
+
+    private int installSystem() throws NoRootException, IOException {
        if (INSTALL_DIR == null)
            return OsConstants.ENOENT;
+        extract();
        final StringBuilder script = new StringBuilder("set -ex; ");
        script.append("trap 'mount -o ro,remount /system' EXIT; mount -o rw,remount /system; ");
-        for (final String[] names : EXECUTABLES) {
-            final File destination = new File(INSTALL_DIR, names[1]);
+        for (final String name : EXECUTABLES) {
+            final File destination = new File(INSTALL_DIR, name);
            script.append(String.format("cp '%s' '%s'; chmod 755 '%s'; restorecon '%s' || true; ",
-                    new File(nativeLibraryDir, names[0]), destination, destination, destination));
+                    new File(localBinaryDir, name), destination, destination, destination));
        }
        try {
-            return rootShell.run(null, script.toString());
+            return Application.getRootShell().run(null, script.toString()) == 0 ? YES | SYSTEM : ERROR;
        } catch (final IOException ignored) {
-            return OsConstants.EXIT_FAILURE;
+            return ERROR;
        }
    }

-    public int symlink() throws NoRootException {
-        final StringBuilder script = new StringBuilder("set -x; ");
-        for (final String[] names : EXECUTABLES) {
-            script.append(String.format("test '%s' -ef '%s' && ",
-                    new File(nativeLibraryDir, names[0]),
-                    new File(localBinaryDir, names[1])));
+    public boolean extract() throws IOException {
+        localBinaryDir.mkdirs();
+        final File files[] = new File[EXECUTABLES.length];
+        final File tempFiles[] = new File[EXECUTABLES.length];
+        boolean allExist = true;
+        for (int i = 0; i < files.length; ++i) {
+            files[i] = new File(localBinaryDir, EXECUTABLES[i]);
+            tempFiles[i] = new File(localBinaryDir, EXECUTABLES[i] + ".tmp");
+            allExist &= files[i].exists();
        }
-        script.append("exit ").append(OsConstants.EALREADY).append("; set -e; ");
-
-        for (final String[] names : EXECUTABLES) {
-            script.append(String.format("ln -fns '%s' '%s'; ",
-                    new File(nativeLibraryDir, names[0]),
-                    new File(localBinaryDir, names[1])));
+        if (allExist)
+            return false;
+        for (int i = 0; i < files.length; ++i) {
+            if (!SharedLibraryLoader.extractLibrary(context, EXECUTABLES[i], tempFiles[i]))
+                throw new FileNotFoundException("Unable to find " + EXECUTABLES[i]);
+            if (!tempFiles[i].setExecutable(true, false))
+                throw new IOException("Unable to mark " + tempFiles[i].getAbsolutePath() + " as executable");
+            if (!tempFiles[i].renameTo(files[i]))
+                throw new IOException("Unable to rename " + tempFiles[i].getAbsolutePath() + " to " + files[i].getAbsolutePath());
        }
-        script.append("exit ").append(OsConstants.EXIT_SUCCESS).append(';');
+        return true;
+    }

-        try {
-            return rootShell.run(null, script.toString());
-        } catch (final IOException ignored) {
-            return OsConstants.EXIT_FAILURE;
+    private boolean willInstallAsMagiskModule() {
+        synchronized (lock) {
+            if (installAsMagiskModule == null) {
+                try {
+                    installAsMagiskModule = Application.getRootShell().run(null, "[ -d /sbin/.magisk/mirror -a -d /sbin/.magisk/img -a ! -f /cache/.disable_magisk ]") == OsConstants.EXIT_SUCCESS;
+                } catch (final Exception ignored) {
+                    installAsMagiskModule = false;
+                }
+            }
+            return installAsMagiskModule;
        }
    }
 }
@@ -0,0 +1,93 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.viewmodel;
+
+import androidx.databinding.ObservableArrayList;
+import androidx.databinding.ObservableList;
+import android.os.Parcel;
+import android.os.Parcelable;
+
+import com.wireguard.config.BadConfigException;
+import com.wireguard.config.Config;
+import com.wireguard.config.Peer;
+
+import java.util.ArrayList;
+import java.util.Collection;
+
+public class ConfigProxy implements Parcelable {
+    public static final Parcelable.Creator<ConfigProxy> CREATOR = new ConfigProxyCreator();
+
+    private final InterfaceProxy interfaze;
+    private final ObservableList<PeerProxy> peers = new ObservableArrayList<>();
+
+    private ConfigProxy(final Parcel in) {
+        interfaze = in.readParcelable(InterfaceProxy.class.getClassLoader());
+        in.readTypedList(peers, PeerProxy.CREATOR);
+        for (final PeerProxy proxy : peers)
+            proxy.bind(this);
+    }
+
+    public ConfigProxy(final Config other) {
+        interfaze = new InterfaceProxy(other.getInterface());
+        for (final Peer peer : other.getPeers()) {
+            final PeerProxy proxy = new PeerProxy(peer);
+            peers.add(proxy);
+            proxy.bind(this);
+        }
+    }
+
+    public ConfigProxy() {
+        interfaze = new InterfaceProxy();
+    }
+
+    public PeerProxy addPeer() {
+        final PeerProxy proxy = new PeerProxy();
+        peers.add(proxy);
+        proxy.bind(this);
+        return proxy;
+    }
+
+    @Override
+    public int describeContents() {
+        return 0;
+    }
+
+    public InterfaceProxy getInterface() {
+        return interfaze;
+    }
+
+    public ObservableList<PeerProxy> getPeers() {
+        return peers;
+    }
+
+    public Config resolve() throws BadConfigException {
+        final Collection<Peer> resolvedPeers = new ArrayList<>();
+        for (final PeerProxy proxy : peers)
+            resolvedPeers.add(proxy.resolve());
+        return new Config.Builder()
+                .setInterface(interfaze.resolve())
+                .addPeers(resolvedPeers)
+                .build();
+    }
+
+    @Override
+    public void writeToParcel(final Parcel dest, final int flags) {
+        dest.writeParcelable(interfaze, flags);
+        dest.writeTypedList(peers);
+    }
+
+    private static class ConfigProxyCreator implements Parcelable.Creator<ConfigProxy> {
+        @Override
+        public ConfigProxy createFromParcel(final Parcel in) {
+            return new ConfigProxy(in);
+        }
+
+        @Override
+        public ConfigProxy[] newArray(final int size) {
+            return new ConfigProxy[size];
+        }
+    }
+}
@@ -0,0 +1,190 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.viewmodel;
+
+import androidx.databinding.BaseObservable;
+import androidx.databinding.Bindable;
+import androidx.databinding.ObservableArrayList;
+import androidx.databinding.ObservableList;
+import android.os.Parcel;
+import android.os.Parcelable;
+
+import com.wireguard.android.BR;
+import com.wireguard.config.Attribute;
+import com.wireguard.config.BadConfigException;
+import com.wireguard.config.Interface;
+import com.wireguard.crypto.Key;
+import com.wireguard.crypto.KeyFormatException;
+import com.wireguard.crypto.KeyPair;
+
+import java.net.InetAddress;
+import java.util.List;
+
+import java9.util.stream.Collectors;
+import java9.util.stream.StreamSupport;
+
+public class InterfaceProxy extends BaseObservable implements Parcelable {
+    public static final Parcelable.Creator<InterfaceProxy> CREATOR = new InterfaceProxyCreator();
+
+    private final ObservableList<String> excludedApplications = new ObservableArrayList<>();
+    private String addresses;
+    private String dnsServers;
+    private String listenPort;
+    private String mtu;
+    private String privateKey;
+    private String publicKey;
+
+    private InterfaceProxy(final Parcel in) {
+        addresses = in.readString();
+        dnsServers = in.readString();
+        in.readStringList(excludedApplications);
+        listenPort = in.readString();
+        mtu = in.readString();
+        privateKey = in.readString();
+        publicKey = in.readString();
+    }
+
+    public InterfaceProxy(final Interface other) {
+        addresses = Attribute.join(other.getAddresses());
+        final List<String> dnsServerStrings = StreamSupport.stream(other.getDnsServers())
+                .map(InetAddress::getHostAddress)
+                .collect(Collectors.toUnmodifiableList());
+        dnsServers = Attribute.join(dnsServerStrings);
+        excludedApplications.addAll(other.getExcludedApplications());
+        listenPort = other.getListenPort().map(String::valueOf).orElse("");
+        mtu = other.getMtu().map(String::valueOf).orElse("");
+        final KeyPair keyPair = other.getKeyPair();
+        privateKey = keyPair.getPrivateKey().toBase64();
+        publicKey = keyPair.getPublicKey().toBase64();
+    }
+
+    public InterfaceProxy() {
+        addresses = "";
+        dnsServers = "";
+        listenPort = "";
+        mtu = "";
+        privateKey = "";
+        publicKey = "";
+    }
+
+    @Override
+    public int describeContents() {
+        return 0;
+    }
+
+    public void generateKeyPair() {
+        final KeyPair keyPair = new KeyPair();
+        privateKey = keyPair.getPrivateKey().toBase64();
+        publicKey = keyPair.getPublicKey().toBase64();
+        notifyPropertyChanged(BR.privateKey);
+        notifyPropertyChanged(BR.publicKey);
+    }
+
+    @Bindable
+    public String getAddresses() {
+        return addresses;
+    }
+
+    @Bindable
+    public String getDnsServers() {
+        return dnsServers;
+    }
+
+    public ObservableList<String> getExcludedApplications() {
+        return excludedApplications;
+    }
+
+    @Bindable
+    public String getListenPort() {
+        return listenPort;
+    }
+
+    @Bindable
+    public String getMtu() {
+        return mtu;
+    }
+
+    @Bindable
+    public String getPrivateKey() {
+        return privateKey;
+    }
+
+    @Bindable
+    public String getPublicKey() {
+        return publicKey;
+    }
+
+    public Interface resolve() throws BadConfigException {
+        final Interface.Builder builder = new Interface.Builder();
+        if (!addresses.isEmpty())
+            builder.parseAddresses(addresses);
+        if (!dnsServers.isEmpty())
+            builder.parseDnsServers(dnsServers);
+        if (!excludedApplications.isEmpty())
+            builder.excludeApplications(excludedApplications);
+        if (!listenPort.isEmpty())
+            builder.parseListenPort(listenPort);
+        if (!mtu.isEmpty())
+            builder.parseMtu(mtu);
+        if (!privateKey.isEmpty())
+            builder.parsePrivateKey(privateKey);
+        return builder.build();
+    }
+
+    public void setAddresses(final String addresses) {
+        this.addresses = addresses;
+        notifyPropertyChanged(BR.addresses);
+    }
+
+    public void setDnsServers(final String dnsServers) {
+        this.dnsServers = dnsServers;
+        notifyPropertyChanged(BR.dnsServers);
+    }
+
+    public void setListenPort(final String listenPort) {
+        this.listenPort = listenPort;
+        notifyPropertyChanged(BR.listenPort);
+    }
+
+    public void setMtu(final String mtu) {
+        this.mtu = mtu;
+        notifyPropertyChanged(BR.mtu);
+    }
+
+    public void setPrivateKey(final String privateKey) {
+        this.privateKey = privateKey;
+        try {
+            publicKey = new KeyPair(Key.fromBase64(privateKey)).getPublicKey().toBase64();
+        } catch (final KeyFormatException ignored) {
+            publicKey = "";
+        }
+        notifyPropertyChanged(BR.privateKey);
+        notifyPropertyChanged(BR.publicKey);
+    }
+
+    @Override
+    public void writeToParcel(final Parcel dest, final int flags) {
+        dest.writeString(addresses);
+        dest.writeString(dnsServers);
+        dest.writeStringList(excludedApplications);
+        dest.writeString(listenPort);
+        dest.writeString(mtu);
+        dest.writeString(privateKey);
+        dest.writeString(publicKey);
+    }
+
+    private static class InterfaceProxyCreator implements Parcelable.Creator<InterfaceProxy> {
+        @Override
+        public InterfaceProxy createFromParcel(final Parcel in) {
+            return new InterfaceProxy(in);
+        }
+
+        @Override
+        public InterfaceProxy[] newArray(final int size) {
+            return new InterfaceProxy[size];
+        }
+    }
+}
@@ -0,0 +1,380 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.viewmodel;
+
+import androidx.databinding.BaseObservable;
+import androidx.databinding.Bindable;
+import androidx.databinding.Observable;
+import androidx.databinding.ObservableList;
+import android.os.Parcel;
+import android.os.Parcelable;
+import androidx.annotation.Nullable;
+
+import com.wireguard.android.BR;
+import com.wireguard.config.Attribute;
+import com.wireguard.config.BadConfigException;
+import com.wireguard.config.InetEndpoint;
+import com.wireguard.config.Peer;
+import com.wireguard.crypto.Key;
+
+import java.lang.ref.WeakReference;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+
+import java9.util.Lists;
+import java9.util.Sets;
+import java9.util.stream.Collectors;
+import java9.util.stream.Stream;
+
+public class PeerProxy extends BaseObservable implements Parcelable {
+    public static final Parcelable.Creator<PeerProxy> CREATOR = new PeerProxyCreator();
+    private static final Set<String> IPV4_PUBLIC_NETWORKS = new LinkedHashSet<>(Lists.of(
+            "0.0.0.0/5", "8.0.0.0/7", "11.0.0.0/8", "12.0.0.0/6", "16.0.0.0/4", "32.0.0.0/3",
+            "64.0.0.0/2", "128.0.0.0/3", "160.0.0.0/5", "168.0.0.0/6", "172.0.0.0/12",
+            "172.32.0.0/11", "172.64.0.0/10", "172.128.0.0/9", "173.0.0.0/8", "174.0.0.0/7",
+            "176.0.0.0/4", "192.0.0.0/9", "192.128.0.0/11", "192.160.0.0/13", "192.169.0.0/16",
+            "192.170.0.0/15", "192.172.0.0/14", "192.176.0.0/12", "192.192.0.0/10",
+            "193.0.0.0/8", "194.0.0.0/7", "196.0.0.0/6", "200.0.0.0/5", "208.0.0.0/4"
+    ));
+    private static final Set<String> IPV4_WILDCARD = Sets.of("0.0.0.0/0");
+
+    private final List<String> dnsRoutes = new ArrayList<>();
+    private String allowedIps;
+    private AllowedIpsState allowedIpsState = AllowedIpsState.INVALID;
+    private String endpoint;
+    @Nullable private InterfaceDnsListener interfaceDnsListener;
+    @Nullable private ConfigProxy owner;
+    @Nullable private PeerListListener peerListListener;
+    private String persistentKeepalive;
+    private String preSharedKey;
+    private String publicKey;
+    private int totalPeers;
+
+    private PeerProxy(final Parcel in) {
+        allowedIps = in.readString();
+        endpoint = in.readString();
+        persistentKeepalive = in.readString();
+        preSharedKey = in.readString();
+        publicKey = in.readString();
+    }
+
+    public PeerProxy(final Peer other) {
+        allowedIps = Attribute.join(other.getAllowedIps());
+        endpoint = other.getEndpoint().map(InetEndpoint::toString).orElse("");
+        persistentKeepalive = other.getPersistentKeepalive().map(String::valueOf).orElse("");
+        preSharedKey = other.getPreSharedKey().map(Key::toBase64).orElse("");
+        publicKey = other.getPublicKey().toBase64();
+    }
+
+    public PeerProxy() {
+        allowedIps = "";
+        endpoint = "";
+        persistentKeepalive = "";
+        preSharedKey = "";
+        publicKey = "";
+    }
+
+    public void bind(final ConfigProxy owner) {
+        final InterfaceProxy interfaze = owner.getInterface();
+        final ObservableList<PeerProxy> peers = owner.getPeers();
+        if (interfaceDnsListener == null)
+            interfaceDnsListener = new InterfaceDnsListener(this);
+        interfaze.addOnPropertyChangedCallback(interfaceDnsListener);
+        setInterfaceDns(interfaze.getDnsServers());
+        if (peerListListener == null)
+            peerListListener = new PeerListListener(this);
+        peers.addOnListChangedCallback(peerListListener);
+        setTotalPeers(peers.size());
+        this.owner = owner;
+    }
+
+    private void calculateAllowedIpsState() {
+        final AllowedIpsState newState;
+        if (totalPeers == 1) {
+            // String comparison works because we only care if allowedIps is a superset of one of
+            // the above sets of (valid) *networks*. We are not checking for a superset based on
+            // the individual addresses in each set.
+            final Collection<String> networkStrings = getAllowedIpsSet();
+            // If allowedIps contains both the wildcard and the public networks, then private
+            // networks aren't excluded!
+            if (networkStrings.containsAll(IPV4_WILDCARD))
+                newState = AllowedIpsState.CONTAINS_IPV4_WILDCARD;
+            else if (networkStrings.containsAll(IPV4_PUBLIC_NETWORKS))
+                newState = AllowedIpsState.CONTAINS_IPV4_PUBLIC_NETWORKS;
+            else
+                newState = AllowedIpsState.OTHER;
+        } else {
+            newState = AllowedIpsState.INVALID;
+        }
+        if (newState != allowedIpsState) {
+            allowedIpsState = newState;
+            notifyPropertyChanged(BR.ableToExcludePrivateIps);
+            notifyPropertyChanged(BR.excludingPrivateIps);
+        }
+    }
+
+    @Override
+    public int describeContents() {
+        return 0;
+    }
+
+    @Bindable
+    public String getAllowedIps() {
+        return allowedIps;
+    }
+
+    private Set<String> getAllowedIpsSet() {
+        return new LinkedHashSet<>(Lists.of(Attribute.split(allowedIps)));
+    }
+
+    @Bindable
+    public String getEndpoint() {
+        return endpoint;
+    }
+
+    @Bindable
+    public String getPersistentKeepalive() {
+        return persistentKeepalive;
+    }
+
+    @Bindable
+    public String getPreSharedKey() {
+        return preSharedKey;
+    }
+
+    @Bindable
+    public String getPublicKey() {
+        return publicKey;
+    }
+
+    @Bindable
+    public boolean isAbleToExcludePrivateIps() {
+        return allowedIpsState == AllowedIpsState.CONTAINS_IPV4_PUBLIC_NETWORKS
+                || allowedIpsState == AllowedIpsState.CONTAINS_IPV4_WILDCARD;
+    }
+
+    @Bindable
+    public boolean isExcludingPrivateIps() {
+        return allowedIpsState == AllowedIpsState.CONTAINS_IPV4_PUBLIC_NETWORKS;
+    }
+
+    public Peer resolve() throws BadConfigException {
+        final Peer.Builder builder = new Peer.Builder();
+        if (!allowedIps.isEmpty())
+            builder.parseAllowedIPs(allowedIps);
+        if (!endpoint.isEmpty())
+            builder.parseEndpoint(endpoint);
+        if (!persistentKeepalive.isEmpty())
+            builder.parsePersistentKeepalive(persistentKeepalive);
+        if (!preSharedKey.isEmpty())
+            builder.parsePreSharedKey(preSharedKey);
+        if (!publicKey.isEmpty())
+            builder.parsePublicKey(publicKey);
+        return builder.build();
+    }
+
+    public void setAllowedIps(final String allowedIps) {
+        this.allowedIps = allowedIps;
+        notifyPropertyChanged(BR.allowedIps);
+        calculateAllowedIpsState();
+    }
+
+    public void setEndpoint(final String endpoint) {
+        this.endpoint = endpoint;
+        notifyPropertyChanged(BR.endpoint);
+    }
+
+    public void setExcludingPrivateIps(final boolean excludingPrivateIps) {
+        if (!isAbleToExcludePrivateIps() || isExcludingPrivateIps() == excludingPrivateIps)
+            return;
+        final Set<String> oldNetworks = excludingPrivateIps ? IPV4_WILDCARD : IPV4_PUBLIC_NETWORKS;
+        final Set<String> newNetworks = excludingPrivateIps ? IPV4_PUBLIC_NETWORKS : IPV4_WILDCARD;
+        final Collection<String> input = getAllowedIpsSet();
+        final int outputSize = input.size() - oldNetworks.size() + newNetworks.size();
+        final Collection<String> output = new LinkedHashSet<>(outputSize);
+        boolean replaced = false;
+        // Replace the first instance of the wildcard with the public network list, or vice versa.
+        for (final String network : input) {
+            if (oldNetworks.contains(network)) {
+                if (!replaced) {
+                    for (final String replacement : newNetworks)
+                        if (!output.contains(replacement))
+                            output.add(replacement);
+                    replaced = true;
+                }
+            } else if (!output.contains(network)) {
+                output.add(network);
+            }
+        }
+        // DNS servers only need to handled specially when we're excluding private IPs.
+        if (excludingPrivateIps)
+            output.addAll(dnsRoutes);
+        else
+            output.removeAll(dnsRoutes);
+        allowedIps = Attribute.join(output);
+        allowedIpsState = excludingPrivateIps ?
+                AllowedIpsState.CONTAINS_IPV4_PUBLIC_NETWORKS : AllowedIpsState.CONTAINS_IPV4_WILDCARD;
+        notifyPropertyChanged(BR.allowedIps);
+        notifyPropertyChanged(BR.excludingPrivateIps);
+    }
+
+    private void setInterfaceDns(final CharSequence dnsServers) {
+        final List<String> newDnsRoutes = Stream.of(Attribute.split(dnsServers))
+                .filter(server -> !server.contains(":"))
+                .map(server -> server + "/32")
+                .collect(Collectors.toUnmodifiableList());
+        if (allowedIpsState == AllowedIpsState.CONTAINS_IPV4_PUBLIC_NETWORKS) {
+            final Collection<String> input = getAllowedIpsSet();
+            final Collection<String> output = new LinkedHashSet<>(input.size() + 1);
+            // Yes, this is quadratic in the number of DNS servers, but most users have 1 or 2.
+            for (final String network : input)
+                if (!dnsRoutes.contains(network) || newDnsRoutes.contains(network))
+                    output.add(network);
+            // Since output is a Set, this does the Right Thing™ (it does not duplicate networks).
+            output.addAll(newDnsRoutes);
+            // None of the public networks are /32s, so this cannot change the AllowedIPs state.
+            allowedIps = Attribute.join(output);
+            notifyPropertyChanged(BR.allowedIps);
+        }
+        dnsRoutes.clear();
+        dnsRoutes.addAll(newDnsRoutes);
+    }
+
+    public void setPersistentKeepalive(final String persistentKeepalive) {
+        this.persistentKeepalive = persistentKeepalive;
+        notifyPropertyChanged(BR.persistentKeepalive);
+    }
+
+    public void setPreSharedKey(final String preSharedKey) {
+        this.preSharedKey = preSharedKey;
+        notifyPropertyChanged(BR.preSharedKey);
+    }
+
+    public void setPublicKey(final String publicKey) {
+        this.publicKey = publicKey;
+        notifyPropertyChanged(BR.publicKey);
+    }
+
+    private void setTotalPeers(final int totalPeers) {
+        if (this.totalPeers == totalPeers)
+            return;
+        this.totalPeers = totalPeers;
+        calculateAllowedIpsState();
+    }
+
+    public void unbind() {
+        if (owner == null)
+            return;
+        final InterfaceProxy interfaze = owner.getInterface();
+        final ObservableList<PeerProxy> peers = owner.getPeers();
+        if (interfaceDnsListener != null)
+            interfaze.removeOnPropertyChangedCallback(interfaceDnsListener);
+        if (peerListListener != null)
+            peers.removeOnListChangedCallback(peerListListener);
+        peers.remove(this);
+        setInterfaceDns("");
+        setTotalPeers(0);
+        owner = null;
+    }
+
+    @Override
+    public void writeToParcel(final Parcel dest, final int flags) {
+        dest.writeString(allowedIps);
+        dest.writeString(endpoint);
+        dest.writeString(persistentKeepalive);
+        dest.writeString(preSharedKey);
+        dest.writeString(publicKey);
+    }
+
+    private enum AllowedIpsState {
+        CONTAINS_IPV4_PUBLIC_NETWORKS,
+        CONTAINS_IPV4_WILDCARD,
+        INVALID,
+        OTHER
+    }
+
+    private static final class InterfaceDnsListener extends Observable.OnPropertyChangedCallback {
+        private final WeakReference<PeerProxy> weakPeerProxy;
+
+        private InterfaceDnsListener(final PeerProxy peerProxy) {
+            weakPeerProxy = new WeakReference<>(peerProxy);
+        }
+
+        @Override
+        public void onPropertyChanged(final Observable sender, final int propertyId) {
+            @Nullable final PeerProxy peerProxy = weakPeerProxy.get();
+            if (peerProxy == null) {
+                sender.removeOnPropertyChangedCallback(this);
+                return;
+            }
+            // This shouldn't be possible, but try to avoid a ClassCastException anyway.
+            if (!(sender instanceof InterfaceProxy))
+                return;
+            if (!(propertyId == BR._all || propertyId == BR.dnsServers))
+                return;
+            peerProxy.setInterfaceDns(((InterfaceProxy) sender).getDnsServers());
+        }
+    }
+
+    private static final class PeerListListener
+            extends ObservableList.OnListChangedCallback<ObservableList<PeerProxy>> {
+        private final WeakReference<PeerProxy> weakPeerProxy;
+
+        private PeerListListener(final PeerProxy peerProxy) {
+            weakPeerProxy = new WeakReference<>(peerProxy);
+        }
+
+        @Override
+        public void onChanged(final ObservableList<PeerProxy> sender) {
+            @Nullable final PeerProxy peerProxy = weakPeerProxy.get();
+            if (peerProxy == null) {
+                sender.removeOnListChangedCallback(this);
+                return;
+            }
+            peerProxy.setTotalPeers(sender.size());
+        }
+
+        @Override
+        public void onItemRangeChanged(final ObservableList<PeerProxy> sender,
+                                       final int positionStart, final int itemCount) {
+            // Do nothing.
+        }
+
+        @Override
+        public void onItemRangeInserted(final ObservableList<PeerProxy> sender,
+                                        final int positionStart, final int itemCount) {
+            onChanged(sender);
+        }
+
+        @Override
+        public void onItemRangeMoved(final ObservableList<PeerProxy> sender,
+                                     final int fromPosition, final int toPosition,
+                                     final int itemCount) {
+            // Do nothing.
+        }
+
+        @Override
+        public void onItemRangeRemoved(final ObservableList<PeerProxy> sender,
+                                       final int positionStart, final int itemCount) {
+            onChanged(sender);
+        }
+    }
+
+    private static class PeerProxyCreator implements Parcelable.Creator<PeerProxy> {
+        @Override
+        public PeerProxy createFromParcel(final Parcel in) {
+            return new PeerProxy(in);
+        }
+
+        @Override
+        public PeerProxy[] newArray(final int size) {
+            return new PeerProxy[size];
+        }
+    }
+}
@@ -1,16 +1,16 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.widget;

+import androidx.annotation.Nullable;
 import android.text.InputFilter;
 import android.text.SpannableStringBuilder;
 import android.text.Spanned;

-import com.wireguard.crypto.KeyEncoding;
+import com.wireguard.crypto.Key;

 /**
 * InputFilter for entering WireGuard private/public keys encoded with base64.
@@ -25,6 +25,7 @@ public class KeyInputFilter implements InputFilter {
        return new KeyInputFilter();
    }

+    @Nullable
    @Override
    public CharSequence filter(final CharSequence source,
                               final int sStart, final int sEnd,
@@ -38,9 +39,9 @@ public class KeyInputFilter implements InputFilter {
            final int dIndex = dStart + (sIndex - sStart);
            // Restrict characters to the base64 character set.
            // Ensure adding this character does not push the length over the limit.
-            if (((dIndex + 1 < KeyEncoding.KEY_LENGTH_BASE64 && isAllowed(c)) ||
-                    (dIndex + 1 == KeyEncoding.KEY_LENGTH_BASE64 && c == '=')) &&
-                    dLength + (sIndex - sStart) < KeyEncoding.KEY_LENGTH_BASE64) {
+            if (((dIndex + 1 < Key.Format.BASE64.getLength() && isAllowed(c)) ||
+                    (dIndex + 1 == Key.Format.BASE64.getLength() && c == '=')) &&
+                    dLength + (sIndex - sStart) < Key.Format.BASE64.getLength()) {
                ++rIndex;
            } else {
                if (replacement == null)
@@ -0,0 +1,59 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.widget;
+
+import android.content.Context;
+import android.util.AttributeSet;
+import android.widget.RelativeLayout;
+
+import com.wireguard.android.R;
+
+public class MultiselectableRelativeLayout extends RelativeLayout {
+    private static final int[] STATE_MULTISELECTED = {R.attr.state_multiselected};
+    private boolean multiselected;
+
+    public MultiselectableRelativeLayout(final Context context) {
+        super(context);
+    }
+
+    public MultiselectableRelativeLayout(final Context context, final AttributeSet attrs) {
+        super(context, attrs);
+    }
+
+    public MultiselectableRelativeLayout(final Context context, final AttributeSet attrs, final int defStyleAttr) {
+        super(context, attrs, defStyleAttr);
+    }
+
+    public MultiselectableRelativeLayout(final Context context, final AttributeSet attrs, final int defStyleAttr, final int defStyleRes) {
+        super(context, attrs, defStyleAttr, defStyleRes);
+    }
+
+    @Override
+    protected int[] onCreateDrawableState(final int extraSpace) {
+        if (multiselected) {
+            final int[] drawableState = super.onCreateDrawableState(extraSpace + 1);
+            mergeDrawableStates(drawableState, STATE_MULTISELECTED);
+            return drawableState;
+        }
+        return super.onCreateDrawableState(extraSpace);
+    }
+
+    public void setMultiSelected(final boolean on) {
+        if (!multiselected) {
+            multiselected = true;
+            refreshDrawableState();
+        }
+        setActivated(on);
+    }
+
+    public void setSingleSelected(final boolean on) {
+        if (multiselected) {
+            multiselected = false;
+            refreshDrawableState();
+        }
+        setActivated(on);
+    }
+}
@@ -1,11 +1,11 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.widget;

+import androidx.annotation.Nullable;
 import android.text.InputFilter;
 import android.text.SpannableStringBuilder;
 import android.text.Spanned;
@@ -25,6 +25,7 @@ public class NameInputFilter implements InputFilter {
        return new NameInputFilter();
    }

+    @Nullable
    @Override
    public CharSequence filter(final CharSequence source,
                               final int sStart, final int sEnd,
@@ -0,0 +1,217 @@
+/*
+ * Copyright © 2018 The Android Open Source Project
+ * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.widget;
+
+import android.animation.ObjectAnimator;
+import android.animation.ValueAnimator;
+import android.content.res.ColorStateList;
+import android.graphics.Canvas;
+import android.graphics.ColorFilter;
+import android.graphics.Matrix;
+import android.graphics.Paint;
+import android.graphics.Path;
+import android.graphics.Path.Direction;
+import android.graphics.PixelFormat;
+import android.graphics.PorterDuff.Mode;
+import android.graphics.Rect;
+import android.graphics.RectF;
+import android.graphics.Region;
+import android.graphics.drawable.Drawable;
+import android.os.Build;
+import androidx.annotation.ColorInt;
+import androidx.annotation.IntRange;
+import androidx.annotation.Nullable;
+import androidx.annotation.RequiresApi;
+import android.util.FloatProperty;
+
+@RequiresApi(Build.VERSION_CODES.N)
+public class SlashDrawable extends Drawable {
+
+    private static final float CENTER_X = 10.65f;
+    private static final float CENTER_Y = 11.869239f;
+    private static final float CORNER_RADIUS = Build.VERSION.SDK_INT < Build.VERSION_CODES.O ? 0f : 1f;
+    // Draw the slash washington-monument style; rotate to no-u-turn style
+    private static final float DEFAULT_ROTATION = -45f;
+    private static final long QS_ANIM_LENGTH = 350;
+    private static final float SCALE = 24f;
+    private static final float SLASH_HEIGHT = 28f;
+    // These values are derived in un-rotated (vertical) orientation
+    private static final float SLASH_WIDTH = 1.8384776f;
+    // Bottom is derived during animation
+    private static final float LEFT = (CENTER_X - (SLASH_WIDTH / 2)) / SCALE;
+    private static final float RIGHT = (CENTER_X + (SLASH_WIDTH / 2)) / SCALE;
+    private static final float TOP = (CENTER_Y - (SLASH_HEIGHT / 2)) / SCALE;
+    private static final FloatProperty mSlashLengthProp = new FloatProperty<SlashDrawable>("slashLength") {
+        @Override
+        public Float get(final SlashDrawable object) {
+            return object.mCurrentSlashLength;
+        }
+
+        @Override
+        public void setValue(final SlashDrawable object, final float value) {
+            object.mCurrentSlashLength = value;
+        }
+    };
+    private final Drawable mDrawable;
+    private final Paint mPaint = new Paint(Paint.ANTI_ALIAS_FLAG);
+    private final Path mPath = new Path();
+    private final RectF mSlashRect = new RectF(0, 0, 0, 0);
+    private boolean mAnimationEnabled = true;
+    // Animate this value on change
+    private float mCurrentSlashLength;
+    private float mRotation;
+    private boolean mSlashed;
+
+    public SlashDrawable(final Drawable d) {
+        mDrawable = d;
+    }
+
+    @SuppressWarnings("deprecation")
+    @Override
+    public void draw(final Canvas canvas) {
+        canvas.save();
+        final Matrix m = new Matrix();
+        final int width = getBounds().width();
+        final int height = getBounds().height();
+        final float radiusX = scale(CORNER_RADIUS, width);
+        final float radiusY = scale(CORNER_RADIUS, height);
+        updateRect(
+                scale(LEFT, width),
+                scale(TOP, height),
+                scale(RIGHT, width),
+                scale(TOP + mCurrentSlashLength, height)
+        );
+
+        mPath.reset();
+        // Draw the slash vertically
+        mPath.addRoundRect(mSlashRect, radiusX, radiusY, Direction.CW);
+        // Rotate -45 + desired rotation
+        m.setRotate(mRotation + DEFAULT_ROTATION, width / 2, height / 2);
+        mPath.transform(m);
+        canvas.drawPath(mPath, mPaint);
+
+        // Rotate back to vertical
+        m.setRotate(-mRotation - DEFAULT_ROTATION, width / 2, height / 2);
+        mPath.transform(m);
+
+        // Draw another rect right next to the first, for clipping
+        m.setTranslate(mSlashRect.width(), 0);
+        mPath.transform(m);
+        mPath.addRoundRect(mSlashRect, 1.0f * width, 1.0f * height, Direction.CW);
+        m.setRotate(mRotation + DEFAULT_ROTATION, width / 2, height / 2);
+        mPath.transform(m);
+
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O)
+            canvas.clipPath(mPath, Region.Op.DIFFERENCE);
+        else
+            canvas.clipOutPath(mPath);
+
+        mDrawable.draw(canvas);
+        canvas.restore();
+    }
+
+    @Override
+    public int getIntrinsicHeight() {
+        return mDrawable.getIntrinsicHeight();
+    }
+
+    @Override
+    public int getIntrinsicWidth() {
+        return mDrawable.getIntrinsicWidth();
+    }
+
+    @SuppressWarnings("deprecation")
+    @Override
+    public int getOpacity() {
+        return PixelFormat.OPAQUE;
+    }
+
+    @Override
+    protected void onBoundsChange(final Rect bounds) {
+        super.onBoundsChange(bounds);
+        mDrawable.setBounds(bounds);
+    }
+
+    private float scale(final float frac, final int width) {
+        return frac * width;
+    }
+
+    @Override
+    public void setAlpha(@IntRange(from = 0, to = 255) final int alpha) {
+        mDrawable.setAlpha(alpha);
+        mPaint.setAlpha(alpha);
+    }
+
+    public void setAnimationEnabled(final boolean enabled) {
+        mAnimationEnabled = enabled;
+    }
+
+    @Override
+    public void setColorFilter(@Nullable final ColorFilter colorFilter) {
+        mDrawable.setColorFilter(colorFilter);
+        mPaint.setColorFilter(colorFilter);
+    }
+
+    private void setDrawableTintList(@Nullable final ColorStateList tint) {
+        mDrawable.setTintList(tint);
+    }
+
+    public void setRotation(final float rotation) {
+        if (mRotation == rotation)
+            return;
+        mRotation = rotation;
+        invalidateSelf();
+    }
+
+    @SuppressWarnings("unchecked")
+    public void setSlashed(final boolean slashed) {
+        if (mSlashed == slashed) return;
+
+        mSlashed = slashed;
+
+        final float end = mSlashed ? SLASH_HEIGHT / SCALE : 0f;
+        final float start = mSlashed ? 0f : SLASH_HEIGHT / SCALE;
+
+        if (mAnimationEnabled) {
+            final ObjectAnimator anim = ObjectAnimator.ofFloat(this, mSlashLengthProp, start, end);
+            anim.addUpdateListener((ValueAnimator valueAnimator) -> invalidateSelf());
+            anim.setDuration(QS_ANIM_LENGTH);
+            anim.start();
+        } else {
+            mCurrentSlashLength = end;
+            invalidateSelf();
+        }
+    }
+
+    @Override
+    public void setTint(@ColorInt final int tintColor) {
+        super.setTint(tintColor);
+        mDrawable.setTint(tintColor);
+        mPaint.setColor(tintColor);
+    }
+
+    @Override
+    public void setTintList(@Nullable final ColorStateList tint) {
+        super.setTintList(tint);
+        setDrawableTintList(tint);
+        mPaint.setColor(tint == null ? 0 : tint.getDefaultColor());
+        invalidateSelf();
+    }
+
+    @Override
+    public void setTintMode(final Mode tintMode) {
+        super.setTintMode(tintMode);
+        mDrawable.setTintMode(tintMode);
+    }
+
+    private void updateRect(final float left, final float top, final float right, final float bottom) {
+        mSlashRect.left = left;
+        mSlashRect.top = top;
+        mSlashRect.right = right;
+        mSlashRect.bottom = bottom;
+    }
+}
@@ -1,5 +1,6 @@
 /*
 * Copyright © 2013 The Android Open Source Project
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

@@ -7,22 +8,23 @@ package com.wireguard.android.widget;

 import android.content.Context;
 import android.os.Parcelable;
+import androidx.annotation.Nullable;
 import android.util.AttributeSet;
 import android.widget.Switch;

 public class ToggleSwitch extends Switch {
    private boolean isRestoringState;
-    private OnBeforeCheckedChangeListener listener;
-
-    @SuppressWarnings({"SameParameterValue", "WeakerAccess"})
-    public ToggleSwitch(final Context context, final AttributeSet attrs) {
-        super(context, attrs);
-    }
+    @Nullable private OnBeforeCheckedChangeListener listener;

    public ToggleSwitch(final Context context) {
        this(context, null);
    }

+    @SuppressWarnings({"SameParameterValue", "WeakerAccess"})
+    public ToggleSwitch(final Context context, @Nullable final AttributeSet attrs) {
+        super(context, attrs);
+    }
+
    @Override
    public void onRestoreInstanceState(final Parcelable state) {
        isRestoringState = true;
@@ -1,96 +0,0 @@
-/*
- * Copyright © 2014 Jerzy Chalupski
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-package com.wireguard.android.widget.fab;
-
-import android.content.Context;
-import android.content.res.TypedArray;
-import android.graphics.Canvas;
-import android.graphics.Paint;
-import android.graphics.Paint.Style;
-import android.graphics.drawable.Drawable;
-import android.graphics.drawable.ShapeDrawable;
-import android.graphics.drawable.shapes.Shape;
-import android.support.annotation.ColorRes;
-import android.support.annotation.DrawableRes;
-import android.util.AttributeSet;
-
-import com.wireguard.android.R;
-
-public class AddFloatingActionButton extends FloatingActionButton {
-    int mPlusColor;
-
-    public AddFloatingActionButton(final Context context) {
-        this(context, null);
-    }
-
-    public AddFloatingActionButton(final Context context, final AttributeSet attrs) {
-        super(context, attrs);
-    }
-
-    public AddFloatingActionButton(final Context context, final AttributeSet attrs, final int defStyle) {
-        super(context, attrs, defStyle);
-    }
-
-    @Override
-    void init(final Context context, final AttributeSet attributeSet) {
-        final TypedArray attr = context.obtainStyledAttributes(attributeSet, R.styleable.AddFloatingActionButton, 0, 0);
-        mPlusColor = attr.getColor(R.styleable.AddFloatingActionButton_fab_plusIconColor, getColor(android.R.color.white));
-        attr.recycle();
-
-        super.init(context, attributeSet);
-    }
-
-    /**
-     * @return the current Color of plus icon.
-     */
-    public int getPlusColor() {
-        return mPlusColor;
-    }
-
-    public void setPlusColor(final int color) {
-        if (mPlusColor != color) {
-            mPlusColor = color;
-            updateBackground();
-        }
-    }
-
-    public void setPlusColorResId(@ColorRes int plusColor) {
-        setPlusColor(getColor(plusColor));
-    }
-
-    @Override
-    public void setIcon(@DrawableRes final int icon) {
-        throw new UnsupportedOperationException("Use FloatingActionButton if you want to use custom icon");
-    }
-
-    @Override
-    Drawable getIconDrawable() {
-        final float iconSize = getDimension(R.dimen.fab_icon_size);
-        final float iconHalfSize = iconSize / 2f;
-
-        final float plusSize = getDimension(R.dimen.fab_plus_icon_size);
-        final float plusHalfStroke = getDimension(R.dimen.fab_plus_icon_stroke) / 2f;
-        final float plusOffset = (iconSize - plusSize) / 2f;
-
-        final Shape shape = new Shape() {
-            @Override
-            public void draw(final Canvas canvas, final Paint paint) {
-                canvas.drawRect(plusOffset, iconHalfSize - plusHalfStroke, iconSize - plusOffset, iconHalfSize + plusHalfStroke, paint);
-                canvas.drawRect(iconHalfSize - plusHalfStroke, plusOffset, iconHalfSize + plusHalfStroke, iconSize - plusOffset, paint);
-            }
-        };
-
-        final ShapeDrawable drawable = new ShapeDrawable(shape);
-
-        final Paint paint = drawable.getPaint();
-        paint.setColor(mPlusColor);
-        paint.setStyle(Style.FILL);
-        paint.setAntiAlias(true);
-
-        return drawable;
-    }
-}
@@ -1,409 +0,0 @@
-/*
- * Copyright © 2014 Jerzy Chalupski
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-package com.wireguard.android.widget.fab;
-
-import android.content.Context;
-import android.content.res.TypedArray;
-import android.graphics.*;
-import android.graphics.Paint.Style;
-import android.graphics.Shader.TileMode;
-import android.graphics.drawable.*;
-import android.graphics.drawable.ShapeDrawable.ShaderFactory;
-import android.graphics.drawable.shapes.OvalShape;
-import android.support.annotation.*;
-import android.support.v7.widget.AppCompatImageButton;
-import android.util.AttributeSet;
-import android.widget.TextView;
-
-import com.wireguard.android.R;
-
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-
-public class FloatingActionButton extends AppCompatImageButton {
-
-    public static final int SIZE_NORMAL = 0;
-    public static final int SIZE_MINI = 1;
-    int mColorNormal;
-    int mColorPressed;
-    int mColorDisabled;
-    String mTitle;
-    boolean mStrokeVisible;
-    @DrawableRes
-    private int mIcon;
-    private Drawable mIconDrawable;
-    private int mSize;
-
-    private float mCircleSize;
-    private float mShadowRadius;
-    private float mShadowOffset;
-    private int mDrawableSize;
-    public FloatingActionButton(final Context context) {
-        this(context, null);
-    }
-
-    public FloatingActionButton(final Context context, final AttributeSet attrs) {
-        super(context, attrs);
-        init(context, attrs);
-    }
-
-    public FloatingActionButton(Context context, AttributeSet attrs, int defStyle) {
-        super(context, attrs, defStyle);
-        init(context, attrs);
-    }
-
-    void init(final Context context, final AttributeSet attributeSet) {
-        final TypedArray attr = context.obtainStyledAttributes(attributeSet, R.styleable.FloatingActionButton, 0, 0);
-        mColorNormal = attr.getColor(R.styleable.FloatingActionButton_fab_colorNormal, getColor(android.R.color.holo_blue_dark));
-        mColorPressed = attr.getColor(R.styleable.FloatingActionButton_fab_colorPressed, getColor(android.R.color.holo_blue_light));
-        mColorDisabled = attr.getColor(R.styleable.FloatingActionButton_fab_colorDisabled, getColor(android.R.color.darker_gray));
-        mSize = attr.getInt(R.styleable.FloatingActionButton_fab_size, SIZE_NORMAL);
-        mIcon = attr.getResourceId(R.styleable.FloatingActionButton_fab_icon, 0);
-        mTitle = attr.getString(R.styleable.FloatingActionButton_fab_title);
-        mStrokeVisible = attr.getBoolean(R.styleable.FloatingActionButton_fab_stroke_visible, true);
-        attr.recycle();
-
-        updateCircleSize();
-        mShadowRadius = getDimension(R.dimen.fab_shadow_radius);
-        mShadowOffset = getDimension(R.dimen.fab_shadow_offset);
-        updateDrawableSize();
-
-        updateBackground();
-    }
-
-    private void updateDrawableSize() {
-        mDrawableSize = (int) (mCircleSize + 2 * mShadowRadius);
-    }
-
-    private void updateCircleSize() {
-        mCircleSize = getDimension(mSize == SIZE_NORMAL ? R.dimen.fab_size_normal : R.dimen.fab_size_mini);
-    }
-
-    @FAB_SIZE
-    public int getSize() {
-        return mSize;
-    }
-
-    public void setSize(@FAB_SIZE final int size) {
-        if (size != SIZE_MINI && size != SIZE_NORMAL) {
-            throw new IllegalArgumentException("Use @FAB_SIZE constants only!");
-        }
-
-        if (mSize != size) {
-            mSize = size;
-            updateCircleSize();
-            updateDrawableSize();
-            updateBackground();
-        }
-    }
-
-    public void setIcon(@DrawableRes final int icon) {
-        if (mIcon != icon) {
-            mIcon = icon;
-            mIconDrawable = null;
-            updateBackground();
-        }
-    }
-
-    /**
-     * @return the current Color for normal state.
-     */
-    public int getColorNormal() {
-        return mColorNormal;
-    }
-
-    public void setColorNormal(final int color) {
-        if (mColorNormal != color) {
-            mColorNormal = color;
-            updateBackground();
-        }
-    }
-
-    public void setColorNormalResId(@ColorRes final int colorNormal) {
-        setColorNormal(getColor(colorNormal));
-    }
-
-    /**
-     * @return the current color for pressed state.
-     */
-    public int getColorPressed() {
-        return mColorPressed;
-    }
-
-    public void setColorPressed(final int color) {
-        if (mColorPressed != color) {
-            mColorPressed = color;
-            updateBackground();
-        }
-    }
-
-    public void setColorPressedResId(@ColorRes final int colorPressed) {
-        setColorPressed(getColor(colorPressed));
-    }
-
-    /**
-     * @return the current color for disabled state.
-     */
-    public int getColorDisabled() {
-        return mColorDisabled;
-    }
-
-    public void setColorDisabled(final int color) {
-        if (mColorDisabled != color) {
-            mColorDisabled = color;
-            updateBackground();
-        }
-    }
-
-    public void setColorDisabledResId(@ColorRes final int colorDisabled) {
-        setColorDisabled(getColor(colorDisabled));
-    }
-
-    public boolean isStrokeVisible() {
-        return mStrokeVisible;
-    }
-
-    public void setStrokeVisible(final boolean visible) {
-        if (mStrokeVisible != visible) {
-            mStrokeVisible = visible;
-            updateBackground();
-        }
-    }
-
-    int getColor(@ColorRes final int id) {
-        return getResources().getColor(id);
-    }
-
-    float getDimension(@DimenRes final int id) {
-        return getResources().getDimension(id);
-    }
-
-    TextView getLabelView() {
-        return (TextView) getTag(R.id.fab_label);
-    }
-
-    public String getTitle() {
-        return mTitle;
-    }
-
-    public void setTitle(final String title) {
-        mTitle = title;
-        final TextView label = getLabelView();
-        if (label != null) {
-            label.setText(title);
-        }
-    }
-
-    @Override
-    protected void onMeasure(final int widthMeasureSpec, final int heightMeasureSpec) {
-        super.onMeasure(widthMeasureSpec, heightMeasureSpec);
-        setMeasuredDimension(mDrawableSize, mDrawableSize);
-    }
-
-    void updateBackground() {
-        final float strokeWidth = getDimension(R.dimen.fab_stroke_width);
-        final float halfStrokeWidth = strokeWidth / 2f;
-
-        final LayerDrawable layerDrawable = new LayerDrawable(
-                new Drawable[]{
-                        getResources().getDrawable(mSize == SIZE_NORMAL ? R.drawable.fab_bg_normal : R.drawable.fab_bg_mini, null),
-                        createFillDrawable(strokeWidth),
-                        createOuterStrokeDrawable(strokeWidth),
-                        getIconDrawable()
-                });
-
-        final int iconOffset = (int) (mCircleSize - getDimension(R.dimen.fab_icon_size)) / 2;
-
-        final int circleInsetHorizontal = (int) (mShadowRadius);
-        final int circleInsetTop = (int) (mShadowRadius - mShadowOffset);
-        final int circleInsetBottom = (int) (mShadowRadius + mShadowOffset);
-
-        layerDrawable.setLayerInset(1,
-                circleInsetHorizontal,
-                circleInsetTop,
-                circleInsetHorizontal,
-                circleInsetBottom);
-
-        layerDrawable.setLayerInset(2,
-                (int) (circleInsetHorizontal - halfStrokeWidth),
-                (int) (circleInsetTop - halfStrokeWidth),
-                (int) (circleInsetHorizontal - halfStrokeWidth),
-                (int) (circleInsetBottom - halfStrokeWidth));
-
-        layerDrawable.setLayerInset(3,
-                circleInsetHorizontal + iconOffset,
-                circleInsetTop + iconOffset,
-                circleInsetHorizontal + iconOffset,
-                circleInsetBottom + iconOffset);
-
-        setBackground(layerDrawable);
-    }
-
-    Drawable getIconDrawable() {
-        if (mIconDrawable != null) {
-            return mIconDrawable;
-        } else if (mIcon != 0) {
-            return getResources().getDrawable(mIcon, null);
-        } else {
-            return new ColorDrawable(Color.TRANSPARENT);
-        }
-    }
-
-    public void setIconDrawable(@NonNull final Drawable iconDrawable) {
-        if (mIconDrawable != iconDrawable) {
-            mIcon = 0;
-            mIconDrawable = iconDrawable;
-            updateBackground();
-        }
-    }
-
-    private StateListDrawable createFillDrawable(final float strokeWidth) {
-        final StateListDrawable drawable = new StateListDrawable();
-        drawable.addState(new int[]{-android.R.attr.state_enabled}, createCircleDrawable(mColorDisabled, strokeWidth));
-        drawable.addState(new int[]{android.R.attr.state_pressed}, createCircleDrawable(mColorPressed, strokeWidth));
-        drawable.addState(new int[]{}, createCircleDrawable(mColorNormal, strokeWidth));
-        return drawable;
-    }
-
-    private Drawable createCircleDrawable(final int color, final float strokeWidth) {
-        final int alpha = Color.alpha(color);
-        final int opaqueColor = opaque(color);
-
-        final ShapeDrawable fillDrawable = new ShapeDrawable(new OvalShape());
-
-        final Paint paint = fillDrawable.getPaint();
-        paint.setAntiAlias(true);
-        paint.setColor(opaqueColor);
-
-        final Drawable[] layers = {
-                fillDrawable,
-                createInnerStrokesDrawable(opaqueColor, strokeWidth)
-        };
-
-        final LayerDrawable drawable = alpha == 255 || !mStrokeVisible
-                ? new LayerDrawable(layers)
-                : new TranslucentLayerDrawable(alpha, layers);
-
-        final int halfStrokeWidth = (int) (strokeWidth / 2f);
-        drawable.setLayerInset(1, halfStrokeWidth, halfStrokeWidth, halfStrokeWidth, halfStrokeWidth);
-
-        return drawable;
-    }
-
-    private Drawable createOuterStrokeDrawable(final float strokeWidth) {
-        final ShapeDrawable shapeDrawable = new ShapeDrawable(new OvalShape());
-
-        final Paint paint = shapeDrawable.getPaint();
-        paint.setAntiAlias(true);
-        paint.setStrokeWidth(strokeWidth);
-        paint.setStyle(Style.STROKE);
-        paint.setColor(Color.BLACK);
-        paint.setAlpha(opacityToAlpha(0.02f));
-
-        return shapeDrawable;
-    }
-
-    private int opacityToAlpha(final float opacity) {
-        return (int) (255f * opacity);
-    }
-
-    private int darkenColor(final int argb) {
-        return adjustColorBrightness(argb, 0.9f);
-    }
-
-    private int lightenColor(final int argb) {
-        return adjustColorBrightness(argb, 1.1f);
-    }
-
-    private int adjustColorBrightness(final int argb, final float factor) {
-        final float[] hsv = new float[3];
-        Color.colorToHSV(argb, hsv);
-
-        hsv[2] = Math.min(hsv[2] * factor, 1f);
-
-        return Color.HSVToColor(Color.alpha(argb), hsv);
-    }
-
-    private int halfTransparent(final int argb) {
-        return Color.argb(
-                Color.alpha(argb) / 2,
-                Color.red(argb),
-                Color.green(argb),
-                Color.blue(argb)
-        );
-    }
-
-    private int opaque(final int argb) {
-        return Color.rgb(
-                Color.red(argb),
-                Color.green(argb),
-                Color.blue(argb)
-        );
-    }
-
-    private Drawable createInnerStrokesDrawable(final int color, final float strokeWidth) {
-        if (!mStrokeVisible) {
-            return new ColorDrawable(Color.TRANSPARENT);
-        }
-
-        final ShapeDrawable shapeDrawable = new ShapeDrawable(new OvalShape());
-
-        final int bottomStrokeColor = darkenColor(color);
-        final int bottomStrokeColorHalfTransparent = halfTransparent(bottomStrokeColor);
-        final int topStrokeColor = lightenColor(color);
-        final int topStrokeColorHalfTransparent = halfTransparent(topStrokeColor);
-
-        final Paint paint = shapeDrawable.getPaint();
-        paint.setAntiAlias(true);
-        paint.setStrokeWidth(strokeWidth);
-        paint.setStyle(Style.STROKE);
-        shapeDrawable.setShaderFactory(new ShaderFactory() {
-            @Override
-            public Shader resize(int width, int height) {
-                return new LinearGradient(width / 2, 0, width / 2, height,
-                        new int[]{topStrokeColor, topStrokeColorHalfTransparent, color, bottomStrokeColorHalfTransparent, bottomStrokeColor},
-                        new float[]{0f, 0.2f, 0.5f, 0.8f, 1f},
-                        TileMode.CLAMP
-                );
-            }
-        });
-
-        return shapeDrawable;
-    }
-
-    @Override
-    public void setVisibility(final int visibility) {
-        final TextView label = getLabelView();
-        if (label != null) {
-            label.setVisibility(visibility);
-        }
-
-        super.setVisibility(visibility);
-    }
-
-    @Retention(RetentionPolicy.SOURCE)
-    @IntDef({SIZE_NORMAL, SIZE_MINI})
-    public @interface FAB_SIZE {
-    }
-
-    private static class TranslucentLayerDrawable extends LayerDrawable {
-        private final int mAlpha;
-
-        public TranslucentLayerDrawable(final int alpha, final Drawable... layers) {
-            super(layers);
-            mAlpha = alpha;
-        }
-
-        @Override
-        public void draw(final Canvas canvas) {
-            final Rect bounds = getBounds();
-            canvas.saveLayerAlpha(bounds.left, bounds.top, bounds.right, bounds.bottom, mAlpha);
-            super.draw(canvas);
-            canvas.restore();
-        }
-    }
-}
@@ -0,0 +1,66 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.widget.fab;
+
+import android.animation.Animator;
+import android.animation.AnimatorListenerAdapter;
+import android.animation.TimeInterpolator;
+import android.animation.ValueAnimator;
+import android.content.Context;
+import androidx.coordinatorlayout.widget.CoordinatorLayout;
+import com.google.android.material.snackbar.Snackbar;
+import androidx.interpolator.view.animation.FastOutSlowInInterpolator;
+import android.util.AttributeSet;
+import android.view.View;
+
+public class FloatingActionButtonBehavior extends CoordinatorLayout.Behavior<FloatingActionsMenu> {
+
+    private static final long ANIMATION_DURATION = 250;
+    private static final TimeInterpolator FAST_OUT_SLOW_IN_INTERPOLATOR = new FastOutSlowInInterpolator();
+
+    public FloatingActionButtonBehavior(final Context context, final AttributeSet attrs) {
+        super(context, attrs);
+    }
+
+    private static void animateChange(final FloatingActionsMenu child, final float destination, final float fullSpan) {
+        final float origin = child.getBehaviorYTranslation();
+        if (Math.abs(destination - origin) < fullSpan / 2) {
+            child.setBehaviorYTranslation(destination);
+            return;
+        }
+        final ValueAnimator animator = new ValueAnimator();
+        animator.setFloatValues(origin, destination);
+        animator.setInterpolator(FAST_OUT_SLOW_IN_INTERPOLATOR);
+        animator.setDuration((long) (ANIMATION_DURATION * (Math.abs(destination - origin) / fullSpan)));
+        animator.addListener(new AnimatorListenerAdapter() {
+            @Override
+            public void onAnimationEnd(final Animator a) {
+                child.setBehaviorYTranslation(destination);
+            }
+        });
+        animator.addUpdateListener(a -> child.setBehaviorYTranslation((float) a.getAnimatedValue()));
+        animator.start();
+    }
+
+    @Override
+    public boolean layoutDependsOn(final CoordinatorLayout parent, final FloatingActionsMenu child,
+                                   final View dependency) {
+        return dependency instanceof Snackbar.SnackbarLayout;
+    }
+
+    @Override
+    public boolean onDependentViewChanged(final CoordinatorLayout parent, final FloatingActionsMenu child,
+                                          final View dependency) {
+        animateChange(child, Math.min(0, dependency.getTranslationY() - dependency.getMeasuredHeight()), dependency.getMeasuredHeight());
+        return true;
+    }
+
+    @Override
+    public void onDependentViewRemoved(final CoordinatorLayout parent, final FloatingActionsMenu child,
+                                       final View dependency) {
+        animateChange(child, 0, dependency.getMeasuredHeight());
+    }
+}
@@ -1,7 +1,7 @@
 /*
 * Copyright © 2014 Jerzy Chalupski
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.widget.fab;
@@ -10,159 +10,85 @@ import android.animation.Animator;
 import android.animation.AnimatorListenerAdapter;
 import android.animation.AnimatorSet;
 import android.animation.ObjectAnimator;
+import android.animation.TimeInterpolator;
 import android.content.Context;
 import android.content.res.TypedArray;
 import android.graphics.Canvas;
 import android.graphics.Rect;
 import android.graphics.drawable.Drawable;
 import android.graphics.drawable.LayerDrawable;
+import android.os.Build;
 import android.os.Parcel;
 import android.os.Parcelable;
-import android.support.annotation.ColorRes;
-import android.support.annotation.NonNull;
+import androidx.annotation.Keep;
+import androidx.annotation.Nullable;
+import com.google.android.material.floatingactionbutton.FloatingActionButton;
+import androidx.core.content.res.ResourcesCompat;
+import androidx.appcompat.widget.AppCompatTextView;
 import android.util.AttributeSet;
 import android.view.ContextThemeWrapper;
 import android.view.TouchDelegate;
 import android.view.View;
 import android.view.ViewGroup;
 import android.view.animation.DecelerateInterpolator;
-import android.view.animation.Interpolator;
 import android.view.animation.OvershootInterpolator;
 import android.widget.TextView;

 import com.wireguard.android.R;

 public class FloatingActionsMenu extends ViewGroup {
-    public static final int EXPAND_UP = 0;
    public static final int EXPAND_DOWN = 1;
    public static final int EXPAND_LEFT = 2;
    public static final int EXPAND_RIGHT = 3;
-
+    public static final int EXPAND_UP = 0;
    public static final int LABELS_ON_LEFT_SIDE = 0;
    public static final int LABELS_ON_RIGHT_SIDE = 1;
-
+    private static final TimeInterpolator ALPHA_EXPAND_INTERPOLATOR = new DecelerateInterpolator();
    private static final int ANIMATION_DURATION = 300;
+    private static final boolean BROKEN_LABEL_STYLE = Build.VERSION.SDK_INT <= Build.VERSION_CODES.LOLLIPOP_MR1 && Build.BRAND.equalsIgnoreCase("ASUS");
    private static final float COLLAPSED_PLUS_ROTATION = 0f;
+    private static final TimeInterpolator COLLAPSE_INTERPOLATOR = new DecelerateInterpolator(3f);
    private static final float EXPANDED_PLUS_ROTATION = 90f + 45f;
-    private static final Interpolator sExpandInterpolator = new OvershootInterpolator();
-    private static final Interpolator sCollapseInterpolator = new DecelerateInterpolator(3f);
-    private static final Interpolator sAlphaExpandInterpolator = new DecelerateInterpolator();
-    private int mAddButtonPlusColor;
-    private int mAddButtonColorNormal;
-    private int mAddButtonColorPressed;
-    private int mAddButtonSize;
-    private boolean mAddButtonStrokeVisible;
-    private int mExpandDirection;
-    private int mButtonSpacing;
-    private int mLabelsMargin;
-    private int mLabelsVerticalOffset;
-    private boolean mExpanded;
-    private final AnimatorSet mExpandAnimation = new AnimatorSet().setDuration(ANIMATION_DURATION);
+    private static final TimeInterpolator EXPAND_INTERPOLATOR = new OvershootInterpolator();
    private final AnimatorSet mCollapseAnimation = new AnimatorSet().setDuration(ANIMATION_DURATION);
-    private AddFloatingActionButton mAddButton;
-    private RotatingDrawable mRotatingDrawable;
-    private int mMaxButtonWidth;
-    private int mMaxButtonHeight;
-    private int mLabelsStyle;
-    private int mLabelsPosition;
-    private int mButtonsCount;
-    private TouchDelegateGroup mTouchDelegateGroup;
-    private OnFloatingActionsMenuUpdateListener mListener;
+    private final AnimatorSet mExpandAnimation = new AnimatorSet().setDuration(ANIMATION_DURATION);
    private final Rect touchArea = new Rect(0, 0, 0, 0);
+    private float behaviorYTranslation;
+    @Nullable private FloatingActionButton mAddButton;
+    private int mButtonSpacing;
+    private int mButtonsCount;
+    private int mExpandDirection;
+    private boolean mExpanded;
+    private int mLabelsMargin;
+    private int mLabelsPosition;
+    private int mLabelsStyle;
+    private int mLabelsVerticalOffset;
+    @Nullable private OnFloatingActionsMenuUpdateListener mListener;
+    private int mMaxButtonHeight;
+    private int mMaxButtonWidth;
+    @Nullable private RotatingDrawable mRotatingDrawable;
+    @Nullable private TouchDelegateGroup mTouchDelegateGroup;
+    private float scrollYTranslation;

    public FloatingActionsMenu(final Context context) {
        this(context, null);
    }

-    public FloatingActionsMenu(final Context context, AttributeSet attrs) {
+    public FloatingActionsMenu(final Context context, @Nullable final AttributeSet attrs) {
        super(context, attrs);
        init(context, attrs);
    }

-    public FloatingActionsMenu(final Context context, final AttributeSet attrs, final int defStyle) {
+    public FloatingActionsMenu(final Context context, @Nullable final AttributeSet attrs, final int defStyle) {
        super(context, attrs, defStyle);
        init(context, attrs);
    }

-    private void init(final Context context, final AttributeSet attributeSet) {
-        mButtonSpacing = (int) (getResources().getDimension(R.dimen.fab_actions_spacing) - getResources().getDimension(R.dimen.fab_shadow_radius) - getResources().getDimension(R.dimen.fab_shadow_offset));
-        mLabelsMargin = getResources().getDimensionPixelSize(R.dimen.fab_labels_margin);
-        mLabelsVerticalOffset = getResources().getDimensionPixelSize(R.dimen.fab_shadow_offset);
-
-        mTouchDelegateGroup = new TouchDelegateGroup(this);
-        setTouchDelegate(mTouchDelegateGroup);
-
-        final TypedArray attr = context.obtainStyledAttributes(attributeSet, R.styleable.FloatingActionsMenu, 0, 0);
-        mAddButtonPlusColor = attr.getColor(R.styleable.FloatingActionsMenu_fab_addButtonPlusIconColor, getColor(android.R.color.white));
-        mAddButtonColorNormal = attr.getColor(R.styleable.FloatingActionsMenu_fab_addButtonColorNormal, getColor(android.R.color.holo_blue_dark));
-        mAddButtonColorPressed = attr.getColor(R.styleable.FloatingActionsMenu_fab_addButtonColorPressed, getColor(android.R.color.holo_blue_light));
-        mAddButtonSize = attr.getInt(R.styleable.FloatingActionsMenu_fab_addButtonSize, FloatingActionButton.SIZE_NORMAL);
-        mAddButtonStrokeVisible = attr.getBoolean(R.styleable.FloatingActionsMenu_fab_addButtonStrokeVisible, true);
-        mExpandDirection = attr.getInt(R.styleable.FloatingActionsMenu_fab_expandDirection, EXPAND_UP);
-        mLabelsStyle = attr.getResourceId(R.styleable.FloatingActionsMenu_fab_labelStyle, 0);
-        mLabelsPosition = attr.getInt(R.styleable.FloatingActionsMenu_fab_labelsPosition, LABELS_ON_LEFT_SIDE);
-        attr.recycle();
-
-        if (mLabelsStyle != 0 && expandsHorizontally()) {
-            throw new IllegalStateException("Action labels in horizontal expand orientation is not supported.");
-        }
-
-        createAddButton(context);
+    private static int adjustForOvershoot(final int dimension) {
+        return dimension * 12 / 10;
    }

-    public void setOnFloatingActionsMenuUpdateListener(final OnFloatingActionsMenuUpdateListener listener) {
-        mListener = listener;
-    }
-
-    private boolean expandsHorizontally() {
-        return mExpandDirection == EXPAND_LEFT || mExpandDirection == EXPAND_RIGHT;
-    }
-
-    private void createAddButton(final Context context) {
-        mAddButton = new AddFloatingActionButton(context) {
-            @Override
-            void updateBackground() {
-                mPlusColor = mAddButtonPlusColor;
-                mColorNormal = mAddButtonColorNormal;
-                mColorPressed = mAddButtonColorPressed;
-                mStrokeVisible = mAddButtonStrokeVisible;
-                super.updateBackground();
-            }
-
-            @Override
-            Drawable getIconDrawable() {
-                final RotatingDrawable rotatingDrawable = new RotatingDrawable(super.getIconDrawable());
-                mRotatingDrawable = rotatingDrawable;
-
-                final OvershootInterpolator interpolator = new OvershootInterpolator();
-
-                final ObjectAnimator collapseAnimator = ObjectAnimator.ofFloat(rotatingDrawable, "rotation", EXPANDED_PLUS_ROTATION, COLLAPSED_PLUS_ROTATION);
-                final ObjectAnimator expandAnimator = ObjectAnimator.ofFloat(rotatingDrawable, "rotation", COLLAPSED_PLUS_ROTATION, EXPANDED_PLUS_ROTATION);
-
-                collapseAnimator.setInterpolator(interpolator);
-                expandAnimator.setInterpolator(interpolator);
-
-                mExpandAnimation.play(expandAnimator);
-                mCollapseAnimation.play(collapseAnimator);
-
-                return rotatingDrawable;
-            }
-        };
-
-        mAddButton.setId(R.id.fab_expand_menu_button);
-        mAddButton.setSize(mAddButtonSize);
-        mAddButton.setOnClickListener(new OnClickListener() {
-            @Override
-            public void onClick(View v) {
-                toggle();
-            }
-        });
-
-        addView(mAddButton, super.generateDefaultLayoutParams());
-        mButtonsCount++;
-    }
-
-    public void addButton(final FloatingActionButton button) {
+    public void addButton(final LabeledFloatingActionButton button) {
        addView(button, mButtonsCount - 1);
        mButtonsCount++;

@@ -171,80 +97,147 @@ public class FloatingActionsMenu extends ViewGroup {
        }
    }

-    public void removeButton(final FloatingActionButton button) {
-        removeView(button.getLabelView());
-        removeView(button);
-        button.setTag(R.id.fab_label, null);
-        mButtonsCount--;
+    public void collapse() {
+        collapse(false);
    }

-    private int getColor(@ColorRes final int id) {
-        return getResources().getColor(id);
+    private void collapse(final boolean immediately) {
+        if (mExpanded) {
+            mExpanded = false;
+            mTouchDelegateGroup.setEnabled(false);
+            mCollapseAnimation.setDuration(immediately ? 0 : ANIMATION_DURATION);
+            mCollapseAnimation.start();
+            mExpandAnimation.cancel();
+
+            if (mListener != null) {
+                mListener.onMenuCollapsed();
+            }
+        }
+    }
+
+    public void collapseImmediately() {
+        collapse(true);
+    }
+
+    private void createAddButton(final Context context) {
+        final RotatingDrawable rotatingDrawable = new RotatingDrawable(ResourcesCompat.getDrawable(context.getResources(), R.drawable.ic_action_add_white, context.getTheme()));
+        mRotatingDrawable = rotatingDrawable;
+
+        final TimeInterpolator interpolator = new OvershootInterpolator();
+
+        final ObjectAnimator collapseAnimator = ObjectAnimator.ofFloat(rotatingDrawable, "rotation", EXPANDED_PLUS_ROTATION, COLLAPSED_PLUS_ROTATION);
+        final ObjectAnimator expandAnimator = ObjectAnimator.ofFloat(rotatingDrawable, "rotation", COLLAPSED_PLUS_ROTATION, EXPANDED_PLUS_ROTATION);
+
+        collapseAnimator.setInterpolator(interpolator);
+        expandAnimator.setInterpolator(interpolator);
+
+        mExpandAnimation.play(expandAnimator);
+        mCollapseAnimation.play(collapseAnimator);
+
+        mAddButton = new FloatingActionButton(context);
+        mAddButton.setImageDrawable(rotatingDrawable);
+        mAddButton.setId(R.id.fab_expand_menu_button);
+        mAddButton.setOnClickListener(v -> toggle());
+
+        addView(mAddButton, super.generateDefaultLayoutParams());
+        mButtonsCount++;
+    }
+
+    private void createLabels() {
+        final Context context = BROKEN_LABEL_STYLE ? getContext() : new ContextThemeWrapper(getContext(), mLabelsStyle);
+
+        for (int i = 0; i < mButtonsCount; i++) {
+            final FloatingActionButton button = (FloatingActionButton) getChildAt(i);
+
+            if (button instanceof LabeledFloatingActionButton) {
+                final String title = ((LabeledFloatingActionButton) button).getTitle();
+
+                final AppCompatTextView label = new AppCompatTextView(context);
+                if (!BROKEN_LABEL_STYLE)
+                    label.setTextAppearance(context, mLabelsStyle);
+                label.setText(title);
+                addView(label);
+
+                button.setTag(R.id.fab_label, label);
+            }
+        }
+    }
+
+    public void expand() {
+        if (!mExpanded) {
+            mExpanded = true;
+            mTouchDelegateGroup.setEnabled(true);
+            mCollapseAnimation.cancel();
+            mExpandAnimation.start();
+
+            if (mListener != null) {
+                mListener.onMenuExpanded();
+            }
+        }
+    }
+
+    private boolean expandsHorizontally() {
+        return mExpandDirection == EXPAND_LEFT || mExpandDirection == EXPAND_RIGHT;
    }

    @Override
-    protected void onMeasure(final int widthMeasureSpec, final int heightMeasureSpec) {
-        measureChildren(widthMeasureSpec, heightMeasureSpec);
-
-        int width = 0;
-        int height = 0;
-
-        mMaxButtonWidth = 0;
-        mMaxButtonHeight = 0;
-        int maxLabelWidth = 0;
-
-        for (int i = 0; i < mButtonsCount; i++) {
-            View child = getChildAt(i);
-
-            if (child.getVisibility() == GONE) {
-                continue;
-            }
-
-            switch (mExpandDirection) {
-                case EXPAND_UP:
-                case EXPAND_DOWN:
-                    mMaxButtonWidth = Math.max(mMaxButtonWidth, child.getMeasuredWidth());
-                    height += child.getMeasuredHeight();
-                    break;
-                case EXPAND_LEFT:
-                case EXPAND_RIGHT:
-                    width += child.getMeasuredWidth();
-                    mMaxButtonHeight = Math.max(mMaxButtonHeight, child.getMeasuredHeight());
-                    break;
-            }
-
-            if (!expandsHorizontally()) {
-                TextView label = (TextView) child.getTag(R.id.fab_label);
-                if (label != null) {
-                    maxLabelWidth = Math.max(maxLabelWidth, label.getMeasuredWidth());
-                }
-            }
-        }
-
-        if (!expandsHorizontally()) {
-            width = mMaxButtonWidth + (maxLabelWidth > 0 ? maxLabelWidth + mLabelsMargin : 0);
-        } else {
-            height = mMaxButtonHeight;
-        }
-
-        switch (mExpandDirection) {
-            case EXPAND_UP:
-            case EXPAND_DOWN:
-                height += mButtonSpacing * (mButtonsCount - 1);
-                height = adjustForOvershoot(height);
-                break;
-            case EXPAND_LEFT:
-            case EXPAND_RIGHT:
-                width += mButtonSpacing * (mButtonsCount - 1);
-                width = adjustForOvershoot(width);
-                break;
-        }
-
-        setMeasuredDimension(width, height);
+    protected ViewGroup.LayoutParams generateDefaultLayoutParams() {
+        return new LayoutParams(super.generateDefaultLayoutParams());
    }

-    private int adjustForOvershoot(final int dimension) {
-        return dimension * 12 / 10;
+    @Override
+    public ViewGroup.LayoutParams generateLayoutParams(final AttributeSet attrs) {
+        return new LayoutParams(super.generateLayoutParams(attrs));
+    }
+
+    @Override
+    protected ViewGroup.LayoutParams generateLayoutParams(final ViewGroup.LayoutParams p) {
+        return new LayoutParams(super.generateLayoutParams(p));
+    }
+
+    public float getBehaviorYTranslation() {
+        return behaviorYTranslation;
+    }
+
+    public float getScrollYTranslation() {
+        return scrollYTranslation;
+    }
+
+    private void init(final Context context, @Nullable final AttributeSet attributeSet) {
+        mButtonSpacing = (int) (getResources().getDimension(R.dimen.fab_actions_spacing));
+        mLabelsMargin = getResources().getDimensionPixelSize(R.dimen.fab_labels_margin);
+        mLabelsVerticalOffset = getResources().getDimensionPixelSize(R.dimen.fab_shadow_offset);
+
+        mTouchDelegateGroup = new TouchDelegateGroup(this);
+        setTouchDelegate(mTouchDelegateGroup);
+
+        final TypedArray attr = context.obtainStyledAttributes(attributeSet, R.styleable.FloatingActionsMenu, 0, 0);
+        mExpandDirection = attr.getInt(R.styleable.FloatingActionsMenu_fab_expandDirection, EXPAND_UP);
+        mLabelsStyle = attr.getResourceId(R.styleable.FloatingActionsMenu_fab_labelStyle, 0);
+        mLabelsPosition = attr.getInt(R.styleable.FloatingActionsMenu_fab_labelsPosition, LABELS_ON_LEFT_SIDE);
+        attr.recycle();
+
+        if (mLabelsStyle != 0 && expandsHorizontally()) {
+            throw new IllegalStateException("Action labels in horizontal expand orientation are not supported");
+        }
+
+        createAddButton(context);
+    }
+
+    public boolean isExpanded() {
+        return mExpanded;
+    }
+
+    @Override
+    protected void onFinishInflate() {
+        super.onFinishInflate();
+
+        bringChildToFront(mAddButton);
+        mButtonsCount = getChildCount();
+
+        if (mLabelsStyle != 0) {
+            createLabels();
+        }
    }

    @Override
@@ -260,9 +253,9 @@ public class FloatingActionsMenu extends ViewGroup {

                final int addButtonY = expandUp ? b - t - mAddButton.getMeasuredHeight() : 0;
                // Ensure mAddButton is centered on the line where the buttons should be
-                final int buttonsHorizontalCenter = mLabelsPosition == LABELS_ON_LEFT_SIDE
+                final int buttonsHorizontalCenter = (mLabelsPosition == LABELS_ON_LEFT_SIDE
                        ? r - l - mMaxButtonWidth / 2
-                        : mMaxButtonWidth / 2;
+                        : mMaxButtonWidth / 2);
                final int addButtonLeft = buttonsHorizontalCenter - mAddButton.getMeasuredWidth() / 2;
                mAddButton.layout(addButtonLeft, addButtonY, addButtonLeft + mAddButton.getMeasuredWidth(), addButtonY + mAddButton.getMeasuredHeight());

@@ -290,7 +283,7 @@ public class FloatingActionsMenu extends ViewGroup {
                    child.setTranslationY(mExpanded ? expandedTranslation : collapsedTranslation);
                    child.setAlpha(mExpanded ? 1f : 0f);

-                    LayoutParams params = (LayoutParams) child.getLayoutParams();
+                    final LayoutParams params = (LayoutParams) child.getLayoutParams();
                    params.mCollapseDir.setFloatValues(expandedTranslation, collapsedTranslation);
                    params.mExpandDir.setFloatValues(collapsedTranslation, expandedTranslation);
                    params.setAnimationsTarget(child);
@@ -317,12 +310,12 @@ public class FloatingActionsMenu extends ViewGroup {
                                childY - mButtonSpacing / 2,
                                Math.max(childX + child.getMeasuredWidth(), labelRight),
                                childY + child.getMeasuredHeight() + mButtonSpacing / 2);
-                        mTouchDelegateGroup.addTouchDelegate(new TouchDelegate(touchArea, child));
+                        mTouchDelegateGroup.addTouchDelegate(new TouchDelegate(new Rect(touchArea), child));

                        label.setTranslationY(mExpanded ? expandedTranslation : collapsedTranslation);
                        label.setAlpha(mExpanded ? 1f : 0f);

-                        LayoutParams labelParams = (LayoutParams) label.getLayoutParams();
+                        final LayoutParams labelParams = (LayoutParams) label.getLayoutParams();
                        labelParams.mCollapseDir.setFloatValues(expandedTranslation, collapsedTranslation);
                        labelParams.mExpandDir.setFloatValues(collapsedTranslation, expandedTranslation);
                        labelParams.setAnimationsTarget(label);
@@ -377,117 +370,64 @@ public class FloatingActionsMenu extends ViewGroup {
    }

    @Override
-    protected ViewGroup.LayoutParams generateDefaultLayoutParams() {
-        return new LayoutParams(super.generateDefaultLayoutParams());
-    }
+    protected void onMeasure(final int widthMeasureSpec, final int heightMeasureSpec) {
+        measureChildren(widthMeasureSpec, heightMeasureSpec);

-    @Override
-    public ViewGroup.LayoutParams generateLayoutParams(final AttributeSet attrs) {
-        return new LayoutParams(super.generateLayoutParams(attrs));
-    }
+        int width = 0;
+        int height = 0;

-    @Override
-    protected ViewGroup.LayoutParams generateLayoutParams(final ViewGroup.LayoutParams p) {
-        return new LayoutParams(super.generateLayoutParams(p));
-    }
-
-    @Override
-    protected boolean checkLayoutParams(final ViewGroup.LayoutParams p) {
-        return super.checkLayoutParams(p);
-    }
-
-    @Override
-    protected void onFinishInflate() {
-        super.onFinishInflate();
-
-        bringChildToFront(mAddButton);
-        mButtonsCount = getChildCount();
-
-        if (mLabelsStyle != 0) {
-            createLabels();
-        }
-    }
-
-    private void createLabels() {
-        final Context context = new ContextThemeWrapper(getContext(), mLabelsStyle);
+        mMaxButtonWidth = 0;
+        mMaxButtonHeight = 0;
+        int maxLabelWidth = 0;

        for (int i = 0; i < mButtonsCount; i++) {
-            final FloatingActionButton button = (FloatingActionButton) getChildAt(i);
-            final String title = button.getTitle();
+            final View child = getChildAt(i);

-            if (button == mAddButton || title == null ||
-                    button.getTag(R.id.fab_label) != null) continue;
+            if (child.getVisibility() == GONE) {
+                continue;
+            }

-            final TextView label = new TextView(context);
-            label.setTextAppearance(context, mLabelsStyle);
-            label.setText(button.getTitle());
-            addView(label);
+            switch (mExpandDirection) {
+                case EXPAND_UP:
+                case EXPAND_DOWN:
+                    mMaxButtonWidth = Math.max(mMaxButtonWidth, child.getMeasuredWidth());
+                    height += child.getMeasuredHeight();
+                    break;
+                case EXPAND_LEFT:
+                case EXPAND_RIGHT:
+                    width += child.getMeasuredWidth();
+                    mMaxButtonHeight = Math.max(mMaxButtonHeight, child.getMeasuredHeight());
+                    break;
+            }

-            button.setTag(R.id.fab_label, label);
-        }
-    }
-
-    public void collapse() {
-        collapse(false);
-    }
-
-    public void collapseImmediately() {
-        collapse(true);
-    }
-
-    private void collapse(final boolean immediately) {
-        if (mExpanded) {
-            mExpanded = false;
-            mTouchDelegateGroup.setEnabled(false);
-            mCollapseAnimation.setDuration(immediately ? 0 : ANIMATION_DURATION);
-            mCollapseAnimation.start();
-            mExpandAnimation.cancel();
-
-            if (mListener != null) {
-                mListener.onMenuCollapsed();
+            if (!expandsHorizontally()) {
+                final TextView label = (TextView) child.getTag(R.id.fab_label);
+                if (label != null) {
+                    maxLabelWidth = Math.max(maxLabelWidth, label.getMeasuredWidth());
+                }
            }
        }
-    }

-    public void toggle() {
-        if (mExpanded) {
-            collapse();
+        if (expandsHorizontally()) {
+            height = mMaxButtonHeight;
        } else {
-            expand();
+            width = mMaxButtonWidth + (maxLabelWidth > 0 ? maxLabelWidth + mLabelsMargin : 0);
        }
-    }

-    public void expand() {
-        if (!mExpanded) {
-            mExpanded = true;
-            mTouchDelegateGroup.setEnabled(true);
-            mCollapseAnimation.cancel();
-            mExpandAnimation.start();
-
-            if (mListener != null) {
-                mListener.onMenuExpanded();
-            }
+        switch (mExpandDirection) {
+            case EXPAND_UP:
+            case EXPAND_DOWN:
+                height += mButtonSpacing * (mButtonsCount - 1);
+                height = adjustForOvershoot(height);
+                break;
+            case EXPAND_LEFT:
+            case EXPAND_RIGHT:
+                width += mButtonSpacing * (mButtonsCount - 1);
+                width = adjustForOvershoot(width);
+                break;
        }
-    }

-    public boolean isExpanded() {
-        return mExpanded;
-    }
-
-    @Override
-    public void setEnabled(boolean enabled) {
-        super.setEnabled(enabled);
-
-        mAddButton.setEnabled(enabled);
-    }
-
-    @Override
-    public Parcelable onSaveInstanceState() {
-        final Parcelable superState = super.onSaveInstanceState();
-        final SavedState savedState = new SavedState(superState);
-        savedState.mExpanded = mExpanded;
-
-        return savedState;
+        setMeasuredDimension(width, height);
    }

    @Override
@@ -507,10 +447,55 @@ public class FloatingActionsMenu extends ViewGroup {
        }
    }

-    public interface OnFloatingActionsMenuUpdateListener {
-        void onMenuExpanded();
+    @Override
+    public Parcelable onSaveInstanceState() {
+        final Parcelable superState = super.onSaveInstanceState();
+        final SavedState savedState = new SavedState(superState);
+        savedState.mExpanded = mExpanded;

+        return savedState;
+    }
+
+    public void removeButton(final LabeledFloatingActionButton button) {
+        removeView(button.getLabelView());
+        removeView(button);
+        button.setTag(R.id.fab_label, null);
+        mButtonsCount--;
+    }
+
+    public void setBehaviorYTranslation(final float behaviorYTranslation) {
+        this.behaviorYTranslation = behaviorYTranslation;
+        setTranslationY(behaviorYTranslation + scrollYTranslation);
+    }
+
+    @Override
+    public void setEnabled(final boolean enabled) {
+        super.setEnabled(enabled);
+
+        mAddButton.setEnabled(enabled);
+    }
+
+    public void setOnFloatingActionsMenuUpdateListener(final OnFloatingActionsMenuUpdateListener listener) {
+        mListener = listener;
+    }
+
+    public void setScrollYTranslation(final float scrollYTranslation) {
+        this.scrollYTranslation = scrollYTranslation;
+        setTranslationY(behaviorYTranslation + scrollYTranslation);
+    }
+
+    public void toggle() {
+        if (mExpanded) {
+            collapse();
+        } else {
+            expand();
+        }
+    }
+
+    public interface OnFloatingActionsMenuUpdateListener {
        void onMenuCollapsed();
+
+        void onMenuExpanded();
    }

    private static class RotatingDrawable extends LayerDrawable {
@@ -520,17 +505,6 @@ public class FloatingActionsMenu extends ViewGroup {
            super(new Drawable[]{drawable});
        }

-        @SuppressWarnings("UnusedDeclaration")
-        public float getRotation() {
-            return mRotation;
-        }
-
-        @SuppressWarnings("UnusedDeclaration")
-        public void setRotation(final float rotation) {
-            mRotation = rotation;
-            invalidateSelf();
-        }
-
        @Override
        public void draw(final Canvas canvas) {
            canvas.save();
@@ -538,22 +512,34 @@ public class FloatingActionsMenu extends ViewGroup {
            super.draw(canvas);
            canvas.restore();
        }
+
+        @SuppressWarnings("UnusedDeclaration")
+        public float getRotation() {
+            return mRotation;
+        }
+
+        @Keep
+        @SuppressWarnings("UnusedDeclaration")
+        public void setRotation(final float rotation) {
+            mRotation = rotation;
+            invalidateSelf();
+        }
    }

    public static class SavedState extends BaseSavedState {
        public static final Creator<SavedState> CREATOR = new Creator<SavedState>() {

            @Override
-            public SavedState createFromParcel(Parcel in) {
+            public SavedState createFromParcel(final Parcel in) {
                return new SavedState(in);
            }

            @Override
-            public SavedState[] newArray(int size) {
+            public SavedState[] newArray(final int size) {
                return new SavedState[size];
            }
        };
-        public boolean mExpanded;
+        private boolean mExpanded;

        public SavedState(final Parcelable parcel) {
            super(parcel);
@@ -565,7 +551,7 @@ public class FloatingActionsMenu extends ViewGroup {
        }

        @Override
-        public void writeToParcel(@NonNull final Parcel out, final int flags) {
+        public void writeToParcel(final Parcel out, final int flags) {
            super.writeToParcel(out, flags);
            out.writeInt(mExpanded ? 1 : 0);
        }
@@ -573,19 +559,19 @@ public class FloatingActionsMenu extends ViewGroup {

    private class LayoutParams extends ViewGroup.LayoutParams {

-        private final ObjectAnimator mExpandDir = new ObjectAnimator();
-        private final ObjectAnimator mExpandAlpha = new ObjectAnimator();
-        private final ObjectAnimator mCollapseDir = new ObjectAnimator();
        private final ObjectAnimator mCollapseAlpha = new ObjectAnimator();
+        private final ObjectAnimator mCollapseDir = new ObjectAnimator();
+        private final ObjectAnimator mExpandAlpha = new ObjectAnimator();
+        private final ObjectAnimator mExpandDir = new ObjectAnimator();
        private boolean animationsSetToPlay;

        LayoutParams(final ViewGroup.LayoutParams source) {
            super(source);

-            mExpandDir.setInterpolator(sExpandInterpolator);
-            mExpandAlpha.setInterpolator(sAlphaExpandInterpolator);
-            mCollapseDir.setInterpolator(sCollapseInterpolator);
-            mCollapseAlpha.setInterpolator(sCollapseInterpolator);
+            mExpandDir.setInterpolator(EXPAND_INTERPOLATOR);
+            mExpandAlpha.setInterpolator(ALPHA_EXPAND_INTERPOLATOR);
+            mCollapseDir.setInterpolator(COLLAPSE_INTERPOLATOR);
+            mCollapseAlpha.setInterpolator(COLLAPSE_INTERPOLATOR);

            mCollapseAlpha.setProperty(View.ALPHA);
            mCollapseAlpha.setFloatValues(1f, 0f);
@@ -607,6 +593,20 @@ public class FloatingActionsMenu extends ViewGroup {
            }
        }

+        private void addLayerTypeListener(final Animator animator, final View view) {
+            animator.addListener(new AnimatorListenerAdapter() {
+                @Override
+                public void onAnimationEnd(final Animator animation) {
+                    view.setLayerType(LAYER_TYPE_NONE, null);
+                }
+
+                @Override
+                public void onAnimationStart(final Animator animation) {
+                    view.setLayerType(LAYER_TYPE_HARDWARE, null);
+                }
+            });
+        }
+
        public void setAnimationsTarget(final View view) {
            mCollapseAlpha.setTarget(view);
            mCollapseDir.setTarget(view);
@@ -625,19 +625,5 @@ public class FloatingActionsMenu extends ViewGroup {
                animationsSetToPlay = true;
            }
        }
-
-        private void addLayerTypeListener(final Animator animator, final View view) {
-            animator.addListener(new AnimatorListenerAdapter() {
-                @Override
-                public void onAnimationEnd(final Animator animation) {
-                    view.setLayerType(LAYER_TYPE_NONE, null);
-                }
-
-                @Override
-                public void onAnimationStart(final Animator animation) {
-                    view.setLayerType(LAYER_TYPE_HARDWARE, null);
-                }
-            });
-        }
    }
 }
@@ -0,0 +1,27 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.widget.fab;
+
+import androidx.recyclerview.widget.RecyclerView;
+
+public class FloatingActionsMenuRecyclerViewScrollListener extends RecyclerView.OnScrollListener {
+    private static final float SCALE_FACTOR = 1.5f;
+    private final FloatingActionsMenu menu;
+
+    public FloatingActionsMenuRecyclerViewScrollListener(final FloatingActionsMenu menu) {
+        this.menu = menu;
+    }
+
+    private static float bound(final float min, final float proposal, final float max) {
+        return Math.min(max, Math.max(min, proposal));
+    }
+
+    @Override
+    public void onScrolled(final RecyclerView recyclerView, final int dx, final int dy) {
+        super.onScrolled(recyclerView, dx, dy);
+        menu.setScrollYTranslation(bound(0, menu.getScrollYTranslation() + dy * SCALE_FACTOR, menu.getMeasuredHeight() - menu.getTranslationY()));
+    }
+}
@@ -0,0 +1,58 @@
+/*
+ * Copyright © 2014 Jerzy Chalupski
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.android.widget.fab;
+
+import android.content.Context;
+import android.content.res.TypedArray;
+import androidx.annotation.Nullable;
+import com.google.android.material.floatingactionbutton.FloatingActionButton;
+import android.util.AttributeSet;
+import android.widget.TextView;
+
+import com.wireguard.android.R;
+
+public class LabeledFloatingActionButton extends FloatingActionButton {
+
+    @Nullable private final String title;
+
+    public LabeledFloatingActionButton(final Context context) {
+        this(context, null);
+    }
+
+    public LabeledFloatingActionButton(final Context context, @Nullable final AttributeSet attrs) {
+        this(context, attrs, 0);
+    }
+
+    public LabeledFloatingActionButton(final Context context, @Nullable final AttributeSet attrs, final int defStyle) {
+        super(context, attrs, defStyle);
+
+        final TypedArray attr = context.obtainStyledAttributes(attrs, R.styleable.LabeledFloatingActionButton, 0, 0);
+        title = attr.getString(R.styleable.LabeledFloatingActionButton_fab_title);
+        attr.recycle();
+    }
+
+    @Nullable
+    TextView getLabelView() {
+        return (TextView) getTag(R.id.fab_label);
+    }
+
+    @Nullable
+    public String getTitle() {
+        return title;
+    }
+
+    @Override
+    public void setVisibility(final int visibility) {
+        final TextView label = getLabelView();
+        if (label != null) {
+            label.setVisibility(visibility);
+        }
+
+        super.setVisibility(visibility);
+    }
+
+}
@@ -1,56 +1,49 @@
 /*
 * Copyright © 2014 Jerzy Chalupski
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.android.widget.fab;

 import android.graphics.Rect;
-import android.support.annotation.NonNull;
+import androidx.annotation.Nullable;
 import android.view.MotionEvent;
 import android.view.TouchDelegate;
 import android.view.View;

 import java.util.ArrayList;
-import java.util.List;
+import java.util.Collection;

 public class TouchDelegateGroup extends TouchDelegate {
    private static final Rect USELESS_HACKY_RECT = new Rect();
-    private final List<TouchDelegate> mTouchDelegates = new ArrayList<>();
-    private TouchDelegate mCurrentTouchDelegate;
+    private final Collection<TouchDelegate> mTouchDelegates = new ArrayList<>();
+    @Nullable private TouchDelegate mCurrentTouchDelegate;
    private boolean mEnabled;

    public TouchDelegateGroup(final View uselessHackyView) {
        super(USELESS_HACKY_RECT, uselessHackyView);
    }

-    public void addTouchDelegate(@NonNull final TouchDelegate touchDelegate) {
+    public void addTouchDelegate(final TouchDelegate touchDelegate) {
        mTouchDelegates.add(touchDelegate);
    }

-    public void removeTouchDelegate(final TouchDelegate touchDelegate) {
-        mTouchDelegates.remove(touchDelegate);
-        if (mCurrentTouchDelegate == touchDelegate) {
-            mCurrentTouchDelegate = null;
-        }
-    }
-
    public void clearTouchDelegates() {
        mTouchDelegates.clear();
        mCurrentTouchDelegate = null;
    }

    @Override
-    public boolean onTouchEvent(@NonNull final MotionEvent event) {
-        if (!mEnabled) return false;
+    public boolean onTouchEvent(final MotionEvent event) {
+        if (!mEnabled)
+            return false;

        TouchDelegate delegate = null;

        switch (event.getAction()) {
            case MotionEvent.ACTION_DOWN:
-                for (int i = 0; i < mTouchDelegates.size(); i++) {
-                    final TouchDelegate touchDelegate = mTouchDelegates.get(i);
+                for (final TouchDelegate touchDelegate : mTouchDelegates) {
                    if (touchDelegate.onTouchEvent(event)) {
                        mCurrentTouchDelegate = touchDelegate;
                        return true;
@@ -72,6 +65,13 @@ public class TouchDelegateGroup extends TouchDelegate {
        return delegate != null && delegate.onTouchEvent(event);
    }

+    public void removeTouchDelegate(final TouchDelegate touchDelegate) {
+        mTouchDelegates.remove(touchDelegate);
+        if (mCurrentTouchDelegate == touchDelegate) {
+            mCurrentTouchDelegate = null;
+        }
+    }
+
    public void setEnabled(final boolean enabled) {
        mEnabled = enabled;
    }
@@ -1,115 +1,49 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.config;

 import android.text.TextUtils;

-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.net.InetAddress;
-import java.util.HashMap;
-import java.util.Locale;
-import java.util.Map;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;

-/**
- * The set of valid attributes for an interface or peer in a WireGuard configuration file.
- */
+import java9.util.Optional;

-enum Attribute {
-    ADDRESS("Address"),
-    ALLOWED_IPS("AllowedIPs"),
-    DNS("DNS"),
-    ENDPOINT("Endpoint"),
-    LISTEN_PORT("ListenPort"),
-    MTU("MTU"),
-    PERSISTENT_KEEPALIVE("PersistentKeepalive"),
-    PRESHARED_KEY("PresharedKey"),
-    PRIVATE_KEY("PrivateKey"),
-    PUBLIC_KEY("PublicKey");
+public final class Attribute {
+    private static final Pattern LINE_PATTERN = Pattern.compile("(\\w+)\\s*=\\s*([^\\s#][^#]*)");
+    private static final Pattern LIST_SEPARATOR = Pattern.compile("\\s*,\\s*");

-    private static final String[] EMPTY_LIST = new String[0];
-    private static final Map<String, Attribute> KEY_MAP;
-    private static final Pattern LIST_SEPARATOR_PATTERN = Pattern.compile("\\s*,\\s*");
-    private static final Method NUMERIC_ADDRESS_PARSER;
-    private static final Pattern SEPARATOR_PATTERN = Pattern.compile("\\s|=");
+    private final String key;
+    private final String value;

-    static {
-        KEY_MAP = new HashMap<>(Attribute.values().length);
-        for (final Attribute key : Attribute.values()) {
-            KEY_MAP.put(key.token.toLowerCase(), key);
-        }
+    private Attribute(final String key, final String value) {
+        this.key = key;
+        this.value = value;
    }

-    static {
-        try {
-            NUMERIC_ADDRESS_PARSER = InetAddress.class.getMethod("parseNumericAddress", String.class);
-        } catch (final Exception e) {
-            throw new RuntimeException(e);
-        }
+    public static String join(final Iterable<?> values) {
+        return TextUtils.join(", ", values);
    }

-    private final Pattern pattern;
-    private final String token;
-
-    Attribute(final String token) {
-        pattern = Pattern.compile(token + "\\s*=\\s*(\\S.*)");
-        this.token = token;
+    public static Optional<Attribute> parse(final CharSequence line) {
+        final Matcher matcher = LINE_PATTERN.matcher(line);
+        if (!matcher.matches())
+            return Optional.empty();
+        return Optional.of(new Attribute(matcher.group(1), matcher.group(2)));
    }

-    public static <T> String iterableToString(final Iterable<T> iterable) {
-        return TextUtils.join(", ", iterable);
+    public static String[] split(final CharSequence value) {
+        return LIST_SEPARATOR.split(value);
    }

-    public static Attribute match(final CharSequence line) {
-        return KEY_MAP.get(SEPARATOR_PATTERN.split(line)[0].toLowerCase());
+    public String getKey() {
+        return key;
    }

-    public static InetAddress parseIPString(final String address) {
-        if (address == null || address.isEmpty())
-            throw new IllegalArgumentException("Empty address");
-        try {
-            return (InetAddress) NUMERIC_ADDRESS_PARSER.invoke(null, address);
-        } catch (final IllegalAccessException e) {
-            throw new RuntimeException(e);
-        } catch (final InvocationTargetException e) {
-            if (e.getCause() instanceof IllegalArgumentException)
-                throw (IllegalArgumentException) e.getCause();
-            else
-                throw new IllegalArgumentException(e.getCause());
-        }
-    }
-
-    public static String[] stringToList(final String string) {
-        if (string == null)
-            return EMPTY_LIST;
-        return LIST_SEPARATOR_PATTERN.split(string.trim());
-    }
-
-    public String composeWith(final Object value) {
-        return String.format("%s = %s%n", token, value);
-    }
-
-    public String composeWith(final int value) {
-        return String.format(Locale.getDefault(), "%s = %d%n", token, value);
-    }
-
-    public <T> String composeWith(final Iterable<T> value) {
-        return String.format("%s = %s%n", token, iterableToString(value));
-    }
-
-    public String parse(final CharSequence line) {
-        final Matcher matcher = pattern.matcher(line);
-        return matcher.matches() ? matcher.group(1) : null;
-    }
-
-    public String[] parseList(final CharSequence line) {
-        final Matcher matcher = pattern.matcher(line);
-        return matcher.matches() ? stringToList(matcher.group(1)) : null;
+    public String getValue() {
+        return value;
    }
 }
@@ -0,0 +1,118 @@
+/*
+ * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import androidx.annotation.Nullable;
+
+import com.wireguard.crypto.KeyFormatException;
+
+public class BadConfigException extends Exception {
+    private final Location location;
+    private final Reason reason;
+    private final Section section;
+    @Nullable private final CharSequence text;
+
+    private BadConfigException(final Section section, final Location location,
+                               final Reason reason, @Nullable final CharSequence text,
+                               @Nullable final Throwable cause) {
+        super(cause);
+        this.section = section;
+        this.location = location;
+        this.reason = reason;
+        this.text = text;
+    }
+
+    public BadConfigException(final Section section, final Location location,
+                              final Reason reason, @Nullable final CharSequence text) {
+        this(section, location, reason, text, null);
+    }
+
+    public BadConfigException(final Section section, final Location location,
+                              final KeyFormatException cause) {
+        this(section, location, Reason.INVALID_KEY, null, cause);
+    }
+
+    public BadConfigException(final Section section, final Location location,
+                              @Nullable final CharSequence text,
+                              final NumberFormatException cause) {
+        this(section, location, Reason.INVALID_NUMBER, text, cause);
+    }
+
+    public BadConfigException(final Section section, final Location location,
+                              final ParseException cause) {
+        this(section, location, Reason.INVALID_VALUE, cause.getText(), cause);
+    }
+
+    public Location getLocation() {
+        return location;
+    }
+
+    public Reason getReason() {
+        return reason;
+    }
+
+    public Section getSection() {
+        return section;
+    }
+
+    @Nullable
+    public CharSequence getText() {
+        return text;
+    }
+
+    public enum Location {
+        TOP_LEVEL(""),
+        ADDRESS("Address"),
+        ALLOWED_IPS("AllowedIPs"),
+        DNS("DNS"),
+        ENDPOINT("Endpoint"),
+        EXCLUDED_APPLICATIONS("ExcludedApplications"),
+        LISTEN_PORT("ListenPort"),
+        MTU("MTU"),
+        PERSISTENT_KEEPALIVE("PersistentKeepalive"),
+        PRE_SHARED_KEY("PresharedKey"),
+        PRIVATE_KEY("PrivateKey"),
+        PUBLIC_KEY("PublicKey");
+
+        private final String name;
+
+        Location(final String name) {
+            this.name = name;
+        }
+
+        public String getName() {
+            return name;
+        }
+    }
+
+    public enum Reason {
+        INVALID_KEY,
+        INVALID_NUMBER,
+        INVALID_VALUE,
+        MISSING_ATTRIBUTE,
+        MISSING_SECTION,
+        MISSING_VALUE,
+        SYNTAX_ERROR,
+        UNKNOWN_ATTRIBUTE,
+        UNKNOWN_SECTION
+    }
+
+    public enum Section {
+        CONFIG("Config"),
+        INTERFACE("Interface"),
+        PEER("Peer");
+
+        private final String name;
+
+        Section(final String name) {
+            this.name = name;
+        }
+
+        public String getName() {
+            return name;
+        }
+    }
+}
@@ -1,45 +1,73 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.config;

-import android.databinding.BaseObservable;
-import android.databinding.Bindable;
-import android.databinding.ObservableArrayList;
-import android.databinding.ObservableList;
-import android.os.Parcel;
-import android.os.Parcelable;
+import androidx.annotation.Nullable;

-import com.android.databinding.library.baseAdapters.BR;
+import com.wireguard.config.BadConfigException.Location;
+import com.wireguard.config.BadConfigException.Reason;
+import com.wireguard.config.BadConfigException.Section;

 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
-import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.LinkedHashSet;
 import java.util.List;
+import java.util.Objects;
+import java.util.Set;

 /**
- * Represents a wg-quick configuration file, its name, and its connection state.
+ * Represents the contents of a wg-quick configuration file, made up of one or more "Interface"
+ * sections (combined together), and zero or more "Peer" sections (treated individually).
+ * <p>
+ * Instances of this class are immutable.
 */
+public final class Config {
+    private final Interface interfaze;
+    private final List<Peer> peers;

-public class Config {
-    private final Interface interfaceSection = new Interface();
-    private List<Peer> peers = new ArrayList<>();
-
-    public static Config from(final InputStream stream) throws IOException {
-        return from(new BufferedReader(new InputStreamReader(stream, StandardCharsets.UTF_8)));
+    private Config(final Builder builder) {
+        interfaze = Objects.requireNonNull(builder.interfaze, "An [Interface] section is required");
+        // Defensively copy to ensure immutability even if the Builder is reused.
+        peers = Collections.unmodifiableList(new ArrayList<>(builder.peers));
    }

-    public static Config from(final BufferedReader reader) throws IOException {
-        final Config config = new Config();
-        Peer currentPeer = null;
-        String line;
+    /**
+     * Parses an series of "Interface" and "Peer" sections into a {@code Config}. Throws
+     * {@link BadConfigException} if the input is not well-formed or contains data that cannot
+     * be parsed.
+     *
+     * @param stream a stream of UTF-8 text that is interpreted as a WireGuard configuration
+     * @return a {@code Config} instance representing the supplied configuration
+     */
+    public static Config parse(final InputStream stream)
+            throws IOException, BadConfigException {
+        return parse(new BufferedReader(new InputStreamReader(stream)));
+    }
+
+    /**
+     * Parses an series of "Interface" and "Peer" sections into a {@code Config}. Throws
+     * {@link BadConfigException} if the input is not well-formed or contains data that cannot
+     * be parsed.
+     *
+     * @param reader a BufferedReader of UTF-8 text that is interpreted as a WireGuard configuration
+     * @return a {@code Config} instance representing the supplied configuration
+     */
+    public static Config parse(final BufferedReader reader)
+            throws IOException, BadConfigException {
+        final Builder builder = new Builder();
+        final Collection<String> interfaceLines = new ArrayList<>();
+        final Collection<String> peerLines = new ArrayList<>();
        boolean inInterfaceSection = false;
+        boolean inPeerSection = false;
+        @Nullable String line;
        while ((line = reader.readLine()) != null) {
            final int commentIndex = line.indexOf('#');
            if (commentIndex != -1)
@@ -47,122 +75,147 @@ public class Config {
            line = line.trim();
            if (line.isEmpty())
                continue;
-            if ("[Interface]".toLowerCase().equals(line.toLowerCase())) {
-                currentPeer = null;
-                inInterfaceSection = true;
-            } else if ("[Peer]".toLowerCase().equals(line.toLowerCase())) {
-                currentPeer = new Peer();
-                config.peers.add(currentPeer);
-                inInterfaceSection = false;
+            if (line.startsWith("[")) {
+                // Consume all [Peer] lines read so far.
+                if (inPeerSection) {
+                    builder.parsePeer(peerLines);
+                    peerLines.clear();
+                }
+                if ("[Interface]".equalsIgnoreCase(line)) {
+                    inInterfaceSection = true;
+                    inPeerSection = false;
+                } else if ("[Peer]".equalsIgnoreCase(line)) {
+                    inInterfaceSection = false;
+                    inPeerSection = true;
+                } else {
+                    throw new BadConfigException(Section.CONFIG, Location.TOP_LEVEL,
+                            Reason.UNKNOWN_SECTION, line);
+                }
            } else if (inInterfaceSection) {
-                config.interfaceSection.parse(line);
-            } else if (currentPeer != null) {
-                currentPeer.parse(line);
+                interfaceLines.add(line);
+            } else if (inPeerSection) {
+                peerLines.add(line);
            } else {
-                throw new IllegalArgumentException("Invalid configuration line: " + line);
+                throw new BadConfigException(Section.CONFIG, Location.TOP_LEVEL,
+                        Reason.UNKNOWN_SECTION, line);
            }
        }
-        if (!inInterfaceSection && currentPeer == null) {
-            throw new IllegalArgumentException("Could not find any config information");
-        }
-        return config;
+        if (inPeerSection)
+            builder.parsePeer(peerLines);
+        else if (!inInterfaceSection)
+            throw new BadConfigException(Section.CONFIG, Location.TOP_LEVEL,
+                    Reason.MISSING_SECTION, null);
+        // Combine all [Interface] sections in the file.
+        builder.parseInterface(interfaceLines);
+        return builder.build();
    }

+    @Override
+    public boolean equals(final Object obj) {
+        if (!(obj instanceof Config))
+            return false;
+        final Config other = (Config) obj;
+        return interfaze.equals(other.interfaze) && peers.equals(other.peers);
+    }
+
+    /**
+     * Returns the interface section of the configuration.
+     *
+     * @return the interface configuration
+     */
    public Interface getInterface() {
-        return interfaceSection;
+        return interfaze;
    }

+    /**
+     * Returns a list of the configuration's peer sections.
+     *
+     * @return a list of {@link Peer}s
+     */
    public List<Peer> getPeers() {
        return peers;
    }

+    @Override
+    public int hashCode() {
+        return 31 * interfaze.hashCode() + peers.hashCode();
+    }
+
+    /**
+     * Converts the {@code Config} into a string suitable for debugging purposes. The {@code Config}
+     * is identified by its interface's public key and the number of peers it has.
+     *
+     * @return a concise single-line identifier for the {@code Config}
+     */
    @Override
    public String toString() {
-        final StringBuilder sb = new StringBuilder().append(interfaceSection);
+        return "(Config " + interfaze + " (" + peers.size() + " peers))";
+    }
+
+    /**
+     * Converts the {@code Config} into a string suitable for use as a {@code wg-quick}
+     * configuration file.
+     *
+     * @return the {@code Config} represented as one [Interface] and zero or more [Peer] sections
+     */
+    public String toWgQuickString() {
+        final StringBuilder sb = new StringBuilder();
+        sb.append("[Interface]\n").append(interfaze.toWgQuickString());
        for (final Peer peer : peers)
-            sb.append('\n').append(peer);
+            sb.append("\n[Peer]\n").append(peer.toWgQuickString());
        return sb.toString();
    }

-    public static class Observable extends BaseObservable implements Parcelable {
-        public static final Creator<Observable> CREATOR = new Creator<Observable>() {
-            @Override
-            public Observable createFromParcel(final Parcel in) {
-                return new Observable(in);
-            }
+    /**
+     * Serializes the {@code Config} for use with the WireGuard cross-platform userspace API.
+     *
+     * @return the {@code Config} represented as a series of "key=value" lines
+     */
+    public String toWgUserspaceString() {
+        final StringBuilder sb = new StringBuilder();
+        sb.append(interfaze.toWgUserspaceString());
+        sb.append("replace_peers=true\n");
+        for (final Peer peer : peers)
+            sb.append(peer.toWgUserspaceString());
+        return sb.toString();
+    }

-            @Override
-            public Observable[] newArray(final int size) {
-                return new Observable[size];
-            }
-        };
-        private String name;
-        private Interface.Observable observableInterface;
-        private ObservableList<Peer.Observable> observablePeers;
+    @SuppressWarnings("UnusedReturnValue")
+    public static final class Builder {
+        // Defaults to an empty set.
+        private final Set<Peer> peers = new LinkedHashSet<>();
+        // No default; must be provided before building.
+        @Nullable private Interface interfaze;

-        public Observable(final Config parent, final String name) {
-            this.name = name;
-            loadData(parent);
+        public Builder addPeer(final Peer peer) {
+            peers.add(peer);
+            return this;
        }

-        private Observable(final Parcel in) {
-            name = in.readString();
-            observableInterface = in.readParcelable(Interface.Observable.class.getClassLoader());
-            observablePeers = new ObservableArrayList<>();
-            in.readTypedList(observablePeers, Peer.Observable.CREATOR);
+        public Builder addPeers(final Collection<Peer> peers) {
+            this.peers.addAll(peers);
+            return this;
        }

-        public void commitData(final Config parent) {
-            observableInterface.commitData(parent.interfaceSection);
-            final List<Peer> newPeers = new ArrayList<>(observablePeers.size());
-            for (final Peer.Observable observablePeer : observablePeers) {
-                final Peer peer = new Peer();
-                observablePeer.commitData(peer);
-                newPeers.add(peer);
-            }
-            parent.peers = newPeers;
-            notifyChange();
+        public Config build() {
+            if (interfaze == null)
+                throw new IllegalArgumentException("An [Interface] section is required");
+            return new Config(this);
        }

-        @Override
-        public int describeContents() {
-            return 0;
+        public Builder parseInterface(final Iterable<? extends CharSequence> lines)
+                throws BadConfigException {
+            return setInterface(Interface.parse(lines));
        }

-        @Bindable
-        public Interface.Observable getInterfaceSection() {
-            return observableInterface;
+        public Builder parsePeer(final Iterable<? extends CharSequence> lines)
+                throws BadConfigException {
+            return addPeer(Peer.parse(lines));
        }

-        @Bindable
-        public String getName() {
-            return name == null ? "" : name;
-        }
-
-        @Bindable
-        public ObservableList<Peer.Observable> getPeers() {
-            return observablePeers;
-        }
-
-        protected void loadData(final Config parent) {
-            observableInterface = new Interface.Observable(parent == null ? null : parent.interfaceSection);
-            observablePeers = new ObservableArrayList<>();
-            if (parent != null) {
-                for (final Peer peer : parent.getPeers())
-                    observablePeers.add(new Peer.Observable(peer));
-            }
-        }
-
-        public void setName(final String name) {
-            this.name = name;
-            notifyPropertyChanged(BR.name);
-        }
-
-        @Override
-        public void writeToParcel(final Parcel dest, final int flags) {
-            dest.writeString(name);
-            dest.writeParcelable(observableInterface, flags);
-            dest.writeTypedList(observablePeers);
+        public Builder setInterface(final Interface interfaze) {
+            this.interfaze = interfaze;
+            return this;
        }
    }
 }
@@ -1,48 +0,0 @@
-/*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-package com.wireguard.config;
-
-import java.net.Inet4Address;
-import java.net.Inet6Address;
-import java.net.InetAddress;
-import java.util.Locale;
-
-public class IPCidr {
-    private final InetAddress address;
-    private int cidr;
-
-    @SuppressWarnings("MagicNumber")
-    public IPCidr(String in) {
-        cidr = -1;
-        final int slash = in.lastIndexOf('/');
-        if (slash != -1 && slash < in.length() - 1) {
-            try {
-                cidr = Integer.parseInt(in.substring(slash + 1), 10);
-                in = in.substring(0, slash);
-            } catch (final Exception ignored) {
-            }
-        }
-        address = Attribute.parseIPString(in);
-        if ((address instanceof Inet6Address) && (cidr > 128 || cidr < 0))
-            cidr = 128;
-        else if ((address instanceof Inet4Address) && (cidr > 32 || cidr < 0))
-            cidr = 32;
-    }
-
-    public InetAddress getAddress() {
-        return address;
-    }
-
-    public int getCidr() {
-        return cidr;
-    }
-
-    @Override
-    public String toString() {
-        return String.format(Locale.getDefault(), "%s/%d", address.getHostAddress(), cidr);
-    }
-}
@@ -0,0 +1,72 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import android.os.Build;
+import java.lang.reflect.Method;
+import java.net.Inet4Address;
+import java.net.Inet6Address;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.util.regex.Pattern;
+
+import javax.annotation.Nullable;
+
+/**
+ * Utility methods for creating instances of {@link InetAddress}.
+ */
+public final class InetAddresses {
+    @Nullable private static final Method PARSER_METHOD;
+    private static final Pattern WONT_TOUCH_RESOLVER = Pattern.compile("^(((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:)))(%.+)?)|((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$");
+
+    static {
+        Method m = null;
+        try {
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q)
+                // noinspection JavaReflectionMemberAccess
+                m = InetAddress.class.getMethod("parseNumericAddress", String.class);
+        } catch (final Exception ignored) {
+        }
+        PARSER_METHOD = m;
+    }
+
+    private InetAddresses() { }
+
+    /**
+     * Parses a numeric IPv4 or IPv6 address without performing any DNS lookups.
+     *
+     * @param address a string representing the IP address
+     * @return an instance of {@link Inet4Address} or {@link Inet6Address}, as appropriate
+     */
+    public static InetAddress parse(final String address) throws ParseException {
+        if (address.isEmpty())
+            throw new ParseException(InetAddress.class, address, "Empty address");
+        try {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+                return android.net.InetAddresses.parseNumericAddress(address);
+            else if (PARSER_METHOD != null)
+                return (InetAddress) PARSER_METHOD.invoke(null, address);
+            else
+                throw new NoSuchMethodException("parseNumericAddress");
+        } catch (final IllegalArgumentException e) {
+            throw new ParseException(InetAddress.class, address, e);
+        } catch (final Exception e) {
+            final Throwable cause = e.getCause();
+            // Re-throw parsing exceptions with the original type, as callers might try to catch
+            // them. On the other hand, callers cannot be expected to handle reflection failures.
+            if (cause instanceof IllegalArgumentException)
+                throw new ParseException(InetAddress.class, address, cause);
+            try {
+                if (WONT_TOUCH_RESOLVER.matcher(address).matches())
+                    return InetAddress.getByName(address);
+                else
+                    throw new ParseException(InetAddress.class, address, "Not an IP address");
+            } catch (final UnknownHostException f) {
+                throw new ParseException(InetAddress.class, address, f);
+            }
+        }
+    }
+}
@@ -0,0 +1,125 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import androidx.annotation.Nullable;
+
+import org.threeten.bp.Duration;
+import org.threeten.bp.Instant;
+
+import java.net.Inet4Address;
+import java.net.InetAddress;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.UnknownHostException;
+import java.util.regex.Pattern;
+
+import java9.util.Optional;
+
+
+/**
+ * An external endpoint (host and port) used to connect to a WireGuard {@link Peer}.
+ * <p>
+ * Instances of this class are externally immutable.
+ */
+public final class InetEndpoint {
+    private static final Pattern BARE_IPV6 = Pattern.compile("^[^\\[\\]]*:[^\\[\\]]*");
+    private static final Pattern FORBIDDEN_CHARACTERS = Pattern.compile("[/?#]");
+
+    private final String host;
+    private final boolean isResolved;
+    private final Object lock = new Object();
+    private final int port;
+    private Instant lastResolution = Instant.EPOCH;
+    @Nullable private InetEndpoint resolved;
+
+    private InetEndpoint(final String host, final boolean isResolved, final int port) {
+        this.host = host;
+        this.isResolved = isResolved;
+        this.port = port;
+    }
+
+    public static InetEndpoint parse(final String endpoint) throws ParseException {
+        if (FORBIDDEN_CHARACTERS.matcher(endpoint).find())
+            throw new ParseException(InetEndpoint.class, endpoint, "Forbidden characters");
+        final URI uri;
+        try {
+            uri = new URI("wg://" + endpoint);
+        } catch (final URISyntaxException e) {
+            throw new IllegalArgumentException(e);
+        }
+        if (uri.getPort() < 0 || uri.getPort() > 65535)
+            throw new ParseException(InetEndpoint.class, endpoint, "Missing/invalid port number");
+        try {
+            InetAddresses.parse(uri.getHost());
+            // Parsing ths host as a numeric address worked, so we don't need to do DNS lookups.
+            return new InetEndpoint(uri.getHost(), true, uri.getPort());
+        } catch (final ParseException ignored) {
+            // Failed to parse the host as a numeric address, so it must be a DNS hostname/FQDN.
+            return new InetEndpoint(uri.getHost(), false, uri.getPort());
+        }
+    }
+
+    @Override
+    public boolean equals(final Object obj) {
+        if (!(obj instanceof InetEndpoint))
+            return false;
+        final InetEndpoint other = (InetEndpoint) obj;
+        return host.equals(other.host) && port == other.port;
+    }
+
+    public String getHost() {
+        return host;
+    }
+
+    public int getPort() {
+        return port;
+    }
+
+    /**
+     * Generate an {@code InetEndpoint} instance with the same port and the host resolved using DNS
+     * to a numeric address. If the host is already numeric, the existing instance may be returned.
+     * Because this function may perform network I/O, it must not be called from the main thread.
+     *
+     * @return the resolved endpoint, or {@link Optional#empty()}
+     */
+    public Optional<InetEndpoint> getResolved() {
+        if (isResolved)
+            return Optional.of(this);
+        synchronized (lock) {
+            //TODO(zx2c4): Implement a real timeout mechanism using DNS TTL
+            if (Duration.between(lastResolution, Instant.now()).toMinutes() > 1) {
+                try {
+                    // Prefer v4 endpoints over v6 to work around DNS64 and IPv6 NAT issues.
+                    final InetAddress[] candidates = InetAddress.getAllByName(host);
+                    InetAddress address = candidates[0];
+                    for (final InetAddress candidate : candidates) {
+                        if (candidate instanceof Inet4Address) {
+                            address = candidate;
+                            break;
+                        }
+                    }
+                    resolved = new InetEndpoint(address.getHostAddress(), true, port);
+                    lastResolution = Instant.now();
+                } catch (final UnknownHostException e) {
+                    resolved = null;
+                }
+            }
+            return Optional.ofNullable(resolved);
+        }
+    }
+
+    @Override
+    public int hashCode() {
+        return host.hashCode() ^ port;
+    }
+
+    @Override
+    public String toString() {
+        final boolean isBareIpv6 = isResolved && BARE_IPV6.matcher(host).matches();
+        return (isBareIpv6 ? '[' + host + ']' : host) + ':' + port;
+    }
+}
@@ -0,0 +1,76 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import java.net.Inet4Address;
+import java.net.InetAddress;
+
+/**
+ * An Internet network, denoted by its address and netmask
+ * <p>
+ * Instances of this class are immutable.
+ */
+public final class InetNetwork {
+    private final InetAddress address;
+    private final int mask;
+
+    private InetNetwork(final InetAddress address, final int mask) {
+        this.address = address;
+        this.mask = mask;
+    }
+
+    public static InetNetwork parse(final String network) throws ParseException {
+        final int slash = network.lastIndexOf('/');
+        final String maskString;
+        final int rawMask;
+        final String rawAddress;
+        if (slash >= 0) {
+            maskString = network.substring(slash + 1);
+            try {
+                rawMask = Integer.parseInt(maskString, 10);
+            } catch (final NumberFormatException ignored) {
+                throw new ParseException(Integer.class, maskString);
+            }
+            rawAddress = network.substring(0, slash);
+        } else {
+            maskString = "";
+            rawMask = -1;
+            rawAddress = network;
+        }
+        final InetAddress address = InetAddresses.parse(rawAddress);
+        final int maxMask = (address instanceof Inet4Address) ? 32 : 128;
+        if (rawMask > maxMask)
+            throw new ParseException(InetNetwork.class, maskString, "Invalid network mask");
+        final int mask = rawMask >= 0 && rawMask <= maxMask ? rawMask : maxMask;
+        return new InetNetwork(address, mask);
+    }
+
+    @Override
+    public boolean equals(final Object obj) {
+        if (!(obj instanceof InetNetwork))
+            return false;
+        final InetNetwork other = (InetNetwork) obj;
+        return address.equals(other.address) && mask == other.mask;
+    }
+
+    public InetAddress getAddress() {
+        return address;
+    }
+
+    public int getMask() {
+        return mask;
+    }
+
+    @Override
+    public int hashCode() {
+        return address.hashCode() ^ mask;
+    }
+
+    @Override
+    public String toString() {
+        return address.getHostAddress() + '/' + mask;
+    }
+}
@@ -1,329 +1,355 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.config;

-import android.databinding.BaseObservable;
-import android.databinding.Bindable;
-import android.os.Parcel;
-import android.os.Parcelable;
+import androidx.annotation.Nullable;

-import com.wireguard.android.BR;
-import com.wireguard.crypto.Keypair;
+import com.wireguard.config.BadConfigException.Location;
+import com.wireguard.config.BadConfigException.Reason;
+import com.wireguard.config.BadConfigException.Section;
+import com.wireguard.crypto.Key;
+import com.wireguard.crypto.KeyFormatException;
+import com.wireguard.crypto.KeyPair;

 import java.net.InetAddress;
-import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.LinkedHashSet;
 import java.util.List;
+import java.util.Locale;
+import java.util.Objects;
+import java.util.Set;
+
+import java9.util.Lists;
+import java9.util.Optional;
+import java9.util.stream.Collectors;
+import java9.util.stream.StreamSupport;

 /**
- * Represents the configuration for a WireGuard interface (an [Interface] block).
+ * Represents the configuration for a WireGuard interface (an [Interface] block). Interfaces must
+ * have a private key (used to initialize a {@code KeyPair}), and may optionally have several other
+ * attributes.
+ * <p>
+ * Instances of this class are immutable.
 */
+public final class Interface {
+    private static final int MAX_UDP_PORT = 65535;
+    private static final int MIN_UDP_PORT = 0;

-public class Interface {
-    private final List<IPCidr> addressList;
-    private final List<InetAddress> dnsList;
-    private Keypair keypair;
-    private int listenPort;
-    private int mtu;
+    private final Set<InetNetwork> addresses;
+    private final Set<InetAddress> dnsServers;
+    private final Set<String> excludedApplications;
+    private final KeyPair keyPair;
+    private final Optional<Integer> listenPort;
+    private final Optional<Integer> mtu;

-    public Interface() {
-        addressList = new ArrayList<>();
-        dnsList = new ArrayList<>();
+    private Interface(final Builder builder) {
+        // Defensively copy to ensure immutability even if the Builder is reused.
+        addresses = Collections.unmodifiableSet(new LinkedHashSet<>(builder.addresses));
+        dnsServers = Collections.unmodifiableSet(new LinkedHashSet<>(builder.dnsServers));
+        excludedApplications = Collections.unmodifiableSet(new LinkedHashSet<>(builder.excludedApplications));
+        keyPair = Objects.requireNonNull(builder.keyPair, "Interfaces must have a private key");
+        listenPort = builder.listenPort;
+        mtu = builder.mtu;
    }

-    private void addAddresses(final String[] addresses) {
-        if (addresses != null && addresses.length > 0) {
-            for (final String addr : addresses) {
-                if (addr.isEmpty())
-                    throw new IllegalArgumentException("Address is empty");
-                addressList.add(new IPCidr(addr));
+    /**
+     * Parses an series of "KEY = VALUE" lines into an {@code Interface}. Throws
+     * {@link ParseException} if the input is not well-formed or contains unknown attributes.
+     *
+     * @param lines An iterable sequence of lines, containing at least a private key attribute
+     * @return An {@code Interface} with all of the attributes from {@code lines} set
+     */
+    public static Interface parse(final Iterable<? extends CharSequence> lines)
+            throws BadConfigException {
+        final Builder builder = new Builder();
+        for (final CharSequence line : lines) {
+            final Attribute attribute = Attribute.parse(line).orElseThrow(() ->
+                    new BadConfigException(Section.INTERFACE, Location.TOP_LEVEL,
+                            Reason.SYNTAX_ERROR, line));
+            switch (attribute.getKey().toLowerCase(Locale.ENGLISH)) {
+                case "address":
+                    builder.parseAddresses(attribute.getValue());
+                    break;
+                case "dns":
+                    builder.parseDnsServers(attribute.getValue());
+                    break;
+                case "excludedapplications":
+                    builder.parseExcludedApplications(attribute.getValue());
+                    break;
+                case "listenport":
+                    builder.parseListenPort(attribute.getValue());
+                    break;
+                case "mtu":
+                    builder.parseMtu(attribute.getValue());
+                    break;
+                case "privatekey":
+                    builder.parsePrivateKey(attribute.getValue());
+                    break;
+                default:
+                    throw new BadConfigException(Section.INTERFACE, Location.TOP_LEVEL,
+                            Reason.UNKNOWN_ATTRIBUTE, attribute.getKey());
            }
        }
-    }
-
-    private void addDnses(final String[] dnses) {
-        if (dnses != null && dnses.length > 0) {
-            for (final String dns : dnses) {
-                dnsList.add(Attribute.parseIPString(dns));
-            }
-        }
-    }
-
-    private String getAddressString() {
-        if (addressList.isEmpty())
-            return null;
-        return Attribute.iterableToString(addressList);
-    }
-
-    public IPCidr[] getAddresses() {
-        return addressList.toArray(new IPCidr[addressList.size()]);
-    }
-
-    private String getDnsString() {
-        if (dnsList.isEmpty())
-            return null;
-        return Attribute.iterableToString(getDnsStrings());
-    }
-
-    private List<String> getDnsStrings() {
-        final List<String> strings = new ArrayList<>();
-        for (final InetAddress addr : dnsList)
-            strings.add(addr.getHostAddress());
-        return strings;
-    }
-
-    public InetAddress[] getDnses() {
-        return dnsList.toArray(new InetAddress[dnsList.size()]);
-    }
-
-    public int getListenPort() {
-        return listenPort;
-    }
-
-    private String getListenPortString() {
-        if (listenPort == 0)
-            return null;
-        return Integer.valueOf(listenPort).toString();
-    }
-
-    public int getMtu() {
-        return mtu;
-    }
-
-    private String getMtuString() {
-        if (mtu == 0)
-            return null;
-        return Integer.toString(mtu);
-    }
-
-    public String getPrivateKey() {
-        if (keypair == null)
-            return null;
-        return keypair.getPrivateKey();
-    }
-
-    public String getPublicKey() {
-        if (keypair == null)
-            return null;
-        return keypair.getPublicKey();
-    }
-
-    public void parse(final String line) {
-        final Attribute key = Attribute.match(line);
-        switch (key) {
-            case ADDRESS:
-                addAddresses(key.parseList(line));
-                break;
-            case DNS:
-                addDnses(key.parseList(line));
-                break;
-            case LISTEN_PORT:
-                setListenPortString(key.parse(line));
-                break;
-            case MTU:
-                setMtuString(key.parse(line));
-                break;
-            case PRIVATE_KEY:
-                setPrivateKey(key.parse(line));
-                break;
-            default:
-                throw new IllegalArgumentException(line);
-        }
-    }
-
-    private void setAddressString(final String addressString) {
-        addressList.clear();
-        addAddresses(Attribute.stringToList(addressString));
-    }
-
-    private void setDnsString(final String dnsString) {
-        dnsList.clear();
-        addDnses(Attribute.stringToList(dnsString));
-    }
-
-    private void setListenPort(final int listenPort) {
-        this.listenPort = listenPort;
-    }
-
-    private void setListenPortString(final String port) {
-        if (port != null && !port.isEmpty())
-            setListenPort(Integer.parseInt(port, 10));
-        else
-            setListenPort(0);
-    }
-
-    private void setMtu(final int mtu) {
-        this.mtu = mtu;
-    }
-
-    private void setMtuString(final String mtu) {
-        if (mtu != null && !mtu.isEmpty())
-            setMtu(Integer.parseInt(mtu, 10));
-        else
-            setMtu(0);
-    }
-
-    private void setPrivateKey(String privateKey) {
-        if (privateKey != null && privateKey.isEmpty())
-            privateKey = null;
-        keypair = privateKey == null ? null : new Keypair(privateKey);
+        return builder.build();
    }

+    @Override
+    public boolean equals(final Object obj) {
+        if (!(obj instanceof Interface))
+            return false;
+        final Interface other = (Interface) obj;
+        return addresses.equals(other.addresses)
+                && dnsServers.equals(other.dnsServers)
+                && excludedApplications.equals(other.excludedApplications)
+                && keyPair.equals(other.keyPair)
+                && listenPort.equals(other.listenPort)
+                && mtu.equals(other.mtu);
+    }
+
+    /**
+     * Returns the set of IP addresses assigned to the interface.
+     *
+     * @return a set of {@link InetNetwork}s
+     */
+    public Set<InetNetwork> getAddresses() {
+        // The collection is already immutable.
+        return addresses;
+    }
+
+    /**
+     * Returns the set of DNS servers associated with the interface.
+     *
+     * @return a set of {@link InetAddress}es
+     */
+    public Set<InetAddress> getDnsServers() {
+        // The collection is already immutable.
+        return dnsServers;
+    }
+
+    /**
+     * Returns the set of applications excluded from using the interface.
+     *
+     * @return a set of package names
+     */
+    public Set<String> getExcludedApplications() {
+        // The collection is already immutable.
+        return excludedApplications;
+    }
+
+    /**
+     * Returns the public/private key pair used by the interface.
+     *
+     * @return a key pair
+     */
+    public KeyPair getKeyPair() {
+        return keyPair;
+    }
+
+    /**
+     * Returns the UDP port number that the WireGuard interface will listen on.
+     *
+     * @return a UDP port number, or {@code Optional.empty()} if none is configured
+     */
+    public Optional<Integer> getListenPort() {
+        return listenPort;
+    }
+
+    /**
+     * Returns the MTU used for the WireGuard interface.
+     *
+     * @return the MTU, or {@code Optional.empty()} if none is configured
+     */
+    public Optional<Integer> getMtu() {
+        return mtu;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 1;
+        hash = 31 * hash + addresses.hashCode();
+        hash = 31 * hash + dnsServers.hashCode();
+        hash = 31 * hash + excludedApplications.hashCode();
+        hash = 31 * hash + keyPair.hashCode();
+        hash = 31 * hash + listenPort.hashCode();
+        hash = 31 * hash + mtu.hashCode();
+        return hash;
+    }
+
+    /**
+     * Converts the {@code Interface} into a string suitable for debugging purposes. The {@code
+     * Interface} is identified by its public key and (if set) the port used for its UDP socket.
+     *
+     * @return A concise single-line identifier for the {@code Interface}
+     */
    @Override
    public String toString() {
-        final StringBuilder sb = new StringBuilder().append("[Interface]\n");
-        if (!addressList.isEmpty())
-            sb.append(Attribute.ADDRESS.composeWith(addressList));
-        if (!dnsList.isEmpty())
-            sb.append(Attribute.DNS.composeWith(getDnsStrings()));
-        if (listenPort != 0)
-            sb.append(Attribute.LISTEN_PORT.composeWith(listenPort));
-        if (mtu != 0)
-            sb.append(Attribute.MTU.composeWith(mtu));
-        if (keypair != null)
-            sb.append(Attribute.PRIVATE_KEY.composeWith(keypair.getPrivateKey()));
+        final StringBuilder sb = new StringBuilder("(Interface ");
+        sb.append(keyPair.getPublicKey().toBase64());
+        listenPort.ifPresent(lp -> sb.append(" @").append(lp));
+        sb.append(')');
        return sb.toString();
    }

-    public static class Observable extends BaseObservable implements Parcelable {
-        public static final Creator<Observable> CREATOR = new Creator<Observable>() {
-            @Override
-            public Observable createFromParcel(final Parcel in) {
-                return new Observable(in);
-            }
+    /**
+     * Converts the {@code Interface} into a string suitable for inclusion in a {@code wg-quick}
+     * configuration file.
+     *
+     * @return The {@code Interface} represented as a series of "Key = Value" lines
+     */
+    public String toWgQuickString() {
+        final StringBuilder sb = new StringBuilder();
+        if (!addresses.isEmpty())
+            sb.append("Address = ").append(Attribute.join(addresses)).append('\n');
+        if (!dnsServers.isEmpty()) {
+            final List<String> dnsServerStrings = StreamSupport.stream(dnsServers)
+                    .map(InetAddress::getHostAddress)
+                    .collect(Collectors.toUnmodifiableList());
+            sb.append("DNS = ").append(Attribute.join(dnsServerStrings)).append('\n');
+        }
+        if (!excludedApplications.isEmpty())
+            sb.append("ExcludedApplications = ").append(Attribute.join(excludedApplications)).append('\n');
+        listenPort.ifPresent(lp -> sb.append("ListenPort = ").append(lp).append('\n'));
+        mtu.ifPresent(m -> sb.append("MTU = ").append(m).append('\n'));
+        sb.append("PrivateKey = ").append(keyPair.getPrivateKey().toBase64()).append('\n');
+        return sb.toString();
+    }

-            @Override
-            public Observable[] newArray(final int size) {
-                return new Observable[size];
-            }
-        };
-        private String addresses;
-        private String dnses;
-        private String listenPort;
-        private String mtu;
-        private String privateKey;
-        private String publicKey;
+    /**
+     * Serializes the {@code Interface} for use with the WireGuard cross-platform userspace API.
+     * Note that not all attributes are included in this representation.
+     *
+     * @return the {@code Interface} represented as a series of "KEY=VALUE" lines
+     */
+    public String toWgUserspaceString() {
+        final StringBuilder sb = new StringBuilder();
+        sb.append("private_key=").append(keyPair.getPrivateKey().toHex()).append('\n');
+        listenPort.ifPresent(lp -> sb.append("listen_port=").append(lp).append('\n'));
+        return sb.toString();
+    }

-        public Observable(final Interface parent) {
-            if (parent != null)
-                loadData(parent);
+    @SuppressWarnings("UnusedReturnValue")
+    public static final class Builder {
+        // Defaults to an empty set.
+        private final Set<InetNetwork> addresses = new LinkedHashSet<>();
+        // Defaults to an empty set.
+        private final Set<InetAddress> dnsServers = new LinkedHashSet<>();
+        // Defaults to an empty set.
+        private final Set<String> excludedApplications = new LinkedHashSet<>();
+        // No default; must be provided before building.
+        @Nullable private KeyPair keyPair;
+        // Defaults to not present.
+        private Optional<Integer> listenPort = Optional.empty();
+        // Defaults to not present.
+        private Optional<Integer> mtu = Optional.empty();
+
+        public Builder addAddress(final InetNetwork address) {
+            addresses.add(address);
+            return this;
        }

-        private Observable(final Parcel in) {
-            addresses = in.readString();
-            dnses = in.readString();
-            publicKey = in.readString();
-            privateKey = in.readString();
-            listenPort = in.readString();
-            mtu = in.readString();
+        public Builder addAddresses(final Collection<InetNetwork> addresses) {
+            this.addresses.addAll(addresses);
+            return this;
        }

-        public void commitData(final Interface parent) {
-            parent.setAddressString(addresses);
-            parent.setDnsString(dnses);
-            parent.setPrivateKey(privateKey);
-            parent.setListenPortString(listenPort);
-            parent.setMtuString(mtu);
-            loadData(parent);
-            notifyChange();
+        public Builder addDnsServer(final InetAddress dnsServer) {
+            dnsServers.add(dnsServer);
+            return this;
        }

-        @Override
-        public int describeContents() {
-            return 0;
+        public Builder addDnsServers(final Collection<? extends InetAddress> dnsServers) {
+            this.dnsServers.addAll(dnsServers);
+            return this;
        }

-        public void generateKeypair() {
-            final Keypair keypair = new Keypair();
-            privateKey = keypair.getPrivateKey();
-            publicKey = keypair.getPublicKey();
-            notifyPropertyChanged(BR.privateKey);
-            notifyPropertyChanged(BR.publicKey);
+        public Interface build() throws BadConfigException {
+            if (keyPair == null)
+                throw new BadConfigException(Section.INTERFACE, Location.PRIVATE_KEY,
+                        Reason.MISSING_ATTRIBUTE, null);
+            return new Interface(this);
        }

-        @Bindable
-        public String getAddresses() {
-            return addresses;
+        public Builder excludeApplication(final String application) {
+            excludedApplications.add(application);
+            return this;
        }

-        @Bindable
-        public String getDnses() {
-            return dnses;
+        public Builder excludeApplications(final Collection<String> applications) {
+            excludedApplications.addAll(applications);
+            return this;
        }

-        @Bindable
-        public String getListenPort() {
-            return listenPort;
-        }
-
-        @Bindable
-        public String getMtu() {
-            return mtu;
-        }
-
-        @Bindable
-        public String getPrivateKey() {
-            return privateKey;
-        }
-
-        @Bindable
-        public String getPublicKey() {
-            return publicKey;
-        }
-
-        protected void loadData(final Interface parent) {
-            addresses = parent.getAddressString();
-            dnses = parent.getDnsString();
-            publicKey = parent.getPublicKey();
-            privateKey = parent.getPrivateKey();
-            listenPort = parent.getListenPortString();
-            mtu = parent.getMtuString();
-        }
-
-        public void setAddresses(final String addresses) {
-            this.addresses = addresses;
-            notifyPropertyChanged(BR.addresses);
-        }
-
-        public void setDnses(final String dnses) {
-            this.dnses = dnses;
-            notifyPropertyChanged(BR.dnses);
-        }
-
-        public void setListenPort(final String listenPort) {
-            this.listenPort = listenPort;
-            notifyPropertyChanged(BR.listenPort);
-        }
-
-        public void setMtu(final String mtu) {
-            this.mtu = mtu;
-            notifyPropertyChanged(BR.mtu);
-        }
-
-        public void setPrivateKey(final String privateKey) {
-            this.privateKey = privateKey;
-
+        public Builder parseAddresses(final CharSequence addresses) throws BadConfigException {
            try {
-                publicKey = new Keypair(privateKey).getPublicKey();
-            } catch (final IllegalArgumentException ignored) {
-                publicKey = "";
+                for (final String address : Attribute.split(addresses))
+                    addAddress(InetNetwork.parse(address));
+                return this;
+            } catch (final ParseException e) {
+                throw new BadConfigException(Section.INTERFACE, Location.ADDRESS, e);
            }
-
-            notifyPropertyChanged(BR.privateKey);
-            notifyPropertyChanged(BR.publicKey);
        }

-        @Override
-        public void writeToParcel(final Parcel dest, final int flags) {
-            dest.writeString(addresses);
-            dest.writeString(dnses);
-            dest.writeString(publicKey);
-            dest.writeString(privateKey);
-            dest.writeString(listenPort);
-            dest.writeString(mtu);
+        public Builder parseDnsServers(final CharSequence dnsServers) throws BadConfigException {
+            try {
+                for (final String dnsServer : Attribute.split(dnsServers))
+                    addDnsServer(InetAddresses.parse(dnsServer));
+                return this;
+            } catch (final ParseException e) {
+                throw new BadConfigException(Section.INTERFACE, Location.DNS, e);
+            }
+        }
+
+        public Builder parseExcludedApplications(final CharSequence apps) {
+            return excludeApplications(Lists.of(Attribute.split(apps)));
+        }
+
+        public Builder parseListenPort(final String listenPort) throws BadConfigException {
+            try {
+                return setListenPort(Integer.parseInt(listenPort));
+            } catch (final NumberFormatException e) {
+                throw new BadConfigException(Section.INTERFACE, Location.LISTEN_PORT, listenPort, e);
+            }
+        }
+
+        public Builder parseMtu(final String mtu) throws BadConfigException {
+            try {
+                return setMtu(Integer.parseInt(mtu));
+            } catch (final NumberFormatException e) {
+                throw new BadConfigException(Section.INTERFACE, Location.MTU, mtu, e);
+            }
+        }
+
+        public Builder parsePrivateKey(final String privateKey) throws BadConfigException {
+            try {
+                return setKeyPair(new KeyPair(Key.fromBase64(privateKey)));
+            } catch (final KeyFormatException e) {
+                throw new BadConfigException(Section.INTERFACE, Location.PRIVATE_KEY, e);
+            }
+        }
+
+        public Builder setKeyPair(final KeyPair keyPair) {
+            this.keyPair = keyPair;
+            return this;
+        }
+
+        public Builder setListenPort(final int listenPort) throws BadConfigException {
+            if (listenPort < MIN_UDP_PORT || listenPort > MAX_UDP_PORT)
+                throw new BadConfigException(Section.INTERFACE, Location.LISTEN_PORT,
+                        Reason.INVALID_VALUE, String.valueOf(listenPort));
+            this.listenPort = listenPort == 0 ? Optional.empty() : Optional.of(listenPort);
+            return this;
+        }
+
+        public Builder setMtu(final int mtu) throws BadConfigException {
+            if (mtu < 0)
+                throw new BadConfigException(Section.INTERFACE, Location.LISTEN_PORT,
+                        Reason.INVALID_VALUE, String.valueOf(mtu));
+            this.mtu = mtu == 0 ? Optional.empty() : Optional.of(mtu);
+            return this;
        }
    }
 }
@@ -0,0 +1,44 @@
+/*
+ * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import androidx.annotation.Nullable;
+
+/**
+ */
+public class ParseException extends Exception {
+    private final Class<?> parsingClass;
+    private final CharSequence text;
+
+    public ParseException(final Class<?> parsingClass, final CharSequence text,
+                          @Nullable final String message, @Nullable final Throwable cause) {
+        super(message, cause);
+        this.parsingClass = parsingClass;
+        this.text = text;
+    }
+
+    public ParseException(final Class<?> parsingClass, final CharSequence text,
+                          @Nullable final String message) {
+        this(parsingClass, text, message, null);
+    }
+
+    public ParseException(final Class<?> parsingClass, final CharSequence text,
+                          @Nullable final Throwable cause) {
+        this(parsingClass, text, null, cause);
+    }
+
+    public ParseException(final Class<?> parsingClass, final CharSequence text) {
+        this(parsingClass, text, null, null);
+    }
+
+    public Class<?> getParsingClass() {
+        return parsingClass;
+    }
+
+    public CharSequence getText() {
+        return text;
+    }
+}
@@ -1,315 +1,306 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.config;

-import android.databinding.BaseObservable;
-import android.databinding.Bindable;
-import android.os.Parcel;
-import android.os.Parcelable;
+import androidx.annotation.Nullable;

-import com.android.databinding.library.baseAdapters.BR;
-import com.wireguard.crypto.KeyEncoding;
+import com.wireguard.config.BadConfigException.Location;
+import com.wireguard.config.BadConfigException.Reason;
+import com.wireguard.config.BadConfigException.Section;
+import com.wireguard.crypto.Key;
+import com.wireguard.crypto.KeyFormatException;

-import java.net.Inet6Address;
-import java.net.InetSocketAddress;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.net.UnknownHostException;
-import java.util.ArrayList;
-import java.util.List;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.LinkedHashSet;
 import java.util.Locale;
+import java.util.Objects;
+import java.util.Set;
+
+import java9.util.Optional;

 /**
- * Represents the configuration for a WireGuard peer (a [Peer] block).
+ * Represents the configuration for a WireGuard peer (a [Peer] block). Peers must have a public key,
+ * and may optionally have several other attributes.
+ * <p>
+ * Instances of this class are immutable.
 */
+public final class Peer {
+    private final Set<InetNetwork> allowedIps;
+    private final Optional<InetEndpoint> endpoint;
+    private final Optional<Integer> persistentKeepalive;
+    private final Optional<Key> preSharedKey;
+    private final Key publicKey;

-public class Peer {
-    private final List<IPCidr> allowedIPsList;
-    private InetSocketAddress endpoint;
-    private int persistentKeepalive;
-    private String preSharedKey;
-    private String publicKey;
-
-    public Peer() {
-        allowedIPsList = new ArrayList<>();
+    private Peer(final Builder builder) {
+        // Defensively copy to ensure immutability even if the Builder is reused.
+        allowedIps = Collections.unmodifiableSet(new LinkedHashSet<>(builder.allowedIps));
+        endpoint = builder.endpoint;
+        persistentKeepalive = builder.persistentKeepalive;
+        preSharedKey = builder.preSharedKey;
+        publicKey = Objects.requireNonNull(builder.publicKey, "Peers must have a public key");
    }

-    private void addAllowedIPs(final String[] allowedIPs) {
-        if (allowedIPs != null && allowedIPs.length > 0) {
-            for (final String allowedIP : allowedIPs) {
-                allowedIPsList.add(new IPCidr(allowedIP));
+    /**
+     * Parses an series of "KEY = VALUE" lines into a {@code Peer}. Throws {@link ParseException} if
+     * the input is not well-formed or contains unknown attributes.
+     *
+     * @param lines an iterable sequence of lines, containing at least a public key attribute
+     * @return a {@code Peer} with all of its attributes set from {@code lines}
+     */
+    public static Peer parse(final Iterable<? extends CharSequence> lines)
+            throws BadConfigException {
+        final Builder builder = new Builder();
+        for (final CharSequence line : lines) {
+            final Attribute attribute = Attribute.parse(line).orElseThrow(() ->
+                    new BadConfigException(Section.PEER, Location.TOP_LEVEL,
+                            Reason.SYNTAX_ERROR, line));
+            switch (attribute.getKey().toLowerCase(Locale.ENGLISH)) {
+                case "allowedips":
+                    builder.parseAllowedIPs(attribute.getValue());
+                    break;
+                case "endpoint":
+                    builder.parseEndpoint(attribute.getValue());
+                    break;
+                case "persistentkeepalive":
+                    builder.parsePersistentKeepalive(attribute.getValue());
+                    break;
+                case "presharedkey":
+                    builder.parsePreSharedKey(attribute.getValue());
+                    break;
+                case "publickey":
+                    builder.parsePublicKey(attribute.getValue());
+                    break;
+                default:
+                    throw new BadConfigException(Section.PEER, Location.TOP_LEVEL,
+                            Reason.UNKNOWN_ATTRIBUTE, attribute.getKey());
            }
        }
-    }
-
-    public IPCidr[] getAllowedIPs() {
-        return allowedIPsList.toArray(new IPCidr[allowedIPsList.size()]);
-    }
-
-    private String getAllowedIPsString() {
-        if (allowedIPsList.isEmpty())
-            return null;
-        return Attribute.iterableToString(allowedIPsList);
-    }
-
-    public InetSocketAddress getEndpoint() {
-        return endpoint;
-    }
-
-    private String getEndpointString() {
-        if (endpoint == null)
-            return null;
-        return String.format(Locale.getDefault(), "%s:%d", endpoint.getHostString(), endpoint.getPort());
-    }
-
-    public int getPersistentKeepalive() {
-        return persistentKeepalive;
-    }
-
-    private String getPersistentKeepaliveString() {
-        if (persistentKeepalive == 0)
-            return null;
-        return Integer.valueOf(persistentKeepalive).toString();
-    }
-
-    public String getPreSharedKey() {
-        return preSharedKey;
-    }
-
-    public String getPublicKey() {
-        return publicKey;
-    }
-
-    public String getResolvedEndpointString() throws UnknownHostException {
-        if (endpoint == null)
-            throw new UnknownHostException("{empty}");
-        if (endpoint.isUnresolved())
-            endpoint = new InetSocketAddress(endpoint.getHostString(), endpoint.getPort());
-        if (endpoint.isUnresolved())
-            throw new UnknownHostException(endpoint.getHostString());
-        if (endpoint.getAddress() instanceof Inet6Address)
-            return String.format(Locale.getDefault(),
-                    "[%s]:%d",
-                    endpoint.getAddress().getHostAddress(),
-                    endpoint.getPort());
-        return String.format(Locale.getDefault(),
-                "%s:%d",
-                endpoint.getAddress().getHostAddress(),
-                endpoint.getPort());
-    }
-
-    public void parse(final String line) {
-        final Attribute key = Attribute.match(line);
-        switch (key) {
-            case ALLOWED_IPS:
-                addAllowedIPs(key.parseList(line));
-                break;
-            case ENDPOINT:
-                setEndpointString(key.parse(line));
-                break;
-            case PERSISTENT_KEEPALIVE:
-                setPersistentKeepaliveString(key.parse(line));
-                break;
-            case PRESHARED_KEY:
-                setPreSharedKey(key.parse(line));
-                break;
-            case PUBLIC_KEY:
-                setPublicKey(key.parse(line));
-                break;
-            default:
-                throw new IllegalArgumentException(line);
-        }
-    }
-
-    private void setAllowedIPsString(final String allowedIPsString) {
-        allowedIPsList.clear();
-        addAllowedIPs(Attribute.stringToList(allowedIPsString));
-    }
-
-    private void setEndpoint(final InetSocketAddress endpoint) {
-        this.endpoint = endpoint;
-    }
-
-    private void setEndpointString(final String endpoint) {
-        if (endpoint != null && !endpoint.isEmpty()) {
-            final InetSocketAddress constructedEndpoint;
-            if (endpoint.indexOf('/') != -1 || endpoint.indexOf('?') != -1 || endpoint.indexOf('#') != -1)
-                throw new IllegalArgumentException("Forbidden characters in endpoint");
-            final URI uri;
-            try {
-                uri = new URI("wg://" + endpoint);
-            } catch (final URISyntaxException e) {
-                throw new IllegalArgumentException(e);
-            }
-            constructedEndpoint = InetSocketAddress.createUnresolved(uri.getHost(), uri.getPort());
-            setEndpoint(constructedEndpoint);
-        } else
-            setEndpoint(null);
-    }
-
-    private void setPersistentKeepalive(final int persistentKeepalive) {
-        this.persistentKeepalive = persistentKeepalive;
-    }
-
-    private void setPersistentKeepaliveString(final String persistentKeepalive) {
-        if (persistentKeepalive != null && !persistentKeepalive.isEmpty())
-            setPersistentKeepalive(Integer.parseInt(persistentKeepalive, 10));
-        else
-            setPersistentKeepalive(0);
-    }
-
-    private void setPreSharedKey(String preSharedKey) {
-        if (preSharedKey != null && preSharedKey.isEmpty())
-            preSharedKey = null;
-        if (preSharedKey != null)
-            KeyEncoding.keyFromBase64(preSharedKey);
-        this.preSharedKey = preSharedKey;
-    }
-
-    private void setPublicKey(String publicKey) {
-        if (publicKey != null && publicKey.isEmpty())
-            publicKey = null;
-        if (publicKey != null)
-            KeyEncoding.keyFromBase64(publicKey);
-        this.publicKey = publicKey;
+        return builder.build();
    }

+    @Override
+    public boolean equals(final Object obj) {
+        if (!(obj instanceof Peer))
+            return false;
+        final Peer other = (Peer) obj;
+        return allowedIps.equals(other.allowedIps)
+                && endpoint.equals(other.endpoint)
+                && persistentKeepalive.equals(other.persistentKeepalive)
+                && preSharedKey.equals(other.preSharedKey)
+                && publicKey.equals(other.publicKey);
+    }
+
+    /**
+     * Returns the peer's set of allowed IPs.
+     *
+     * @return the set of allowed IPs
+     */
+    public Set<InetNetwork> getAllowedIps() {
+        // The collection is already immutable.
+        return allowedIps;
+    }
+
+    /**
+     * Returns the peer's endpoint.
+     *
+     * @return the endpoint, or {@code Optional.empty()} if none is configured
+     */
+    public Optional<InetEndpoint> getEndpoint() {
+        return endpoint;
+    }
+
+    /**
+     * Returns the peer's persistent keepalive.
+     *
+     * @return the persistent keepalive, or {@code Optional.empty()} if none is configured
+     */
+    public Optional<Integer> getPersistentKeepalive() {
+        return persistentKeepalive;
+    }
+
+    /**
+     * Returns the peer's pre-shared key.
+     *
+     * @return the pre-shared key, or {@code Optional.empty()} if none is configured
+     */
+    public Optional<Key> getPreSharedKey() {
+        return preSharedKey;
+    }
+
+    /**
+     * Returns the peer's public key.
+     *
+     * @return the public key
+     */
+    public Key getPublicKey() {
+        return publicKey;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 1;
+        hash = 31 * hash + allowedIps.hashCode();
+        hash = 31 * hash + endpoint.hashCode();
+        hash = 31 * hash + persistentKeepalive.hashCode();
+        hash = 31 * hash + preSharedKey.hashCode();
+        hash = 31 * hash + publicKey.hashCode();
+        return hash;
+    }
+
+    /**
+     * Converts the {@code Peer} into a string suitable for debugging purposes. The {@code Peer} is
+     * identified by its public key and (if known) its endpoint.
+     *
+     * @return a concise single-line identifier for the {@code Peer}
+     */
    @Override
    public String toString() {
-        final StringBuilder sb = new StringBuilder().append("[Peer]\n");
-        if (!allowedIPsList.isEmpty())
-            sb.append(Attribute.ALLOWED_IPS.composeWith(allowedIPsList));
-        if (endpoint != null)
-            sb.append(Attribute.ENDPOINT.composeWith(getEndpointString()));
-        if (persistentKeepalive != 0)
-            sb.append(Attribute.PERSISTENT_KEEPALIVE.composeWith(persistentKeepalive));
-        if (preSharedKey != null)
-            sb.append(Attribute.PRESHARED_KEY.composeWith(preSharedKey));
-        if (publicKey != null)
-            sb.append(Attribute.PUBLIC_KEY.composeWith(publicKey));
+        final StringBuilder sb = new StringBuilder("(Peer ");
+        sb.append(publicKey.toBase64());
+        endpoint.ifPresent(ep -> sb.append(" @").append(ep));
+        sb.append(')');
        return sb.toString();
    }

-    public static class Observable extends BaseObservable implements Parcelable {
-        public static final Creator<Observable> CREATOR = new Creator<Observable>() {
-            @Override
-            public Observable createFromParcel(final Parcel in) {
-                return new Observable(in);
+    /**
+     * Converts the {@code Peer} into a string suitable for inclusion in a {@code wg-quick}
+     * configuration file.
+     *
+     * @return the {@code Peer} represented as a series of "Key = Value" lines
+     */
+    public String toWgQuickString() {
+        final StringBuilder sb = new StringBuilder();
+        if (!allowedIps.isEmpty())
+            sb.append("AllowedIPs = ").append(Attribute.join(allowedIps)).append('\n');
+        endpoint.ifPresent(ep -> sb.append("Endpoint = ").append(ep).append('\n'));
+        persistentKeepalive.ifPresent(pk -> sb.append("PersistentKeepalive = ").append(pk).append('\n'));
+        preSharedKey.ifPresent(psk -> sb.append("PreSharedKey = ").append(psk.toBase64()).append('\n'));
+        sb.append("PublicKey = ").append(publicKey.toBase64()).append('\n');
+        return sb.toString();
+    }
+
+    /**
+     * Serializes the {@code Peer} for use with the WireGuard cross-platform userspace API. Note
+     * that not all attributes are included in this representation.
+     *
+     * @return the {@code Peer} represented as a series of "key=value" lines
+     */
+    public String toWgUserspaceString() {
+        final StringBuilder sb = new StringBuilder();
+        // The order here is important: public_key signifies the beginning of a new peer.
+        sb.append("public_key=").append(publicKey.toHex()).append('\n');
+        for (final InetNetwork allowedIp : allowedIps)
+            sb.append("allowed_ip=").append(allowedIp).append('\n');
+        endpoint.flatMap(InetEndpoint::getResolved).ifPresent(ep -> sb.append("endpoint=").append(ep).append('\n'));
+        persistentKeepalive.ifPresent(pk -> sb.append("persistent_keepalive_interval=").append(pk).append('\n'));
+        preSharedKey.ifPresent(psk -> sb.append("preshared_key=").append(psk.toHex()).append('\n'));
+        return sb.toString();
+    }
+
+    @SuppressWarnings("UnusedReturnValue")
+    public static final class Builder {
+        // See wg(8)
+        private static final int MAX_PERSISTENT_KEEPALIVE = 65535;
+
+        // Defaults to an empty set.
+        private final Set<InetNetwork> allowedIps = new LinkedHashSet<>();
+        // Defaults to not present.
+        private Optional<InetEndpoint> endpoint = Optional.empty();
+        // Defaults to not present.
+        private Optional<Integer> persistentKeepalive = Optional.empty();
+        // Defaults to not present.
+        private Optional<Key> preSharedKey = Optional.empty();
+        // No default; must be provided before building.
+        @Nullable private Key publicKey;
+
+        public Builder addAllowedIp(final InetNetwork allowedIp) {
+            allowedIps.add(allowedIp);
+            return this;
+        }
+
+        public Builder addAllowedIps(final Collection<InetNetwork> allowedIps) {
+            this.allowedIps.addAll(allowedIps);
+            return this;
+        }
+
+        public Peer build() throws BadConfigException {
+            if (publicKey == null)
+                throw new BadConfigException(Section.PEER, Location.PUBLIC_KEY,
+                        Reason.MISSING_ATTRIBUTE, null);
+            return new Peer(this);
+        }
+
+        public Builder parseAllowedIPs(final CharSequence allowedIps) throws BadConfigException {
+            try {
+                for (final String allowedIp : Attribute.split(allowedIps))
+                    addAllowedIp(InetNetwork.parse(allowedIp));
+                return this;
+            } catch (final ParseException e) {
+                throw new BadConfigException(Section.PEER, Location.ALLOWED_IPS, e);
            }
+        }

-            @Override
-            public Observable[] newArray(final int size) {
-                return new Observable[size];
+        public Builder parseEndpoint(final String endpoint) throws BadConfigException {
+            try {
+                return setEndpoint(InetEndpoint.parse(endpoint));
+            } catch (final ParseException e) {
+                throw new BadConfigException(Section.PEER, Location.ENDPOINT, e);
            }
-        };
-        private String allowedIPs;
-        private String endpoint;
-        private String persistentKeepalive;
-        private String preSharedKey;
-        private String publicKey;
-
-        public Observable(final Peer parent) {
-            loadData(parent);
        }

-        private Observable(final Parcel in) {
-            allowedIPs = in.readString();
-            endpoint = in.readString();
-            persistentKeepalive = in.readString();
-            preSharedKey = in.readString();
-            publicKey = in.readString();
+        public Builder parsePersistentKeepalive(final String persistentKeepalive)
+                throws BadConfigException {
+            try {
+                return setPersistentKeepalive(Integer.parseInt(persistentKeepalive));
+            } catch (final NumberFormatException e) {
+                throw new BadConfigException(Section.PEER, Location.PERSISTENT_KEEPALIVE,
+                        persistentKeepalive, e);
+            }
        }

-        public static Observable newInstance() {
-            return new Observable(new Peer());
+        public Builder parsePreSharedKey(final String preSharedKey) throws BadConfigException {
+            try {
+                return setPreSharedKey(Key.fromBase64(preSharedKey));
+            } catch (final KeyFormatException e) {
+                throw new BadConfigException(Section.PEER, Location.PRE_SHARED_KEY, e);
+            }
        }

-        public void commitData(final Peer parent) {
-            parent.setAllowedIPsString(allowedIPs);
-            parent.setEndpointString(endpoint);
-            parent.setPersistentKeepaliveString(persistentKeepalive);
-            parent.setPreSharedKey(preSharedKey);
-            parent.setPublicKey(publicKey);
-            if (parent.getPublicKey() == null)
-                throw new IllegalArgumentException("Peer public key may not be empty");
-            loadData(parent);
-            notifyChange();
+        public Builder parsePublicKey(final String publicKey) throws BadConfigException {
+            try {
+                return setPublicKey(Key.fromBase64(publicKey));
+            } catch (final KeyFormatException e) {
+                throw new BadConfigException(Section.PEER, Location.PUBLIC_KEY, e);
+            }
        }

-        @Override
-        public int describeContents() {
-            return 0;
+        public Builder setEndpoint(final InetEndpoint endpoint) {
+            this.endpoint = Optional.of(endpoint);
+            return this;
        }

-        @Bindable
-        public String getAllowedIPs() {
-            return allowedIPs;
+        public Builder setPersistentKeepalive(final int persistentKeepalive)
+                throws BadConfigException {
+            if (persistentKeepalive < 0 || persistentKeepalive > MAX_PERSISTENT_KEEPALIVE)
+                throw new BadConfigException(Section.PEER, Location.PERSISTENT_KEEPALIVE,
+                        Reason.INVALID_VALUE, String.valueOf(persistentKeepalive));
+            this.persistentKeepalive = persistentKeepalive == 0 ?
+                    Optional.empty() : Optional.of(persistentKeepalive);
+            return this;
        }

-        @Bindable
-        public String getEndpoint() {
-            return endpoint;
+        public Builder setPreSharedKey(final Key preSharedKey) {
+            this.preSharedKey = Optional.of(preSharedKey);
+            return this;
        }

-        @Bindable
-        public String getPersistentKeepalive() {
-            return persistentKeepalive;
-        }
-
-        @Bindable
-        public String getPreSharedKey() {
-            return preSharedKey;
-        }
-
-        @Bindable
-        public String getPublicKey() {
-            return publicKey;
-        }
-
-        protected void loadData(final Peer parent) {
-            allowedIPs = parent.getAllowedIPsString();
-            endpoint = parent.getEndpointString();
-            persistentKeepalive = parent.getPersistentKeepaliveString();
-            preSharedKey = parent.getPreSharedKey();
-            publicKey = parent.getPublicKey();
-        }
-
-        public void setAllowedIPs(final String allowedIPs) {
-            this.allowedIPs = allowedIPs;
-            notifyPropertyChanged(BR.allowedIPs);
-        }
-
-        public void setEndpoint(final String endpoint) {
-            this.endpoint = endpoint;
-            notifyPropertyChanged(BR.endpoint);
-        }
-
-        public void setPersistentKeepalive(final String persistentKeepalive) {
-            this.persistentKeepalive = persistentKeepalive;
-            notifyPropertyChanged(BR.persistentKeepalive);
-        }
-
-        public void setPreSharedKey(final String preSharedKey) {
-            this.preSharedKey = preSharedKey;
-            notifyPropertyChanged(BR.preSharedKey);
-        }
-
-        public void setPublicKey(final String publicKey) {
+        public Builder setPublicKey(final Key publicKey) {
            this.publicKey = publicKey;
-            notifyPropertyChanged(BR.publicKey);
-        }
-
-        @Override
-        public void writeToParcel(final Parcel dest, final int flags) {
-            dest.writeString(allowedIPs);
-            dest.writeString(endpoint);
-            dest.writeString(persistentKeepalive);
-            dest.writeString(preSharedKey);
-            dest.writeString(publicKey);
+            return this;
        }
    }
 }
@@ -1,32 +1,35 @@
 /*
 * Copyright © 2016 Southern Storm Software, Pty Ltd.
- * SPDX-License-Identifier: MIT
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

 package com.wireguard.crypto;

+import androidx.annotation.Nullable;
+
 import java.util.Arrays;

 /**
 * Implementation of the Curve25519 elliptic curve algorithm.
 * <p>
+ * This implementation was imported to WireGuard from noise-java:
+ * https://github.com/rweather/noise-java
+ * <p>
 * This implementation is based on that from arduinolibs:
 * https://github.com/rweather/arduinolibs
 * <p>
- * This implementation is copied verbatim from noise-java:
- * https://github.com/rweather/noise-java
- * <p>
 * Differences in this version are due to using 26-bit limbs for the
 * representation instead of the 8/16/32-bit limbs in the original.
 * <p>
 * References: http://cr.yp.to/ecdh.html, RFC 7748
 */
-@SuppressWarnings("MagicNumber")
+@SuppressWarnings({"MagicNumber", "NonConstantFieldWithUpperCaseName", "SuspiciousNameCombination"})
 public final class Curve25519 {
-
    // Numbers modulo 2^255 - 19 are broken up into ten 26-bit words.
    private static final int NUM_LIMBS_255BIT = 10;
    private static final int NUM_LIMBS_510BIT = 20;
+
    private final int[] A;
    private final int[] AA;
    private final int[] B;
@@ -93,7 +96,7 @@ public final class Curve25519 {
     *                   if the base point of the curve should be used.
     */
    public static void eval(final byte[] result, final int offset,
-                            final byte[] privateKey, final byte[] publicKey) {
+                            final byte[] privateKey, @Nullable final byte[] publicKey) {
        final Curve25519 state = new Curve25519();
        try {
            // Unpack the public key value.  If null, use 9 as the base point.
@@ -152,6 +155,38 @@ public final class Curve25519 {
        }
    }

+    /**
+     * Subtracts two numbers modulo 2^255 - 19.
+     *
+     * @param result The result.
+     * @param x      The first number to subtract.
+     * @param y      The second number to subtract.
+     */
+    private static void sub(final int[] result, final int[] x, final int[] y) {
+        int index;
+        int borrow;
+
+        // Subtract y from x to generate the intermediate result.
+        borrow = 0;
+        for (index = 0; index < NUM_LIMBS_255BIT; ++index) {
+            borrow = x[index] - y[index] - ((borrow >> 26) & 0x01);
+            result[index] = borrow & 0x03FFFFFF;
+        }
+
+        // If we had a borrow, then the result has gone negative and we
+        // have to add 2^255 - 19 to the result to make it positive again.
+        // The top bits of "borrow" will be all 1's if there is a borrow
+        // or it will be all 0's if there was no borrow.  Easiest is to
+        // conditionally subtract 19 and then mask off the high bits.
+        borrow = result[0] - ((-((borrow >> 26) & 0x01)) & 19);
+        result[0] = borrow & 0x03FFFFFF;
+        for (index = 1; index < NUM_LIMBS_255BIT; ++index) {
+            borrow = result[index] - ((borrow >> 26) & 0x01);
+            result[index] = borrow & 0x03FFFFFF;
+        }
+        result[NUM_LIMBS_255BIT - 1] &= 0x001FFFFF;
+    }
+
    /**
     * Adds two numbers modulo 2^255 - 19.
     *
@@ -160,8 +195,7 @@ public final class Curve25519 {
     * @param y      The second number to add.
     */
    private void add(final int[] result, final int[] x, final int[] y) {
-        int carry;
-        carry = x[0] + y[0];
+        int carry = x[0] + y[0];
        result[0] = carry & 0x03FFFFFF;
        for (int index = 1; index < NUM_LIMBS_255BIT; ++index) {
            carry = (carry >> 26) + x[index] + y[index];
@@ -200,12 +234,13 @@ public final class Curve25519 {
     */
    private void evalCurve(final byte[] s) {
        int sposn = 31;
+        int sbit = 6;
        int svalue = s[sposn] | 0x40;
        int swap = 0;

        // Iterate over all 255 bits of "s" from the highest to the lowest.
        // We ignore the high bit of the 256-bit representation of "s".
-        for (int sbit = 6; ; ) {
+        while (true) {
            // Conditional swaps on entry to this bit but only if we
            // didn't swap on the previous bit.
            final int select = (svalue >> sbit) & 0x01;
@@ -263,14 +298,12 @@ public final class Curve25519 {
     * @param y      The second number to multiply.
     */
    private void mul(final int[] result, final int[] x, final int[] y) {
-        int i;
-
        // Multiply the two numbers to create the intermediate result.
        long v = x[0];
-        for (i = 0; i < NUM_LIMBS_255BIT; ++i) {
+        for (int i = 0; i < NUM_LIMBS_255BIT; ++i) {
            t1[i] = v * y[i];
        }
-        for (i = 1; i < NUM_LIMBS_255BIT; ++i) {
+        for (int i = 1; i < NUM_LIMBS_255BIT; ++i) {
            v = x[i];
            for (int j = 0; j < (NUM_LIMBS_255BIT - 1); ++j) {
                t1[i + j] += v * y[j];
@@ -281,7 +314,7 @@ public final class Curve25519 {
        // Propagate carries and convert back into 26-bit words.
        v = t1[0];
        t2[0] = ((int) v) & 0x03FFFFFF;
-        for (i = 1; i < NUM_LIMBS_510BIT; ++i) {
+        for (int i = 1; i < NUM_LIMBS_510BIT; ++i) {
            v = (v >> 26) + t1[i];
            t2[i] = ((int) v) & 0x03FFFFFF;
        }
@@ -315,8 +348,6 @@ public final class Curve25519 {
     * @param x      The argument.
     */
    private void pow250(final int[] result, final int[] x) {
-        int j;
-
        // The big-endian hexadecimal expansion of (2^250 - 1) is:
        // 03FFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
        //
@@ -329,11 +360,11 @@ public final class Curve25519 {

        // Build a pattern of 250 bits in length of repeated copies of 0000000001.
        square(A, x);
-        for (j = 0; j < 9; ++j)
+        for (int j = 0; j < 9; ++j)
            square(A, A);
        mul(result, A, x);
        for (int i = 0; i < 23; ++i) {
-            for (j = 0; j < 10; ++j)
+            for (int j = 0; j < 10; ++j)
                square(A, A);
            mul(result, result, A);
        }
@@ -342,7 +373,7 @@ public final class Curve25519 {
        // the result to "fill in" the gaps in the pattern.
        square(A, result);
        mul(result, result, A);
-        for (j = 0; j < 8; ++j) {
+        for (int j = 0; j < 8; ++j) {
            square(A, A);
            mul(result, result, A);
        }
@@ -381,18 +412,14 @@ public final class Curve25519 {
     * @param size   The number of limbs in the high order half of x.
     */
    private void reduce(final int[] result, final int[] x, final int size) {
-        int index;
-        int limb;
-        int carry;
-
        // Calculate (x mod 2^255) + ((x / 2^255) * 19) which will
        // either produce the answer we want or it will produce a
        // value of the form "answer + j * (2^255 - 19)".  There are
        // 5 left-over bits in the top-most limb of the bottom half.
-        carry = 0;
-        limb = x[NUM_LIMBS_255BIT - 1] >> 21;
+        int carry = 0;
+        int limb = x[NUM_LIMBS_255BIT - 1] >> 21;
        x[NUM_LIMBS_255BIT - 1] &= 0x001FFFFF;
-        for (index = 0; index < size; ++index) {
+        for (int index = 0; index < size; ++index) {
            limb += x[NUM_LIMBS_255BIT + index] << 5;
            carry += (limb & 0x03FFFFFF) * 19 + x[index];
            x[index] = carry & 0x03FFFFFF;
@@ -402,7 +429,7 @@ public final class Curve25519 {
        if (size < NUM_LIMBS_255BIT) {
            // The high order half of the number is short; e.g. for mulA24().
            // Propagate the carry through the rest of the low order part.
-            for (index = size; index < NUM_LIMBS_255BIT; ++index) {
+            for (int index = size; index < NUM_LIMBS_255BIT; ++index) {
                carry += x[index];
                x[index] = carry & 0x03FFFFFF;
                carry >>= 26;
@@ -417,7 +444,7 @@ public final class Curve25519 {
        // top 5 bits of the highest limb of the bottom half.
        carry = (x[NUM_LIMBS_255BIT - 1] >> 21) * 19;
        x[NUM_LIMBS_255BIT - 1] &= 0x001FFFFF;
-        for (index = 0; index < NUM_LIMBS_255BIT; ++index) {
+        for (int index = 0; index < NUM_LIMBS_255BIT; ++index) {
            carry += x[index];
            result[index] = carry & 0x03FFFFFF;
            carry >>= 26;
@@ -436,14 +463,11 @@ public final class Curve25519 {
     * @param x The number to reduce, and the result.
     */
    private void reduceQuick(final int[] x) {
-        int index;
-        int carry;
-
        // Perform a trial subtraction of (2^255 - 19) from "x" which is
        // equivalent to adding 19 and subtracting 2^255.  We add 19 here;
        // the subtraction of 2^255 occurs in the next step.
-        carry = 19;
-        for (index = 0; index < NUM_LIMBS_255BIT; ++index) {
+        int carry = 19;
+        for (int index = 0; index < NUM_LIMBS_255BIT; ++index) {
            carry += x[index];
            t2[index] = carry & 0x03FFFFFF;
            carry >>= 26;
@@ -457,7 +481,7 @@ public final class Curve25519 {
        final int mask = -((t2[NUM_LIMBS_255BIT - 1] >> 21) & 0x01);
        final int nmask = ~mask;
        t2[NUM_LIMBS_255BIT - 1] &= 0x001FFFFF;
-        for (index = 0; index < NUM_LIMBS_255BIT; ++index)
+        for (int index = 0; index < NUM_LIMBS_255BIT; ++index)
            x[index] = (x[index] & nmask) | (t2[index] & mask);
    }

@@ -470,36 +494,4 @@ public final class Curve25519 {
    private void square(final int[] result, final int[] x) {
        mul(result, x, x);
    }
-
-    /**
-     * Subtracts two numbers modulo 2^255 - 19.
-     *
-     * @param result The result.
-     * @param x      The first number to subtract.
-     * @param y      The second number to subtract.
-     */
-    private static void sub(final int[] result, final int[] x, final int[] y) {
-        int index;
-        int borrow;
-
-        // Subtract y from x to generate the intermediate result.
-        borrow = 0;
-        for (index = 0; index < NUM_LIMBS_255BIT; ++index) {
-            borrow = x[index] - y[index] - ((borrow >> 26) & 0x01);
-            result[index] = borrow & 0x03FFFFFF;
-        }
-
-        // If we had a borrow, then the result has gone negative and we
-        // have to add 2^255 - 19 to the result to make it positive again.
-        // The top bits of "borrow" will be all 1's if there is a borrow
-        // or it will be all 0's if there was no borrow.  Easiest is to
-        // conditionally subtract 19 and then mask off the high bits.
-        borrow = result[0] - ((-((borrow >> 26) & 0x01)) & 19);
-        result[0] = borrow & 0x03FFFFFF;
-        for (index = 1; index < NUM_LIMBS_255BIT; ++index) {
-            borrow = result[index] - ((borrow >> 26) & 0x01);
-            result[index] = borrow & 0x03FFFFFF;
-        }
-        result[NUM_LIMBS_255BIT - 1] &= 0x001FFFFF;
-    }
 }
@@ -0,0 +1,288 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.crypto;
+
+import com.wireguard.crypto.KeyFormatException.Type;
+
+import java.security.MessageDigest;
+import java.security.SecureRandom;
+import java.util.Arrays;
+
+/**
+ * Represents a WireGuard public or private key. This class uses specialized constant-time base64
+ * and hexadecimal codec implementations that resist side-channel attacks.
+ * <p>
+ * Instances of this class are immutable.
+ */
+@SuppressWarnings("MagicNumber")
+public final class Key {
+    private final byte[] key;
+
+    /**
+     * Constructs an object encapsulating the supplied key.
+     *
+     * @param key an array of bytes containing a binary key. Callers of this constructor are
+     *            responsible for ensuring that the array is of the correct length.
+     */
+    private Key(final byte[] key) {
+        // Defensively copy to ensure immutability.
+        this.key = Arrays.copyOf(key, key.length);
+    }
+
+    /**
+     * Decodes a single 4-character base64 chunk to an integer in constant time.
+     *
+     * @param src       an array of at least 4 characters in base64 format
+     * @param srcOffset the offset of the beginning of the chunk in {@code src}
+     * @return the decoded 3-byte integer, or some arbitrary integer value if the input was not
+     * valid base64
+     */
+    private static int decodeBase64(final char[] src, final int srcOffset) {
+        int val = 0;
+        for (int i = 0; i < 4; ++i) {
+            final char c = src[i + srcOffset];
+            val |= (-1
+                    + ((((('A' - 1) - c) & (c - ('Z' + 1))) >>> 8) & (c - 64))
+                    + ((((('a' - 1) - c) & (c - ('z' + 1))) >>> 8) & (c - 70))
+                    + ((((('0' - 1) - c) & (c - ('9' + 1))) >>> 8) & (c + 5))
+                    + ((((('+' - 1) - c) & (c - ('+' + 1))) >>> 8) & 63)
+                    + ((((('/' - 1) - c) & (c - ('/' + 1))) >>> 8) & 64)
+            ) << (18 - 6 * i);
+        }
+        return val;
+    }
+
+    /**
+     * Encodes a single 4-character base64 chunk from 3 consecutive bytes in constant time.
+     *
+     * @param src        an array of at least 3 bytes
+     * @param srcOffset  the offset of the beginning of the chunk in {@code src}
+     * @param dest       an array of at least 4 characters
+     * @param destOffset the offset of the beginning of the chunk in {@code dest}
+     */
+    private static void encodeBase64(final byte[] src, final int srcOffset,
+                                     final char[] dest, final int destOffset) {
+        final byte[] input = {
+                (byte) ((src[srcOffset] >>> 2) & 63),
+                (byte) ((src[srcOffset] << 4 | ((src[1 + srcOffset] & 0xff) >>> 4)) & 63),
+                (byte) ((src[1 + srcOffset] << 2 | ((src[2 + srcOffset] & 0xff) >>> 6)) & 63),
+                (byte) ((src[2 + srcOffset]) & 63),
+        };
+        for (int i = 0; i < 4; ++i) {
+            dest[i + destOffset] = (char) (input[i] + 'A'
+                    + (((25 - input[i]) >>> 8) & 6)
+                    - (((51 - input[i]) >>> 8) & 75)
+                    - (((61 - input[i]) >>> 8) & 15)
+                    + (((62 - input[i]) >>> 8) & 3));
+        }
+    }
+
+    /**
+     * Decodes a WireGuard public or private key from its base64 string representation. This
+     * function throws a {@link KeyFormatException} if the source string is not well-formed.
+     *
+     * @param str the base64 string representation of a WireGuard key
+     * @return the decoded key encapsulated in an immutable container
+     */
+    public static Key fromBase64(final String str) throws KeyFormatException {
+        final char[] input = str.toCharArray();
+        if (input.length != Format.BASE64.length || input[Format.BASE64.length - 1] != '=')
+            throw new KeyFormatException(Format.BASE64, Type.LENGTH);
+        final byte[] key = new byte[Format.BINARY.length];
+        int i;
+        int ret = 0;
+        for (i = 0; i < key.length / 3; ++i) {
+            final int val = decodeBase64(input, i * 4);
+            ret |= val >>> 31;
+            key[i * 3] = (byte) ((val >>> 16) & 0xff);
+            key[i * 3 + 1] = (byte) ((val >>> 8) & 0xff);
+            key[i * 3 + 2] = (byte) (val & 0xff);
+        }
+        final char[] endSegment = {
+                input[i * 4],
+                input[i * 4 + 1],
+                input[i * 4 + 2],
+                'A',
+        };
+        final int val = decodeBase64(endSegment, 0);
+        ret |= (val >>> 31) | (val & 0xff);
+        key[i * 3] = (byte) ((val >>> 16) & 0xff);
+        key[i * 3 + 1] = (byte) ((val >>> 8) & 0xff);
+
+        if (ret != 0)
+            throw new KeyFormatException(Format.BASE64, Type.CONTENTS);
+        return new Key(key);
+    }
+
+    /**
+     * Wraps a WireGuard public or private key in an immutable container. This function throws a
+     * {@link KeyFormatException} if the source data is not the correct length.
+     *
+     * @param bytes an array of bytes containing a WireGuard key in binary format
+     * @return the key encapsulated in an immutable container
+     */
+    public static Key fromBytes(final byte[] bytes) throws KeyFormatException {
+        if (bytes.length != Format.BINARY.length)
+            throw new KeyFormatException(Format.BINARY, Type.LENGTH);
+        return new Key(bytes);
+    }
+
+    /**
+     * Decodes a WireGuard public or private key from its hexadecimal string representation. This
+     * function throws a {@link KeyFormatException} if the source string is not well-formed.
+     *
+     * @param str the hexadecimal string representation of a WireGuard key
+     * @return the decoded key encapsulated in an immutable container
+     */
+    public static Key fromHex(final String str) throws KeyFormatException {
+        final char[] input = str.toCharArray();
+        if (input.length != Format.HEX.length)
+            throw new KeyFormatException(Format.HEX, Type.LENGTH);
+        final byte[] key = new byte[Format.BINARY.length];
+        int ret = 0;
+        for (int i = 0; i < key.length; ++i) {
+            int c;
+            int cNum;
+            int cNum0;
+            int cAlpha;
+            int cAlpha0;
+            int cVal;
+            final int cAcc;
+
+            c = input[i * 2];
+            cNum = c ^ 48;
+            cNum0 = ((cNum - 10) >>> 8) & 0xff;
+            cAlpha = (c & ~32) - 55;
+            cAlpha0 = (((cAlpha - 10) ^ (cAlpha - 16)) >>> 8) & 0xff;
+            ret |= ((cNum0 | cAlpha0) - 1) >>> 8;
+            cVal = (cNum0 & cNum) | (cAlpha0 & cAlpha);
+            cAcc = cVal * 16;
+
+            c = input[i * 2 + 1];
+            cNum = c ^ 48;
+            cNum0 = ((cNum - 10) >>> 8) & 0xff;
+            cAlpha = (c & ~32) - 55;
+            cAlpha0 = (((cAlpha - 10) ^ (cAlpha - 16)) >>> 8) & 0xff;
+            ret |= ((cNum0 | cAlpha0) - 1) >>> 8;
+            cVal = (cNum0 & cNum) | (cAlpha0 & cAlpha);
+            key[i] = (byte) (cAcc | cVal);
+        }
+        if (ret != 0)
+            throw new KeyFormatException(Format.HEX, Type.CONTENTS);
+        return new Key(key);
+    }
+
+    /**
+     * Generates a private key using the system's {@link SecureRandom} number generator.
+     *
+     * @return a well-formed random private key
+     */
+    static Key generatePrivateKey() {
+        final SecureRandom secureRandom = new SecureRandom();
+        final byte[] privateKey = new byte[Format.BINARY.getLength()];
+        secureRandom.nextBytes(privateKey);
+        privateKey[0] &= 248;
+        privateKey[31] &= 127;
+        privateKey[31] |= 64;
+        return new Key(privateKey);
+    }
+
+    /**
+     * Generates a public key from an existing private key.
+     *
+     * @param privateKey a private key
+     * @return a well-formed public key that corresponds to the supplied private key
+     */
+    static Key generatePublicKey(final Key privateKey) {
+        final byte[] publicKey = new byte[Format.BINARY.getLength()];
+        Curve25519.eval(publicKey, 0, privateKey.getBytes(), null);
+        return new Key(publicKey);
+    }
+
+    /**
+     * Returns the key as an array of bytes.
+     *
+     * @return an array of bytes containing the raw binary key
+     */
+    public byte[] getBytes() {
+        // Defensively copy to ensure immutability.
+        return Arrays.copyOf(key, key.length);
+    }
+
+    /**
+     * Encodes the key to base64.
+     *
+     * @return a string containing the encoded key
+     */
+    public String toBase64() {
+        final char[] output = new char[Format.BASE64.length];
+        int i;
+        for (i = 0; i < key.length / 3; ++i)
+            encodeBase64(key, i * 3, output, i * 4);
+        final byte[] endSegment = {
+                key[i * 3],
+                key[i * 3 + 1],
+                0,
+        };
+        encodeBase64(endSegment, 0, output, i * 4);
+        output[Format.BASE64.length - 1] = '=';
+        return new String(output);
+    }
+
+    /**
+     * Encodes the key to hexadecimal ASCII characters.
+     *
+     * @return a string containing the encoded key
+     */
+    public String toHex() {
+        final char[] output = new char[Format.HEX.length];
+        for (int i = 0; i < key.length; ++i) {
+            output[i * 2] = (char) (87 + (key[i] >> 4 & 0xf)
+                    + ((((key[i] >> 4 & 0xf) - 10) >> 8) & ~38));
+            output[i * 2 + 1] = (char) (87 + (key[i] & 0xf)
+                    + ((((key[i] & 0xf) - 10) >> 8) & ~38));
+        }
+        return new String(output);
+    }
+
+    @Override
+    public int hashCode() {
+        int ret = 0;
+        for (int i = 0; i < key.length / 4; ++i)
+            ret ^= (key[i * 4 + 0] >> 0) + (key[i * 4 + 1] >> 8) + (key[i * 4 + 2] >> 16) + (key[i * 4 + 3] >> 24);
+        return ret;
+    }
+
+    @Override
+    public boolean equals(final Object obj) {
+        if (obj == this)
+            return true;
+        if (obj == null || obj.getClass() != getClass())
+            return false;
+        final Key other = (Key) obj;
+        return MessageDigest.isEqual(key, other.key);
+    }
+
+    /**
+     * The supported formats for encoding a WireGuard key.
+     */
+    public enum Format {
+        BASE64(44),
+        BINARY(32),
+        HEX(64);
+
+        private final int length;
+
+        Format(final int length) {
+            this.length = length;
+        }
+
+        public int getLength() {
+            return length;
+        }
+    }
+
+}
@@ -1,144 +0,0 @@
-/*
- * Copyright © 2015-2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-package com.wireguard.crypto;
-
-/**
- * This is a specialized constant-time base64 and hex implementation that resists side-channel attacks.
- */
-
-@SuppressWarnings("MagicNumber")
-public final class KeyEncoding {
-    public static final int KEY_LENGTH = 32;
-    public static final int KEY_LENGTH_BASE64 = 44;
-    public static final int KEY_LENGTH_HEX = 64;
-    private static final String KEY_LENGTH_BASE64_EXCEPTION_MESSAGE =
-            "WireGuard base64 keys must be 44 characters encoding 32 bytes";
-    private static final String KEY_LENGTH_EXCEPTION_MESSAGE =
-            "WireGuard keys must be 32 bytes";
-    private static final String KEY_LENGTH_HEX_EXCEPTION_MESSAGE =
-            "WireGuard hex keys must be 64 characters encoding 32 bytes";
-
-    private KeyEncoding() {
-        // Prevent instantiation.
-    }
-
-    private static int decodeBase64(final char[] src, final int src_offset) {
-        int val = 0;
-        for (int i = 0; i < 4; ++i) {
-            final char c = src[i + src_offset];
-            val |= (-1
-                    + ((((('A' - 1) - c) & (c - ('Z' + 1))) >>> 8) & (c - 64))
-                    + ((((('a' - 1) - c) & (c - ('z' + 1))) >>> 8) & (c - 70))
-                    + ((((('0' - 1) - c) & (c - ('9' + 1))) >>> 8) & (c + 5))
-                    + ((((('+' - 1) - c) & (c - ('+' + 1))) >>> 8) & 63)
-                    + ((((('/' - 1) - c) & (c - ('/' + 1))) >>> 8) & 64)
-            ) << (18 - 6 * i);
-        }
-        return val;
-    }
-
-    private static void encodeBase64(final byte[] src, final int src_offset,
-                                     final char[] dest, final int dest_offset) {
-        final byte[] input = {
-                (byte) ((src[src_offset] >>> 2) & 63),
-                (byte) ((src[src_offset] << 4 | ((src[1 + src_offset] & 0xff) >>> 4)) & 63),
-                (byte) ((src[1 + src_offset] << 2 | ((src[2 + src_offset] & 0xff) >>> 6)) & 63),
-                (byte) ((src[2 + src_offset]) & 63),
-        };
-        for (int i = 0; i < 4; ++i) {
-            dest[i + dest_offset] = (char) (input[i] + 'A'
-                    + (((25 - input[i]) >>> 8) & 6)
-                    - (((51 - input[i]) >>> 8) & 75)
-                    - (((61 - input[i]) >>> 8) & 15)
-                    + (((62 - input[i]) >>> 8) & 3));
-        }
-    }
-
-    public static byte[] keyFromBase64(final String str) {
-        final char[] input = str.toCharArray();
-        final byte[] key = new byte[KEY_LENGTH];
-        if (input.length != KEY_LENGTH_BASE64 || input[KEY_LENGTH_BASE64 - 1] != '=')
-            throw new IllegalArgumentException(KEY_LENGTH_BASE64_EXCEPTION_MESSAGE);
-        int i;
-        for (i = 0; i < KEY_LENGTH / 3; ++i) {
-            final int val = decodeBase64(input, i * 4);
-            if (val < 0)
-                throw new IllegalArgumentException(KEY_LENGTH_BASE64_EXCEPTION_MESSAGE);
-            key[i * 3] = (byte) ((val >>> 16) & 0xff);
-            key[i * 3 + 1] = (byte) ((val >>> 8) & 0xff);
-            key[i * 3 + 2] = (byte) (val & 0xff);
-        }
-        final char[] endSegment = {
-                input[i * 4],
-                input[i * 4 + 1],
-                input[i * 4 + 2],
-                'A',
-        };
-        final int val = decodeBase64(endSegment, 0);
-        if (val < 0 || (val & 0xff) != 0)
-            throw new IllegalArgumentException(KEY_LENGTH_BASE64_EXCEPTION_MESSAGE);
-        key[i * 3] = (byte) ((val >>> 16) & 0xff);
-        key[i * 3 + 1] = (byte) ((val >>> 8) & 0xff);
-        return key;
-    }
-
-    public static byte[] keyFromHex(final String str) {
-        final char[] input = str.toCharArray();
-        final byte[] key = new byte[KEY_LENGTH];
-        if (input.length != KEY_LENGTH_HEX)
-            throw new IllegalArgumentException(KEY_LENGTH_HEX_EXCEPTION_MESSAGE);
-
-        int c_acc = 0;
-        int state = 0;
-
-        for (int i = 0; i < KEY_LENGTH_HEX; ++i) {
-            final int c = input[i];
-            final int c_num = c ^ 48;
-            final int c_num0 = (c_num - 10) >> 8;
-            final int c_alpha = (c & ~32) - 55;
-            final int c_alpha0 = ((c_alpha - 10) ^ (c_alpha - 16)) >> 8;
-            if ((c_num0 | c_alpha0) == 0)
-                throw new IllegalArgumentException(KEY_LENGTH_HEX_EXCEPTION_MESSAGE);
-            final int c_val = (c_num0 & c_num) | (c_alpha0 & c_alpha);
-            if (state == 0)
-                c_acc = c_val * 16;
-            else
-                key[i / 2] = (byte) (c_acc | c_val);
-            state = ~state;
-        }
-        return key;
-    }
-
-    public static String keyToBase64(final byte[] key) {
-        final char[] output = new char[KEY_LENGTH_BASE64];
-        if (key.length != KEY_LENGTH)
-            throw new IllegalArgumentException(KEY_LENGTH_EXCEPTION_MESSAGE);
-        int i;
-        for (i = 0; i < KEY_LENGTH / 3; ++i)
-            encodeBase64(key, i * 3, output, i * 4);
-        final byte[] endSegment = {
-                key[i * 3],
-                key[i * 3 + 1],
-                0,
-        };
-        encodeBase64(endSegment, 0, output, i * 4);
-        output[KEY_LENGTH_BASE64 - 1] = '=';
-        return new String(output);
-    }
-
-    public static String keyToHex(final byte[] key) {
-        final char[] output = new char[KEY_LENGTH_HEX];
-        if (key.length != KEY_LENGTH)
-            throw new IllegalArgumentException(KEY_LENGTH_EXCEPTION_MESSAGE);
-        for (int i = 0; i < KEY_LENGTH; ++i) {
-            output[i * 2] = (char) (87 + (key[i] >> 4 & 0xf)
-                    + ((((key[i] >> 4 & 0xf) - 10) >> 8) & ~38));
-            output[i * 2 + 1] = (char) (87 + (key[i] & 0xf)
-                    + ((((key[i] & 0xf) - 10) >> 8) & ~38));
-        }
-        return new String(output);
-    }
-}
@@ -0,0 +1,34 @@
+/*
+ * Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.crypto;
+
+/**
+ * An exception thrown when attempting to parse an invalid key (too short, too long, or byte
+ * data inappropriate for the format). The format being parsed can be accessed with the
+ * {@link #getFormat} method.
+ */
+public final class KeyFormatException extends Exception {
+    private final Key.Format format;
+    private final Type type;
+
+    KeyFormatException(final Key.Format format, final Type type) {
+        this.format = format;
+        this.type = type;
+    }
+
+    public Key.Format getFormat() {
+        return format;
+    }
+
+    public Type getType() {
+        return type;
+    }
+
+    public enum Type {
+        CONTENTS,
+        LENGTH
+    }
+}
@@ -0,0 +1,51 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.crypto;
+
+/**
+ * Represents a Curve25519 key pair as used by WireGuard.
+ * <p>
+ * Instances of this class are immutable.
+ */
+public class KeyPair {
+    private final Key privateKey;
+    private final Key publicKey;
+
+    /**
+     * Creates a key pair using a newly-generated private key.
+     */
+    public KeyPair() {
+        this(Key.generatePrivateKey());
+    }
+
+    /**
+     * Creates a key pair using an existing private key.
+     *
+     * @param privateKey a private key, used to derive the public key
+     */
+    public KeyPair(final Key privateKey) {
+        this.privateKey = privateKey;
+        publicKey = Key.generatePublicKey(privateKey);
+    }
+
+    /**
+     * Returns the private key from the key pair.
+     *
+     * @return the private key
+     */
+    public Key getPrivateKey() {
+        return privateKey;
+    }
+
+    /**
+     * Returns the public key from the key pair.
+     *
+     * @return the public key
+     */
+    public Key getPublicKey() {
+        return publicKey;
+    }
+}
@@ -1,56 +0,0 @@
-/*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-package com.wireguard.crypto;
-
-import java.security.SecureRandom;
-
-/**
- * Represents a Curve25519 keypair as used by WireGuard.
- */
-
-public class Keypair {
-    private final byte[] privateKey;
-    private final byte[] publicKey;
-
-    public Keypair() {
-        this(generatePrivateKey());
-    }
-
-    private Keypair(final byte[] privateKey) {
-        this.privateKey = privateKey;
-        publicKey = generatePublicKey(privateKey);
-    }
-
-    public Keypair(final String privateKey) {
-        this(KeyEncoding.keyFromBase64(privateKey));
-    }
-
-    @SuppressWarnings("MagicNumber")
-    private static byte[] generatePrivateKey() {
-        final SecureRandom secureRandom = new SecureRandom();
-        final byte[] privateKey = new byte[KeyEncoding.KEY_LENGTH];
-        secureRandom.nextBytes(privateKey);
-        privateKey[0] &= 248;
-        privateKey[31] &= 127;
-        privateKey[31] |= 64;
-        return privateKey;
-    }
-
-    private static byte[] generatePublicKey(final byte[] privateKey) {
-        final byte[] publicKey = new byte[KeyEncoding.KEY_LENGTH];
-        Curve25519.eval(publicKey, 0, privateKey, null);
-        return publicKey;
-    }
-
-    public String getPrivateKey() {
-        return KeyEncoding.keyToBase64(privateKey);
-    }
-
-    public String getPublicKey() {
-        return KeyEncoding.keyToBase64(publicKey);
-    }
-}
@@ -0,0 +1,14 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.util;
+
+/**
+ * Interface for objects that have a identifying key of the given type.
+ */
+
+public interface Keyed<K> {
+    K getKey();
+}
@@ -1,10 +1,11 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

-package com.wireguard.android.util;
+package com.wireguard.util;
+
+import androidx.annotation.Nullable;

 import java.util.Collection;
 import java.util.List;
@@ -19,8 +20,10 @@ public interface KeyedList<K, E extends Keyed<? extends K>> extends List<E> {

    boolean containsKey(K key);

+    @Nullable
    E get(K key);

+    @Nullable
    E getLast(K key);

    int indexOfKey(K key);
@@ -0,0 +1,26 @@
+/*
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.util;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+import javax.annotation.Nonnull;
+import javax.annotation.meta.TypeQualifierDefault;
+
+/**
+ * This annotation can be applied to a package, class or method to indicate that all
+ * class fields and method parameters and return values in that element are nonnull
+ * by default unless overridden.
+ */
+@Documented
+@Nonnull
+@TypeQualifierDefault({ElementType.FIELD, ElementType.METHOD, ElementType.PARAMETER})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface NonNullForAll {
+}
@@ -1,10 +1,11 @@
 /*
- * Copyright © 2018 Samuel Holland <samuel@sholland.org>
- * Copyright © 2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
- * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright © 2017-2019 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
 */

-package com.wireguard.android.util;
+package com.wireguard.util;
+
+import androidx.annotation.Nullable;

 import java.util.Collection;
 import java.util.Comparator;
@@ -18,10 +19,12 @@ import java.util.Set;
 public interface SortedKeyedList<K, E extends Keyed<? extends K>> extends KeyedList<K, E> {
    Comparator<? super K> comparator();

+    @Nullable
    K firstKey();

    Set<K> keySet();

+    @Nullable
    K lastKey();

    Collection<E> values();
--- a/Show More
+++ b/Show More