/*
 * Copyright © 2017-2021 WireGuard LLC. All Rights Reserved.
 * SPDX-License-Identifier: Apache-2.0
 */

package com.wireguard.android.backend;

import android.content.Context;
import android.content.Intent;
import android.content.pm.PackageManager;
import android.net.ConnectivityManager;
import android.net.LinkProperties;
import android.net.LocalSocketAddress;
import android.net.Network;
import android.net.NetworkCapabilities;
import android.net.NetworkRequest;
import android.net.ProxyInfo;
import android.net.TrafficStats;
import android.net.Uri;
import android.os.Build;
import android.os.ParcelFileDescriptor;
import android.os.Process;
import android.system.OsConstants;
import android.util.Log;

import com.google.protobuf.ByteString;
import com.google.protobuf.InvalidProtocolBufferException;
import com.google.protobuf.Empty;

import com.wireguard.android.backend.BackendException.Reason;
import com.wireguard.android.backend.Tunnel.State;
import com.wireguard.android.backend.gen.DhcpRequest;
import com.wireguard.android.backend.gen.DhcpResponse;
import com.wireguard.android.backend.gen.GetConnectionOwnerUidResponse;
import com.wireguard.android.backend.gen.IpcSetRequest;
import com.wireguard.android.backend.gen.IpcSetResponse;
import com.wireguard.android.backend.gen.Lease;
import com.wireguard.android.backend.gen.LibwgGrpc;
import com.wireguard.android.backend.gen.ReverseRequest;
import com.wireguard.android.backend.gen.ReverseResponse;
import com.wireguard.android.backend.gen.StartHttpProxyRequest;
import com.wireguard.android.backend.gen.StartHttpProxyResponse;
import com.wireguard.android.backend.gen.StopHttpProxyRequest;
import com.wireguard.android.backend.gen.StopHttpProxyResponse;
import com.wireguard.android.backend.gen.TunnelHandle;
import com.wireguard.android.backend.gen.VersionRequest;
import com.wireguard.android.backend.gen.VersionResponse;
import com.wireguard.android.util.SharedLibraryLoader;
import com.wireguard.config.Config;
import com.wireguard.config.HttpProxy;
import com.wireguard.config.InetEndpoint;
import com.wireguard.config.InetNetwork;
import com.wireguard.config.Peer;
import com.wireguard.crypto.Key;
import com.wireguard.crypto.KeyFormatException;
import com.wireguard.util.NonNullForAll;
import com.wireguard.util.Resolver;

import io.grpc.ManagedChannel;
import io.grpc.ManagedChannelBuilder;
import io.grpc.okhttp.OkHttpChannelBuilder;
import io.grpc.stub.StreamObserver;

import java.time.LocalDateTime;
import java.time.ZoneOffset;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.InetAddress;
import java.net.Inet4Address;
import java.net.Inet6Address;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
import java.net.URL;
import java.nio.ByteOrder;
import java.util.Collections;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.FutureTask;
import java.util.concurrent.LinkedBlockingQueue;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;
import java.util.concurrent.atomic.AtomicReference;

import javax.net.SocketFactory;

import androidx.annotation.Nullable;
import androidx.collection.ArraySet;

/**
 * Implementation of {@link Backend} that uses the wireguard-go userspace implementation to provide
 * WireGuard tunnels.
 */
@NonNullForAll
public final class GoBackend implements Backend {
    private static final int DNS_RESOLUTION_RETRIES = 10;
    private static final String TAG = "WireGuard/GoBackend";
    private static final int STATS_TAG = 2;
    @Nullable private static AlwaysOnCallback alwaysOnCallback;
    private static GhettoCompletableFuture<VpnService> vpnService = new GhettoCompletableFuture<>();
    private final Context context;
    @Nullable private Config currentConfig;
    @Nullable private Tunnel currentTunnel;
    private int currentTunnelHandle = -1;
    private ManagedChannel channel;
    private ConnectivityManager connectivityManager;
    private ConnectivityManager.NetworkCallback myNetworkCallback = new MyNetworkCallback();
    private ConnectivityManager.NetworkCallback vpnNetworkCallback;
    @Nullable private Network activeNetwork;
    private boolean obtainDhcpLease = false;
    @Nullable private Bgp bgp;

    /**
     * Public constructor for GoBackend.
     *
     * @param context An Android {@link Context}
     */
    public GoBackend(final Context context) {
        SharedLibraryLoader.loadSharedLibrary(context, "wg-go");
        this.context = context;
        connectivityManager = context.getSystemService(ConnectivityManager.class);
        File socketFile = new File(context.getCacheDir(), "libwg.sock");
        String socketName = socketFile.getAbsolutePath();
        Log.i(TAG, "wgStartGrpc: " + wgStartGrpc(socketName));
        ManagedChannelBuilder<?> channelBuilder = ManagedChannelBuilder.forAddress("localhost", 10000).usePlaintext();
        LocalSocketAddress address = new LocalSocketAddress(socketName, LocalSocketAddress.Namespace.FILESYSTEM);
        SocketFactory socketFactory = new UnixDomainSocketFactory(address);
        ((OkHttpChannelBuilder) channelBuilder).socketFactory(socketFactory);
        channel = channelBuilder.build();
    }

    /**
     * Set a {@link AlwaysOnCallback} to be invoked when {@link VpnService} is started by the
     * system's Always-On VPN mode.
     *
     * @param cb Callback to be invoked
     */
    public static void setAlwaysOnCallback(final AlwaysOnCallback cb) {
        alwaysOnCallback = cb;
    }

    @Nullable private static native String wgGetConfig(int handle);

    private static native int wgGetSocketV4(int handle);

    private static native int wgGetSocketV6(int handle);

    private static native void wgSetFd(int handle, int tunFd);

    private static native void wgTurnOff(int handle);

    private static native int wgTurnOn(String ifName, int tunFd, String settings);

    private static native String wgVersion();

    private static native int wgStartGrpc(String sockName);

    /**
     * Method to get the names of running tunnels.
     *
     * @return A set of string values denoting names of running tunnels.
     */
    @Override
    public Set<String> getRunningTunnelNames() {
        if (currentTunnel != null) {
            final Set<String> runningTunnels = new ArraySet<>();
            runningTunnels.add(currentTunnel.getName());
            return runningTunnels;
        }
        return Collections.emptySet();
    }

    /**
     * Get the associated {@link State} for a given {@link Tunnel}.
     *
     * @param tunnel The tunnel to examine the state of.
     * @return {@link State} associated with the given tunnel.
     */
    @Override
    public State getState(final Tunnel tunnel) {
        return currentTunnel == tunnel ? State.UP : State.DOWN;
    }

    /**
     * Get the associated {@link Statistics} for a given {@link Tunnel}.
     *
     * @param tunnel The tunnel to retrieve statistics for.
     * @return {@link Statistics} associated with the given tunnel.
     */
    @Override
    public Statistics getStatistics(final Tunnel tunnel) {
        final Statistics stats = new Statistics();
        if (tunnel != currentTunnel || currentTunnelHandle == -1)
            return stats;
        final String config = wgGetConfig(currentTunnelHandle);
        if (config == null)
            return stats;
        Key key = null;
        long rx = 0;
        long tx = 0;
        long handshakeSec = 0;
        int handshakeNSec = 0;
        for (final String line : config.split("\\n")) {
            if (line.startsWith("public_key=")) {
                if (key != null) {
                    LocalDateTime handshake = null;
                    if (handshakeSec > 0) {
                        handshake = LocalDateTime.ofEpochSecond(handshakeSec, handshakeNSec, ZoneOffset.UTC);
                    }
                    stats.add(key, rx, tx, handshake);
                }
                rx = 0;
                tx = 0;
                try {
                    key = Key.fromHex(line.substring(11));
                } catch (final KeyFormatException ignored) {
                    key = null;
                }
            } else if (line.startsWith("rx_bytes=")) {
                if (key == null)
                    continue;
                try {
                    rx = Long.parseLong(line.substring(9));
                } catch (final NumberFormatException ignored) {
                    rx = 0;
                }
            } else if (line.startsWith("tx_bytes=")) {
                if (key == null)
                    continue;
                try {
                    tx = Long.parseLong(line.substring(9));
                } catch (final NumberFormatException ignored) {
                    tx = 0;
                }
            } else if (line.startsWith("last_handshake_time_sec=")) {
                if (key == null)
                    continue;
                try {
                    handshakeSec = Long.parseLong(line.substring(24));
                } catch (final NumberFormatException ignored) {
                    handshakeSec = 0;
                }
            } else if (line.startsWith("last_handshake_time_nsec=")) {
                if (key == null)
                    continue;
                try {
                    handshakeNSec = Integer.parseInt(line.substring(25));
                } catch (final NumberFormatException ignored) {
                    handshakeNSec = 0;
                }
            }
        }
        if (key != null) {
            LocalDateTime handshake = null;
            if (handshakeSec > 0) {
                handshake = LocalDateTime.ofEpochSecond(handshakeSec, handshakeNSec, ZoneOffset.UTC);
            }
            stats.add(key, rx, tx, handshake);
        }
        return stats;
    }

    /**
     * Get the version of the underlying wireguard-go library.
     *
     * @return {@link String} value of the version of the wireguard-go library.
     */
    @Override
    public String getVersion() {
        LibwgGrpc.LibwgBlockingStub stub = LibwgGrpc.newBlockingStub(channel);
        VersionRequest request = VersionRequest.newBuilder().build();
        VersionResponse resp = stub.version(request);
        return resp.getVersion();
    }

    /**
     * Change the state of a given {@link Tunnel}, optionally applying a given {@link Config}.
     *
     * @param tunnel The tunnel to control the state of.
     * @param state  The new state for this tunnel. Must be {@code UP}, {@code DOWN}, or
     *               {@code TOGGLE}.
     * @param config The configuration for this tunnel, may be null if state is {@code DOWN}.
     * @return {@link State} of the tunnel after state changes are applied.
     * @throws Exception Exception raised while changing tunnel state.
     */
    @Override
    public State setState(final Tunnel tunnel, State state, @Nullable final Config config) throws Exception {
        final State originalState = getState(tunnel);

        if (state == State.TOGGLE)
            state = originalState == State.UP ? State.DOWN : State.UP;
        if (state == originalState && tunnel == currentTunnel && config == currentConfig)
            return originalState;
        if (state == State.UP) {
            final Config originalConfig = currentConfig;
            final Tunnel originalTunnel = currentTunnel;
            if (currentTunnel != null)
                setStateInternal(currentTunnel, null, State.DOWN);
            try {
                setStateInternal(tunnel, config, state);
            } catch (final Exception e) {
                if (originalTunnel != null)
                    setStateInternal(originalTunnel, originalConfig, State.UP);
                throw e;
            }
        } else if (state == State.DOWN && tunnel == currentTunnel) {
            setStateInternal(tunnel, null, State.DOWN);
        }
        return getState(tunnel);
    }

    private static String downloadPacFile(Network network, Uri pacFileUrl) {
        HttpURLConnection urlConnection = null;
        StringBuffer buf = new StringBuffer();
        try {
            URL url = new URL(pacFileUrl.toString());
            TrafficStats.setThreadStatsTag(STATS_TAG);
            urlConnection = (HttpURLConnection) network.openConnection(url);

            InputStream in = urlConnection.getInputStream();
            InputStreamReader isw = new InputStreamReader(in);

            int data = isw.read();
            while (data != -1) {
                char current = (char) data;
                data = isw.read();
                buf.append(current);
            }
        } catch (Exception e) {
        } finally {
            if (urlConnection != null) {
                urlConnection.disconnect();
            }
        }

        return buf.toString();
    }

    private int startHttpProxy(String pacFile) {
        LibwgGrpc.LibwgStub asyncStub = LibwgGrpc.newStub(channel);
        LibwgGrpc.LibwgBlockingStub stub = LibwgGrpc.newBlockingStub(channel);
        StartHttpProxyRequest.Builder reqBuilder = StartHttpProxyRequest.newBuilder();
        if (pacFile != null && pacFile != "") {
            reqBuilder.setPacFileContent(pacFile);
        }

        Thread streamer = new Thread(new Runnable() {
            public void run() {
                try {
                    Log.i(TAG, "Before streamReverse");
                    streamReverse(asyncStub);
                    Log.i(TAG, "After streamReverse");
                } catch (InterruptedException e) {
                    throw new RuntimeException(e);
                }
            }
        });

        StartHttpProxyRequest req = reqBuilder.build();
        StartHttpProxyResponse resp = stub.startHttpProxy(req);
        Log.i(TAG, "Start http proxy listen_port:" + resp.getListenPort() + ", error:" + resp.getError().getMessage());
        streamer.start();
        return resp.getListenPort();
    }

    private void stopHttpProxy() {
        LibwgGrpc.LibwgBlockingStub stub = LibwgGrpc.newBlockingStub(channel);
        StopHttpProxyRequest req = StopHttpProxyRequest.newBuilder().build();
        StopHttpProxyResponse resp = stub.stopHttpProxy(req);
        Log.i(TAG, "Stop http proxy: " + resp.getError().getMessage());
    }

    private static InetSocketAddress toInetSocketAddress(com.wireguard.android.backend.gen.InetSocketAddress sockAddr) {
        try {
            return new InetSocketAddress(InetAddress.getByAddress(sockAddr.getAddress().getAddress().toByteArray()), sockAddr.getPort());
        } catch (UnknownHostException e) {
            throw new RuntimeException(e);
        }
    }

    private void Dhcp(VpnService service) throws Exception{
        obtainDhcpLease = false;

        // Heuristics: Use first ULA address as client address
        com.wireguard.android.backend.gen.InetAddress source = null;

        for (final InetNetwork net : currentConfig.getInterface().getAddresses()) {
            InetAddress addr = net.getAddress();
            if (addr instanceof Inet6Address) {
                if (Resolver.isULA((Inet6Address)addr)) {
                    source = com.wireguard.android.backend.gen.InetAddress.newBuilder().setAddress(ByteString.copyFrom(addr.getAddress())).build();
                }
            }
        }

        LibwgGrpc.LibwgBlockingStub stub = LibwgGrpc.newBlockingStub(channel);
        DhcpRequest request = DhcpRequest.newBuilder().setSource(source).build();
        DhcpResponse resp = stub.dhcp(request);
        Log.i(TAG, "Dhcp: " + resp.getError().getMessage());

        Set<InetNetwork> addresses = new LinkedHashSet<>();
        if (resp.getLeasesList() != null) {
            for (final Lease lease: resp.getLeasesList()) {
                try {
                    InetAddress addr = InetAddress.getByAddress(lease.getAddress().getAddress().toByteArray());
                    Log.i(TAG, "Lease: " + addr);
                    addresses.add(new InetNetwork(addr, 128));
                } catch (UnknownHostException ex) {
                    // Ignore
                }
            }
        }

        Dhcp dhcp = new Dhcp(addresses);

        // Replace the vpn tunnel
        final VpnService.Builder builder = getBuilder(currentTunnel.getName(), currentConfig, service, dhcp.getAddresses());

        Log.i(TAG, "Builder: " + builder);

        try (final ParcelFileDescriptor tun = builder.establish()) {
            if (tun == null)
                throw new BackendException(Reason.TUN_CREATION_ERROR);
            Log.d(TAG, "Go backend " + wgVersion());
            // SetFd
            wgSetFd(currentTunnelHandle, tun.detachFd());
        }
        if (currentTunnelHandle < 0)
            throw new BackendException(Reason.GO_ACTIVATION_ERROR_CODE, currentTunnelHandle);

        service.protect(wgGetSocketV4(currentTunnelHandle));
        service.protect(wgGetSocketV6(currentTunnelHandle));
        Log.i(TAG, "Dhcp done");

        bgp = new Bgp(channel, currentTunnel, currentTunnelHandle);
        bgp.startServer();

        currentTunnel.onDhcpChange(dhcp);
    }

    private int getConnectionOwnerUid(int protocol, InetSocketAddress local, InetSocketAddress remote) {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
            return connectivityManager.getConnectionOwnerUid(protocol, local, remote);
        else
            return Process.INVALID_UID;
    }

    private void streamReverse(LibwgGrpc.LibwgStub asyncStub) throws InterruptedException {
        Log.i(TAG, "In streamReverse");
        final CountDownLatch finishLatch = new CountDownLatch(1);
        final AtomicReference<StreamObserver<ReverseRequest>> atomicRequestObserver = new AtomicReference<StreamObserver<ReverseRequest>>();
        // Throwable failed = null;

        StreamObserver<ReverseResponse> responseObserver = new StreamObserver<ReverseResponse>() {
                @Override
                public void onNext(ReverseResponse resp) {
                    try {
                    String pkg = "";
                    int uid = getConnectionOwnerUid(resp.getUid().getProtocol(), toInetSocketAddress(resp.getUid().getLocal()), toInetSocketAddress(resp.getUid().getRemote()));
                    if (uid != Process.INVALID_UID) {
                        PackageManager pm = context.getPackageManager();
                        pkg = pm.getNameForUid(uid);
                        String[] pkgs = pm.getPackagesForUid(uid);
                        Log.i(TAG, "reverse onNext uid:" + uid + " package:" + pkg);
                        if (pkgs != null) {
                            for (int i=0; i < pkgs.length; i++) {
                                Log.i(TAG, "getPackagesForUid() = " + pkgs[i]);
                            }
                        }
                    } else {
                        Log.i(TAG, "Connection not found");
                    }

                    ReverseRequest req = ReverseRequest.newBuilder()
                    .setUid(GetConnectionOwnerUidResponse.newBuilder()
                            .setUid(uid)
                            .setPackage(pkg != null ? pkg: "")
                            .build())
                    .build();

                    io.grpc.Context.current().fork().run(new Runnable() {
                            public void run() {
                                atomicRequestObserver.get().onNext(req);
                            }
                        });
                    } catch (RuntimeException ex) {
                        Log.i(TAG, "onNext " + ex);
                        throw ex;
                    }
                }

                @Override
                public void onError(Throwable t) {
                    // failed = t;
                    Log.i(TAG, "streamReverse error: " + t);
                    finishLatch.countDown();
                }

                @Override
                public void onCompleted() {
                    Log.i(TAG, "streamReverse completed");
                    finishLatch.countDown();
                }
            };
        StreamObserver<ReverseRequest> requestObserver = asyncStub.reverse(responseObserver);
        atomicRequestObserver.set(requestObserver);

        // Mark the end of requests
        //requestObserver.onCompleted();

        //requestObserver.onNext(ReverseRequest.getDefaultInstance());

        Log.i(TAG, "Waiting streamReverse");
        // Receiving happens asynchronously
        finishLatch.await();

        // if (failed != null) {
        //     throw new RuntimeException(failed);
        // }
        Log.i(TAG, "Exit streamReverse");
    }

    private VpnService.Builder getBuilder(final String name, @Nullable final Config config, final VpnService service, @Nullable final Set<InetNetwork> leases) throws PackageManager.NameNotFoundException {
        Log.i(TAG, "Builder 1");
            final VpnService.Builder builder = service.getBuilder();
        Log.i(TAG, "Builder 2");
            builder.setSession(name);

        Log.i(TAG, "Builder 3");
            for (final String excludedApplication : config.getInterface().getExcludedApplications())
                builder.addDisallowedApplication(excludedApplication);

        Log.i(TAG, "Builder 4");
            for (final String includedApplication : config.getInterface().getIncludedApplications())
                builder.addAllowedApplication(includedApplication);

        Log.i(TAG, "Builder 5");
            if (leases != null) {
                for (final InetNetwork lease: leases) {
                    builder.addAddress(lease.getAddress(), lease.getMask());
                }
            }

        Log.i(TAG, "Builder 6");
            for (final InetNetwork addr : config.getInterface().getAddresses())
                builder.addAddress(addr.getAddress(), addr.getMask());

        Log.i(TAG, "Builder 7");
            for (final InetAddress addr : config.getInterface().getDnsServers())
                builder.addDnsServer(addr.getHostAddress());

        Log.i(TAG, "Builder 8");
            for (final String dnsSearchDomain : config.getInterface().getDnsSearchDomains())
                builder.addSearchDomain(dnsSearchDomain);

        Log.i(TAG, "Builder 9");
            boolean sawDefaultRoute = false;
            for (final Peer peer : config.getPeers()) {
                for (final InetNetwork addr : peer.getAllowedIps()) {
                    if (addr.getMask() == 0)
                        sawDefaultRoute = true;
                    builder.addRoute(addr.getAddress(), addr.getMask());
                }
            }

        Log.i(TAG, "Builder 10");
            // "Kill-switch" semantics
            if (!(sawDefaultRoute && config.getPeers().size() == 1)) {
                builder.allowFamily(OsConstants.AF_INET);
                builder.allowFamily(OsConstants.AF_INET6);
            }

        Log.i(TAG, "Builder 11");
            builder.setMtu(config.getInterface().getMtu().orElse(1280));

        Log.i(TAG, "Builder 12");
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
                builder.setMetered(false);
        Log.i(TAG, "Builder 13");
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M)
                service.setUnderlyingNetworks(null);

        Log.i(TAG, "Builder 14");
            Optional<HttpProxy> proxy = config.getInterface().getHttpProxy();
        Log.i(TAG, "Builder 14.1");
            if (proxy.isPresent()) {
        Log.i(TAG, "Builder 14.2");
                ProxyInfo pi = proxy.get().getProxyInfo();
        Log.i(TAG, "Builder 14.3");
                Uri pacFileUrl = pi.getPacFileUrl();
        Log.i(TAG, "Builder 14.4");

                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
        Log.i(TAG, "Builder 14.5");
                    if (pacFileUrl != null && pacFileUrl != Uri.EMPTY) {
        Log.i(TAG, "Builder 14.6");
        String pacFile = downloadPacFile(activeNetwork, pacFileUrl);
                        int listenPort = startHttpProxy(pacFile);
        Log.i(TAG, "Builder 14.7");
                        ProxyInfo localPi = ProxyInfo.buildDirectProxy("localhost", listenPort);
        Log.i(TAG, "Builder 14.8");
                        builder.setHttpProxy(localPi);
        Log.i(TAG, "Builder 14.9");
                    } else {
        Log.i(TAG, "Builder 14.10");
                        builder.setHttpProxy(pi);
        Log.i(TAG, "Builder 14.11");
                    }
        Log.i(TAG, "Builder 14.12");
                }
        Log.i(TAG, "Builder 14.13");
            }
        Log.i(TAG, "Builder 14.14");

        Log.i(TAG, "Builder 15");
            builder.setBlocking(true);
            return builder;
    }

    private void setStateInternal(final Tunnel tunnel, @Nullable final Config config, final State state)
            throws Exception {
        Log.i(TAG, "Bringing tunnel " + tunnel.getName() + ' ' + state);

        if (state == State.UP) {
            if (config == null)
                throw new BackendException(Reason.TUNNEL_MISSING_CONFIG);

            if (VpnService.prepare(context) != null)
                throw new BackendException(Reason.VPN_NOT_AUTHORIZED);

            final VpnService service;
            if (!vpnService.isDone()) {
                Log.d(TAG, "Requesting to start VpnService");
                context.startService(new Intent(context, VpnService.class));
            }

            try {
                service = vpnService.get(2, TimeUnit.SECONDS);
            } catch (final TimeoutException e) {
                final Exception be = new BackendException(Reason.UNABLE_TO_START_VPN);
                be.initCause(e);
                throw be;
            }
            service.setOwner(this);

            if (currentTunnelHandle != -1) {
                Log.w(TAG, "Tunnel already up");
                return;
            }


            activeNetwork = connectivityManager.getActiveNetwork();
            if (!connectivityManager.getNetworkCapabilities(activeNetwork).hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)) {
                Log.w(TAG, "VPN network is active, null activeNetwork");
                activeNetwork = null;
            }
            final Resolver resolver = new Resolver(activeNetwork, connectivityManager.getLinkProperties(activeNetwork));
            dnsRetry: for (int i = 0; i < DNS_RESOLUTION_RETRIES; ++i) {
                // Pre-resolve IPs so they're cached when building the userspace string
                for (final Peer peer : config.getPeers()) {
                    final InetEndpoint ep = peer.getEndpoint().orElse(null);
                    if (ep == null)
                        continue;
                    // FIXME
                    tunnel.onEndpointChange(peer.getPublicKey(), ep);
                    Log.i(TAG, "onEndpointChange " + peer.getPublicKey() + ", " + ep);
                    if (ep.getResolved(resolver, true).orElse(null) == null) {
                        if (i < DNS_RESOLUTION_RETRIES - 1) {
                            Log.w(TAG, "DNS host \"" + ep.getHost() + "\" failed to resolve; trying again");
                            Thread.sleep(1000);
                            continue dnsRetry;
                        } else
                            throw new BackendException(Reason.DNS_RESOLUTION_FAILURE, ep.getHost());
                    }
                }
                break;
            }

            // Build config
            final String goConfig = config.toWgUserspaceString(resolver);

            // Create the vpn tunnel with android API
            final VpnService.Builder builder = getBuilder(tunnel.getName(), config, service, null);

            try (final ParcelFileDescriptor tun = builder.establish()) {
                if (tun == null)
                    throw new BackendException(Reason.TUN_CREATION_ERROR);
                Log.d(TAG, "Go backend " + wgVersion());
                currentTunnelHandle = wgTurnOn(tunnel.getName(), tun.detachFd(), goConfig);
            }
            if (currentTunnelHandle < 0)
                throw new BackendException(Reason.GO_ACTIVATION_ERROR_CODE, currentTunnelHandle);

            currentTunnel = tunnel;
            currentConfig = config;

            service.protect(wgGetSocketV4(currentTunnelHandle));
            service.protect(wgGetSocketV6(currentTunnelHandle));

            obtainDhcpLease = true;

            NetworkRequest req = new NetworkRequest.Builder().addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN).build();
            connectivityManager.requestNetwork(req,  myNetworkCallback);

            NetworkRequest vpnReq = new NetworkRequest.Builder().addTransportType(NetworkCapabilities.TRANSPORT_VPN).removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN).build();
            vpnNetworkCallback = new VpnNetworkCallback(service);
            connectivityManager.requestNetwork(vpnReq, vpnNetworkCallback);
        } else {
            if (currentTunnelHandle == -1) {
                Log.w(TAG, "Tunnel already down");
                return;
            }
            int handleToClose = currentTunnelHandle;
            currentTunnel = null;
            currentTunnelHandle = -1;
            currentConfig = null;
            if (bgp != null) {
                bgp.stopServer();
                bgp = null;
            }
            stopHttpProxy();
            if (vpnNetworkCallback != null)
                connectivityManager.unregisterNetworkCallback(vpnNetworkCallback);
            vpnNetworkCallback = null;
            connectivityManager.unregisterNetworkCallback(myNetworkCallback);
            activeNetwork = null;
            wgTurnOff(handleToClose);
        }

        tunnel.onStateChange(state);
    }

    /**
     * Callback for {@link GoBackend} that is invoked when {@link VpnService} is started by the
     * system's Always-On VPN mode.
     */
    public interface AlwaysOnCallback {
        void alwaysOnTriggered();
    }

    // TODO: When we finally drop API 21 and move to API 24, delete this and replace with the ordinary CompletableFuture.
    private static final class GhettoCompletableFuture<V> {
        private final LinkedBlockingQueue<V> completion = new LinkedBlockingQueue<>(1);
        private final FutureTask<V> result = new FutureTask<>(completion::peek);

        public boolean complete(final V value) {
            final boolean offered = completion.offer(value);
            if (offered)
                result.run();
            return offered;
        }

        public V get() throws ExecutionException, InterruptedException {
            return result.get();
        }

        public V get(final long timeout, final TimeUnit unit) throws ExecutionException, InterruptedException, TimeoutException {
            return result.get(timeout, unit);
        }

        public boolean isDone() {
            return !completion.isEmpty();
        }

        public GhettoCompletableFuture<V> newIncompleteFuture() {
            return new GhettoCompletableFuture<>();
        }
    }

    /**
     * {@link android.net.VpnService} implementation for {@link GoBackend}
     */
    public static class VpnService extends android.net.VpnService {
        @Nullable private GoBackend owner;

        public Builder getBuilder() {
            return new Builder();
        }

        @Override
        public void onCreate() {
            vpnService.complete(this);
            super.onCreate();
        }

        @Override
        public void onDestroy() {
            if (owner != null) {
                if (owner.bgp != null) {
                    owner.bgp.stopServer();
                    owner.bgp = null;
                }
                owner.stopHttpProxy();
                final Tunnel tunnel = owner.currentTunnel;
                if (tunnel != null) {
                    if (owner.currentTunnelHandle != -1) {
                        if (owner.vpnNetworkCallback != null)
                            owner.connectivityManager.unregisterNetworkCallback(owner.vpnNetworkCallback);
                        owner.vpnNetworkCallback = null;
                        owner.connectivityManager.unregisterNetworkCallback(owner.myNetworkCallback);
                        owner.activeNetwork = null;
                        wgTurnOff(owner.currentTunnelHandle);
                    }
                    owner.currentTunnel = null;
                    owner.currentTunnelHandle = -1;
                    owner.currentConfig = null;
                    tunnel.onStateChange(State.DOWN);
                }
            }
            vpnService = vpnService.newIncompleteFuture();
            super.onDestroy();
        }

        @Override
        public int onStartCommand(@Nullable final Intent intent, final int flags, final int startId) {
            vpnService.complete(this);
            if (intent == null || intent.getComponent() == null || !intent.getComponent().getPackageName().equals(getPackageName())) {
                Log.d(TAG, "Service started by Always-on VPN feature");
                if (alwaysOnCallback != null)
                    alwaysOnCallback.alwaysOnTriggered();
            }
            return super.onStartCommand(intent, flags, startId);
        }

        public void setOwner(final GoBackend owner) {
            this.owner = owner;
        }
    }

    private class VpnNetworkCallback extends ConnectivityManager.NetworkCallback {
        private VpnService service;
        public VpnNetworkCallback(VpnService service) {
            this.service = service;
        }
        @Override
        public void onAvailable(Network network) {
            Log.w(TAG, "VPN onAvailable: " + network);
            if (obtainDhcpLease) {
                Log.w(TAG, "Obtaindhcplease");
                try {
                    Log.w(TAG, "Before Dhcp");
                    Dhcp(service);
                    Log.w(TAG, "After Dhcp");
                } catch (Exception ex) {
                    Log.e(TAG, "DHCP failed: " + ex);
                }
            }
        }
    }

    private class MyNetworkCallback extends ConnectivityManager.NetworkCallback {
        @Override
        public void onAvailable(Network network) {
            activeNetwork = network;
            Log.w(TAG, "onAvailable: " + activeNetwork);
        }

        @Override
        public void onLinkPropertiesChanged(Network network, LinkProperties linkProperties) {
            Log.w(TAG, "onLinkPropertiesChanged: " + network + " is default:" + (network.equals(activeNetwork)));
            if (network.equals(activeNetwork) && currentConfig != null && currentTunnelHandle > -1) {
                final Resolver resolver = new Resolver(network, linkProperties);
                final String goConfig = currentConfig.toWgUserspaceStringWithChangedEndpoints(resolver);
                Log.w(TAG, "is default network, config:" + goConfig);

                LibwgGrpc.LibwgBlockingStub stub = LibwgGrpc.newBlockingStub(channel);
                TunnelHandle tunnel = TunnelHandle.newBuilder().setHandle(currentTunnelHandle).build();
                IpcSetRequest request = IpcSetRequest.newBuilder().setTunnel(tunnel).setConfig(goConfig).build();
                IpcSetResponse resp = stub.ipcSet(request);
            }
        }
    }
}