Merge branch 'vpn_cert_update' into 'master'

improve VPN cert update

Closes #9087

See merge request leap/bitmask_android!184

9 files changed, 270 insertions, 146 deletions

diff --git a/app/src/main/java/se/leap/bitmaskclient/base/MainActivity.java b/app/src/main/java/se/leap/bitmaskclient/base/MainActivity.java
index d01edf5d..8cb12652 100644
--- a/app/src/main/java/se/leap/bitmaskclient/base/MainActivity.java
+++ b/app/src/main/java/se/leap/bitmaskclient/base/MainActivity.java
@@ -49,6 +49,8 @@ import se.leap.bitmaskclient.eip.EIP;
 import se.leap.bitmaskclient.eip.EipCommand;
 import se.leap.bitmaskclient.eip.EipSetupListener;
 import se.leap.bitmaskclient.eip.EipSetupObserver;
+import se.leap.bitmaskclient.eip.EipStatus;
+import se.leap.bitmaskclient.providersetup.ProviderAPI;
 import se.leap.bitmaskclient.providersetup.activities.LoginActivity;
 import se.leap.bitmaskclient.providersetup.models.LeapSRPSession;
 
@@ -74,6 +76,9 @@ import static se.leap.bitmaskclient.providersetup.ProviderAPI.ERRORID;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.ERRORS;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_DOWNLOADED_EIP_SERVICE;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_UPDATED_INVALID_VPN_CERTIFICATE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.TOR_EXCEPTION;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.TOR_TIMEOUT;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.UPDATE_INVALID_VPN_CERTIFICATE;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.USER_MESSAGE;
 
 
@@ -303,6 +308,19 @@ public class MainActivity extends AppCompatActivity implements EipSetupListener,
                     askUserToLogIn(getString(vpn_certificate_user_message));
                 }
                 break;
+            case TOR_TIMEOUT:
+            case TOR_EXCEPTION:
+                try {
+                    Bundle resultData = intent.getParcelableExtra(BROADCAST_RESULT_KEY);
+                    JSONObject jsonObject = new JSONObject(resultData.getString(ProviderAPI.ERRORS));
+                    String initialAction = jsonObject.optString(ProviderAPI.INITIAL_ACTION);
+                    if (UPDATE_INVALID_VPN_CERTIFICATE.equals(initialAction)) {
+                        showMainActivityErrorDialog(getString(downloading_vpn_certificate_failed));
+                    }
+                } catch (Exception e) {
+                    //ignore
+                }
+                break;
         }
     }
 
@@ -327,7 +345,6 @@ public class MainActivity extends AppCompatActivity implements EipSetupListener,
                 JSONObject errorJson = new JSONObject(reasonToFail);
                 newFragment = MainActivityErrorDialog.newInstance(provider, errorJson);
             } catch (JSONException e) {
-                e.printStackTrace();
                 newFragment = MainActivityErrorDialog.newInstance(provider, reasonToFail);
             }
             newFragment.show(fragmentTransaction, MainActivityErrorDialog.TAG);
diff --git a/app/src/main/java/se/leap/bitmaskclient/base/fragments/EipFragment.java b/app/src/main/java/se/leap/bitmaskclient/base/fragments/EipFragment.java
index dfa45614..a61680a1 100644
--- a/app/src/main/java/se/leap/bitmaskclient/base/fragments/EipFragment.java
+++ b/app/src/main/java/se/leap/bitmaskclient/base/fragments/EipFragment.java
@@ -16,6 +16,26 @@
  */
 package se.leap.bitmaskclient.base.fragments;
 
+import static de.blinkt.openvpn.core.ConnectionStatus.LEVEL_NONETWORK;
+import static se.leap.bitmaskclient.base.models.Constants.ASK_TO_CANCEL_VPN;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_START;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_EARLY_ROUTES;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_RESTART_ON_BOOT;
+import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_KEY;
+import static se.leap.bitmaskclient.base.models.Constants.REQUEST_CODE_CONFIGURE_LEAP;
+import static se.leap.bitmaskclient.base.models.Constants.REQUEST_CODE_LOG_IN;
+import static se.leap.bitmaskclient.base.models.Constants.REQUEST_CODE_SWITCH_PROVIDER;
+import static se.leap.bitmaskclient.base.models.Constants.SHARED_PREFERENCES;
+import static se.leap.bitmaskclient.base.utils.ConfigHelper.isDefaultBitmask;
+import static se.leap.bitmaskclient.base.utils.PreferenceHelper.getPreferredCity;
+import static se.leap.bitmaskclient.base.utils.ViewHelper.convertDimensionToPx;
+import static se.leap.bitmaskclient.eip.EipSetupObserver.gatewayOrder;
+import static se.leap.bitmaskclient.eip.EipSetupObserver.reconnectingWithDifferentGateway;
+import static se.leap.bitmaskclient.eip.GatewaysManager.Load.UNKNOWN;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.DOWNLOAD_GEOIP_JSON;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.UPDATE_INVALID_VPN_CERTIFICATE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.USER_MESSAGE;
+
 import android.app.Activity;
 import android.content.ComponentName;
 import android.content.Context;
@@ -27,18 +47,19 @@ import android.graphics.ColorMatrixColorFilter;
 import android.os.Bundle;
 import android.os.IBinder;
 import android.os.Vibrator;
+import android.text.Spannable;
+import android.text.SpannableString;
 import android.text.TextUtils;
+import android.text.style.RelativeSizeSpan;
 import android.util.Log;
 import android.view.Gravity;
 import android.view.LayoutInflater;
 import android.view.View;
 import android.view.ViewGroup;
-import android.widget.TextView;
 import android.widget.Toast;
 
 import androidx.annotation.NonNull;
 import androidx.appcompat.app.AlertDialog;
-import androidx.appcompat.widget.AppCompatButton;
 import androidx.appcompat.widget.AppCompatImageView;
 import androidx.appcompat.widget.AppCompatTextView;
 import androidx.fragment.app.DialogFragment;
@@ -74,29 +95,8 @@ import se.leap.bitmaskclient.providersetup.ProviderListActivity;
 import se.leap.bitmaskclient.providersetup.activities.CustomProviderSetupActivity;
 import se.leap.bitmaskclient.providersetup.activities.LoginActivity;
 import se.leap.bitmaskclient.providersetup.models.LeapSRPSession;
-
-import static android.view.View.INVISIBLE;
-import static android.view.View.VISIBLE;
-import static de.blinkt.openvpn.core.ConnectionStatus.LEVEL_NONETWORK;
-import static se.leap.bitmaskclient.R.string.vpn_certificate_user_message;
-import static se.leap.bitmaskclient.base.models.Constants.ASK_TO_CANCEL_VPN;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_START;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_EARLY_ROUTES;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_RESTART_ON_BOOT;
-import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_KEY;
-import static se.leap.bitmaskclient.base.models.Constants.REQUEST_CODE_CONFIGURE_LEAP;
-import static se.leap.bitmaskclient.base.models.Constants.REQUEST_CODE_LOG_IN;
-import static se.leap.bitmaskclient.base.models.Constants.REQUEST_CODE_SWITCH_PROVIDER;
-import static se.leap.bitmaskclient.base.models.Constants.SHARED_PREFERENCES;
-import static se.leap.bitmaskclient.base.utils.ConfigHelper.isDefaultBitmask;
-import static se.leap.bitmaskclient.base.utils.PreferenceHelper.getPreferredCity;
-import static se.leap.bitmaskclient.base.utils.ViewHelper.convertDimensionToPx;
-import static se.leap.bitmaskclient.eip.EipSetupObserver.gatewayOrder;
-import static se.leap.bitmaskclient.eip.EipSetupObserver.reconnectingWithDifferentGateway;
-import static se.leap.bitmaskclient.eip.GatewaysManager.Load.UNKNOWN;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.DOWNLOAD_GEOIP_JSON;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.UPDATE_INVALID_VPN_CERTIFICATE;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.USER_MESSAGE;
+import se.leap.bitmaskclient.tor.TorServiceCommand;
+import se.leap.bitmaskclient.tor.TorStatusObservable;
 
 public class EipFragment extends Fragment implements Observer {
 
@@ -123,6 +123,8 @@ public class EipFragment extends Fragment implements Observer {
 
     private Unbinder unbinder;
     private EipStatus eipStatus;
+    private ProviderObservable providerObservable;
+    private TorStatusObservable torStatusObservable;
 
     private GatewaysManager gatewaysManager;
 
@@ -172,6 +174,8 @@ public class EipFragment extends Fragment implements Observer {
         super.onCreate(savedInstanceState);
         openVpnConnection = new EipFragmentServiceConnection();
         eipStatus = EipStatus.getInstance();
+        providerObservable = ProviderObservable.getInstance();
+        torStatusObservable = TorStatusObservable.getInstance();
         Activity activity = getActivity();
         if (activity != null) {
             preferences = getActivity().getSharedPreferences(SHARED_PREFERENCES, Context.MODE_PRIVATE);
@@ -187,6 +191,8 @@ public class EipFragment extends Fragment implements Observer {
     @Override
     public View onCreateView(@NonNull LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
         eipStatus.addObserver(this);
+        torStatusObservable.addObserver(this);
+        providerObservable.addObserver(this);
         View view = inflater.inflate(R.layout.f_eip, container, false);
         unbinder = ButterKnife.bind(this, view);
 
@@ -264,6 +270,8 @@ public class EipFragment extends Fragment implements Observer {
     public void onDestroyView() {
         super.onDestroyView();
         eipStatus.deleteObserver(this);
+        providerObservable.deleteObserver(this);
+        torStatusObservable.deleteObserver(this);
         unbinder.unbind();
     }
 
@@ -277,7 +285,7 @@ public class EipFragment extends Fragment implements Observer {
     }
 
     void handleIcon() {
-        if (isOpenVpnRunningWithoutNetwork() || eipStatus.isConnected() || eipStatus.isConnecting())
+        if (isOpenVpnRunningWithoutNetwork() || eipStatus.isConnected() || eipStatus.isConnecting() || eipStatus.isUpdatingVpnCert())
             handleSwitchOff();
         else
             handleSwitchOn();
@@ -313,7 +321,7 @@ public class EipFragment extends Fragment implements Observer {
     }
 
     private void handleSwitchOff() {
-        if (isOpenVpnRunningWithoutNetwork() || eipStatus.isConnecting()) {
+        if (isOpenVpnRunningWithoutNetwork() || eipStatus.isConnecting() || eipStatus.isUpdatingVpnCert()) {
             askPendingStartCancellation();
         } else if (eipStatus.isConnected()) {
             askToStopEIP();
@@ -364,7 +372,14 @@ public class EipFragment extends Fragment implements Observer {
             showPendingStartCancellation = true;
             alertDialog = alertBuilder.setTitle(activity.getString(R.string.eip_cancel_connect_title))
                     .setMessage(activity.getString(R.string.eip_cancel_connect_text))
-                    .setPositiveButton((android.R.string.yes), (dialog, which) -> stopEipIfPossible())
+                    .setPositiveButton((android.R.string.yes), (dialog, which) -> {
+                        Context context = getContext();
+                        if (context != null && eipStatus.isUpdatingVpnCert() &&
+                                TorStatusObservable.isRunning()) {
+                            TorServiceCommand.stopTorServiceAsync(context.getApplicationContext());
+                        }
+                        stopEipIfPossible();
+                    })
                     .setNegativeButton(activity.getString(android.R.string.no), (dialog, which) -> {
                     }).setOnDismissListener(dialog -> showPendingStartCancellation = false).show();
         } catch (IllegalStateException e) {
@@ -397,14 +412,20 @@ public class EipFragment extends Fragment implements Observer {
     public void update(Observable observable, Object data) {
         if (observable instanceof EipStatus) {
             eipStatus = (EipStatus) observable;
-            Activity activity = getActivity();
-            if (activity != null) {
-                activity.runOnUiThread(this::handleNewState);
-            } else {
-                Log.e("EipFragment", "activity is null");
-            }
+            handleNewStateOnMain();
         } else if (observable instanceof ProviderObservable) {
             provider = ((ProviderObservable) observable).getCurrentProvider();
+        } else if (observable instanceof TorStatusObservable && EipStatus.getInstance().isUpdatingVpnCert()) {
+            handleNewStateOnMain();
+        }
+    }
+
+    private void handleNewStateOnMain() {
+        Activity activity = getActivity();
+        if (activity != null) {
+            activity.runOnUiThread(this::handleNewState);
+        } else {
+            Log.e("EipFragment", "activity is null");
         }
     }
 
@@ -416,7 +437,23 @@ public class EipFragment extends Fragment implements Observer {
         }
 
         Log.d(TAG, "eip fragment eipStatus state: " + eipStatus.getState() + " - level: " + eipStatus.getLevel() + " - is reconnecting: " + eipStatus.isReconnecting());
-        if (eipStatus.isConnecting()) {
+        if (eipStatus.isUpdatingVpnCert()) {
+            setMainButtonEnabled(true);
+            showConnectionTransitionLayout(true);
+            locationButton.setText(getString(R.string.eip_status_start_pending));
+            locationButton.setLocationLoad(UNKNOWN);
+            locationButton.showBridgeIndicator(false);
+            locationButton.showRecommendedIndicator(false);
+            mainDescription.setText(null);
+            String torStatus = TorStatusObservable.getStringForCurrentStatus(getContext());
+            if (!TextUtils.isEmpty(torStatus)) {
+                Spannable spannable = new SpannableString(torStatus);
+                spannable.setSpan(new RelativeSizeSpan(0.75f), 0, spannable.length(), Spannable.SPAN_EXCLUSIVE_EXCLUSIVE);
+                subDescription.setText(TextUtils.concat(getString(R.string.updating_certificate_message) + "\n", spannable));
+            } else {
+                subDescription.setText(getString(R.string.updating_certificate_message));
+            }
+        } else if (eipStatus.isConnecting()) {
             setMainButtonEnabled(true);
             showConnectionTransitionLayout(true);
             locationButton.setText(getString(R.string.eip_status_start_pending));
@@ -574,6 +611,7 @@ public class EipFragment extends Fragment implements Observer {
     }
 
     private void updateInvalidVpnCertificate() {
+        eipStatus.setUpdatingVpnCert(true);
         ProviderAPICommand.execute(getContext(), UPDATE_INVALID_VPN_CERTIFICATE, provider);
     }
 
diff --git a/app/src/main/java/se/leap/bitmaskclient/eip/EipSetupObserver.java b/app/src/main/java/se/leap/bitmaskclient/eip/EipSetupObserver.java
index 813b8b62..9d67340e 100644
--- a/app/src/main/java/se/leap/bitmaskclient/eip/EipSetupObserver.java
+++ b/app/src/main/java/se/leap/bitmaskclient/eip/EipSetupObserver.java
@@ -17,6 +17,38 @@
 
 package se.leap.bitmaskclient.eip;
 
+import static android.app.Activity.RESULT_CANCELED;
+import static android.content.Intent.CATEGORY_DEFAULT;
+import static de.blinkt.openvpn.core.ConnectionStatus.LEVEL_CONNECTING_NO_SERVER_REPLY_YET;
+import static de.blinkt.openvpn.core.ConnectionStatus.LEVEL_NOTCONNECTED;
+import static se.leap.bitmaskclient.appUpdate.DownloadServiceCommand.CHECK_VERSION_FILE;
+import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_EIP_EVENT;
+import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_GATEWAY_SETUP_OBSERVER_EVENT;
+import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_PROVIDER_API_EVENT;
+import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_RESULT_CODE;
+import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_RESULT_KEY;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_LAUNCH_VPN;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_PREPARE_VPN;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_START;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_START_ALWAYS_ON_VPN;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_EARLY_ROUTES;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_N_CLOSEST_GATEWAY;
+import static se.leap.bitmaskclient.base.models.Constants.EIP_REQUEST;
+import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_KEY;
+import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_PROFILE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.CORRECTLY_DOWNLOADED_EIP_SERVICE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.CORRECTLY_DOWNLOADED_GEOIP_JSON;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.CORRECTLY_UPDATED_INVALID_VPN_CERTIFICATE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_DOWNLOADED_EIP_SERVICE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_DOWNLOADED_GEOIP_JSON;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_DOWNLOADED_VPN_CERTIFICATE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_UPDATED_INVALID_VPN_CERTIFICATE;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.PROVIDER_NOK;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.PROVIDER_OK;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.TOR_EXCEPTION;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.TOR_TIMEOUT;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.UPDATE_INVALID_VPN_CERTIFICATE;
+
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
@@ -45,39 +77,8 @@ import se.leap.bitmaskclient.base.utils.PreferenceHelper;
 import se.leap.bitmaskclient.providersetup.ProviderAPI;
 import se.leap.bitmaskclient.providersetup.ProviderAPICommand;
 import se.leap.bitmaskclient.tor.TorServiceCommand;
-import se.leap.bitmaskclient.tor.TorServiceConnection;
 import se.leap.bitmaskclient.tor.TorStatusObservable;
 
-import static android.app.Activity.RESULT_CANCELED;
-import static android.content.Intent.CATEGORY_DEFAULT;
-import static de.blinkt.openvpn.core.ConnectionStatus.LEVEL_CONNECTING_NO_SERVER_REPLY_YET;
-import static de.blinkt.openvpn.core.ConnectionStatus.LEVEL_NOTCONNECTED;
-import static se.leap.bitmaskclient.appUpdate.DownloadServiceCommand.CHECK_VERSION_FILE;
-import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_EIP_EVENT;
-import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_GATEWAY_SETUP_OBSERVER_EVENT;
-import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_PROVIDER_API_EVENT;
-import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_RESULT_CODE;
-import static se.leap.bitmaskclient.base.models.Constants.BROADCAST_RESULT_KEY;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_LAUNCH_VPN;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_PREPARE_VPN;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_START;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_ACTION_START_ALWAYS_ON_VPN;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_EARLY_ROUTES;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_N_CLOSEST_GATEWAY;
-import static se.leap.bitmaskclient.base.models.Constants.EIP_REQUEST;
-import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_KEY;
-import static se.leap.bitmaskclient.base.models.Constants.PROVIDER_PROFILE;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.CORRECTLY_DOWNLOADED_EIP_SERVICE;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.CORRECTLY_DOWNLOADED_GEOIP_JSON;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.CORRECTLY_UPDATED_INVALID_VPN_CERTIFICATE;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_DOWNLOADED_EIP_SERVICE;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_DOWNLOADED_GEOIP_JSON;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_DOWNLOADED_VPN_CERTIFICATE;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.INCORRECTLY_UPDATED_INVALID_VPN_CERTIFICATE;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.PROVIDER_NOK;
-import static se.leap.bitmaskclient.providersetup.ProviderAPI.PROVIDER_OK;
-import static se.leap.bitmaskclient.tor.TorStatusObservable.TorStatus.OFF;
-
 /**
  * Created by cyberta on 05.12.18.
  */
@@ -86,7 +87,7 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
     private static final String TAG = EipSetupObserver.class.getName();
 
     private static final int UPDATE_CHECK_TIMEOUT = 1000*60*60*24*7;
-    private Context context;
+    private final Context appContext;
     private VpnProfile setupVpnProfile;
     private String observedProfileFromVpnStatus;
     AtomicInteger reconnectTry = new AtomicInteger();
@@ -97,7 +98,7 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
     private static EipSetupObserver instance;
 
     private EipSetupObserver(Context context, SharedPreferences preferences) {
-        this.context = context;
+        this.appContext = context.getApplicationContext();
         this.preferences = preferences;
         IntentFilter updateIntentFilter = new IntentFilter(BROADCAST_GATEWAY_SETUP_OBSERVER_EVENT);
         updateIntentFilter.addAction(BROADCAST_EIP_EVENT);
@@ -105,7 +106,7 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
         updateIntentFilter.addAction(TorService.ACTION_STATUS);
         updateIntentFilter.addAction(TorService.ACTION_ERROR);
         updateIntentFilter.addCategory(CATEGORY_DEFAULT);
-        LocalBroadcastManager.getInstance(context.getApplicationContext()).registerReceiver(this, updateIntentFilter);
+        LocalBroadcastManager.getInstance(context).registerReceiver(this, updateIntentFilter);
         instance = this;
         VpnStatus.addLogListener(this);
     }
@@ -174,7 +175,7 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
         Log.d(TAG, "handle Tor status event: " + status);
         Integer bootstrap = intent.getIntExtra(TorService.EXTRA_STATUS_DETAIL_BOOTSTRAP, -1);
         String logKey = intent.getStringExtra(TorService.EXTRA_STATUS_DETAIL_LOGKEY);
-        TorStatusObservable.updateState(context, status, bootstrap, logKey);
+        TorStatusObservable.updateState(appContext, status, bootstrap, logKey);
     }
 
 
@@ -193,14 +194,18 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
                 ProviderObservable.getInstance().updateProvider(provider);
                 PreferenceHelper.storeProviderInPreferences(preferences, provider);
                 if (EipStatus.getInstance().isDisconnected()) {
-                    EipCommand.startVPN(context, false);
+                    EipCommand.startVPN(appContext, false);
                 }
                 break;
             case CORRECTLY_UPDATED_INVALID_VPN_CERTIFICATE:
                 provider = resultData.getParcelable(PROVIDER_KEY);
                 ProviderObservable.getInstance().updateProvider(provider);
                 PreferenceHelper.storeProviderInPreferences(preferences, provider);
-                EipCommand.startVPN(context, false);
+                EipCommand.startVPN(appContext, false);
+                EipStatus.getInstance().setUpdatingVpnCert(false);
+                if (TorStatusObservable.isRunning()) {
+                    TorServiceCommand.stopTorServiceAsync(appContext);
+                }
                 break;
             case CORRECTLY_DOWNLOADED_GEOIP_JSON:
                 provider = resultData.getParcelable(PROVIDER_KEY);
@@ -211,18 +216,35 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
             case INCORRECTLY_DOWNLOADED_GEOIP_JSON:
                 maybeStartEipService(resultData);
                 break;
-            case PROVIDER_NOK:
             case INCORRECTLY_UPDATED_INVALID_VPN_CERTIFICATE:
+                EipStatus.getInstance().setUpdatingVpnCert(false);
+                if (TorStatusObservable.isRunning()) {
+                    TorServiceCommand.stopTorServiceAsync(appContext);
+                }
+                break;
+            case PROVIDER_NOK:
             case INCORRECTLY_DOWNLOADED_EIP_SERVICE:
             case INCORRECTLY_DOWNLOADED_VPN_CERTIFICATE:
-                if (TorStatusObservable.getStatus() != OFF) {
-                    TorServiceCommand.stopTorServiceAsync(context);
+                if (TorStatusObservable.isRunning()) {
+                    TorServiceCommand.stopTorServiceAsync(appContext);
                 }
                 Log.d(TAG, "PROVIDER NOK - FETCH FAILED");
                 break;
             case PROVIDER_OK:
                 Log.d(TAG, "PROVIDER OK - FETCH SUCCESSFUL");
                 break;
+            case TOR_TIMEOUT:
+            case TOR_EXCEPTION:
+                try {
+                    JSONObject jsonObject = new JSONObject(resultData.getString(ProviderAPI.ERRORS));
+                    String initialAction = jsonObject.optString(ProviderAPI.INITIAL_ACTION);
+                    if (UPDATE_INVALID_VPN_CERTIFICATE.equals(initialAction)) {
+                        EipStatus.getInstance().setUpdatingVpnCert(false);
+                    }
+                } catch (Exception e) {
+                    //ignore
+                }
+                break;
             default:
                 break;
         }
@@ -235,7 +257,7 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
     private void maybeStartEipService(Bundle resultData) {
         if (resultData.getBoolean(EIP_ACTION_START)) {
             boolean earlyRoutes = resultData.getBoolean(EIP_EARLY_ROUTES);
-            EipCommand.startVPN(context, earlyRoutes);
+            EipCommand.startVPN(appContext, earlyRoutes);
         }
     }
 
@@ -262,14 +284,14 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
                     switch (error) {
                         case NO_MORE_GATEWAYS:
                             finishGatewaySetup(false);
-                            EipCommand.startBlockingVPN(context);
+                            EipCommand.startBlockingVPN(appContext);
                             break;
                         case ERROR_INVALID_PROFILE:
                             selectNextGateway();
                             break;
                         default:
                             finishGatewaySetup(false);
-                            EipCommand.stopVPN(context);
+                            EipCommand.stopVPN(appContext);
                             EipStatus.refresh();
                     }
                 }
@@ -345,11 +367,11 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
             Provider provider = ProviderObservable.getInstance().getCurrentProvider();
             if (setupNClosestGateway.get() > 0 || provider.shouldUpdateEipServiceJson()) {
                 //setupNClostestGateway > 0: at least one failed gateway -> did the provider change it's gateways?
-                ProviderAPICommand.execute(context, ProviderAPI.DOWNLOAD_SERVICE_JSON, provider);
+                ProviderAPICommand.execute(appContext, ProviderAPI.DOWNLOAD_SERVICE_JSON, provider);
             }
 
             if (shouldCheckAppUpdate()) {
-                DownloadServiceCommand.execute(context, CHECK_VERSION_FILE);
+                DownloadServiceCommand.execute(appContext, CHECK_VERSION_FILE);
             }
             finishGatewaySetup(false);
         } else if ("TCP_CONNECT".equals(state)) {
@@ -358,13 +380,13 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
     }
 
     private boolean shouldCheckAppUpdate() {
-        return System.currentTimeMillis() - PreferenceHelper.getLastAppUpdateCheck(context) >= UPDATE_CHECK_TIMEOUT;
+        return System.currentTimeMillis() - PreferenceHelper.getLastAppUpdateCheck(appContext) >= UPDATE_CHECK_TIMEOUT;
     }
 
     private void selectNextGateway() {
         changingGateway.set(true);
         reconnectTry.set(0);
-        EipCommand.startVPN(context, false, setupNClosestGateway.get() + 1);
+        EipCommand.startVPN(appContext, false, setupNClosestGateway.get() + 1);
     }
 
     private void finishGatewaySetup(boolean changingGateway) {
@@ -374,8 +396,8 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
         observedProfileFromVpnStatus = null;
         this.changingGateway.set(changingGateway);
         this.reconnectTry.set(0);
-        if (TorStatusObservable.getStatus() != OFF) {
-            TorServiceCommand.stopTorServiceAsync(context);
+        if (TorStatusObservable.isRunning()) {
+            TorServiceCommand.stopTorServiceAsync(appContext);
         }
     }
 
@@ -396,9 +418,9 @@ public class EipSetupObserver extends BroadcastReceiver implements VpnStatus.Sta
                 case SHAPESHIFTER:
                     VpnProfile profile = VpnStatus.getLastConnectedVpnProfile();
                     if (profile == null) {
-                        EipCommand.startVPN(context, false, 0);
+                        EipCommand.startVPN(appContext, false, 0);
                     } else {
-                        GatewaysManager gatewaysManager = new GatewaysManager(context.getApplicationContext());
+                        GatewaysManager gatewaysManager = new GatewaysManager(appContext);
                         int position = gatewaysManager.getPosition(profile);
                         setupNClosestGateway.set(position >= 0 ? position : 0);
                         selectNextGateway();
diff --git a/app/src/main/java/se/leap/bitmaskclient/eip/EipStatus.java b/app/src/main/java/se/leap/bitmaskclient/eip/EipStatus.java
index bc123683..003e396f 100644
--- a/app/src/main/java/se/leap/bitmaskclient/eip/EipStatus.java
+++ b/app/src/main/java/se/leap/bitmaskclient/eip/EipStatus.java
@@ -56,6 +56,7 @@ public class EipStatus extends Observable implements VpnStatus.StateListener {
     private int lastErrorLine = 0;
     private String state, logMessage;
     private int localizedResId;
+    private boolean isUpdatingVPNCertificate;
 
     public static EipStatus getInstance() {
         if (currentStatus == null) {
@@ -178,6 +179,15 @@ public class EipStatus extends Observable implements VpnStatus.StateListener {
         }
     }
 
+    public void setUpdatingVpnCert(boolean isUpdating) {
+        isUpdatingVPNCertificate = isUpdating;
+        refresh();
+    }
+
+    public boolean isUpdatingVpnCert() {
+        return isUpdatingVPNCertificate;
+    }
+
     public boolean isConnecting() {
         return currentEipLevel == EipLevel.CONNECTING;
     }
diff --git a/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderAPI.java b/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderAPI.java
index 022ad040..da77af2f 100644
--- a/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderAPI.java
+++ b/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderAPI.java
@@ -93,7 +93,8 @@ public class ProviderAPI extends JobIntentService implements ProviderApiManagerB
             CORRECTLY_DOWNLOADED_GEOIP_JSON = 17,
             INCORRECTLY_DOWNLOADED_GEOIP_JSON = 18,
             TOR_TIMEOUT = 19,
-            MISSING_NETWORK_CONNECTION = 20;
+            MISSING_NETWORK_CONNECTION = 20,
+            TOR_EXCEPTION = 21;
 
     ProviderApiManager providerApiManager;
     private volatile TorServiceConnection torServiceConnection;
diff --git a/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java b/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java
index 63cf03cf..ecddb9c7 100644
--- a/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java
+++ b/app/src/main/java/se/leap/bitmaskclient/providersetup/ProviderApiManagerBase.java
@@ -17,57 +17,6 @@
 
 package se.leap.bitmaskclient.providersetup;
 
-import android.content.Intent;
-import android.content.SharedPreferences;
-import android.content.res.Resources;
-import android.os.Bundle;
-import android.os.ResultReceiver;
-import android.util.Base64;
-import android.util.Log;
-import android.util.Pair;
-
-import androidx.annotation.NonNull;
-
-import org.json.JSONException;
-import org.json.JSONObject;
-
-import java.io.IOException;
-import java.math.BigInteger;
-import java.net.ConnectException;
-import java.net.MalformedURLException;
-import java.net.SocketTimeoutException;
-import java.net.UnknownHostException;
-import java.net.UnknownServiceException;
-import java.security.NoSuchAlgorithmException;
-import java.security.cert.CertificateEncodingException;
-import java.security.cert.CertificateException;
-import java.security.cert.CertificateExpiredException;
-import java.security.cert.CertificateNotYetValidException;
-import java.security.cert.X509Certificate;
-import java.security.interfaces.RSAPrivateKey;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.NoSuchElementException;
-import java.util.concurrent.TimeoutException;
-
-import javax.net.ssl.SSLHandshakeException;
-import javax.net.ssl.SSLPeerUnverifiedException;
-
-import de.blinkt.openvpn.core.VpnStatus;
-import okhttp3.OkHttpClient;
-import se.leap.bitmaskclient.R;
-import se.leap.bitmaskclient.base.models.Constants.CREDENTIAL_ERRORS;
-import se.leap.bitmaskclient.base.models.Provider;
-import se.leap.bitmaskclient.base.models.ProviderObservable;
-import se.leap.bitmaskclient.base.utils.ConfigHelper;
-import se.leap.bitmaskclient.base.utils.PreferenceHelper;
-import se.leap.bitmaskclient.eip.EipStatus;
-import se.leap.bitmaskclient.providersetup.connectivity.OkHttpClientGenerator;
-import se.leap.bitmaskclient.providersetup.models.LeapSRPSession;
-import se.leap.bitmaskclient.providersetup.models.SrpCredentials;
-import se.leap.bitmaskclient.providersetup.models.SrpRegistrationData;
-import se.leap.bitmaskclient.tor.TorStatusObservable;
-
 import static se.leap.bitmaskclient.R.string.certificate_error;
 import static se.leap.bitmaskclient.R.string.error_io_exception_user_message;
 import static se.leap.bitmaskclient.R.string.error_json_exception_user_message;
@@ -128,6 +77,7 @@ import static se.leap.bitmaskclient.providersetup.ProviderAPI.SIGN_UP;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.SUCCESSFUL_LOGIN;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.SUCCESSFUL_LOGOUT;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.SUCCESSFUL_SIGNUP;
+import static se.leap.bitmaskclient.providersetup.ProviderAPI.TOR_EXCEPTION;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.TOR_TIMEOUT;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.UPDATE_INVALID_VPN_CERTIFICATE;
 import static se.leap.bitmaskclient.providersetup.ProviderAPI.UPDATE_PROVIDER_DETAILS;
@@ -140,6 +90,57 @@ import static se.leap.bitmaskclient.tor.TorStatusObservable.TorStatus.OFF;
 import static se.leap.bitmaskclient.tor.TorStatusObservable.TorStatus.ON;
 import static se.leap.bitmaskclient.tor.TorStatusObservable.getProxyPort;
 
+import android.content.Intent;
+import android.content.SharedPreferences;
+import android.content.res.Resources;
+import android.os.Bundle;
+import android.os.ResultReceiver;
+import android.util.Base64;
+import android.util.Log;
+import android.util.Pair;
+
+import androidx.annotation.NonNull;
+
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.net.ConnectException;
+import java.net.MalformedURLException;
+import java.net.SocketTimeoutException;
+import java.net.UnknownHostException;
+import java.net.UnknownServiceException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateExpiredException;
+import java.security.cert.CertificateNotYetValidException;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPrivateKey;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.NoSuchElementException;
+import java.util.concurrent.TimeoutException;
+
+import javax.net.ssl.SSLHandshakeException;
+import javax.net.ssl.SSLPeerUnverifiedException;
+
+import de.blinkt.openvpn.core.VpnStatus;
+import okhttp3.OkHttpClient;
+import se.leap.bitmaskclient.R;
+import se.leap.bitmaskclient.base.models.Constants.CREDENTIAL_ERRORS;
+import se.leap.bitmaskclient.base.models.Provider;
+import se.leap.bitmaskclient.base.models.ProviderObservable;
+import se.leap.bitmaskclient.base.utils.ConfigHelper;
+import se.leap.bitmaskclient.base.utils.PreferenceHelper;
+import se.leap.bitmaskclient.eip.EipStatus;
+import se.leap.bitmaskclient.providersetup.connectivity.OkHttpClientGenerator;
+import se.leap.bitmaskclient.providersetup.models.LeapSRPSession;
+import se.leap.bitmaskclient.providersetup.models.SrpCredentials;
+import se.leap.bitmaskclient.providersetup.models.SrpRegistrationData;
+import se.leap.bitmaskclient.tor.TorStatusObservable;
+
 /**
  * Implements the logic of the http api calls. The methods of this class needs to be called from
  * a background thread.
@@ -200,11 +201,14 @@ public abstract class ProviderApiManagerBase {
         }
 
          try {
-             if (PreferenceHelper.hasSnowflakePrefs(preferences)) {
+             if (PreferenceHelper.hasSnowflakePrefs(preferences) && !VpnStatus.isVPNActive()) {
                  startTorProxy();
              }
         } catch (InterruptedException | IllegalStateException e) {
             e.printStackTrace();
+             Bundle result = new Bundle();
+             setErrorResultAction(result, action);
+             sendToReceiverOrBroadcast(receiver, TOR_EXCEPTION, result, provider);
             return;
         } catch (TimeoutException e) {
              serviceCallback.stopTorService();
@@ -369,7 +373,7 @@ public abstract class ProviderApiManagerBase {
 
     private void addErrorMessageToJson(JSONObject jsonObject, String errorMessage, String errorId, String initialAction) {
         try {
-            jsonObject.put(ERRORS, errorMessage);
+            jsonObject.putOpt(ERRORS, errorMessage);
             jsonObject.putOpt(ERRORID, errorId);
             jsonObject.putOpt(INITIAL_ACTION, initialAction);
         } catch (JSONException e) {
@@ -599,6 +603,10 @@ public abstract class ProviderApiManagerBase {
             case INCORRECTLY_DOWNLOADED_GEOIP_JSON:
                 event = "download menshen service json.";
                 break;
+            case TOR_TIMEOUT:
+            case TOR_EXCEPTION:
+                event = "start tor for censorship circumvention";
+                break;
             default:
                 break;
         }
@@ -959,6 +967,15 @@ public abstract class ProviderApiManagerBase {
         return result;
     }
 
+    Bundle setErrorResultAction(Bundle result, String initialAction) {
+        JSONObject errorJson = new JSONObject();
+        addErrorMessageToJson(errorJson, null, null, initialAction);
+        VpnStatus.logWarning("[API] error: " + initialAction + " failed.");
+        result.putString(ERRORS, errorJson.toString());
+        result.putBoolean(BROADCAST_RESULT_KEY, false);
+        return result;
+    }
+
     Bundle setErrorResult(Bundle result, int errorMessageId, String errorId) {
         return setErrorResult(result, errorMessageId, errorId, null);
     }
diff --git a/app/src/main/java/se/leap/bitmaskclient/tor/ClientTransportPlugin.java b/app/src/main/java/se/leap/bitmaskclient/tor/ClientTransportPlugin.java
index 0b481780..59c1290a 100644
--- a/app/src/main/java/se/leap/bitmaskclient/tor/ClientTransportPlugin.java
+++ b/app/src/main/java/se/leap/bitmaskclient/tor/ClientTransportPlugin.java
@@ -113,13 +113,16 @@ public class ClientTransportPlugin implements ClientTransportPluginInterface {
     @Override
     public void stop() {
         IPtProxy.stopSnowflake();
-         try {
+        try {
             TorStatusObservable.waitUntil(this::isSnowflakeOff, 10);
         } catch (InterruptedException | TimeoutException e) {
             e.printStackTrace();
         }
         snowflakePort = -1;
-        logFileObserver.stopWatching();
+        if (logFileObserver != null) {
+            logFileObserver.stopWatching();
+            logFileObserver = null;
+        }
     }
 
     private boolean isSnowflakeOff() {
diff --git a/app/src/main/java/se/leap/bitmaskclient/tor/TorServiceCommand.java b/app/src/main/java/se/leap/bitmaskclient/tor/TorServiceCommand.java
index 68988b67..b99abb3d 100644
--- a/app/src/main/java/se/leap/bitmaskclient/tor/TorServiceCommand.java
+++ b/app/src/main/java/se/leap/bitmaskclient/tor/TorServiceCommand.java
@@ -42,7 +42,9 @@ public class TorServiceCommand {
     public static boolean startTorService(Context context, String action) throws InterruptedException {
         Log.d(TAG, "startTorService");
         try {
-            waitUntil(TorServiceCommand::isNotCancelled, 30);
+            if (TorStatusObservable.isCancelled()) {
+                waitUntil(TorServiceCommand::isNotCancelled, 30);
+            }
         } catch (TimeoutException e) {
             e.printStackTrace();
         }
@@ -79,7 +81,8 @@ public class TorServiceCommand {
 
     @WorkerThread
     public static void stopTorService(Context context) {
-        if (TorStatusObservable.getStatus() == TorStatusObservable.TorStatus.OFF) {
+        if (TorStatusObservable.getStatus() == TorStatusObservable.TorStatus.STOPPING ||
+            TorStatusObservable.getStatus() == TorStatusObservable.TorStatus.OFF) {
             return;
         }
         TorStatusObservable.markCancelled();
@@ -100,6 +103,9 @@ public class TorServiceCommand {
     }
 
     public static void stopTorServiceAsync(Context context) {
+        if (!TorStatusObservable.isRunning()) {
+            return;
+        }
         TorStatusObservable.markCancelled();
         new Thread(() -> stopTorService(context)).start();
     }
diff --git a/app/src/main/java/se/leap/bitmaskclient/tor/TorStatusObservable.java b/app/src/main/java/se/leap/bitmaskclient/tor/TorStatusObservable.java
index c924caee..7eee1a9d 100644
--- a/app/src/main/java/se/leap/bitmaskclient/tor/TorStatusObservable.java
+++ b/app/src/main/java/se/leap/bitmaskclient/tor/TorStatusObservable.java
@@ -178,7 +178,6 @@ public class TorStatusObservable extends Observable {
             if (getInstance().status == TorStatus.OFF) {
                 getInstance().torNotificationManager.cancelNotifications(context);
                 getInstance().cancelled = false;
-                getInstance().port = -1;
             } else {
                 if (logKey != null) {
                     getInstance().lastTorLog = getStringFor(context, logKey);
@@ -264,6 +263,10 @@ public class TorStatusObservable extends Observable {
     }
 
     public static String getStringForCurrentStatus(Context context) {
+        if (context == null) {
+            return "";
+        }
+
         switch (getInstance().status) {
             case ON:
                 return context.getString(R.string.tor_started);
@@ -280,6 +283,8 @@ public class TorStatusObservable extends Observable {
     public static void markCancelled() {
         if (!getInstance().cancelled) {
             getInstance().cancelled = true;
+            getInstance().port = -1;
+            getInstance().setChanged();
             getInstance().notifyObservers();
         }
     }
@@ -287,4 +292,9 @@ public class TorStatusObservable extends Observable {
     public static boolean isCancelled() {
         return getInstance().cancelled;
     }
+
+    public static boolean isRunning() {
+        return !TorStatusObservable.isCancelled() &&
+                TorStatusObservable.getStatus() != TorStatusObservable.TorStatus.OFF;
+    }
 }