Update ics-openvpn to 1006

72 files changed, 2003 insertions, 260 deletions

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 4893ce4c..cd04f68a 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -35,7 +35,7 @@
         android:icon="@drawable/icon"
         android:logo="@drawable/icon"
         android:label="@string/app"
-        android:theme="@style/appstyle">
+        android:theme="@style/blinkt">
 
         <service
             android:name="se.leap.bitmaskclient.eip.VoidVpnService"
diff --git a/app/src/main/java/de/blinkt/openvpn/LaunchVPN.java b/app/src/main/java/de/blinkt/openvpn/LaunchVPN.java
index d7f3e110..02abd7a1 100644
--- a/app/src/main/java/de/blinkt/openvpn/LaunchVPN.java
+++ b/app/src/main/java/de/blinkt/openvpn/LaunchVPN.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn;
diff --git a/app/src/main/java/de/blinkt/openvpn/VpnProfile.java b/app/src/main/java/de/blinkt/openvpn/VpnProfile.java
index fb2ba90d..4f747d21 100644
--- a/app/src/main/java/de/blinkt/openvpn/VpnProfile.java
+++ b/app/src/main/java/de/blinkt/openvpn/VpnProfile.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn;
@@ -42,6 +42,7 @@ import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.Collection;
+import java.util.HashSet;
 import java.util.Locale;
 import java.util.UUID;
 import java.util.Vector;
@@ -51,13 +52,14 @@ import javax.crypto.Cipher;
 import javax.crypto.IllegalBlockSizeException;
 import javax.crypto.NoSuchPaddingException;
 
+import de.blinkt.openvpn.core.Connection;
 import de.blinkt.openvpn.core.NativeUtils;
 import de.blinkt.openvpn.core.OpenVPNService;
 import de.blinkt.openvpn.core.VPNLaunchHelper;
 import de.blinkt.openvpn.core.VpnStatus;
 import de.blinkt.openvpn.core.X509Utils;
 
-public class VpnProfile implements Serializable {
+public class VpnProfile implements Serializable, Cloneable {
     // Note that this class cannot be moved to core where it belongs since
     // the profile loading depends on it being here
     // The Serializable documentation mentions that class name change are possible
@@ -71,7 +73,7 @@ public class VpnProfile implements Serializable {
 
     private static final long serialVersionUID = 7085688938959334563L;
     public static final int MAXLOGLEVEL = 4;
-    public static final int CURRENT_PROFILE_VERSION = 2;
+    public static final int CURRENT_PROFILE_VERSION = 5;
     public static final int DEFAULT_MSSFIX_SIZE = 1450;
     public static String DEFAULT_DNS1 = "8.8.8.8";
     public static String DEFAULT_DNS2 = "8.8.4.4";
@@ -106,12 +108,10 @@ public class VpnProfile implements Serializable {
     public String mClientKeyFilename;
     public String mCaFilename;
     public boolean mUseLzo = true;
-    public String mServerPort = "1194";
-    public boolean mUseUdp = true;
     public String mPKCS12Filename;
     public String mPKCS12Password;
     public boolean mUseTLSAuth = false;
-    public String mServerName = "openvpn.blinkt.de";
+
     public String mDNS1 = DEFAULT_DNS1;
     public String mDNS2 = DEFAULT_DNS2;
     public String mIPv4Address;
@@ -152,6 +152,16 @@ public class VpnProfile implements Serializable {
     public String mExcludedRoutes;
     public String mExcludedRoutesv6;
     public int mMssFix =0; // -1 is default,
+    public Connection[] mConnections = new Connection[0];
+    public boolean mRemoteRandom=false;
+    public HashSet<String> mAllowedAppsVpn = new HashSet<String>();
+    public boolean mAllowedAppsVpnAreDisallowed = true;
+
+
+    /* Options no long used in new profiles */
+    public String mServerName = "openvpn.blinkt.de";
+    public String mServerPort = "1194";
+    public boolean mUseUdp = true;
 
 
 
@@ -159,6 +169,9 @@ public class VpnProfile implements Serializable {
         mUuid = UUID.randomUUID();
         mName = name;
         mProfileVersion = CURRENT_PROFILE_VERSION;
+
+        mConnections = new Connection[1];
+        mConnections[0]  = new Connection();
     }
 
     public static String openVpnEscape(String unescaped) {
@@ -206,7 +219,30 @@ public class VpnProfile implements Serializable {
             mAllowLocalLAN = Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT;
         }
 
+        if (mProfileVersion < 4) {
+            moveOptionsToConnection();
+            mAllowedAppsVpnAreDisallowed=true;
+        }
+        if (mAllowedAppsVpn==null)
+            mAllowedAppsVpn = new HashSet<String>();
+        if (mConnections ==null)
+            mConnections = new Connection[0];
+
         mProfileVersion= CURRENT_PROFILE_VERSION;
+
+    }
+
+    private void moveOptionsToConnection() {
+        mConnections = new Connection[1];
+        Connection conn = new Connection();
+
+        conn.mServerName = mServerName;
+        conn.mServerPort = mServerPort;
+        conn.mUseUdp = mUseUdp;
+        conn.mCustomConfiguration = "";
+
+        mConnections[0] = conn;
+
     }
 
     public String getConfigFile(Context context, boolean configForOvpn3) {
@@ -267,15 +303,27 @@ public class VpnProfile implements Serializable {
         // We cannot use anything else than tun
         cfg += "dev tun\n";
 
-        // Server Address
-        cfg += "remote ";
-        cfg += mServerName;
-        cfg += " ";
-        cfg += mServerPort;
-        if (mUseUdp)
-            cfg += " udp\n";
-        else
-            cfg += " tcp-client\n";
+
+        boolean canUsePlainRemotes = true;
+
+        if (mConnections.length==1) {
+            cfg += mConnections[0].getConnectionBlock();
+        } else {
+            for (Connection conn : mConnections) {
+                canUsePlainRemotes = canUsePlainRemotes && conn.isOnlyRemote();
+            }
+
+            if (mRemoteRandom)
+                cfg+="remote-random\n";
+
+            if (canUsePlainRemotes) {
+                for (Connection conn : mConnections) {
+                    if (conn.mEnabled) {
+                        cfg += conn.getConnectionBlock();
+                    }
+                }
+            }
+        }
 
 
         switch (mAuthenticationType) {
@@ -365,11 +413,6 @@ public class VpnProfile implements Serializable {
             }
         }
 
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT && !mAllowLocalLAN)
-            cfg+="redirect-private block-local\n";
-        else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT && mAllowLocalLAN)
-            cfg+="redirect-private unblock-local\n";
-
 
         if (mUseDefaultRoutev6)
             cfg += "route-ipv6 ::/0\n";
@@ -405,7 +448,7 @@ public class VpnProfile implements Serializable {
         if (mAuthenticationType != TYPE_STATICKEYS) {
             if (mCheckRemoteCN) {
                 if (mRemoteCN == null || mRemoteCN.equals(""))
-                    cfg += "verify-x509-name " + mServerName + " name\n";
+                    cfg += "verify-x509-name " + mConnections[0].mServerName + " name\n";
                 else
                     switch (mX509AuthType) {
 
@@ -470,6 +513,19 @@ public class VpnProfile implements Serializable {
 
         }
 
+        if (!canUsePlainRemotes) {
+            cfg += "# Connection Options are at the end to allow global options (and global custom options) to influence connection blocks\n";
+            for (Connection conn : mConnections) {
+                if (conn.mEnabled) {
+                    cfg += "<connection>\n";
+                    cfg += conn.getConnectionBlock();
+                    cfg += "</connection>\n";
+                }
+            }
+        }
+
+
+
 
         return cfg;
     }
@@ -639,6 +695,27 @@ public class VpnProfile implements Serializable {
         }
     }
 
+    @Override
+    protected VpnProfile clone() throws CloneNotSupportedException {
+        VpnProfile copy = (VpnProfile) super.clone();
+        copy.mUuid = UUID.randomUUID();
+        copy.mConnections = mConnections.clone();
+        copy.mAllowedAppsVpn = (HashSet<String>) mAllowedAppsVpn.clone();
+        return copy;
+    }
+
+    public VpnProfile copy(String name) {
+        try {
+            VpnProfile copy = (VpnProfile) clone();
+            copy.mName = name;
+            return copy;
+
+        } catch (CloneNotSupportedException e) {
+            e.printStackTrace();
+            return null;
+        }
+    }
+
 
     class NoCertReturnedException extends Exception {
         public NoCertReturnedException (String msg) {
@@ -769,6 +846,14 @@ public class VpnProfile implements Serializable {
         if (!mUseDefaultRoute && (getCustomRoutes(mCustomRoutes) == null || getCustomRoutes(mExcludedRoutes) ==null))
             return R.string.custom_route_format_error;
 
+        boolean noRemoteEnabled = true;
+        for (Connection c : mConnections)
+            if (c.mEnabled)
+                noRemoteEnabled = false;
+
+        if(noRemoteEnabled)
+            return R.string.remote_no_server_selected;
+
         // Everything okay
         return R.string.no_error_found;
 
diff --git a/app/src/main/java/de/blinkt/openvpn/activities/DisconnectVPN.java b/app/src/main/java/de/blinkt/openvpn/activities/DisconnectVPN.java
index 4940d5d6..dfd815e4 100644
--- a/app/src/main/java/de/blinkt/openvpn/activities/DisconnectVPN.java
+++ b/app/src/main/java/de/blinkt/openvpn/activities/DisconnectVPN.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.activities;
diff --git a/app/src/main/java/de/blinkt/openvpn/activities/LogWindow.java b/app/src/main/java/de/blinkt/openvpn/activities/LogWindow.java
index 5e4f9517..45f09c8e 100644
--- a/app/src/main/java/de/blinkt/openvpn/activities/LogWindow.java
+++ b/app/src/main/java/de/blinkt/openvpn/activities/LogWindow.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.activities;
diff --git a/app/src/main/java/de/blinkt/openvpn/core/CIDRIP.java b/app/src/main/java/de/blinkt/openvpn/core/CIDRIP.java
index ac9a8ccb..e525abd5 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/CIDRIP.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/CIDRIP.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
diff --git a/app/src/main/java/de/blinkt/openvpn/core/ConfigParser.java b/app/src/main/java/de/blinkt/openvpn/core/ConfigParser.java
index 0d8230b7..5dc96bbc 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/ConfigParser.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/ConfigParser.java
@@ -1,13 +1,17 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
 
+import android.text.TextUtils;
+import android.util.Pair;
+
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.Reader;
+import java.io.StringReader;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Locale;
@@ -28,48 +32,49 @@ public class ConfigParser {
 	private HashMap<String, Vector<Vector<String>>> options = new HashMap<String, Vector<Vector<String>>>();
 	private HashMap<String, Vector<String>> meta = new HashMap<String, Vector<String>>();
 
-
-	private boolean extraRemotesAsCustom=false;
-
 	public void parseConfig(Reader reader) throws IOException, ConfigParseError {
 
 
-		BufferedReader br =new BufferedReader(reader);
+        BufferedReader br = new BufferedReader(reader);
 
-        int lineno=0;
-		while (true){
-			String line = br.readLine();
-            lineno++;
-			if(line==null)
-				break;
+        int lineno = 0;
+        try {
+            while (true) {
+                String line = br.readLine();
+                lineno++;
+                if (line == null)
+                    break;
 
-            if (lineno==1 && (line.startsWith("PK\003\004")
-                        ||   (line.startsWith("PK\007\008"))))
+                if (lineno == 1 && (line.startsWith("PK\003\004")
+                        || (line.startsWith("PK\007\008"))))
                     throw new ConfigParseError("Input looks like a ZIP Archive. Import is only possible for OpenVPN config files (.ovpn/.conf)");
 
-			// Check for OpenVPN Access Server Meta information
-			if (line.startsWith("# OVPN_ACCESS_SERVER_")) {
-				Vector<String> metaarg = parsemeta(line);
-				meta.put(metaarg.get(0),metaarg);
-				continue;
-			}
-			Vector<String> args = parseline(line);	
+                // Check for OpenVPN Access Server Meta information
+                if (line.startsWith("# OVPN_ACCESS_SERVER_")) {
+                    Vector<String> metaarg = parsemeta(line);
+                    meta.put(metaarg.get(0), metaarg);
+                    continue;
+                }
+                Vector<String> args = parseline(line);
 
-			if(args.size() ==0)
-				continue;
+                if (args.size() == 0)
+                    continue;
 
 
-			if(args.get(0).startsWith("--"))
-				args.set(0, args.get(0).substring(2));
+                if (args.get(0).startsWith("--"))
+                    args.set(0, args.get(0).substring(2));
 
-			checkinlinefile(args,br);
+                checkinlinefile(args, br);
 
-			String optionname = args.get(0);
-			if(!options.containsKey(optionname)) {
-				options.put(optionname, new Vector<Vector<String>>());
-			}
-			options.get(optionname).add(args);
-		}
+                String optionname = args.get(0);
+                if (!options.containsKey(optionname)) {
+                    options.put(optionname, new Vector<Vector<String>>());
+                }
+                options.get(optionname).add(args);
+            }
+        } catch (java.lang.OutOfMemoryError memoryError) {
+            throw new ConfigParseError("File too large to parse: " + memoryError.getLocalizedMessage());
+        }
 	}
 
 	private Vector<String> parsemeta(String line) {
@@ -98,7 +103,7 @@ public class ConfigParser {
 					break;
 				else {
 					inlinefile+=line;
-					inlinefile+= "\n";					
+					inlinefile+= "\n";
 				}
 			} while(true);
 
@@ -132,7 +137,7 @@ public class ConfigParser {
 
 	// adapted openvpn's parse function to java
 	private Vector<String> parseline(String line) throws ConfigParseError {
-		Vector<String> parameters = new Vector<String>(); 
+		Vector<String> parameters = new Vector<String>();
 
 		if (line.length()==0)
 			return parameters;
@@ -145,12 +150,12 @@ public class ConfigParser {
 		int pos=0;
 		String currentarg="";
 
-		do { 
+		do {
 			// Emulate the c parsing ...
 			char in;
 			if(pos < line.length())
 				in = line.charAt(pos);
-			else 
+			else
 				in = '\0';
 
 			if (!backslash && in == '\\' && state != linestate.readin_single_quote)
@@ -228,10 +233,7 @@ public class ConfigParser {
 	}
 
 
-	final String[] unsupportedOptions = { "config", 
-			"connection", 
-			"proto-force", 
-			"remote-random",
+	final String[] unsupportedOptions = { "config",
 			"tls-server"
 
 	};
@@ -299,7 +301,7 @@ public class ConfigParser {
             "remote",
             "float",
             "port",
-//            "connect-retry",
+            "connect-retry",
             "connect-timeout",
             "connect-retry-max",
             "link-mtu",
@@ -325,7 +327,7 @@ public class ConfigParser {
 
     // This method is far too long
 	@SuppressWarnings("ConstantConditions")
-    public VpnProfile convertProfile() throws ConfigParseError{
+    public VpnProfile convertProfile() throws ConfigParseError, IOException {
 		boolean noauthtypeset=true;
 		VpnProfile np = new VpnProfile(CONVERTED_PROFILE);
 		// Pull, client, tls-client
@@ -338,7 +340,7 @@ public class ConfigParser {
 		}
 
 		Vector<String> secret = getOption("secret", 1, 2);
-		if(secret!=null) 
+		if(secret!=null)
 		{
 			np.mAuthenticationType=VpnProfile.TYPE_STATICKEYS;
 			noauthtypeset=false;
@@ -362,7 +364,7 @@ public class ConfigParser {
                 if (route.size() >= 4)
                     gateway = route.get(3);
 
-				String net = route.get(1);	
+				String net = route.get(1);
 				try {
 					CIDRIP cidr = new CIDRIP(net, netmask);
                     if (gateway.equals("net_gateway"))
@@ -398,7 +400,7 @@ public class ConfigParser {
 		Vector<Vector<String>> tlsauthoptions = getAllOption("tls-auth", 1, 2);
 		if(tlsauthoptions!=null) {
 			for(Vector<String> tlsauth:tlsauthoptions) {
-				if(tlsauth!=null) 
+				if(tlsauth!=null)
 				{
 					if(!tlsauth.get(1).equals("[inline]")) {
 						np.mTLSAuthFilename=tlsauth.get(1);
@@ -458,36 +460,6 @@ public class ConfigParser {
 				throw new ConfigParseError("Invalid mode for --mode specified, need p2p");
 		}
 
-		Vector<String> port = getOption("port", 1,1);
-		if(port!=null){
-			np.mServerPort = port.get(1);
-		}
-
-        Vector<String> rport = getOption("rport", 1,1);
-        if(rport!=null){
-            np.mServerPort = rport.get(1);
-        }
-
-        Vector<String> proto = getOption("proto", 1,1);
-		if(proto!=null){
-			np.mUseUdp=isUdpProto(proto.get(1));
-		}
-
-		// Parse remote config
-		Vector<Vector<String>> remotes = getAllOption("remote",1,3);
-
-		if(remotes!=null && remotes.size()>=1 ) {
-			Vector<String> remote = remotes.get(0);
-			switch (remote.size()) {
-			case 4:
-				np.mUseUdp=isUdpProto(remote.get(3));
-			case 3:
-				np.mServerPort = remote.get(2);
-			case 2:
-				np.mServerName = remote.get(1);
-			}
-		}
-
 
 
 		Vector<Vector<String>> dhcpoptions = getAllOption("dhcp-option", 2, 2);
@@ -581,18 +553,18 @@ public class ConfigParser {
 		if(verifyx509name!=null){
 			np.mRemoteCN = verifyx509name.get(1);
 			np.mCheckRemoteCN=true;
-			if(verifyx509name.size()>2) {  
+			if(verifyx509name.size()>2) {
 				if (verifyx509name.get(2).equals("name"))
 					np.mX509AuthType=VpnProfile.X509_VERIFY_TLSREMOTE_RDN;
 				else if (verifyx509name.get(2).equals("name-prefix"))
 					np.mX509AuthType=VpnProfile.X509_VERIFY_TLSREMOTE_RDN_PREFIX;
-				else 
+				else
 					throw new ConfigParseError("Unknown parameter to x509-verify-name: " + verifyx509name.get(2) );
 			} else {
 				np.mX509AuthType = VpnProfile.X509_VERIFY_TLSREMOTE_DN;
 			}
 
-		} 
+		}
 
 
 		Vector<String> verb = getOption("verb",1,1);
@@ -615,7 +587,7 @@ public class ConfigParser {
 		if(connectretrymax!=null)
 			np.mConnectRetryMax =connectretrymax.get(1);
 
-		Vector<Vector<String>> remotetls = getAllOption("remote-cert-tls", 1, 1);
+        Vector<Vector<String>> remotetls = getAllOption("remote-cert-tls", 1, 1);
 		if(remotetls!=null)
 			if(remotetls.get(0).get(1).equals("server"))
 				np.mExpectTLSCert=true;
@@ -632,14 +604,55 @@ public class ConfigParser {
 				np.mAuthenticationType=VpnProfile.TYPE_USERPASS_KEYSTORE;
 			}
 			if(authuser.size()>1) {
-				// Set option value to password get to get cance to embed later.
+				// Set option value to password get to embed later.
 				np.mUsername=null;
-				np.mPassword=authuser.get(1);
-				useEmbbedUserAuth(np,authuser.get(1));
+				useEmbbedUserAuth(np, authuser.get(1));
 			}
 		}
 
-		// Parse OpenVPN Access Server extra
+        Pair<Connection, Connection[]> conns = parseConnectionOptions(null);
+        np.mConnections =conns.second;
+
+        Vector<Vector<String>> connectionBlocks = getAllOption("connection", 1, 1);
+
+        if (np.mConnections.length > 0 && connectionBlocks !=null ) {
+            throw  new ConfigParseError("Using a <connection> block and --remote is not allowed.");
+        }
+
+        if (connectionBlocks!=null) {
+            np.mConnections = new Connection[connectionBlocks.size()];
+
+            int connIndex = 0;
+            for (Vector<String> conn : connectionBlocks) {
+                Pair<Connection, Connection[]> connectionBlockConnection =
+                        parseConnection(conn.get(1), conns.first);
+
+                if (connectionBlockConnection.second.length != 1)
+                    throw new ConfigParseError("A <connection> block must have exactly one remote");
+                np.mConnections[connIndex] = connectionBlockConnection.second[0];
+                connIndex++;
+            }
+        }
+        if(getOption("remote-random", 0, 0) != null)
+            np.mRemoteRandom=true;
+
+        Vector<String> protoforce = getOption("proto-force", 1, 1);
+        if(protoforce!=null) {
+            boolean disableUDP;
+            String protoToDisable = protoforce.get(1);
+            if (protoToDisable.equals("udp"))
+                disableUDP=true;
+            else if (protoToDisable.equals("tcp"))
+                disableUDP=false;
+            else
+                throw new ConfigParseError(String.format("Unknown protocol %s in proto-force", protoToDisable));
+
+            for (Connection conn:np.mConnections)
+                if(conn.mUseUdp==disableUDP)
+                    conn.mEnabled=false;
+        }
+
+        // Parse OpenVPN Access Server extra
 		Vector<String> friendlyname = meta.get("FRIENDLY_NAME");
 		if(friendlyname !=null && friendlyname.size() > 1)
 			np.mName=friendlyname.get(1);
@@ -649,20 +662,95 @@ public class ConfigParser {
 		if(ocusername !=null && ocusername.size() > 1)
 			np.mUsername=ocusername.get(1);
 
-		// Check the other options
-		if(remotes !=null && remotes.size()>1 && extraRemotesAsCustom) {
-			// first is already added
-			remotes.remove(0);
-			np.mCustomConfigOptions += getOptionStrings(remotes);
-			np.mUseCustomConfig=true;
-
-		}
-		checkIgnoreAndInvalidOptions(np);
+        checkIgnoreAndInvalidOptions(np);
 		fixup(np);
 
 		return np;
 	}
 
+    private Pair<Connection, Connection[]> parseConnection(String connection, Connection defaultValues) throws IOException, ConfigParseError {
+       // Parse a connection Block as a new configuration file
+
+
+        ConfigParser connectionParser = new ConfigParser();
+        StringReader reader = new StringReader(connection.substring(VpnProfile.INLINE_TAG.length()));
+        connectionParser.parseConfig(reader);
+
+        Pair<Connection, Connection[]> conn = connectionParser.parseConnectionOptions(defaultValues);
+
+        return conn;
+    }
+
+    private Pair<Connection, Connection[]> parseConnectionOptions(Connection connDefault) throws ConfigParseError {
+        Connection conn;
+        if (connDefault!=null)
+            try {
+                conn = connDefault.clone();
+            } catch (CloneNotSupportedException e) {
+                e.printStackTrace();
+                return null;
+            }
+        else
+            conn = new Connection();
+
+        Vector<String> port = getOption("port", 1,1);
+        if(port!=null){
+            conn.mServerPort = port.get(1);
+        }
+
+        Vector<String> rport = getOption("rport", 1,1);
+        if(rport!=null){
+            conn.mServerPort = rport.get(1);
+        }
+
+        Vector<String> proto = getOption("proto", 1,1);
+        if(proto!=null){
+            conn.mUseUdp=isUdpProto(proto.get(1));
+        }
+
+
+        // Parse remote config
+        Vector<Vector<String>> remotes = getAllOption("remote",1,3);
+
+
+        // Assume that we need custom options if connectionDefault are set
+        if(connDefault!=null) {
+            for (Vector<Vector<String>> option : options.values()) {
+
+                conn.mCustomConfiguration += getOptionStrings(option);
+
+            }
+            if (!TextUtils.isEmpty(conn.mCustomConfiguration))
+                conn.mUseCustomConfig = true;
+        }
+        // Make remotes empty to simplify code
+        if (remotes==null)
+            remotes = new Vector<Vector<String>>();
+
+        Connection[] connections = new Connection[remotes.size()];
+
+
+        int i=0;
+        for (Vector<String> remote: remotes) {
+            try {
+                connections[i] = conn.clone();
+            } catch (CloneNotSupportedException e) {
+                e.printStackTrace();
+            }
+            switch (remote.size()) {
+                case 4:
+                    connections[i].mUseUdp=isUdpProto(remote.get(3));
+                case 3:
+                    connections[i].mServerPort = remote.get(2);
+                case 2:
+                    connections[i].mServerName = remote.get(1);
+            }
+            i++;
+        }
+        return Pair.create(conn, connections);
+
+    }
+
     private void checkRedirectParameters(VpnProfile np, Vector<Vector<String>> defgw) {
         for (Vector<String> redirect: defgw)
             for (int i=1;i<redirect.size();i++){
@@ -673,25 +761,21 @@ public class ConfigParser {
             }
     }
 
-    public void useExtraRemotesAsCustom(boolean b) {
-		this.extraRemotesAsCustom = b;
-	}
-
 	private boolean isUdpProto(String proto) throws ConfigParseError {
 		boolean isudp;
 		if(proto.equals("udp") || proto.equals("udp6"))
 			isudp=true;
 		else if (proto.equals("tcp-client") ||
-				proto.equals("tcp")  || 
+				proto.equals("tcp")  ||
 				proto.equals("tcp6") ||
 				proto.endsWith("tcp6-client"))
 			isudp =false;
-		else 
+		else
 			throw new ConfigParseError("Unsupported option to --proto " + proto);
 		return isudp;
 	}
 
-	static public void useEmbbedUserAuth(VpnProfile np,String inlinedata)
+	static public void useEmbbedUserAuth(VpnProfile np, String inlinedata)
 	{
 		String data = VpnProfile.getEmbeddedContent(inlinedata);
 		String[] parts = data.split("\n");
diff --git a/app/src/main/java/de/blinkt/openvpn/core/Connection.java b/app/src/main/java/de/blinkt/openvpn/core/Connection.java
new file mode 100644
index 00000000..b10664ce
--- /dev/null
+++ b/app/src/main/java/de/blinkt/openvpn/core/Connection.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2012-2014 Arne Schwabe
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
+ */
+
+package de.blinkt.openvpn.core;
+
+import android.text.TextUtils;
+
+import java.io.Serializable;
+
+public class Connection implements Serializable, Cloneable {
+    public String mServerName = "openvpn.blinkt.de";
+    public String mServerPort = "1194";
+    public boolean mUseUdp = true;
+    public String mCustomConfiguration="";
+    public boolean mUseCustomConfig=false;
+    public boolean mEnabled=true;
+
+    private static final long serialVersionUID = 92031902903829089L;
+
+
+    public String getConnectionBlock() {
+        String cfg="";
+
+        // Server Address
+        cfg += "remote ";
+        cfg += mServerName;
+        cfg += " ";
+        cfg += mServerPort;
+        if (mUseUdp)
+            cfg += " udp\n";
+        else
+            cfg += " tcp-client\n";
+
+        if (!TextUtils.isEmpty(mCustomConfiguration) && mUseCustomConfig) {
+            cfg += mCustomConfiguration;
+            cfg += "\n";
+        }
+        return cfg;
+    }
+
+    @Override
+    public Connection clone() throws CloneNotSupportedException {
+        return (Connection) super.clone();
+    }
+
+    public boolean isOnlyRemote() {
+        return TextUtils.isEmpty(mCustomConfiguration) || !mUseCustomConfig;
+    }
+}
diff --git a/app/src/main/java/de/blinkt/openvpn/core/DeviceStateReceiver.java b/app/src/main/java/de/blinkt/openvpn/core/DeviceStateReceiver.java
index 0d75ae51..4ccf5472 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/DeviceStateReceiver.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/DeviceStateReceiver.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
@@ -182,18 +182,14 @@ public class DeviceStateReceiver extends BroadcastReceiver implements ByteCountL
                     screen = connectState.DISCONNECTED;
 
                 if (shouldBeConnected()) {
-                    if (sendusr1) {
-                        if (lastNetwork == -1) {
-                            mManagement.resume();
-                        } else {
-                            mManagement.reconnect();
-                        }
+                    if (lastNetwork == -1) {
+                        mManagement.resume();
                     } else {
                         mManagement.networkChange();
+
                     }
                 }
 
-
                 lastNetwork = newnet;
             }
         } else if (networkInfo == null) {
diff --git a/app/src/main/java/de/blinkt/openvpn/core/ICSOpenVPNApplication.java b/app/src/main/java/de/blinkt/openvpn/core/ICSOpenVPNApplication.java
index 83e760ca..56a574dc 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/ICSOpenVPNApplication.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/ICSOpenVPNApplication.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
diff --git a/app/src/main/java/de/blinkt/openvpn/core/LollipopDeviceStateListener.java b/app/src/main/java/de/blinkt/openvpn/core/LollipopDeviceStateListener.java
new file mode 100644
index 00000000..440458e4
--- /dev/null
+++ b/app/src/main/java/de/blinkt/openvpn/core/LollipopDeviceStateListener.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2012-2014 Arne Schwabe
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
+ */
+
+package de.blinkt.openvpn.core;
+
+import android.annotation.TargetApi;
+import android.net.ConnectivityManager;
+import android.net.LinkProperties;
+import android.net.Network;
+import android.net.NetworkCapabilities;
+import android.os.Build;
+
+/**
+ * Created by arne on 26.11.14.
+ */
+@TargetApi(Build.VERSION_CODES.LOLLIPOP)
+public class LollipopDeviceStateListener extends ConnectivityManager.NetworkCallback {
+
+    private String mLastConnectedStatus;
+    private String mLastLinkProperties;
+    private String mLastNetworkCapabilities;
+
+    @Override
+    public void onAvailable(Network network) {
+        super.onAvailable(network);
+
+        if (!network.toString().equals(mLastConnectedStatus)) {
+            mLastConnectedStatus = network.toString();
+            VpnStatus.logDebug("Connected to " + mLastConnectedStatus);
+        }
+    }
+
+    @Override
+    public void onLinkPropertiesChanged(Network network, LinkProperties linkProperties) {
+        super.onLinkPropertiesChanged(network, linkProperties);
+
+        if (!linkProperties.toString().equals(mLastLinkProperties)) {
+            mLastLinkProperties = linkProperties.toString();
+            VpnStatus.logDebug(String.format("Linkproperties of %s: %s", network, linkProperties));
+        }
+    }
+
+    @Override
+    public void onCapabilitiesChanged(Network network, NetworkCapabilities networkCapabilities) {
+        super.onCapabilitiesChanged(network, networkCapabilities);
+        if (!networkCapabilities.toString().equals(mLastNetworkCapabilities)) {
+            mLastNetworkCapabilities = networkCapabilities.toString();
+            VpnStatus.logDebug(String.format("Network capabilities of %s: %s", network, networkCapabilities));
+        }
+    }
+}
diff --git a/app/src/main/java/de/blinkt/openvpn/core/NativeUtils.java b/app/src/main/java/de/blinkt/openvpn/core/NativeUtils.java
index 6d7ffdf2..f67b7730 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/NativeUtils.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/NativeUtils.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
@@ -9,6 +9,7 @@ import java.security.InvalidKeyException;
 
 public class NativeUtils {
 	public static native byte[] rsasign(byte[] input,int pkey) throws InvalidKeyException;
+    public static native String[] getIfconfig() throws  IllegalArgumentException;
 	static native void jniclose(int fdint);
 
 	static {
diff --git a/app/src/main/java/de/blinkt/openvpn/core/NetworkSpace.java b/app/src/main/java/de/blinkt/openvpn/core/NetworkSpace.java
index 35f46513..26354689 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/NetworkSpace.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/NetworkSpace.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
@@ -21,6 +21,8 @@ import se.leap.bitmaskclient.BuildConfig;
 public class NetworkSpace {
 
 
+
+
     static class ipAddress implements Comparable<ipAddress> {
         private BigInteger netAddress;
         public int networkMask;
@@ -198,6 +200,13 @@ public class NetworkSpace {
         mIpAddresses.add(new ipAddress(cidrIp, include));
     }
 
+    public void addIPSplit(CIDRIP cidrIp, boolean include) {
+        ipAddress newIP = new ipAddress(cidrIp, include);
+        ipAddress[] splitIps = newIP.split();
+        for (ipAddress split: splitIps)
+            mIpAddresses.add(split);
+    }
+
     void addIPv6(Inet6Address address, int mask, boolean included) {
         mIpAddresses.add(new ipAddress(address, mask, included));
     }
diff --git a/app/src/main/java/de/blinkt/openvpn/core/OpenVPNManagement.java b/app/src/main/java/de/blinkt/openvpn/core/OpenVPNManagement.java
index e90c16d1..1f28c77d 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/OpenVPNManagement.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/OpenVPNManagement.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
diff --git a/app/src/main/java/de/blinkt/openvpn/core/OpenVPNService.java b/app/src/main/java/de/blinkt/openvpn/core/OpenVPNService.java
index d9830955..578d95e7 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/OpenVPNService.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/OpenVPNService.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
@@ -14,7 +14,9 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.SharedPreferences;
+import android.content.pm.PackageManager;
 import android.net.ConnectivityManager;
+import android.net.NetworkRequest;
 import android.net.VpnService;
 import android.os.Binder;
 import android.os.Build;
@@ -23,6 +25,7 @@ import android.os.IBinder;
 import android.os.Message;
 import android.os.ParcelFileDescriptor;
 import android.preference.PreferenceManager;
+import android.system.OsConstants;
 import android.text.TextUtils;
 import android.util.Log;
 
@@ -81,6 +84,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
     private String mLastTunCfg;
     private String mRemoteGW;
     private final Object mProcessLock = new Object();
+    private LollipopDeviceStateListener mLollipopDeviceStateListener;
 
     // From: http://stackoverflow.com/questions/3758606/how-to-convert-byte-size-into-human-readable-format-in-java
     public static String humanReadableByteCount(long bytes, boolean mbit) {
@@ -266,6 +270,9 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
         mDeviceStateReceiver = new DeviceStateReceiver(magnagement);
         registerReceiver(mDeviceStateReceiver, filter);
         VpnStatus.addByteCountListener(mDeviceStateReceiver);
+
+        /*if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP)
+            addLollipopCMListener(); */
     }
 
     synchronized void unregisterDeviceStateReceiver() {
@@ -280,6 +287,10 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
                 iae.printStackTrace();
             }
         mDeviceStateReceiver = null;
+
+        /*if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP)
+            removeLollipopCMListener();*/
+
     }
 
     public void userPause(boolean shouldBePaused) {
@@ -320,7 +331,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
             mProfile = ProfileManager.getLastConnectedProfile(this, false);
 
             /* Got no profile, just stop */
-            if (mProfile==null) {
+            if (mProfile == null) {
                 Log.d("OpenVPN", "Got no last connected profile on null intent. Stopping");
                 stopSelf(startId);
                 return START_NOT_STICKY;
@@ -431,7 +442,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
     private OpenVPNManagement instantiateOpenVPN3Core() {
         try {
             Class cl = Class.forName("de.blinkt.openvpn.core.OpenVPNThreadv3");
-            return (OpenVPNManagement) cl.getConstructor(OpenVPNService.class,VpnProfile.class).newInstance(this,mProfile);
+            return (OpenVPNManagement) cl.getConstructor(OpenVPNService.class, VpnProfile.class).newInstance(this, mProfile);
         } catch (IllegalArgumentException e) {
             e.printStackTrace();
         } catch (InstantiationException e) {
@@ -474,6 +485,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
         if (mLocalIPv6 != null)
             cfg += mLocalIPv6;
 
+
         cfg += "routes: " + TextUtils.join("|", mRoutes.getNetworks(true)) + TextUtils.join("|", mRoutesv6.getNetworks(true));
         cfg += "excl. routes:" + TextUtils.join("|", mRoutes.getNetworks(false)) + TextUtils.join("|", mRoutesv6.getNetworks(false));
         cfg += "dns: " + TextUtils.join("|", mDnslist);
@@ -490,6 +502,10 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
 
         VpnStatus.logInfo(R.string.last_openvpn_tun_config);
 
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP && mProfile.mAllowLocalLAN)
+        {
+            allowAllAFFamilies(builder);
+        }
 
         if (mLocalIP == null && mLocalIPv6 == null) {
             VpnStatus.logError(getString(R.string.opentun_no_ipaddr));
@@ -497,6 +513,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
         }
 
         if (mLocalIP != null) {
+            addLocalNetworksToRoutes();
             try {
                 builder.addAddress(mLocalIP.mIp, mLocalIP.len);
             } catch (IllegalArgumentException iae) {
@@ -527,7 +544,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
 
         String release = Build.VERSION.RELEASE;
         if ((Build.VERSION.SDK_INT == Build.VERSION_CODES.KITKAT && !release.startsWith("4.4.3")
-                &&  !release.startsWith("4.4.4") &&  !release.startsWith("4.4.5") && !release.startsWith("4.4.6"))
+                && !release.startsWith("4.4.4") && !release.startsWith("4.4.5") && !release.startsWith("4.4.6"))
                 && mMtu < 1280) {
             VpnStatus.logInfo(String.format(Locale.US, "Forcing MTU to 1280 instead of %d to workaround Android Bug #70916", mMtu));
             builder.setMtu(1280);
@@ -560,8 +577,12 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
         VpnStatus.logInfo(R.string.local_ip_info, mLocalIP.mIp, mLocalIP.len, mLocalIPv6, mMtu);
         VpnStatus.logInfo(R.string.dns_server_info, TextUtils.join(", ", mDnslist), mDomain);
         VpnStatus.logInfo(R.string.routes_info_incl, TextUtils.join(", ", mRoutes.getNetworks(true)), TextUtils.join(", ", mRoutesv6.getNetworks(true)));
-        VpnStatus.logInfo(R.string.routes_info_excl, TextUtils.join(", ", mRoutes.getNetworks(false)),TextUtils.join(", ", mRoutesv6.getNetworks(false)));
+        VpnStatus.logInfo(R.string.routes_info_excl, TextUtils.join(", ", mRoutes.getNetworks(false)), TextUtils.join(", ", mRoutesv6.getNetworks(false)));
         VpnStatus.logDebug(R.string.routes_debug, TextUtils.join(", ", positiveIPv4Routes), TextUtils.join(", ", positiveIPv6Routes));
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+            setAllowedVpnPackages(builder);
+        }
+
 
         String session = mProfile.mName;
         if (mLocalIP != null && mLocalIPv6 != null)
@@ -601,6 +622,82 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
 
     }
 
+    @TargetApi(Build.VERSION_CODES.LOLLIPOP)
+    private void allowAllAFFamilies(Builder builder) {
+        builder.allowFamily(OsConstants.AF_INET);
+        builder.allowFamily(OsConstants.AF_INET6);
+    }
+
+    @TargetApi(Build.VERSION_CODES.LOLLIPOP)
+    void removeLollipopCMListener() {
+        ConnectivityManager cm = (ConnectivityManager) getBaseContext().getSystemService(CONNECTIVITY_SERVICE);
+        cm.unregisterNetworkCallback(mLollipopDeviceStateListener);
+        mLollipopDeviceStateListener = null;
+    }
+
+    @TargetApi(Build.VERSION_CODES.LOLLIPOP)
+    void addLollipopCMListener() {
+        ConnectivityManager cm = (ConnectivityManager) getBaseContext().getSystemService(CONNECTIVITY_SERVICE);
+        NetworkRequest.Builder nrb = new NetworkRequest.Builder();
+
+        mLollipopDeviceStateListener = new LollipopDeviceStateListener();
+        cm.registerNetworkCallback(nrb.build(), mLollipopDeviceStateListener);
+    }
+
+    private void addLocalNetworksToRoutes() {
+
+        // Add local network interfaces
+        String[] localRoutes = NativeUtils.getIfconfig();
+
+        // The format of mLocalRoutes is kind of broken because I don't really like JNI
+        for (int i = 0; i < localRoutes.length; i += 3) {
+            String intf = localRoutes[i];
+            String ipAddr = localRoutes[i + 1];
+            String netMask = localRoutes[i + 2];
+
+            if (intf == null || intf.equals("lo") ||
+                    intf.startsWith("tun") || intf.startsWith("rmnet"))
+                continue;
+
+            if (ipAddr==null || netMask == null) {
+                VpnStatus.logError("Local routes are broken?! (Report to author) " + TextUtils.join("|", localRoutes));
+                continue;
+            }
+            
+            if (ipAddr.equals(mLocalIP.mIp))
+                continue;
+
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.KITKAT && !mProfile.mAllowLocalLAN) {
+                mRoutes.addIPSplit(new CIDRIP(ipAddr, netMask), true);
+
+            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT && mProfile.mAllowLocalLAN)
+                mRoutes.addIP(new CIDRIP(ipAddr, netMask), false);
+        }
+    }
+
+
+    @TargetApi(Build.VERSION_CODES.LOLLIPOP)
+    private void setAllowedVpnPackages(Builder builder) {
+        for (String pkg : mProfile.mAllowedAppsVpn) {
+            try {
+                if (mProfile.mAllowedAppsVpnAreDisallowed) {
+                    builder.addDisallowedApplication(pkg);
+                } else {
+                    builder.addAllowedApplication(pkg);
+                }
+            } catch (PackageManager.NameNotFoundException e) {
+                mProfile.mAllowedAppsVpn.remove(pkg);
+                VpnStatus.logInfo(R.string.app_no_longer_exists, pkg);
+            }
+        }
+
+        if (mProfile.mAllowedAppsVpnAreDisallowed) {
+            VpnStatus.logDebug(R.string.disallowed_vpn_apps_info, TextUtils.join(", ", mProfile.mAllowedAppsVpn));
+        } else {
+            VpnStatus.logDebug(R.string.allowed_vpn_apps_info, TextUtils.join(", ", mProfile.mAllowedAppsVpn));
+        }
+    }
+
     public void addDNS(String dns) {
         mDnslist.add(dns);
     }
@@ -611,28 +708,30 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
         }
     }
 
-    /** Route that is always included, used by the v3 core */
-    public void addRoute (CIDRIP route) {
+    /**
+     * Route that is always included, used by the v3 core
+     */
+    public void addRoute(CIDRIP route) {
         mRoutes.addIP(route, true);
     }
 
-    public void addRoute (String dest, String mask, String gateway, String device) {
+    public void addRoute(String dest, String mask, String gateway, String device) {
         CIDRIP route = new CIDRIP(dest, mask);
         boolean include = isAndroidTunDevice(device);
 
-        NetworkSpace.ipAddress gatewayIP = new NetworkSpace.ipAddress(new CIDRIP(gateway, 32),false);
+        NetworkSpace.ipAddress gatewayIP = new NetworkSpace.ipAddress(new CIDRIP(gateway, 32), false);
 
-        if (mLocalIP==null) {
+        if (mLocalIP == null) {
             VpnStatus.logError("Local IP address unset but adding route?! This is broken! Please contact author with log");
             return;
         }
-        NetworkSpace.ipAddress localNet = new NetworkSpace.ipAddress(mLocalIP,true);
+        NetworkSpace.ipAddress localNet = new NetworkSpace.ipAddress(mLocalIP, true);
         if (localNet.containsNet(gatewayIP))
-            include=true;
+            include = true;
 
-        if (gateway!= null &&
+        if (gateway != null &&
                 (gateway.equals("255.255.255.255") || gateway.equals(mRemoteGW)))
-            include=true;
+            include = true;
 
 
         if (route.len == 32 && !mask.equals("255.255.255.255")) {
@@ -664,7 +763,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
     }
 
     private boolean isAndroidTunDevice(String device) {
-        return device!=null &&
+        return device != null &&
                 (device.startsWith("tun") || "(null)".equals(device) || "vpnservice-tun".equals(device));
     }
 
@@ -679,7 +778,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
     public void setLocalIP(String local, String netmask, int mtu, String mode) {
         mLocalIP = new CIDRIP(local, netmask);
         mMtu = mtu;
-        mRemoteGW=null;
+        mRemoteGW = null;
 
         long netMaskAsInt = CIDRIP.getInt(netmask);
 
@@ -687,14 +786,17 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
             // get the netmask as IP
 
             int masklen;
-            if ("net30".equals(mode))
+            long mask;
+            if ("net30".equals(mode)) {
                 masklen = 30;
-            else
+                mask = 0xfffffffc;
+            } else {
                 masklen = 31;
+                mask = 0xfffffffe;
+            }
 
-            int mask = ~( 1 << (32 - (mLocalIP.len +1)));
             // Netmask is Ip address +/-1, assume net30/p2p with small net
-            if ((netMaskAsInt & mask) == (mLocalIP.getInt() & mask )) {
+            if ((netMaskAsInt & mask) == (mLocalIP.getInt() & mask)) {
                 mLocalIP.len = masklen;
             } else {
                 mLocalIP.len = 32;
@@ -702,13 +804,18 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
                     VpnStatus.logWarning(R.string.ip_not_cidr, local, netmask, mode);
             }
         }
-        if (("p2p".equals(mode)  && mLocalIP.len < 32) || ("net30".equals(mode) && mLocalIP.len < 30)) {
+        if (("p2p".equals(mode) && mLocalIP.len < 32) || ("net30".equals(mode) && mLocalIP.len < 30)) {
             VpnStatus.logWarning(R.string.ip_looks_like_subnet, local, netmask, mode);
         }
 
 
+        /* Workaround for Lollipop, it  does not route traffic to the VPNs own network mask */
+        if (mLocalIP.len <= 31 && Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP)
+            addRoute(mLocalIP);
+
+
         // Configurations are sometimes really broken...
-        mRemoteGW=netmask;
+        mRemoteGW = netmask;
     }
 
     public void setLocalIPv6(String ipv6addr) {
@@ -810,7 +917,7 @@ public class OpenVPNService extends VpnService implements StateListener, Callbac
         } else {
             String release = Build.VERSION.RELEASE;
             if (Build.VERSION.SDK_INT == Build.VERSION_CODES.KITKAT && !release.startsWith("4.4.3")
-                    &&  !release.startsWith("4.4.4") &&  !release.startsWith("4.4.5") && !release.startsWith("4.4.6"))
+                    && !release.startsWith("4.4.4") && !release.startsWith("4.4.5") && !release.startsWith("4.4.6"))
                 // There will be probably no 4.4.4 or 4.4.5 version, so don't waste effort to do parsing here
                 return "OPEN_AFTER_CLOSE";
             else
diff --git a/app/src/main/java/de/blinkt/openvpn/core/OpenVPNThread.java b/app/src/main/java/de/blinkt/openvpn/core/OpenVPNThread.java
index e36a5b8a..298a6c40 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/OpenVPNThread.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/OpenVPNThread.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
diff --git a/app/src/main/java/de/blinkt/openvpn/core/OpenVpnManagementThread.java b/app/src/main/java/de/blinkt/openvpn/core/OpenVpnManagementThread.java
index 37094a1b..1c3b3362 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/OpenVpnManagementThread.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/OpenVpnManagementThread.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
@@ -157,7 +157,7 @@ public class OpenVpnManagementThread implements Runnable, OpenVPNManagement {
 
             }
         } catch (IOException e) {
-            if (!e.getMessage().equals("socket closed"))
+            if (!e.getMessage().equals("socket closed") && !e.getMessage().equals("Connection reset by peer"))
                 VpnStatus.logException(e);
         }
         synchronized (active) {
diff --git a/app/src/main/java/de/blinkt/openvpn/core/PRNGFixes.java b/app/src/main/java/de/blinkt/openvpn/core/PRNGFixes.java
index bca0a4ab..a788426a 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/PRNGFixes.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/PRNGFixes.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;/*
diff --git a/app/src/main/java/de/blinkt/openvpn/core/ProfileManager.java b/app/src/main/java/de/blinkt/openvpn/core/ProfileManager.java
index 2a26152e..1ebc0a57 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/ProfileManager.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/ProfileManager.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
diff --git a/app/src/main/java/de/blinkt/openvpn/core/ProxyDetection.java b/app/src/main/java/de/blinkt/openvpn/core/ProxyDetection.java
index cf953863..6e2abb13 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/ProxyDetection.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/ProxyDetection.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
diff --git a/app/src/main/java/de/blinkt/openvpn/core/VPNLaunchHelper.java b/app/src/main/java/de/blinkt/openvpn/core/VPNLaunchHelper.java
index 208aa359..73ed05bc 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/VPNLaunchHelper.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/VPNLaunchHelper.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
@@ -76,7 +76,6 @@ public class VPNLaunchHelper {
         args.add("--config");
         args.add(c.getCacheDir().getAbsolutePath() + "/" + OVPNCONFIGFILE);
 
-
         return args.toArray(new String[args.size()]);
     }
 
diff --git a/app/src/main/java/de/blinkt/openvpn/core/VpnStatus.java b/app/src/main/java/de/blinkt/openvpn/core/VpnStatus.java
index 25558f13..ffc8097d 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/VpnStatus.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/VpnStatus.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
@@ -480,7 +480,11 @@ public class VpnStatus {
 		newLogItem(new LogItem(LogLevel.INFO, message));
 	}
 
-	public static void logInfo(int resourceId, Object... args) {
+    public static void logDebug(String message) {
+        newLogItem(new LogItem(LogLevel.DEBUG, message));
+    }
+
+    public static void logInfo(int resourceId, Object... args) {
 		newLogItem(new LogItem(LogLevel.INFO, resourceId, args));
 	}
 
diff --git a/app/src/main/java/de/blinkt/openvpn/core/X509Utils.java b/app/src/main/java/de/blinkt/openvpn/core/X509Utils.java
index ff383e0f..0786967b 100644
--- a/app/src/main/java/de/blinkt/openvpn/core/X509Utils.java
+++ b/app/src/main/java/de/blinkt/openvpn/core/X509Utils.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.core;
diff --git a/app/src/main/java/de/blinkt/openvpn/fragments/LogFragment.java b/app/src/main/java/de/blinkt/openvpn/fragments/LogFragment.java
index 77fc21e6..199caa63 100644
--- a/app/src/main/java/de/blinkt/openvpn/fragments/LogFragment.java
+++ b/app/src/main/java/de/blinkt/openvpn/fragments/LogFragment.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.fragments;
diff --git a/app/src/main/java/de/blinkt/openvpn/views/SeekBarTicks.java b/app/src/main/java/de/blinkt/openvpn/views/SeekBarTicks.java
index e25c2859..82378b00 100644
--- a/app/src/main/java/de/blinkt/openvpn/views/SeekBarTicks.java
+++ b/app/src/main/java/de/blinkt/openvpn/views/SeekBarTicks.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2014 Arne Schwabe
- * Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+ * Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
  */
 
 package de.blinkt.openvpn.views;
diff --git a/app/src/main/res/drawable-hdpi/ic_delete_grey600_24dp.png b/app/src/main/res/drawable-hdpi/ic_delete_grey600_24dp.png
new file mode 100644
index 00000000..b72a9f3c
--- /dev/null
+++ b/app/src/main/res/drawable-hdpi/ic_delete_grey600_24dp.png
diff --git a/app/src/main/res/drawable-mdpi/ic_delete_grey600_24dp.png b/app/src/main/res/drawable-mdpi/ic_delete_grey600_24dp.png
new file mode 100644
index 00000000..e757fdb0
--- /dev/null
+++ b/app/src/main/res/drawable-mdpi/ic_delete_grey600_24dp.png
diff --git a/app/src/main/res/drawable-xhdpi/ic_delete_grey600_24dp.png b/app/src/main/res/drawable-xhdpi/ic_delete_grey600_24dp.png
new file mode 100644
index 00000000..c6bb43e8
--- /dev/null
+++ b/app/src/main/res/drawable-xhdpi/ic_delete_grey600_24dp.png
diff --git a/app/src/main/res/drawable-xxhdpi/ic_delete_grey600_24dp.png b/app/src/main/res/drawable-xxhdpi/ic_delete_grey600_24dp.png
new file mode 100644
index 00000000..4886ab1e
--- /dev/null
+++ b/app/src/main/res/drawable-xxhdpi/ic_delete_grey600_24dp.png
diff --git a/app/src/main/res/drawable-xxxhdpi/ic_delete_grey600_24dp.png b/app/src/main/res/drawable-xxxhdpi/ic_delete_grey600_24dp.png
new file mode 100644
index 00000000..e4e21812
--- /dev/null
+++ b/app/src/main/res/drawable-xxxhdpi/ic_delete_grey600_24dp.png
diff --git a/app/src/main/res/drawable/white_rect.xml b/app/src/main/res/drawable/white_rect.xml
new file mode 100644
index 00000000..5ead4b9b
--- /dev/null
+++ b/app/src/main/res/drawable/white_rect.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (c) 2012-2014 Arne Schwabe
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
+  -->
+
+<shape xmlns:android="http://schemas.android.com/apk/res/android">
+    <solid android:color="@android:color/background_light" />
+
+</shape>
\ No newline at end of file
diff --git a/app/src/main/res/layout-sw600dp-port/log_fragment.xml b/app/src/main/res/layout-sw600dp-port/log_fragment.xml
index 2f5c774d..1fb9fa54 100644
--- a/app/src/main/res/layout-sw600dp-port/log_fragment.xml
+++ b/app/src/main/res/layout-sw600dp-port/log_fragment.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
@@ -12,6 +12,8 @@
               tools:context=".LogWindow">
 
     <LinearLayout
+        android:background="@drawable/white_rect"
+        android:elevation="1dp"
             android:layout_height="wrap_content"
             android:layout_width="match_parent">
 
@@ -33,10 +35,6 @@
                 android:layout_weight="1"/>
     </LinearLayout>
 
-    <Space
-            android:layout_height="wrap_content"
-            android:layout_width="wrap_content"
-            android:minHeight="5dp"/>
 
     <ListView
             android:id="@android:id/list"
diff --git a/app/src/main/res/layout-sw600dp/log_fragment.xml b/app/src/main/res/layout-sw600dp/log_fragment.xml
index b8997982..0bd3f991 100644
--- a/app/src/main/res/layout-sw600dp/log_fragment.xml
+++ b/app/src/main/res/layout-sw600dp/log_fragment.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
@@ -14,6 +14,8 @@
 
 
     <LinearLayout
+        android:background="@drawable/white_rect"
+        android:elevation="1dp"
             android:minWidth="300dp"
             android:orientation="vertical"
             android:layout_width="wrap_content"
@@ -24,11 +26,6 @@
         <include layout="@layout/vpnstatus"/>
     </LinearLayout>
 
-    <Space
-            android:layout_height="wrap_content"
-            android:layout_width="wrap_content"
-            android:minWidth="5dp"/>
-
     <ListView
             android:id="@android:id/list"
             android:transcriptMode="normal"
diff --git a/app/src/main/res/layout/log_fragment.xml b/app/src/main/res/layout/log_fragment.xml
index 2cc4759e..4fec942e 100644
--- a/app/src/main/res/layout/log_fragment.xml
+++ b/app/src/main/res/layout/log_fragment.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
@@ -11,19 +11,21 @@
               android:orientation="vertical">
 
     <LinearLayout
+        android:background="@drawable/white_rect"
+        android:elevation="1dp"
             android:layout_height="wrap_content"
             android:layout_width="match_parent">
 
         <include layout="@layout/log_silders"/>
-    </LinearLayout>
 
-    <TextView
+        <TextView
             android:text="@string/speed_waiting"
             android:singleLine="true"
             android:id="@+id/speed"
             tools:ignore="InconsistentLayout"
             android:layout_width="match_parent"
             android:layout_height="wrap_content"/>
+    </LinearLayout>
 
     <ListView
             android:id="@android:id/list"
diff --git a/app/src/main/res/layout/log_silders.xml b/app/src/main/res/layout/log_silders.xml
index 3fcbd85a..152407f9 100644
--- a/app/src/main/res/layout/log_silders.xml
+++ b/app/src/main/res/layout/log_silders.xml
@@ -3,7 +3,7 @@
 
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <LinearLayout
diff --git a/app/src/main/res/layout/log_window.xml b/app/src/main/res/layout/log_window.xml
index d7576ca3..fcc7aa7a 100644
--- a/app/src/main/res/layout/log_window.xml
+++ b/app/src/main/res/layout/log_window.xml
@@ -1,6 +1,6 @@
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <FrameLayout xmlns:android="http://schemas.android.com/apk/res/android"
diff --git a/app/src/main/res/layout/vpnstatus.xml b/app/src/main/res/layout/vpnstatus.xml
index 2fd65b4c..2d77bbab 100644
--- a/app/src/main/res/layout/vpnstatus.xml
+++ b/app/src/main/res/layout/vpnstatus.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <merge xmlns:tools="http://schemas.android.com/tools"
diff --git a/app/src/main/res/menu/logmenu.xml b/app/src/main/res/menu/logmenu.xml
index 52ba4b7d..2df53141 100644
--- a/app/src/main/res/menu/logmenu.xml
+++ b/app/src/main/res/menu/logmenu.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <menu xmlns:android="http://schemas.android.com/apk/res/android">
diff --git a/app/src/main/res/values-ca/strings-icsopenvpn.xml b/app/src/main/res/values-ca/strings-icsopenvpn.xml
index b18766ca..ce7b8919 100755
--- a/app/src/main/res/values-ca/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-ca/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-cs/strings-icsopenvpn.xml b/app/src/main/res/values-cs/strings-icsopenvpn.xml
index 6ae5a3f0..87a6bed1 100755
--- a/app/src/main/res/values-cs/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-cs/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
@@ -328,4 +329,23 @@
   <string name="mssfix_value_dialog">Oznámit TCP sezením běžícím skrze tunel, že mají limitovat velikost odesílaných paketů tak, aby poté, co je OpenVPN zabalí, byla výsledná velikost UDP paketu, které OpenVPN posílá menší než tento počet bytů. (výchozí je 1450)</string>
   <string name="mssfix_checkbox">Přepsat hodnotu MSS pro TCP obsah</string>
   <string name="mssfix_dialogtitle">Nastavit MSS pro TCP obsah</string>
+  <string name="client_behaviour">Chování klienta</string>
+  <string name="clear_external_apps">Zrušit povolené externí aplikace</string>
+  <string name="loading">Načítání&#8230;</string>
+  <string name="allowed_vpn_apps_info">Povolené VPN aplikace: %1$s</string>
+  <string name="disallowed_vpn_apps_info">Zakázané VPN aplikace: %1$s</string>
+  <string name="app_no_longer_exists">Balíček %s již není nainstalován, odstraňuji ho ze seznamu povolených/zakázaných aplikací</string>
+  <string name="vpn_disallow_radio">VPN je používaná pro všechny aplikace, kromě</string>
+  <string name="vpn_allow_radio">VPN je používaná je pro vybrané aplikace</string>
+  <string name="query_delete_remote">Odstranit položku vzdáleného serveru?</string>
+  <string name="keep">Zachovat</string>
+  <string name="delete">Smazat</string>
+  <string name="add_remote">Přidat nové vzdálené místo</string>
+  <string name="remote_random">Použít položky k připojení v náhodném pořadí</string>
+  <string name="remote_no_server_selected">Je potřeba definovat a povolit alespoň jeden vzdálený server.</string>
+  <string name="server_list">Seznam serverů</string>
+  <string name="vpn_allowed_apps">Povolené aplikace</string>
+  <string name="advanced_settings">Pokročilé nastavení</string>
+  <string name="payload_options">Možnosti dat</string>
+  <string name="tls_settings">Nastevení TLS</string>
 </resources>
diff --git a/app/src/main/res/values-de/strings-icsopenvpn.xml b/app/src/main/res/values-de/strings-icsopenvpn.xml
index cebb9646..ba667502 100755
--- a/app/src/main/res/values-de/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-de/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
@@ -328,4 +329,26 @@
   <string name="mssfix_value_dialog">Ändere TCP-Verbindungen, die über den Tunnel laufen, so dass die resultierende UDP-Paketgröße nach der Enkapsulierung durch OpenVPN auf diesen Wert beschränkt bleibt. (Standardwert ist 1450)</string>
   <string name="mssfix_checkbox">Überschreiben des MSS-Wert von TCP-Nutzlast</string>
   <string name="mssfix_dialogtitle">Setze MSS von TCP-Nutzlast</string>
+  <string name="client_behaviour">Client-Verhalten</string>
+  <string name="clear_external_apps">Widerrufe Berechtigungen OpenVPN zu steuern</string>
+  <string name="loading">Wird geladen&#8230;</string>
+  <string name="allowed_vpn_apps_info">Apps erlaubt für das VPN: %1$s</string>
+  <string name="disallowed_vpn_apps_info">Apps, die nicht das VPN nutzen: %1$s</string>
+  <string name="app_no_longer_exists">Anwendung mit Paketnamen \'%s\' ist nicht mehr installiert, wird von der Liste der erlaubten/nicht erlaubten VPN Anwendungen gelöscht.</string>
+  <string name="vpn_disallow_radio">VPN für alle Anwendung ausgenommen den ausgewählten</string>
+  <string name="vpn_allow_radio">VPN nur für die ausgewählten Anwendungen</string>
+  <string name="query_delete_remote">Servereintrag entfernen?</string>
+  <string name="keep">Behalten</string>
+  <string name="delete">Entfernen</string>
+  <string name="add_remote">Neuen Server hinzufügen</string>
+  <string name="remote_random">Beim Verbinden Servereinträge in zufälliger Reihenfolge verwenden</string>
+  <string name="remote_no_server_selected">Sie müssen mindestens einen Server definieren und aktivieren.</string>
+  <string name="server_list">Serverliste</string>
+  <string name="vpn_allowed_apps">Erlaubte Anwendungen</string>
+  <string name="advanced_settings">Erweiterte Einstellungen</string>
+  <string name="payload_options">Nutzlast-Optionen</string>
+  <string name="tls_settings">TLS-Einstellungen</string>
+  <string name="no_remote_defined">Keine Server definiert</string>
+  <string name="duplicate_vpn">VPN Profil duplizieren</string>
+  <string name="duplicate_profile_title">VPN Profil duplizieren: %s</string>
 </resources>
diff --git a/app/src/main/res/values-es/strings-icsopenvpn.xml b/app/src/main/res/values-es/strings-icsopenvpn.xml
index 92995c6f..4cbb152d 100755
--- a/app/src/main/res/values-es/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-es/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
@@ -147,7 +148,7 @@
   <string name="import_warning_custom_options">Su configuración tiene algunas opciones de configuración que no están establecidas en la interfaz de usuario . Estas opciones fueron agregadas como opciones de configuración personalizadas. A continuación se muestra la configuración personalizada:</string>
   <string name="import_done">Se termino de leer el archivo de configuración.</string>
   <string name="nobind_summary">No enlazar con el puerto y la dirección local</string>
-  <string name="no_bind">Ningún enlace local</string>
+  <string name="no_bind">No enlazar localmente</string>
   <string name="import_configuration_file">Importar archivo de configuracion</string>
   <string name="faq_security_title">Consideraciones de seguridad</string>
   <string name="faq_security">"Como OpenVPN es sensible a la seguridad, son razonables algunas notas acerca de seguridad. Todos los datos en la tarjeta SD son inherentemente inseguros. Cualquier aplicación puede leerla (por ejemplo, esta aplicación no requiere ningún permiso especial sobre la tarjeta SD). Los datos de esta aplicación sólo pueden ser leidos por la misma aplicación. Al utilizar la opción importar para el certificado de la CA/certificado/llave, en la ventana de diálogo para selección de archivos, los datos se almacenan en el perfil de la VPN. Los perfiles de VPN sólo son accesibles por esta aplicación. (No olvide después borrar las copias de la tarjeta SD). Aunque sólo sea accesible por esta aplicación, los datos aún están sin encriptar. Al acceder el dispositivo portátil como root u otro medio, es posible recuperar estos datos. Las contraseñas guardadas son almacenadas también en texto plano. Para archivos pkcs12 es muy recomendable que los importe al repositorio de llaves de Android."</string>
@@ -173,7 +174,8 @@
   <string name="generated_config_summary">Muestra el archivo de configuración OpenVPN generado</string>
   <string name="edit_profile_title">Editando \"%s\"</string>
   <string name="building_configration">Construyendo configuracion&#8230;</string>
-  <string name="netchange_summary">Turning this option on will force a reconnect if the network state is changed (e.g. WiFi to/from mobile)</string>
+  <string name="netchange_summary">Activando esta opción forzara una reconexión si el estado de la red es cambiado (Ej. De/hacia WIFi
+hacia/de Móvil)</string>
   <string name="netchange">Reconectar en cambio de red</string>
   <string name="netstatus">Estado de la red: %s</string>
   <string name="extracahint">El certificado de la CA usualmente es recuperado del almacén de claves de Android. Especifique un certificado diferente si obtiene errores de verificación de certificado.</string>
@@ -185,7 +187,7 @@
   <string name="error_rsa_sign">Error al firmar con la llave del almacén de llaves de Android %1$s: %2$s</string>
   <string name="faq_system_dialogs">El aviso de conectividad VPN que esta aplicación puede interceptar todo el trafico esta impuesta por el sistema para evitar abusos de la API VPNService.\nLa notificación de conectividad (El símbolo de llave) también esta impuesta por el sistema Android para notificar una conexión VPN en curso. En algunas imágenes, esta notificación también emite un sonido.\nAndroid ha introducido estos diálogos de sistema para su seguridad e se ha asegurado que no pueden ser evitados. (En algunas imágenes, esto incluye la notificación sonora)</string>
   <string name="faq_system_dialogs_title">Advertencia de conexión y sonido de notificación</string>
-  <string name="translationby">Traducción al español por José Luis Bandala Perez&lt;luis.449bp@gmail.com&gt;</string>
+  <string name="translationby">Traducción al español por José Luis Bandala Pérez&lt;luis.449bp@gmail.com&gt;</string>
   <string name="ipdns">IP y DNS</string>
   <string name="basic">Básico</string>
   <string name="routing">Enrutamiento</string>
@@ -274,7 +276,7 @@
   <string name="rdn">RDN (nombre comun)</string>
   <string name="rdn_prefix">Prefijo RDN</string>
   <string name="tls_remote_deprecated">tls-remote (OBSOLETO)</string>
-  <string name="help_translate">Tu puedes ayudar traduciendo visitando http://crowdin.net/project/ics-openvpn/invite</string>
+  <string name="help_translate">Tu puedes ayudar a traducir visitando http://crowdin.net/project/ics-openvpn/invite</string>
   <string name="prompt">%1$s intentos de controlar %2$s</string>
   <string name="remote_warning">Al proceder, le estás proporcionando permiso a la aplicación para controlar completamente OpenVPN for Android e interceptar todo el tráfico de la red.<b>NO aceptar a menos que confíes en la aplicación.</b> De otro modo, corres el riesgo de que tus datos se vean comprometidos por software malicioso.\"</string>
   <string name="remote_trust">Confío en esta aplicación.</string>
@@ -317,7 +319,7 @@
   <string name="faq_system_dialog_xposed">Si ha rooteado su dispositivo Android, puede instalar el &lt;a href=\"http://xposed.info/\"&gt;framework Xposed&lt;/a&gt; y añadir el &lt;a href=\"http://repo.xposed.info/module/de.blinkt.vpndialogxposed\"&gt;módulo de confirmación de Diálogo VPN&lt;/a&gt; bajo su propio riesgo\"</string>
   <string name="full_licenses">Licencias completas</string>
   <string name="blocklocal_summary">Las redes conectadas directamente a los interfaces locales no serán enrutadas a través de la VPN. Al desmarcar esta opción, todo el tráfico previsto para las redes locales será redirigido a la VPN.</string>
-  <string name="blocklocal_title">Evitar la VPN para las redes locales</string>
+  <string name="blocklocal_title">Saltarse la VPN en redes locales</string>
   <string name="userpw_file">Archivo de Usuario/Contraseña</string>
   <string name="imported_from_file">[Importado de:%s]</string>
   <string name="files_missing_hint">Algunos archivos no se pudo encontrar. Por favor, seleccione los archivos que desea importar el perfil:</string>
@@ -325,6 +327,29 @@
   <string name="import_log">Importar registros:</string>
   <string name="ip_looks_like_subnet">Topología de VPN \"%3$s\" especificado pero ifconfig %1$s %2$s se parece más a una dirección IP con una máscara de red. Asumiendo una topología de \"subred\".</string>
   <string name="mssfix_invalid_value">El valor de mssfix debe ser un número entero entre 0 y 9000</string>
+  <string name="mssfix_value_dialog">Anunciar a las sesiones TCP ejecutandose sobre el túnel que deben limitar su tamaño de paquetes enviados de tal manera que después de que OpenVPN los hay encapsulado, el tamaño del paquete UDP resultante enviado a su par no exceda este numero de bytes. (Por defecto es 1450)</string>
   <string name="mssfix_checkbox">Reemplazar el valor MSS de la carga TCP</string>
   <string name="mssfix_dialogtitle">Establecer MSS de la carga TCP</string>
+  <string name="client_behaviour">Comportamiento del cliente</string>
+  <string name="clear_external_apps">Borrar aplicaciones externas permitidas</string>
+  <string name="loading">Cargando&#8230;</string>
+  <string name="allowed_vpn_apps_info">Aplicaciones VPN permitidas: %1$s</string>
+  <string name="disallowed_vpn_apps_info">Aplicaciones VPN no permitidas: %1$s</string>
+  <string name="app_no_longer_exists">El paquete %s ya no está instalado, sacándolo de la lista de apps permitidas/no permitidas</string>
+  <string name="vpn_disallow_radio">La VPN es usada por todas las aplicaciones, excepto por las seleccionadas</string>
+  <string name="vpn_allow_radio">La VPN es utilizada únicamente por las aplicaciones seleccionadas</string>
+  <string name="query_delete_remote">¿Eliminar entrada del servidor remoto?</string>
+  <string name="keep">Mantener</string>
+  <string name="delete">Eliminar</string>
+  <string name="add_remote">Añadir nuevo acceso remoto</string>
+  <string name="remote_random">Utiliza las entradas de conexión en orden aleatorio en la conexión</string>
+  <string name="remote_no_server_selected">Es necesario definir y habilitar al menos un servidor remoto.</string>
+  <string name="server_list">Lista de servidores</string>
+  <string name="vpn_allowed_apps">Aplicaciones permitidas</string>
+  <string name="advanced_settings">Opciones Avanzadas</string>
+  <string name="payload_options">Opciones de carga útil</string>
+  <string name="tls_settings">Configuración TLS</string>
+  <string name="no_remote_defined">Servidor remoto no definido</string>
+  <string name="duplicate_vpn">Duplicar perfil VPN</string>
+  <string name="duplicate_profile_title">Duplicando Perfil: %s</string>
 </resources>
diff --git a/app/src/main/res/values-et/strings-icsopenvpn.xml b/app/src/main/res/values-et/strings-icsopenvpn.xml
index 7761726e..c5174284 100755
--- a/app/src/main/res/values-et/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-et/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
@@ -328,4 +329,26 @@
   <string name="mssfix_value_dialog">Informeeri tunneldatud TCP sessioone et nad piiraksid saadetavate pakettide suuruse nii, et peale OpenVPN kapseldatud paketi partnerile saatmist ei oleks saadud UDP pakett suurem kui ette antud baitide arv. (vaikeväärtus on 1450)</string>
   <string name="mssfix_checkbox">Ignoreeri TCP lasti MSS väärtust</string>
   <string name="mssfix_dialogtitle">Sea TCP lasti MSS väärtus</string>
+  <string name="client_behaviour">Kliendi toimimine</string>
+  <string name="clear_external_apps">Nulli lubatud välised programmid</string>
+  <string name="loading">Laadimine&#8230;</string>
+  <string name="allowed_vpn_apps_info">Lubatud VPN programmid: %1$s</string>
+  <string name="disallowed_vpn_apps_info">Keelatud VPN programmid: %1$s</string>
+  <string name="app_no_longer_exists">Programm %s on seadmest eemaldatud, see kustutatakse ka lubatud/keelatud programmide nimistust</string>
+  <string name="vpn_disallow_radio">VPN on kõigi, välja arvatud märgitud, programmide puhul kasutuses</string>
+  <string name="vpn_allow_radio">VPN on kasutuses ainult märgitud programmide puhul</string>
+  <string name="query_delete_remote">Kas eemaldada kaugserveri kirje?</string>
+  <string name="keep">Säilita</string>
+  <string name="delete">Eemalda</string>
+  <string name="add_remote">Uue kaugserveri lisamine</string>
+  <string name="remote_random">Ühendumisel kasuta ühenduskirjeid juhuslikus järjekorras</string>
+  <string name="remote_no_server_selected">Peate määrama vähemalt ühe kaugserveri.</string>
+  <string name="server_list">Serverite Nimistu</string>
+  <string name="vpn_allowed_apps">Lubatud Programmid</string>
+  <string name="advanced_settings">Täpsemad seaded</string>
+  <string name="payload_options">Nimikoormuse valikud</string>
+  <string name="tls_settings">TLS Seaded</string>
+  <string name="no_remote_defined">Kaugserverid määramata</string>
+  <string name="duplicate_vpn">Dubleeritud VPN profiil</string>
+  <string name="duplicate_profile_title">Duplitseeritakse profiili: %s</string>
 </resources>
diff --git a/app/src/main/res/values-fr/strings-icsopenvpn.xml b/app/src/main/res/values-fr/strings-icsopenvpn.xml
index 15bc7aa4..657646c8 100755
--- a/app/src/main/res/values-fr/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-fr/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-hu/strings-icsopenvpn.xml b/app/src/main/res/values-hu/strings-icsopenvpn.xml
index 504ab893..2efdcf5f 100755
--- a/app/src/main/res/values-hu/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-hu/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-in/strings-icsopenvpn.xml b/app/src/main/res/values-in/strings-icsopenvpn.xml
index c111cbb5..3dac7c71 100755
--- a/app/src/main/res/values-in/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-in/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-it/strings-icsopenvpn.xml b/app/src/main/res/values-it/strings-icsopenvpn.xml
index 29d48904..36198678 100755
--- a/app/src/main/res/values-it/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-it/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
@@ -325,4 +326,16 @@ Effettuata la lettura del file di configurazione</string>
   <string name="files_missing_hint">Alcuni file non possono essere trovati. Si prega di selezionare i file da importare nel profilo:</string>
   <string name="openvpn_is_no_free_vpn">Per utilizzare questa applicazione è necessario un provider VPN/gateway VPN che supportino OpenVPN (spesso forniti dal datore di lavoro). Vai a http://community.openvpn.net/ per ulteriori informazioni su OpenVPN e come configurare il proprio server OpenVPN.</string>
   <string name="import_log">Registro importazione:</string>
+  <string name="mssfix_checkbox">Sovrascrivi il valore del MSS nel payload TCP</string>
+  <string name="mssfix_dialogtitle">Setta il valore del MSS nel payload TCP</string>
+  <string name="client_behaviour">Comportamento Client</string>
+  <string name="loading">Caricando&#8230;</string>
+  <string name="keep">Mantieni</string>
+  <string name="delete">Elimina</string>
+  <string name="server_list">Lista Server</string>
+  <string name="advanced_settings">Impostazioni Avanzate</string>
+  <string name="payload_options">Opzioni Payload</string>
+  <string name="tls_settings">Impostazioni TLS</string>
+  <string name="duplicate_vpn">Profilo VPN duplicato</string>
+  <string name="duplicate_profile_title">Duplicazione del profilo: %s</string>
 </resources>
diff --git a/app/src/main/res/values-ja/strings-icsopenvpn.xml b/app/src/main/res/values-ja/strings-icsopenvpn.xml
index 79474f2d..792e6200 100755
--- a/app/src/main/res/values-ja/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-ja/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-ko/strings-icsopenvpn.xml b/app/src/main/res/values-ko/strings-icsopenvpn.xml
index b05e4f51..9266a36c 100755
--- a/app/src/main/res/values-ko/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-ko/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-nl/strings-icsopenvpn.xml b/app/src/main/res/values-nl/strings-icsopenvpn.xml
index 2a000195..b486706e 100755
--- a/app/src/main/res/values-nl/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-nl/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-no/strings-icsopenvpn.xml b/app/src/main/res/values-no/strings-icsopenvpn.xml
index 66391eb5..501b18df 100755
--- a/app/src/main/res/values-no/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-no/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-pl/strings-icsopenvpn.xml b/app/src/main/res/values-pl/strings-icsopenvpn.xml
index 495eb00e..052b0135 100755
--- a/app/src/main/res/values-pl/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-pl/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-pt/strings-icsopenvpn.xml b/app/src/main/res/values-pt/strings-icsopenvpn.xml
index d0058c68..ec7d2534 100755
--- a/app/src/main/res/values-pt/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-pt/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-ro/strings-icsopenvpn.xml b/app/src/main/res/values-ro/strings-icsopenvpn.xml
index ef4e3a75..3821f964 100755
--- a/app/src/main/res/values-ro/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-ro/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-ru/strings-icsopenvpn.xml b/app/src/main/res/values-ru/strings-icsopenvpn.xml
index e2bc930c..5db415df 100755
--- a/app/src/main/res/values-ru/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-ru/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-sv/strings-icsopenvpn.xml b/app/src/main/res/values-sv/strings-icsopenvpn.xml
index 9b974522..151742a5 100755
--- a/app/src/main/res/values-sv/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-sv/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-sw600dp/dimens.xml b/app/src/main/res/values-sw600dp/dimens.xml
index b83bb856..94a120d1 100644
--- a/app/src/main/res/values-sw600dp/dimens.xml
+++ b/app/src/main/res/values-sw600dp/dimens.xml
@@ -1,4 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (c) 2012-2014 Arne Schwabe
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
+  -->
+
 <resources>
     <bool name="logSildersAlwaysVisible">true</bool>
 
diff --git a/app/src/main/res/values-sw600dp/styles.xml b/app/src/main/res/values-sw600dp/styles.xml
index de0bb55d..c320388d 100644
--- a/app/src/main/res/values-sw600dp/styles.xml
+++ b/app/src/main/res/values-sw600dp/styles.xml
@@ -1,4 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (c) 2012-2014 Arne Schwabe
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
+  -->
+
 <resources>
 
     <dimen name="stdpadding">16dp</dimen>
diff --git a/app/src/main/res/values-tr/strings-icsopenvpn.xml b/app/src/main/res/values-tr/strings-icsopenvpn.xml
index 90ad068d..ea81d3ed 100755
--- a/app/src/main/res/values-tr/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-tr/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
@@ -11,7 +12,7 @@
   <string name="port">Sunucu Portu:</string>
   <string name="location">Konum</string>
   <string name="cant_read_folder">Dizin Okunamıyor</string>
-  <string name="select">Seçin</string>
+  <string name="select">Seç</string>
   <string name="cancel">İptal</string>
   <string name="no_data">Veri Yok</string>
   <string name="useLZO">LZO sıkıştırma</string>
@@ -316,4 +317,20 @@
   <string name="userpw_file">Kullanıcı adı / Şifre dosyası</string>
   <string name="imported_from_file">[Buradan içeri aktar: %s]</string>
   <string name="import_log">Kaydı içe aktar:</string>
+  <string name="client_behaviour">İstemci davranışı</string>
+  <string name="loading">Yükleniyor&#8230;</string>
+  <string name="allowed_vpn_apps_info">Izin verilen VPN uygulamaları: %1$s</string>
+  <string name="disallowed_vpn_apps_info">İzin verilmeyen VPN uygulamaları: %1$s</string>
+  <string name="app_no_longer_exists">%s adlı paket artık yüklü değil, izin listesinden çıkarılıyor</string>
+  <string name="vpn_disallow_radio">Seçilen uygulamar dışındaki tüm uygulamalar için VPN kullanılır</string>
+  <string name="vpn_allow_radio">Sadece seçilen uygulamar için VPN kullanılır</string>
+  <string name="query_delete_remote">Uzak sunucu girişi kaldırılsın mı?</string>
+  <string name="keep">Sakla</string>
+  <string name="delete">Sil</string>
+  <string name="add_remote">Yenı uzak sunucu ekle</string>
+  <string name="remote_no_server_selected">En az bir uzak sunucu tanımlamalı ve etkinleştirmelisiniz.</string>
+  <string name="server_list">Sunucu Listesi</string>
+  <string name="vpn_allowed_apps">İzin verilen uygulamalar</string>
+  <string name="advanced_settings">Gelişmiş Ayarlar</string>
+  <string name="tls_settings">TLS Ayarları</string>
 </resources>
diff --git a/app/src/main/res/values-uk/strings-icsopenvpn.xml b/app/src/main/res/values-uk/strings-icsopenvpn.xml
index 92637b74..dbbc65a0 100755
--- a/app/src/main/res/values-uk/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-uk/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values-v21/colours.xml b/app/src/main/res/values-v21/colours.xml
new file mode 100644
index 00000000..1fedf7b9
--- /dev/null
+++ b/app/src/main/res/values-v21/colours.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (c) 2012-2014 Arne Schwabe
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
+  -->
+
+<resources>
+    <color name="switchbar">#5C6BC0</color>    <!-- 400-->
+</resources>
\ No newline at end of file
diff --git a/app/src/main/res/values-v21/refs.xml b/app/src/main/res/values-v21/refs.xml
index 0d5d271a..d29d04ed 100644
--- a/app/src/main/res/values-v21/refs.xml
+++ b/app/src/main/res/values-v21/refs.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <resources>
@@ -9,5 +9,7 @@
     <drawable name="ic_menu_share">@drawable/ic_share_white_24dp </drawable>
     <drawable name="ic_menu_view">@drawable/ic_filter_list_white_24dp</drawable>
     <drawable name="ic_menu_delete">@drawable/ic_delete_white_24dp</drawable>
+    <drawable name="ic_menu_delete_grey">@drawable/ic_delete_grey600_24dp</drawable>
+
     <drawable name="ic_menu_edit">@drawable/ic_edit_white_24dp</drawable>
 </resources>
diff --git a/app/src/main/res/values-v21/styles.xml b/app/src/main/res/values-v21/styles.xml
index 892b6cb0..4379dd6d 100644
--- a/app/src/main/res/values-v21/styles.xml
+++ b/app/src/main/res/values-v21/styles.xml
@@ -1,13 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <resources>
+    <style name="blinkt.baseTheme" parent="android:Theme.Material.Light.DarkActionBar" />
+
 
     <!-- http://www.google.de/design/spec/style/color.html#color-color-palette -->
-    <style name="appstyle" parent="android:Theme.Material.Light.DarkActionBar">
+    <style name="blinkt" parent="blinkt.common">
         <item name="android:colorPrimary">@color/primary</item>
         <item name="android:colorPrimaryDark">@color/primary_dark</item>
         <item name="android:colorAccent">@color/accent</item>
diff --git a/app/src/main/res/values-zh-rCN/strings-icsopenvpn.xml b/app/src/main/res/values-zh-rCN/strings-icsopenvpn.xml
index 93e0cbb1..4a3da0f4 100755
--- a/app/src/main/res/values-zh-rCN/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-zh-rCN/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
@@ -88,7 +89,9 @@
   <string name="default_route_summary">重定向所有流量到VPN</string>
   <string name="use_default_title">使用默认路由</string>
   <string name="custom_route_message">输入自定义路由。输入 CIDR 格式地址。</string>
+  <string name="custom_route_message_excluded">路线不应该被路由通过VPN。使用相同的语法包括路线。</string>
   <string name="custom_routes_title">自定义路由</string>
+  <string name="custom_routes_title_excluded">排查网络</string>
   <string name="log_verbosity_level">日志详细级别</string>
   <string name="float_summary">允许来自任何 IP 的认证数据包</string>
   <string name="float_title">允许浮服务器</string>
@@ -102,7 +105,9 @@
   <string name="last_openvpn_tun_config">正在打开 tun 设备：</string>
   <string name="local_ip_info">本地 IPv4： %1$s/%2$d IPv6： %3$s MTU： %4$d</string>
   <string name="dns_server_info">DNS 服务器: %1$s, 域名: %2$s</string>
+  <string name="routes_info_incl">路线: %1$s %2$s</string>
   <string name="routes_info_excl">排除的路由： %1$s %2$s</string>
+  <string name="routes_debug">VpnService安装路线 : %1$s %2$s</string>
   <string name="ip_not_cidr">已获得接口信息 %1$s 以及 %2$s，将第二个地址作为远程地址。使用 /32 作为本地掩码。OpenVPN 给出的模式是 \"%3$s\"。</string>
   <string name="route_not_cidr">无法将 %1$s 和 %2$s 作为 CIDR 形式的路由，将使用 /32 的子网掩码。</string>
   <string name="route_not_netip">纠正路由 %1$s/%2$s 为 %3$s/%2$s</string>
@@ -217,6 +222,7 @@
   <string name="vpn_import_hint">使用 &lt;img src=\"ic_menu_archive\"/&gt; 图标导入存储卡中已有的配置文件(.ovpn 或 .conf)。</string>
   <string name="faq_hint">请确保阅读常见问题解答。这是一个快速向导。</string>
   <string name="faq_routing_title">路由/接口配置</string>
+  <string name="faq_routing">的路由和接口配置不通过传统的ifconfig /路由的命令而将用VPNService API来完成。这导致了比在其它操作系统不同的路由配置。 \ n此VPN隧道的配置包括IP地址，并应被指定到该接口的网络。特别是，没有同行伙伴地址或网关地址是必要的或需要。特殊的路由到达VPN服务器不需要任何（例如，当使用重定向网关添加）。导入配置时，应用程序会因此忽略这些设置。该应用程序可确保与连接到服务器没有通过VPN隧道路由的VPNService API。\ n此VPNService API不允许指定的网络，不应该通过VPN路由。作为一种变通方法的应用程序会检测网络，不应该被路由到隧道（如路由XXXX YYYY net_gateway），并计算一组路由排除这种路线效仿其他平台的行为。日志窗口显示VPNService的在建立连接的配置\ nBehind的场景：安卓4.4+确实使用策略路由。使用route / ifconfig命令不会显示已安装的路径。而使用IP规则，iptables的-t轧-L</string>
   <string name="persisttun_summary">当 OpenVPN 重连时，也一直使用 VPN 连接。</string>
   <string name="persistent_tun_title">保持 tun 通道</string>
   <string name="openvpn_log">OpenVPN 日志</string>
diff --git a/app/src/main/res/values-zh-rTW/strings-icsopenvpn.xml b/app/src/main/res/values-zh-rTW/strings-icsopenvpn.xml
index bd155362..36360cf1 100755
--- a/app/src/main/res/values-zh-rTW/strings-icsopenvpn.xml
+++ b/app/src/main/res/values-zh-rTW/strings-icsopenvpn.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!--Generated by crowdin.com-->
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
+
+<!--Generated by crowdin.com-->
 <!-- Generated by crowdin.net -->
 <resources>
 
diff --git a/app/src/main/res/values/colours.xml b/app/src/main/res/values/colours.xml
index 89fb41dd..f27167f3 100644
--- a/app/src/main/res/values/colours.xml
+++ b/app/src/main/res/values/colours.xml
@@ -1,13 +1,21 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <resources>
     <!-- Indigo -->
     <!-- OpenVPN colours #203155, #C66D0D -->
-    <color name="primary">#3F51B5</color>
-    <color name="primary_dark">#303F9F</color>
-    <color name="accent">#FFA726</color>
+    <color name="primary">#3F51B5</color>      <!--500-->
+    <color name="primary_dark">#303F9F</color> <!--700-->
+    <color name="accent">#FFA726</color>       <!-- Orange 400 -->
+    <color name="gelb">#ffff00</color>
+    <color name="rot">#ff0000</color>
+
+    <color name="switchbar">@android:color/darker_gray</color>
+
+
+    <color name="background_tab_pressed">#1AFFFFFF</color>
+
 </resources>
\ No newline at end of file
diff --git a/app/src/main/res/values/dimens.xml b/app/src/main/res/values/dimens.xml
index 9a53fe4c..727f5a78 100644
--- a/app/src/main/res/values/dimens.xml
+++ b/app/src/main/res/values/dimens.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <resources>
@@ -9,4 +9,12 @@
     <dimen name="stdpadding">8dp</dimen>
     <bool name="logSildersAlwaysVisible">false</bool>
 
+    <dimen name="diameter">48dp</dimen>
+    <dimen name="elevation_low">1dp</dimen>
+    <dimen name="elevation_high">4dp</dimen>
+    <dimen name="add_button_margin">16dp</dimen>
+    <dimen name="add_button_margin_topfab">96dp</dimen>
+    <dimen name="round_button_diameter">56dp</dimen>
+    <dimen name="switchbar_pad">16dp</dimen>
+    <dimen name="vpn_setting_padding">16dp</dimen>
 </resources>
\ No newline at end of file
diff --git a/app/src/main/res/values/refs.xml b/app/src/main/res/values/refs.xml
index 5e7f5e14..4d97e380 100644
--- a/app/src/main/res/values/refs.xml
+++ b/app/src/main/res/values/refs.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <resources>
@@ -11,5 +11,4 @@
     <drawable name="ic_menu_view">@android:drawable/ic_menu_view</drawable>
     <drawable name="ic_menu_delete">@android:drawable/ic_menu_delete</drawable>
     <drawable name="ic_menu_edit">@android:drawable/ic_menu_edit</drawable>
-
 </resources>
diff --git a/app/src/main/res/values/strings-icsopenvpn.xml b/app/src/main/res/values/strings-icsopenvpn.xml
index 15bf8142..307d3a42 100755
--- a/app/src/main/res/values/strings-icsopenvpn.xml
+++ b/app/src/main/res/values/strings-icsopenvpn.xml
@@ -1,10 +1,9 @@
 <?xml version="1.0" encoding="utf-8"?> <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
-  --> <!-- Generated by crowdin.net -->
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
+  -->
 <resources>
 
-
     <string name="address">Server Address:</string>
     <string name="port">Server Port:</string>
     <string name="location">Location</string>
@@ -174,14 +173,14 @@
     <string name="netchange_summary">Turning this option on will force a reconnect if the network state is changed (e.g. WiFi to/from mobile)</string>
     <string name="netchange">Reconnect on network change</string>
     <string name="netstatus">Network Status: %s</string>
-    <string name="extracahint">The CA cert is usually returned from the Android Keystore. Specify a separate certificate if you get certificate verification errors.</string>
+    <string name="extracahint">The CA cert is usually returned from the Android keystore. Specify a separate certificate if you get certificate verification errors.</string>
     <string name="select_file">Select</string>
-    <string name="keychain_nocacert">No CA Certificate returned while reading from Android keystore. Auhtentication will probably fail.</string>
+    <string name="keychain_nocacert">No CA Certificate returned while reading from Android keystore. Authentication will probably fail.</string>
     <string name="show_log_summary">Shows the log window on connect. The log window can always be accessed from the notification status.</string>
     <string name="show_log_window">Show log window</string>
     <string name="mobile_info">Running on %1$s (%2$s) %3$s, Android API %4$d</string>
     <string name="error_rsa_sign">Error signing with Android keystore key %1$s: %2$s</string>
-    <string name="faq_system_dialogs">The VPN connection warning telling you that this app can intercept all traffic is imposed by the system to prevent abuse of the VPNService API.\nThe VPN connection notification (The key symbol) is also imposed by the Android system to signal an ongoing VPN connection. On some images this notification plays a sound.\nAndroid introduced these system dialogs for your own safety and made sure that they cannot be circumenvented. (On some images this unfortunely includes a notifciation sound)</string>
+    <string name="faq_system_dialogs">The VPN connection warning telling you that this app can intercept all traffic is imposed by the system to prevent abuse of the VPNService API.\nThe VPN connection notification (The key symbol) is also imposed by the Android system to signal an ongoing VPN connection. On some images this notification plays a sound.\nAndroid introduced these system dialogs for your own safety and made sure that they cannot be circumvented. (On some images this unfortunately includes a notification sound)</string>
     <string name="faq_system_dialogs_title">Connection warning and notification sound</string>
     <string name="translationby">English translation by Arne Schwabe&lt;arne@rfc2549.org&gt;</string>
     <string name="ipdns">IP and DNS</string>
@@ -314,7 +313,7 @@
     <string name="unhandled_exception_context">%3$s: %1$s\n\n%2$s</string>
     <string name="faq_system_dialog_xposed">If you have rooted your Android device you can install the &lt;a href=\"http://xposed.info/\"&gt;Xposed framework&lt;/a&gt; and a the &lt;a href=\"http://repo.xposed.info/module/de.blinkt.vpndialogxposed\"&gt;VPN Dialog confirm module&lt;/a&gt; at your own risk"</string>
     <string name="full_licenses">Full licenses</string>
-    <string name="blocklocal_summary">Networks directly connected to the local interfaces will not be routed over the VPN. Unchecking this option will redirect all traffic indented for local networks to VPN.</string>
+    <string name="blocklocal_summary">Networks directly connected to the local interfaces will not be routed over the VPN. Deselecting this option will redirect all traffic indented for local networks to the VPN.</string>
     <string name="blocklocal_title">Bypass VPN for local networks</string>
     <string name="userpw_file">Username/Password file</string>
     <string name="imported_from_file">[Imported from: %s]</string>
@@ -322,11 +321,34 @@
     <string name="openvpn_is_no_free_vpn">To use this app you need a VPN provider/VPN gateway supporting OpenVPN (often provided by your employer). Check out http://community.openvpn.net/ for more information on OpenVPN and how to setup your own OpenVPN server.</string>
     <string name="import_log">Import log:</string>
     <string name="ip_looks_like_subnet">Vpn topology \"%3$s\" specified but ifconfig %1$s %2$s looks more like an IP address with a network mask. Assuming \"subnet\" topology.</string>
-    <string name="mssfix_invalid_value">mssfix value has to be a integer between 0 and 9000</string>
+    <string name="mssfix_invalid_value">The MSS override value has to be a integer between 0 and 9000</string>
     <string name="mssfix_value_dialog">Announce to TCP sessions running over the tunnel that they should limit their send packet sizes such that after OpenVPN has encapsulated them, the resulting UDP packet size that OpenVPN sends to its peer will not exceed this number of bytes. (default is 1450)</string>
     <string name="mssfix_checkbox">Override MSS value of TCP payload</string>
     <string name="mssfix_dialogtitle">Set MSS of TCP payload</string>
     <string name="client_behaviour">Client behaviour</string>
     <string name="clear_external_apps">Clear allowed external apps</string>
+    <string name="loading">Loading…</string>
+    <string name="allowed_vpn_apps_info">Allowed VPN apps: %1$s</string>
+    <string name="disallowed_vpn_apps_info">Disallowed VPN apps: %1$s</string>
+    <string name="app_no_longer_exists">Package %s is no longer installed, removing it from app allow/disallow list</string>
+    <string name="vpn_disallow_radio">VPN is used for all apps but exclude selected</string>
+    <string name="vpn_allow_radio">VPN is used for only for selected apps</string>
+    <string name="query_delete_remote">Remove remote server entry?</string>
+    <string name="keep">Keep</string>
+    <string name="delete">Delete</string>
+    <string name="add_remote">Add new remote</string>
+    <string name="remote_random">Use connection entries in random order on connect</string>
+    <string name="remote_no_server_selected">You need to define and enable at least one remote server.</string>
+    <string name="server_list">Server List</string>
+    <string name="vpn_allowed_apps">Allowed Apps</string>
+    <string name="advanced_settings">Advanced Settings</string>
+    <string name="payload_options">Payload options</string>
+    <string name="tls_settings">TLS Settings</string>
+    <string name="no_remote_defined">No remote defined</string>
+    <string name="duplicate_vpn">Duplicate VPN profile</string>
+    <string name="duplicate_profile_title">Duplicating profile: %s</string>
+    <string name="show_log">Show log</string>
+    <string name="faq_android_clients">Multiple OpenVPN clients for Android exist. The most common ones are OpenVPN for Android (this client), OpenVPN Connect and OpenVPN Settings.&lt;p&gt;The clients can be grouped into two groups: OpenVPN for Android and OpenVPN Connect use the official VPNService API (Android 4.0+) and require no root and OpenVPN Settings which uses root.&lt;p&gt;OpenVPN for Android is an open source client and developed by Arne Schwabe.  It is targeted at more advanced users and offers many settings and the ability to import profiles from files and to configure/change profiles inside the app. The client is based on the community version of OpenVPN. It is based on the OpenVPN 2.x source code. This client can be seen as the semi officially client of the community. &lt;p&gt;OpenVPN Connect is non open source client that is developed by OpenVPN Technologies, Inc. The client is indented to be general use client and moree targeted at the average user and allows the import of OpenVPN profiles. This client is based on the OpenVPN C++ reimplementation of the OpenVPN protocol (This was required to allow OpenVPN Technologies, Inc to publish an iOS OpenVPN app). This client is the official client of the OpenVPN technologies &lt;p&gt; OpenVPN Settings is the oldest of the clients and also a UI for the open source OpenVPN. In contrast to OpenVPN  for Android it requires root and does not use the VPNService API. It does not depend on Android 4.0+</string>
+    <string name="faq_androids_clients_title">Differences between the OpenVPN Android clients</string>
 
 </resources>
diff --git a/app/src/main/res/values/styles.xml b/app/src/main/res/values/styles.xml
index a60e29b8..94970c88 100644
--- a/app/src/main/res/values/styles.xml
+++ b/app/src/main/res/values/styles.xml
@@ -1,14 +1,24 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
   ~ Copyright (c) 2012-2014 Arne Schwabe
-  ~ Distributed under the GNU GPL v2. For full terms see the file doc/LICENSE.txt
+  ~ Distributed under the GNU GPL v2 with additional terms. For full terms see the file doc/LICENSE.txt
   -->
 
 <resources>
-    <style name="appstyle" parent="android:Theme.DeviceDefault.Light">
+    <style name="blinkt.baseTheme" parent="android:Theme.DeviceDefault.Light" />
+    <style name="blinkt.common" parent="blinkt.baseTheme" >
+        <!-- Shared between Holo and Material -->
+        <item name="android:preferenceStyle">@style/BlinktPreferencePanel</item>
 
     </style>
 
+    <style name="blinkt" parent="blinkt.common">
+    </style>
+
+    <!-- No margins or background by default. Not different for x-large screens -->
+    <style name="BlinktPreferencePanel">
+        <item name="android:background">@color/gelb</item>
+    </style>
 
     <style name="item">
         <item name="android:layout_width">match_parent</item>
diff --git a/app/src/main/res/values/untranslatable.xml b/app/src/main/res/values/untranslatable.xml
index 82147ab5..3aa47129 100644
--- a/app/src/main/res/values/untranslatable.xml
+++ b/app/src/main/res/values/untranslatable.xml
@@ -3170,4 +3170,864 @@
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 </resources>
\ No newline at end of file
diff --git a/app/src/ovpn3/java/de/blinkt/openvpn/core/OpenVPNThreadv3.java b/app/src/ovpn3/java/de/blinkt/openvpn/core/OpenVPNThreadv3.java
new file mode 100644
index 00000000..e595106c
--- /dev/null
+++ b/app/src/ovpn3/java/de/blinkt/openvpn/core/OpenVPNThreadv3.java
@@ -0,0 +1,275 @@
+package de.blinkt.openvpn.core;
+
+import net.openvpn.ovpn3.ClientAPI_Config;
+import net.openvpn.ovpn3.ClientAPI_EvalConfig;
+import net.openvpn.ovpn3.ClientAPI_Event;
+import net.openvpn.ovpn3.ClientAPI_ExternalPKICertRequest;
+import net.openvpn.ovpn3.ClientAPI_ExternalPKISignRequest;
+import net.openvpn.ovpn3.ClientAPI_LogInfo;
+import net.openvpn.ovpn3.ClientAPI_OpenVPNClient;
+import net.openvpn.ovpn3.ClientAPI_ProvideCreds;
+import net.openvpn.ovpn3.ClientAPI_Status;
+import net.openvpn.ovpn3.ClientAPI_TransportStats;
+
+import java.lang.Override;
+
+import de.blinkt.openvpn.VpnProfile;
+
+import android.content.Context;
+
+public class OpenVPNThreadv3 extends ClientAPI_OpenVPNClient implements Runnable, OpenVPNManagement {
+
+	static {
+		/*System.loadLibrary("crypto");
+		System.loadLibrary("ssl");*/
+        System.loadLibrary("polarssl-dynamic");
+		System.loadLibrary("ovpn3");
+	}
+
+	private VpnProfile mVp;
+	private OpenVPNService mService;
+
+	class StatusPoller implements  Runnable 
+	{
+		private long mSleeptime;
+
+		boolean mStopped=false;
+
+		public StatusPoller(long sleeptime) {
+			mSleeptime=sleeptime;
+		}
+
+		public void run() {
+			while(!mStopped) {
+				try {
+					Thread.sleep(mSleeptime);
+				} catch (InterruptedException e) {
+				}
+				ClientAPI_TransportStats t = transport_stats();
+				long in = t.getBytesIn();
+				long out = t.getBytesOut();
+				VpnStatus.updateByteCount(in, out);
+			}
+		}
+
+		public void stop() {
+			mStopped=true;
+		}
+	}
+
+	@Override
+	public void run() {
+		String configstr = mVp.getConfigFile((Context)mService,true);
+		if(!setConfig(configstr))
+			return;
+		setUserPW();
+        VpnStatus.logInfo(copyright());
+
+		StatusPoller statuspoller = new StatusPoller(5000);
+		new Thread(statuspoller,"Status Poller").start();
+
+		ClientAPI_Status status = connect();
+		if(status.getError()) {
+            VpnStatus.logError(String.format("connect() error: %s: %s",status.getStatus(),status.getMessage()));
+		} else {
+            VpnStatus.logInfo("OpenVPN3 thread finished");
+		}
+		statuspoller.stop();
+	}
+
+	@Override
+	public boolean tun_builder_set_remote_address(String address, boolean ipv6) {
+		mService.setMtu(1500);
+		return true;
+	}
+
+	@Override
+	public boolean tun_builder_set_mtu(int mtu) {
+		mService.setMtu(mtu);
+		return true;
+	}
+	@Override
+	public boolean tun_builder_add_dns_server(String address, boolean ipv6) {
+		mService.addDNS(address);
+		return true;
+	}
+
+	@Override
+	public boolean tun_builder_add_route(String address, int prefix_length,
+			boolean ipv6) {
+		if (address.equals("remote_host"))
+			return false;
+		
+		if(ipv6)
+			mService.addRoutev6(address + "/" + prefix_length,"tun");
+		else
+			mService.addRoute(new CIDRIP(address, prefix_length));
+		return true;
+	}
+
+	@Override
+	public boolean tun_builder_add_search_domain(String domain) {
+		mService.setDomain(domain);
+		return true;
+	}
+
+	@Override
+	public int tun_builder_establish() {
+		return mService.openTun().detachFd();
+	}
+
+	@Override
+	public boolean tun_builder_set_session_name(String name) {
+        VpnStatus.logInfo("We should call this session" + name);
+		return true;
+	}
+
+
+
+	@Override
+	public boolean tun_builder_add_address(String address, int prefix_length,
+			boolean ipv6) {
+		if(!ipv6)
+			mService.setLocalIP(new CIDRIP(address, prefix_length));
+		else
+			mService.setLocalIPv6(address+ "/" + prefix_length);
+		return true;
+	}
+
+	@Override
+	public boolean tun_builder_new() {
+
+		return true;
+	}
+
+	@Override
+	public boolean tun_builder_reroute_gw(String server_address,
+			boolean server_address_ipv6, boolean ipv4, boolean ipv6, long flags) {
+		// ignore
+		return true;
+	}
+
+	@Override
+	public boolean tun_builder_exclude_route(String address, int prefix_length,
+			boolean ipv6) {
+		//ignore
+		return true;
+	}
+
+
+	private boolean setConfig(String vpnconfig) {
+
+		ClientAPI_Config config = new ClientAPI_Config();
+		if(mVp.getPasswordPrivateKey()!=null)
+			config.setPrivateKeyPassword(mVp.getPasswordPrivateKey());
+
+		config.setContent(vpnconfig);
+		config.setTunPersist(mVp.mPersistTun);
+        config.setGuiVersion(mVp.getVersionEnvString(mService));
+		config.setExternalPkiAlias("extpki");
+
+		ClientAPI_EvalConfig ec = eval_config(config);
+		if(ec.getExternalPki()) {
+            VpnStatus.logError("OpenVPN seem to think as external PKI");
+		}
+		if (ec.getError()) {
+            VpnStatus.logError("OpenVPN config file parse error: " + ec.getMessage());
+			return false;
+		} else {
+			config.setContent(vpnconfig);
+			return true;
+		}
+	}
+
+	@Override
+	public void external_pki_cert_request(ClientAPI_ExternalPKICertRequest certreq) {
+        VpnStatus.logError("EXT PKI CERT");
+		String[] ks = mVp.getKeyStoreCertificates((Context) mService);
+		if(ks==null) {
+			certreq.setError(true);
+			certreq.setErrorText("Error in pki cert request");
+			return;
+		}
+
+        String supcerts = ks[0];
+        /* FIXME: How to differentiate between chain and ca certs in OpenVPN 3? */
+        if (ks[1]!=null)
+            supcerts += "\n" + ks[1];
+		certreq.setSupportingChain(supcerts);
+		certreq.setCert(ks[2]);
+		certreq.setError(false);
+	}
+
+	@Override
+	public void external_pki_sign_request(ClientAPI_ExternalPKISignRequest signreq) {
+		signreq.setSig(mVp.getSignedData(signreq.getData()));
+	}
+
+	void setUserPW() {
+		if(mVp.isUserPWAuth()) {
+			ClientAPI_ProvideCreds creds = new ClientAPI_ProvideCreds();
+			creds.setCachePassword(true);
+			creds.setPassword(mVp.getPasswordAuth());
+			creds.setUsername(mVp.mUsername);
+			provide_creds(creds);
+		}
+	}
+
+	@Override
+	public boolean socket_protect(int socket) {
+		boolean b= mService.protect(socket);
+		return b;
+
+	}
+
+	public OpenVPNThreadv3(OpenVPNService openVpnService, VpnProfile vp) {
+		init_process();
+		mVp =vp;
+		mService =openVpnService;
+	}
+
+    @Override
+    public void pause(pauseReason pauseReason)
+    {
+        pause();
+    }
+
+	@Override
+	public void log(ClientAPI_LogInfo arg0) {
+		String logmsg =arg0.getText();
+		while (logmsg.endsWith("\n"))
+			logmsg = logmsg.substring(0, logmsg.length()-1);
+
+        VpnStatus.logInfo(logmsg);
+	}
+
+	@Override
+	public void event(ClientAPI_Event event) {
+		VpnStatus.updateStateString(event.getName(), event.getInfo());
+		if(event.getError())
+            VpnStatus.logError(String.format("EVENT(Error): %s: %s",event.getName(),event.getInfo()));
+	}
+
+
+	// When a connection is close to timeout, the core will call this
+	// method.  If it returns false, the core will disconnect with a
+	// CONNECTION_TIMEOUT event.  If true, the core will enter a PAUSE
+	// state.
+
+	@Override
+	public boolean pause_on_connection_timeout() {
+        VpnStatus.logInfo("pause on connection timeout?! ");
+		return true; 
+	}
+
+	public boolean stopVPN() {
+		stop();
+		return true;
+	}
+
+	@Override
+	public void reconnect() {
+		reconnect(1);
+	}
+
+}