Update VPN client to 0.22.0-beta.1

Start by reviewing the Android backend client API and adapter references named in the changelog, especially VpnBackendClient.Ev1ProtocolOverrides and VpnBackendClient.Config. Compare the integration with the listed changes: discovery configuration, fixed client token, bootstrap config updates, removed v3 settings and API overloads, and the default TLS profile. Done means the Android client integrates VPN client 0.22.0-beta.1 and its affected callers use the updated APIs.

A new VPN client version 0.22.0-beta.1 has been released. Please integrate it.

Changelog: https://github.com/AdGuardSoftwareLimited/vpn-client/releases/tag/v0.22.0-beta.1

Changelog

Added

Backend domains are now resolved through the DNS Discovery Protocol (v5): one encrypted DNS query
against a configured zone answers for every service at once, over any transport dns-libs supports.

• New backend selection parameters discoveryZone, discoveryServerPublicKey and browserAuthFallbackDomain.
  The last one is split from auth domain because all backend domains can be relayed and use fake SNI.
  So for links that are opened in browser, the separate discoverable domain is needed.
  • [Apple] See AGVpnBackendClientProtocolEv1Overrides.discoveryZone, .discoveryServerPublicKey and .browserAuthFallbackDomain.
  • [Android] See VpnBackendClient.Ev1ProtocolOverrides.discoveryZone, .discoveryServerPublicKey and .browserAuthFallbackDomain.
  • [Native] See VpnBackendDomainsConfig.discovery_zone, .discovery_server_pubkey and VpnBackendDomains.browser_auth_domain.
• The relay the backend is reached through can now be read back, for reaching VPN endpoints when they are unreachable.
  Call it when the backend client failed to update locations. In this case, to connect to a server, take the
  location from the offline cache, replace its endpoint addresses (or relays) and SNI with the relay address and
  the relay-wide SNI (if the relay has one) reported here, and keep the endpoint's own remote_id and
  additional_data.
  • [Apple] See AGVpnBackendClient.discoveryRelay and AGVpnBackendRelayInfo.
  • [Android] See VpnBackendClient.getDiscoveryRelay.
  • [Native] See vpn_backend_client_get_discovery_relay and VpnBackendRelayInfo.
• Added the endpoint TLS ClientHello fingerprint profile (TlsProfile) setting to the Android, Apple, and Windows adapters. It selects which client the outgoing TLS ClientHello mimics (its JA4 fingerprint). Chrome is the default. The backend support are not here yet, so please just set the default.

Changed

• The fetched bootstrap config moved from backend.txt to discovery.txt in the same buckets, and
  states its resolvers as dns_servers (any transport dns-libs supports) rather than the DoH-only
  doh_servers. doh_servers is still read, so a client pointed at the old document keeps working.
  Applications overriding backend_selector_config_fetch_urls must update them.
• The VPN token is now fixed for the lifetime of a backend client: discovery routes on the token in the
  app details the client is created with, and every request carries those same app details. Applications
  must create a new backend client on login and on logout, rather than passing a token per API.
  Using old api for changing AppDetails on the fly does not longer work.
• The bootstrap config is no longer fetched on the way to a discovery lookup. Discovery uses the
  cached config, stale or not, and the config is refreshed in the background on its own schedule,
  kept away from discovery lookups. It is fetched inline only when nothing is cached and discovery
  with the built-in DNS servers failed. How long a fetched config stays fresh now comes from the
  server's Cache-Control: max-age=N, must-revalidate, 1 hour without it; it was a hardcoded
  30 minutes.

Removed

• The v3 backend selection (per-service TXT lookups over DoH) and its configuration. Applications
  configure a discovery zone instead; the account type and the logged-in email are no longer used,
  as the server derives the tier from the VPN token the backend client is created with.
  • [Apple] Removed AGVpnBackendClientProtocolEv1Overrides.authTxtDomain, .apiTxtDomain, .tmTxtDomain,
    AGVpnBackendClientConfig.accountType and .loggedInEmail.
  • [Android] Removed VpnBackendClient.Ev1ProtocolOverrides.authTxtDomain, .apiTxtDomain, .tmTxtDomain,
    VpnBackendClient.Config.accountType and .loggedInEmail.
  • [Native] Removed VpnBackendDomainsConfig.auth_txt_domain, .api_txt_domain, .tm_txt_domain,
    .logged_in_email and VpnBackendClientConfig.account_type.
• Passing a VPN token per API; the token now comes from the app details the client is created with.
  • [Apple] Removed AGVpnBackendClient.locationsApiWithVpnToken:, .credentialsApiWithVpnToken:,
    .appsApiWithVpnToken:, .paymentsApiWithVpnToken: and .pushNotificationsApiWithVpnToken:.
  • [Android] Removed VpnBackendClient.locationsApi(String), .credentialsApi(String), .appsApi(String)
    and .paymentsApi(String).