Update VPN client to 0.22.0-beta.2

A new VPN client version 0.22.0-beta.2 has been released. Please integrate it.

Changelog: https://github.com/AdGuardSoftwareLimited/vpn-client/releases/tag/v0.22.0-beta.2

Changelog

Added

• A new VPN error code for a "not yet valid" certificate verification error, which hints
  at an incorrectly set wall clock. The application should process this new error code by
  displaying a hint to the user that the wall clock might be set incorrectly.
  • [Android] com.adguard.vpnclient.VpnError.Code#CERTIFICATE_NOT_YET_VALID.
  • [Apple] AGVEC_CERTIFICATE_NOT_YET_VALID.
• A new VPN backend error code to hint that the wall clock might be set incorrectly
  is now returned in place of a generic HTTP error with a 4xx status, and in place of
  a generic network error when the backend server's certificate is not yet valid.
  The application should process this new error type by displaying a hint to the
  user that the wall clock might be set incorrectly.
  • [Android] New unchecked exception: com.adguard.vpnclient.api.exceptions.VpnBackendCheckWallClockException.
  • [Apple] New error code: AGVpnBackendErrorCheckWallClock.
• The previously missing "cancelled" network error code is now declared in the platform
  network error code enumerations, which restores their correspondence with ag::vpn::WebRequestsErrorCode.
  • [Android] VpnBackendNetworkException.Code#CANCELLED.
  • [Apple] AGNECCancelled, AGWebRequestsErrorCodeCancelled.
• A new Chrome Canary endpoint TLS ClientHello fingerprint profile.
  • [Android] com.adguard.vpnclient.TlsProfile#CHROME_CANARY.
  • [Apple] AGTP_CHROME_CANARY.
  • [Windows] VpnApiC.VpnTlsProfile.VPN_TLS_PROFILE_CHROME_CANARY.
• [Apple] A new event raised when the process is probably missing the Local Network permission.
  This permission is required to query a DNS resolver on the local network: either because it was
  configured by the user, or because it was determined as the "system" resolver and an exclusion
  host needs to be resolved. The application should guide the user through the permission process.
  See AGVpnClientEvents.onCheckLocalNetworkPermission.

Changed

• A backend request is no longer retried after the server's certificate has been rejected
  as not yet valid, since a retry would fail in exactly the same way.
• The relay the backend is reached through, as reported by DNS discovery, now overrides the relays
  of every location. Whenever a relay is reported, connect to each endpoint through it instead of
  through the location's own relays:
  replace the endpoint addresses and the location relays with the reported address, and the endpoint
  SNI with the reported SNI when there is one; keep the endpoint's own remote_id and additional_data.
  Ask for it again before each connection, since a later discovery lookup may move or remove the relay.
  Taking locations from an offline cache when the backend cannot be reached is no longer part of this
  contract.
  • [Apple] See AGVpnBackendClient.discoveryRelay and AGVpnBackendRelayInfo.
  • [Android] See VpnBackendClient.getDiscoveryRelay.
  • [Windows] See IVpnBackendClient.GetDiscoveryRelay and DiscoveryRelayInfo.
  • [Native] See vpn_backend_client_get_discovery_relay and VpnBackendRelayInfo.
• A backend request that fails to reach the backend now triggers a new DNS discovery lookup, even
  while the current answer is within its TTL, at most once every 90 seconds. The request's next try,
  or the next request, uses the new routes.

Fixed

• [Android] A network error during a backend request is now reported as
  VpnBackendNetworkException, as documented, instead of VpnBackendServerSideException
  carrying the network error code in place of an HTTP status.