mullvadvpn-app

Fixed

Linux

• Fix crash when trying to apply IPv6 routes for OpenVPN when IPv6 is disabled.
• Ignore failure to add IPv6 split-tunneling routing rules when they fail due to IPv6 being
  unavailable.

Windows

• Fix failure when Wintun adapter name conflicts with that of a non-Wintun adapter.
• Fix detection of SetupAPI patch when not installed by KB2921916.

Fixed

• Fix crash on desktop when entering problem report view when using an outdated app version.

The rest is identical to 2021.1-beta2, see that change log and previous betas for all changes since last stable release.

Fixed

• Make it impossible to apply an empty list of custom DNS server IPs.
  Stops the daemon from getting stuck in the offline state on macOS.

Windows

• Only load and unload the Wintun driver once instead of on every connection.
  Will hopefully fix an issue where it gave an error

This release is for desktop only.

Added

• Add header containing OS version to version-check API call to enable OS specific compatibility and
  vulnerability checks.
• Add TALPID_DISABLE_OFFLINE_MONITOR environment variable to allow users to disable offline
  detection.

Android

• Allow to configure the tunnel to use custom DNS servers.
• Show only applications that has INTERNET permission on split tunnel screen.

Linux

• Improved compatiblitiy with newer versions of systemd-resolved.
• Add version data to problem reports for the following software: the kernel, NetworkManager,
  WireGuard kernel module, SystemD.

Changed

• Allow the API to be accessed while in a blocking state.
• Prefer the last used API endpoint when the service starts back up, as well as in other tools such
  as the problem report tool.
• Migrate cache to a directory readable by all users, consistent with Android and Linux.
• Change the default value of the GUI auto-connect setting to "off" and respect the setting when
  logging in.

Linux

• Improve offline check to query the routing table to allow users to use a bridged adapter as their
  primary interface.

Fixed

• Fix Turkish translations for on/off in the bridge settings. They were inverted, so it was
  confusing to change the setting.
• Stop returning bogus version information when there is no version cache.

Linux

• Fix missing app window icon in Xfce.

Windows

• Resolve single-label hostnames correctly.

Security

• Default to connecting when the daemon starts if the target state cache cannot be read or parsed.

Linux

• Prevent the private tunnel IPv6 address from being detectable on a local network when using
  OpenVPN by correctly applying the fix for
  CVE-2019-14899.

Windows

• Deny network access to the OpenVPN plugin pipe, which allowed for anonymous write access when
  passwordless file sharing was enabled.

This release is for desktop only. Most actual changes are listed in the changelog for android/2020.8-beta1.

Added

Android

• Add a screen to view the logs included in a problem report.

Changed

• Upgrade wireguard-go to v0.0.20201118.
• Reduce logging about time outs when conneting to a WireGuard tunnel.

Fixed

Android

• Fix login appearing to be cancelled after leaving the login screen while logging in.
• Fix login input area missing some times when opening the login screen.

This release is for Android only.

Added

• Improve accessibility in the desktop app. UI elements now have the correct role
  and are labeled to allow usage of a screen reader.
• Add --wait flag to connect, disconnect and reconnect CLI subcommands to make the CLI wait
  for the target state to be reached before exiting.
• Navigate back to the main view when escape is pressed.
• Add support for custom DNS resolvers on Windows, macOS and Linux. For now only resolvers in the
  local network will work properly.

Windows

• Add setting that unpins the window from the tray icon to let the user move it around freely.

Changed

• Never use DNS to get the IP to contact the Mullvad API over. Instead a list of IPs is bundled
  with the app, and updates are fetched from the API itself. This list is then shuffled and used
  to pick a way to reach the API. This avoids censored/fake DNS responses and increases the
  likelihood to be able to talk to the API.
• Remove WireGuard keys during uninstallation after the firewall is unlocked.
• Rename CLI subcommand mullvad relay set relay to mullvad relay set hostname.
• Upgrade OpenVPN from 2.4.9 to 2.5.0.
• Upgrade Electron from 8.5.2 to Electron 11.0.2.
• Upgrade wireguard-go to v0.0.20201118.
• Reduce logging about time outs when conneting to a WireGuard tunnel.

Android

• Remove the Quit button.
• Add button to remove account and WireGuard key from history in the login screen.
• Improve navigation in the app using a keyboard, so that touchless devices (like TVs) can be used
  more smoothly.
• Run app in landscape mode on TVs.
• Try to connect even if VPN permission is denied, so that the app shows an error message saying
  that the VPN permission was denied.

Windows

• Fully uninstall the old app when performing a downgrade. This solves the problem of downgrades
  not being able to migrate from something newer. For example it fully removes any blocking
  firewall rules a newer app might have put in place.
• Use Wintun instead of the OpenVPN TAP driver for OpenVPN.

Linux

• Increase NetworkManager device readiness timeout to 15 seconds.
• Set up routes for OpenVPN using our route manager instead of relying on OpenVPN to do it.
• Use rule-based routing and static routes. Avoids monitoring and duplicating the main routing
  table into a separate table.

Fixed

• Fix missing map animation after selecting a new location in the desktop app.
• Fix crash on older kernels which report a default route through the loopback interface.

Android

• Fix connect action button sometimes showing itself as "Cancel" instead of "Secure my connection"
  for a few seconds.
• Fix the notification sometimes leaving the foreground and becoming dismissable even if the UI was
  still visible.
• Fix crash if connection to service is lost while opening the Split Tunneling settings screen.
• Fix rare crash that could occur when the tunnel state changes when showing or hiding the quick
  settings tile.
• Fix app starting by itself sometimes.
• Fix apps not being excluded from the tunnel sometimes if auto-connect was enabled.
• Fix crash that happened sometimes when closing the app or when requesting from the notification
  or the quick-settings tile for the app to connect or disconnect.
• Fix app showing that it was blocking connections when it wasn't when VPN permission was denied.
• Fix internet not working for a minute or two after changing Allow LAN setting.
• Fix login appearing to be cancelled after leaving the login screen while logging in.
• Fix login input area missing some times when opening the login screen.

Windows

• Fix log output encoding for Windows modules.
• Fix app not appearing on top in some situations when pressing the tray icon.
• Fix memory leak in Windows firewall code.

Linux

• Stop reconnecting when using WireGuard and NetworkManager.
• Reset DNS config correctly when the tunnel monitor unexpectedly goes down.
• Set search domains in NetworkManager's DNS configuration, resolving issues where NetworkManager
  is used to manage DNS via systemd-resolved.
• Fix incorrect version string in .deb installer causing downgrade warnings when upgrading from beta
  to stable.
• Fix memory leak in firewall code via updating nftnl dependency.
• Handle IPv6 traffic correctly using mullvad-exclude when there is no default route to any
  non-tunnel interface.
• Fix issues managing DNS when dnsmasq is used with NetworkManager.
• Fix issues with managing kernel WireGuard device via NetworkManager.
• Disable NetworkManager's connectivity check before applying firewall rules to avoid triggering
  NetworkManager's bug

Security

• Restore the last target state if the daemon crashes. Previously, if auto-connect and
  "Always require VPN" were disabled, the service would reset the firewall upon starting back up,
  even if the tunnel was up when the crash occurred.
• Add firewall rules for mullvad-exclude, i.e. split tunneling, that disallow all traffic in the
  tunnel other than non-custom DNS traffic. This prevents leaks into the tunnel.
• Force OpenVPN to use TLS 1.3 or newer.

Windows

• Block all traffic received or sent before the BFE service and daemon service have started during
  boot, if "Always require VPN" or auto-connect is enabled.

This release is identical to 2020.7-beta2, see that change log and 2020.7-beta1 for all changes since last stable release.

This release has no differences for Windows and macOS compared to 2020.6. This release is just to address a number of DNS, routing and other networking issues present on Linux in version 2020.6.

This release is for desktop only. It only has changes for Linux

Fixed

Linux

• Parse routes more permissively and log parsing errors less verbosely.

This release is for desktop only. It only has changes for Linux.

Fixed

Linux

• Order routes by prefix size in ascending order when applying them.
  Fixes an issue where seemingly manually added routes would be returned
  from the kernel in an order which can't be applied.
• If possible, use NetworkManager to create a WireGuard interface so that DNS can be managed
  via NetworkManager as well. This fixes the issue where the daemon will reconnect
  spuriously when using NetworkManager and WireGuard.
• Fix route parsing bug in route monitor by ignoring loopback routes.
• Apply DNS config quicker when managing DNS via NetworkManager.
• When NetworkManager is managing /etc/resolv.conf but ultimately using systemd-resolved, use
  systemd-resolved directly to manage DNS.
• Only use WireGuard kernel implementation if DNS isn't managed via NetworkManager.

Added

• Save application logs to file.
• Add button to reconnect the tunnel.
• Add support for iOS 12.
• Ship the initial relay list with the app, and do once an hour periodic refresh in background.
• Refresh account expiry when visiting settings.

Fixed

• Fix the issue when starting the tunnel could take longer than expected due to the app refreshing
  the relay list before connecting.
• Fix the issue when regenerating the WireGuard key and dismissing the settings at the same
  time could lead to the revoked key still being used by the tunnel, leaving the tunnel unusable.

Changed

• Remove the WireGuard key from the account inside the VPN tunnel during the log out, if VPN is
  active at that time. Before it would always remove it outside the tunnel.
• Turn off WireGuard backend when there are no active network interfaces available. Saves battery.
• Switch from JSON-RPC to REST communication protocol when talking to Mullvad API servers.

This release is for desktop only.

Except for updated GUI translations, the rest is identical to 2020.6-beta3, see that change log for all changes since last stable release.

This release is for desktop only.

Added

Linux

• Add support for WireGuard's kernel module if it's loaded.
• Add tray context menu with actions.

Changed

Linux

• Open and focus app when opened from context menu instead of toggling the window.

Fixed

• Start key rotation when WireGuard key is first created.
• Remove firewall filters (unblock internet access) when "Always require VPN" is enabled and the app
  is uninstalled.

Android

• Fix rare crash that could happen when starting the background service.
• Fix rare crash that happened with large text sizes and long location names on the main screen.
• Fix UI not updating in split screen mode when the window is unfocused.
• Fix split tunneling not being correctly configured after restarting the app.
• Fix app reopening after pressing the Quit button because app was running multiple tasks.
• Fix inconsistent behavior of the quick-settings tile when logged out. It would sometimes enter the
  blocking state and sometimes open the UI for the user to login. Now it always opens the UI.
• Mark the VPN connection as not metered, so that Android properly reports if the connection is or
  isn't metered based solely on the underlying network, and not on the VPN connection.

Linux

• Fix split tunneling rules preventing systemd-resolved from performing DNS lookups for excluded
  processes.
• Honor routes other than the default route with mullvad-exclude. This is mainly to improve
  routing within LANs.

Security

• Stop resetting the firewall after an upgrade to not leak after an upgrade.

This release is for Android only.

Added

• Add CLI command to set the location constraint via mullvad relay set relay HOSTNAME.
• Add a provider relay constraint, which restricts relay selection to a given hosting provider.
• Include hosting providers in the CLI for mullvad relay list and mullvad bridge list.

Changed

• Use gRPC for communication between frontends and the backend instead of JSON-RPC.
• Show a warning in the CLI if the provided location constraints don't match any known relay.

Fixed

• Fix high CPU usage in 2020.6-beta1. This was due to an incorrectly initialized stream in the
  relay list updater.
• Fix the relay list not being updated in 2020.6-beta1 after the daemon has started.

Android

• Fix possible crash when starting the app, caused by trying to use JNI functions before the library
  is loaded.
• Fix crash when selecting the whole text entered for the voucher code and then deleting it in the
  Redeem Voucher dialog.
• Show "Exclude applications" header if needed when entering the "Split tunneling" screen.
• Fix check for update versions and check for support for current version.
• Fix crash that could happen when leaving the Select Location screen.
• Don't show out-of-time notification for newly created accounts.

This release is Android only.

Added

• Show system notification when account has expired.
• Add fish shell completions for the mullvad CLI.
• Reconnect with a new key when WireGuard key is rotated automatically, previously the tunnel would
  time out before reconnecting.

Linux

• Add split tunnelling menu under advanced settings in Linux app.

Android

• Add split-tunnelling, allowing apps to be configured to be excluded from the tunnel.
• Add localized app messages.

Changed

• Upgrade from Electron 7 to Electron 8.
• Change version string parsing to never suggest the user to upgrade to an older version.
• Make connectivity checker more resilient to suspension.
• Make uninstaller on desktop platforms attempt to remove WireGuard keys from accounts.
• Make important notifications not timeout on macOS and remain in the notification list on Linux.
• Add exponential backoff to relay list downloader.
• Display the original block reason in the non-blocking error state, and why applying the blocking
  policy failed.
• Don't show account time expired notification for newly created accounts.

Android

• Show a system notification when the account time will soon run out.
• Changed how the Select Location screen scrolls so that more items can be viewed at the same time.

Windows

• Upgrade Wintun from 0.7 to 0.8.1.
• Display causes of firewall errors in the GUI.

Linux

• Allow users to specify net_cls controller mountpoint via TALPID_NET_CLS_MOUNT_DIR. The
  specified mountpoint will only be used if the controller isn't mounted already.

Fixed

• Fix connectivity monitor for WireGuard not disconnecting from a relay when connectivity is lost.
• Forward firewall errors to the GUI in the connecting state, instead of showing a generic message
  about failing to start the tunnel.

Windows

• Fix window flickering by disabling window animations.
• Fix WireGuard not connecting if IPv6 is disabled in the adapter or OS. libwg would time out
  waiting for an IPv6 interface to become available.

Android

• Fix Connect screen sometimes becoming unusually tall. This ended up causing the screen to be
  scrolled up and made the UI elements unable to be seen until the user scrolled down.
• Fix connect action from quick-settings tile or notification sometimes opening the UI instead of
  connecting.
• Fix notification sometimes not being dismissible.
• Fix toggle switch sometimes getting stuck.

Linux

• Fix systemd-resolved DNS management by not parsing /etc/resolv.conf.
• Fix issue where DNS configuration would not be reset when NetworkManager was used and the daemon
  was stopped ungracefully. This persisted after reboots.

Added

• Add Korean, Polish and Thai languages to the desktop app.

The rest is identical to 2020.5-beta2, see that change log for all changes since last stable release.

Added

Android

• Add buttons to buy credit and redeem voucher in Account screen.
• Show a notification banner warning when the account time will soon run out.

Changed

• Send an ICMP reject message or TCP reset packet when blocking outgoing packets to prevent
  timeouts.

macOS

• Use SCNetworkReachability to help determine connectivity of host. Helps bring the app online
  faster when the computer wakes up from sleep.

Android

• Show the remaining account time in the Settings screen in days if it's less than 3 months.
• Prevent commands to connect or disconnect to be sent when the device is locked.
• Make all screens scrollable to better handle small screens and split-screen mode.

Fixed

• Show both WireGuard and OpenVPN servers in location list when protocol is set to automatic on
  Linux and macOS.
• Fix missing in app notification about unsupported version.
• Prevent auto-connect on login if the account is out of time.
• Fix race that caused WireGuard key upload to fail which could cause the "too many keys" error and
  the tunnel to invalidly fall back to OpenVPN.

Android

• Fix crash when that happened sometimes when the app tried to start the daemon service on recent
  Android versions.
• Fix quitting the app sometimes failing.
• Fix WireGuard key status events being lost by the UI, causing stale information to be shown.
• Fix time left in account not showing in settings screen.
• Fix attempt to connect when the app doesn't have the VPN permission.
• Fix crash that happened sometimes when the WireGuard key was loaded too quickly.
• Fix crash when entering split-screen mode whilst on the Report a Problem screen.
• Fix invalid back stack history when connection to service is lost and the app returns to the
  launch screen.
• Fix app leaving settings screen when entering split-screen mode.
• Fix app sometimes leaving Welcome screen prematurely after creating an account.

Windows

• Fix race in network adapter monitor that could result in data corruption and crashes.
• Upgrade miow dependency to stop daemon from crashing when the management interface named pipes
  were accessed with accesschk.exe and some web browsers.
• Fix race that may rarely occur during install when obtaining the GUID of a newly created TAP
  adapter.

Security

• Tighten the firewall rules that were allowing traffic to the relay server over the physical
  network interface. On Linux and macOS now only processes running under root are allowed to send
  traffic to this port and IP. On Windows only the Mullvad VPN binaries are allowed to send.
  This fixes audit ticket MUL-02-002.

Windows

• Tighten the firewall rule allowing traffic on port 53 to the relay server IP on the physical
  interfaces if the VPN tunnel is established on port 53 to only allow UDP. This fixes
  audit ticket MUL-02-004.
• Deny access to the management interface named pipe for the NT AUTHORITY\NETWORK group.
  This makes the named pipe no longer accessible under the IPC$ network share.
  This fixes audit ticket MUL-02-007.

Android

• Ignore touch events when another view is shown on top of the app in order to prevent tapjacking
  attacks. Fixes audit ticket MUL-02-003.
• Prevent screens showing potentially sensitive data from being recorded. Fixes audit
  ticket MUL-02-003.

This release is Android only

Added

• Add a new Let's Encrypt root certificate.

Android

• Add possibility to create account from the login screen.
• Add welcome screen for newly created accounts.
• Allow submitting voucher codes to add time to the account.
• Add Out Of Time screen for user to add more time to account once it expires.

Changed

• Move location of the account data (including the WireGuard keys), so that it isn't lost when the
  system cache is cleaned.
• Rename "Block when disconnected" setting to "Always require VPN" and add additional explanation
  of the setting.
• Embed TLS certificates used for HTTPS into the binary rather than loading them from disk at
  runtime.
• Ignore case when setting the relay or bridge location in the CLI.
• Upgrade OpenVPN from 2.4.8 to 2.4.9 and the OpenSSL version it uses from 1.1.1d to 1.1.1g.
• Upgrade shadowsocks-rust to version 1.8.10.
• Always enable the beta program when running a beta version.
• Increase relay list download failure retry interval from 5 to 15 minutes. And from 5 seconds
  to 15 minutes for the WireGuard key rotation retry interval.

Android

• Adjust the minimum supported Android version to correctly reflect the supported versions decided
  in 2020.4-beta2. The app will now only install on Android 7 and later (API level 24).

Fixed

Android

• Fix crash when leaving WireGuard Key screen while key is still verifying.
• Fix crash that sometimes happens right after some other unrelated crash.
• Fix app not connecting when pressing the notification or quick-settings tile when the service
  isn't running. It would previously just open the app UI and stay in the disconnected state.
• Fix crash when requesting to connect from notification or quick-settings tile.
• Fix version update notifications not appearing.
• Fix UI losing any settings updates that happen after leaving the app and then coming back.
• Fix account expiration date disappearing in some circumstances.
• Fix notification reappearing after quitting the application.
• Retry when fetching account expiration fails.

This release is for desktop only. This release is identical to 2020.4-beta4.

For the changes since last stable release see the changelogs for all the betas since then:

• 2020.4-beta1.
• 2020.4-beta2.
• 2020.4-beta3.
• 2020.4-beta4.

Fixed

• Fix bogus or absent update notifications on the desktop app due to incorrect deserialization of a
  struct sent from the daemon.

Android

• App will now use packaged relay list if it's newer than the cached one.
• Fix relay list sort order

Windows

• Remove all log files on uninstall. Clear install.log on upgrades.

Added

• Add shell completions for the mullvad CLI. Installed for bash and zsh on Linux and zsh on macOS.

Changed

• Downgrade to Electron 7 due to issues with tray icon in Electron 8.
• Use rustls instead of OpenSSL for TLS encryption to the API and GeoIP location service.

Windows

• When required, attempt to enable IPv6 for network adapters instead of failing.

Android

• Update the WireGuard Key screen so that it looks the same as on the desktop app. It is now reached
  through the Advanced settings screen.

Fixed

• Enable IPv6 in WireGuard regardless of the specified MTU value, previously IPv6 was disabled if
  the MTU was below 1380.

Windows

• Improve offline detection logic.
• Enable missing IPv6 interface on the WireGuard TUN adapter when it has been disabled.

Android

• Change button colors on problem report no email confirmation dialog to match the desktop version.
• Fix crash when attempting to run app from the non-default location, such as the SD card or from a
  different user profile.

Security

macOS

• Ship native Node modules unpacked to prevent malware checks by macOS on each run. The malware
  checks delayed app startup when "block when disconnected" was enabled and performed system network
  requests to Apple.

Android

• Fix failure to create tunnel when app is started with auto-connect enabled. This would sometimes
  lead to a traffic leak.