2021.4-beta1

This release is for desktop only.

Added

• When MULLVAD_MANAGEMENT_SOCKET_GROUP is set, only allow the specified group to access the
  management interface UDS socket. This means that only users in that group can use the CLI and GUI.
• Support WireGuard over TCP for custom VPN relays in the CLI. (Our relays don't support this yet).
• Make app native on Apple Silicon.
• Support WireGuard multihop using an entry endpoint constraint in the CLI.
• Add Ad and tracker blocking to the desktop app. Implemented via DNS on the relays.

Windows

• Add split tunneling as a beta feature. Allows excluding some applications from the VPN tunnel.

Android

• Added support of adaptive icons (available only from Android 8).

Changed

• Upgrade OpenVPN from 2.5.0 to 2.5.1.
• Replace CLI command mullvad custom-dns with the new command mullvad dns.
• Upgrade wireguard-go to 20210521230051 (Windows: v0.3.14)

Linux

• Only allow packets with the mark set to 0x6d6f6c65 to communicate with the relay server.
  Previously, bridges were expected to run as root instead.
• Use an ICMP socket instead of relying on a ping binary in $PATH to establish if a tunnel is
  working.

Android

• Improve stability by running the UI and the tunnel management logic in separate processes.
• Remove dialog warning that only custom local DNS servers are supported, since public custom DNS
  servers are now supported.

macOS

• Update shape of macOS icon to be in line with Apple's guidelines.

Fixed

• Fix relay selection failing to pick a WireGuard relay when no tunnel protocol is specified.
• Fix time left not always being translated in desktop app settings.
• Fix API address cache to use the supplied ports instead of always using port 443.
• Do not try to parse an empty account history.

Windows

• Prevent tray icons from being extracted to %TEMP% directory.
• Fix failure to create Wintun adapter due to a residual network interface by upgrading Wintun to
  0.10.4.
• Wait indefinitely for IP interfaces to attach to the tunnel device to prevent early timeouts,
  and errors setting interface metrics.
• Prevent Microsoft Store from dropping packets in WireGuard tunnels.

Linux

• Fix find mullvad-vpn.desktop in XDG_DATA_DIRS instead of using hardcoded path.

MacOS

• Set correct permissions for daemon's launch file in installer.
• Fix downgrades on macOS silently keeping previous version.
• Fix other menubar context menus not always closing when opening app on macOS 11.

Android

• Fix UI sometimes not updating correctly while no split screen or after having a dialog from
  another app appear on top.
• Fix request to connect from notification or quick-settings tile not connecting if VPN permission
  isn't granted to the app. The app will now show the UI to ask for the permission and correctly
  connect after it is granted.
• Fix quick-settings tile sometimes showing the wrong tunnel state.
• Fix TV-only apps not appearing in the Split Tunneling screen.

Security

Linux

• Drop packets being forwarded unless they are approved by the same rules as incoming or outgoing
  traffic.