From 4bca2df4a29b18e630df955694e5eb39afda7601 Mon Sep 17 00:00:00 2001
From: cd-amn <cd@amnezia.org>
Date: Thu, 7 May 2026 15:26:01 +0400
Subject: [PATCH] feat: revoke old endpoint from KS allowlist after server
 switch

---
 client/core/vpnTrafficGuard.cpp | 16 ++++++++++++++++
 client/core/vpnTrafficGuard.h   |  3 ++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/client/core/vpnTrafficGuard.cpp b/client/core/vpnTrafficGuard.cpp
index c8694ad36..6436f3ccb 100644
--- a/client/core/vpnTrafficGuard.cpp
+++ b/client/core/vpnTrafficGuard.cpp
@@ -35,6 +35,9 @@ bool VpnTrafficGuard::allowEndpoint(const QString &remoteAddress)
     if (remoteAddress.isEmpty()) {
         return false;
     }
+    if (!m_allowedEndpoints.contains(remoteAddress)) {
+        m_allowedEndpoints.append(remoteAddress);
+    }
     return IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
         QRemoteObjectPendingReply<bool> reply = iface->addKillSwitchAllowedRange(QStringList(remoteAddress));
         return reply.waitForFinished(1000) && reply.returnValue();
@@ -45,6 +48,18 @@ bool VpnTrafficGuard::allowEndpoint(const QString &remoteAddress)
 #endif
 }
 
+void VpnTrafficGuard::revokeEndpoint(const QString &remoteAddress)
+{
+#ifdef AMNEZIA_DESKTOP
+    m_allowedEndpoints.removeAll(remoteAddress);
+    IpcClient::withInterface([this](QSharedPointer<IpcInterfaceReplica> iface) {
+        iface->resetKillSwitchAllowedRange(m_allowedEndpoints);
+    });
+#else
+    Q_UNUSED(remoteAddress)
+#endif
+}
+
 void VpnTrafficGuard::setupRoutes(const QJsonObject &vpnConfiguration, const QSharedPointer<VpnProtocol> &protocol, const QString &remoteAddress)
 {
 #ifdef AMNEZIA_DESKTOP
@@ -222,6 +237,7 @@ void VpnTrafficGuard::teardown()
 #ifdef AMNEZIA_DESKTOP
     IpcClient::withInterface([&](QSharedPointer<IpcInterfaceReplica> iface) {
         QRemoteObjectPendingReply<bool> reply = iface->disableKillSwitch();
+        m_allowedEndpoints.clear();
         //TODO: why it takes so long?
         if (!reply.waitForFinished(5000) || !reply.returnValue()) {
             qWarning() << "VpnTrafficGuard::teardown: Failed to disable killswitch";
diff --git a/client/core/vpnTrafficGuard.h b/client/core/vpnTrafficGuard.h
index 0be2de8d2..c56047bce 100644
--- a/client/core/vpnTrafficGuard.h
+++ b/client/core/vpnTrafficGuard.h
@@ -19,13 +19,14 @@ public:
 
     void teardown();
     bool allowEndpoint(const QString &remoteAddress);
+    void revokeEndpoint(const QString &remoteAddress);
     void applyFirewall(const QString &vpnGateway, const QString &vpnLocalAddress);
 private:
     void addSplitTunnelRoutes(const QString &gateway, amnezia::RouteMode mode);
     SecureAppSettingsRepository* m_appSettingsRepository;
     QJsonObject m_config;
     bool m_ipv6RoutingStopped = false;
-
+    QStringList m_allowedEndpoints;
 };
 
 #endif // VPNTRAFFICGUARD_H