diff --git a/app/README.md b/app/README.md
new file mode 100644
index 0000000..5080ab2
--- /dev/null
+++ b/app/README.md
@@ -0,0 +1,17 @@
+## Build
+```
+cd core
+go get -v golang.org/x/mobile/bind
+gomobile bind -target android -v
+if [[ $? -ne 0 ]]; then
+    echo "build error"
+    exit 9
+fi
+echo "build ok"
+cp openp2p.aar openp2p-sources.jar ../app/app/libs
+echo "copy to APP libs"
+
+cd ../app
+./gradlew build
+
+```
\ No newline at end of file
diff --git a/core/config.go b/core/config.go
index 488b204..6eb48f7 100644
--- a/core/config.go
+++ b/core/config.go
@@ -128,10 +128,13 @@ func (c *Config) load() error {
 	return err
 }
 
+// TODO: deal with multi-thread r/w
 func (c *Config) setToken(token uint64) {
 	c.mtx.Lock()
 	defer c.mtx.Unlock()
-	c.Network.Token = token
+	if token != 0 {
+		c.Network.Token = token
+	}
 }
 func (c *Config) setUser(user string) {
 	c.mtx.Lock()
@@ -229,7 +232,7 @@ func parseParams(subCommand string) {
 			gConf.Network.TCPPort = *tcpPort
 		}
 		if f.Name == "token" {
-			gConf.Network.Token = *token
+			gConf.setToken(*token)
 		}
 	})
 
diff --git a/core/handlepush.go b/core/handlepush.go
index 8c23bdc..9a900a6 100644
--- a/core/handlepush.go
+++ b/core/handlepush.go
@@ -9,6 +9,8 @@ import (
 	"os/exec"
 	"path/filepath"
 	"time"
+
+	"github.com/openp2p-cn/totp"
 )
 
 func handlePush(pn *P2PNetwork, subType uint16, msg []byte) error {
@@ -40,8 +42,9 @@ func handlePush(pn *P2PNetwork, subType uint16, msg []byte) error {
 			return ErrVersionNotCompatible
 		}
 		// verify totp token or token
-		if VerifyTOTP(req.Token, pn.config.Token, time.Now().Unix()+(pn.serverTs-pn.localTs)) || // localTs may behind, auto adjust ts
-			VerifyTOTP(req.Token, pn.config.Token, time.Now().Unix()) {
+		t := totp.TOTP{Step: totp.RelayTOTPStep}
+		if t.Verify(req.Token, pn.config.Token, time.Now().Unix()+(pn.serverTs-pn.localTs)) || // localTs may behind, auto adjust ts
+			t.Verify(req.Token, pn.config.Token, time.Now().Unix()) {
 			gLog.Printf(LvINFO, "Access Granted\n")
 			config := AppConfig{}
 			config.peerNatType = req.NatType
diff --git a/core/log.go b/core/log.go
index e411c4a..c744981 100644
--- a/core/log.go
+++ b/core/log.go
@@ -67,11 +67,11 @@ func NewLogger(path string, filePrefix string, level LogLevel, maxLogSize int64,
 	os.MkdirAll(logdir, 0777)
 	for lv := range logFileNames {
 		logFilePath := logdir + filePrefix + logFileNames[lv]
-		f, err := os.OpenFile(logFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
+		f, err := os.OpenFile(logFilePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
 		if err != nil {
 			log.Fatal(err)
 		}
-		os.Chmod(logFilePath, 0666)
+		os.Chmod(logFilePath, 0644)
 		logfiles[lv] = f
 		loggers[lv] = log.New(f, "", log.LstdFlags)
 	}
@@ -119,7 +119,7 @@ func (l *logger) checkFile() {
 				backupPath := l.logDir + fname + ".0"
 				os.Remove(backupPath)
 				os.Rename(l.logDir+fname, backupPath)
-				newFile, e := os.OpenFile(l.logDir+fname, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
+				newFile, e := os.OpenFile(l.logDir+fname, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
 				if e == nil {
 					l.loggers[lv].SetOutput(newFile)
 					l.files[lv] = newFile
diff --git a/core/openp2p.go b/core/openp2p.go
index d6c9bb4..e00b805 100644
--- a/core/openp2p.go
+++ b/core/openp2p.go
@@ -53,6 +53,10 @@ func Run() {
 
 	gLog.Println(LvINFO, &gConf)
 	setFirewall()
+	err := setRLimit()
+	if err != nil {
+		gLog.Println(LvINFO, "setRLimit error:", err)
+	}
 	network := P2PNetworkInstance(&gConf.Network)
 	if ok := network.Connect(30000); !ok {
 		gLog.Println(LvERROR, "P2PNetwork login error")
diff --git a/core/p2papp.go b/core/p2papp.go
index 7bb309a..8056ef7 100644
--- a/core/p2papp.go
+++ b/core/p2papp.go
@@ -51,7 +51,7 @@ func (app *p2pApp) listenTCP() error {
 	gLog.Printf(LvDEBUG, "tcp accept on port %d start", app.config.SrcPort)
 	defer gLog.Printf(LvDEBUG, "tcp accept on port %d end", app.config.SrcPort)
 	var err error
-	app.listener, err = net.Listen("tcp4", fmt.Sprintf("0.0.0.0:%d", app.config.SrcPort))
+	app.listener, err = net.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", app.config.SrcPort)) // support tcp4 and tcp6
 	if err != nil {
 		gLog.Printf(LvERROR, "listen error:%s", err)
 		return err
diff --git a/core/p2pnetwork.go b/core/p2pnetwork.go
index 26f064f..c9c6b83 100644
--- a/core/p2pnetwork.go
+++ b/core/p2pnetwork.go
@@ -435,10 +435,10 @@ func (pn *P2PNetwork) newTunnel(t *P2PTunnel, tid uint64, isClient bool) error {
 }
 func (pn *P2PNetwork) init() error {
 	gLog.Println(LvINFO, "init start")
+	pn.wgReconnect.Add(1)
 	go func() { //reconnect at least 5s
-		pn.wgReconnect.Add(1)
-		defer pn.wgReconnect.Done()
 		time.Sleep(NatTestTimeout)
+		pn.wgReconnect.Done()
 	}()
 	var err error
 	for {
@@ -551,6 +551,7 @@ func (pn *P2PNetwork) handleMessage(t int, msg []byte) {
 			gConf.setUser(rsp.User)
 			if len(rsp.Node) >= MinNodeNameLen {
 				gConf.setNode(rsp.Node)
+				pn.config.Node = rsp.Node
 			}
 			gConf.save()
 			pn.localTs = time.Now().Unix()
diff --git a/core/protocol.go b/core/protocol.go
index 6eb73c8..a4c3ee4 100644
--- a/core/protocol.go
+++ b/core/protocol.go
@@ -10,7 +10,7 @@ import (
 	"time"
 )
 
-const OpenP2PVersion = "3.5.6"
+const OpenP2PVersion = "3.6.5"
 const ProductName string = "openp2p"
 const LeastSupportVersion = "3.0.0"
 
diff --git a/core/util_darwin.go b/core/util_darwin.go
index 3b0f123..6a10f37 100644
--- a/core/util_darwin.go
+++ b/core/util_darwin.go
@@ -21,7 +21,7 @@ func setRLimit() error {
 	if err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, &limit); err != nil {
 		return err
 	}
-	limit.Cur = 10240
+	limit.Cur = 65536
 	if err := syscall.Setrlimit(syscall.RLIMIT_NOFILE, &limit); err != nil {
 		return err
 	}
diff --git a/core/util_linux.go b/core/util_linux.go
index 6b3951b..a918596 100644
--- a/core/util_linux.go
+++ b/core/util_linux.go
@@ -64,7 +64,7 @@ func setRLimit() error {
 	if err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, &limit); err != nil {
 		return err
 	}
-	limit.Max = 1024 * 1024
+	limit.Max = 65536
 	limit.Cur = limit.Max
 	if err := syscall.Setrlimit(syscall.RLIMIT_NOFILE, &limit); err != nil {
 		return err
diff --git a/go.mod b/go.mod
index 3c9157e..eeab426 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ require (
 	github.com/lucas-clemente/quic-go v0.27.0
 	github.com/openp2p-cn/go-reuseport v0.3.2
 	github.com/openp2p-cn/service v1.0.0
+	github.com/openp2p-cn/totp v0.0.0-20230102121327-8e02f6b392ed
 	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f
 )
 
@@ -24,5 +25,6 @@ require (
 	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
 	golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect
 	golang.org/x/tools v0.1.12 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 )