agd

type ArgumentError struct {
	// Name is the name of the argument.
	Name string

	// Message is an optional additional message.
	Message string
}

type BlockPageRedirect struct {
	// Apply defines request parameters based on which the block page is shown
	// always.  If a request matches Apply, both [BlockPageRedirect.Skip] and
	// [BlockPageRedirect.Probability] are ignored.
	//
	// If [BlockPageRedirect.Enabled] is true, Apply must not be nil.
	Apply *BlockPageRedirectApply

	// Skip defines request parameters based on which the block page is not
	// shown, regardless of [BlockPageRedirect.Probability].
	//
	// If [BlockPageRedirect.Enabled] is true, Skip must not be nil.
	Skip *BlockPageRedirectSkip

	// IPv4 are the IPv4 addresses of the block page, used to respond to A
	// queries.
	//
	// If [BlockPageRedirect.Enabled] is true, IPv4, [BlockPageRedirect.IPv6],
	// or both must be filled.
	IPv4 []netip.Addr

	// IPv6 are the IPv6 addresses of the block page, used to respond to AAAA
	// queries.
	//
	// If [BlockPageRedirect.Enabled] is true, [BlockPageRedirect.IPv4], IPv6,
	// or both must be filled.
	IPv6 []netip.Addr

	// Probability defines the probability of responding with the block page IPs
	// based on remote address.  Probability must be between 0.0 and 1.0.
	Probability Probability

	// Enabled defines whether the block-page feature is enabled.
	Enabled bool
}

type BlockPageRedirectApply struct {
	// ClientSubnets are the subnets for which block page is always enabled.
	ClientSubnets []netip.Prefix
}

type BlockPageRedirectSkip struct {
	// ClientSubnets are the subnets for which block page is always disabled.
	ClientSubnets []netip.Prefix

	// QuestionDomains are the domain names for which block page is always
	// disabled.
	QuestionDomains []string
}

type BlockedServiceID string

type DDR struct {
	// DeviceTargets is the set of all domain names, subdomains of which should
	// be checked for DDR queries with device IDs.
	DeviceTargets *stringutil.Set

	// PublicTargets is the set of all public domain names, DDR queries for
	// which should be processed.
	PublicTargets *stringutil.Set

	// DeviceRecordTemplates are used to respond to DDR queries from recognized
	// devices.
	DeviceRecordTemplates []*dns.SVCB

	// PubilcRecordTemplates are used to respond to DDR queries from
	// unrecognized devices.
	PublicRecordTemplates []*dns.SVCB

	// Enabled shows if DDR queries are processed.  If it is false, DDR domain
	// name queries receive an NXDOMAIN response.
	Enabled bool
}

type DNSCryptConfig struct {
	// Cert is the DNSCrypt certificate.
	Cert *dnscrypt.Cert

	// ProviderName is the name of the DNSCrypt provider.
	ProviderName string
}

type DayRange struct {
	Start uint16
	End   uint16
}

type Device struct {
	// ID is the unique ID of the device.
	ID DeviceID

	// LinkedIP, when non-empty, allows AdGuard DNS to identify a device by its
	// IP address when it can only use plain DNS.
	LinkedIP netip.Addr

	// Name is the human-readable name of the device.
	Name DeviceName

	// DedicatedIPs are the destination (server) IP-addresses dedicated to this
	// device, if any.  A device can use one of these addresses as a DNS server
	// address for AdGuard DNS to recognize it.
	DedicatedIPs []netip.Addr

	// FilteringEnabled defines whether queries from the device should be
	// filtered in any way at all.
	FilteringEnabled bool
}

type DeviceID string

type DeviceName string

type ECS struct {
	// Location is the GeoIP location data about the IP address from the
	// request's ECS data, if any.
	Location *geoip.Location

	// Subnet is the source subnet.
	Subnet netip.Prefix

	// Scope is the scope prefix.
	Scope uint8
}

type FilterListID string

type FilterRuleText string

type FilteringGroup struct {
	// ID is the unique ID of this filtering group.
	ID FilteringGroupID

	// RuleListIDs are the filtering rule list IDs used for this filtering
	// group.  They are ignored if RuleListsEnabled is false.
	RuleListIDs []FilterListID

	// RuleListsEnabled shows whether the rule-list based filtering is enabled.
	// This must be true in order for all parameters below to work.
	RuleListsEnabled bool

	// ParentalEnabled shows whether the parental protection functionality is
	// enabled.  This must be true in order for all parameters below to
	// work.
	ParentalEnabled bool

	// BlockAdult shows whether the adult content blocking safe browsing
	// filtering should be enforced.
	BlockAdult bool

	// SafeBrowsingEnabled shows whether the general safe browsing filtering
	// should be enforced.
	SafeBrowsingEnabled bool

	// BlockDangerousDomains shows whether the dangerous domains safe browsing
	// filtering should be enforced.
	BlockDangerousDomains bool

	// BlockNewlyRegisteredDomains shows whether the newly registered domains
	// safe browsing filtering should be enforced.
	BlockNewlyRegisteredDomains bool

	// GeneralSafeSearch shows whether the general safe search filtering should
	// be enforced.
	GeneralSafeSearch bool

	// YoutubeSafeSearch shows whether the YouTube safe search filtering should
	// be enforced.
	YoutubeSafeSearch bool

	// BlockPrivateRelay shows if Apple Private Relay is blocked for requests
	// using this filtering group.
	BlockPrivateRelay bool

	// BlockFirefoxCanary shows if Firefox canary domain is blocked for
	// requests using this filtering group.
	BlockFirefoxCanary bool
}

type FilteringGroupID string

type ParentalProtectionSchedule struct {
	// Week is the parental protection schedule for every day of the week.
	Week *WeeklySchedule

	// TimeZone is the profile's time zone.
	TimeZone *agdtime.Location
}

type ParentalProtectionSettings struct {
	Schedule *ParentalProtectionSchedule

	// BlockedServices are the IDs of the services blocked for this profile.
	BlockedServices []BlockedServiceID

	// Enabled tells whether the parental protection should be enabled at all.
	// This must be true in order for all parameters below to work.
	Enabled bool

	// BlockAdult tells if AdGuard DNS should enforce blocking of adult content
	// using the safe browsing filter.
	BlockAdult bool

	// GeneralSafeSearch tells if AdGuard DNS should enforce general safe search
	// in most search engines.
	GeneralSafeSearch bool

	// YoutubeSafeSearch tells if AdGuard DNS should enforce safe search on
	// YouTube.
	YoutubeSafeSearch bool
}

type Probability float64

type Profile struct {
	// Parental are the parental settings for this profile.  They are ignored if
	// FilteringEnabled is set to false.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	Parental *ParentalProtectionSettings

	// SafeBrowsing are the safe browsing settings for this profile.  They are
	// ignored if FilteringEnabled is set to false.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	SafeBrowsing *SafeBrowsingSettings

	// Access is the access manager for this profile.  Access is never nil.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	Access access.Profile

	// BlockingMode defines the way blocked responses are constructed.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	BlockingMode dnsmsg.BlockingMode

	// ID is the unique ID of this profile.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	ID ProfileID

	// UpdateTime shows the last time this profile was updated from the backend.
	// This is NOT the time of update in the backend's database, since the
	// backend doesn't send this information.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	UpdateTime time.Time

	// DeviceIDs are the IDs of devices attached to this profile.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	DeviceIDs []DeviceID

	// RuleListIDs are the IDs of the filtering rule lists enabled for this
	// profile.  They are ignored if FilteringEnabled or RuleListsEnabled are
	// set to false.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	RuleListIDs []FilterListID

	// CustomRules are the custom filtering rules for this profile.  They are
	// ignored if RuleListsEnabled is set to false.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	CustomRules []FilterRuleText

	// FilteredResponseTTL is the time-to-live value used for responses sent to
	// the devices of this profile.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	FilteredResponseTTL time.Duration

	// FilteringEnabled defines whether queries from devices of this profile
	// should be filtered in any way at all.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	FilteringEnabled bool

	// RuleListsEnabled defines whether queries from devices of this profile
	// should be filtered using the filtering rule lists in RuleListIDs.
	// Requires FilteringEnabled to be set to true.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	RuleListsEnabled bool

	// QueryLogEnabled defines whether query logs should be saved for the
	// devices of this profile.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	QueryLogEnabled bool

	// Deleted shows if this profile is deleted.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	Deleted bool

	// BlockPrivateRelay shows if Apple Private Relay queries are blocked for
	// requests from all devices in this profile.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	BlockPrivateRelay bool

	// BlockFirefoxCanary shows if Firefox canary domain is blocked for
	// requests from all devices in this profile.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	BlockFirefoxCanary bool

	// IPLogEnabled shows if client IP addresses are logged.
	//
	// NOTE: Do not change fields of this structure without incrementing
	// [internal/profiledb/internal.FileCacheVersion].
	IPLogEnabled bool
}

type ProfileID string

type Protocol = dnsserver.Protocol

type QUICConfig struct {
	// MaxStreamsPerPeer is the maximum number of concurrent streams that a peer
	// is allowed to open.
	MaxStreamsPerPeer int

	// QUICLimitsEnabled, if true, enables QUIC limiting.
	QUICLimitsEnabled bool
}

type RequestID [RequestIDLen]byte

type RequestInfo struct {
	// Device is the found device.  It is nil for anonymous requests.  If Device
	// is present then Profile is also present.
	Device *Device

	// Profile is the found profile.  It is nil for anonymous requests.  If
	// Profile is present then Device is also present.
	Profile *Profile

	// Location is the GeoIP location data about the remote IP address, if any.
	Location *geoip.Location

	// ECS contains the EDNS Client Subnet option information of the request, if
	// any.
	ECS *ECS

	// FilteringGroup is the server's default filtering group.
	FilteringGroup *FilteringGroup

	// Messages is the message constructor to be used for the filtered responses
	// to this request.
	Messages *dnsmsg.Constructor

	// RemoteIP is the remote IP address of the client.
	RemoteIP netip.Addr

	// ServerGroup is the name of the server group which handles this request.
	ServerGroup ServerGroupName

	// Server is the name of the server which handles this request.
	Server ServerName

	// Host is the lowercased, non-FQDN version of the hostname from the
	// question of the request.
	Host string

	// ID is the unique ID of the request.  It is resurfaced here to optimize
	// context lookups.
	ID RequestID

	// QType is the type of question for this request.
	QType dnsmsg.RRType

	// QClass is the class of question for this request.
	QClass dnsmsg.Class

	// Proto is the protocol by which this request is made.
	Proto Protocol
}

type SafeBrowsingSettings struct {
	// Enabled defines whether queries from devices of this profile should be
	// filtered using the safe browsing filter.  This must be true in order for
	// all parameters below to work.
	Enabled bool

	// BlockDangerousDomains shows whether the dangerous domains safe browsing
	// filtering should be enforced.
	BlockDangerousDomains bool

	// BlockNewlyRegisteredDomains shows whether the newly registered domains
	// safe browsing filtering should be enforced.
	BlockNewlyRegisteredDomains bool
}

type Server struct {
	// DNSCrypt are the DNSCrypt settings for this server, if any.
	DNSCrypt *DNSCryptConfig

	// TLS is the TLS configuration for this server, if any.
	TLS *tls.Config

	// QUICConf is the QUIC configuration for this server.
	QUICConf *QUICConfig

	// TCPConf is the TCP configuration for this server.
	TCPConf *TCPConfig

	// UDPConf is the UDP configuration for this server.
	UDPConf *UDPConfig

	// Name is the unique name of the server.  Not to be confused with a TLS
	// Server Name.
	Name ServerName

	// ReadTimeout defines the timeout for any read from a UDP connection or the
	// first read from a TCP/TLS connection.  It currently doesn't affect
	// DNSCrypt, QUIC, or HTTPS.
	//
	// TODO(a.garipov): Make it work for DNSCrypt, QUIC, and HTTPS.
	ReadTimeout time.Duration `yaml:"read_timeout"`

	// WriteTimeout defines the timeout for writing to a UDP or TCP/TLS
	// connection.  It currently doesn't affect DNSCrypt, QUIC, or HTTPS.
	//
	// TODO(a.garipov): Make it work for DNSCrypt, QUIC, and HTTPS.
	WriteTimeout time.Duration `yaml:"write_timeout"`

	// Protocol is the protocol of the server.
	Protocol Protocol

	// LinkedIPEnabled shows if the linked IP addresses should be used to detect
	// profiles on this server.
	LinkedIPEnabled bool
	// contains filtered or unexported fields
}

type ServerBindData struct {
	ListenConfig netext.ListenConfig
	PrefixAddr   *agdnet.PrefixNetAddr

	AddrPort netip.AddrPort
}

type ServerGroup struct {
	// BlockPageRedirect is the configuration for the server group's block page.
	// BlockPageRedirect is never nil.
	//
	// TODO(a.garipov): Use.
	BlockPageRedirect *BlockPageRedirect

	// DDR is the configuration for the server group's Discovery Of Designated
	// Resolvers (DDR) handlers.  DDR is never nil.
	DDR *DDR

	// TLS are the TLS settings for this server group.  If Servers contains at
	// least one server with a non-plain protocol (see [Protocol.IsPlain]), TLS
	// must not be nil.
	TLS *TLS

	// Name is the unique name of the server group.
	Name ServerGroupName

	// FilteringGroup is the ID of the filtering group for this server.
	FilteringGroup FilteringGroupID

	// Servers are the settings for servers.  Each element must be non-nil.
	Servers []*Server
}

type ServerGroupName string

type ServerName string

type TCPConfig struct {
	// IdleTimeout defines the timeout for consecutive reads from a TCP/TLS
	// connection.
	IdleTimeout time.Duration

	// MaxPipelineCount is the maximum number of simultaneously processing TCP
	// messages per one connection.  If MaxPipelineEnabled is true, it must be
	// greater than zero.
	MaxPipelineCount uint

	// MaxPipelineEnabled, if true, enables TCP pipeline limiting.
	MaxPipelineEnabled bool
}

type TLS struct {
	// Conf is the server's TLS configuration.
	Conf *tls.Config

	// DeviceIDWildcards are the domain wildcards used to detect device IDs from
	// clients' server names.
	DeviceIDWildcards []string

	// SessionKeys are paths to files containing the TLS session keys for this
	// server.
	SessionKeys []string
}

type UDPConfig struct {
	// MaxRespSize is the maximum size in bytes of DNS response over UDP
	// protocol.
	MaxRespSize uint16
}

type WeeklySchedule [7]DayRange