Pull request: * all: move internal Go packages to internal/

Merge in DNS/adguard-home from 2234-move-to-internal to master

Squashed commit of the following:

commit d26a288cabeac86f9483fab307677b1027c78524
Author: Eugene Burkov <e.burkov@adguard.com>
Date:   Fri Oct 30 12:44:18 2020 +0300

    * all: move internal Go packages to internal/

    Closes #2234.

internal/dnsforward/access.go

@@ -0,0 +1,206 @@
+package dnsforward
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/AdguardTeam/urlfilter"
+	"github.com/AdguardTeam/urlfilter/filterlist"
+)
+
+type accessCtx struct {
+	lock sync.Mutex
+
+	allowedClients    map[string]bool // IP addresses of whitelist clients
+	disallowedClients map[string]bool // IP addresses of clients that should be blocked
+
+	allowedClientsIPNet    []net.IPNet // CIDRs of whitelist clients
+	disallowedClientsIPNet []net.IPNet // CIDRs of clients that should be blocked
+
+	blockedHostsEngine *urlfilter.DNSEngine // finds hosts that should be blocked
+}
+
+func (a *accessCtx) Init(allowedClients, disallowedClients, blockedHosts []string) error {
+	err := processIPCIDRArray(&a.allowedClients, &a.allowedClientsIPNet, allowedClients)
+	if err != nil {
+		return err
+	}
+
+	err = processIPCIDRArray(&a.disallowedClients, &a.disallowedClientsIPNet, disallowedClients)
+	if err != nil {
+		return err
+	}
+
+	buf := strings.Builder{}
+	for _, s := range blockedHosts {
+		buf.WriteString(s)
+		buf.WriteString("\n")
+	}
+
+	listArray := []filterlist.RuleList{}
+	list := &filterlist.StringRuleList{
+		ID:             int(0),
+		RulesText:      buf.String(),
+		IgnoreCosmetic: true,
+	}
+	listArray = append(listArray, list)
+	rulesStorage, err := filterlist.NewRuleStorage(listArray)
+	if err != nil {
+		return fmt.Errorf("filterlist.NewRuleStorage(): %s", err)
+	}
+	a.blockedHostsEngine = urlfilter.NewDNSEngine(rulesStorage)
+
+	return nil
+}
+
+// Split array of IP or CIDR into 2 containers for fast search
+func processIPCIDRArray(dst *map[string]bool, dstIPNet *[]net.IPNet, src []string) error {
+	*dst = make(map[string]bool)
+
+	for _, s := range src {
+		ip := net.ParseIP(s)
+		if ip != nil {
+			(*dst)[s] = true
+			continue
+		}
+
+		_, ipnet, err := net.ParseCIDR(s)
+		if err != nil {
+			return err
+		}
+		*dstIPNet = append(*dstIPNet, *ipnet)
+	}
+
+	return nil
+}
+
+// IsBlockedIP - return TRUE if this client should be blocked
+// Returns the item from the "disallowedClients" list that lead to blocking IP.
+// If it returns TRUE and an empty string, it means that the "allowedClients" is not empty,
+// but the ip does not belong to it.
+func (a *accessCtx) IsBlockedIP(ip string) (bool, string) {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	if len(a.allowedClients) != 0 || len(a.allowedClientsIPNet) != 0 {
+		_, ok := a.allowedClients[ip]
+		if ok {
+			return false, ""
+		}
+
+		if len(a.allowedClientsIPNet) != 0 {
+			ipAddr := net.ParseIP(ip)
+			for _, ipnet := range a.allowedClientsIPNet {
+				if ipnet.Contains(ipAddr) {
+					return false, ""
+				}
+			}
+		}
+
+		return true, ""
+	}
+
+	_, ok := a.disallowedClients[ip]
+	if ok {
+		return true, ip
+	}
+
+	if len(a.disallowedClientsIPNet) != 0 {
+		ipAddr := net.ParseIP(ip)
+		for _, ipnet := range a.disallowedClientsIPNet {
+			if ipnet.Contains(ipAddr) {
+				return true, ipnet.String()
+			}
+		}
+	}
+
+	return false, ""
+}
+
+// IsBlockedDomain - return TRUE if this domain should be blocked
+func (a *accessCtx) IsBlockedDomain(host string) bool {
+	a.lock.Lock()
+	_, ok := a.blockedHostsEngine.Match(host)
+	a.lock.Unlock()
+	return ok
+}
+
+type accessListJSON struct {
+	AllowedClients    []string `json:"allowed_clients"`
+	DisallowedClients []string `json:"disallowed_clients"`
+	BlockedHosts      []string `json:"blocked_hosts"`
+}
+
+func (s *Server) handleAccessList(w http.ResponseWriter, r *http.Request) {
+	s.RLock()
+	j := accessListJSON{
+		AllowedClients:    s.conf.AllowedClients,
+		DisallowedClients: s.conf.DisallowedClients,
+		BlockedHosts:      s.conf.BlockedHosts,
+	}
+	s.RUnlock()
+
+	w.Header().Set("Content-Type", "application/json")
+	err := json.NewEncoder(w).Encode(j)
+	if err != nil {
+		httpError(r, w, http.StatusInternalServerError, "json.Encode: %s", err)
+		return
+	}
+}
+
+func checkIPCIDRArray(src []string) error {
+	for _, s := range src {
+		ip := net.ParseIP(s)
+		if ip != nil {
+			continue
+		}
+
+		_, _, err := net.ParseCIDR(s)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (s *Server) handleAccessSet(w http.ResponseWriter, r *http.Request) {
+	j := accessListJSON{}
+	err := json.NewDecoder(r.Body).Decode(&j)
+	if err != nil {
+		httpError(r, w, http.StatusBadRequest, "json.Decode: %s", err)
+		return
+	}
+
+	err = checkIPCIDRArray(j.AllowedClients)
+	if err == nil {
+		err = checkIPCIDRArray(j.DisallowedClients)
+	}
+	if err != nil {
+		httpError(r, w, http.StatusBadRequest, "%s", err)
+		return
+	}
+
+	a := &accessCtx{}
+	err = a.Init(j.AllowedClients, j.DisallowedClients, j.BlockedHosts)
+	if err != nil {
+		httpError(r, w, http.StatusBadRequest, "access.Init: %s", err)
+		return
+	}
+
+	s.Lock()
+	s.conf.AllowedClients = j.AllowedClients
+	s.conf.DisallowedClients = j.DisallowedClients
+	s.conf.BlockedHosts = j.BlockedHosts
+	s.access = a
+	s.Unlock()
+	s.conf.ConfigModified()
+
+	log.Debug("Access: updated lists: %d, %d, %d",
+		len(j.AllowedClients), len(j.DisallowedClients), len(j.BlockedHosts))
+}

internal/dnsforward/access_test.go

@@ -0,0 +1,73 @@
+package dnsforward
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsBlockedIPAllowed(t *testing.T) {
+	a := &accessCtx{}
+	assert.True(t, a.Init([]string{"1.1.1.1", "2.2.0.0/16"}, nil, nil) == nil)
+
+	disallowed, disallowedRule := a.IsBlockedIP("1.1.1.1")
+	assert.False(t, disallowed)
+	assert.Equal(t, "", disallowedRule)
+
+	disallowed, disallowedRule = a.IsBlockedIP("1.1.1.2")
+	assert.True(t, disallowed)
+	assert.Equal(t, "", disallowedRule)
+
+	disallowed, disallowedRule = a.IsBlockedIP("2.2.1.1")
+	assert.False(t, disallowed)
+	assert.Equal(t, "", disallowedRule)
+
+	disallowed, disallowedRule = a.IsBlockedIP("2.3.1.1")
+	assert.True(t, disallowed)
+	assert.Equal(t, "", disallowedRule)
+}
+
+func TestIsBlockedIPDisallowed(t *testing.T) {
+	a := &accessCtx{}
+	assert.True(t, a.Init(nil, []string{"1.1.1.1", "2.2.0.0/16"}, nil) == nil)
+
+	disallowed, disallowedRule := a.IsBlockedIP("1.1.1.1")
+	assert.True(t, disallowed)
+	assert.Equal(t, "1.1.1.1", disallowedRule)
+
+	disallowed, disallowedRule = a.IsBlockedIP("1.1.1.2")
+	assert.False(t, disallowed)
+	assert.Equal(t, "", disallowedRule)
+
+	disallowed, disallowedRule = a.IsBlockedIP("2.2.1.1")
+	assert.True(t, disallowed)
+	assert.Equal(t, "2.2.0.0/16", disallowedRule)
+
+	disallowed, disallowedRule = a.IsBlockedIP("2.3.1.1")
+	assert.False(t, disallowed)
+	assert.Equal(t, "", disallowedRule)
+}
+
+func TestIsBlockedIPBlockedDomain(t *testing.T) {
+	a := &accessCtx{}
+	assert.True(t, a.Init(nil, nil, []string{"host1",
+		"host2",
+		"*.host.com",
+		"||host3.com^",
+	}) == nil)
+
+	// match by "host2.com"
+	assert.True(t, a.IsBlockedDomain("host1"))
+	assert.True(t, a.IsBlockedDomain("host2"))
+	assert.True(t, !a.IsBlockedDomain("host3"))
+
+	// match by wildcard "*.host.com"
+	assert.True(t, !a.IsBlockedDomain("host.com"))
+	assert.True(t, a.IsBlockedDomain("asdf.host.com"))
+	assert.True(t, a.IsBlockedDomain("qwer.asdf.host.com"))
+	assert.True(t, !a.IsBlockedDomain("asdf.zhost.com"))
+
+	// match by wildcard "||host3.com^"
+	assert.True(t, a.IsBlockedDomain("host3.com"))
+	assert.True(t, a.IsBlockedDomain("asdf.host3.com"))
+}

internal/dnsforward/config.go

@@ -0,0 +1,337 @@
+package dnsforward
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"sort"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
+	"github.com/AdguardTeam/AdGuardHome/internal/util"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/dnsproxy/upstream"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/joomcode/errorx"
+)
+
+// FilteringConfig represents the DNS filtering configuration of AdGuard Home
+// The zero FilteringConfig is empty and ready for use.
+type FilteringConfig struct {
+	// Callbacks for other modules
+	// --
+
+	// Filtering callback function
+	FilterHandler func(clientAddr string, settings *dnsfilter.RequestFilteringSettings) `yaml:"-"`
+
+	// GetCustomUpstreamByClient - a callback function that returns upstreams configuration
+	// based on the client IP address. Returns nil if there are no custom upstreams for the client
+	GetCustomUpstreamByClient func(clientAddr string) *proxy.UpstreamConfig `yaml:"-"`
+
+	// Protection configuration
+	// --
+
+	ProtectionEnabled  bool   `yaml:"protection_enabled"` // whether or not use any of dnsfilter features
+	BlockingMode       string `yaml:"blocking_mode"`      // mode how to answer filtered requests
+	BlockingIPv4       string `yaml:"blocking_ipv4"`      // IP address to be returned for a blocked A request
+	BlockingIPv6       string `yaml:"blocking_ipv6"`      // IP address to be returned for a blocked AAAA request
+	BlockingIPAddrv4   net.IP `yaml:"-"`
+	BlockingIPAddrv6   net.IP `yaml:"-"`
+	BlockedResponseTTL uint32 `yaml:"blocked_response_ttl"` // if 0, then default is used (3600)
+
+	// IP (or domain name) which is used to respond to DNS requests blocked by parental control or safe-browsing
+	ParentalBlockHost     string `yaml:"parental_block_host"`
+	SafeBrowsingBlockHost string `yaml:"safebrowsing_block_host"`
+
+	// Anti-DNS amplification
+	// --
+
+	Ratelimit          uint32   `yaml:"ratelimit"`           // max number of requests per second from a given IP (0 to disable)
+	RatelimitWhitelist []string `yaml:"ratelimit_whitelist"` // a list of whitelisted client IP addresses
+	RefuseAny          bool     `yaml:"refuse_any"`          // if true, refuse ANY requests
+
+	// Upstream DNS servers configuration
+	// --
+
+	UpstreamDNS         []string `yaml:"upstream_dns"`
+	UpstreamDNSFileName string   `yaml:"upstream_dns_file"`
+	BootstrapDNS        []string `yaml:"bootstrap_dns"` // a list of bootstrap DNS for DoH and DoT (plain DNS only)
+	AllServers          bool     `yaml:"all_servers"`   // if true, parallel queries to all configured upstream servers are enabled
+	FastestAddr         bool     `yaml:"fastest_addr"`  // use Fastest Address algorithm
+
+	// Access settings
+	// --
+
+	AllowedClients    []string `yaml:"allowed_clients"`    // IP addresses of whitelist clients
+	DisallowedClients []string `yaml:"disallowed_clients"` // IP addresses of clients that should be blocked
+	BlockedHosts      []string `yaml:"blocked_hosts"`      // hosts that should be blocked
+
+	// DNS cache settings
+	// --
+
+	CacheSize   uint32 `yaml:"cache_size"`    // DNS cache size (in bytes)
+	CacheMinTTL uint32 `yaml:"cache_ttl_min"` // override TTL value (minimum) received from upstream server
+	CacheMaxTTL uint32 `yaml:"cache_ttl_max"` // override TTL value (maximum) received from upstream server
+
+	// Other settings
+	// --
+
+	BogusNXDomain          []string `yaml:"bogus_nxdomain"`     // transform responses with these IP addresses to NXDOMAIN
+	AAAADisabled           bool     `yaml:"aaaa_disabled"`      // Respond with an empty answer to all AAAA requests
+	EnableDNSSEC           bool     `yaml:"enable_dnssec"`      // Set DNSSEC flag in outcoming DNS request
+	EnableEDNSClientSubnet bool     `yaml:"edns_client_subnet"` // Enable EDNS Client Subnet option
+	MaxGoroutines          uint32   `yaml:"max_goroutines"`     // Max. number of parallel goroutines for processing incoming requests
+
+	// IPSET configuration - add IP addresses of the specified domain names to an ipset list
+	// Syntax:
+	// "DOMAIN[,DOMAIN].../IPSET_NAME"
+	IPSETList []string `yaml:"ipset"`
+}
+
+// TLSConfig is the TLS configuration for HTTPS, DNS-over-HTTPS, and DNS-over-TLS
+type TLSConfig struct {
+	TLSListenAddr  *net.TCPAddr `yaml:"-" json:"-"`
+	QUICListenAddr *net.UDPAddr `yaml:"-" json:"-"`
+	StrictSNICheck bool         `yaml:"strict_sni_check" json:"-"` // Reject connection if the client uses server name (in SNI) that doesn't match the certificate
+
+	CertificateChain string `yaml:"certificate_chain" json:"certificate_chain"` // PEM-encoded certificates chain
+	PrivateKey       string `yaml:"private_key" json:"private_key"`             // PEM-encoded private key
+
+	CertificatePath string `yaml:"certificate_path" json:"certificate_path"` // certificate file name
+	PrivateKeyPath  string `yaml:"private_key_path" json:"private_key_path"` // private key file name
+
+	CertificateChainData []byte `yaml:"-" json:"-"`
+	PrivateKeyData       []byte `yaml:"-" json:"-"`
+
+	cert     tls.Certificate // nolint(structcheck) - linter thinks that this field is unused, while TLSConfig is directly included into ServerConfig
+	dnsNames []string        // nolint(structcheck) // DNS names from certificate (SAN) or CN value from Subject
+}
+
+// ServerConfig represents server configuration.
+// The zero ServerConfig is empty and ready for use.
+type ServerConfig struct {
+	UDPListenAddr  *net.UDPAddr          // UDP listen address
+	TCPListenAddr  *net.TCPAddr          // TCP listen address
+	UpstreamConfig *proxy.UpstreamConfig // Upstream DNS servers config
+	OnDNSRequest   func(d *proxy.DNSContext)
+
+	FilteringConfig
+	TLSConfig
+	TLSAllowUnencryptedDOH bool
+
+	TLSv12Roots *x509.CertPool // list of root CAs for TLSv1.2
+	TLSCiphers  []uint16       // list of TLS ciphers to use
+
+	// Called when the configuration is changed by HTTP request
+	ConfigModified func()
+
+	// Register an HTTP handler
+	HTTPRegister func(string, string, func(http.ResponseWriter, *http.Request))
+}
+
+// if any of ServerConfig values are zero, then default values from below are used
+var defaultValues = ServerConfig{
+	UDPListenAddr:   &net.UDPAddr{Port: 53},
+	TCPListenAddr:   &net.TCPAddr{Port: 53},
+	FilteringConfig: FilteringConfig{BlockedResponseTTL: 3600},
+}
+
+// createProxyConfig creates and validates configuration for the main proxy
+func (s *Server) createProxyConfig() (proxy.Config, error) {
+	proxyConfig := proxy.Config{
+		UDPListenAddr:          []*net.UDPAddr{s.conf.UDPListenAddr},
+		TCPListenAddr:          []*net.TCPAddr{s.conf.TCPListenAddr},
+		Ratelimit:              int(s.conf.Ratelimit),
+		RatelimitWhitelist:     s.conf.RatelimitWhitelist,
+		RefuseAny:              s.conf.RefuseAny,
+		CacheMinTTL:            s.conf.CacheMinTTL,
+		CacheMaxTTL:            s.conf.CacheMaxTTL,
+		UpstreamConfig:         s.conf.UpstreamConfig,
+		BeforeRequestHandler:   s.beforeRequestHandler,
+		RequestHandler:         s.handleDNSRequest,
+		EnableEDNSClientSubnet: s.conf.EnableEDNSClientSubnet,
+		MaxGoroutines:          int(s.conf.MaxGoroutines),
+	}
+
+	if s.conf.CacheSize != 0 {
+		proxyConfig.CacheEnabled = true
+		proxyConfig.CacheSizeBytes = int(s.conf.CacheSize)
+	}
+
+	proxyConfig.UpstreamMode = proxy.UModeLoadBalance
+	if s.conf.AllServers {
+		proxyConfig.UpstreamMode = proxy.UModeParallel
+	} else if s.conf.FastestAddr {
+		proxyConfig.UpstreamMode = proxy.UModeFastestAddr
+	}
+
+	if len(s.conf.BogusNXDomain) > 0 {
+		for _, s := range s.conf.BogusNXDomain {
+			ip := net.ParseIP(s)
+			if ip == nil {
+				log.Error("Invalid bogus IP: %s", s)
+			} else {
+				proxyConfig.BogusNXDomain = append(proxyConfig.BogusNXDomain, ip)
+			}
+		}
+	}
+
+	// TLS settings
+	err := s.prepareTLS(&proxyConfig)
+	if err != nil {
+		return proxyConfig, err
+	}
+
+	// Validate proxy config
+	if proxyConfig.UpstreamConfig == nil || len(proxyConfig.UpstreamConfig.Upstreams) == 0 {
+		return proxyConfig, errors.New("no default upstream servers configured")
+	}
+
+	return proxyConfig, nil
+}
+
+// initDefaultSettings initializes default settings if nothing
+// is configured
+func (s *Server) initDefaultSettings() {
+	if len(s.conf.UpstreamDNS) == 0 {
+		s.conf.UpstreamDNS = defaultDNS
+	}
+	if len(s.conf.BootstrapDNS) == 0 {
+		s.conf.BootstrapDNS = defaultBootstrap
+	}
+	if len(s.conf.ParentalBlockHost) == 0 {
+		s.conf.ParentalBlockHost = parentalBlockHost
+	}
+	if len(s.conf.SafeBrowsingBlockHost) == 0 {
+		s.conf.SafeBrowsingBlockHost = safeBrowsingBlockHost
+	}
+	if s.conf.UDPListenAddr == nil {
+		s.conf.UDPListenAddr = defaultValues.UDPListenAddr
+	}
+	if s.conf.TCPListenAddr == nil {
+		s.conf.TCPListenAddr = defaultValues.TCPListenAddr
+	}
+	if len(s.conf.BlockedHosts) == 0 {
+		s.conf.BlockedHosts = defaultBlockedHosts
+	}
+}
+
+// prepareUpstreamSettings - prepares upstream DNS server settings
+func (s *Server) prepareUpstreamSettings() error {
+	// We're setting a customized set of RootCAs
+	// The reason is that Go default mechanism of loading TLS roots
+	// does not always work properly on some routers so we're
+	// loading roots manually and pass it here.
+	// See "util.LoadSystemRootCAs"
+	upstream.RootCAs = s.conf.TLSv12Roots
+
+	// See util.InitTLSCiphers -- removed unsafe ciphers
+	if len(s.conf.TLSCiphers) > 0 {
+		upstream.CipherSuites = s.conf.TLSCiphers
+	}
+
+	// Load upstreams either from the file, or from the settings
+	var upstreams []string
+	if s.conf.UpstreamDNSFileName != "" {
+		data, err := ioutil.ReadFile(s.conf.UpstreamDNSFileName)
+		if err != nil {
+			return err
+		}
+		d := string(data)
+		for len(d) != 0 {
+			s := util.SplitNext(&d, '\n')
+			upstreams = append(upstreams, s)
+		}
+		log.Debug("DNS: using %d upstream servers from file %s", len(upstreams), s.conf.UpstreamDNSFileName)
+	} else {
+		upstreams = s.conf.UpstreamDNS
+	}
+	upstreams = filterOutComments(upstreams)
+	upstreamConfig, err := proxy.ParseUpstreamsConfig(upstreams, s.conf.BootstrapDNS, DefaultTimeout)
+	if err != nil {
+		return fmt.Errorf("DNS: proxy.ParseUpstreamsConfig: %s", err)
+	}
+
+	if len(upstreamConfig.Upstreams) == 0 {
+		log.Info("Warning: no default upstream servers specified, using %v", defaultDNS)
+		uc, err := proxy.ParseUpstreamsConfig(defaultDNS, s.conf.BootstrapDNS, DefaultTimeout)
+		if err != nil {
+			return fmt.Errorf("DNS: failed to parse default upstreams: %v", err)
+		}
+		upstreamConfig.Upstreams = uc.Upstreams
+	}
+
+	s.conf.UpstreamConfig = &upstreamConfig
+	return nil
+}
+
+// prepareIntlProxy - initializes DNS proxy that we use for internal DNS queries
+func (s *Server) prepareIntlProxy() {
+	intlProxyConfig := proxy.Config{
+		CacheEnabled:   true,
+		CacheSizeBytes: 4096,
+		UpstreamConfig: s.conf.UpstreamConfig,
+	}
+	s.internalProxy = &proxy.Proxy{Config: intlProxyConfig}
+}
+
+// prepareTLS - prepares TLS configuration for the DNS proxy
+func (s *Server) prepareTLS(proxyConfig *proxy.Config) error {
+	if len(s.conf.CertificateChainData) == 0 || len(s.conf.PrivateKeyData) == 0 {
+		return nil
+	}
+
+	if s.conf.TLSListenAddr == nil &&
+		s.conf.QUICListenAddr == nil {
+		return nil
+	}
+
+	if s.conf.TLSListenAddr != nil {
+		proxyConfig.TLSListenAddr = []*net.TCPAddr{s.conf.TLSListenAddr}
+	}
+
+	if s.conf.QUICListenAddr != nil {
+		proxyConfig.QUICListenAddr = []*net.UDPAddr{s.conf.QUICListenAddr}
+	}
+
+	var err error
+	s.conf.cert, err = tls.X509KeyPair(s.conf.CertificateChainData, s.conf.PrivateKeyData)
+	if err != nil {
+		return errorx.Decorate(err, "Failed to parse TLS keypair")
+	}
+
+	if s.conf.StrictSNICheck {
+		x, err := x509.ParseCertificate(s.conf.cert.Certificate[0])
+		if err != nil {
+			return errorx.Decorate(err, "x509.ParseCertificate(): %s", err)
+		}
+		if len(x.DNSNames) != 0 {
+			s.conf.dnsNames = x.DNSNames
+			log.Debug("DNS: using DNS names from certificate's SAN: %v", x.DNSNames)
+			sort.Strings(s.conf.dnsNames)
+		} else {
+			s.conf.dnsNames = append(s.conf.dnsNames, x.Subject.CommonName)
+			log.Debug("DNS: using DNS name from certificate's CN: %s", x.Subject.CommonName)
+		}
+	}
+
+	proxyConfig.TLSConfig = &tls.Config{
+		GetCertificate: s.onGetCertificate,
+		MinVersion:     tls.VersionTLS12,
+	}
+
+	return nil
+}
+
+// Called by 'tls' package when Client Hello is received
+// If the server name (from SNI) supplied by client is incorrect - we terminate the ongoing TLS handshake.
+func (s *Server) onGetCertificate(ch *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	if s.conf.StrictSNICheck && !matchDNSName(s.conf.dnsNames, ch.ServerName) {
+		log.Info("DNS: TLS: unknown SNI in Client Hello: %s", ch.ServerName)
+		return nil, fmt.Errorf("invalid SNI")
+	}
+	return &s.conf.cert, nil
+}

internal/dnsforward/dnsforward.go

@@ -0,0 +1,308 @@
+package dnsforward
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"runtime"
+	"sync"
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
+	"github.com/AdguardTeam/AdGuardHome/internal/querylog"
+	"github.com/AdguardTeam/AdGuardHome/internal/stats"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/joomcode/errorx"
+	"github.com/miekg/dns"
+)
+
+// DefaultTimeout is the default upstream timeout
+const DefaultTimeout = 10 * time.Second
+
+const (
+	safeBrowsingBlockHost = "standard-block.dns.adguard.com"
+	parentalBlockHost     = "family-block.dns.adguard.com"
+)
+
+var defaultDNS = []string{
+	"https://dns10.quad9.net/dns-query",
+}
+var defaultBootstrap = []string{"9.9.9.10", "149.112.112.10", "2620:fe::10", "2620:fe::fe:10"}
+
+// Often requested by all kinds of DNS probes
+var defaultBlockedHosts = []string{"version.bind", "id.server", "hostname.bind"}
+
+var webRegistered bool
+
+// Server is the main way to start a DNS server.
+//
+// Example:
+//  s := dnsforward.Server{}
+//  err := s.Start(nil) // will start a DNS server listening on default port 53, in a goroutine
+//  err := s.Reconfigure(ServerConfig{UDPListenAddr: &net.UDPAddr{Port: 53535}}) // will reconfigure running DNS server to listen on UDP port 53535
+//  err := s.Stop() // will stop listening on port 53535 and cancel all goroutines
+//  err := s.Start(nil) // will start listening again, on port 53535, in a goroutine
+//
+// The zero Server is empty and ready for use.
+type Server struct {
+	dnsProxy   *proxy.Proxy          // DNS proxy instance
+	dnsFilter  *dnsfilter.Dnsfilter  // DNS filter instance
+	dhcpServer dhcpd.ServerInterface // DHCP server instance (optional)
+	queryLog   querylog.QueryLog     // Query log instance
+	stats      stats.Stats
+	access     *accessCtx
+
+	ipset ipsetCtx
+
+	tableHostToIP     map[string]net.IP // "hostname -> IP" table for internal addresses (DHCP)
+	tableHostToIPLock sync.Mutex
+
+	tablePTR     map[string]string // "IP -> hostname" table for reverse lookup
+	tablePTRLock sync.Mutex
+
+	// DNS proxy instance for internal usage
+	// We don't Start() it and so no listen port is required.
+	internalProxy *proxy.Proxy
+
+	isRunning bool
+
+	sync.RWMutex
+	conf ServerConfig
+}
+
+// DNSCreateParams - parameters for NewServer()
+type DNSCreateParams struct {
+	DNSFilter  *dnsfilter.Dnsfilter
+	Stats      stats.Stats
+	QueryLog   querylog.QueryLog
+	DHCPServer dhcpd.ServerInterface
+}
+
+// NewServer creates a new instance of the dnsforward.Server
+// Note: this function must be called only once
+func NewServer(p DNSCreateParams) *Server {
+	s := &Server{}
+	s.dnsFilter = p.DNSFilter
+	s.stats = p.Stats
+	s.queryLog = p.QueryLog
+
+	if p.DHCPServer != nil {
+		s.dhcpServer = p.DHCPServer
+		s.dhcpServer.SetOnLeaseChanged(s.onDHCPLeaseChanged)
+		s.onDHCPLeaseChanged(dhcpd.LeaseChangedAdded)
+	}
+
+	if runtime.GOARCH == "mips" || runtime.GOARCH == "mipsle" {
+		// Use plain DNS on MIPS, encryption is too slow
+		defaultDNS = defaultBootstrap
+	}
+	return s
+}
+
+// Close - close object
+func (s *Server) Close() {
+	s.Lock()
+	s.dnsFilter = nil
+	s.stats = nil
+	s.queryLog = nil
+	s.dnsProxy = nil
+	s.Unlock()
+}
+
+// WriteDiskConfig - write configuration
+func (s *Server) WriteDiskConfig(c *FilteringConfig) {
+	s.RLock()
+	sc := s.conf.FilteringConfig
+	*c = sc
+	c.RatelimitWhitelist = stringArrayDup(sc.RatelimitWhitelist)
+	c.BootstrapDNS = stringArrayDup(sc.BootstrapDNS)
+	c.AllowedClients = stringArrayDup(sc.AllowedClients)
+	c.DisallowedClients = stringArrayDup(sc.DisallowedClients)
+	c.BlockedHosts = stringArrayDup(sc.BlockedHosts)
+	c.UpstreamDNS = stringArrayDup(sc.UpstreamDNS)
+	s.RUnlock()
+}
+
+// Resolve - get IP addresses by host name from an upstream server.
+// No request/response filtering is performed.
+// Query log and Stats are not updated.
+// This method may be called before Start().
+func (s *Server) Resolve(host string) ([]net.IPAddr, error) {
+	s.RLock()
+	defer s.RUnlock()
+	return s.internalProxy.LookupIPAddr(host)
+}
+
+// Exchange - send DNS request to an upstream server and receive response
+// No request/response filtering is performed.
+// Query log and Stats are not updated.
+// This method may be called before Start().
+func (s *Server) Exchange(req *dns.Msg) (*dns.Msg, error) {
+	s.RLock()
+	defer s.RUnlock()
+
+	ctx := &proxy.DNSContext{
+		Proto:     "udp",
+		Req:       req,
+		StartTime: time.Now(),
+	}
+	err := s.internalProxy.Resolve(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return ctx.Res, nil
+}
+
+// Start starts the DNS server
+func (s *Server) Start() error {
+	s.Lock()
+	defer s.Unlock()
+	return s.startInternal()
+}
+
+// startInternal starts without locking
+func (s *Server) startInternal() error {
+	err := s.dnsProxy.Start()
+	if err == nil {
+		s.isRunning = true
+	}
+	return err
+}
+
+// Prepare the object
+func (s *Server) Prepare(config *ServerConfig) error {
+	// Initialize the server configuration
+	// --
+	if config != nil {
+		s.conf = *config
+		if s.conf.BlockingMode == "custom_ip" {
+			s.conf.BlockingIPAddrv4 = net.ParseIP(s.conf.BlockingIPv4)
+			s.conf.BlockingIPAddrv6 = net.ParseIP(s.conf.BlockingIPv6)
+			if s.conf.BlockingIPAddrv4 == nil || s.conf.BlockingIPAddrv6 == nil {
+				return fmt.Errorf("DNS: invalid custom blocking IP address specified")
+			}
+		}
+		if s.conf.MaxGoroutines == 0 {
+			s.conf.MaxGoroutines = 50
+		}
+	}
+
+	// Set default values in the case if nothing is configured
+	// --
+	s.initDefaultSettings()
+
+	// Initialize IPSET configuration
+	// --
+	s.ipset.init(s.conf.IPSETList)
+
+	// Prepare DNS servers settings
+	// --
+	err := s.prepareUpstreamSettings()
+	if err != nil {
+		return err
+	}
+
+	// Create DNS proxy configuration
+	// --
+	var proxyConfig proxy.Config
+	proxyConfig, err = s.createProxyConfig()
+	if err != nil {
+		return err
+	}
+
+	// Prepare a DNS proxy instance that we use for internal DNS queries
+	// --
+	s.prepareIntlProxy()
+
+	// Initialize DNS access module
+	// --
+	s.access = &accessCtx{}
+	err = s.access.Init(s.conf.AllowedClients, s.conf.DisallowedClients, s.conf.BlockedHosts)
+	if err != nil {
+		return err
+	}
+
+	// Register web handlers if necessary
+	// --
+	if !webRegistered && s.conf.HTTPRegister != nil {
+		webRegistered = true
+		s.registerHandlers()
+	}
+
+	// Create the main DNS proxy instance
+	// --
+	s.dnsProxy = &proxy.Proxy{Config: proxyConfig}
+	return nil
+}
+
+// Stop stops the DNS server
+func (s *Server) Stop() error {
+	s.Lock()
+	defer s.Unlock()
+	return s.stopInternal()
+}
+
+// stopInternal stops without locking
+func (s *Server) stopInternal() error {
+	if s.dnsProxy != nil {
+		err := s.dnsProxy.Stop()
+		if err != nil {
+			return errorx.Decorate(err, "could not stop the DNS server properly")
+		}
+	}
+
+	s.isRunning = false
+	return nil
+}
+
+// IsRunning returns true if the DNS server is running
+func (s *Server) IsRunning() bool {
+	s.RLock()
+	defer s.RUnlock()
+	return s.isRunning
+}
+
+// Reconfigure applies the new configuration to the DNS server
+func (s *Server) Reconfigure(config *ServerConfig) error {
+	s.Lock()
+	defer s.Unlock()
+
+	log.Print("Start reconfiguring the server")
+	err := s.stopInternal()
+	if err != nil {
+		return errorx.Decorate(err, "could not reconfigure the server")
+	}
+
+	// It seems that net.Listener.Close() doesn't close file descriptors right away.
+	// We wait for some time and hope that this fd will be closed.
+	time.Sleep(100 * time.Millisecond)
+
+	err = s.Prepare(config)
+	if err != nil {
+		return errorx.Decorate(err, "could not reconfigure the server")
+	}
+
+	err = s.startInternal()
+	if err != nil {
+		return errorx.Decorate(err, "could not reconfigure the server")
+	}
+
+	return nil
+}
+
+// ServeHTTP is a HTTP handler method we use to provide DNS-over-HTTPS
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	s.RLock()
+	p := s.dnsProxy
+	s.RUnlock()
+	if p != nil { // an attempt to protect against race in case we're here after Close() was called
+		p.ServeHTTP(w, r)
+	}
+}
+
+// IsBlockedIP - return TRUE if this client should be blocked
+func (s *Server) IsBlockedIP(ip string) (bool, string) {
+	return s.access.IsBlockedIP(ip)
+}

internal/dnsforward/dnsforward_http.go

@@ -0,0 +1,481 @@
+package dnsforward
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/AdguardTeam/dnsproxy/upstream"
+	"github.com/AdguardTeam/golibs/jsonutil"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/AdguardTeam/golibs/utils"
+	"github.com/miekg/dns"
+)
+
+func httpError(r *http.Request, w http.ResponseWriter, code int, format string, args ...interface{}) {
+	text := fmt.Sprintf(format, args...)
+	log.Info("DNS: %s %s: %s", r.Method, r.URL, text)
+	http.Error(w, text, code)
+}
+
+type dnsConfigJSON struct {
+	Upstreams     []string `json:"upstream_dns"`
+	UpstreamsFile string   `json:"upstream_dns_file"`
+	Bootstraps    []string `json:"bootstrap_dns"`
+
+	ProtectionEnabled bool   `json:"protection_enabled"`
+	RateLimit         uint32 `json:"ratelimit"`
+	BlockingMode      string `json:"blocking_mode"`
+	BlockingIPv4      string `json:"blocking_ipv4"`
+	BlockingIPv6      string `json:"blocking_ipv6"`
+	EDNSCSEnabled     bool   `json:"edns_cs_enabled"`
+	DNSSECEnabled     bool   `json:"dnssec_enabled"`
+	DisableIPv6       bool   `json:"disable_ipv6"`
+	UpstreamMode      string `json:"upstream_mode"`
+	CacheSize         uint32 `json:"cache_size"`
+	CacheMinTTL       uint32 `json:"cache_ttl_min"`
+	CacheMaxTTL       uint32 `json:"cache_ttl_max"`
+}
+
+func (s *Server) handleGetConfig(w http.ResponseWriter, r *http.Request) {
+	resp := dnsConfigJSON{}
+	s.RLock()
+	resp.Upstreams = stringArrayDup(s.conf.UpstreamDNS)
+	resp.UpstreamsFile = s.conf.UpstreamDNSFileName
+	resp.Bootstraps = stringArrayDup(s.conf.BootstrapDNS)
+
+	resp.ProtectionEnabled = s.conf.ProtectionEnabled
+	resp.BlockingMode = s.conf.BlockingMode
+	resp.BlockingIPv4 = s.conf.BlockingIPv4
+	resp.BlockingIPv6 = s.conf.BlockingIPv6
+	resp.RateLimit = s.conf.Ratelimit
+	resp.EDNSCSEnabled = s.conf.EnableEDNSClientSubnet
+	resp.DNSSECEnabled = s.conf.EnableDNSSEC
+	resp.DisableIPv6 = s.conf.AAAADisabled
+	resp.CacheSize = s.conf.CacheSize
+	resp.CacheMinTTL = s.conf.CacheMinTTL
+	resp.CacheMaxTTL = s.conf.CacheMaxTTL
+	if s.conf.FastestAddr {
+		resp.UpstreamMode = "fastest_addr"
+	} else if s.conf.AllServers {
+		resp.UpstreamMode = "parallel"
+	}
+	s.RUnlock()
+
+	js, err := json.Marshal(resp)
+	if err != nil {
+		httpError(r, w, http.StatusInternalServerError, "json.Marshal: %s", err)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write(js)
+}
+
+func checkBlockingMode(req dnsConfigJSON) bool {
+	bm := req.BlockingMode
+	if !(bm == "default" || bm == "refused" || bm == "nxdomain" || bm == "null_ip" || bm == "custom_ip") {
+		return false
+	}
+
+	if bm == "custom_ip" {
+		ip := net.ParseIP(req.BlockingIPv4)
+		if ip == nil || ip.To4() == nil {
+			return false
+		}
+
+		ip = net.ParseIP(req.BlockingIPv6)
+		if ip == nil {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Validate bootstrap server address
+func checkBootstrap(addr string) error {
+	if addr == "" { // additional check is required because NewResolver() allows empty address
+		return fmt.Errorf("invalid bootstrap server address: empty")
+	}
+	_, err := upstream.NewResolver(addr, 0)
+	if err != nil {
+		return fmt.Errorf("invalid bootstrap server address: %s", err)
+	}
+	return nil
+}
+
+// nolint(gocyclo) - we need to check each JSON field separately
+func (s *Server) handleSetConfig(w http.ResponseWriter, r *http.Request) {
+	req := dnsConfigJSON{}
+	js, err := jsonutil.DecodeObject(&req, r.Body)
+	if err != nil {
+		httpError(r, w, http.StatusBadRequest, "json.Decode: %s", err)
+		return
+	}
+
+	if js.Exists("upstream_dns") {
+		err = ValidateUpstreams(req.Upstreams)
+		if err != nil {
+			httpError(r, w, http.StatusBadRequest, "wrong upstreams specification: %s", err)
+			return
+		}
+	}
+
+	if js.Exists("bootstrap_dns") {
+		for _, boot := range req.Bootstraps {
+			if err := checkBootstrap(boot); err != nil {
+				httpError(r, w, http.StatusBadRequest, "%s can not be used as bootstrap dns cause: %s", boot, err)
+				return
+			}
+		}
+	}
+
+	if js.Exists("blocking_mode") && !checkBlockingMode(req) {
+		httpError(r, w, http.StatusBadRequest, "blocking_mode: incorrect value")
+		return
+	}
+
+	if js.Exists("upstream_mode") &&
+		!(req.UpstreamMode == "" || req.UpstreamMode == "fastest_addr" || req.UpstreamMode == "parallel") {
+		httpError(r, w, http.StatusBadRequest, "upstream_mode: incorrect value")
+		return
+	}
+
+	if req.CacheMinTTL > req.CacheMaxTTL {
+		httpError(r, w, http.StatusBadRequest, "cache_ttl_min must be less or equal than cache_ttl_max")
+		return
+	}
+
+	restart := false
+	s.Lock()
+
+	if js.Exists("upstream_dns") {
+		s.conf.UpstreamDNS = req.Upstreams
+		restart = true
+	}
+
+	if js.Exists("upstream_dns_file") {
+		s.conf.UpstreamDNSFileName = req.UpstreamsFile
+		restart = true
+	}
+
+	if js.Exists("bootstrap_dns") {
+		s.conf.BootstrapDNS = req.Bootstraps
+		restart = true
+	}
+
+	if js.Exists("protection_enabled") {
+		s.conf.ProtectionEnabled = req.ProtectionEnabled
+	}
+
+	if js.Exists("blocking_mode") {
+		s.conf.BlockingMode = req.BlockingMode
+		if req.BlockingMode == "custom_ip" {
+			if js.Exists("blocking_ipv4") {
+				s.conf.BlockingIPv4 = req.BlockingIPv4
+				s.conf.BlockingIPAddrv4 = net.ParseIP(req.BlockingIPv4)
+			}
+			if js.Exists("blocking_ipv6") {
+				s.conf.BlockingIPv6 = req.BlockingIPv6
+				s.conf.BlockingIPAddrv6 = net.ParseIP(req.BlockingIPv6)
+			}
+		}
+	}
+
+	if js.Exists("ratelimit") {
+		if s.conf.Ratelimit != req.RateLimit {
+			restart = true
+		}
+		s.conf.Ratelimit = req.RateLimit
+	}
+
+	if js.Exists("edns_cs_enabled") {
+		s.conf.EnableEDNSClientSubnet = req.EDNSCSEnabled
+		restart = true
+	}
+
+	if js.Exists("dnssec_enabled") {
+		s.conf.EnableDNSSEC = req.DNSSECEnabled
+	}
+
+	if js.Exists("disable_ipv6") {
+		s.conf.AAAADisabled = req.DisableIPv6
+	}
+
+	if js.Exists("cache_size") {
+		s.conf.CacheSize = req.CacheSize
+		restart = true
+	}
+
+	if js.Exists("cache_ttl_min") {
+		s.conf.CacheMinTTL = req.CacheMinTTL
+		restart = true
+	}
+
+	if js.Exists("cache_ttl_max") {
+		s.conf.CacheMaxTTL = req.CacheMaxTTL
+		restart = true
+	}
+
+	if js.Exists("upstream_mode") {
+		s.conf.FastestAddr = false
+		s.conf.AllServers = false
+		switch req.UpstreamMode {
+		case "":
+			//
+
+		case "parallel":
+			s.conf.AllServers = true
+
+		case "fastest_addr":
+			s.conf.FastestAddr = true
+		}
+	}
+
+	s.Unlock()
+	s.conf.ConfigModified()
+
+	if restart {
+		err = s.Reconfigure(nil)
+		if err != nil {
+			httpError(r, w, http.StatusInternalServerError, "%s", err)
+			return
+		}
+	}
+}
+
+type upstreamJSON struct {
+	Upstreams    []string `json:"upstream_dns"`  // Upstreams
+	BootstrapDNS []string `json:"bootstrap_dns"` // Bootstrap DNS
+}
+
+// ValidateUpstreams validates each upstream and returns an error if any upstream is invalid or if there are no default upstreams specified
+func ValidateUpstreams(upstreams []string) error {
+	// No need to validate comments
+	upstreams = filterOutComments(upstreams)
+
+	// Consider this case valid because defaultDNS will be used
+	if len(upstreams) == 0 {
+		return nil
+	}
+
+	var defaultUpstreamFound bool
+	for _, u := range upstreams {
+		d, err := validateUpstream(u)
+		if err != nil {
+			return err
+		}
+
+		// Check this flag until default upstream will not be found
+		if !defaultUpstreamFound {
+			defaultUpstreamFound = d
+		}
+	}
+
+	// Return error if there are no default upstreams
+	if !defaultUpstreamFound {
+		return fmt.Errorf("no default upstreams specified")
+	}
+
+	return nil
+}
+
+var protocols = []string{"tls://", "https://", "tcp://", "sdns://", "quic://"}
+
+func validateUpstream(u string) (bool, error) {
+	// Check if user tries to specify upstream for domain
+	u, defaultUpstream, err := separateUpstream(u)
+	if err != nil {
+		return defaultUpstream, err
+	}
+
+	// The special server address '#' means "use the default servers"
+	if u == "#" && !defaultUpstream {
+		return defaultUpstream, nil
+	}
+
+	// Check if the upstream has a valid protocol prefix
+	for _, proto := range protocols {
+		if strings.HasPrefix(u, proto) {
+			return defaultUpstream, nil
+		}
+	}
+
+	// Return error if the upstream contains '://' without any valid protocol
+	if strings.Contains(u, "://") {
+		return defaultUpstream, fmt.Errorf("wrong protocol")
+	}
+
+	// Check if upstream is valid plain DNS
+	return defaultUpstream, checkPlainDNS(u)
+}
+
+// separateUpstream returns upstream without specified domains and a bool flag that indicates if no domains were specified
+// error will be returned if upstream per domain specification is invalid
+func separateUpstream(upstream string) (string, bool, error) {
+	defaultUpstream := true
+	if strings.HasPrefix(upstream, "[/") {
+		defaultUpstream = false
+		// split domains and upstream string
+		domainsAndUpstream := strings.Split(strings.TrimPrefix(upstream, "[/"), "/]")
+		if len(domainsAndUpstream) != 2 {
+			return "", defaultUpstream, fmt.Errorf("wrong DNS upstream per domain specification: %s", upstream)
+		}
+
+		// split domains list and validate each one
+		for _, host := range strings.Split(domainsAndUpstream[0], "/") {
+			if host != "" {
+				if err := utils.IsValidHostname(host); err != nil {
+					return "", defaultUpstream, err
+				}
+			}
+		}
+		upstream = domainsAndUpstream[1]
+	}
+	return upstream, defaultUpstream, nil
+}
+
+// checkPlainDNS checks if host is plain DNS
+func checkPlainDNS(upstream string) error {
+	// Check if host is ip without port
+	if net.ParseIP(upstream) != nil {
+		return nil
+	}
+
+	// Check if host is ip with port
+	ip, port, err := net.SplitHostPort(upstream)
+	if err != nil {
+		return err
+	}
+
+	if net.ParseIP(ip) == nil {
+		return fmt.Errorf("%s is not a valid IP", ip)
+	}
+
+	_, err = strconv.ParseInt(port, 0, 64)
+	if err != nil {
+		return fmt.Errorf("%s is not a valid port: %s", port, err)
+	}
+
+	return nil
+}
+
+func (s *Server) handleTestUpstreamDNS(w http.ResponseWriter, r *http.Request) {
+	req := upstreamJSON{}
+	err := json.NewDecoder(r.Body).Decode(&req)
+	if err != nil {
+		httpError(r, w, http.StatusBadRequest, "Failed to read request body: %s", err)
+		return
+	}
+
+	result := map[string]string{}
+
+	for _, host := range req.Upstreams {
+		err = checkDNS(host, req.BootstrapDNS)
+		if err != nil {
+			log.Info("%v", err)
+			result[host] = err.Error()
+		} else {
+			result[host] = "OK"
+		}
+	}
+
+	jsonVal, err := json.Marshal(result)
+	if err != nil {
+		httpError(r, w, http.StatusInternalServerError, "Unable to marshal status json: %s", err)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	_, err = w.Write(jsonVal)
+	if err != nil {
+		httpError(r, w, http.StatusInternalServerError, "Couldn't write body: %s", err)
+		return
+	}
+}
+
+func checkDNS(input string, bootstrap []string) error {
+	if !isUpstream(input) {
+		return nil
+	}
+
+	// separate upstream from domains list
+	input, defaultUpstream, err := separateUpstream(input)
+	if err != nil {
+		return fmt.Errorf("wrong upstream format: %s", err)
+	}
+
+	// No need to check this DNS server
+	if !defaultUpstream {
+		return nil
+	}
+
+	if _, err := validateUpstream(input); err != nil {
+		return fmt.Errorf("wrong upstream format: %s", err)
+	}
+
+	if len(bootstrap) == 0 {
+		bootstrap = defaultBootstrap
+	}
+
+	log.Debug("Checking if DNS %s works...", input)
+	u, err := upstream.AddressToUpstream(input, upstream.Options{Bootstrap: bootstrap, Timeout: DefaultTimeout})
+	if err != nil {
+		return fmt.Errorf("failed to choose upstream for %s: %s", input, err)
+	}
+
+	req := dns.Msg{}
+	req.Id = dns.Id()
+	req.RecursionDesired = true
+	req.Question = []dns.Question{
+		{Name: "google-public-dns-a.google.com.", Qtype: dns.TypeA, Qclass: dns.ClassINET},
+	}
+	reply, err := u.Exchange(&req)
+	if err != nil {
+		return fmt.Errorf("couldn't communicate with DNS server %s: %s", input, err)
+	}
+	if len(reply.Answer) != 1 {
+		return fmt.Errorf("DNS server %s returned wrong answer", input)
+	}
+	if t, ok := reply.Answer[0].(*dns.A); ok {
+		if !net.IPv4(8, 8, 8, 8).Equal(t.A) {
+			return fmt.Errorf("DNS server %s returned wrong answer: %v", input, t.A)
+		}
+	}
+
+	log.Debug("DNS %s works OK", input)
+	return nil
+}
+
+// Control flow:
+// web
+//  -> dnsforward.handleDOH -> dnsforward.ServeHTTP
+//  -> proxy.ServeHTTP -> proxy.handleDNSRequest
+//  -> dnsforward.handleDNSRequest
+func (s *Server) handleDOH(w http.ResponseWriter, r *http.Request) {
+	if !s.conf.TLSAllowUnencryptedDOH && r.TLS == nil {
+		httpError(r, w, http.StatusNotFound, "Not Found")
+		return
+	}
+
+	if !s.IsRunning() {
+		httpError(r, w, http.StatusInternalServerError, "DNS server is not running")
+		return
+	}
+
+	s.ServeHTTP(w, r)
+}
+
+func (s *Server) registerHandlers() {
+	s.conf.HTTPRegister("GET", "/control/dns_info", s.handleGetConfig)
+	s.conf.HTTPRegister("POST", "/control/dns_config", s.handleSetConfig)
+	s.conf.HTTPRegister("POST", "/control/test_upstream_dns", s.handleTestUpstreamDNS)
+
+	s.conf.HTTPRegister("GET", "/control/access/list", s.handleAccessList)
+	s.conf.HTTPRegister("POST", "/control/access/set", s.handleAccessSet)
+
+	s.conf.HTTPRegister("", "/dns-query", s.handleDOH)
+}

internal/dnsforward/filter.go

@@ -0,0 +1,148 @@
+package dnsforward
+
+import (
+	"strings"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/joomcode/errorx"
+	"github.com/miekg/dns"
+)
+
+func (s *Server) beforeRequestHandler(_ *proxy.Proxy, d *proxy.DNSContext) (bool, error) {
+	ip := ipFromAddr(d.Addr)
+	disallowed, _ := s.access.IsBlockedIP(ip)
+	if disallowed {
+		log.Tracef("Client IP %s is blocked by settings", ip)
+		return false, nil
+	}
+
+	if len(d.Req.Question) == 1 {
+		host := strings.TrimSuffix(d.Req.Question[0].Name, ".")
+		if s.access.IsBlockedDomain(host) {
+			log.Tracef("Domain %s is blocked by settings", host)
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
+
+// getClientRequestFilteringSettings lookups client filtering settings
+// using the client's IP address from the DNSContext
+func (s *Server) getClientRequestFilteringSettings(d *proxy.DNSContext) *dnsfilter.RequestFilteringSettings {
+	setts := s.dnsFilter.GetConfig()
+	setts.FilteringEnabled = true
+	if s.conf.FilterHandler != nil {
+		clientAddr := ipFromAddr(d.Addr)
+		s.conf.FilterHandler(clientAddr, &setts)
+	}
+	return &setts
+}
+
+// filterDNSRequest applies the dnsFilter and sets d.Res if the request was filtered
+func (s *Server) filterDNSRequest(ctx *dnsContext) (*dnsfilter.Result, error) {
+	d := ctx.proxyCtx
+	req := d.Req
+	host := strings.TrimSuffix(req.Question[0].Name, ".")
+	res, err := s.dnsFilter.CheckHost(host, d.Req.Question[0].Qtype, ctx.setts)
+	if err != nil {
+		// Return immediately if there's an error
+		return nil, errorx.Decorate(err, "dnsfilter failed to check host '%s'", host)
+
+	} else if res.IsFiltered {
+		log.Tracef("Host %s is filtered, reason - '%s', matched rule: '%s'", host, res.Reason, res.Rule)
+		d.Res = s.genDNSFilterMessage(d, &res)
+
+	} else if res.Reason == dnsfilter.ReasonRewrite && len(res.CanonName) != 0 && len(res.IPList) == 0 {
+		ctx.origQuestion = d.Req.Question[0]
+		// resolve canonical name, not the original host name
+		d.Req.Question[0].Name = dns.Fqdn(res.CanonName)
+
+	} else if res.Reason == dnsfilter.RewriteEtcHosts && len(res.ReverseHost) != 0 {
+
+		resp := s.makeResponse(req)
+		ptr := &dns.PTR{}
+		ptr.Hdr = dns.RR_Header{
+			Name:   req.Question[0].Name,
+			Rrtype: dns.TypePTR,
+			Ttl:    s.conf.BlockedResponseTTL,
+			Class:  dns.ClassINET,
+		}
+		ptr.Ptr = res.ReverseHost
+		resp.Answer = append(resp.Answer, ptr)
+		d.Res = resp
+	} else if res.Reason == dnsfilter.ReasonRewrite || res.Reason == dnsfilter.RewriteEtcHosts {
+		resp := s.makeResponse(req)
+
+		name := host
+		if len(res.CanonName) != 0 {
+			resp.Answer = append(resp.Answer, s.genCNAMEAnswer(req, res.CanonName))
+			name = res.CanonName
+		}
+
+		for _, ip := range res.IPList {
+			if req.Question[0].Qtype == dns.TypeA {
+				a := s.genAAnswer(req, ip.To4())
+				a.Hdr.Name = dns.Fqdn(name)
+				resp.Answer = append(resp.Answer, a)
+			} else if req.Question[0].Qtype == dns.TypeAAAA {
+				a := s.genAAAAAnswer(req, ip)
+				a.Hdr.Name = dns.Fqdn(name)
+				resp.Answer = append(resp.Answer, a)
+			}
+		}
+
+		d.Res = resp
+	}
+
+	return &res, err
+}
+
+// If response contains CNAME, A or AAAA records, we apply filtering to each canonical host name or IP address.
+// If this is a match, we set a new response in d.Res and return.
+func (s *Server) filterDNSResponse(ctx *dnsContext) (*dnsfilter.Result, error) {
+	d := ctx.proxyCtx
+	for _, a := range d.Res.Answer {
+		host := ""
+
+		switch v := a.(type) {
+		case *dns.CNAME:
+			log.Debug("DNSFwd: Checking CNAME %s for %s", v.Target, v.Hdr.Name)
+			host = strings.TrimSuffix(v.Target, ".")
+
+		case *dns.A:
+			host = v.A.String()
+			log.Debug("DNSFwd: Checking record A (%s) for %s", host, v.Hdr.Name)
+
+		case *dns.AAAA:
+			host = v.AAAA.String()
+			log.Debug("DNSFwd: Checking record AAAA (%s) for %s", host, v.Hdr.Name)
+
+		default:
+			continue
+		}
+
+		s.RLock()
+		// Synchronize access to s.dnsFilter so it won't be suddenly uninitialized while in use.
+		// This could happen after proxy server has been stopped, but its workers are not yet exited.
+		if !s.conf.ProtectionEnabled || s.dnsFilter == nil {
+			s.RUnlock()
+			continue
+		}
+		res, err := s.dnsFilter.CheckHostRules(host, d.Req.Question[0].Qtype, ctx.setts)
+		s.RUnlock()
+
+		if err != nil {
+			return nil, err
+
+		} else if res.IsFiltered {
+			d.Res = s.genDNSFilterMessage(d, &res)
+			log.Debug("DNSFwd: Matched %s by response: %s", d.Req.Question[0].Name, host)
+			return &res, nil
+		}
+	}
+
+	return nil, nil
+}

internal/dnsforward/handle_dns.go

@@ -0,0 +1,407 @@
+package dnsforward
+
+import (
+	"net"
+	"strings"
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
+	"github.com/AdguardTeam/AdGuardHome/internal/util"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/miekg/dns"
+)
+
+// To transfer information between modules
+type dnsContext struct {
+	srv                  *Server
+	proxyCtx             *proxy.DNSContext
+	setts                *dnsfilter.RequestFilteringSettings // filtering settings for this client
+	startTime            time.Time
+	result               *dnsfilter.Result
+	origResp             *dns.Msg     // response received from upstream servers.  Set when response is modified by filtering
+	origQuestion         dns.Question // question received from client.  Set when Rewrites are used.
+	err                  error        // error returned from the module
+	protectionEnabled    bool         // filtering is enabled, dnsfilter object is ready
+	responseFromUpstream bool         // response is received from upstream servers
+	origReqDNSSEC        bool         // DNSSEC flag in the original request from user
+}
+
+const (
+	resultDone   = iota // module has completed its job, continue
+	resultFinish        // module has completed its job, exit normally
+	resultError         // an error occurred, exit with an error
+)
+
+// handleDNSRequest filters the incoming DNS requests and writes them to the query log
+func (s *Server) handleDNSRequest(_ *proxy.Proxy, d *proxy.DNSContext) error {
+	ctx := &dnsContext{srv: s, proxyCtx: d}
+	ctx.result = &dnsfilter.Result{}
+	ctx.startTime = time.Now()
+
+	type modProcessFunc func(ctx *dnsContext) int
+	mods := []modProcessFunc{
+		processInitial,
+		processInternalHosts,
+		processInternalIPAddrs,
+		processFilteringBeforeRequest,
+		processUpstream,
+		processDNSSECAfterResponse,
+		processFilteringAfterResponse,
+		s.ipset.process,
+		processQueryLogsAndStats,
+	}
+	for _, process := range mods {
+		r := process(ctx)
+		switch r {
+		case resultDone:
+			// continue: call the next filter
+
+		case resultFinish:
+			return nil
+
+		case resultError:
+			return ctx.err
+		}
+	}
+
+	if d.Res != nil {
+		d.Res.Compress = true // some devices require DNS message compression
+	}
+	return nil
+}
+
+// Perform initial checks;  process WHOIS & rDNS
+func processInitial(ctx *dnsContext) int {
+	s := ctx.srv
+	d := ctx.proxyCtx
+	if s.conf.AAAADisabled && d.Req.Question[0].Qtype == dns.TypeAAAA {
+		_ = proxy.CheckDisabledAAAARequest(d, true)
+		return resultFinish
+	}
+
+	if s.conf.OnDNSRequest != nil {
+		s.conf.OnDNSRequest(d)
+	}
+
+	// disable Mozilla DoH
+	// https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet
+	if (d.Req.Question[0].Qtype == dns.TypeA || d.Req.Question[0].Qtype == dns.TypeAAAA) &&
+		d.Req.Question[0].Name == "use-application-dns.net." {
+		d.Res = s.genNXDomain(d.Req)
+		return resultFinish
+	}
+
+	return resultDone
+}
+
+// Return TRUE if host names doesn't contain disallowed characters
+func isHostnameOK(hostname string) bool {
+	for _, c := range hostname {
+		if !((c >= 'a' && c <= 'z') ||
+			(c >= 'A' && c <= 'Z') ||
+			(c >= '0' && c <= '9') ||
+			c == '.' || c == '-') {
+			log.Debug("DNS: skipping invalid hostname %s from DHCP", hostname)
+			return false
+		}
+	}
+	return true
+}
+
+func (s *Server) onDHCPLeaseChanged(flags int) {
+	switch flags {
+	case dhcpd.LeaseChangedAdded,
+		dhcpd.LeaseChangedAddedStatic,
+		dhcpd.LeaseChangedRemovedStatic:
+		//
+	default:
+		return
+	}
+
+	hostToIP := make(map[string]net.IP)
+	m := make(map[string]string)
+
+	ll := s.dhcpServer.Leases(dhcpd.LeasesAll)
+
+	for _, l := range ll {
+		if len(l.Hostname) == 0 || !isHostnameOK(l.Hostname) {
+			continue
+		}
+
+		lowhost := strings.ToLower(l.Hostname)
+
+		m[l.IP.String()] = lowhost
+
+		ip := make(net.IP, 4)
+		copy(ip, l.IP.To4())
+		hostToIP[lowhost] = ip
+	}
+
+	log.Debug("DNS: added %d A/PTR entries from DHCP", len(m))
+
+	s.tableHostToIPLock.Lock()
+	s.tableHostToIP = hostToIP
+	s.tableHostToIPLock.Unlock()
+
+	s.tablePTRLock.Lock()
+	s.tablePTR = m
+	s.tablePTRLock.Unlock()
+}
+
+// Respond to A requests if the target host name is associated with a lease from our DHCP server
+func processInternalHosts(ctx *dnsContext) int {
+	s := ctx.srv
+	req := ctx.proxyCtx.Req
+	if !(req.Question[0].Qtype == dns.TypeA || req.Question[0].Qtype == dns.TypeAAAA) {
+		return resultDone
+	}
+
+	host := req.Question[0].Name
+	host = strings.ToLower(host)
+	if !strings.HasSuffix(host, ".lan.") {
+		return resultDone
+	}
+	host = strings.TrimSuffix(host, ".lan.")
+
+	s.tableHostToIPLock.Lock()
+	if s.tableHostToIP == nil {
+		s.tableHostToIPLock.Unlock()
+		return resultDone
+	}
+	ip, ok := s.tableHostToIP[host]
+	s.tableHostToIPLock.Unlock()
+	if !ok {
+		return resultDone
+	}
+
+	log.Debug("DNS: internal record: %s -> %s", req.Question[0].Name, ip.String())
+
+	resp := s.makeResponse(req)
+
+	if req.Question[0].Qtype == dns.TypeA {
+		a := &dns.A{}
+		a.Hdr = dns.RR_Header{
+			Name:   req.Question[0].Name,
+			Rrtype: dns.TypeA,
+			Ttl:    s.conf.BlockedResponseTTL,
+			Class:  dns.ClassINET,
+		}
+		a.A = make([]byte, 4)
+		copy(a.A, ip)
+		resp.Answer = append(resp.Answer, a)
+	}
+
+	ctx.proxyCtx.Res = resp
+	return resultDone
+}
+
+// Respond to PTR requests if the target IP address is leased by our DHCP server
+func processInternalIPAddrs(ctx *dnsContext) int {
+	s := ctx.srv
+	req := ctx.proxyCtx.Req
+	if req.Question[0].Qtype != dns.TypePTR {
+		return resultDone
+	}
+
+	arpa := req.Question[0].Name
+	arpa = strings.TrimSuffix(arpa, ".")
+	arpa = strings.ToLower(arpa)
+	ip := util.DNSUnreverseAddr(arpa)
+	if ip == nil {
+		return resultDone
+	}
+
+	s.tablePTRLock.Lock()
+	if s.tablePTR == nil {
+		s.tablePTRLock.Unlock()
+		return resultDone
+	}
+	host, ok := s.tablePTR[ip.String()]
+	s.tablePTRLock.Unlock()
+	if !ok {
+		return resultDone
+	}
+
+	log.Debug("DNS: reverse-lookup: %s -> %s", arpa, host)
+
+	resp := s.makeResponse(req)
+	ptr := &dns.PTR{}
+	ptr.Hdr = dns.RR_Header{
+		Name:   req.Question[0].Name,
+		Rrtype: dns.TypePTR,
+		Ttl:    s.conf.BlockedResponseTTL,
+		Class:  dns.ClassINET,
+	}
+	ptr.Ptr = host + "."
+	resp.Answer = append(resp.Answer, ptr)
+	ctx.proxyCtx.Res = resp
+	return resultDone
+}
+
+// Apply filtering logic
+func processFilteringBeforeRequest(ctx *dnsContext) int {
+	s := ctx.srv
+	d := ctx.proxyCtx
+
+	if d.Res != nil {
+		return resultDone // response is already set - nothing to do
+	}
+
+	s.RLock()
+	// Synchronize access to s.dnsFilter so it won't be suddenly uninitialized while in use.
+	// This could happen after proxy server has been stopped, but its workers are not yet exited.
+	//
+	// A better approach is for proxy.Stop() to wait until all its workers exit,
+	//  but this would require the Upstream interface to have Close() function
+	//  (to prevent from hanging while waiting for unresponsive DNS server to respond).
+
+	var err error
+	ctx.protectionEnabled = s.conf.ProtectionEnabled && s.dnsFilter != nil
+	if ctx.protectionEnabled {
+		ctx.setts = s.getClientRequestFilteringSettings(d)
+		ctx.result, err = s.filterDNSRequest(ctx)
+	}
+	s.RUnlock()
+
+	if err != nil {
+		ctx.err = err
+		return resultError
+	}
+	return resultDone
+}
+
+// Pass request to upstream servers;  process the response
+func processUpstream(ctx *dnsContext) int {
+	s := ctx.srv
+	d := ctx.proxyCtx
+	if d.Res != nil {
+		return resultDone // response is already set - nothing to do
+	}
+
+	if d.Addr != nil && s.conf.GetCustomUpstreamByClient != nil {
+		clientIP := ipFromAddr(d.Addr)
+		upstreamsConf := s.conf.GetCustomUpstreamByClient(clientIP)
+		if upstreamsConf != nil {
+			log.Debug("Using custom upstreams for %s", clientIP)
+			d.CustomUpstreamConfig = upstreamsConf
+		}
+	}
+
+	if s.conf.EnableDNSSEC {
+		opt := d.Req.IsEdns0()
+		if opt == nil {
+			log.Debug("DNS: Adding OPT record with DNSSEC flag")
+			d.Req.SetEdns0(4096, true)
+		} else if !opt.Do() {
+			opt.SetDo(true)
+		} else {
+			ctx.origReqDNSSEC = true
+		}
+	}
+
+	// request was not filtered so let it be processed further
+	err := s.dnsProxy.Resolve(d)
+	if err != nil {
+		ctx.err = err
+		return resultError
+	}
+
+	ctx.responseFromUpstream = true
+	return resultDone
+}
+
+// Process DNSSEC after response from upstream server
+func processDNSSECAfterResponse(ctx *dnsContext) int {
+	d := ctx.proxyCtx
+
+	if !ctx.responseFromUpstream || // don't process response if it's not from upstream servers
+		!ctx.srv.conf.EnableDNSSEC {
+		return resultDone
+	}
+
+	if !ctx.origReqDNSSEC {
+		optResp := d.Res.IsEdns0()
+		if optResp != nil && !optResp.Do() {
+			return resultDone
+		}
+
+		// Remove RRSIG records from response
+		// because there is no DO flag in the original request from client,
+		// but we have EnableDNSSEC set, so we have set DO flag ourselves,
+		// and now we have to clean up the DNS records our client didn't ask for.
+
+		answers := []dns.RR{}
+		for _, a := range d.Res.Answer {
+			switch a.(type) {
+			case *dns.RRSIG:
+				log.Debug("Removing RRSIG record from response: %v", a)
+			default:
+				answers = append(answers, a)
+			}
+		}
+		d.Res.Answer = answers
+
+		answers = []dns.RR{}
+		for _, a := range d.Res.Ns {
+			switch a.(type) {
+			case *dns.RRSIG:
+				log.Debug("Removing RRSIG record from response: %v", a)
+			default:
+				answers = append(answers, a)
+			}
+		}
+		d.Res.Ns = answers
+	}
+
+	return resultDone
+}
+
+// Apply filtering logic after we have received response from upstream servers
+func processFilteringAfterResponse(ctx *dnsContext) int {
+	s := ctx.srv
+	d := ctx.proxyCtx
+	res := ctx.result
+	var err error
+
+	switch res.Reason {
+	case dnsfilter.ReasonRewrite:
+		if len(ctx.origQuestion.Name) == 0 {
+			// origQuestion is set in case we get only CNAME without IP from rewrites table
+			break
+		}
+
+		d.Req.Question[0] = ctx.origQuestion
+		d.Res.Question[0] = ctx.origQuestion
+
+		if len(d.Res.Answer) != 0 {
+			answer := []dns.RR{}
+			answer = append(answer, s.genCNAMEAnswer(d.Req, res.CanonName))
+			answer = append(answer, d.Res.Answer...) // host -> IP
+			d.Res.Answer = answer
+		}
+
+	case dnsfilter.NotFilteredWhiteList:
+		// nothing
+
+	default:
+		if !ctx.protectionEnabled || // filters are disabled: there's nothing to check for
+			!ctx.responseFromUpstream { // only check response if it's from an upstream server
+			break
+		}
+		origResp2 := d.Res
+		ctx.result, err = s.filterDNSResponse(ctx)
+		if err != nil {
+			ctx.err = err
+			return resultError
+		}
+		if ctx.result != nil {
+			ctx.origResp = origResp2 // matched by response
+		} else {
+			ctx.result = &dnsfilter.Result{}
+		}
+	}
+
+	return resultDone
+}

internal/dnsforward/ipset.go

@@ -0,0 +1,142 @@
+package dnsforward
+
+import (
+	"net"
+	"strings"
+	"sync"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/util"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/miekg/dns"
+)
+
+type ipsetCtx struct {
+	ipsetList   map[string][]string // domain -> []ipset_name
+	ipsetCache  map[[4]byte]bool    // cache for IP[] to prevent duplicate calls to ipset program
+	ipsetMutex  *sync.Mutex
+	ipset6Cache map[[16]byte]bool // cache for IP[] to prevent duplicate calls to ipset program
+	ipset6Mutex *sync.Mutex
+}
+
+// Convert configuration settings to an internal map
+// DOMAIN[,DOMAIN].../IPSET1_NAME[,IPSET2_NAME]...
+func (c *ipsetCtx) init(ipsetConfig []string) {
+	c.ipsetList = make(map[string][]string)
+	c.ipsetCache = make(map[[4]byte]bool)
+	c.ipsetMutex = &sync.Mutex{}
+	c.ipset6Cache = make(map[[16]byte]bool)
+	c.ipset6Mutex = &sync.Mutex{}
+
+	for _, it := range ipsetConfig {
+		it = strings.TrimSpace(it)
+		hostsAndNames := strings.Split(it, "/")
+		if len(hostsAndNames) != 2 {
+			log.Debug("IPSET: invalid value '%s'", it)
+			continue
+		}
+
+		ipsetNames := strings.Split(hostsAndNames[1], ",")
+		if len(ipsetNames) == 0 {
+			log.Debug("IPSET: invalid value '%s'", it)
+			continue
+		}
+		bad := false
+		for i := range ipsetNames {
+			ipsetNames[i] = strings.TrimSpace(ipsetNames[i])
+			if len(ipsetNames[i]) == 0 {
+				bad = true
+				break
+			}
+		}
+		if bad {
+			log.Debug("IPSET: invalid value '%s'", it)
+			continue
+		}
+
+		hosts := strings.Split(hostsAndNames[0], ",")
+		for _, host := range hosts {
+			host = strings.TrimSpace(host)
+			host = strings.ToLower(host)
+			if len(host) == 0 {
+				log.Debug("IPSET: invalid value '%s'", it)
+				continue
+			}
+			c.ipsetList[host] = ipsetNames
+		}
+	}
+	log.Debug("IPSET: added %d hosts", len(c.ipsetList))
+}
+
+func (c *ipsetCtx) getIP(rr dns.RR) net.IP {
+	switch a := rr.(type) {
+	case *dns.A:
+		var ip4 [4]byte
+		copy(ip4[:], a.A.To4())
+		c.ipsetMutex.Lock()
+		defer c.ipsetMutex.Unlock()
+		_, found := c.ipsetCache[ip4]
+		if found {
+			return nil // this IP was added before
+		}
+		c.ipsetCache[ip4] = false
+		return a.A
+
+	case *dns.AAAA:
+		var ip6 [16]byte
+		copy(ip6[:], a.AAAA)
+		c.ipset6Mutex.Lock()
+		defer c.ipset6Mutex.Unlock()
+		_, found := c.ipset6Cache[ip6]
+		if found {
+			return nil // this IP was added before
+		}
+		c.ipset6Cache[ip6] = false
+		return a.AAAA
+
+	default:
+		return nil
+	}
+}
+
+// Add IP addresses of the specified in configuration domain names to an ipset list
+func (c *ipsetCtx) process(ctx *dnsContext) int {
+	req := ctx.proxyCtx.Req
+	if !(req.Question[0].Qtype == dns.TypeA ||
+		req.Question[0].Qtype == dns.TypeAAAA) ||
+		!ctx.responseFromUpstream {
+		return resultDone
+	}
+
+	host := req.Question[0].Name
+	host = strings.TrimSuffix(host, ".")
+	host = strings.ToLower(host)
+	ipsetNames, found := c.ipsetList[host]
+	if !found {
+		return resultDone
+	}
+
+	log.Debug("IPSET: found ipsets %v for host %s", ipsetNames, host)
+
+	for _, it := range ctx.proxyCtx.Res.Answer {
+		ip := c.getIP(it)
+		if ip == nil {
+			continue
+		}
+
+		ipStr := ip.String()
+		for _, name := range ipsetNames {
+			code, out, err := util.RunCommand("ipset", "add", name, ipStr)
+			if err != nil {
+				log.Info("IPSET: %s(%s) -> %s: %s", host, ipStr, name, err)
+				continue
+			}
+			if code != 0 {
+				log.Info("IPSET: ipset add:  code:%d  output:'%s'", code, out)
+				continue
+			}
+			log.Debug("IPSET: added %s(%s) -> %s", host, ipStr, name)
+		}
+	}
+
+	return resultDone
+}

internal/dnsforward/ipset_test.go

@@ -0,0 +1,41 @@
+package dnsforward
+
+import (
+	"testing"
+
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIPSET(t *testing.T) {
+	s := Server{}
+	s.conf.IPSETList = append(s.conf.IPSETList, "HOST.com/name")
+	s.conf.IPSETList = append(s.conf.IPSETList, "host2.com,host3.com/name23")
+	s.conf.IPSETList = append(s.conf.IPSETList, "host4.com/name4,name41")
+	c := ipsetCtx{}
+	c.init(s.conf.IPSETList)
+
+	assert.Equal(t, "name", c.ipsetList["host.com"][0])
+	assert.Equal(t, "name23", c.ipsetList["host2.com"][0])
+	assert.Equal(t, "name23", c.ipsetList["host3.com"][0])
+	assert.Equal(t, "name4", c.ipsetList["host4.com"][0])
+	assert.Equal(t, "name41", c.ipsetList["host4.com"][1])
+
+	_, ok := c.ipsetList["host0.com"]
+	assert.False(t, ok)
+
+	ctx := &dnsContext{
+		srv: &s,
+	}
+	ctx.proxyCtx = &proxy.DNSContext{}
+	ctx.proxyCtx.Req = &dns.Msg{
+		Question: []dns.Question{
+			{
+				Name:  "host.com.",
+				Qtype: dns.TypeA,
+			},
+		},
+	}
+	assert.Equal(t, resultDone, c.process(ctx))
+}

internal/dnsforward/msg.go

@@ -0,0 +1,247 @@
+package dnsforward
+
+import (
+	"log"
+	"net"
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/miekg/dns"
+)
+
+// Create a DNS response by DNS request and set necessary flags
+func (s *Server) makeResponse(req *dns.Msg) *dns.Msg {
+	resp := dns.Msg{}
+	resp.SetReply(req)
+	resp.RecursionAvailable = true
+	resp.Compress = true
+	return &resp
+}
+
+// genDNSFilterMessage generates a DNS message corresponding to the filtering result
+func (s *Server) genDNSFilterMessage(d *proxy.DNSContext, result *dnsfilter.Result) *dns.Msg {
+	m := d.Req
+
+	if m.Question[0].Qtype != dns.TypeA && m.Question[0].Qtype != dns.TypeAAAA {
+		if s.conf.BlockingMode == "null_ip" {
+			return s.makeResponse(m)
+		}
+		return s.genNXDomain(m)
+	}
+
+	switch result.Reason {
+	case dnsfilter.FilteredSafeBrowsing:
+		return s.genBlockedHost(m, s.conf.SafeBrowsingBlockHost, d)
+	case dnsfilter.FilteredParental:
+		return s.genBlockedHost(m, s.conf.ParentalBlockHost, d)
+	default:
+		// If the query was filtered by "Safe search", dnsfilter also must return
+		// the IP address that must be used in response.
+		// In this case regardless of the filtering method, we should return it
+		if result.Reason == dnsfilter.FilteredSafeSearch && result.IP != nil {
+			return s.genResponseWithIP(m, result.IP)
+		}
+
+		if s.conf.BlockingMode == "null_ip" {
+			// it means that we should return 0.0.0.0 or :: for any blocked request
+			return s.makeResponseNullIP(m)
+
+		} else if s.conf.BlockingMode == "custom_ip" {
+			// means that we should return custom IP for any blocked request
+
+			switch m.Question[0].Qtype {
+			case dns.TypeA:
+				return s.genARecord(m, s.conf.BlockingIPAddrv4)
+			case dns.TypeAAAA:
+				return s.genAAAARecord(m, s.conf.BlockingIPAddrv6)
+			}
+
+		} else if s.conf.BlockingMode == "nxdomain" {
+			// means that we should return NXDOMAIN for any blocked request
+
+			return s.genNXDomain(m)
+
+		} else if s.conf.BlockingMode == "refused" {
+			// means that we should return NXDOMAIN for any blocked request
+
+			return s.makeResponseREFUSED(m)
+		}
+
+		// Default blocking mode
+		// If there's an IP specified in the rule, return it
+		// For host-type rules, return null IP
+		if result.IP != nil {
+			return s.genResponseWithIP(m, result.IP)
+		}
+
+		return s.makeResponseNullIP(m)
+	}
+}
+
+func (s *Server) genServerFailure(request *dns.Msg) *dns.Msg {
+	resp := dns.Msg{}
+	resp.SetRcode(request, dns.RcodeServerFailure)
+	resp.RecursionAvailable = true
+	return &resp
+}
+
+func (s *Server) genARecord(request *dns.Msg, ip net.IP) *dns.Msg {
+	resp := s.makeResponse(request)
+	resp.Answer = append(resp.Answer, s.genAAnswer(request, ip))
+	return resp
+}
+
+func (s *Server) genAAAARecord(request *dns.Msg, ip net.IP) *dns.Msg {
+	resp := s.makeResponse(request)
+	resp.Answer = append(resp.Answer, s.genAAAAAnswer(request, ip))
+	return resp
+}
+
+func (s *Server) genAAnswer(req *dns.Msg, ip net.IP) *dns.A {
+	answer := new(dns.A)
+	answer.Hdr = dns.RR_Header{
+		Name:   req.Question[0].Name,
+		Rrtype: dns.TypeA,
+		Ttl:    s.conf.BlockedResponseTTL,
+		Class:  dns.ClassINET,
+	}
+	answer.A = ip
+	return answer
+}
+
+func (s *Server) genAAAAAnswer(req *dns.Msg, ip net.IP) *dns.AAAA {
+	answer := new(dns.AAAA)
+	answer.Hdr = dns.RR_Header{
+		Name:   req.Question[0].Name,
+		Rrtype: dns.TypeAAAA,
+		Ttl:    s.conf.BlockedResponseTTL,
+		Class:  dns.ClassINET,
+	}
+	answer.AAAA = ip
+	return answer
+}
+
+// generate DNS response message with an IP address
+func (s *Server) genResponseWithIP(req *dns.Msg, ip net.IP) *dns.Msg {
+	if req.Question[0].Qtype == dns.TypeA && ip.To4() != nil {
+		return s.genARecord(req, ip.To4())
+	} else if req.Question[0].Qtype == dns.TypeAAAA &&
+		len(ip) == net.IPv6len && ip.To4() == nil {
+		return s.genAAAARecord(req, ip)
+	}
+
+	// empty response
+	resp := s.makeResponse(req)
+	return resp
+}
+
+// Respond with 0.0.0.0 for A, :: for AAAA, empty response for other types
+func (s *Server) makeResponseNullIP(req *dns.Msg) *dns.Msg {
+	if req.Question[0].Qtype == dns.TypeA {
+		return s.genARecord(req, []byte{0, 0, 0, 0})
+	} else if req.Question[0].Qtype == dns.TypeAAAA {
+		return s.genAAAARecord(req, net.IPv6zero)
+	}
+
+	return s.makeResponse(req)
+}
+
+func (s *Server) genBlockedHost(request *dns.Msg, newAddr string, d *proxy.DNSContext) *dns.Msg {
+
+	ip := net.ParseIP(newAddr)
+	if ip != nil {
+		return s.genResponseWithIP(request, ip)
+	}
+
+	// look up the hostname, TODO: cache
+	replReq := dns.Msg{}
+	replReq.SetQuestion(dns.Fqdn(newAddr), request.Question[0].Qtype)
+	replReq.RecursionDesired = true
+
+	newContext := &proxy.DNSContext{
+		Proto:     d.Proto,
+		Addr:      d.Addr,
+		StartTime: time.Now(),
+		Req:       &replReq,
+	}
+
+	err := s.dnsProxy.Resolve(newContext)
+	if err != nil {
+		log.Printf("Couldn't look up replacement host '%s': %s", newAddr, err)
+		return s.genServerFailure(request)
+	}
+
+	resp := s.makeResponse(request)
+	if newContext.Res != nil {
+		for _, answer := range newContext.Res.Answer {
+			answer.Header().Name = request.Question[0].Name
+			resp.Answer = append(resp.Answer, answer)
+		}
+	}
+
+	return resp
+}
+
+// Make a CNAME response
+func (s *Server) genCNAMEAnswer(req *dns.Msg, cname string) *dns.CNAME {
+	answer := new(dns.CNAME)
+	answer.Hdr = dns.RR_Header{
+		Name:   req.Question[0].Name,
+		Rrtype: dns.TypeCNAME,
+		Ttl:    s.conf.BlockedResponseTTL,
+		Class:  dns.ClassINET,
+	}
+	answer.Target = dns.Fqdn(cname)
+	return answer
+}
+
+// Create REFUSED DNS response
+func (s *Server) makeResponseREFUSED(request *dns.Msg) *dns.Msg {
+	resp := dns.Msg{}
+	resp.SetRcode(request, dns.RcodeRefused)
+	resp.RecursionAvailable = true
+	return &resp
+}
+
+func (s *Server) genNXDomain(request *dns.Msg) *dns.Msg {
+	resp := dns.Msg{}
+	resp.SetRcode(request, dns.RcodeNameError)
+	resp.RecursionAvailable = true
+	resp.Ns = s.genSOA(request)
+	return &resp
+}
+
+func (s *Server) genSOA(request *dns.Msg) []dns.RR {
+	zone := ""
+	if len(request.Question) > 0 {
+		zone = request.Question[0].Name
+	}
+
+	soa := dns.SOA{
+		// values copied from verisign's nonexistent .com domain
+		// their exact values are not important in our use case because they are used for domain transfers between primary/secondary DNS servers
+		Refresh: 1800,
+		Retry:   900,
+		Expire:  604800,
+		Minttl:  86400,
+		// copied from AdGuard DNS
+		Ns:     "fake-for-negative-caching.adguard.com.",
+		Serial: 100500,
+		// rest is request-specific
+		Hdr: dns.RR_Header{
+			Name:   zone,
+			Rrtype: dns.TypeSOA,
+			Ttl:    s.conf.BlockedResponseTTL,
+			Class:  dns.ClassINET,
+		},
+		Mbox: "hostmaster.", // zone will be appended later if it's not empty or "."
+	}
+	if soa.Hdr.Ttl == 0 {
+		soa.Hdr.Ttl = defaultValues.BlockedResponseTTL
+	}
+	if len(zone) > 0 && zone[0] != '.' {
+		soa.Mbox += zone
+	}
+	return []dns.RR{&soa}
+}

internal/dnsforward/stats.go

@@ -0,0 +1,98 @@
+package dnsforward
+
+import (
+	"net"
+	"strings"
+	"time"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/querylog"
+	"github.com/miekg/dns"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
+	"github.com/AdguardTeam/AdGuardHome/internal/stats"
+	"github.com/AdguardTeam/dnsproxy/proxy"
+)
+
+// Write Stats data and logs
+func processQueryLogsAndStats(ctx *dnsContext) int {
+	elapsed := time.Since(ctx.startTime)
+	s := ctx.srv
+	d := ctx.proxyCtx
+
+	shouldLog := true
+	msg := d.Req
+
+	// don't log ANY request if refuseAny is enabled
+	if len(msg.Question) >= 1 && msg.Question[0].Qtype == dns.TypeANY && s.conf.RefuseAny {
+		shouldLog = false
+	}
+
+	s.RLock()
+	// Synchronize access to s.queryLog and s.stats so they won't be suddenly uninitialized while in use.
+	// This can happen after proxy server has been stopped, but its workers haven't yet exited.
+	if shouldLog && s.queryLog != nil {
+		p := querylog.AddParams{
+			Question:   msg,
+			Answer:     d.Res,
+			OrigAnswer: ctx.origResp,
+			Result:     ctx.result,
+			Elapsed:    elapsed,
+			ClientIP:   getIP(d.Addr),
+		}
+
+		if d.Proto == "https" {
+			p.ClientProto = "doh"
+		} else if d.Proto == "tls" {
+			p.ClientProto = "dot"
+		}
+
+		if d.Upstream != nil {
+			p.Upstream = d.Upstream.Address()
+		}
+		s.queryLog.Add(p)
+	}
+
+	s.updateStats(d, elapsed, *ctx.result)
+	s.RUnlock()
+
+	return resultDone
+}
+
+func (s *Server) updateStats(d *proxy.DNSContext, elapsed time.Duration, res dnsfilter.Result) {
+	if s.stats == nil {
+		return
+	}
+
+	e := stats.Entry{}
+	e.Domain = strings.ToLower(d.Req.Question[0].Name)
+	e.Domain = e.Domain[:len(e.Domain)-1] // remove last "."
+	switch addr := d.Addr.(type) {
+	case *net.UDPAddr:
+		e.Client = addr.IP
+	case *net.TCPAddr:
+		e.Client = addr.IP
+	}
+	e.Time = uint32(elapsed / 1000)
+	e.Result = stats.RNotFiltered
+
+	switch res.Reason {
+
+	case dnsfilter.FilteredSafeBrowsing:
+		e.Result = stats.RSafeBrowsing
+
+	case dnsfilter.FilteredParental:
+		e.Result = stats.RParental
+
+	case dnsfilter.FilteredSafeSearch:
+		e.Result = stats.RSafeSearch
+
+	case dnsfilter.FilteredBlackList:
+		fallthrough
+	case dnsfilter.FilteredInvalid:
+		fallthrough
+	case dnsfilter.FilteredBlockedService:
+		e.Result = stats.RFiltered
+	}
+
+	s.stats.Update(e)
+}

internal/dnsforward/util.go

@@ -0,0 +1,102 @@
+package dnsforward
+
+import (
+	"net"
+	"sort"
+	"strings"
+
+	"github.com/AdguardTeam/golibs/utils"
+)
+
+// GetIPString is a helper function that extracts IP address from net.Addr
+func GetIPString(addr net.Addr) string {
+	switch addr := addr.(type) {
+	case *net.UDPAddr:
+		return addr.IP.String()
+	case *net.TCPAddr:
+		return addr.IP.String()
+	}
+	return ""
+}
+
+func stringArrayDup(a []string) []string {
+	a2 := make([]string, len(a))
+	copy(a2, a)
+	return a2
+}
+
+// Get IP address from net.Addr object
+// Note: we can't use net.SplitHostPort(a.String()) because of IPv6 zone:
+// https://github.com/AdguardTeam/AdGuardHome/internal/issues/1261
+func ipFromAddr(a net.Addr) string {
+	switch addr := a.(type) {
+	case *net.UDPAddr:
+		return addr.IP.String()
+	case *net.TCPAddr:
+		return addr.IP.String()
+	}
+	return ""
+}
+
+// Get IP address from net.Addr
+func getIP(addr net.Addr) net.IP {
+	switch addr := addr.(type) {
+	case *net.UDPAddr:
+		return addr.IP
+	case *net.TCPAddr:
+		return addr.IP
+	}
+	return nil
+}
+
+// Find value in a sorted array
+func findSorted(ar []string, val string) int {
+	i := sort.SearchStrings(ar, val)
+	if i == len(ar) || ar[i] != val {
+		return -1
+	}
+	return i
+}
+
+func isWildcard(host string) bool {
+	return len(host) >= 2 &&
+		host[0] == '*' && host[1] == '.'
+}
+
+// Return TRUE if host name matches a wildcard pattern
+func matchDomainWildcard(host, wildcard string) bool {
+	return isWildcard(wildcard) &&
+		strings.HasSuffix(host, wildcard[1:])
+}
+
+// Return TRUE if client's SNI value matches DNS names from certificate
+func matchDNSName(dnsNames []string, sni string) bool {
+	if utils.IsValidHostname(sni) != nil {
+		return false
+	}
+	if findSorted(dnsNames, sni) != -1 {
+		return true
+	}
+
+	for _, dn := range dnsNames {
+		if matchDomainWildcard(sni, dn) {
+			return true
+		}
+	}
+	return false
+}
+
+// Is not comment
+func isUpstream(line string) bool {
+	return !strings.HasPrefix(line, "#")
+}
+
+func filterOutComments(lines []string) []string {
+	var filtered []string
+	for _, l := range lines {
+		if isUpstream(l) {
+			filtered = append(filtered, l)
+		}
+	}
+	return filtered
+}