Pull request: all: client id support

Merge in DNS/adguard-home from 1383-client-id to master Updates #1383. Squashed commit of the following: commit ebe2678bfa9bf651a2cb1e64499b38edcf19a7ad Author: Ildar Kamalov <ik@adguard.com> Date: Wed Jan 27 17:51:59 2021 +0300 - client: check if IP is valid commit 0c330585a170ea149ee75e43dfa65211e057299c Author: Ildar Kamalov <ik@adguard.com> Date: Wed Jan 27 17:07:50 2021 +0300 - client: find clients by client_id commit 71c9593ee35d996846f061e114b7867c3aa3c978 Merge: 9104f161 3e9edd9e Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Wed Jan 27 16:09:45 2021 +0300 Merge branch 'master' into 1383-client-id commit 9104f1615d2d462606c52017df25a422df872cea Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Wed Jan 27 13:28:50 2021 +0300 dnsforward: imp tests commit ed47f26e611ade625a2cc2c2f71a291b796bbf8f Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Wed Jan 27 12:39:52 2021 +0300 dnsforward: fix address commit 98b222ba69a5d265f620c180c960d01c84a1fb3b Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Tue Jan 26 19:50:31 2021 +0300 home: imp code commit 4f3966548a2d8437d0b68207dd108dd1a6cb7d20 Merge: 199fdc05 c215b820 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Tue Jan 26 19:45:13 2021 +0300 Merge branch 'master' into 1383-client-id commit 199fdc056f8a8be5500584f3aaee32865188aedc Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Tue Jan 26 19:20:37 2021 +0300 all: imp tests, logging, etc commit 35ff14f4d534251aecb2ea60baba225f3eed8a3e Author: Ildar Kamalov <ik@adguard.com> Date: Tue Jan 26 18:55:19 2021 +0300 + client: remove block button from clients with client_id commit 32991a0b4c56583a02fb5e00bba95d96000bce20 Author: Ildar Kamalov <ik@adguard.com> Date: Tue Jan 26 18:54:25 2021 +0300 + client: add requests count for client_id commit 2d68df4d2eac4a296d7469923e601dad4575c1a1 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Tue Jan 26 15:49:50 2021 +0300 stats: handle client ids commit 4e14ab3590328f93a8cd6e9cbe1665baf74f220b Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Tue Jan 26 13:45:25 2021 +0300 openapi: fix example commit ca9cf3f744fe197cace2c28ddc5bc68f71dad1f3 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Tue Jan 26 13:37:10 2021 +0300 openapi: improve clients find api docs commit f79876e550c424558b704bc316a4cd04f25db011 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Tue Jan 26 13:18:52 2021 +0300 home: accept ids in clients find commit 5b72595122aa0bd64debadfd753ed8a0e0840629 Merge: 607e241f abf8f65f Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Mon Jan 25 18:34:56 2021 +0300 Merge branch 'master' into 1383-client-id commit 607e241f1c339dd6397218f70b8301e3de6a1ee0 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Mon Jan 25 18:30:39 2021 +0300 dnsforward: fix quic commit f046352fef93e46234c2bbe8ae316d21034260e5 Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Mon Jan 25 16:53:09 2021 +0300 all: remove wildcard requirement commit 3b679489bae82c54177372be453fe184d8f0bab6 Author: Andrey Meshkov <am@adguard.com> Date: Mon Jan 25 16:02:28 2021 +0300 workDir now supports symlinks commit 0647ab4f113de2223f6949df001f42ecab05c995 Author: Ildar Kamalov <ik@adguard.com> Date: Mon Jan 25 14:59:46 2021 +0300 - client: remove wildcard from domain validation commit b1aec04a4ecadc9d65648ed6d284188fecce01c3 Author: Ildar Kamalov <ik@adguard.com> Date: Mon Jan 25 14:55:39 2021 +0300 + client: add form to download mobileconfig ... and 12 more commits
2021-01-27 18:32:13 +03:00
parent 3e9edd9eac
commit fc9ddcf941
56 changed files with 1735 additions and 623 deletions
--- a/internal/home/clients.go
+++ b/internal/home/clients.go
@@ -11,23 +11,21 @@ import (
 	"sync"
 	"time"

-	"github.com/AdguardTeam/dnsproxy/proxy"
-
+	"github.com/AdguardTeam/AdGuardHome/internal/agherr"
 	"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/AdGuardHome/internal/util"
+	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/AdguardTeam/golibs/utils"
 )

-const (
-	clientsUpdatePeriod = 10 * time.Minute
-)
+const clientsUpdatePeriod = 10 * time.Minute

 var webHandlersRegistered = false

-// Client information
+// Client contains information about persistent clients.
 type Client struct {
 	IDs                 []string
 	Tags                []string
@@ -52,14 +50,13 @@ type Client struct {

 type clientSource uint

-// Client sources
+// Client sources.  The order determines the priority.
 const (
-	// Priority: etc/hosts > DHCP > ARP > rDNS > WHOIS
-	ClientSourceWHOIS     clientSource = iota // from WHOIS
-	ClientSourceRDNS                          // from rDNS
-	ClientSourceDHCP                          // from DHCP
-	ClientSourceARP                           // from 'arp -a'
-	ClientSourceHostsFile                     // from /etc/hosts
+	ClientSourceWHOIS clientSource = iota
+	ClientSourceRDNS
+	ClientSourceDHCP
+	ClientSourceARP
+	ClientSourceHostsFile
 )

 // ClientHost information
@@ -70,12 +67,12 @@ type ClientHost struct {
 }

 type clientsContainer struct {
-	list    map[string]*Client // name -> client
-	idIndex map[string]*Client // IP -> client
-	// TODO(e.burkov): Think of a way to not require string conversion for
-	// IP addresses.
-	ipHost map[string]*ClientHost // IP -> Hostname
-	lock   sync.Mutex
+	// TODO(a.garipov): Perhaps use a number of separate indices for
+	// different types (string, net.IP, and so on).
+	list    map[string]*Client     // name -> client
+	idIndex map[string]*Client     // ID -> client
+	ipHost  map[string]*ClientHost // IP -> Hostname
+	lock    sync.Mutex

 	allTags map[string]bool

@@ -158,7 +155,7 @@ func (clients *clientsContainer) tagKnown(tag string) bool {

 func (clients *clientsContainer) addFromConfig(objects []clientObject) {
 	for _, cy := range objects {
-		cli := Client{
+		cli := &Client{
 			Name:                cy.Name,
 			IDs:                 cy.IDs,
 			UseOwnSettings:      !cy.UseGlobalSettings,
@@ -174,7 +171,7 @@ func (clients *clientsContainer) addFromConfig(objects []clientObject) {

 		for _, s := range cy.BlockedServices {
 			if !dnsfilter.BlockedSvcKnown(s) {
-				log.Debug("Clients: skipping unknown blocked-service %q", s)
+				log.Debug("clients: skipping unknown blocked-service %q", s)
 				continue
 			}
 			cli.BlockedServices = append(cli.BlockedServices, s)
@@ -182,7 +179,7 @@ func (clients *clientsContainer) addFromConfig(objects []clientObject) {

 		for _, t := range cy.Tags {
 			if !clients.tagKnown(t) {
-				log.Debug("Clients: skipping unknown tag %q", t)
+				log.Debug("clients: skipping unknown tag %q", t)
 				continue
 			}
 			cli.Tags = append(cli.Tags, t)
@@ -210,10 +207,10 @@ func (clients *clientsContainer) WriteDiskConfig(objects *[]clientObject) {
 			UseGlobalBlockedServices: !cli.UseOwnBlockedServices,
 		}

-		cy.Tags = stringArrayDup(cli.Tags)
-		cy.IDs = stringArrayDup(cli.IDs)
-		cy.BlockedServices = stringArrayDup(cli.BlockedServices)
-		cy.Upstreams = stringArrayDup(cli.Upstreams)
+		cy.Tags = copyStrings(cli.Tags)
+		cy.IDs = copyStrings(cli.IDs)
+		cy.BlockedServices = copyStrings(cli.BlockedServices)
+		cy.Upstreams = copyStrings(cli.Upstreams)

 		*objects = append(*objects, cy)
 	}
@@ -240,45 +237,44 @@ func (clients *clientsContainer) onHostsChanged() {
 	clients.addFromHostsFile()
 }

-// Exists checks if client with this IP already exists
-func (clients *clientsContainer) Exists(ip net.IP, source clientSource) bool {
+// Exists checks if client with this ID already exists.
+func (clients *clientsContainer) Exists(id string, source clientSource) (ok bool) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	_, ok := clients.findByIP(ip)
+	_, ok = clients.findLocked(id)
 	if ok {
 		return true
 	}

-	ch, ok := clients.ipHost[ip.String()]
+	var ch *ClientHost
+	ch, ok = clients.ipHost[id]
 	if !ok {
 		return false
 	}
-	if source > ch.Source {
-		return false // we're going to overwrite this client's info with a stronger source
-	}
-	return true
+
+	// Return false if the new source has higher priority.
+	return source <= ch.Source
 }

-func stringArrayDup(a []string) []string {
-	a2 := make([]string, len(a))
-	copy(a2, a)
-	return a2
+func copyStrings(a []string) (b []string) {
+	return append(b, a...)
 }

-// Find searches for a client by IP
-func (clients *clientsContainer) Find(ip net.IP) (Client, bool) {
+// Find searches for a client by its ID.
+func (clients *clientsContainer) Find(id string) (c *Client, ok bool) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	c, ok := clients.findByIP(ip)
+	c, ok = clients.findLocked(id)
 	if !ok {
-		return Client{}, false
+		return nil, false
 	}
-	c.IDs = stringArrayDup(c.IDs)
-	c.Tags = stringArrayDup(c.Tags)
-	c.BlockedServices = stringArrayDup(c.BlockedServices)
-	c.Upstreams = stringArrayDup(c.Upstreams)
+
+	c.IDs = copyStrings(c.IDs)
+	c.Tags = copyStrings(c.Tags)
+	c.BlockedServices = copyStrings(c.BlockedServices)
+	c.Upstreams = copyStrings(c.Upstreams)
 	return c, true
 }

@@ -289,7 +285,7 @@ func (clients *clientsContainer) FindUpstreams(ip string) *proxy.UpstreamConfig
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	c, ok := clients.findByIP(net.ParseIP(ip))
+	c, ok := clients.findLocked(ip)
 	if !ok {
 		return nil
 	}
@@ -308,15 +304,16 @@ func (clients *clientsContainer) FindUpstreams(ip string) *proxy.UpstreamConfig
 	return c.upstreamConfig
 }

-// Find searches for a client by IP (and does not lock anything)
-func (clients *clientsContainer) findByIP(ip net.IP) (Client, bool) {
-	if ip == nil {
-		return Client{}, false
+// findLocked searches for a client by its ID.  For internal use only.
+func (clients *clientsContainer) findLocked(id string) (c *Client, ok bool) {
+	c, ok = clients.idIndex[id]
+	if ok {
+		return c, true
 	}

-	c, ok := clients.idIndex[ip.String()]
-	if ok {
-		return *c, true
+	ip := net.ParseIP(id)
+	if ip == nil {
+		return nil, false
 	}

 	for _, c = range clients.list {
@@ -325,88 +322,96 @@ func (clients *clientsContainer) findByIP(ip net.IP) (Client, bool) {
 			if err != nil {
 				continue
 			}
+
 			if ipnet.Contains(ip) {
-				return *c, true
+				return c, true
 			}
 		}
 	}

 	if clients.dhcpServer == nil {
-		return Client{}, false
+		return nil, false
 	}
+
 	macFound := clients.dhcpServer.FindMACbyIP(ip)
 	if macFound == nil {
-		return Client{}, false
+		return nil, false
 	}
+
 	for _, c = range clients.list {
 		for _, id := range c.IDs {
 			hwAddr, err := net.ParseMAC(id)
 			if err != nil {
 				continue
 			}
+
 			if bytes.Equal(hwAddr, macFound) {
-				return *c, true
+				return c, true
 			}
 		}
 	}

-	return Client{}, false
+	return nil, false
 }

 // FindAutoClient - search for an auto-client by IP
-func (clients *clientsContainer) FindAutoClient(ip net.IP) (ClientHost, bool) {
-	if ip == nil {
+func (clients *clientsContainer) FindAutoClient(ip string) (ClientHost, bool) {
+	ipAddr := net.ParseIP(ip)
+	if ipAddr == nil {
 		return ClientHost{}, false
 	}

 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	ch, ok := clients.ipHost[ip.String()]
+	ch, ok := clients.ipHost[ip]
 	if ok {
 		return *ch, true
 	}
 	return ClientHost{}, false
 }

-// Check if Client object's fields are correct
-func (clients *clientsContainer) check(c *Client) error {
-	if len(c.Name) == 0 {
-		return fmt.Errorf("invalid Name")
-	}
-
-	if len(c.IDs) == 0 {
-		return fmt.Errorf("id required")
+// check validates the client.
+func (clients *clientsContainer) check(c *Client) (err error) {
+	switch {
+	case c == nil:
+		return agherr.Error("client is nil")
+	case c.Name == "":
+		return agherr.Error("invalid name")
+	case len(c.IDs) == 0:
+		return agherr.Error("id required")
+	default:
+		// Go on.
 	}

 	for i, id := range c.IDs {
-		ip := net.ParseIP(id)
-		if ip != nil {
-			c.IDs[i] = ip.String() // normalize IP address
-			continue
+		// Normalize structured data.
+		var ip net.IP
+		var ipnet *net.IPNet
+		var mac net.HardwareAddr
+		if ip = net.ParseIP(id); ip != nil {
+			c.IDs[i] = ip.String()
+		} else if ip, ipnet, err = net.ParseCIDR(id); err == nil {
+			ipnet.IP = ip
+			c.IDs[i] = ipnet.String()
+		} else if mac, err = net.ParseMAC(id); err == nil {
+			c.IDs[i] = mac.String()
+		} else if err = dnsforward.ValidateClientID(id); err == nil {
+			c.IDs[i] = id
+		} else {
+			return fmt.Errorf("invalid client id at index %d: %q", i, id)
 		}
-
-		_, _, err := net.ParseCIDR(id)
-		if err == nil {
-			continue
-		}
-
-		_, err = net.ParseMAC(id)
-		if err == nil {
-			continue
-		}
-
-		return fmt.Errorf("invalid ID: %s", id)
 	}

 	for _, t := range c.Tags {
 		if !clients.tagKnown(t) {
-			return fmt.Errorf("invalid tag: %s", t)
+			return fmt.Errorf("invalid tag: %q", t)
 		}
 	}
+
 	sort.Strings(c.Tags)

-	err := dnsforward.ValidateUpstreams(c.Upstreams)
+	err = dnsforward.ValidateUpstreams(c.Upstreams)
 	if err != nil {
 		return fmt.Errorf("invalid upstream servers: %w", err)
 	}
@@ -414,49 +419,52 @@ func (clients *clientsContainer) check(c *Client) error {
 	return nil
 }

-// Add a new client object
-// Return true: success;  false: client exists.
-func (clients *clientsContainer) Add(c Client) (bool, error) {
-	e := clients.check(&c)
-	if e != nil {
-		return false, e
+// Add adds a new client object.  ok is false if such client already exists or
+// if an error occurred.
+func (clients *clientsContainer) Add(c *Client) (ok bool, err error) {
+	err = clients.check(c)
+	if err != nil {
+		return false, err
 	}

 	clients.lock.Lock()
 	defer clients.lock.Unlock()

 	// check Name index
-	_, ok := clients.list[c.Name]
+	_, ok = clients.list[c.Name]
 	if ok {
 		return false, nil
 	}

 	// check ID index
 	for _, id := range c.IDs {
-		c2, ok := clients.idIndex[id]
+		var c2 *Client
+		c2, ok = clients.idIndex[id]
 		if ok {
-			return false, fmt.Errorf("another client uses the same ID (%s): %s", id, c2.Name)
+			return false, fmt.Errorf("another client uses the same ID (%q): %q", id, c2.Name)
 		}
 	}

 	// update Name index
-	clients.list[c.Name] = &c
+	clients.list[c.Name] = c

 	// update ID index
 	for _, id := range c.IDs {
-		clients.idIndex[id] = &c
+		clients.idIndex[id] = c
 	}

-	log.Debug("Clients: added %q: ID:%v [%d]", c.Name, c.IDs, len(clients.list))
+	log.Debug("clients: added %q: ID:%q [%d]", c.Name, c.IDs, len(clients.list))
+
 	return true, nil
 }

-// Del removes a client
-func (clients *clientsContainer) Del(name string) bool {
+// Del removes a client.  ok is false if there is no such client.
+func (clients *clientsContainer) Del(name string) (ok bool) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	c, ok := clients.list[name]
+	var c *Client
+	c, ok = clients.list[name]
 	if !ok {
 		return false
 	}
@@ -468,25 +476,28 @@ func (clients *clientsContainer) Del(name string) bool {
 	for _, id := range c.IDs {
 		delete(clients.idIndex, id)
 	}
+
 	return true
 }

-// Return TRUE if arrays are equal
-func arraysEqual(a, b []string) bool {
+// equalStringSlices returns true if the slices are equal.
+func equalStringSlices(a, b []string) (ok bool) {
 	if len(a) != len(b) {
 		return false
 	}
-	for i := 0; i != len(a); i++ {
+
+	for i := range a {
 		if a[i] != b[i] {
 			return false
 		}
 	}
+
 	return true
 }

-// Update a client
-func (clients *clientsContainer) Update(name string, c Client) error {
-	err := clients.check(&c)
+// Update updates a client by its name.
+func (clients *clientsContainer) Update(name string, c *Client) (err error) {
+	err = clients.check(c)
 	if err != nil {
 		return err
 	}
@@ -494,66 +505,69 @@ func (clients *clientsContainer) Update(name string, c Client) error {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	old, ok := clients.list[name]
+	prev, ok := clients.list[name]
 	if !ok {
-		return fmt.Errorf("client not found")
+		return agherr.Error("client not found")
 	}

 	// check Name index
-	if old.Name != c.Name {
+	if prev.Name != c.Name {
 		_, ok = clients.list[c.Name]
 		if ok {
-			return fmt.Errorf("client already exists")
+			return agherr.Error("client already exists")
 		}
 	}

 	// check IP index
-	if !arraysEqual(old.IDs, c.IDs) {
+	if !equalStringSlices(prev.IDs, c.IDs) {
 		for _, id := range c.IDs {
 			c2, ok := clients.idIndex[id]
-			if ok && c2 != old {
-				return fmt.Errorf("another client uses the same ID (%s): %s", id, c2.Name)
+			if ok && c2 != prev {
+				return fmt.Errorf("another client uses the same ID (%q): %q", id, c2.Name)
 			}
 		}

 		// update ID index
-		for _, id := range old.IDs {
+		for _, id := range prev.IDs {
 			delete(clients.idIndex, id)
 		}
 		for _, id := range c.IDs {
-			clients.idIndex[id] = old
+			clients.idIndex[id] = prev
 		}
 	}

 	// update Name index
-	if old.Name != c.Name {
-		delete(clients.list, old.Name)
-		clients.list[c.Name] = old
+	if prev.Name != c.Name {
+		delete(clients.list, prev.Name)
+		clients.list[c.Name] = prev
 	}

 	// update upstreams cache
 	c.upstreamConfig = nil

-	*old = c
+	*prev = *c
+
 	return nil
 }

-// SetWhoisInfo - associate WHOIS information with a client
-func (clients *clientsContainer) SetWhoisInfo(ip net.IP, info [][]string) {
+// SetWhoisInfo sets the WHOIS information for a client.
+//
+// TODO(a.garipov): Perhaps replace [][]string with map[string]string.
+func (clients *clientsContainer) SetWhoisInfo(ip string, info [][]string) {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	_, ok := clients.findByIP(ip)
+	_, ok := clients.findLocked(ip)
 	if ok {
-		log.Debug("Clients: client for %s is already created, ignore WHOIS info", ip)
+		log.Debug("clients: client for %s is already created, ignore whois info", ip)
 		return
 	}

-	ipStr := ip.String()
-	ch, ok := clients.ipHost[ipStr]
+	ch, ok := clients.ipHost[ip]
 	if ok {
 		ch.WhoisInfo = info
-		log.Debug("Clients: set WHOIS info for auto-client %s: %v", ch.Host, ch.WhoisInfo)
+		log.Debug("clients: set whois info for auto-client %s: %q", ch.Host, info)
+
 		return
 	}

@@ -562,32 +576,34 @@ func (clients *clientsContainer) SetWhoisInfo(ip net.IP, info [][]string) {
 		Source: ClientSourceWHOIS,
 	}
 	ch.WhoisInfo = info
-	clients.ipHost[ipStr] = ch
-	log.Debug("Clients: set WHOIS info for auto-client with IP %s: %v", ip, ch.WhoisInfo)
+	clients.ipHost[ip] = ch
+	log.Debug("clients: set whois info for auto-client with IP %s: %q", ip, info)
 }

-// AddHost adds new IP -> Host pair
-// Use priority of the source (etc/hosts > ARP > rDNS)
-//  so we overwrite existing entries with an equal or higher priority
-func (clients *clientsContainer) AddHost(ip, host string, source clientSource) (bool, error) {
+// AddHost adds a new IP-hostname pairing.  The priorities of the sources is
+// taken into account.  ok is true if the pairing was added.
+func (clients *clientsContainer) AddHost(ip, host string, src clientSource) (ok bool, err error) {
 	clients.lock.Lock()
-	b := clients.addHost(ip, host, source)
+	ok = clients.addHostLocked(ip, host, src)
 	clients.lock.Unlock()
-	return b, nil
+
+	return ok, nil
 }

-func (clients *clientsContainer) addHost(ip, host string, source clientSource) (addedNew bool) {
-	ch, ok := clients.ipHost[ip]
+// addHostLocked adds a new IP-hostname pairing.  For internal use only.
+func (clients *clientsContainer) addHostLocked(ip, host string, src clientSource) (ok bool) {
+	var ch *ClientHost
+	ch, ok = clients.ipHost[ip]
 	if ok {
-		if ch.Source > source {
+		if ch.Source > src {
 			return false
 		}

-		ch.Source = source
+		ch.Source = src
 	} else {
 		ch = &ClientHost{
 			Host:   host,
-			Source: source,
+			Source: src,
 		}

 		clients.ipHost[ip] = ch
@@ -598,11 +614,11 @@ func (clients *clientsContainer) addHost(ip, host string, source clientSource) (
 	return true
 }

-// Remove all entries that match the specified source
-func (clients *clientsContainer) rmHosts(source clientSource) {
+// rmHostsBySrc removes all entries that match the specified source.
+func (clients *clientsContainer) rmHostsBySrc(src clientSource) {
 	n := 0
 	for k, v := range clients.ipHost {
-		if v.Source == source {
+		if v.Source == src {
 			delete(clients.ipHost, k)
 			n++
 		}
@@ -611,19 +627,20 @@ func (clients *clientsContainer) rmHosts(source clientSource) {
 	log.Debug("clients: removed %d client aliases", n)
 }

-// addFromHostsFile fills the clients hosts list from the system's hosts files.
+// addFromHostsFile fills the client-hostname pairing index from the system's
+// hosts files.
 func (clients *clientsContainer) addFromHostsFile() {
 	hosts := clients.autoHosts.List()

 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	clients.rmHosts(ClientSourceHostsFile)
+	clients.rmHostsBySrc(ClientSourceHostsFile)

 	n := 0
 	for ip, names := range hosts {
 		for _, name := range names {
-			ok := clients.addHost(ip, name, ClientSourceHostsFile)
+			ok := clients.addHostLocked(ip, name, ClientSourceHostsFile)
 			if ok {
 				n++
 			}
@@ -633,31 +650,31 @@ func (clients *clientsContainer) addFromHostsFile() {
 	log.Debug("Clients: added %d client aliases from system hosts-file", n)
 }

-// Add IP -> Host pairs from the system's `arp -a` command output
-// The command's output is:
-// HOST (IP) at MAC on IFACE
+// addFromSystemARP adds the IP-hostname pairings from the output of the arp -a
+// command.
 func (clients *clientsContainer) addFromSystemARP() {
 	if runtime.GOOS == "windows" {
 		return
 	}

 	cmd := exec.Command("arp", "-a")
-	log.Tracef("executing %s %v", cmd.Path, cmd.Args)
+	log.Tracef("executing %q %q", cmd.Path, cmd.Args)
 	data, err := cmd.Output()
 	if err != nil || cmd.ProcessState.ExitCode() != 0 {
-		log.Debug("command %s has failed: %v code:%d",
+		log.Debug("command %q has failed: %q code:%d",
 			cmd.Path, err, cmd.ProcessState.ExitCode())
 		return
 	}

 	clients.lock.Lock()
 	defer clients.lock.Unlock()
-	clients.rmHosts(ClientSourceARP)
+
+	clients.rmHostsBySrc(ClientSourceARP)

 	n := 0
+	// TODO(a.garipov): Rewrite to use bufio.Scanner.
 	lines := strings.Split(string(data), "\n")
 	for _, ln := range lines {
-
 		open := strings.Index(ln, " (")
 		close := strings.Index(ln, ") ")
 		if open == -1 || close == -1 || open >= close {
@@ -670,16 +687,17 @@ func (clients *clientsContainer) addFromSystemARP() {
 			continue
 		}

-		ok := clients.addHost(ip, host, ClientSourceARP)
+		ok := clients.addHostLocked(ip, host, ClientSourceARP)
 		if ok {
 			n++
 		}
 	}

-	log.Debug("Clients: added %d client aliases from 'arp -a' command output", n)
+	log.Debug("clients: added %d client aliases from 'arp -a' command output", n)
 }

-// Add clients from DHCP that have non-empty Hostname property
+// addFromDHCP adds the clients that have a non-empty hostname from the DHCP
+// server.
 func (clients *clientsContainer) addFromDHCP() {
 	if clients.dhcpServer == nil {
 		return
@@ -688,18 +706,20 @@ func (clients *clientsContainer) addFromDHCP() {
 	clients.lock.Lock()
 	defer clients.lock.Unlock()

-	clients.rmHosts(ClientSourceDHCP)
+	clients.rmHostsBySrc(ClientSourceDHCP)

 	leases := clients.dhcpServer.Leases(dhcpd.LeasesAll)
 	n := 0
 	for _, l := range leases {
-		if len(l.Hostname) == 0 {
+		if l.Hostname == "" {
 			continue
 		}
-		ok := clients.addHost(l.IP.String(), l.Hostname, ClientSourceDHCP)
+
+		ok := clients.addHostLocked(l.IP.String(), l.Hostname, ClientSourceDHCP)
 		if ok {
 			n++
 		}
 	}
-	log.Debug("Clients: added %d client aliases from DHCP", n)
+
+	log.Debug("clients: added %d client aliases from dhcp", n)
 }
--- a/internal/home/clients_test.go
+++ b/internal/home/clients_test.go
@@ -18,65 +18,65 @@ func TestClients(t *testing.T) {
 	clients.Init(nil, nil, nil)

 	t.Run("add_success", func(t *testing.T) {
-		c := Client{
+		c := &Client{
 			IDs:  []string{"1.1.1.1", "1:2:3::4", "aa:aa:aa:aa:aa:aa"},
 			Name: "client1",
 		}

-		b, err := clients.Add(c)
-		assert.True(t, b)
+		ok, err := clients.Add(c)
+		assert.True(t, ok)
 		assert.Nil(t, err)

-		c = Client{
+		c = &Client{
 			IDs:  []string{"2.2.2.2"},
 			Name: "client2",
 		}

-		b, err = clients.Add(c)
-		assert.True(t, b)
+		ok, err = clients.Add(c)
+		assert.True(t, ok)
 		assert.Nil(t, err)

-		c, b = clients.Find(net.IPv4(1, 1, 1, 1))
-		assert.True(t, b)
-		assert.Equal(t, c.Name, "client1")
+		c, ok = clients.Find("1.1.1.1")
+		assert.True(t, ok)
+		assert.Equal(t, "client1", c.Name)

-		c, b = clients.Find(net.ParseIP("1:2:3::4"))
-		assert.True(t, b)
-		assert.Equal(t, c.Name, "client1")
+		c, ok = clients.Find("1:2:3::4")
+		assert.True(t, ok)
+		assert.Equal(t, "client1", c.Name)

-		c, b = clients.Find(net.IPv4(2, 2, 2, 2))
-		assert.True(t, b)
-		assert.Equal(t, c.Name, "client2")
+		c, ok = clients.Find("2.2.2.2")
+		assert.True(t, ok)
+		assert.Equal(t, "client2", c.Name)

-		assert.False(t, clients.Exists(net.IPv4(1, 2, 3, 4), ClientSourceHostsFile))
-		assert.True(t, clients.Exists(net.IPv4(1, 1, 1, 1), ClientSourceHostsFile))
-		assert.True(t, clients.Exists(net.IPv4(2, 2, 2, 2), ClientSourceHostsFile))
+		assert.True(t, !clients.Exists("1.2.3.4", ClientSourceHostsFile))
+		assert.True(t, clients.Exists("1.1.1.1", ClientSourceHostsFile))
+		assert.True(t, clients.Exists("2.2.2.2", ClientSourceHostsFile))
 	})

 	t.Run("add_fail_name", func(t *testing.T) {
-		c := Client{
+		c := &Client{
 			IDs:  []string{"1.2.3.5"},
 			Name: "client1",
 		}

-		b, err := clients.Add(c)
-		assert.False(t, b)
+		ok, err := clients.Add(c)
+		assert.False(t, ok)
 		assert.Nil(t, err)
 	})

 	t.Run("add_fail_ip", func(t *testing.T) {
-		c := Client{
+		c := &Client{
 			IDs:  []string{"2.2.2.2"},
 			Name: "client3",
 		}

-		b, err := clients.Add(c)
-		assert.False(t, b)
+		ok, err := clients.Add(c)
+		assert.False(t, ok)
 		assert.NotNil(t, err)
 	})

 	t.Run("update_fail_name", func(t *testing.T) {
-		c := Client{
+		c := &Client{
 			IDs:  []string{"1.2.3.0"},
 			Name: "client3",
 		}
@@ -84,7 +84,7 @@ func TestClients(t *testing.T) {
 		err := clients.Update("client3", c)
 		assert.NotNil(t, err)

-		c = Client{
+		c = &Client{
 			IDs:  []string{"1.2.3.0"},
 			Name: "client2",
 		}
@@ -94,7 +94,7 @@ func TestClients(t *testing.T) {
 	})

 	t.Run("update_fail_ip", func(t *testing.T) {
-		c := Client{
+		c := &Client{
 			IDs:  []string{"2.2.2.2"},
 			Name: "client1",
 		}
@@ -104,7 +104,7 @@ func TestClients(t *testing.T) {
 	})

 	t.Run("update_success", func(t *testing.T) {
-		c := Client{
+		c := &Client{
 			IDs:  []string{"1.1.1.2"},
 			Name: "client1",
 		}
@@ -112,10 +112,10 @@ func TestClients(t *testing.T) {
 		err := clients.Update("client1", c)
 		assert.Nil(t, err)

-		assert.False(t, clients.Exists(net.IPv4(1, 1, 1, 1), ClientSourceHostsFile))
-		assert.True(t, clients.Exists(net.IPv4(1, 1, 1, 2), ClientSourceHostsFile))
+		assert.True(t, !clients.Exists("1.1.1.1", ClientSourceHostsFile))
+		assert.True(t, clients.Exists("1.1.1.2", ClientSourceHostsFile))

-		c = Client{
+		c = &Client{
 			IDs:            []string{"1.1.1.2"},
 			Name:           "client1-renamed",
 			UseOwnSettings: true,
@@ -124,77 +124,89 @@ func TestClients(t *testing.T) {
 		err = clients.Update("client1", c)
 		assert.Nil(t, err)

-		c, b := clients.Find(net.IPv4(1, 1, 1, 2))
-		assert.True(t, b)
+		c, ok := clients.Find("1.1.1.2")
+		assert.True(t, ok)
 		assert.Equal(t, "client1-renamed", c.Name)
-		assert.Equal(t, "1.1.1.2", c.IDs[0])
 		assert.True(t, c.UseOwnSettings)
 		assert.Nil(t, clients.list["client1"])
+		if assert.Len(t, c.IDs, 1) {
+			assert.Equal(t, "1.1.1.2", c.IDs[0])
+		}
 	})

 	t.Run("del_success", func(t *testing.T) {
-		b := clients.Del("client1-renamed")
-		assert.True(t, b)
-		assert.False(t, clients.Exists(net.IPv4(1, 1, 1, 2), ClientSourceHostsFile))
+		ok := clients.Del("client1-renamed")
+		assert.True(t, ok)
+		assert.False(t, clients.Exists("1.1.1.2", ClientSourceHostsFile))
 	})

 	t.Run("del_fail", func(t *testing.T) {
-		b := clients.Del("client3")
-		assert.False(t, b)
+		ok := clients.Del("client3")
+		assert.False(t, ok)
 	})

 	t.Run("addhost_success", func(t *testing.T) {
-		b, err := clients.AddHost("1.1.1.1", "host", ClientSourceARP)
-		assert.True(t, b)
+		ok, err := clients.AddHost("1.1.1.1", "host", ClientSourceARP)
+		assert.True(t, ok)
 		assert.Nil(t, err)

-		b, err = clients.AddHost("1.1.1.1", "host2", ClientSourceARP)
-		assert.True(t, b)
+		ok, err = clients.AddHost("1.1.1.1", "host2", ClientSourceARP)
+		assert.True(t, ok)
 		assert.Nil(t, err)

-		b, err = clients.AddHost("1.1.1.1", "host3", ClientSourceHostsFile)
-		assert.True(t, b)
+		ok, err = clients.AddHost("1.1.1.1", "host3", ClientSourceHostsFile)
+		assert.True(t, ok)
 		assert.Nil(t, err)

-		assert.True(t, clients.Exists(net.IPv4(1, 1, 1, 1), ClientSourceHostsFile))
+		assert.True(t, clients.Exists("1.1.1.1", ClientSourceHostsFile))
 	})

 	t.Run("addhost_fail", func(t *testing.T) {
-		b, err := clients.AddHost("1.1.1.1", "host1", ClientSourceRDNS)
-		assert.False(t, b)
+		ok, err := clients.AddHost("1.1.1.1", "host1", ClientSourceRDNS)
+		assert.False(t, ok)
 		assert.Nil(t, err)
 	})
 }

 func TestClientsWhois(t *testing.T) {
-	var c Client
+	var c *Client
 	clients := clientsContainer{}
 	clients.testing = true
 	clients.Init(nil, nil, nil)

 	whois := [][]string{{"orgname", "orgname-val"}, {"country", "country-val"}}
 	// set whois info on new client
-	clients.SetWhoisInfo(net.IPv4(1, 1, 1, 255), whois)
-	assert.Equal(t, "orgname-val", clients.ipHost["1.1.1.255"].WhoisInfo[0][1])
+	clients.SetWhoisInfo("1.1.1.255", whois)
+	if assert.NotNil(t, clients.ipHost["1.1.1.255"]) {
+		h := clients.ipHost["1.1.1.255"]
+		if assert.Len(t, h.WhoisInfo, 2) && assert.Len(t, h.WhoisInfo[0], 2) {
+			assert.Equal(t, "orgname-val", h.WhoisInfo[0][1])
+		}
+	}

 	// set whois info on existing auto-client
 	_, _ = clients.AddHost("1.1.1.1", "host", ClientSourceRDNS)
-	clients.SetWhoisInfo(net.IPv4(1, 1, 1, 1), whois)
-	assert.Equal(t, "orgname-val", clients.ipHost["1.1.1.1"].WhoisInfo[0][1])
+	clients.SetWhoisInfo("1.1.1.1", whois)
+	if assert.NotNil(t, clients.ipHost["1.1.1.1"]) {
+		h := clients.ipHost["1.1.1.1"]
+		if assert.Len(t, h.WhoisInfo, 2) && assert.Len(t, h.WhoisInfo[0], 2) {
+			assert.Equal(t, "orgname-val", h.WhoisInfo[0][1])
+		}
+	}

 	// Check that we cannot set whois info on a manually-added client
-	c = Client{
+	c = &Client{
 		IDs:  []string{"1.1.1.2"},
 		Name: "client1",
 	}
 	_, _ = clients.Add(c)
-	clients.SetWhoisInfo(net.IPv4(1, 1, 1, 2), whois)
+	clients.SetWhoisInfo("1.1.1.2", whois)
 	assert.Nil(t, clients.ipHost["1.1.1.2"])
 	_ = clients.Del("client1")
 }

 func TestClientsAddExisting(t *testing.T) {
-	var c Client
+	var c *Client
 	clients := clientsContainer{}
 	clients.testing = true
 	clients.Init(nil, nil, nil)
@@ -204,7 +216,7 @@ func TestClientsAddExisting(t *testing.T) {
 	testIP := "1.2.3.4"

 	// add a client
-	c = Client{
+	c = &Client{
 		IDs:  []string{"1.1.1.1", "1:2:3::4", "aa:aa:aa:aa:aa:aa", "2.2.2.0/24"},
 		Name: "client1",
 	}
@@ -233,7 +245,7 @@ func TestClientsAddExisting(t *testing.T) {
 	assert.Nil(t, err)

 	// add a new client with the same IP as for a client with MAC
-	c = Client{
+	c = &Client{
 		IDs:  []string{testIP},
 		Name: "client2",
 	}
@@ -242,7 +254,7 @@ func TestClientsAddExisting(t *testing.T) {
 	assert.Nil(t, err)

 	// add a new client with the IP from the client1's IP range
-	c = Client{
+	c = &Client{
 		IDs:  []string{"2.2.2.2"},
 		Name: "client3",
 	}
@@ -258,7 +270,7 @@ func TestClientsCustomUpstream(t *testing.T) {
 	clients.Init(nil, nil, nil)

 	// add client with upstreams
-	client := Client{
+	c := &Client{
 		IDs:  []string{"1.1.1.1", "1:2:3::4", "aa:aa:aa:aa:aa:aa"},
 		Name: "client1",
 		Upstreams: []string{
@@ -266,7 +278,7 @@ func TestClientsCustomUpstream(t *testing.T) {
 			"[/example.org/]8.8.8.8",
 		},
 	}
-	ok, err := clients.Add(client)
+	ok, err := clients.Add(c)
 	assert.Nil(t, err)
 	assert.True(t, ok)

@@ -275,6 +287,6 @@ func TestClientsCustomUpstream(t *testing.T) {

 	config = clients.FindUpstreams("1.1.1.1")
 	assert.NotNil(t, config)
-	assert.Len(t, config.Upstreams, 1)
-	assert.Len(t, config.DomainReservedUpstreams, 1)
+	assert.Equal(t, 1, len(config.Upstreams))
+	assert.Equal(t, 1, len(config.DomainReservedUpstreams))
 }
--- a/internal/home/clientshttp.go
+++ b/internal/home/clientshttp.go
@@ -158,7 +158,7 @@ func (clients *clientsContainer) handleAddClient(w http.ResponseWriter, r *http.
 	}

 	c := jsonToClient(cj)
-	ok, err := clients.Add(*c)
+	ok, err := clients.Add(c)
 	if err != nil {
 		httpError(w, http.StatusBadRequest, "%s", err)
 		return
@@ -216,7 +216,7 @@ func (clients *clientsContainer) handleUpdateClient(w http.ResponseWriter, r *ht
 	}

 	c := jsonToClient(dj.Data)
-	err = clients.Update(dj.Name, *c)
+	err = clients.Update(dj.Name, c)
 	if err != nil {
 		httpError(w, http.StatusBadRequest, "%s", err)
 		return
@@ -229,28 +229,28 @@ func (clients *clientsContainer) handleUpdateClient(w http.ResponseWriter, r *ht
 func (clients *clientsContainer) handleFindClient(w http.ResponseWriter, r *http.Request) {
 	q := r.URL.Query()
 	data := []map[string]clientJSON{}
-	for i := 0; ; i++ {
-		ipStr := q.Get(fmt.Sprintf("ip%d", i))
-		ip := net.ParseIP(ipStr)
-		if ip == nil {
+	for i := 0; i < len(q); i++ {
+		idStr := q.Get(fmt.Sprintf("ip%d", i))
+		if idStr == "" {
 			break
 		}

-		c, ok := clients.Find(ip)
+		ip := net.ParseIP(idStr)
+		c, ok := clients.Find(idStr)
 		var cj clientJSON
 		if !ok {
 			var found bool
-			cj, found = clients.findTemporary(ip)
+			cj, found = clients.findTemporary(ip, idStr)
 			if !found {
 				continue
 			}
 		} else {
-			cj = clientToJSON(&c)
+			cj = clientToJSON(c)
 			cj.Disallowed, cj.DisallowedRule = clients.dnsServer.IsBlockedIP(ip)
 		}

 		data = append(data, map[string]clientJSON{
-			ipStr: cj,
+			idStr: cj,
 		})
 	}

@@ -263,10 +263,9 @@ func (clients *clientsContainer) handleFindClient(w http.ResponseWriter, r *http

 // findTemporary looks up the IP in temporary storages, like autohosts or
 // blocklists.
-func (clients *clientsContainer) findTemporary(ip net.IP) (cj clientJSON, found bool) {
-	ipStr := ip.String()
-	ch, ok := clients.FindAutoClient(ip)
-	if !ok {
+func (clients *clientsContainer) findTemporary(ip net.IP, idStr string) (cj clientJSON, found bool) {
+	ch, ok := clients.FindAutoClient(idStr)
+	if !ok && ip != nil {
 		// It is still possible that the IP used to be in the runtime
 		// clients list, but then the server was reloaded.  So, check
 		// the DNS server's blocked IP list.
@@ -278,7 +277,7 @@ func (clients *clientsContainer) findTemporary(ip net.IP) (cj clientJSON, found
 		}

 		cj = clientJSON{
-			IDs:            []string{ipStr},
+			IDs:            []string{idStr},
 			Disallowed:     disallowed,
 			DisallowedRule: rule,
 		}
@@ -286,8 +285,10 @@ func (clients *clientsContainer) findTemporary(ip net.IP) (cj clientJSON, found
 		return cj, true
 	}

-	cj = clientHostToJSON(ipStr, ch)
-	cj.Disallowed, cj.DisallowedRule = clients.dnsServer.IsBlockedIP(ip)
+	cj = clientHostToJSON(idStr, ch)
+	if ip != nil {
+		cj.Disallowed, cj.DisallowedRule = clients.dnsServer.IsBlockedIP(ip)
+	}

 	return cj, true
 }
--- a/internal/home/config.go
+++ b/internal/home/config.go
@@ -1,6 +1,7 @@
 package home

 import (
+	"errors"
 	"io/ioutil"
 	"net"
 	"os"
@@ -188,7 +189,7 @@ func initConfig() {
 func (c *configuration) getConfigFilename() string {
 	configFile, err := filepath.EvalSymlinks(Context.configFilename)
 	if err != nil {
-		if !os.IsNotExist(err) {
+		if !errors.Is(err, os.ErrNotExist) {
 			log.Error("unexpected error while config file path evaluation: %s", err)
 		}
 		configFile = Context.configFilename
--- a/internal/home/dns.go
+++ b/internal/home/dns.go
@@ -3,8 +3,10 @@ package home
 import (
 	"fmt"
 	"net"
+	"net/url"
 	"os"
 	"path/filepath"
+	"strconv"

 	"github.com/AdguardTeam/AdGuardHome/internal/agherr"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
@@ -58,7 +60,7 @@ func initDNSServer() error {
 	if config.DNS.BindHost.IsUnspecified() {
 		bindhost = net.IPv4(127, 0, 0, 1)
 	}
-	filterConf.ResolverAddress = fmt.Sprintf("%s:%d", bindhost, config.DNS.Port)
+	filterConf.ResolverAddress = net.JoinHostPort(bindhost.String(), strconv.Itoa(config.DNS.Port))
 	filterConf.AutoHosts = &Context.autoHosts
 	filterConf.ConfigModified = onConfigModified
 	filterConf.HTTPRegister = httpRegister
@@ -126,6 +128,7 @@ func generateServerConfig() (newconfig dnsforward.ServerConfig, err error) {
 	Context.tls.WriteDiskConfig(&tlsConf)
 	if tlsConf.Enabled {
 		newconfig.TLSConfig = tlsConf.TLSConfig
+		newconfig.TLSConfig.ServerName = tlsConf.ServerName

 		if tlsConf.PortDNSOverTLS != 0 {
 			newconfig.TLSListenAddr = &net.TCPAddr{
@@ -207,36 +210,42 @@ type dnsEncryption struct {
 	quic  string
 }

-func getDNSEncryption() dnsEncryption {
-	dnsEncryption := dnsEncryption{}
-
+func getDNSEncryption() (de dnsEncryption) {
 	tlsConf := tlsConfigSettings{}

 	Context.tls.WriteDiskConfig(&tlsConf)

 	if tlsConf.Enabled && len(tlsConf.ServerName) != 0 {
-
+		hostname := tlsConf.ServerName
 		if tlsConf.PortHTTPS != 0 {
-			addr := tlsConf.ServerName
+			addr := hostname
 			if tlsConf.PortHTTPS != 443 {
-				addr = fmt.Sprintf("%s:%d", addr, tlsConf.PortHTTPS)
+				addr = net.JoinHostPort(addr, strconv.Itoa(tlsConf.PortHTTPS))
 			}
-			addr = fmt.Sprintf("https://%s/dns-query", addr)
-			dnsEncryption.https = addr
+
+			de.https = (&url.URL{
+				Scheme: "https",
+				Host:   addr,
+				Path:   "/dns-query",
+			}).String()
 		}

 		if tlsConf.PortDNSOverTLS != 0 {
-			addr := fmt.Sprintf("tls://%s:%d", tlsConf.ServerName, tlsConf.PortDNSOverTLS)
-			dnsEncryption.tls = addr
+			de.tls = (&url.URL{
+				Scheme: "tls",
+				Host:   net.JoinHostPort(hostname, strconv.Itoa(tlsConf.PortDNSOverTLS)),
+			}).String()
 		}

 		if tlsConf.PortDNSOverQUIC != 0 {
-			addr := fmt.Sprintf("quic://%s:%d", tlsConf.ServerName, tlsConf.PortDNSOverQUIC)
-			dnsEncryption.quic = addr
+			de.quic = (&url.URL{
+				Scheme: "quic",
+				Host:   net.JoinHostPort(hostname, strconv.Itoa(int(tlsConf.PortDNSOverQUIC))),
+			}).String()
 		}
 	}

-	return dnsEncryption
+	return de
 }

 // Get the list of DNS addresses the server is listening on
@@ -273,21 +282,26 @@ func getDNSAddresses() []string {
 	return dnsAddresses
 }

-// If a client has his own settings, apply them
-func applyAdditionalFiltering(clientAddr net.IP, setts *dnsfilter.RequestFilteringSettings) {
+// applyAdditionalFiltering adds additional client information and settings if
+// the client has them.
+func applyAdditionalFiltering(clientAddr net.IP, clientID string, setts *dnsfilter.RequestFilteringSettings) {
 	Context.dnsFilter.ApplyBlockedServices(setts, nil, true)

 	if clientAddr == nil {
 		return
 	}
+
 	setts.ClientIP = clientAddr

-	c, ok := Context.clients.Find(clientAddr)
+	c, ok := Context.clients.Find(clientID)
 	if !ok {
-		return
+		c, ok = Context.clients.Find(clientAddr.String())
+		if !ok {
+			return
+		}
 	}

-	log.Debug("Using settings for client %s with IP %s", c.Name, clientAddr)
+	log.Debug("using settings for client %s with ip %s and id %q", c.Name, clientAddr, clientID)

 	if c.UseOwnBlockedServices {
 		Context.dnsFilter.ApplyBlockedServices(setts, c.BlockedServices, false)
--- a/internal/home/home.go
+++ b/internal/home/home.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"net"
@@ -434,6 +435,10 @@ func initWorkingDir(args options) {
 	} else {
 		Context.workDir = filepath.Dir(execPath)
 	}
+
+	if workDir, err := filepath.EvalSymlinks(Context.workDir); err == nil {
+		Context.workDir = workDir
+	}
 }

 // configureLogger configures logger level and output
@@ -624,7 +629,7 @@ func detectFirstRun() bool {
 		configfile = filepath.Join(Context.workDir, Context.configFilename)
 	}
 	_, err := os.Stat(configfile)
-	return os.IsNotExist(err)
+	return errors.Is(err, os.ErrNotExist)
 }

 // Connect to a remote server resolving hostname using our own DNS server
--- a/internal/home/mobileconfig.go
+++ b/internal/home/mobileconfig.go
@@ -4,7 +4,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
+	"path"

+	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/golibs/log"
 	uuid "github.com/satori/go.uuid"
 	"howett.net/plist"
@@ -14,6 +17,7 @@ type dnsSettings struct {
 	DNSProtocol string
 	ServerURL   string `plist:",omitempty"`
 	ServerName  string `plist:",omitempty"`
+	clientID    string
 }

 type payloadContent struct {
@@ -23,19 +27,19 @@ type payloadContent struct {
 	PayloadIdentifier  string
 	PayloadType        string
 	PayloadUUID        string
-	PayloadVersion     int
 	DNSSettings        dnsSettings
+	PayloadVersion     int
 }

 type mobileConfig struct {
-	PayloadContent           []payloadContent
 	PayloadDescription       string
 	PayloadDisplayName       string
 	PayloadIdentifier        string
-	PayloadRemovalDisallowed bool
 	PayloadType              string
 	PayloadUUID              string
+	PayloadContent           []payloadContent
 	PayloadVersion           int
+	PayloadRemovalDisallowed bool
 }

 func genUUIDv4() string {
@@ -48,22 +52,35 @@ const (
 )

 func getMobileConfig(d dnsSettings) ([]byte, error) {
-	var name string
+	var dspName string
 	switch d.DNSProtocol {
 	case dnsProtoHTTPS:
-		name = fmt.Sprintf("%s DoH", d.ServerName)
-		d.ServerURL = fmt.Sprintf("https://%s/dns-query", d.ServerName)
+		dspName = fmt.Sprintf("%s DoH", d.ServerName)
+
+		u := &url.URL{
+			Scheme: "https",
+			Host:   d.ServerName,
+			Path:   "/dns-query",
+		}
+		if d.clientID != "" {
+			u.Path = path.Join(u.Path, d.clientID)
+		}
+
+		d.ServerURL = u.String()
 	case dnsProtoTLS:
-		name = fmt.Sprintf("%s DoT", d.ServerName)
+		dspName = fmt.Sprintf("%s DoT", d.ServerName)
+		if d.clientID != "" {
+			d.ServerName = d.clientID + "." + d.ServerName
+		}
 	default:
 		return nil, fmt.Errorf("bad dns protocol %q", d.DNSProtocol)
 	}

 	data := mobileConfig{
 		PayloadContent: []payloadContent{{
-			Name:               name,
+			Name:               dspName,
 			PayloadDescription: "Configures device to use AdGuard Home",
-			PayloadDisplayName: name,
+			PayloadDisplayName: dspName,
 			PayloadIdentifier:  fmt.Sprintf("com.apple.dnsSettings.managed.%s", genUUIDv4()),
 			PayloadType:        "com.apple.dnsSettings.managed",
 			PayloadUUID:        genUUIDv4(),
@@ -71,7 +88,7 @@ func getMobileConfig(d dnsSettings) ([]byte, error) {
 			DNSSettings:        d,
 		}},
 		PayloadDescription:       "Adds AdGuard Home to Big Sur and iOS 14 or newer systems",
-		PayloadDisplayName:       name,
+		PayloadDisplayName:       dspName,
 		PayloadIdentifier:        genUUIDv4(),
 		PayloadRemovalDisallowed: false,
 		PayloadType:              "Configuration",
@@ -83,7 +100,10 @@ func getMobileConfig(d dnsSettings) ([]byte, error) {
 }

 func handleMobileConfig(w http.ResponseWriter, r *http.Request, dnsp string) {
-	host := r.URL.Query().Get("host")
+	var err error
+
+	q := r.URL.Query()
+	host := q.Get("host")
 	if host == "" {
 		host = Context.tls.conf.ServerName
 	}
@@ -92,7 +112,7 @@ func handleMobileConfig(w http.ResponseWriter, r *http.Request, dnsp string) {
 		w.WriteHeader(http.StatusInternalServerError)

 		const msg = "no host in query parameters and no server_name"
-		err := json.NewEncoder(w).Encode(&jsonError{
+		err = json.NewEncoder(w).Encode(&jsonError{
 			Message: msg,
 		})
 		if err != nil {
@@ -102,9 +122,25 @@ func handleMobileConfig(w http.ResponseWriter, r *http.Request, dnsp string) {
 		return
 	}

+	clientID := q.Get("client_id")
+	err = dnsforward.ValidateClientID(clientID)
+	if err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+
+		err = json.NewEncoder(w).Encode(&jsonError{
+			Message: err.Error(),
+		})
+		if err != nil {
+			log.Debug("writing 400 json response: %s", err)
+		}
+
+		return
+	}
+
 	d := dnsSettings{
 		DNSProtocol: dnsp,
 		ServerName:  host,
+		clientID:    clientID,
 	}

 	mobileconfig, err := getMobileConfig(d)
@@ -115,6 +151,7 @@ func handleMobileConfig(w http.ResponseWriter, r *http.Request, dnsp string) {
 	}

 	w.Header().Set("Content-Type", "application/xml")
+
 	_, _ = w.Write(mobileconfig)
 }

--- a/internal/home/mobileconfig_test.go
+++ b/internal/home/mobileconfig_test.go
@@ -73,6 +73,27 @@ func TestHandleMobileConfigDOH(t *testing.T) {
 		handleMobileConfigDOH(w, r)
 		assert.Equal(t, http.StatusInternalServerError, w.Code)
 	})
+
+	t.Run("client_id", func(t *testing.T) {
+		r, err := http.NewRequest(http.MethodGet, "https://example.com:12345/apple/doh.mobileconfig?host=example.org&client_id=cli42", nil)
+		assert.Nil(t, err)
+
+		w := httptest.NewRecorder()
+
+		handleMobileConfigDOH(w, r)
+		assert.Equal(t, http.StatusOK, w.Code)
+
+		var mc mobileConfig
+		_, err = plist.Unmarshal(w.Body.Bytes(), &mc)
+		assert.Nil(t, err)
+
+		if assert.Len(t, mc.PayloadContent, 1) {
+			assert.Equal(t, "example.org DoH", mc.PayloadContent[0].Name)
+			assert.Equal(t, "example.org DoH", mc.PayloadContent[0].PayloadDisplayName)
+			assert.Equal(t, "example.org", mc.PayloadContent[0].DNSSettings.ServerName)
+			assert.Equal(t, "https://example.org/dns-query/cli42", mc.PayloadContent[0].DNSSettings.ServerURL)
+		}
+	})
 }

 func TestHandleMobileConfigDOT(t *testing.T) {
@@ -137,4 +158,24 @@ func TestHandleMobileConfigDOT(t *testing.T) {
 		handleMobileConfigDOT(w, r)
 		assert.Equal(t, http.StatusInternalServerError, w.Code)
 	})
+
+	t.Run("client_id", func(t *testing.T) {
+		r, err := http.NewRequest(http.MethodGet, "https://example.com:12345/apple/dot.mobileconfig?host=example.org&client_id=cli42", nil)
+		assert.Nil(t, err)
+
+		w := httptest.NewRecorder()
+
+		handleMobileConfigDOT(w, r)
+		assert.Equal(t, http.StatusOK, w.Code)
+
+		var mc mobileConfig
+		_, err = plist.Unmarshal(w.Body.Bytes(), &mc)
+		assert.Nil(t, err)
+
+		if assert.Len(t, mc.PayloadContent, 1) {
+			assert.Equal(t, "example.org DoT", mc.PayloadContent[0].Name)
+			assert.Equal(t, "example.org DoT", mc.PayloadContent[0].PayloadDisplayName)
+			assert.Equal(t, "cli42.example.org", mc.PayloadContent[0].DNSSettings.ServerName)
+		}
+	})
 }
--- a/internal/home/rdns.go
+++ b/internal/home/rdns.go
@@ -57,7 +57,8 @@ func (r *RDNS) Begin(ip net.IP) {
 	binary.BigEndian.PutUint64(expire, now+ttl)
 	_ = r.ipAddrs.Set(ip, expire)

-	if r.clients.Exists(ip, ClientSourceRDNS) {
+	id := ip.String()
+	if r.clients.Exists(id, ClientSourceRDNS) {
 		return
 	}

--- a/internal/home/whois.go
+++ b/internal/home/whois.go
@@ -11,7 +11,6 @@ import (

 	"github.com/AdguardTeam/AdGuardHome/internal/aghio"
 	"github.com/AdguardTeam/AdGuardHome/internal/util"
-
 	"github.com/AdguardTeam/golibs/cache"
 	"github.com/AdguardTeam/golibs/log"
 )
@@ -25,14 +24,16 @@ const (

 // Whois - module context
 type Whois struct {
-	clients     *clientsContainer
-	ipChan      chan net.IP
-	timeoutMsec uint
+	clients *clientsContainer
+	ipChan  chan net.IP

 	// Contains IP addresses of clients
 	// An active IP address is resolved once again after it expires.
 	// If IP address couldn't be resolved, it stays here for some time to prevent further attempts to resolve the same IP.
 	ipAddrs cache.Cache
+
+	// TODO(a.garipov): Rewrite to use time.Duration.  Like, seriously, why?
+	timeoutMsec uint
 }

 // initWhois creates the Whois module context.
@@ -244,6 +245,7 @@ func (w *Whois) workerLoop() {
 			continue
 		}

-		w.clients.SetWhoisInfo(ip, info)
+		id := ip.String()
+		w.clients.SetWhoisInfo(id, info)
 	}
 }