From 474306d46546097700d5c767c7283f33f63f53d7 Mon Sep 17 00:00:00 2001
From: ArtemBaskal <a.baskal@adguard.com>
Date: Thu, 3 Sep 2020 23:05:11 +0300
Subject: [PATCH 01/34] - client: Fix delay of custom filter editor

---
 client/src/actions/index.js                    | 4 ++--
 client/src/components/Logs/Cells/ClientCell.js | 4 +++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/client/src/actions/index.js b/client/src/actions/index.js
index ff512883..6842accc 100644
--- a/client/src/actions/index.js
+++ b/client/src/actions/index.js
@@ -561,10 +561,10 @@ export const toggleBlocking = (type, domain) => async (dispatch, getState) => {
     const matchPreparedUnblockingRule = userRules.match(preparedUnblockingRule);
 
     if (matchPreparedBlockingRule) {
-        dispatch(setRules(userRules.replace(`${blockingRule}`, '')));
+        await dispatch(setRules(userRules.replace(`${blockingRule}`, '')));
         dispatch(addSuccessToast(i18next.t('rule_removed_from_custom_filtering_toast', { rule: blockingRule })));
     } else if (!matchPreparedUnblockingRule) {
-        dispatch(setRules(`${userRules}${lineEnding}${unblockingRule}\n`));
+        await dispatch(setRules(`${userRules}${lineEnding}${unblockingRule}\n`));
         dispatch(addSuccessToast(i18next.t('rule_added_to_custom_filtering_toast', { rule: unblockingRule })));
     } else if (matchPreparedUnblockingRule) {
         dispatch(addSuccessToast(i18next.t('rule_added_to_custom_filtering_toast', { rule: unblockingRule })));
diff --git a/client/src/components/Logs/Cells/ClientCell.js b/client/src/components/Logs/Cells/ClientCell.js
index 93830faa..da0c9c9b 100644
--- a/client/src/components/Logs/Cells/ClientCell.js
+++ b/client/src/components/Logs/Cells/ClientCell.js
@@ -59,7 +59,9 @@ const ClientCell = ({
             'btn-outline-danger': !isFiltered,
         });
 
-        const onClick = () => dispatch(toggleBlocking(buttonType, domain));
+        const onClick = async () => {
+            await dispatch(toggleBlocking(buttonType, domain));
+        };
 
         return <button
                 type="button"

From 8f017d2c0e25969bd86eafa4adbc184e41c61dc0 Mon Sep 17 00:00:00 2001
From: Simon Zolin <s.zolin@adguard.com>
Date: Tue, 18 Aug 2020 14:26:01 +0300
Subject: [PATCH 02/34] * DNS: use REFUSED DNS error code as the default
 blocking method

---
 dnsforward/dnsforward_test.go | 10 ++++------
 dnsforward/handle_dns.go      |  2 +-
 dnsforward/msg.go             | 14 +++++++++++---
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/dnsforward/dnsforward_test.go b/dnsforward/dnsforward_test.go
index a3eb94f1..825a6e88 100644
--- a/dnsforward/dnsforward_test.go
+++ b/dnsforward/dnsforward_test.go
@@ -227,7 +227,7 @@ func TestBlockedRequest(t *testing.T) {
 	addr := s.dnsProxy.Addr(proxy.ProtoUDP)
 
 	//
-	// NXDomain blocking
+	// Default blocking - REFUSED
 	//
 	req := dns.Msg{}
 	req.Id = dns.Id()
@@ -240,9 +240,7 @@ func TestBlockedRequest(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Couldn't talk to server %s: %s", addr, err)
 	}
-	if reply.Rcode != dns.RcodeNameError {
-		t.Fatalf("Wrong response: %s", reply.String())
-	}
+	assert.Equal(t, dns.RcodeRefused, reply.Rcode)
 
 	err = s.Stop()
 	if err != nil {
@@ -404,7 +402,7 @@ func TestBlockCNAME(t *testing.T) {
 	req := createTestMessage("badhost.")
 	reply, err := dns.Exchange(req, addr.String())
 	assert.Nil(t, err, nil)
-	assert.Equal(t, dns.RcodeNameError, reply.Rcode)
+	assert.Equal(t, dns.RcodeRefused, reply.Rcode)
 
 	// 'whitelist.example.org' has a canonical name 'null.example.org' which is blocked by filters
 	//   but 'whitelist.example.org' is in a whitelist:
@@ -419,7 +417,7 @@ func TestBlockCNAME(t *testing.T) {
 	req = createTestMessage("example.org.")
 	reply, err = dns.Exchange(req, addr.String())
 	assert.Nil(t, err)
-	assert.Equal(t, dns.RcodeNameError, reply.Rcode)
+	assert.Equal(t, dns.RcodeRefused, reply.Rcode)
 
 	_ = s.Stop()
 }
diff --git a/dnsforward/handle_dns.go b/dnsforward/handle_dns.go
index 3f0f7911..f864865b 100644
--- a/dnsforward/handle_dns.go
+++ b/dnsforward/handle_dns.go
@@ -88,7 +88,7 @@ func processInitial(ctx *dnsContext) int {
 	// disable Mozilla DoH
 	if (d.Req.Question[0].Qtype == dns.TypeA || d.Req.Question[0].Qtype == dns.TypeAAAA) &&
 		d.Req.Question[0].Name == "use-application-dns.net." {
-		d.Res = s.genNXDomain(d.Req)
+		d.Res = s.makeResponseREFUSED(d.Req)
 		return resultFinish
 	}
 
diff --git a/dnsforward/msg.go b/dnsforward/msg.go
index a1078539..0df35bfc 100644
--- a/dnsforward/msg.go
+++ b/dnsforward/msg.go
@@ -24,7 +24,7 @@ func (s *Server) genDNSFilterMessage(d *proxy.DNSContext, result *dnsfilter.Resu
 	m := d.Req
 
 	if m.Question[0].Qtype != dns.TypeA && m.Question[0].Qtype != dns.TypeAAAA {
-		return s.genNXDomain(m)
+		return s.makeResponseREFUSED(m)
 	}
 
 	switch result.Reason {
@@ -68,11 +68,11 @@ func (s *Server) genDNSFilterMessage(d *proxy.DNSContext, result *dnsfilter.Resu
 
 		// Default blocking mode
 		// If there's an IP specified in the rule, return it
-		// If there is no IP, return NXDOMAIN
+		// If there is no IP, return REFUSED
 		if result.IP != nil {
 			return s.genResponseWithIP(m, result.IP)
 		}
-		return s.genNXDomain(m)
+		return s.makeResponseREFUSED(m)
 	}
 }
 
@@ -182,6 +182,14 @@ func (s *Server) genCNAMEAnswer(req *dns.Msg, cname string) *dns.CNAME {
 	return answer
 }
 
+// Create REFUSED DNS response
+func (s *Server) makeResponseREFUSED(request *dns.Msg) *dns.Msg {
+	resp := dns.Msg{}
+	resp.SetRcode(request, dns.RcodeRefused)
+	resp.RecursionAvailable = true
+	return &resp
+}
+
 func (s *Server) genNXDomain(request *dns.Msg) *dns.Msg {
 	resp := dns.Msg{}
 	resp.SetRcode(request, dns.RcodeNameError)

From f0ebec545e2c96060a13fb6bb30f17bc6326ef8c Mon Sep 17 00:00:00 2001
From: Simon Zolin <s.zolin@adguard.com>
Date: Tue, 18 Aug 2020 18:14:09 +0300
Subject: [PATCH 03/34] * locales: blocking_mode_default: NXDOMAIN -> REFUSED

---
 client/src/__locales/en.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index e8e984e2..d6c2cd5c 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -249,7 +249,7 @@
     "rate_limit_desc": "The number of requests per second that a single client is allowed to make (0: unlimited)",
     "blocking_ipv4_desc": "IP address to be returned for a blocked A request",
     "blocking_ipv6_desc": "IP address to be returned for a blocked AAAA request",
-    "blocking_mode_default": "Default: Respond with NXDOMAIN when blocked by Adblock-style rule; respond with the IP address specified in the rule when blocked by /etc/hosts-style rule",
+    "blocking_mode_default": "Default: Respond with REFUSED when blocked by Adblock-style rule; respond with the IP address specified in the rule when blocked by /etc/hosts-style rule",
     "blocking_mode_nxdomain": "NXDOMAIN: Respond with NXDOMAIN code",
     "blocking_mode_null_ip": "Null IP: Respond with zero IP address (0.0.0.0 for A; :: for AAAA)",
     "blocking_mode_custom_ip": "Custom IP: Respond with a manually set IP address",

From b6193c32ceb814ad305017854ad4bb2115f7cfbf Mon Sep 17 00:00:00 2001
From: Simon Zolin <s.zolin@adguard.com>
Date: Wed, 19 Aug 2020 14:13:16 +0300
Subject: [PATCH 04/34] + DNS: new blocking mode: "refused"

---
 AGHTechDoc.md                 | 4 ++--
 dnsforward/dnsforward_http.go | 2 +-
 dnsforward/msg.go             | 5 +++++
 openapi/openapi.yaml          | 1 +
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/AGHTechDoc.md b/AGHTechDoc.md
index e5e582ec..49b62d52 100644
--- a/AGHTechDoc.md
+++ b/AGHTechDoc.md
@@ -990,7 +990,7 @@ Response:
 
 		"protection_enabled": true | false,
 		"ratelimit": 1234,
-		"blocking_mode": "default" | "nxdomain" | "null_ip" | "custom_ip",
+		"blocking_mode": "default" | "refused" | "nxdomain" | "null_ip" | "custom_ip",
 		"blocking_ipv4": "1.2.3.4",
 		"blocking_ipv6": "1:2:3::4",
 		"edns_cs_enabled": true | false,
@@ -1015,7 +1015,7 @@ Request:
 
 		"protection_enabled": true | false,
 		"ratelimit": 1234,
-		"blocking_mode": "default" | "nxdomain" | "null_ip" | "custom_ip",
+		"blocking_mode": "default" | "refused" | "nxdomain" | "null_ip" | "custom_ip",
 		"blocking_ipv4": "1.2.3.4",
 		"blocking_ipv6": "1:2:3::4",
 		"edns_cs_enabled": true | false,
diff --git a/dnsforward/dnsforward_http.go b/dnsforward/dnsforward_http.go
index 63e82d95..f3dc35e0 100644
--- a/dnsforward/dnsforward_http.go
+++ b/dnsforward/dnsforward_http.go
@@ -74,7 +74,7 @@ func (s *Server) handleGetConfig(w http.ResponseWriter, r *http.Request) {
 
 func checkBlockingMode(req dnsConfigJSON) bool {
 	bm := req.BlockingMode
-	if !(bm == "default" || bm == "nxdomain" || bm == "null_ip" || bm == "custom_ip") {
+	if !(bm == "default" || bm == "refused" || bm == "nxdomain" || bm == "null_ip" || bm == "custom_ip") {
 		return false
 	}
 
diff --git a/dnsforward/msg.go b/dnsforward/msg.go
index 0df35bfc..fc4ecb51 100644
--- a/dnsforward/msg.go
+++ b/dnsforward/msg.go
@@ -64,6 +64,11 @@ func (s *Server) genDNSFilterMessage(d *proxy.DNSContext, result *dnsfilter.Resu
 			// means that we should return NXDOMAIN for any blocked request
 
 			return s.genNXDomain(m)
+
+		} else if s.conf.BlockingMode == "refused" {
+			// means that we should return NXDOMAIN for any blocked request
+
+			return s.makeResponseREFUSED(m)
 		}
 
 		// Default blocking mode
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index 57d63c70..7fd48870 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -1007,6 +1007,7 @@ components:
                     type: string
                     enum:
                         - default
+                        - refused
                         - nxdomain
                         - null_ip
                         - custom_ip

From dfab6597cd0d3f92381cb2240cdc4fe5195bd74c Mon Sep 17 00:00:00 2001
From: Simon Zolin <s.zolin@adguard.com>
Date: Tue, 1 Sep 2020 14:33:35 +0300
Subject: [PATCH 05/34] + DNS: "dns.upstream_dns_file" setting

---
 AGHTechDoc.md                 |  2 ++
 dnsforward/config.go          | 28 +++++++++++++++++++++++-----
 dnsforward/dnsforward_http.go | 11 +++++++++--
 openapi/openapi.yaml          |  2 ++
 4 files changed, 36 insertions(+), 7 deletions(-)

diff --git a/AGHTechDoc.md b/AGHTechDoc.md
index e5e582ec..50ad9d90 100644
--- a/AGHTechDoc.md
+++ b/AGHTechDoc.md
@@ -986,6 +986,7 @@ Response:
 
 	{
 		"upstream_dns": ["tls://...", ...],
+		"upstream_dns_file": "",
 		"bootstrap_dns": ["1.2.3.4", ...],
 
 		"protection_enabled": true | false,
@@ -1011,6 +1012,7 @@ Request:
 
 	{
 		"upstream_dns": ["tls://...", ...],
+		"upstream_dns_file": "",
 		"bootstrap_dns": ["1.2.3.4", ...],
 
 		"protection_enabled": true | false,
diff --git a/dnsforward/config.go b/dnsforward/config.go
index 69af11eb..db224ea2 100644
--- a/dnsforward/config.go
+++ b/dnsforward/config.go
@@ -5,6 +5,7 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"sort"
@@ -13,6 +14,7 @@ import (
 	"github.com/joomcode/errorx"
 
 	"github.com/AdguardTeam/AdGuardHome/dnsfilter"
+	"github.com/AdguardTeam/AdGuardHome/util"
 	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/dnsproxy/upstream"
 )
@@ -55,10 +57,11 @@ type FilteringConfig struct {
 	// Upstream DNS servers configuration
 	// --
 
-	UpstreamDNS  []string `yaml:"upstream_dns"`
-	BootstrapDNS []string `yaml:"bootstrap_dns"` // a list of bootstrap DNS for DoH and DoT (plain DNS only)
-	AllServers   bool     `yaml:"all_servers"`   // if true, parallel queries to all configured upstream servers are enabled
-	FastestAddr  bool     `yaml:"fastest_addr"`  // use Fastest Address algorithm
+	UpstreamDNS         []string `yaml:"upstream_dns"`
+	UpstreamDNSFileName string   `yaml:"upstream_dns_file"`
+	BootstrapDNS        []string `yaml:"bootstrap_dns"` // a list of bootstrap DNS for DoH and DoT (plain DNS only)
+	AllServers          bool     `yaml:"all_servers"`   // if true, parallel queries to all configured upstream servers are enabled
+	FastestAddr         bool     `yaml:"fastest_addr"`  // use Fastest Address algorithm
 
 	// Access settings
 	// --
@@ -215,7 +218,22 @@ func (s *Server) initDefaultSettings() {
 
 // prepareUpstreamSettings - prepares upstream DNS server settings
 func (s *Server) prepareUpstreamSettings() error {
-	upstreamConfig, err := proxy.ParseUpstreamsConfig(s.conf.UpstreamDNS, s.conf.BootstrapDNS, DefaultTimeout)
+	var upstreams []string
+	if s.conf.UpstreamDNSFileName != "" {
+		data, err := ioutil.ReadFile(s.conf.UpstreamDNSFileName)
+		if err != nil {
+			return err
+		}
+		d := string(data)
+		for len(d) != 0 {
+			s := util.SplitNext(&d, '\n')
+			upstreams = append(upstreams, s)
+		}
+		log.Debug("DNS: using %d upstream servers from file %s", len(upstreams), s.conf.UpstreamDNSFileName)
+	} else {
+		upstreams = s.conf.UpstreamDNS
+	}
+	upstreamConfig, err := proxy.ParseUpstreamsConfig(upstreams, s.conf.BootstrapDNS, DefaultTimeout)
 	if err != nil {
 		return fmt.Errorf("DNS: proxy.ParseUpstreamsConfig: %s", err)
 	}
diff --git a/dnsforward/dnsforward_http.go b/dnsforward/dnsforward_http.go
index 63e82d95..286e9b81 100644
--- a/dnsforward/dnsforward_http.go
+++ b/dnsforward/dnsforward_http.go
@@ -22,8 +22,9 @@ func httpError(r *http.Request, w http.ResponseWriter, code int, format string,
 }
 
 type dnsConfigJSON struct {
-	Upstreams  []string `json:"upstream_dns"`
-	Bootstraps []string `json:"bootstrap_dns"`
+	Upstreams     []string `json:"upstream_dns"`
+	UpstreamsFile string   `json:"upstream_dns_file"`
+	Bootstraps    []string `json:"bootstrap_dns"`
 
 	ProtectionEnabled bool   `json:"protection_enabled"`
 	RateLimit         uint32 `json:"ratelimit"`
@@ -43,6 +44,7 @@ func (s *Server) handleGetConfig(w http.ResponseWriter, r *http.Request) {
 	resp := dnsConfigJSON{}
 	s.RLock()
 	resp.Upstreams = stringArrayDup(s.conf.UpstreamDNS)
+	resp.UpstreamsFile = s.conf.UpstreamDNSFileName
 	resp.Bootstraps = stringArrayDup(s.conf.BootstrapDNS)
 
 	resp.ProtectionEnabled = s.conf.ProtectionEnabled
@@ -157,6 +159,11 @@ func (s *Server) handleSetConfig(w http.ResponseWriter, r *http.Request) {
 		restart = true
 	}
 
+	if js.Exists("upstream_dns_file") {
+		s.conf.UpstreamDNSFileName = req.UpstreamsFile
+		restart = true
+	}
+
 	if js.Exists("bootstrap_dns") {
 		s.conf.BootstrapDNS = req.Bootstraps
 		restart = true
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index 57d63c70..4b5da50e 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -997,6 +997,8 @@ components:
                     example:
                         - tls://1.1.1.1
                         - tls://1.0.0.1
+                upstream_dns_file:
+                    type: string
                 protection_enabled:
                     type: boolean
                 dhcp_available:

From 07b6cc24b77c2bc300278a518072bb66280173b0 Mon Sep 17 00:00:00 2001
From: Simon Zolin <s.zolin@adguard.com>
Date: Thu, 27 Aug 2020 14:20:17 +0300
Subject: [PATCH 06/34] * dnsproxy v0.32.0

---
 go.mod |   5 +-
 go.sum | 214 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 210 insertions(+), 9 deletions(-)

diff --git a/go.mod b/go.mod
index 1a81eba8..476a496f 100644
--- a/go.mod
+++ b/go.mod
@@ -3,13 +3,12 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.14
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.31.1
+	github.com/AdguardTeam/dnsproxy v0.32.0
 	github.com/AdguardTeam/golibs v0.4.2
 	github.com/AdguardTeam/urlfilter v0.12.2
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/fsnotify/fsnotify v1.4.9
 	github.com/gobuffalo/packr v1.30.1
-	github.com/google/go-cmp v0.4.0 // indirect
 	github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714
 	github.com/insomniacslk/dhcp v0.0.0-20200621044212-d74cd86ad5b8
 	github.com/joomcode/errorx v1.0.1
@@ -24,7 +23,7 @@ require (
 	github.com/u-root/u-root v6.0.0+incompatible
 	go.etcd.io/bbolt v1.3.4
 	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
-	golang.org/x/net v0.0.0-20200625001655-4c5254603344
+	golang.org/x/net v0.0.0-20200707034311-ab3426394381
 	golang.org/x/sys v0.0.0-20200519105757-fe76b779f299
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0
 	gopkg.in/yaml.v2 v2.3.0
diff --git a/go.sum b/go.sum
index 794cd232..d1e535fa 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,14 @@
-github.com/AdguardTeam/dnsproxy v0.31.1 h1:kYnlLGM20LjPlEH+fqwCy08gMP5EVdp1FRaJ7uzyIJ0=
-github.com/AdguardTeam/dnsproxy v0.31.1/go.mod h1:hOYFV9TW+pd5XKYz7KZf2FFD8SvSPqjyGTxUae86s58=
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.31.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.37.0/go.mod h1:TS1dMSSfndXH133OKGwekG838Om/cQT0BUHV3HcBgoo=
+dmitri.shuralyov.com/app/changes v0.0.0-20180602232624-0a106ad413e3/go.mod h1:Yl+fi1br7+Rr3LqpNJf1/uxUdtRUV+Tnj0o93V2B9MU=
+dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBrvjyP0v+ecvNYvCpyZgu5/xkfAUhi6wJj28eUfSU=
+dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
+dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
+git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
+github.com/AdguardTeam/dnsproxy v0.32.0 h1:taULDOMubiQSvRLynn8GlfMunhKaVryCBd/OkM++YFU=
+github.com/AdguardTeam/dnsproxy v0.32.0/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
 github.com/AdguardTeam/golibs v0.4.0/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
 github.com/AdguardTeam/golibs v0.4.2 h1:7M28oTZFoFwNmp8eGPb3ImmYbxGaJLyQXeIFVHjME0o=
 github.com/AdguardTeam/golibs v0.4.2/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
@@ -20,21 +29,35 @@ github.com/ameshkov/dnscrypt v1.1.0 h1:2vAt5dD6ZmqlAxEAfzRcLBnkvdf8NI46Kn9InSwQb
 github.com/ameshkov/dnscrypt v1.1.0/go.mod h1:ikduAxNLCTEfd1AaCgpIA5TgroIVQ8JY3Vb095fiFJg=
 github.com/ameshkov/dnsstamps v1.0.1 h1:LhGvgWDzhNJh+kBQd/AfUlq1vfVe109huiXw4JhnPug=
 github.com/ameshkov/dnsstamps v1.0.1/go.mod h1:Ii3eUu73dx4Vw5O4wjzmT5+lkCwovjzaEZZ4gKyIH5A=
+github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/beefsack/go-rate v0.0.0-20180408011153-efa7637bb9b6 h1:KXlsf+qt/X5ttPGEjR0tPH1xaWWoKBEg9Q1THAj2h3I=
 github.com/beefsack/go-rate v0.0.0-20180408011153-efa7637bb9b6/go.mod h1:6YNgTHLutezwnBvyneBbwvB8C82y3dcoOj5EQJIdGXA=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
+github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
+github.com/cheekybits/genny v1.0.0 h1:uGGa4nei+j20rOSeDeP5Of12XVm7TGUd4dJA9RDitfE=
+github.com/cheekybits/genny v1.0.0/go.mod h1:+tQajlRqAUrPI7DOSpB0XAqZYtQakVtB7wXkRAgjxjQ=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
+github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
 github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI=
 github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
 github.com/go-test/deep v1.0.5 h1:AKODKU3pDH1RzZzm6YZu77YWtEAq6uh1rLIAQlay2qc=
@@ -49,12 +72,43 @@ github.com/gobuffalo/packr v1.30.1 h1:hu1fuVR3fXEZR7rXNW3h8rqSML8EVAf6KNm0NKO/wK
 github.com/gobuffalo/packr v1.30.1/go.mod h1:ljMyFO2EcrnzsHsN99cvbq055Y9OhRrIaviy289eRuk=
 github.com/gobuffalo/packr/v2 v2.5.1 h1:TFOeY2VoGamPjQLiNDT3mn//ytzk236VMO2j7iHxJR4=
 github.com/gobuffalo/packr/v2 v2.5.1/go.mod h1:8f9c96ITobJlPzI44jj+4tHnEKNt0xXWSVlXRN9X1Iw=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20191027212112-611e8accdfc9/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.4 h1:l75CXGRSwbaYNpl/Z2X1XIIAMSCquvXgpVZDhwEIJsc=
+github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
+github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
+github.com/googleapis/gax-go/v2 v2.0.3/go.mod h1:LLvjysVCY1JZeum8Z6l8qUty8fiNwE08qbEPm1M08qg=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714 h1:/jC7qQFrv8CrSJVmaolDVOxTfS9kc36uB6H40kdbQq8=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714/go.mod h1:2Goc3h8EklBH5mspfHFxBnEoURQCGzQQH1ga9Myjvis=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
@@ -62,16 +116,20 @@ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANyt
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/insomniacslk/dhcp v0.0.0-20200621044212-d74cd86ad5b8 h1:u+vle+5E78+cT/CSMD5/Y3NUpMgA83Yu2KhG+Zbco/k=
 github.com/insomniacslk/dhcp v0.0.0-20200621044212-d74cd86ad5b8/go.mod h1:CfMdguCK66I5DAUJgGKyNz8aB6vO5dZzkm9Xep6WGvw=
+github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU=
 github.com/jessevdk/go-flags v1.4.0 h1:4IU2WS7AumrZ/40jfhf4QVDMsQwqA7VEHozFRrGARJA=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/joomcode/errorx v1.0.1 h1:CalpDWz14ZHd68fIqluJasJosAewpz2TFaJALrUxjrk=
 github.com/joomcode/errorx v1.0.1/go.mod h1:kgco15ekB6cs+4Xjzo7SPeXzx38PbJzBwbnu9qfVNHQ=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/kardianos/service v1.1.0 h1:QV2SiEeWK42P0aEmGcsAgjApw/lRxkwopvT+Gu6t1/0=
 github.com/kardianos/service v1.1.0/go.mod h1:RrJI2xn5vve/r32U5suTbeaSGoMU6GbNPoj36CVYcHc=
 github.com/karrick/godirwalk v1.10.12 h1:BqUm+LuJcXjGv1d2mj3gBiQyrQ57a0rYoAmhvJQ7RDU=
 github.com/karrick/godirwalk v1.10.12/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3enTrPXyIXCl+2iCXH/aMAp9s=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -79,38 +137,94 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJ
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lucas-clemente/quic-go v0.18.0 h1:JhQDdqxdwdmGdKsKgXi1+coHRoGhvU6z0rNzOJqZ/4o=
+github.com/lucas-clemente/quic-go v0.18.0/go.mod h1:yXttHsSNxQi8AWijC/vLP+OJczXqzHSOcJrM5ITUlCg=
+github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/marten-seemann/qpack v0.2.0/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
+github.com/marten-seemann/qtls v0.10.0 h1:ECsuYUKalRL240rRD4Ri33ISb7kAQ3qGDlrrl55b2pc=
+github.com/marten-seemann/qtls v0.10.0/go.mod h1:UvMd1oaYDACI99/oZUYLzMCkBXQVT0aGm99sJhbT8hs=
+github.com/marten-seemann/qtls-go1-15 v0.1.0 h1:i/YPXVxz8q9umso/5y474CNcHmTpA+5DH+mFPjx6PZg=
+github.com/marten-seemann/qtls-go1-15 v0.1.0/go.mod h1:GyFwywLKkRt+6mfU99csTEY1joMZz5vmB1WNZH3P81I=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mdlayher/ethernet v0.0.0-20190606142754-0394541c37b7 h1:lez6TS6aAau+8wXUP3G9I3TGlmPFEq2CTxBaRqY6AGE=
 github.com/mdlayher/ethernet v0.0.0-20190606142754-0394541c37b7/go.mod h1:U6ZQobyTjI/tJyq2HG+i/dfSoFUt8/aZCM+GKtmFk/Y=
 github.com/mdlayher/raw v0.0.0-20190606142536-fef19f00fc18/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
 github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065 h1:aFkJ6lx4FPip+S+Uw4aTegFMct9shDvP+79PsSxpm3w=
 github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
+github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
 github.com/miekg/dns v1.1.29 h1:xHBEhR+t5RzcFJjBLJlax2daXOrTYtr9z4WdKEfWFzg=
 github.com/miekg/dns v1.1.29/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
+github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
+github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.3.0 h1:RR9dF3JtopPvtkroDZuVD7qquD0bnHlKSqaQhgwt8yk=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
+github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/shirou/gopsutil v2.20.3+incompatible h1:0JVooMPsT7A7HqEYdydp/OfjSOYSjhXV7w1hkKj/NPQ=
 github.com/shirou/gopsutil v2.20.3+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
+github.com/shurcooL/component v0.0.0-20170202220835-f88ec8f54cc4/go.mod h1:XhFIlyj5a1fBNx5aJTbKoIq0mNaPvOagO+HjB3EtxrY=
+github.com/shurcooL/events v0.0.0-20181021180414-410e4ca65f48/go.mod h1:5u70Mqkb5O5cxEA8nxTsgrgLehJeAw6Oc4Ab1c/P1HM=
+github.com/shurcooL/github_flavored_markdown v0.0.0-20181002035957-2122de532470/go.mod h1:2dOwnU2uBioM+SGy2aZoq1f/Sd1l9OkAeAUvjSyvgU0=
+github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
+github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
+github.com/shurcooL/gofontwoff v0.0.0-20180329035133-29b52fc0a18d/go.mod h1:05UtEgK5zq39gLST6uB0cf3NEHjETfB4Fgr3Gx5R9Vw=
+github.com/shurcooL/gopherjslib v0.0.0-20160914041154-feb6d3990c2c/go.mod h1:8d3azKNyqcHP1GaQE/c6dDgjkgSx2BZ4IoEi4F1reUI=
+github.com/shurcooL/highlight_diff v0.0.0-20170515013008-09bb4053de1b/go.mod h1:ZpfEhSmds4ytuByIcDnOLkTHGUI6KNqRNPDLHDk+mUU=
+github.com/shurcooL/highlight_go v0.0.0-20181028180052-98c3abbbae20/go.mod h1:UDKB5a1T23gOMUJrI+uSuH0VRDStOiUVSjBTRDVBVag=
+github.com/shurcooL/home v0.0.0-20181020052607-80b7ffcb30f9/go.mod h1:+rgNQw2P9ARFAs37qieuu7ohDNQ3gds9msbT2yn85sg=
+github.com/shurcooL/htmlg v0.0.0-20170918183704-d01228ac9e50/go.mod h1:zPn1wHpTIePGnXSHpsVPWEktKXHr6+SS6x/IKRb7cpw=
+github.com/shurcooL/httperror v0.0.0-20170206035902-86b7830d14cc/go.mod h1:aYMfkZ6DWSJPJ6c4Wwz3QtW22G7mf/PEgaB9k/ik5+Y=
+github.com/shurcooL/httpfs v0.0.0-20171119174359-809beceb2371/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
+github.com/shurcooL/httpgzip v0.0.0-20180522190206-b1c53ac65af9/go.mod h1:919LwcH0M7/W4fcZ0/jy0qGght1GIhqyS/EgWGH2j5Q=
+github.com/shurcooL/issues v0.0.0-20181008053335-6292fdc1e191/go.mod h1:e2qWDig5bLteJ4fwvDAc2NHzqFEthkqn7aOZAOpj+PQ=
+github.com/shurcooL/issuesapp v0.0.0-20180602232740-048589ce2241/go.mod h1:NPpHK2TI7iSaM0buivtFUc9offApnI0Alt/K8hcHy0I=
+github.com/shurcooL/notifications v0.0.0-20181007000457-627ab5aea122/go.mod h1:b5uSkrEVM1jQUspwbixRBhaIjIzL2xazXp6kntxYle0=
+github.com/shurcooL/octicon v0.0.0-20181028054416-fa4f57f9efb2/go.mod h1:eWdoE5JD4R5UVWDucdOPg1g2fqQRq78IQa9zlOV1vpQ=
+github.com/shurcooL/reactions v0.0.0-20181006231557-f2e0b4ca5b82/go.mod h1:TCR1lToEk4d2s07G3XGfz2QrgHXg4RJBvjrOozvoWfk=
+github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/shurcooL/users v0.0.0-20180125191416-49c67e49c537/go.mod h1:QJTqeLYEDaXHZDBsXlPCDqdhQuJkuw4NOtaxYe3xii4=
+github.com/shurcooL/webdavfs v0.0.0-20170829043945-18c3829fa133/go.mod h1:hKmq5kWdCj2z2KEozexVbfEZIWiTjhE0+UjmZgPqehw=
 github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
+github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
 github.com/sparrc/go-ping v0.0.0-20190613174326-4e5b6552494c h1:gqEdF4VwBu3lTKGHS9rXE9x1/pEaSwCXRLOZRF6qtlw=
 github.com/sparrc/go-ping v0.0.0-20190613174326-4e5b6552494c/go.mod h1:eMyUVp6f/5jnzM+3zahzl7q6UXLbgSc3MKg/+ow9QW0=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
@@ -126,25 +240,47 @@ github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
 github.com/u-root/u-root v6.0.0+incompatible h1:YqPGmRoRyYmeg17KIWFRSyVq6LX5T6GSzawyA6wG6EE=
 github.com/u-root/u-root v6.0.0+incompatible/go.mod h1:RYkpo8pTHrNjW08opNd/U6p/RJE7K0D8fXO0d47+3YY=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
+github.com/viant/assertly v0.4.8/go.mod h1:aGifi++jvCrUaklKEKT0BU95igDNaqkvz+49uaYMPRU=
+github.com/viant/toolbox v0.24.0/go.mod h1:OxMCG57V0PXuIP2HNQrtJf2CjqdmbrOx5EkMILuUhzM=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 go.etcd.io/bbolt v1.3.4 h1:hi1bXHMVrlQh6WwxAy+qZCV/SYIlqo+Ushwdpa4tAKg=
 go.etcd.io/bbolt v1.3.4/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
+go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
+go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
+golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
+golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190313024323-a1f597ede03a/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190621222207-cc06ce4a13d4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200221231518-2aa609cf4a9d/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200403201458-baeed622b8d8 h1:fpnn/HnJONpIu6hkXi1u/7rR0NzilgWr4T0JmWkEitk=
-golang.org/x/crypto v0.0.0-20200403201458-baeed622b8d8/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181029044818-c44066c5c816/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181106065722-10aee1819953/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190313220215-9f648a60d977/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190419010253-1f3472d942ba/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -153,46 +289,112 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e h1:3G+cUijn7XD+S4eJFddp53Pv7+slrESplyjG25HgL+k=
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344 h1:vGXIOMxbNfDTk/aXCmfdLgkrSV+Z2tcbze+pEc3v5W4=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a h1:WXEvlFVvvGxCJLG6REjsT03iWnKLEWinaScsxF2Vm2o=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181029174526-d69651ed3497/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190316082340-a2f829d7f35f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190418153312-f0ce4c0180be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190515120540-06a5c4944438/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606122018-79a91cf218c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200331124033-c3d80250170d h1:nc5K6ox/4lTFbMVSL9WRR81ixkcwXThoiF6yf+R9scA=
 golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200519105757-fe76b779f299 h1:DYfZAGf2WMFjMxbgTjaC+2HC7NkNAQs+6Q8b9WEB/F4=
 golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030000716-a0a13e073c7b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190624180213-70d37148ca0c/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20191216052735-49a3e744a425 h1:VvQyQJN0tSuecqgcIxMWnnfG5kSmgy9KZR9sW3W5QeA=
 golang.org/x/tools v0.0.0-20191216052735-49a3e744a425/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
+google.golang.org/api v0.0.0-20181030000543-1d582fd0359e/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
+google.golang.org/api v0.1.0/go.mod h1:UGEZY7KEX120AnNLIHFMKIo4obdJhkp2tPbaPlQx13Y=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20180831171423-11092d34479b/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20181029155118-b69ba1387ce2/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20181202183823-bd91e49a0898/go.mod h1:7Ep/1NZk928CDR8SjdVbjWNpdIf6nzjE3BTgJDr2Atg=
+google.golang.org/genproto v0.0.0-20190306203927-b5d61aea6440/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
+google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+grpc.go4.org v0.0.0-20170609214715-11d0a25b4919/go.mod h1:77eQGdRu53HpSqPFJFmuJdjuHRquDANNeA4x7B8WQ9o=
+honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
+sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=
+sourcegraph.com/sqs/pbtypes v0.0.0-20180604144634-d3ebe8f20ae4/go.mod h1:ketZ/q3QxT9HOBeFhu6RdvsftgpsbFHBF5Cas6cDKZ0=

From d53e32259a3a1b5f55b3e1730339f1a0410eb1be Mon Sep 17 00:00:00 2001
From: Simon Zolin <s.zolin@adguard.com>
Date: Thu, 27 Aug 2020 15:03:07 +0300
Subject: [PATCH 07/34] + DNS: "port_dns_over_quic" setting

---
 AGHTechDoc.md                 |  2 ++
 dnsforward/config.go          |  5 +++++
 dnsforward/dnsforward_http.go |  2 +-
 home/config.go                | 16 +++++++++-------
 home/control_update.go        |  4 +++-
 home/dns.go                   | 13 +++++++++++++
 home/tls.go                   |  2 ++
 openapi/openapi.yaml          |  5 +++++
 8 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/AGHTechDoc.md b/AGHTechDoc.md
index e5e582ec..0dcb001b 100644
--- a/AGHTechDoc.md
+++ b/AGHTechDoc.md
@@ -743,6 +743,7 @@ Response:
 	"server_name":"...",
 	"port_https":443,
 	"port_dns_over_tls":853,
+	"port_dns_over_quic":784,
 	"certificate_chain":"...",
 	"private_key":"...",
 	"certificate_path":"...",
@@ -774,6 +775,7 @@ Request:
 	"force_https":false,
 	"port_https":443,
 	"port_dns_over_tls":853,
+	"port_dns_over_quic":784,
 	"certificate_chain":"...",
 	"private_key":"...",
 	"certificate_path":"...", // if set, certificate_chain must be empty
diff --git a/dnsforward/config.go b/dnsforward/config.go
index 69af11eb..5d06b9dc 100644
--- a/dnsforward/config.go
+++ b/dnsforward/config.go
@@ -92,6 +92,7 @@ type FilteringConfig struct {
 // TLSConfig is the TLS configuration for HTTPS, DNS-over-HTTPS, and DNS-over-TLS
 type TLSConfig struct {
 	TLSListenAddr  *net.TCPAddr `yaml:"-" json:"-"`
+	QUICListenAddr *net.UDPAddr `yaml:"-" json:"-"`
 	StrictSNICheck bool         `yaml:"strict_sni_check" json:"-"` // Reject connection if the client uses server name (in SNI) that doesn't match the certificate
 
 	CertificateChain string `yaml:"certificate_chain" json:"certificate_chain"` // PEM-encoded certificates chain
@@ -153,6 +154,10 @@ func (s *Server) createProxyConfig() (proxy.Config, error) {
 		MaxGoroutines:          int(s.conf.MaxGoroutines),
 	}
 
+	if s.conf.QUICListenAddr != nil {
+		proxyConfig.QUICListenAddr = []*net.UDPAddr{s.conf.QUICListenAddr}
+	}
+
 	if s.conf.CacheSize != 0 {
 		proxyConfig.CacheEnabled = true
 		proxyConfig.CacheSizeBytes = int(s.conf.CacheSize)
diff --git a/dnsforward/dnsforward_http.go b/dnsforward/dnsforward_http.go
index 63e82d95..79e4ded7 100644
--- a/dnsforward/dnsforward_http.go
+++ b/dnsforward/dnsforward_http.go
@@ -270,7 +270,7 @@ func ValidateUpstreams(upstreams []string) error {
 	return nil
 }
 
-var protocols = []string{"tls://", "https://", "tcp://", "sdns://"}
+var protocols = []string{"tls://", "https://", "tcp://", "sdns://", "quic://"}
 
 func validateUpstream(u string) (bool, error) {
 	// Check if user tries to specify upstream for domain
diff --git a/home/config.go b/home/config.go
index d0fc6396..348e72fa 100644
--- a/home/config.go
+++ b/home/config.go
@@ -92,11 +92,12 @@ type dnsConfig struct {
 }
 
 type tlsConfigSettings struct {
-	Enabled        bool   `yaml:"enabled" json:"enabled"`                               // Enabled is the encryption (DOT/DOH/HTTPS) status
-	ServerName     string `yaml:"server_name" json:"server_name,omitempty"`             // ServerName is the hostname of your HTTPS/TLS server
-	ForceHTTPS     bool   `yaml:"force_https" json:"force_https,omitempty"`             // ForceHTTPS: if true, forces HTTP->HTTPS redirect
-	PortHTTPS      int    `yaml:"port_https" json:"port_https,omitempty"`               // HTTPS port. If 0, HTTPS will be disabled
-	PortDNSOverTLS int    `yaml:"port_dns_over_tls" json:"port_dns_over_tls,omitempty"` // DNS-over-TLS port. If 0, DOT will be disabled
+	Enabled         bool   `yaml:"enabled" json:"enabled"`                                 // Enabled is the encryption (DOT/DOH/HTTPS) status
+	ServerName      string `yaml:"server_name" json:"server_name,omitempty"`               // ServerName is the hostname of your HTTPS/TLS server
+	ForceHTTPS      bool   `yaml:"force_https" json:"force_https,omitempty"`               // ForceHTTPS: if true, forces HTTP->HTTPS redirect
+	PortHTTPS       int    `yaml:"port_https" json:"port_https,omitempty"`                 // HTTPS port. If 0, HTTPS will be disabled
+	PortDNSOverTLS  int    `yaml:"port_dns_over_tls" json:"port_dns_over_tls,omitempty"`   // DNS-over-TLS port. If 0, DOT will be disabled
+	PortDNSOverQUIC uint16 `yaml:"port_dns_over_quic" json:"port_dns_over_quic,omitempty"` // DNS-over-QUIC port. If 0, DoQ will be disabled
 
 	// Allow DOH queries via unencrypted HTTP (e.g. for reverse proxying)
 	AllowUnencryptedDOH bool `yaml:"allow_unencrypted_doh" json:"allow_unencrypted_doh"`
@@ -124,8 +125,9 @@ var config = configuration{
 		FiltersUpdateIntervalHours: 24,
 	},
 	TLS: tlsConfigSettings{
-		PortHTTPS:      443,
-		PortDNSOverTLS: 853, // needs to be passed through to dnsproxy
+		PortHTTPS:       443,
+		PortDNSOverTLS:  853, // needs to be passed through to dnsproxy
+		PortDNSOverQUIC: 784,
 	},
 	logSettings: logSettings{
 		LogCompress:   false,
diff --git a/home/control_update.go b/home/control_update.go
index fb160900..b8f6bcbe 100644
--- a/home/control_update.go
+++ b/home/control_update.go
@@ -99,7 +99,9 @@ func getVersionResp(info update.VersionInfo) []byte {
 		Context.tls.WriteDiskConfig(&tlsConf)
 
 		if runtime.GOOS != "windows" &&
-			((tlsConf.Enabled && (tlsConf.PortHTTPS < 1024 || tlsConf.PortDNSOverTLS < 1024)) ||
+			((tlsConf.Enabled && (tlsConf.PortHTTPS < 1024 ||
+				tlsConf.PortDNSOverTLS < 1024 ||
+				tlsConf.PortDNSOverQUIC < 1024)) ||
 				config.BindPort < 1024 ||
 				config.DNS.Port < 1024) {
 			// On UNIX, if we're running under a regular user,
diff --git a/home/dns.go b/home/dns.go
index 2d647f94..820b441a 100644
--- a/home/dns.go
+++ b/home/dns.go
@@ -172,12 +172,20 @@ func generateServerConfig() dnsforward.ServerConfig {
 	Context.tls.WriteDiskConfig(&tlsConf)
 	if tlsConf.Enabled {
 		newconfig.TLSConfig = tlsConf.TLSConfig
+
 		if tlsConf.PortDNSOverTLS != 0 {
 			newconfig.TLSListenAddr = &net.TCPAddr{
 				IP:   net.ParseIP(config.DNS.BindHost),
 				Port: tlsConf.PortDNSOverTLS,
 			}
 		}
+
+		if tlsConf.PortDNSOverQUIC != 0 {
+			newconfig.QUICListenAddr = &net.UDPAddr{
+				IP:   net.ParseIP(config.DNS.BindHost),
+				Port: int(tlsConf.PortDNSOverQUIC),
+			}
+		}
 	}
 	newconfig.TLSv12Roots = Context.tlsRoots
 	newconfig.TLSCiphers = Context.tlsCiphers
@@ -225,6 +233,11 @@ func getDNSAddresses() []string {
 			addr := fmt.Sprintf("tls://%s:%d", tlsConf.ServerName, tlsConf.PortDNSOverTLS)
 			dnsAddresses = append(dnsAddresses, addr)
 		}
+
+		if tlsConf.PortDNSOverQUIC != 0 {
+			addr := fmt.Sprintf("quic://%s:%d", tlsConf.ServerName, tlsConf.PortDNSOverQUIC)
+			dnsAddresses = append(dnsAddresses, addr)
+		}
 	}
 
 	return dnsAddresses
diff --git a/home/tls.go b/home/tls.go
index 157cda2a..0b9e8f90 100644
--- a/home/tls.go
+++ b/home/tls.go
@@ -45,6 +45,7 @@ func tlsCreate(conf tlsConfigSettings) *TLSMod {
 				ServerName:          conf.ServerName,
 				PortHTTPS:           conf.PortHTTPS,
 				PortDNSOverTLS:      conf.PortDNSOverTLS,
+				PortDNSOverQUIC:     conf.PortDNSOverQUIC,
 				AllowUnencryptedDOH: conf.AllowUnencryptedDOH,
 			}}
 		}
@@ -267,6 +268,7 @@ func (t *TLSMod) handleTLSConfigure(w http.ResponseWriter, r *http.Request) {
 	t.conf.ForceHTTPS = data.ForceHTTPS
 	t.conf.PortHTTPS = data.PortHTTPS
 	t.conf.PortDNSOverTLS = data.PortDNSOverTLS
+	t.conf.PortDNSOverQUIC = data.PortDNSOverQUIC
 	t.conf.CertificateChain = data.CertificateChain
 	t.conf.CertificatePath = data.CertificatePath
 	t.conf.CertificateChainData = data.CertificateChainData
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index 57d63c70..7777c069 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -1563,6 +1563,11 @@ components:
                     format: int32
                     example: 853
                     description: DNS-over-TLS port. If 0, DOT will be disabled.
+                port_dns_over_quic:
+                    type: integer
+                    format: int32
+                    example: 784
+                    description: DNS-over-QUIC port. If 0, DOQ will be disabled.
                 certificate_chain:
                     type: string
                     description: Base64 string with PEM-encoded certificates chain

From 03506df25d5c6af6daf1ba19300d2697ad241bda Mon Sep 17 00:00:00 2001
From: David Sheets <sheets@alum.mit.edu>
Date: Mon, 7 Sep 2020 09:10:56 +0100
Subject: [PATCH 08/34] cli: factor options struct and parsing into
 home/options.go

---
 home/home.go         | 109 +++---------------
 home/options.go      | 255 +++++++++++++++++++++++++++++++++++++++++++
 home/options_test.go | 171 +++++++++++++++++++++++++++++
 3 files changed, 439 insertions(+), 96 deletions(-)
 create mode 100644 home/options.go
 create mode 100644 home/options_test.go

diff --git a/home/home.go b/home/home.go
index b9d7a760..806c59e2 100644
--- a/home/home.go
+++ b/home/home.go
@@ -526,108 +526,25 @@ func cleanupAlways() {
 	log.Info("Stopped")
 }
 
-// command-line arguments
-type options struct {
-	verbose        bool   // is verbose logging enabled
-	configFilename string // path to the config file
-	workDir        string // path to the working directory where we will store the filters data and the querylog
-	bindHost       string // host address to bind HTTP server on
-	bindPort       int    // port to serve HTTP pages on
-	logFile        string // Path to the log file. If empty, write to stdout. If "syslog", writes to syslog
-	pidFile        string // File name to save PID to
-	checkConfig    bool   // Check configuration and exit
-	disableUpdate  bool   // If set, don't check for updates
-
-	// service control action (see service.ControlAction array + "status" command)
-	serviceControlAction string
-
-	// runningAsService flag is set to true when options are passed from the service runner
-	runningAsService bool
-
-	glinetMode bool // Activate GL-Inet mode
+func exitWithError() {
+	os.Exit(64)
 }
 
 // loadOptions reads command line arguments and initializes configuration
 func loadOptions() options {
-	o := options{}
+	o, f, err := parse(os.Args[0], os.Args[1:])
 
-	var printHelp func()
-	var opts = []struct {
-		longName          string
-		shortName         string
-		description       string
-		callbackWithValue func(value string)
-		callbackNoValue   func()
-	}{
-		{"config", "c", "Path to the config file", func(value string) { o.configFilename = value }, nil},
-		{"work-dir", "w", "Path to the working directory", func(value string) { o.workDir = value }, nil},
-		{"host", "h", "Host address to bind HTTP server on", func(value string) { o.bindHost = value }, nil},
-		{"port", "p", "Port to serve HTTP pages on", func(value string) {
-			v, err := strconv.Atoi(value)
-			if err != nil {
-				panic("Got port that is not a number")
-			}
-			o.bindPort = v
-		}, nil},
-		{"service", "s", "Service control action: status, install, uninstall, start, stop, restart, reload (configuration)", func(value string) {
-			o.serviceControlAction = value
-		}, nil},
-		{"logfile", "l", "Path to log file. If empty: write to stdout; if 'syslog': write to system log", func(value string) {
-			o.logFile = value
-		}, nil},
-		{"pidfile", "", "Path to a file where PID is stored", func(value string) { o.pidFile = value }, nil},
-		{"check-config", "", "Check configuration and exit", nil, func() { o.checkConfig = true }},
-		{"no-check-update", "", "Don't check for updates", nil, func() { o.disableUpdate = true }},
-		{"verbose", "v", "Enable verbose output", nil, func() { o.verbose = true }},
-		{"glinet", "", "Run in GL-Inet compatibility mode", nil, func() { o.glinetMode = true }},
-		{"version", "", "Show the version and exit", nil, func() {
-			fmt.Println(version())
+	if err != nil {
+		log.Error(err.Error())
+		_ = printHelp(os.Args[0])
+		exitWithError()
+	} else if f != nil {
+		err = f()
+		if err != nil {
+			log.Error(err.Error())
+			exitWithError()
+		} else {
 			os.Exit(0)
-		}},
-		{"help", "", "Print this help", nil, func() {
-			printHelp()
-			os.Exit(64)
-		}},
-	}
-	printHelp = func() {
-		fmt.Printf("Usage:\n\n")
-		fmt.Printf("%s [options]\n\n", os.Args[0])
-		fmt.Printf("Options:\n")
-		for _, opt := range opts {
-			val := ""
-			if opt.callbackWithValue != nil {
-				val = " VALUE"
-			}
-			if opt.shortName != "" {
-				fmt.Printf("  -%s, %-30s %s\n", opt.shortName, "--"+opt.longName+val, opt.description)
-			} else {
-				fmt.Printf("  %-34s %s\n", "--"+opt.longName+val, opt.description)
-			}
-		}
-	}
-	for i := 1; i < len(os.Args); i++ {
-		v := os.Args[i]
-		knownParam := false
-		for _, opt := range opts {
-			if v == "--"+opt.longName || (opt.shortName != "" && v == "-"+opt.shortName) {
-				if opt.callbackWithValue != nil {
-					if i+1 >= len(os.Args) {
-						log.Error("Got %s without argument\n", v)
-						os.Exit(64)
-					}
-					i++
-					opt.callbackWithValue(os.Args[i])
-				} else if opt.callbackNoValue != nil {
-					opt.callbackNoValue()
-				}
-				knownParam = true
-				break
-			}
-		}
-		if !knownParam {
-			log.Error("unknown option %v\n", v)
-			printHelp()
-			os.Exit(64)
 		}
 	}
 
diff --git a/home/options.go b/home/options.go
new file mode 100644
index 00000000..ec789d4f
--- /dev/null
+++ b/home/options.go
@@ -0,0 +1,255 @@
+package home
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+)
+
+// options passed from command-line arguments
+type options struct {
+	verbose        bool   // is verbose logging enabled
+	configFilename string // path to the config file
+	workDir        string // path to the working directory where we will store the filters data and the querylog
+	bindHost       string // host address to bind HTTP server on
+	bindPort       int    // port to serve HTTP pages on
+	logFile        string // Path to the log file. If empty, write to stdout. If "syslog", writes to syslog
+	pidFile        string // File name to save PID to
+	checkConfig    bool   // Check configuration and exit
+	disableUpdate  bool   // If set, don't check for updates
+
+	// service control action (see service.ControlAction array + "status" command)
+	serviceControlAction string
+
+	// runningAsService flag is set to true when options are passed from the service runner
+	runningAsService bool
+
+	glinetMode bool // Activate GL-Inet mode
+}
+
+// functions used for their side-effects
+type effect func() error
+
+type arg struct {
+	description string // a short, English description of the argument
+	longName    string // the name of the argument used after '--'
+	shortName   string // the name of the argument used after '-'
+
+	// only one of updateWithValue, updateNoValue, and effect should be present
+
+	updateWithValue func(o options, v string) (options, error)         // the mutator for arguments with parameters
+	updateNoValue   func(o options) (options, error)                   // the mutator for arguments without parameters
+	effect          func(o options, exec string) (f effect, err error) // the side-effect closure generator
+}
+
+var args []arg
+
+var configArg = arg{
+	"Path to the config file",
+	"config", "c",
+	func(o options, v string) (options, error) { o.configFilename = v; return o, nil },
+	nil,
+	nil,
+}
+
+var workDirArg = arg{
+	"Path to the working directory",
+	"work-dir", "w",
+	func(o options, v string) (options, error) { o.workDir = v; return o, nil }, nil, nil,
+}
+
+var hostArg = arg{
+	"Host address to bind HTTP server on",
+	"host", "h",
+	func(o options, v string) (options, error) { o.bindHost = v; return o, nil }, nil, nil,
+}
+
+var portArg = arg{
+	"Port to serve HTTP pages on",
+	"port", "p",
+	func(o options, v string) (options, error) {
+		var err error
+		var p int
+		minPort, maxPort := 0, 1<<16-1
+		if p, err = strconv.Atoi(v); err != nil {
+			err = fmt.Errorf("port '%s' is not a number", v)
+		} else if p < minPort || p > maxPort {
+			err = fmt.Errorf("port %d not in range %d - %d", p, minPort, maxPort)
+		} else {
+			o.bindPort = p
+		}
+		return o, err
+	}, nil, nil,
+}
+
+var serviceArg = arg{
+	"Service control action: status, install, uninstall, start, stop, restart, reload (configuration)",
+	"service", "s",
+	func(o options, v string) (options, error) {
+		o.serviceControlAction = v
+		return o, nil
+	}, nil, nil,
+}
+
+var logfileArg = arg{
+	"Path to log file. If empty: write to stdout; if 'syslog': write to system log",
+	"logfile", "l",
+	func(o options, v string) (options, error) { o.logFile = v; return o, nil }, nil, nil,
+}
+
+var pidfileArg = arg{
+	"Path to a file where PID is stored",
+	"pidfile", "",
+	func(o options, v string) (options, error) { o.pidFile = v; return o, nil }, nil, nil,
+}
+
+var checkConfigArg = arg{
+	"Check configuration and exit",
+	"check-config", "",
+	nil, func(o options) (options, error) { o.checkConfig = true; return o, nil }, nil,
+}
+
+var noCheckUpdateArg = arg{
+	"Don't check for updates",
+	"no-check-update", "",
+	nil, func(o options) (options, error) { o.disableUpdate = true; return o, nil }, nil,
+}
+
+var verboseArg = arg{
+	"Enable verbose output",
+	"verbose", "v",
+	nil, func(o options) (options, error) { o.verbose = true; return o, nil }, nil,
+}
+
+var glinetArg = arg{
+	"Run in GL-Inet compatibility mode",
+	"glinet", "",
+	nil, func(o options) (options, error) { o.glinetMode = true; return o, nil }, nil,
+}
+
+var versionArg = arg{
+	"Show the version and exit",
+	"version", "",
+	nil, nil, func(o options, exec string) (effect, error) {
+		return func() error { fmt.Println(version()); os.Exit(0); return nil }, nil
+	},
+}
+
+var helpArg = arg{
+	"Print this help",
+	"help", "",
+	nil, nil, func(o options, exec string) (effect, error) {
+		return func() error { _ = printHelp(exec); os.Exit(64); return nil }, nil
+	},
+}
+
+func init() {
+	args = []arg{
+		configArg,
+		workDirArg,
+		hostArg,
+		portArg,
+		serviceArg,
+		logfileArg,
+		pidfileArg,
+		checkConfigArg,
+		noCheckUpdateArg,
+		verboseArg,
+		glinetArg,
+		versionArg,
+		helpArg,
+	}
+}
+
+func getUsageLines(exec string, args []arg) []string {
+	usage := []string{
+		"Usage:",
+		"",
+		fmt.Sprintf("%s [options]", exec),
+		"",
+		"Options:",
+	}
+	for _, arg := range args {
+		val := ""
+		if arg.updateWithValue != nil {
+			val = " VALUE"
+		}
+		if arg.shortName != "" {
+			usage = append(usage, fmt.Sprintf("  -%s, %-30s %s",
+				arg.shortName,
+				"--"+arg.longName+val,
+				arg.description))
+		} else {
+			usage = append(usage, fmt.Sprintf("  %-34s %s",
+				"--"+arg.longName+val,
+				arg.description))
+		}
+	}
+	return usage
+}
+
+func printHelp(exec string) error {
+	for _, line := range getUsageLines(exec, args) {
+		_, err := fmt.Println(line)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func argMatches(a arg, v string) bool {
+	return v == "--"+a.longName || (a.shortName != "" && v == "-"+a.shortName)
+}
+
+func parse(exec string, ss []string) (o options, f effect, err error) {
+	for i := 0; i < len(ss); i++ {
+		v := ss[i]
+		knownParam := false
+		for _, arg := range args {
+			if argMatches(arg, v) {
+				if arg.updateWithValue != nil {
+					if i+1 >= len(ss) {
+						return o, f, fmt.Errorf("got %s without argument", v)
+					}
+					i++
+					o, err = arg.updateWithValue(o, ss[i])
+					if err != nil {
+						return
+					}
+				} else if arg.updateNoValue != nil {
+					o, err = arg.updateNoValue(o)
+					if err != nil {
+						return
+					}
+				} else if arg.effect != nil {
+					var eff effect
+					eff, err = arg.effect(o, exec)
+					if err != nil {
+						return
+					}
+					if eff != nil {
+						prevf := f
+						f = func() error {
+							var err error
+							if prevf != nil {
+								err = prevf()
+							}
+							if err == nil {
+								err = eff()
+							}
+							return err
+						}
+					}
+				}
+				knownParam = true
+				break
+			}
+		}
+		if !knownParam {
+			return o, f, fmt.Errorf("unknown option %v", v)
+		}
+	}
+
+	return
+}
diff --git a/home/options_test.go b/home/options_test.go
new file mode 100644
index 00000000..750f3ce2
--- /dev/null
+++ b/home/options_test.go
@@ -0,0 +1,171 @@
+package home
+
+import (
+	"fmt"
+	"testing"
+)
+
+func testParseOk(t *testing.T, ss ...string) options {
+	o, _, err := parse("", ss)
+	if err != nil {
+		t.Fatal(err.Error())
+	}
+	return o
+}
+
+func testParseErr(t *testing.T, descr string, ss ...string) {
+	_, _, err := parse("", ss)
+	if err == nil {
+		t.Fatalf("expected an error because %s but no error returned", descr)
+	}
+}
+
+func testParseParamMissing(t *testing.T, param string) {
+	testParseErr(t, fmt.Sprintf("%s parameter missing", param), param)
+}
+
+func TestParseVerbose(t *testing.T) {
+	if testParseOk(t).verbose {
+		t.Fatal("empty is not verbose")
+	}
+	if !testParseOk(t, "-v").verbose {
+		t.Fatal("-v is verbose")
+	}
+	if !testParseOk(t, "--verbose").verbose {
+		t.Fatal("--verbose is verbose")
+	}
+}
+
+func TestParseConfigFilename(t *testing.T) {
+	if testParseOk(t).configFilename != "" {
+		t.Fatal("empty is no config filename")
+	}
+	if testParseOk(t, "-c", "path").configFilename != "path" {
+		t.Fatal("-c is config filename")
+	}
+	testParseParamMissing(t, "-c")
+	if testParseOk(t, "--config", "path").configFilename != "path" {
+		t.Fatal("--configFilename is config filename")
+	}
+	testParseParamMissing(t, "--config")
+}
+
+func TestParseWorkDir(t *testing.T) {
+	if testParseOk(t).workDir != "" {
+		t.Fatal("empty is no work dir")
+	}
+	if testParseOk(t, "-w", "path").workDir != "path" {
+		t.Fatal("-w is work dir")
+	}
+	testParseParamMissing(t, "-w")
+	if testParseOk(t, "--work-dir", "path").workDir != "path" {
+		t.Fatal("--work-dir is work dir")
+	}
+	testParseParamMissing(t, "--work-dir")
+}
+
+func TestParseBindHost(t *testing.T) {
+	if testParseOk(t).bindHost != "" {
+		t.Fatal("empty is no host")
+	}
+	if testParseOk(t, "-h", "addr").bindHost != "addr" {
+		t.Fatal("-h is host")
+	}
+	testParseParamMissing(t, "-h")
+	if testParseOk(t, "--host", "addr").bindHost != "addr" {
+		t.Fatal("--host is host")
+	}
+	testParseParamMissing(t, "--host")
+}
+
+func TestParseBindPort(t *testing.T) {
+	if testParseOk(t).bindPort != 0 {
+		t.Fatal("empty is port 0")
+	}
+	if testParseOk(t, "-p", "65535").bindPort != 65535 {
+		t.Fatal("-p is port")
+	}
+	testParseParamMissing(t, "-p")
+	if testParseOk(t, "--port", "65535").bindPort != 65535 {
+		t.Fatal("--port is port")
+	}
+	testParseParamMissing(t, "--port")
+}
+
+func TestParseBindPortBad(t *testing.T) {
+	testParseErr(t, "not an int", "-p", "x")
+	testParseErr(t, "hex not supported", "-p", "0x100")
+	testParseErr(t, "port negative", "-p", "-1")
+	testParseErr(t, "port too high", "-p", "65536")
+	testParseErr(t, "port too high", "-p", "4294967297")           // 2^32 + 1
+	testParseErr(t, "port too high", "-p", "18446744073709551617") // 2^64 + 1
+}
+
+func TestParseLogfile(t *testing.T) {
+	if testParseOk(t).logFile != "" {
+		t.Fatal("empty is no log file")
+	}
+	if testParseOk(t, "-l", "path").logFile != "path" {
+		t.Fatal("-l is log file")
+	}
+	if testParseOk(t, "--logfile", "path").logFile != "path" {
+		t.Fatal("--logfile is log file")
+	}
+}
+
+func TestParsePidfile(t *testing.T) {
+	if testParseOk(t).pidFile != "" {
+		t.Fatal("empty is no pid file")
+	}
+	if testParseOk(t, "--pidfile", "path").pidFile != "path" {
+		t.Fatal("--pidfile is pid file")
+	}
+}
+
+func TestParseCheckConfig(t *testing.T) {
+	if testParseOk(t).checkConfig {
+		t.Fatal("empty is not check config")
+	}
+	if !testParseOk(t, "--check-config").checkConfig {
+		t.Fatal("--check-config is check config")
+	}
+}
+
+func TestParseDisableUpdate(t *testing.T) {
+	if testParseOk(t).disableUpdate {
+		t.Fatal("empty is not disable update")
+	}
+	if !testParseOk(t, "--no-check-update").disableUpdate {
+		t.Fatal("--no-check-update is disable update")
+	}
+}
+
+func TestParseService(t *testing.T) {
+	if testParseOk(t).serviceControlAction != "" {
+		t.Fatal("empty is no service command")
+	}
+	if testParseOk(t, "-s", "command").serviceControlAction != "command" {
+		t.Fatal("-s is service command")
+	}
+	if testParseOk(t, "--service", "command").serviceControlAction != "command" {
+		t.Fatal("--service is service command")
+	}
+}
+
+func TestParseGLInet(t *testing.T) {
+	if testParseOk(t).glinetMode {
+		t.Fatal("empty is not GL-Inet mode")
+	}
+	if !testParseOk(t, "--glinet").glinetMode {
+		t.Fatal("--glinet is GL-Inet mode")
+	}
+}
+
+func TestParseUnknown(t *testing.T) {
+	testParseErr(t, "unknown word", "x")
+	testParseErr(t, "unknown short", "-x")
+	testParseErr(t, "unknown long", "--x")
+	testParseErr(t, "unknown triple", "---x")
+	testParseErr(t, "unknown plus", "+x")
+	testParseErr(t, "unknown dash", "-")
+}

From d3428ca46c9d68b4d9d6d1967fbe128b7799dac7 Mon Sep 17 00:00:00 2001
From: David Sheets <sheets@alum.mit.edu>
Date: Mon, 7 Sep 2020 09:53:16 +0100
Subject: [PATCH 09/34] home/options: add options -> args serialization

---
 home/options.go      | 58 ++++++++++++++++++++++++++++++++++++++
 home/options_test.go | 66 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 124 insertions(+)

diff --git a/home/options.go b/home/options.go
index ec789d4f..90d356e8 100644
--- a/home/options.go
+++ b/home/options.go
@@ -40,6 +40,33 @@ type arg struct {
 	updateWithValue func(o options, v string) (options, error)         // the mutator for arguments with parameters
 	updateNoValue   func(o options) (options, error)                   // the mutator for arguments without parameters
 	effect          func(o options, exec string) (f effect, err error) // the side-effect closure generator
+
+	serialize func(o options) []string // the re-serialization function back to arguments (return nil for omit)
+}
+
+// {type}SliceOrNil functions check their parameter of type {type}
+// against its zero value and return nil if the parameter value is
+// zero otherwise they return a string slice of the parameter
+
+func stringSliceOrNil(s string) []string {
+	if s == "" {
+		return nil
+	}
+	return []string{s}
+}
+
+func intSliceOrNil(i int) []string {
+	if i == 0 {
+		return nil
+	}
+	return []string{strconv.Itoa(i)}
+}
+
+func boolSliceOrNil(b bool) []string {
+	if b {
+		return []string{}
+	}
+	return nil
 }
 
 var args []arg
@@ -50,18 +77,21 @@ var configArg = arg{
 	func(o options, v string) (options, error) { o.configFilename = v; return o, nil },
 	nil,
 	nil,
+	func(o options) []string { return stringSliceOrNil(o.configFilename) },
 }
 
 var workDirArg = arg{
 	"Path to the working directory",
 	"work-dir", "w",
 	func(o options, v string) (options, error) { o.workDir = v; return o, nil }, nil, nil,
+	func(o options) []string { return stringSliceOrNil(o.workDir) },
 }
 
 var hostArg = arg{
 	"Host address to bind HTTP server on",
 	"host", "h",
 	func(o options, v string) (options, error) { o.bindHost = v; return o, nil }, nil, nil,
+	func(o options) []string { return stringSliceOrNil(o.bindHost) },
 }
 
 var portArg = arg{
@@ -80,6 +110,7 @@ var portArg = arg{
 		}
 		return o, err
 	}, nil, nil,
+	func(o options) []string { return intSliceOrNil(o.bindPort) },
 }
 
 var serviceArg = arg{
@@ -89,42 +120,49 @@ var serviceArg = arg{
 		o.serviceControlAction = v
 		return o, nil
 	}, nil, nil,
+	func(o options) []string { return stringSliceOrNil(o.serviceControlAction) },
 }
 
 var logfileArg = arg{
 	"Path to log file. If empty: write to stdout; if 'syslog': write to system log",
 	"logfile", "l",
 	func(o options, v string) (options, error) { o.logFile = v; return o, nil }, nil, nil,
+	func(o options) []string { return stringSliceOrNil(o.logFile) },
 }
 
 var pidfileArg = arg{
 	"Path to a file where PID is stored",
 	"pidfile", "",
 	func(o options, v string) (options, error) { o.pidFile = v; return o, nil }, nil, nil,
+	func(o options) []string { return stringSliceOrNil(o.pidFile) },
 }
 
 var checkConfigArg = arg{
 	"Check configuration and exit",
 	"check-config", "",
 	nil, func(o options) (options, error) { o.checkConfig = true; return o, nil }, nil,
+	func(o options) []string { return boolSliceOrNil(o.checkConfig) },
 }
 
 var noCheckUpdateArg = arg{
 	"Don't check for updates",
 	"no-check-update", "",
 	nil, func(o options) (options, error) { o.disableUpdate = true; return o, nil }, nil,
+	func(o options) []string { return boolSliceOrNil(o.disableUpdate) },
 }
 
 var verboseArg = arg{
 	"Enable verbose output",
 	"verbose", "v",
 	nil, func(o options) (options, error) { o.verbose = true; return o, nil }, nil,
+	func(o options) []string { return boolSliceOrNil(o.verbose) },
 }
 
 var glinetArg = arg{
 	"Run in GL-Inet compatibility mode",
 	"glinet", "",
 	nil, func(o options) (options, error) { o.glinetMode = true; return o, nil }, nil,
+	func(o options) []string { return boolSliceOrNil(o.glinetMode) },
 }
 
 var versionArg = arg{
@@ -133,6 +171,7 @@ var versionArg = arg{
 	nil, nil, func(o options, exec string) (effect, error) {
 		return func() error { fmt.Println(version()); os.Exit(0); return nil }, nil
 	},
+	func(o options) []string { return nil },
 }
 
 var helpArg = arg{
@@ -141,6 +180,7 @@ var helpArg = arg{
 	nil, nil, func(o options, exec string) (effect, error) {
 		return func() error { _ = printHelp(exec); os.Exit(64); return nil }, nil
 	},
+	func(o options) []string { return nil },
 }
 
 func init() {
@@ -253,3 +293,21 @@ func parse(exec string, ss []string) (o options, f effect, err error) {
 
 	return
 }
+
+func shortestFlag(a arg) string {
+	if a.shortName != "" {
+		return "-" + a.shortName
+	}
+	return "--" + a.longName
+}
+
+func serialize(o options) []string {
+	ss := []string{}
+	for _, arg := range args {
+		s := arg.serialize(o)
+		if s != nil {
+			ss = append(ss, append([]string{shortestFlag(arg)}, s...)...)
+		}
+	}
+	return ss
+}
diff --git a/home/options_test.go b/home/options_test.go
index 750f3ce2..5a2b1155 100644
--- a/home/options_test.go
+++ b/home/options_test.go
@@ -169,3 +169,69 @@ func TestParseUnknown(t *testing.T) {
 	testParseErr(t, "unknown plus", "+x")
 	testParseErr(t, "unknown dash", "-")
 }
+
+func testSerialize(t *testing.T, o options, ss ...string) {
+	result := serialize(o)
+	if len(result) != len(ss) {
+		t.Fatalf("expected %s but got %s", ss, result)
+	}
+	for i, r := range result {
+		if r != ss[i] {
+			t.Fatalf("expected %s but got %s", ss, result)
+		}
+	}
+}
+
+func TestSerializeEmpty(t *testing.T) {
+	testSerialize(t, options{})
+}
+
+func TestSerializeConfigFilename(t *testing.T) {
+	testSerialize(t, options{configFilename: "path"}, "-c", "path")
+}
+
+func TestSerializeWorkDir(t *testing.T) {
+	testSerialize(t, options{workDir: "path"}, "-w", "path")
+}
+
+func TestSerializeBindHost(t *testing.T) {
+	testSerialize(t, options{bindHost: "addr"}, "-h", "addr")
+}
+
+func TestSerializeBindPort(t *testing.T) {
+	testSerialize(t, options{bindPort: 666}, "-p", "666")
+}
+
+func TestSerializeLogfile(t *testing.T) {
+	testSerialize(t, options{logFile: "path"}, "-l", "path")
+}
+
+func TestSerializePidfile(t *testing.T) {
+	testSerialize(t, options{pidFile: "path"}, "--pidfile", "path")
+}
+
+func TestSerializeCheckConfig(t *testing.T) {
+	testSerialize(t, options{checkConfig: true}, "--check-config")
+}
+
+func TestSerializeDisableUpdate(t *testing.T) {
+	testSerialize(t, options{disableUpdate: true}, "--no-check-update")
+}
+
+func TestSerializeService(t *testing.T) {
+	testSerialize(t, options{serviceControlAction: "run"}, "-s", "run")
+}
+
+func TestSerializeGLInet(t *testing.T) {
+	testSerialize(t, options{glinetMode: true}, "--glinet")
+}
+
+func TestSerializeMultiple(t *testing.T) {
+	testSerialize(t, options{
+		serviceControlAction: "run",
+		configFilename:       "config",
+		workDir:              "work",
+		pidFile:              "pid",
+		disableUpdate:        true,
+	}, "-c", "config", "-w", "work", "-s", "run", "--pidfile", "pid", "--no-check-update")
+}

From 9e87f0afed6f26605adb1661cdc32f5c07947c02 Mon Sep 17 00:00:00 2001
From: David Sheets <sheets@alum.mit.edu>
Date: Mon, 7 Sep 2020 10:04:31 +0100
Subject: [PATCH 10/34] home/auth: disable non-crypto RNG gosec lint check for
 session salt

Fixes #2078.
---
 home/auth.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/home/auth.go b/home/auth.go
index 36e56d05..afb7f0ed 100644
--- a/home/auth.go
+++ b/home/auth.go
@@ -276,7 +276,11 @@ type loginJSON struct {
 }
 
 func getSession(u *User) []byte {
-	d := []byte(fmt.Sprintf("%d%s%s", rand.Uint32(), u.Name, u.PasswordHash))
+	// the developers don't currently believe that using a
+	// non-cryptographic RNG for the session hash salt is
+	// insecure
+	salt := rand.Uint32() //nolint:gosec
+	d := []byte(fmt.Sprintf("%d%s%s", salt, u.Name, u.PasswordHash))
 	hash := sha256.Sum256(d)
 	return hash[:]
 }

From 90ef204d0473c9df6bba468f33f2669a0bcf519f Mon Sep 17 00:00:00 2001
From: David Sheets <sheets@alum.mit.edu>
Date: Mon, 7 Sep 2020 10:26:40 +0100
Subject: [PATCH 11/34] service: installation and running of AGH as a service
 with CLI args

---
 home/home.go    |  2 +-
 home/service.go | 13 +++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/home/home.go b/home/home.go
index 806c59e2..898fb4bd 100644
--- a/home/home.go
+++ b/home/home.go
@@ -126,7 +126,7 @@ func Main(version string, channel string, armVer string) {
 	}()
 
 	if args.serviceControlAction != "" {
-		handleServiceControlAction(args.serviceControlAction)
+		handleServiceControlAction(args)
 		return
 	}
 
diff --git a/home/service.go b/home/service.go
index 21c9cfc6..b48c743b 100644
--- a/home/service.go
+++ b/home/service.go
@@ -24,12 +24,14 @@ const (
 
 // Represents the program that will be launched by a service or daemon
 type program struct {
+	opts options
 }
 
 // Start should quickly start the program
 func (p *program) Start(s service.Service) error {
 	// Start should not block. Do the actual work async.
-	args := options{runningAsService: true}
+	args := p.opts
+	args.runningAsService = true
 	go run(args)
 	return nil
 }
@@ -125,7 +127,8 @@ func sendSigReload() {
 // run - this is a special command that is not supposed to be used directly
 // it is specified when we register a service, and it indicates to the app
 // that it is being run as a service/daemon.
-func handleServiceControlAction(action string) {
+func handleServiceControlAction(opts options) {
+	action := opts.serviceControlAction
 	log.Printf("Service control action: %s", action)
 
 	if action == "reload" {
@@ -137,15 +140,17 @@ func handleServiceControlAction(action string) {
 	if err != nil {
 		log.Fatal("Unable to find the path to the current directory")
 	}
+	runOpts := opts
+	runOpts.serviceControlAction = "run"
 	svcConfig := &service.Config{
 		Name:             serviceName,
 		DisplayName:      serviceDisplayName,
 		Description:      serviceDescription,
 		WorkingDirectory: pwd,
-		Arguments:        []string{"-s", "run"},
+		Arguments:        serialize(runOpts),
 	}
 	configureService(svcConfig)
-	prg := &program{}
+	prg := &program{runOpts}
 	s, err := service.New(prg, svcConfig)
 	if err != nil {
 		log.Fatal(err)

From 12ed67ab1154138c0008f18b6fb7ac8a17f43860 Mon Sep 17 00:00:00 2001
From: ArtemBaskal <a.baskal@adguard.com>
Date: Mon, 7 Sep 2020 12:38:35 +0300
Subject: [PATCH 12/34] + client: Add REFUSED DNS error code as the default
 blocking method

---
 client/src/__locales/en.json    | 1 +
 client/src/helpers/constants.js | 1 +
 2 files changed, 2 insertions(+)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index d6c2cd5c..fe21ef6c 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -235,6 +235,7 @@
     "blocking_mode": "Blocking mode",
     "default": "Default",
     "nxdomain": "NXDOMAIN",
+    "refused": "REFUSED",
     "null_ip": "Null IP",
     "custom_ip": "Custom IP",
     "blocking_ipv4": "Blocking IPv4",
diff --git a/client/src/helpers/constants.js b/client/src/helpers/constants.js
index e0075a25..163b11a6 100644
--- a/client/src/helpers/constants.js
+++ b/client/src/helpers/constants.js
@@ -294,6 +294,7 @@ export const FILTERS_INTERVALS_HOURS = [0, 1, 12, 24, 72, 168];
 
 export const BLOCKING_MODES = {
     default: 'default',
+    refused: 'refused',
     nxdomain: 'nxdomain',
     null_ip: 'null_ip',
     custom_ip: 'custom_ip',

From 14bc5297ac6cb7c6dbc74d55239eeb16c041c048 Mon Sep 17 00:00:00 2001
From: ArtemBaskal <a.baskal@adguard.com>
Date: Mon, 7 Sep 2020 13:50:03 +0300
Subject: [PATCH 13/34] + client: Add experimental DNS-over-QUIC support

---
 client/src/__locales/en.json                  |  8 +++++
 client/src/actions/encryption.js              |  2 ++
 .../Settings/Dns/Upstream/Examples.js         | 19 +++++++++++
 .../components/Settings/Encryption/Form.js    | 33 +++++++++++++++++--
 .../components/Settings/Encryption/index.js   |  2 ++
 client/src/components/Settings/Settings.css   |  2 +-
 client/src/helpers/constants.js               |  1 +
 client/src/helpers/validators.js              |  6 ++++
 8 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index 6cce0d91..58e270be 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -186,6 +186,7 @@
     "example_upstream_regular": "regular DNS (over UDP)",
     "example_upstream_dot": "encrypted <0>DNS-over-TLS</0>",
     "example_upstream_doh": "encrypted <0>DNS-over-HTTPS</0>",
+    "example_upstream_doq": "encrypted <0>DNS-over-QUIC</0>",
     "example_upstream_sdns": "you can use <0>DNS Stamps</0> for <1>DNSCrypt</1> or <2>DNS-over-HTTPS</2> resolvers",
     "example_upstream_tcp": "regular DNS (over TCP)",
     "all_lists_up_to_date_toast": "All lists are already up-to-date",
@@ -330,6 +331,8 @@
     "encryption_https_desc": "If HTTPS port is configured, AdGuard Home admin interface will be accessible via HTTPS, and it will also provide DNS-over-HTTPS on '/dns-query' location.",
     "encryption_dot": "DNS-over-TLS port",
     "encryption_dot_desc": "If this port is configured, AdGuard Home will run a DNS-over-TLS server on this port.",
+    "encryption_doq": "DNS-over-QUIC port",
+    "encryption_doq_desc": "If this port is configured, AdGuard Home will run a DNS-over-QUIC server on this port. It's experimental and may not be reliable at the moment. The only DNS provider that supports it now is AdGuard DNS",
     "encryption_certificates": "Certificates",
     "encryption_certificates_desc": "In order to use encryption, you need to provide a valid SSL certificates chain for your domain. You can get a free certificate on <0>{{link}}</0> or you can buy it from one of the trusted Certificate Authorities.",
     "encryption_certificates_input": "Copy/paste your PEM-encoded certificates here.",
@@ -574,5 +577,10 @@
     "original_response": "Original response",
     "click_to_view_queries": "Click to view queries",
     "port_53_faq_link": "Port 53 is often occupied by \"DNSStubListener\" or \"systemd-resolved\" services. Please read <0>this instruction</0> on how to resolve this.",
+<<<<<<< Updated upstream
     "adg_will_drop_dns_queries": "AdGuard Home will be dropping all DNS queries from this client."
+=======
+    "adg_will_drop_dns_queries": "AdGuard Home will be dropping all DNS queries from this client.",
+    "experimental": "Experimental"
+>>>>>>> Stashed changes
 }
diff --git a/client/src/actions/encryption.js b/client/src/actions/encryption.js
index 0e743323..36faf2ec 100644
--- a/client/src/actions/encryption.js
+++ b/client/src/actions/encryption.js
@@ -34,6 +34,7 @@ export const setTlsConfig = (config) => async (dispatch, getState) => {
         values.private_key = btoa(values.private_key);
         values.port_https = values.port_https || 0;
         values.port_dns_over_tls = values.port_dns_over_tls || 0;
+        values.port_dns_over_quic = values.port_dns_over_quic || 0;
 
         const response = await apiClient.setTlsConfig(values);
         response.certificate_chain = atob(response.certificate_chain);
@@ -59,6 +60,7 @@ export const validateTlsConfig = (config) => async (dispatch) => {
         values.private_key = btoa(values.private_key);
         values.port_https = values.port_https || 0;
         values.port_dns_over_tls = values.port_dns_over_tls || 0;
+        values.port_dns_over_quic = values.port_dns_over_quic || 0;
 
         const response = await apiClient.validateTlsConfig(values);
         response.certificate_chain = atob(response.certificate_chain);
diff --git a/client/src/components/Settings/Dns/Upstream/Examples.js b/client/src/components/Settings/Dns/Upstream/Examples.js
index de779b18..a18c1c90 100644
--- a/client/src/components/Settings/Dns/Upstream/Examples.js
+++ b/client/src/components/Settings/Dns/Upstream/Examples.js
@@ -63,6 +63,25 @@ const Examples = (props) => (
                     </Trans>
                 </span>
             </li>
+            <li>
+                <code>quic://dns-unfiltered.adguard.com:784</code> –&nbsp;
+                <span>
+                    <Trans
+                        components={[
+                            <a
+                                href="https://wikipedia.org/wiki/QUIC"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                key="0"
+                            >
+                                DNS-over-QUIC
+                            </a>,
+                        ]}
+                    >
+                        example_upstream_doq
+                    </Trans>
+                </span>
+            </li>
             <li>
                 <code>tcp://9.9.9.9</code> – <Trans>example_upstream_tcp</Trans>
             </li>
diff --git a/client/src/components/Settings/Encryption/Form.js b/client/src/components/Settings/Encryption/Form.js
index 7be23b10..ee56b315 100644
--- a/client/src/components/Settings/Encryption/Form.js
+++ b/client/src/components/Settings/Encryption/Form.js
@@ -11,11 +11,15 @@ import {
     renderRadioField,
     toNumber,
 } from '../../../helpers/form';
-import { validateIsSafePort, validatePort, validatePortTLS } from '../../../helpers/validators';
+import {
+    validateIsSafePort, validatePort, validatePortQuic, validatePortTLS,
+} from '../../../helpers/validators';
 import i18n from '../../../i18n';
 import KeyStatus from './KeyStatus';
 import CertificateStatus from './CertificateStatus';
-import { DNS_OVER_TLS_PORT, FORM_NAME, STANDARD_HTTPS_PORT } from '../../../helpers/constants';
+import {
+    DNS_OVER_QUIC_PORT, DNS_OVER_TLS_PORT, FORM_NAME, STANDARD_HTTPS_PORT,
+} from '../../../helpers/constants';
 
 const validate = (values) => {
     const errors = {};
@@ -38,6 +42,7 @@ const clearFields = (change, setTlsConfig, t) => {
         certificate_path: '',
         port_https: STANDARD_HTTPS_PORT,
         port_dns_over_tls: DNS_OVER_TLS_PORT,
+        port_dns_over_quic: DNS_OVER_QUIC_PORT,
         server_name: '',
         force_https: false,
         enabled: false,
@@ -189,6 +194,30 @@ let Form = (props) => {
                         </div>
                     </div>
                 </div>
+                <div className="col-lg-6">
+                    <div className="form__group form__group--settings">
+                        <label className="form__label" htmlFor="port_dns_over_quic">
+                            <Trans>encryption_doq</Trans>
+                            &nbsp;
+                            (<Trans>experimental</Trans>)
+                        </label>
+                        <Field
+                                id="port_dns_over_quic"
+                                name="port_dns_over_quic"
+                                component={renderInputField}
+                                type="number"
+                                className="form-control"
+                                placeholder={t('encryption_doq')}
+                                validate={[validatePortQuic]}
+                                normalize={toNumber}
+                                onChange={handleChange}
+                                disabled={!isEnabled}
+                        />
+                        <div className="form__desc">
+                            <Trans>encryption_doq_desc</Trans>
+                        </div>
+                    </div>
+                </div>
             </div>
             <div className="row">
                 <div className="col-12">
diff --git a/client/src/components/Settings/Encryption/index.js b/client/src/components/Settings/Encryption/index.js
index 7c2cccc8..f7ca52e0 100644
--- a/client/src/components/Settings/Encryption/index.js
+++ b/client/src/components/Settings/Encryption/index.js
@@ -66,6 +66,7 @@ class Encryption extends Component {
             force_https,
             port_https,
             port_dns_over_tls,
+            port_dns_over_quic,
             certificate_chain,
             private_key,
             certificate_path,
@@ -78,6 +79,7 @@ class Encryption extends Component {
             force_https,
             port_https,
             port_dns_over_tls,
+            port_dns_over_quic,
             certificate_chain,
             private_key,
             certificate_path,
diff --git a/client/src/components/Settings/Settings.css b/client/src/components/Settings/Settings.css
index 3bf1a121..4efb0868 100644
--- a/client/src/components/Settings/Settings.css
+++ b/client/src/components/Settings/Settings.css
@@ -54,7 +54,7 @@
 }
 
 .form__message--error {
-    color: var(--red);
+    color: #cd201f;
 }
 
 .form__message--left-pad {
diff --git a/client/src/helpers/constants.js b/client/src/helpers/constants.js
index e0075a25..1020a50c 100644
--- a/client/src/helpers/constants.js
+++ b/client/src/helpers/constants.js
@@ -69,6 +69,7 @@ export const STANDARD_DNS_PORT = 53;
 export const STANDARD_WEB_PORT = 80;
 export const STANDARD_HTTPS_PORT = 443;
 export const DNS_OVER_TLS_PORT = 853;
+export const DNS_OVER_QUIC_PORT = 784;
 export const MAX_PORT = 65535;
 
 export const EMPTY_DATE = '0001-01-01T00:00:00Z';
diff --git a/client/src/helpers/validators.js b/client/src/helpers/validators.js
index 45055154..64c5fa49 100644
--- a/client/src/helpers/validators.js
+++ b/client/src/helpers/validators.js
@@ -180,6 +180,12 @@ export const validatePortTLS = (value) => {
     return undefined;
 };
 
+/**
+ * @param value {number}
+ * @returns {undefined|string}
+ */
+export const validatePortQuic = validatePortTLS;
+
 /**
  * @param value {number}
  * @returns {undefined|string}

From 4d1666eff1f5643dab485e35051677c103dd20b2 Mon Sep 17 00:00:00 2001
From: ArtemBaskal <a.baskal@adguard.com>
Date: Mon, 7 Sep 2020 13:52:23 +0300
Subject: [PATCH 14/34] Resolve conflict

---
 client/src/__locales/en.json | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index 58e270be..eafb667b 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -577,10 +577,6 @@
     "original_response": "Original response",
     "click_to_view_queries": "Click to view queries",
     "port_53_faq_link": "Port 53 is often occupied by \"DNSStubListener\" or \"systemd-resolved\" services. Please read <0>this instruction</0> on how to resolve this.",
-<<<<<<< Updated upstream
-    "adg_will_drop_dns_queries": "AdGuard Home will be dropping all DNS queries from this client."
-=======
     "adg_will_drop_dns_queries": "AdGuard Home will be dropping all DNS queries from this client.",
     "experimental": "Experimental"
->>>>>>> Stashed changes
 }

From 9f3c27c03a6fcba71ee84e3826c3e10bd270c348 Mon Sep 17 00:00:00 2001
From: ArtemBaskal <a.baskal@adguard.com>
Date: Tue, 8 Sep 2020 10:17:39 +0300
Subject: [PATCH 15/34] Change link and translation

---
 client/src/__locales/en.json                            | 2 +-
 client/src/components/Settings/Dns/Upstream/Examples.js | 4 +++-
 client/src/components/Settings/Encryption/Form.js       | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index eafb667b..6abd1d4c 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -332,7 +332,7 @@
     "encryption_dot": "DNS-over-TLS port",
     "encryption_dot_desc": "If this port is configured, AdGuard Home will run a DNS-over-TLS server on this port.",
     "encryption_doq": "DNS-over-QUIC port",
-    "encryption_doq_desc": "If this port is configured, AdGuard Home will run a DNS-over-QUIC server on this port. It's experimental and may not be reliable at the moment. The only DNS provider that supports it now is AdGuard DNS",
+    "encryption_doq_desc": "If this port is configured, AdGuard Home will run a DNS-over-QUIC server on this port. It's experimental and may not be reliable. Also, there are not too many clients that support it at the moment.",
     "encryption_certificates": "Certificates",
     "encryption_certificates_desc": "In order to use encryption, you need to provide a valid SSL certificates chain for your domain. You can get a free certificate on <0>{{link}}</0> or you can buy it from one of the trusted Certificate Authorities.",
     "encryption_certificates_input": "Copy/paste your PEM-encoded certificates here.",
diff --git a/client/src/components/Settings/Dns/Upstream/Examples.js b/client/src/components/Settings/Dns/Upstream/Examples.js
index a18c1c90..70797909 100644
--- a/client/src/components/Settings/Dns/Upstream/Examples.js
+++ b/client/src/components/Settings/Dns/Upstream/Examples.js
@@ -69,7 +69,7 @@ const Examples = (props) => (
                     <Trans
                         components={[
                             <a
-                                href="https://wikipedia.org/wiki/QUIC"
+                                href="https://tools.ietf.org/html/draft-huitema-quic-dnsoquic-07"
                                 target="_blank"
                                 rel="noopener noreferrer"
                                 key="0"
@@ -80,6 +80,8 @@ const Examples = (props) => (
                     >
                         example_upstream_doq
                     </Trans>
+                    &nbsp;
+                    <span className="text-lowercase">(<Trans>experimental</Trans>)</span>
                 </span>
             </li>
             <li>
diff --git a/client/src/components/Settings/Encryption/Form.js b/client/src/components/Settings/Encryption/Form.js
index ee56b315..15f8a3c6 100644
--- a/client/src/components/Settings/Encryption/Form.js
+++ b/client/src/components/Settings/Encryption/Form.js
@@ -199,7 +199,7 @@ let Form = (props) => {
                         <label className="form__label" htmlFor="port_dns_over_quic">
                             <Trans>encryption_doq</Trans>
                             &nbsp;
-                            (<Trans>experimental</Trans>)
+                            <span className="text-lowercase">(<Trans>experimental</Trans>)</span>
                         </label>
                         <Field
                                 id="port_dns_over_quic"

From c5ca2e60c6c94f0e00a710e692e8d9a6900371d1 Mon Sep 17 00:00:00 2001
From: Artem Baskal <a.baskal@adguard.com>
Date: Tue, 8 Sep 2020 14:05:26 +0300
Subject: [PATCH 16/34] - client: Count client requests correctly

Close #2037

Squashed commit of the following:

commit f19b5f5919ab0c9c31e03728a0def04f02b8d7db
Merge: b51cf160 06594bde
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Tue Sep 8 13:18:39 2020 +0300

    Merge branch 'master' into fix/2037

commit b51cf16008f516bfeed6d8212d27902514d3251c
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Fri Sep 4 18:06:17 2020 +0300

    - client: Count client requests correctly
---
 client/src/__tests__/helpers.test.js          | 59 ++++++++++++++-
 .../Settings/Clients/ClientsTable.js          |  7 +-
 client/src/helpers/constants.js               |  6 ++
 client/src/helpers/helpers.js                 | 72 +++++++++++++++++++
 4 files changed, 140 insertions(+), 4 deletions(-)

diff --git a/client/src/__tests__/helpers.test.js b/client/src/__tests__/helpers.test.js
index f974cca6..bb371be4 100644
--- a/client/src/__tests__/helpers.test.js
+++ b/client/src/__tests__/helpers.test.js
@@ -1,5 +1,7 @@
-import { getIpMatchListStatus, sortIp } from '../helpers/helpers';
-import { IP_MATCH_LIST_STATUS } from '../helpers/constants';
+import {
+    countClientsStatistics, findAddressType, getIpMatchListStatus, sortIp,
+} from '../helpers/helpers';
+import { ADDRESS_TYPES, IP_MATCH_LIST_STATUS } from '../helpers/constants';
 
 describe('getIpMatchListStatus', () => {
     describe('IPv4', () => {
@@ -482,3 +484,56 @@ describe('sortIp', () => {
         });
     });
 });
+
+describe('findAddressType', () => {
+    describe('ip', () => {
+        expect(findAddressType('127.0.0.1')).toStrictEqual(ADDRESS_TYPES.IP);
+    });
+    describe('cidr', () => {
+        expect(findAddressType('127.0.0.1/8')).toStrictEqual(ADDRESS_TYPES.CIDR);
+    });
+    describe('mac', () => {
+        expect(findAddressType('00:1B:44:11:3A:B7')).toStrictEqual(ADDRESS_TYPES.UNKNOWN);
+    });
+});
+
+describe('countClientsStatistics', () => {
+    test('single ip', () => {
+        expect(countClientsStatistics(['127.0.0.1'], {
+            '127.0.0.1': 1,
+        })).toStrictEqual(1);
+    });
+    test('multiple ip', () => {
+        expect(countClientsStatistics(['127.0.0.1', '127.0.0.2'], {
+            '127.0.0.1': 1,
+            '127.0.0.2': 2,
+        })).toStrictEqual(1 + 2);
+    });
+    test('cidr', () => {
+        expect(countClientsStatistics(['127.0.0.0/8'], {
+            '127.0.0.1': 1,
+            '127.0.0.2': 2,
+        })).toStrictEqual(1 + 2);
+    });
+    test('cidr and multiple ip', () => {
+        expect(countClientsStatistics(['1.1.1.1', '2.2.2.2', '3.3.3.0/24'], {
+            '1.1.1.1': 1,
+            '2.2.2.2': 2,
+            '3.3.3.3': 3,
+        })).toStrictEqual(1 + 2 + 3);
+    });
+    test('mac', () => {
+        expect(countClientsStatistics(['00:1B:44:11:3A:B7', '2.2.2.2', '3.3.3.0/24'], {
+            '1.1.1.1': 1,
+            '2.2.2.2': 2,
+            '3.3.3.3': 3,
+        })).toStrictEqual(2 + 3);
+    });
+    test('not found', () => {
+        expect(countClientsStatistics(['4.4.4.4', '5.5.5.5', '6.6.6.6'], {
+            '1.1.1.1': 1,
+            '2.2.2.2': 2,
+            '3.3.3.3': 3,
+        })).toStrictEqual(0);
+    });
+});
diff --git a/client/src/components/Settings/Clients/ClientsTable.js b/client/src/components/Settings/Clients/ClientsTable.js
index cb7f2914..ac613164 100644
--- a/client/src/components/Settings/Clients/ClientsTable.js
+++ b/client/src/components/Settings/Clients/ClientsTable.js
@@ -4,7 +4,7 @@ import { Trans, withTranslation } from 'react-i18next';
 import ReactTable from 'react-table';
 
 import { MODAL_TYPE } from '../../../helpers/constants';
-import { splitByNewLine } from '../../../helpers/helpers';
+import { splitByNewLine, countClientsStatistics } from '../../../helpers/helpers';
 import Card from '../../ui/Card';
 import Modal from './Modal';
 import CellWrap from '../../ui/CellWrap';
@@ -204,7 +204,10 @@ class ClientsTable extends Component {
         {
             Header: this.props.t('requests_count'),
             id: 'statistics',
-            accessor: (row) => this.props.normalizedTopClients.configured[row.name] || 0,
+            accessor: (row) => countClientsStatistics(
+                row.ids,
+                this.props.normalizedTopClients.auto,
+            ),
             sortMethod: (a, b) => b - a,
             minWidth: 120,
             Cell: (row) => {
diff --git a/client/src/helpers/constants.js b/client/src/helpers/constants.js
index 90d06a6f..deabf72a 100644
--- a/client/src/helpers/constants.js
+++ b/client/src/helpers/constants.js
@@ -548,3 +548,9 @@ export const TOAST_TIMEOUTS = {
     [TOAST_TYPES.ERROR]: FAILURE_TOAST_TIMEOUT,
     [TOAST_TYPES.NOTICE]: FAILURE_TOAST_TIMEOUT,
 };
+
+export const ADDRESS_TYPES = {
+    IP: 'IP',
+    CIDR: 'CIDR',
+    UNKNOWN: 'UNKNOWN',
+};
diff --git a/client/src/helpers/helpers.js b/client/src/helpers/helpers.js
index bafd230e..f509ef44 100644
--- a/client/src/helpers/helpers.js
+++ b/client/src/helpers/helpers.js
@@ -14,6 +14,7 @@ import queryString from 'query-string';
 import { getTrackerData } from './trackers/trackers';
 
 import {
+    ADDRESS_TYPES,
     CHECK_TIMEOUT,
     CUSTOM_FILTERING_RULES_ID,
     DEFAULT_DATE_FORMAT_OPTIONS,
@@ -509,6 +510,18 @@ const isIpMatchCidr = (parsedIp, parsedCidr) => {
     }
 };
 
+export const isIpInCidr = (ip, cidr) => {
+    try {
+        const parsedIp = ipaddr.parse(ip);
+        const parsedCidr = ipaddr.parseCIDR(cidr);
+
+        return isIpMatchCidr(parsedIp, parsedCidr);
+    } catch (e) {
+        console.error(e);
+        return false;
+    }
+};
+
 /**
  * The purpose of this method is to quickly check
  * if this IP can possibly be in the specified CIDR range.
@@ -578,6 +591,29 @@ const isIpQuickMatchCIDR = (ip, listItem) => {
     return false;
 };
 
+/**
+ *
+ * @param ipOrCidr
+ * @returns {'IP' | 'CIDR' | 'UNKNOWN'}
+ *
+ */
+export const findAddressType = (address) => {
+    try {
+        const cidrMaybe = address.includes('/');
+
+        if (!cidrMaybe && ipaddr.isValid(address)) {
+            return ADDRESS_TYPES.IP;
+        }
+        if (cidrMaybe && ipaddr.parseCIDR(address)) {
+            return ADDRESS_TYPES.CIDR;
+        }
+
+        return ADDRESS_TYPES.UNKNOWN;
+    } catch (e) {
+        return ADDRESS_TYPES.UNKNOWN;
+    }
+};
+
 /**
  * @param ip {string}
  * @param list {string}
@@ -622,6 +658,42 @@ export const getIpMatchListStatus = (ip, list) => {
     }
 };
 
+/**
+ * @param ids {string[]}
+ * @returns {Object}
+ */
+export const separateIpsAndCidrs = (ids) => ids.reduce((acc, curr) => {
+    const addressType = findAddressType(curr);
+
+    if (addressType === ADDRESS_TYPES.IP) {
+        acc.ips.push(curr);
+    }
+    if (addressType === ADDRESS_TYPES.CIDR) {
+        acc.cidrs.push(curr);
+    }
+    return acc;
+}, { ips: [], cidrs: [] });
+
+export const countClientsStatistics = (ids, autoClients) => {
+    const { ips, cidrs } = separateIpsAndCidrs(ids);
+
+    const ipsCount = ips.reduce((acc, curr) => {
+        const count = autoClients[curr] || 0;
+        return acc + count;
+    }, 0);
+
+    const cidrsCount = Object.entries(autoClients)
+        .reduce((acc, curr) => {
+            const [id, count] = curr;
+            if (cidrs.some((cidr) => isIpInCidr(id, cidr))) {
+            // eslint-disable-next-line no-param-reassign
+                acc += count;
+            }
+            return acc;
+        }, 0);
+
+    return ipsCount + cidrsCount;
+};
 
 /**
  * @param {string} elapsedMs

From b04e12e189b5949cdc8f60aede950dedf574d839 Mon Sep 17 00:00:00 2001
From: Artem Baskal <a.baskal@adguard.com>
Date: Tue, 8 Sep 2020 14:06:19 +0300
Subject: [PATCH 17/34] + client: Display upstreams list loaded from a file

Squashed commit of the following:

commit b5abc9115806f345c8d0dd5ea00b8552d27813f9
Merge: 92708411 c1c8abdd
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Mon Sep 7 14:38:06 2020 +0300

    Merge branch '1680-upstreams-file' into feature/1680

commit 92708411f07638c037e049ee8012d15bdeda77e4
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Fri Sep 4 13:54:24 2020 +0300

    + client: Display upstreams list loaded from a file
---
 client/src/__locales/en.json                  |  4 +-
 .../components/Settings/Dns/Upstream/Form.js  | 93 +++++++++++--------
 .../components/Settings/Dns/Upstream/index.js | 23 +++--
 client/src/helpers/constants.js               |  1 +
 client/src/reducers/dnsConfig.js              |  1 +
 5 files changed, 74 insertions(+), 48 deletions(-)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index 6cce0d91..674332d7 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -574,5 +574,7 @@
     "original_response": "Original response",
     "click_to_view_queries": "Click to view queries",
     "port_53_faq_link": "Port 53 is often occupied by \"DNSStubListener\" or \"systemd-resolved\" services. Please read <0>this instruction</0> on how to resolve this.",
-    "adg_will_drop_dns_queries": "AdGuard Home will be dropping all DNS queries from this client."
+    "adg_will_drop_dns_queries": "AdGuard Home will be dropping all DNS queries from this client.",
+    "configured_in": "Configured in {{path}}",
+    "please_read_wiki": "Please read the wiki"
 }
diff --git a/client/src/components/Settings/Dns/Upstream/Form.js b/client/src/components/Settings/Dns/Upstream/Form.js
index 2678edac..65a41c9f 100644
--- a/client/src/components/Settings/Dns/Upstream/Form.js
+++ b/client/src/components/Settings/Dns/Upstream/Form.js
@@ -5,51 +5,61 @@ import { Field, reduxForm } from 'redux-form';
 import { Trans, useTranslation } from 'react-i18next';
 import classnames from 'classnames';
 
+import i18next from 'i18next';
 import Examples from './Examples';
 import { renderRadioField, renderTextareaField } from '../../../../helpers/form';
-import { DNS_REQUEST_OPTIONS, FORM_NAME } from '../../../../helpers/constants';
+import { DNS_REQUEST_OPTIONS, FORM_NAME, UPSTREAM_CONFIGURATION_WIKI_LINK } from '../../../../helpers/constants';
 import { testUpstream } from '../../../../actions';
 import { removeEmptyLines } from '../../../../helpers/helpers';
 
-const getInputFields = () => [{
-    // eslint-disable-next-line react/display-name
-    getTitle: () => <label className="form__label" htmlFor="upstream_dns">
-        <Trans>upstream_dns</Trans>
-    </label>,
-    name: 'upstream_dns',
-    type: 'text',
-    component: renderTextareaField,
-    className: 'form-control form-control--textarea font-monospace',
-    placeholder: 'upstream_dns',
-    normalizeOnBlur: removeEmptyLines,
-},
-{
-    name: 'upstream_mode',
-    type: 'radio',
-    value: DNS_REQUEST_OPTIONS.LOAD_BALANCING,
-    component: renderRadioField,
-    subtitle: 'load_balancing_desc',
-    placeholder: 'load_balancing',
-},
-{
-    name: 'upstream_mode',
-    type: 'radio',
-    value: DNS_REQUEST_OPTIONS.PARALLEL,
-    component: renderRadioField,
-    subtitle: 'upstream_parallel',
-    placeholder: 'parallel_requests',
-},
-{
-    name: 'upstream_mode',
-    type: 'radio',
-    value: DNS_REQUEST_OPTIONS.FASTEST_ADDR,
-    component: renderRadioField,
-    subtitle: 'fastest_addr_desc',
-    placeholder: 'fastest_addr',
-}];
+const Title = () => <label className="form__label" htmlFor="upstream_dns">
+    {i18next.t('upstream_dns')}
+    <div>
+        <a href={UPSTREAM_CONFIGURATION_WIKI_LINK} target="_blank"
+           rel="noopener noreferrer">{i18next.t('please_read_wiki')}</a>
+    </div>
+</label>;
+
+const getInputFields = (upstream_dns_file) => [
+    {
+        getTitle: Title,
+        name: 'upstream_dns',
+        type: 'text',
+        value: 'test',
+        component: renderTextareaField,
+        className: 'form-control form-control--textarea font-monospace',
+        placeholder: 'upstream_dns',
+        normalizeOnBlur: removeEmptyLines,
+        disabled: !!upstream_dns_file,
+    },
+    {
+        name: 'upstream_mode',
+        type: 'radio',
+        value: DNS_REQUEST_OPTIONS.LOAD_BALANCING,
+        component: renderRadioField,
+        subtitle: 'load_balancing_desc',
+        placeholder: 'load_balancing',
+    },
+    {
+        name: 'upstream_mode',
+        type: 'radio',
+        value: DNS_REQUEST_OPTIONS.PARALLEL,
+        component: renderRadioField,
+        subtitle: 'upstream_parallel',
+        placeholder: 'parallel_requests',
+    },
+    {
+        name: 'upstream_mode',
+        type: 'radio',
+        value: DNS_REQUEST_OPTIONS.FASTEST_ADDR,
+        component: renderRadioField,
+        subtitle: 'fastest_addr_desc',
+        placeholder: 'fastest_addr',
+    },
+];
 
 const Form = ({
-    submitting, invalid, processingSetConfig, processingTestUpstream, handleSubmit,
+    submitting, invalid, handleSubmit,
 }) => {
     const dispatch = useDispatch();
     const { t } = useTranslation();
@@ -57,6 +67,9 @@ const Form = ({
     const bootstrap_dns = useSelector(
         (store) => store.form[FORM_NAME.UPSTREAM].values.bootstrap_dns,
     );
+    const upstream_dns_file = useSelector((state) => state.dnsConfig.upstream_dns_file);
+    const processingTestUpstream = useSelector((state) => state.settings.processingTestUpstream);
+    const processingSetConfig = useSelector((state) => state.dnsConfig.processingSetConfig);
 
     const handleUpstreamTest = () => dispatch(testUpstream({
         upstream_dns,
@@ -67,7 +80,7 @@ const Form = ({
         'btn-loading': processingTestUpstream,
     });
 
-    const INPUT_FIELDS = getInputFields();
+    const INPUT_FIELDS = getInputFields(upstream_dns_file);
 
     return <form onSubmit={handleSubmit}>
         <div className="row">
@@ -146,8 +159,6 @@ Form.propTypes = {
     initialValues: PropTypes.object,
     upstream_dns: PropTypes.string,
     bootstrap_dns: PropTypes.string,
-    processingTestUpstream: PropTypes.bool,
-    processingSetConfig: PropTypes.bool,
 };
 
 export default reduxForm({ form: FORM_NAME.UPSTREAM })(Form);
diff --git a/client/src/components/Settings/Dns/Upstream/index.js b/client/src/components/Settings/Dns/Upstream/index.js
index a0a26c00..4092638c 100644
--- a/client/src/components/Settings/Dns/Upstream/index.js
+++ b/client/src/components/Settings/Dns/Upstream/index.js
@@ -12,15 +12,28 @@ const Upstream = () => {
         upstream_dns,
         bootstrap_dns,
         upstream_mode,
-        processingSetConfig,
     } = useSelector((state) => state.dnsConfig, shallowEqual);
 
-    const { processingTestUpstream } = useSelector((state) => state.settings, shallowEqual);
+    const upstream_dns_file = useSelector((state) => state.dnsConfig.upstream_dns_file);
 
     const handleSubmit = (values) => {
-        dispatch(setDnsConfig(values));
+        const {
+            bootstrap_dns,
+            upstream_dns,
+            upstream_mode,
+        } = values;
+
+        const dnsConfig = {
+            bootstrap_dns,
+            upstream_mode,
+            ...(upstream_dns_file ? null : { upstream_dns }),
+        };
+
+        dispatch(setDnsConfig(dnsConfig));
     };
 
+    const upstreamDns = upstream_dns_file ? t('configured_in', { path: upstream_dns_file }) : upstream_dns;
+
     return <Card
         title={t('upstream_dns')}
         subtitle={t('upstream_dns_hint')}
@@ -30,13 +43,11 @@ const Upstream = () => {
             <div className="col">
                 <Form
                     initialValues={{
-                        upstream_dns,
+                        upstream_dns: upstreamDns,
                         bootstrap_dns,
                         upstream_mode,
                     }}
                     onSubmit={handleSubmit}
-                    processingTestUpstream={processingTestUpstream}
-                    processingSetConfig={processingSetConfig}
                 />
             </div>
         </div>
diff --git a/client/src/helpers/constants.js b/client/src/helpers/constants.js
index e0075a25..7f63d324 100644
--- a/client/src/helpers/constants.js
+++ b/client/src/helpers/constants.js
@@ -52,6 +52,7 @@ export const REPOSITORY = {
 
 export const PRIVACY_POLICY_LINK = 'https://adguard.com/privacy/home.html';
 export const PORT_53_FAQ_LINK = 'https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#bindinuse';
+export const UPSTREAM_CONFIGURATION_WIKI_LINK = 'https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration#upstreams';
 
 export const ADDRESS_IN_USE_TEXT = 'address already in use';
 
diff --git a/client/src/reducers/dnsConfig.js b/client/src/reducers/dnsConfig.js
index 91e95818..bbe4ad2f 100644
--- a/client/src/reducers/dnsConfig.js
+++ b/client/src/reducers/dnsConfig.js
@@ -48,6 +48,7 @@ const dnsConfig = handleActions(
         edns_cs_enabled: false,
         disable_ipv6: false,
         dnssec_enabled: false,
+        upstream_dns_file: '',
     },
 );
 

From 7be0cc72df9b01922e6bc5b3e6e9c6ab57b3fc26 Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Tue, 8 Sep 2020 15:53:25 +0300
Subject: [PATCH 18/34] Don't run home_test with race detection

---
 .githooks/pre-commit | 6 +++++-
 home/home_test.go    | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index d933e462..4fd4e4f5 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -1,6 +1,10 @@
 #!/bin/bash
 set -e;
-git diff --cached --name-only | grep -q '.js$' && make lint-js;
+git diff --cached --name-only | grep -q '.js$' && found=1
+if [ $found == 1 ]; then
+    make lint-js || exit 1
+    npm run test --prefix client || exit 1
+fi
 
 found=0
 git diff --cached --name-only | grep -q '.go$' && found=1
diff --git a/home/home_test.go b/home/home_test.go
index 0868cb71..c78aee52 100644
--- a/home/home_test.go
+++ b/home/home_test.go
@@ -1,3 +1,5 @@
+// +build !race
+
 package home
 
 import (

From 314867734ac60e430143a25060ee6e62e027a9cb Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Tue, 8 Sep 2020 17:20:24 +0300
Subject: [PATCH 19/34] - (dnsforward): fixed running only quic, added a test

QUIC was not initialized if DOT port is not set. Also, there were no
tests on DoQ functionality.
---
 dnsforward/config.go          | 65 ++++++++++++++++++++---------------
 dnsforward/dnsforward_test.go | 36 +++++++++++++++++++
 go.sum                        |  2 ++
 3 files changed, 76 insertions(+), 27 deletions(-)

diff --git a/dnsforward/config.go b/dnsforward/config.go
index 5d06b9dc..4c86a2ff 100644
--- a/dnsforward/config.go
+++ b/dnsforward/config.go
@@ -154,10 +154,6 @@ func (s *Server) createProxyConfig() (proxy.Config, error) {
 		MaxGoroutines:          int(s.conf.MaxGoroutines),
 	}
 
-	if s.conf.QUICListenAddr != nil {
-		proxyConfig.QUICListenAddr = []*net.UDPAddr{s.conf.QUICListenAddr}
-	}
-
 	if s.conf.CacheSize != 0 {
 		proxyConfig.CacheEnabled = true
 		proxyConfig.CacheSizeBytes = int(s.conf.CacheSize)
@@ -240,34 +236,49 @@ func (s *Server) prepareIntlProxy() {
 
 // prepareTLS - prepares TLS configuration for the DNS proxy
 func (s *Server) prepareTLS(proxyConfig *proxy.Config) error {
-	if s.conf.TLSListenAddr != nil && len(s.conf.CertificateChainData) != 0 && len(s.conf.PrivateKeyData) != 0 {
+	if len(s.conf.CertificateChainData) == 0 || len(s.conf.PrivateKeyData) == 0 {
+		return nil
+	}
+
+	if s.conf.TLSListenAddr == nil &&
+		s.conf.QUICListenAddr == nil {
+		return nil
+	}
+
+	if s.conf.TLSListenAddr != nil {
 		proxyConfig.TLSListenAddr = []*net.TCPAddr{s.conf.TLSListenAddr}
-		var err error
-		s.conf.cert, err = tls.X509KeyPair(s.conf.CertificateChainData, s.conf.PrivateKeyData)
+	}
+
+	if s.conf.QUICListenAddr != nil {
+		proxyConfig.QUICListenAddr = []*net.UDPAddr{s.conf.QUICListenAddr}
+	}
+
+	var err error
+	s.conf.cert, err = tls.X509KeyPair(s.conf.CertificateChainData, s.conf.PrivateKeyData)
+	if err != nil {
+		return errorx.Decorate(err, "Failed to parse TLS keypair")
+	}
+
+	if s.conf.StrictSNICheck {
+		x, err := x509.ParseCertificate(s.conf.cert.Certificate[0])
 		if err != nil {
-			return errorx.Decorate(err, "Failed to parse TLS keypair")
+			return errorx.Decorate(err, "x509.ParseCertificate(): %s", err)
 		}
-
-		if s.conf.StrictSNICheck {
-			x, err := x509.ParseCertificate(s.conf.cert.Certificate[0])
-			if err != nil {
-				return errorx.Decorate(err, "x509.ParseCertificate(): %s", err)
-			}
-			if len(x.DNSNames) != 0 {
-				s.conf.dnsNames = x.DNSNames
-				log.Debug("DNS: using DNS names from certificate's SAN: %v", x.DNSNames)
-				sort.Strings(s.conf.dnsNames)
-			} else {
-				s.conf.dnsNames = append(s.conf.dnsNames, x.Subject.CommonName)
-				log.Debug("DNS: using DNS name from certificate's CN: %s", x.Subject.CommonName)
-			}
-		}
-
-		proxyConfig.TLSConfig = &tls.Config{
-			GetCertificate: s.onGetCertificate,
-			MinVersion:     tls.VersionTLS12,
+		if len(x.DNSNames) != 0 {
+			s.conf.dnsNames = x.DNSNames
+			log.Debug("DNS: using DNS names from certificate's SAN: %v", x.DNSNames)
+			sort.Strings(s.conf.dnsNames)
+		} else {
+			s.conf.dnsNames = append(s.conf.dnsNames, x.Subject.CommonName)
+			log.Debug("DNS: using DNS name from certificate's CN: %s", x.Subject.CommonName)
 		}
 	}
+
+	proxyConfig.TLSConfig = &tls.Config{
+		GetCertificate: s.onGetCertificate,
+		MinVersion:     tls.VersionTLS12,
+	}
+
 	upstream.RootCAs = s.conf.TLSv12Roots
 	upstream.CipherSuites = s.conf.TLSCiphers
 	return nil
diff --git a/dnsforward/dnsforward_test.go b/dnsforward/dnsforward_test.go
index a3eb94f1..a183d786 100644
--- a/dnsforward/dnsforward_test.go
+++ b/dnsforward/dnsforward_test.go
@@ -8,6 +8,7 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
+	"fmt"
 	"math/big"
 	"net"
 	"sort"
@@ -128,6 +129,41 @@ func TestDotServer(t *testing.T) {
 	}
 }
 
+func TestDoqServer(t *testing.T) {
+	// Prepare the proxy server
+	_, certPem, keyPem := createServerTLSConfig(t)
+	s := createTestServer(t)
+
+	s.conf.TLSConfig = TLSConfig{
+		QUICListenAddr:       &net.UDPAddr{Port: 0},
+		CertificateChainData: certPem,
+		PrivateKeyData:       keyPem,
+	}
+
+	_ = s.Prepare(nil)
+	// Starting the server
+	err := s.Start()
+	assert.Nil(t, err)
+
+	// Create a DNS-over-QUIC upstream
+	addr := s.dnsProxy.Addr(proxy.ProtoQUIC)
+	opts := upstream.Options{InsecureSkipVerify: true}
+	u, err := upstream.AddressToUpstream(fmt.Sprintf("quic://%s", addr), opts)
+	assert.Nil(t, err)
+
+	// Send the test message
+	req := createGoogleATestMessage()
+	res, err := u.Exchange(req)
+	assert.Nil(t, err)
+	assertGoogleAResponse(t, res)
+
+	// Stop the proxy
+	err = s.Stop()
+	if err != nil {
+		t.Fatalf("DNS server failed to stop: %s", err)
+	}
+}
+
 func TestServerRace(t *testing.T) {
 	s := createTestServer(t)
 	err := s.Start()
diff --git a/go.sum b/go.sum
index d1e535fa..60b7eda0 100644
--- a/go.sum
+++ b/go.sum
@@ -290,6 +290,7 @@ golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e h1:3G+cUijn7XD+S4eJFddp53Pv7+slrESplyjG25HgL+k=
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -382,6 +383,7 @@ gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMy
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

From 7d7609cf7a2c0c3c539649776f0eebd35adb08c7 Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Tue, 8 Sep 2020 17:28:01 +0300
Subject: [PATCH 20/34] * (dnsforward): moved setting upstream.RootCAs

---
 dnsforward/config.go | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/dnsforward/config.go b/dnsforward/config.go
index 4c86a2ff..4cba7f30 100644
--- a/dnsforward/config.go
+++ b/dnsforward/config.go
@@ -9,12 +9,11 @@ import (
 	"net/http"
 	"sort"
 
-	"github.com/AdguardTeam/golibs/log"
-	"github.com/joomcode/errorx"
-
 	"github.com/AdguardTeam/AdGuardHome/dnsfilter"
 	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/dnsproxy/upstream"
+	"github.com/AdguardTeam/golibs/log"
+	"github.com/joomcode/errorx"
 )
 
 // FilteringConfig represents the DNS filtering configuration of AdGuard Home
@@ -216,6 +215,18 @@ func (s *Server) initDefaultSettings() {
 
 // prepareUpstreamSettings - prepares upstream DNS server settings
 func (s *Server) prepareUpstreamSettings() error {
+	// We're setting a customized set of RootCAs
+	// The reason is that Go default mechanism of loading TLS roots
+	// does not always work properly on some routers so we're
+	// loading roots manually and pass it here.
+	// See "util.LoadSystemRootCAs"
+	upstream.RootCAs = s.conf.TLSv12Roots
+
+	// See util.InitTLSCiphers -- removed unsafe ciphers
+	if len(s.conf.TLSCiphers) > 0 {
+		upstream.CipherSuites = s.conf.TLSCiphers
+	}
+
 	upstreamConfig, err := proxy.ParseUpstreamsConfig(s.conf.UpstreamDNS, s.conf.BootstrapDNS, DefaultTimeout)
 	if err != nil {
 		return fmt.Errorf("DNS: proxy.ParseUpstreamsConfig: %s", err)
@@ -279,8 +290,6 @@ func (s *Server) prepareTLS(proxyConfig *proxy.Config) error {
 		MinVersion:     tls.VersionTLS12,
 	}
 
-	upstream.RootCAs = s.conf.TLSv12Roots
-	upstream.CipherSuites = s.conf.TLSCiphers
 	return nil
 }
 

From 317e030554ecaaa9c32e187c4aecca9e87283e40 Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Wed, 9 Sep 2020 13:59:18 +0300
Subject: [PATCH 21/34] * (ui): added refused string

---
 client/src/__locales/en.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index 791bb301..c1aaa839 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -256,6 +256,7 @@
     "blocking_ipv4_desc": "IP address to be returned for a blocked A request",
     "blocking_ipv6_desc": "IP address to be returned for a blocked AAAA request",
     "blocking_mode_default": "Default: Respond with REFUSED when blocked by Adblock-style rule; respond with the IP address specified in the rule when blocked by /etc/hosts-style rule",
+    "blocking_mode_refused": "REFUSED: Respond with REFUSED code",
     "blocking_mode_nxdomain": "NXDOMAIN: Respond with NXDOMAIN code",
     "blocking_mode_null_ip": "Null IP: Respond with zero IP address (0.0.0.0 for A; :: for AAAA)",
     "blocking_mode_custom_ip": "Custom IP: Respond with a manually set IP address",

From 382cddea47452abd02adeab2a1539dcd3c74c1dd Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Wed, 9 Sep 2020 14:03:27 +0300
Subject: [PATCH 22/34] fix pre-commit hook

---
 .githooks/pre-commit            | 4 +++-
 client/src/helpers/constants.js | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index 4fd4e4f5..9889db34 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -1,8 +1,10 @@
 #!/bin/bash
 set -e;
+
+found=0
 git diff --cached --name-only | grep -q '.js$' && found=1
 if [ $found == 1 ]; then
-    make lint-js || exit 1
+    npm --prefix client run lint || exit 1
     npm run test --prefix client || exit 1
 fi
 
diff --git a/client/src/helpers/constants.js b/client/src/helpers/constants.js
index 69450297..cae6f597 100644
--- a/client/src/helpers/constants.js
+++ b/client/src/helpers/constants.js
@@ -293,6 +293,8 @@ export const QUERY_LOG_INTERVALS_DAYS = [1, 7, 30, 90];
 
 export const FILTERS_INTERVALS_HOURS = [0, 1, 12, 24, 72, 168];
 
+// Note that translation strings contain these modes (blocking_mode_CONSTANT)
+// i.e. blocking_mode_default, blocking_mode_null_ip
 export const BLOCKING_MODES = {
     default: 'default',
     refused: 'refused',

From 90e4316cfc152323257f092c7002b29252a2339b Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Wed, 9 Sep 2020 14:50:21 +0300
Subject: [PATCH 23/34] * (ui): fix strings

---
 client/src/__locales/en.json                         | 3 +--
 client/src/components/Settings/Dns/Upstream/Form.js  | 9 +++------
 client/src/components/Settings/Dns/Upstream/index.js | 1 -
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index 2fe1e760..001b7a09 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -132,7 +132,7 @@
     "encryption_settings": "Encryption settings",
     "dhcp_settings": "DHCP settings",
     "upstream_dns": "Upstream DNS servers",
-    "upstream_dns_hint": "If you keep this field empty, AdGuard Home will use <a href='https://www.quad9.net/' target='_blank'>Quad9</a> as an upstream.",
+    "upstream_dns_help": "Enter servers addresses one per line. <0>Learn more</0> about configuring upstream DNS servers.",
     "upstream_dns_configured_in_file": "Configured in {{path}}",
     "test_upstream_btn": "Test upstreams",
     "upstreams": "Upstreams",
@@ -579,6 +579,5 @@
     "click_to_view_queries": "Click to view queries",
     "port_53_faq_link": "Port 53 is often occupied by \"DNSStubListener\" or \"systemd-resolved\" services. Please read <0>this instruction</0> on how to resolve this.",
     "adg_will_drop_dns_queries": "AdGuard Home will be dropping all DNS queries from this client.",
-    "please_read_wiki": "Please read the wiki",
     "experimental": "Experimental"
 }
diff --git a/client/src/components/Settings/Dns/Upstream/Form.js b/client/src/components/Settings/Dns/Upstream/Form.js
index 65a41c9f..0ebb6605 100644
--- a/client/src/components/Settings/Dns/Upstream/Form.js
+++ b/client/src/components/Settings/Dns/Upstream/Form.js
@@ -5,7 +5,6 @@ import { Field, reduxForm } from 'redux-form';
 import { Trans, useTranslation } from 'react-i18next';
 import classnames from 'classnames';
 
-import i18next from 'i18next';
 import Examples from './Examples';
 import { renderRadioField, renderTextareaField } from '../../../../helpers/form';
 import { DNS_REQUEST_OPTIONS, FORM_NAME, UPSTREAM_CONFIGURATION_WIKI_LINK } from '../../../../helpers/constants';
@@ -13,11 +12,9 @@ import { testUpstream } from '../../../../actions';
 import { removeEmptyLines } from '../../../../helpers/helpers';
 
 const Title = () => <label className="form__label" htmlFor="upstream_dns">
-    {i18next.t('upstream_dns')}
-    <div>
-        <a href={UPSTREAM_CONFIGURATION_WIKI_LINK} target="_blank"
-           rel="noopener noreferrer">{i18next.t('please_read_wiki')}</a>
-    </div>
+    <Trans components={[<a href={UPSTREAM_CONFIGURATION_WIKI_LINK} key="0">link</a>]}>
+        upstream_dns_help
+    </Trans>
 </label>;
 
 const getInputFields = (upstream_dns_file) => [
diff --git a/client/src/components/Settings/Dns/Upstream/index.js b/client/src/components/Settings/Dns/Upstream/index.js
index 315a8aea..0342713e 100644
--- a/client/src/components/Settings/Dns/Upstream/index.js
+++ b/client/src/components/Settings/Dns/Upstream/index.js
@@ -36,7 +36,6 @@ const Upstream = () => {
 
     return <Card
         title={t('upstream_dns')}
-        subtitle={t('upstream_dns_hint')}
         bodyType="card-body box-body--settings"
     >
         <div className="row">

From f8010902ce7428210948207c4e59b8f2dc8a540b Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Wed, 9 Sep 2020 17:50:39 +0300
Subject: [PATCH 24/34] * (dnsforward): upgrade dnsproxy to v0.32.1

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 476a496f..e1d1dfb7 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.14
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.32.0
+	github.com/AdguardTeam/dnsproxy v0.32.1
 	github.com/AdguardTeam/golibs v0.4.2
 	github.com/AdguardTeam/urlfilter v0.12.2
 	github.com/NYTimes/gziphandler v1.1.1
diff --git a/go.sum b/go.sum
index 60b7eda0..10b294c7 100644
--- a/go.sum
+++ b/go.sum
@@ -7,8 +7,8 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr
 dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
-github.com/AdguardTeam/dnsproxy v0.32.0 h1:taULDOMubiQSvRLynn8GlfMunhKaVryCBd/OkM++YFU=
-github.com/AdguardTeam/dnsproxy v0.32.0/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
+github.com/AdguardTeam/dnsproxy v0.32.1 h1:UoiFt/aT8YCBFUGe7hG8ehLRXyvoIf22mOQqeIQxhWI=
+github.com/AdguardTeam/dnsproxy v0.32.1/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
 github.com/AdguardTeam/golibs v0.4.0/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
 github.com/AdguardTeam/golibs v0.4.2 h1:7M28oTZFoFwNmp8eGPb3ImmYbxGaJLyQXeIFVHjME0o=
 github.com/AdguardTeam/golibs v0.4.2/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=

From 88c67764b9515902514b0a8e4f00af29a353c584 Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Wed, 9 Sep 2020 18:12:11 +0300
Subject: [PATCH 25/34] * (dnsforward): don't fail when default upstream is not
 set

---
 dnsforward/config.go | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/dnsforward/config.go b/dnsforward/config.go
index c66406ac..5e4fe170 100644
--- a/dnsforward/config.go
+++ b/dnsforward/config.go
@@ -187,7 +187,7 @@ func (s *Server) createProxyConfig() (proxy.Config, error) {
 
 	// Validate proxy config
 	if proxyConfig.UpstreamConfig == nil || len(proxyConfig.UpstreamConfig.Upstreams) == 0 {
-		return proxyConfig, errors.New("no upstream servers configured")
+		return proxyConfig, errors.New("no default upstream servers configured")
 	}
 
 	return proxyConfig, nil
@@ -250,6 +250,16 @@ func (s *Server) prepareUpstreamSettings() error {
 	if err != nil {
 		return fmt.Errorf("DNS: proxy.ParseUpstreamsConfig: %s", err)
 	}
+
+	if len(upstreamConfig.Upstreams) == 0 {
+		log.Info("Warning: no default upstream servers specified, using %v", defaultDNS)
+		uc, err := proxy.ParseUpstreamsConfig(defaultDNS, s.conf.BootstrapDNS, DefaultTimeout)
+		if err != nil {
+			return fmt.Errorf("DNS: failed to parse default upstreams: %v", err)
+		}
+		upstreamConfig.Upstreams = uc.Upstreams
+	}
+
 	s.conf.UpstreamConfig = &upstreamConfig
 	return nil
 }

From 75d680ff30001e846edcbbc6c102fb36ce52bcba Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Thu, 10 Sep 2020 12:32:36 +0300
Subject: [PATCH 26/34] * (dnsforward): added some hosts to disallowed by
 default

---
 dnsforward/config.go     | 3 +++
 dnsforward/dnsforward.go | 3 +++
 go.mod                   | 2 +-
 go.sum                   | 4 ++--
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/dnsforward/config.go b/dnsforward/config.go
index 5e4fe170..8d27d1ff 100644
--- a/dnsforward/config.go
+++ b/dnsforward/config.go
@@ -214,6 +214,9 @@ func (s *Server) initDefaultSettings() {
 	if s.conf.TCPListenAddr == nil {
 		s.conf.TCPListenAddr = defaultValues.TCPListenAddr
 	}
+	if len(s.conf.BlockedHosts) == 0 {
+		s.conf.BlockedHosts = defaultBlockedHosts
+	}
 }
 
 // prepareUpstreamSettings - prepares upstream DNS server settings
diff --git a/dnsforward/dnsforward.go b/dnsforward/dnsforward.go
index 39d09a39..0cb645dd 100644
--- a/dnsforward/dnsforward.go
+++ b/dnsforward/dnsforward.go
@@ -31,6 +31,9 @@ var defaultDNS = []string{
 }
 var defaultBootstrap = []string{"9.9.9.10", "149.112.112.10", "2620:fe::10", "2620:fe::fe:10"}
 
+// Often requested by all kinds of DNS probes
+var defaultBlockedHosts = []string{"version.bind", "id.server", "hostname.bind"}
+
 var webRegistered bool
 
 // Server is the main way to start a DNS server.
diff --git a/go.mod b/go.mod
index e1d1dfb7..4638e6da 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.14
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.32.1
+	github.com/AdguardTeam/dnsproxy v0.32.2
 	github.com/AdguardTeam/golibs v0.4.2
 	github.com/AdguardTeam/urlfilter v0.12.2
 	github.com/NYTimes/gziphandler v1.1.1
diff --git a/go.sum b/go.sum
index 10b294c7..3f4250a7 100644
--- a/go.sum
+++ b/go.sum
@@ -7,8 +7,8 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr
 dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
-github.com/AdguardTeam/dnsproxy v0.32.1 h1:UoiFt/aT8YCBFUGe7hG8ehLRXyvoIf22mOQqeIQxhWI=
-github.com/AdguardTeam/dnsproxy v0.32.1/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
+github.com/AdguardTeam/dnsproxy v0.32.2 h1:gD2VojnQEIzWp3fkT20RS9ehyF0MBGGZQdcX/eKM7fQ=
+github.com/AdguardTeam/dnsproxy v0.32.2/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
 github.com/AdguardTeam/golibs v0.4.0/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
 github.com/AdguardTeam/golibs v0.4.2 h1:7M28oTZFoFwNmp8eGPb3ImmYbxGaJLyQXeIFVHjME0o=
 github.com/AdguardTeam/golibs v0.4.2/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=

From 67e6b7d3e817fedf63a462fa5caf4bad495dd9ed Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Thu, 10 Sep 2020 18:19:09 +0300
Subject: [PATCH 27/34] * (dnsforward): upgrade dnsproxy to v0.32.4

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 4638e6da..8c61faa3 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.14
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.32.2
+	github.com/AdguardTeam/dnsproxy v0.32.4
 	github.com/AdguardTeam/golibs v0.4.2
 	github.com/AdguardTeam/urlfilter v0.12.2
 	github.com/NYTimes/gziphandler v1.1.1
diff --git a/go.sum b/go.sum
index 3f4250a7..3520b5d8 100644
--- a/go.sum
+++ b/go.sum
@@ -7,8 +7,8 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr
 dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
-github.com/AdguardTeam/dnsproxy v0.32.2 h1:gD2VojnQEIzWp3fkT20RS9ehyF0MBGGZQdcX/eKM7fQ=
-github.com/AdguardTeam/dnsproxy v0.32.2/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
+github.com/AdguardTeam/dnsproxy v0.32.4 h1:EsT/5WaKXh3pAAHgt5hKISZNqQwVIbm5e02Z/B0ZVus=
+github.com/AdguardTeam/dnsproxy v0.32.4/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
 github.com/AdguardTeam/golibs v0.4.0/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
 github.com/AdguardTeam/golibs v0.4.2 h1:7M28oTZFoFwNmp8eGPb3ImmYbxGaJLyQXeIFVHjME0o=
 github.com/AdguardTeam/golibs v0.4.2/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=

From caee4b86fa4e4c5742427af34a80c8338b7dcd82 Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Thu, 10 Sep 2020 23:54:15 +0300
Subject: [PATCH 28/34] * (dnsforward): upgrade dnsproxy to v0.32.5

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 8c61faa3..68944567 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.14
 
 require (
-	github.com/AdguardTeam/dnsproxy v0.32.4
+	github.com/AdguardTeam/dnsproxy v0.32.5
 	github.com/AdguardTeam/golibs v0.4.2
 	github.com/AdguardTeam/urlfilter v0.12.2
 	github.com/NYTimes/gziphandler v1.1.1
diff --git a/go.sum b/go.sum
index 3520b5d8..aed6cc4b 100644
--- a/go.sum
+++ b/go.sum
@@ -7,8 +7,8 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr
 dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
-github.com/AdguardTeam/dnsproxy v0.32.4 h1:EsT/5WaKXh3pAAHgt5hKISZNqQwVIbm5e02Z/B0ZVus=
-github.com/AdguardTeam/dnsproxy v0.32.4/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
+github.com/AdguardTeam/dnsproxy v0.32.5 h1:UiExd/uHt2UOL4tYg1+WfXXUlkxmlpnMnQiTs63PekQ=
+github.com/AdguardTeam/dnsproxy v0.32.5/go.mod h1:ZLDrKIypYxBDz2N9FQHgeehuHrwTbuhZXdGwNySshbw=
 github.com/AdguardTeam/golibs v0.4.0/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
 github.com/AdguardTeam/golibs v0.4.2 h1:7M28oTZFoFwNmp8eGPb3ImmYbxGaJLyQXeIFVHjME0o=
 github.com/AdguardTeam/golibs v0.4.2/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=

From cb8afde629f272be79782b8e5bee4908ae97eabc Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Fri, 11 Sep 2020 11:53:36 +0300
Subject: [PATCH 29/34] * (dnsforward): fix reverse lookups from /etc/hosts

There was a bug with empty PTR responses for IPs that are in the hosts
file

Closes: #2085
---
 dnsforward/dnsforward_test.go |  54 ++++++++++++++--
 dnsforward/filter.go          |  29 ++++-----
 util/auto_hosts.go            | 118 ++++++++++++++++++----------------
 util/auto_hosts_test.go       |   4 --
 4 files changed, 125 insertions(+), 80 deletions(-)

diff --git a/dnsforward/dnsforward_test.go b/dnsforward/dnsforward_test.go
index 664a5c1b..2fb89075 100644
--- a/dnsforward/dnsforward_test.go
+++ b/dnsforward/dnsforward_test.go
@@ -9,13 +9,17 @@ import (
 	"crypto/x509/pkix"
 	"encoding/pem"
 	"fmt"
+	"io/ioutil"
 	"math/big"
 	"net"
+	"os"
 	"sort"
 	"sync"
 	"testing"
 	"time"
 
+	"github.com/AdguardTeam/AdGuardHome/util"
+
 	"github.com/AdguardTeam/AdGuardHome/dhcpd"
 	"github.com/AdguardTeam/AdGuardHome/dnsfilter"
 	"github.com/AdguardTeam/dnsproxy/proxy"
@@ -664,17 +668,17 @@ func TestBlockedBySafeBrowsing(t *testing.T) {
 func TestRewrite(t *testing.T) {
 	c := dnsfilter.Config{}
 	c.Rewrites = []dnsfilter.RewriteEntry{
-		dnsfilter.RewriteEntry{
+		{
 			Domain: "test.com",
 			Answer: "1.2.3.4",
 			Type:   dns.TypeA,
 		},
-		dnsfilter.RewriteEntry{
+		{
 			Domain: "alias.test.com",
 			Answer: "test.com",
 			Type:   dns.TypeCNAME,
 		},
-		dnsfilter.RewriteEntry{
+		{
 			Domain: "my.alias.example.org",
 			Answer: "example.org",
 			Type:   dns.TypeCNAME,
@@ -1066,7 +1070,7 @@ func (d *testDHCP) SetOnLeaseChanged(onLeaseChanged dhcpd.OnLeaseChangedT) {
 	return
 }
 
-func TestPTRResponse(t *testing.T) {
+func TestPTRResponseFromDHCPLeases(t *testing.T) {
 	dhcp := &testDHCP{}
 
 	c := dnsfilter.Config{}
@@ -1094,3 +1098,45 @@ func TestPTRResponse(t *testing.T) {
 
 	s.Close()
 }
+
+func TestPTRResponseFromHosts(t *testing.T) {
+	c := dnsfilter.Config{
+		AutoHosts: &util.AutoHosts{},
+	}
+
+	// Prepare test hosts file
+	hf, _ := ioutil.TempFile("", "")
+	defer func() { _ = os.Remove(hf.Name()) }()
+	defer hf.Close()
+
+	_, _ = hf.WriteString("  127.0.0.1   host # comment \n")
+	_, _ = hf.WriteString("  ::1   localhost#comment  \n")
+
+	// Init auto hosts
+	c.AutoHosts.Init(hf.Name())
+	defer c.AutoHosts.Close()
+
+	f := dnsfilter.New(&c, nil)
+	s := NewServer(DNSCreateParams{DNSFilter: f})
+	s.conf.UDPListenAddr = &net.UDPAddr{Port: 0}
+	s.conf.TCPListenAddr = &net.TCPAddr{Port: 0}
+	s.conf.UpstreamDNS = []string{"127.0.0.1:53"}
+	s.conf.FilteringConfig.ProtectionEnabled = true
+	err := s.Prepare(nil)
+	assert.True(t, err == nil)
+	assert.Nil(t, s.Start())
+
+	addr := s.dnsProxy.Addr(proxy.ProtoUDP)
+	req := createTestMessage("1.0.0.127.in-addr.arpa.")
+	req.Question[0].Qtype = dns.TypePTR
+
+	resp, err := dns.Exchange(req, addr.String())
+	assert.Nil(t, err)
+	assert.Equal(t, 1, len(resp.Answer))
+	assert.Equal(t, dns.TypePTR, resp.Answer[0].Header().Rrtype)
+	assert.Equal(t, "1.0.0.127.in-addr.arpa.", resp.Answer[0].Header().Name)
+	ptr := resp.Answer[0].(*dns.PTR)
+	assert.Equal(t, "host.", ptr.Ptr)
+
+	s.Close()
+}
diff --git a/dnsforward/filter.go b/dnsforward/filter.go
index 068c5112..4ef3979d 100644
--- a/dnsforward/filter.go
+++ b/dnsforward/filter.go
@@ -51,7 +51,7 @@ func (s *Server) filterDNSRequest(ctx *dnsContext) (*dnsfilter.Result, error) {
 		return nil, errorx.Decorate(err, "dnsfilter failed to check host '%s'", host)
 
 	} else if res.IsFiltered {
-		// log.Tracef("Host %s is filtered, reason - '%s', matched rule: '%s'", host, res.Reason, res.Rule)
+		log.Tracef("Host %s is filtered, reason - '%s', matched rule: '%s'", host, res.Reason, res.Rule)
 		d.Res = s.genDNSFilterMessage(d, &res)
 
 	} else if res.Reason == dnsfilter.ReasonRewrite && len(res.CanonName) != 0 && len(res.IPList) == 0 {
@@ -59,6 +59,19 @@ func (s *Server) filterDNSRequest(ctx *dnsContext) (*dnsfilter.Result, error) {
 		// resolve canonical name, not the original host name
 		d.Req.Question[0].Name = dns.Fqdn(res.CanonName)
 
+	} else if res.Reason == dnsfilter.RewriteEtcHosts && len(res.ReverseHost) != 0 {
+
+		resp := s.makeResponse(req)
+		ptr := &dns.PTR{}
+		ptr.Hdr = dns.RR_Header{
+			Name:   req.Question[0].Name,
+			Rrtype: dns.TypePTR,
+			Ttl:    s.conf.BlockedResponseTTL,
+			Class:  dns.ClassINET,
+		}
+		ptr.Ptr = res.ReverseHost
+		resp.Answer = append(resp.Answer, ptr)
+		d.Res = resp
 	} else if res.Reason == dnsfilter.ReasonRewrite || res.Reason == dnsfilter.RewriteEtcHosts {
 		resp := s.makeResponse(req)
 
@@ -81,20 +94,6 @@ func (s *Server) filterDNSRequest(ctx *dnsContext) (*dnsfilter.Result, error) {
 		}
 
 		d.Res = resp
-
-	} else if res.Reason == dnsfilter.RewriteEtcHosts && len(res.ReverseHost) != 0 {
-
-		resp := s.makeResponse(req)
-		ptr := &dns.PTR{}
-		ptr.Hdr = dns.RR_Header{
-			Name:   req.Question[0].Name,
-			Rrtype: dns.TypePTR,
-			Ttl:    s.conf.BlockedResponseTTL,
-			Class:  dns.ClassINET,
-		}
-		ptr.Ptr = res.ReverseHost
-		resp.Answer = append(resp.Answer, ptr)
-		d.Res = resp
 	}
 
 	return &res, err
diff --git a/util/auto_hosts.go b/util/auto_hosts.go
index b12acd81..1cec9c1a 100644
--- a/util/auto_hosts.go
+++ b/util/auto_hosts.go
@@ -10,9 +10,10 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/miekg/dns"
+
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/fsnotify/fsnotify"
-	"github.com/miekg/dns"
 )
 
 type onChangedT func()
@@ -62,6 +63,9 @@ func (a *AutoHosts) Init(hostsFn string) {
 		a.hostsDirs = append(a.hostsDirs, "/tmp/hosts") // OpenWRT: "/tmp/hosts/dhcp.cfg01411c"
 	}
 
+	// Load hosts initially
+	a.updateHosts()
+
 	var err error
 	a.watcher, err = fsnotify.NewWatcher()
 	if err != nil {
@@ -102,6 +106,62 @@ func (a *AutoHosts) Close() {
 	}
 }
 
+// Process - get the list of IP addresses for the hostname
+// Return nil if not found
+func (a *AutoHosts) Process(host string, qtype uint16) []net.IP {
+	if qtype == dns.TypePTR {
+		return nil
+	}
+
+	var ipsCopy []net.IP
+	a.lock.Lock()
+	ips, _ := a.table[host]
+	if len(ips) != 0 {
+		ipsCopy = make([]net.IP, len(ips))
+		copy(ipsCopy, ips)
+	}
+	a.lock.Unlock()
+
+	log.Debug("AutoHosts: answer: %s -> %v", host, ipsCopy)
+	return ipsCopy
+}
+
+// ProcessReverse - process PTR request
+// Return "" if not found or an error occurred
+func (a *AutoHosts) ProcessReverse(addr string, qtype uint16) string {
+	if qtype != dns.TypePTR {
+		return ""
+	}
+
+	ipReal := DNSUnreverseAddr(addr)
+	if ipReal == nil {
+		return "" // invalid IP in question
+	}
+	ipStr := ipReal.String()
+
+	a.lock.Lock()
+	host := a.tableReverse[ipStr]
+	a.lock.Unlock()
+
+	if len(host) == 0 {
+		return "" // not found
+	}
+
+	log.Debug("AutoHosts: reverse-lookup: %s -> %s", addr, host)
+	return host
+}
+
+// List - get "IP -> hostname" table.  Thread-safe.
+func (a *AutoHosts) List() map[string]string {
+	table := make(map[string]string)
+	a.lock.Lock()
+	for k, v := range a.tableReverse {
+		table[k] = v
+	}
+	a.lock.Unlock()
+	return table
+}
+
 // update table
 func (a *AutoHosts) updateTable(table map[string][]net.IP, host string, ipAddr net.IP) {
 	ips, ok := table[host]
@@ -275,59 +335,3 @@ func (a *AutoHosts) updateHosts() {
 
 	a.notify()
 }
-
-// Process - get the list of IP addresses for the hostname
-// Return nil if not found
-func (a *AutoHosts) Process(host string, qtype uint16) []net.IP {
-	if qtype == dns.TypePTR {
-		return nil
-	}
-
-	var ipsCopy []net.IP
-	a.lock.Lock()
-	ips, _ := a.table[host]
-	if len(ips) != 0 {
-		ipsCopy = make([]net.IP, len(ips))
-		copy(ipsCopy, ips)
-	}
-	a.lock.Unlock()
-
-	log.Debug("AutoHosts: answer: %s -> %v", host, ipsCopy)
-	return ipsCopy
-}
-
-// ProcessReverse - process PTR request
-// Return "" if not found or an error occurred
-func (a *AutoHosts) ProcessReverse(addr string, qtype uint16) string {
-	if qtype != dns.TypePTR {
-		return ""
-	}
-
-	ipReal := DNSUnreverseAddr(addr)
-	if ipReal == nil {
-		return "" // invalid IP in question
-	}
-	ipStr := ipReal.String()
-
-	a.lock.Lock()
-	host := a.tableReverse[ipStr]
-	a.lock.Unlock()
-
-	if len(host) == 0 {
-		return "" // not found
-	}
-
-	log.Debug("AutoHosts: reverse-lookup: %s -> %s", addr, host)
-	return host
-}
-
-// List - get "IP -> hostname" table.  Thread-safe.
-func (a *AutoHosts) List() map[string]string {
-	table := make(map[string]string)
-	a.lock.Lock()
-	for k, v := range a.tableReverse {
-		table[k] = v
-	}
-	a.lock.Unlock()
-	return table
-}
diff --git a/util/auto_hosts_test.go b/util/auto_hosts_test.go
index ea2e43ad..efd94b99 100644
--- a/util/auto_hosts_test.go
+++ b/util/auto_hosts_test.go
@@ -34,9 +34,6 @@ func TestAutoHostsResolution(t *testing.T) {
 
 	ah.Init(f.Name())
 
-	// Update from the hosts file
-	ah.updateHosts()
-
 	// Existing host
 	ips := ah.Process("localhost", dns.TypeA)
 	assert.NotNil(t, ips)
@@ -79,7 +76,6 @@ func TestAutoHostsFSNotify(t *testing.T) {
 	// Init
 	_, _ = f.WriteString("  127.0.0.1   host  localhost  \n")
 	ah.Init(f.Name())
-	ah.updateHosts()
 
 	// Unknown host
 	ips := ah.Process("newhost", dns.TypeA)

From 8533081da7632cca634e400c5b14b3bf52a55b61 Mon Sep 17 00:00:00 2001
From: ArtemBaskal <a.baskal@adguard.com>
Date: Fri, 11 Sep 2020 12:06:52 +0300
Subject: [PATCH 30/34] - client: Fix dashboard client names display

---
 client/src/components/Dashboard/Dashboard.css | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/client/src/components/Dashboard/Dashboard.css b/client/src/components/Dashboard/Dashboard.css
index 04522ef6..6d3aef7f 100644
--- a/client/src/components/Dashboard/Dashboard.css
+++ b/client/src/components/Dashboard/Dashboard.css
@@ -26,3 +26,10 @@
     left: -20px;
     width: calc(100% + 20px);
 }
+
+@media (max-width: 1279.98px) {
+    .table__action {
+        position: absolute;
+        right: 0;
+    }
+}

From b3a68bb806dd16228398a64e66ef08b891cb3f30 Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Fri, 11 Sep 2020 13:19:37 +0300
Subject: [PATCH 31/34] * (global): added --no-mem-optimization flag

This commit adds a new command-line argument that disables memory
optimizations AGH is using. These memory optimizations might be
necessary on low-memory devices, but they aren't free and there's a
performance hit (see #2044). Now they can be disabled - just pass
--no-mem-optimization when you run AGH or when you install the service
-- ./AdGuardHome -s install --no-mem-optimization

Closes: #2044
---
 home/home.go    |  3 +++
 home/memory.go  | 44 ++++++++++++++++++++++++++++++++++++++++++++
 home/options.go | 14 +++++++++++++-
 main.go         | 31 -------------------------------
 4 files changed, 60 insertions(+), 32 deletions(-)
 create mode 100644 home/memory.go

diff --git a/home/home.go b/home/home.go
index 898fb4bd..3c2dce58 100644
--- a/home/home.go
+++ b/home/home.go
@@ -161,6 +161,9 @@ func run(args options) {
 	// configure log level and output
 	configureLogger(args)
 
+	// Go memory hacks
+	memoryUsage(args)
+
 	// print the first message after logger is configured
 	log.Println(version())
 	log.Debug("Current working directory is %s", Context.workDir)
diff --git a/home/memory.go b/home/memory.go
new file mode 100644
index 00000000..5ca1c12f
--- /dev/null
+++ b/home/memory.go
@@ -0,0 +1,44 @@
+package home
+
+import (
+	"os"
+	"runtime/debug"
+	"time"
+
+	"github.com/AdguardTeam/golibs/log"
+)
+
+// memoryUsage implements a couple of not really beautiful hacks which purpose is to
+// make OS reclaim the memory freed by AdGuard Home as soon as possible.
+// See this for the details on the performance hits & gains:
+// https://github.com/AdguardTeam/AdGuardHome/issues/2044#issuecomment-687042211
+func memoryUsage(args options) {
+	if args.disableMemoryOptimization {
+		log.Info("Memory optimization is disabled")
+		return
+	}
+
+	// Makes Go allocate heap at a slower pace
+	// By default we keep it at 50%
+	debug.SetGCPercent(50)
+
+	// madvdontneed: setting madvdontneed=1 will use MADV_DONTNEED
+	// instead of MADV_FREE on Linux when returning memory to the
+	// kernel. This is less efficient, but causes RSS numbers to drop
+	// more quickly.
+	_ = os.Setenv("GODEBUG", "madvdontneed=1")
+
+	// periodically call "debug.FreeOSMemory" so
+	// that the OS could reclaim the free memory
+	go func() {
+		ticker := time.NewTicker(5 * time.Minute)
+		for {
+			select {
+			case t := <-ticker.C:
+				t.Second()
+				log.Debug("Free OS memory")
+				debug.FreeOSMemory()
+			}
+		}
+	}()
+}
diff --git a/home/options.go b/home/options.go
index 90d356e8..1d8a8a4e 100644
--- a/home/options.go
+++ b/home/options.go
@@ -24,7 +24,11 @@ type options struct {
 	// runningAsService flag is set to true when options are passed from the service runner
 	runningAsService bool
 
-	glinetMode bool // Activate GL-Inet mode
+	// disableMemoryOptimization - disables memory optimization hacks
+	// see memoryUsage() function for the details
+	disableMemoryOptimization bool
+
+	glinetMode bool // Activate GL-Inet compatibility mode
 }
 
 // functions used for their side-effects
@@ -151,6 +155,13 @@ var noCheckUpdateArg = arg{
 	func(o options) []string { return boolSliceOrNil(o.disableUpdate) },
 }
 
+var disableMemoryOptimizationArg = arg{
+	"Disable memory optimization",
+	"no-mem-optimization", "",
+	nil, func(o options) (options, error) { o.disableMemoryOptimization = true; return o, nil }, nil,
+	func(o options) []string { return boolSliceOrNil(o.disableMemoryOptimization) },
+}
+
 var verboseArg = arg{
 	"Enable verbose output",
 	"verbose", "v",
@@ -194,6 +205,7 @@ func init() {
 		pidfileArg,
 		checkConfigArg,
 		noCheckUpdateArg,
+		disableMemoryOptimizationArg,
 		verboseArg,
 		glinetArg,
 		versionArg,
diff --git a/main.go b/main.go
index eebcd5c4..f712d6c0 100644
--- a/main.go
+++ b/main.go
@@ -4,10 +4,6 @@
 package main
 
 import (
-	"os"
-	"runtime/debug"
-	"time"
-
 	"github.com/AdguardTeam/AdGuardHome/home"
 )
 
@@ -21,32 +17,5 @@ var channel = "release"
 var goarm = ""
 
 func main() {
-	memoryUsage()
-
 	home.Main(version, channel, goarm)
 }
-
-// memoryUsage implements a couple of not really beautiful hacks which purpose is to
-// make OS reclaim the memory freed by AdGuard Home as soon as possible.
-func memoryUsage() {
-	debug.SetGCPercent(10)
-
-	// madvdontneed: setting madvdontneed=1 will use MADV_DONTNEED
-	// instead of MADV_FREE on Linux when returning memory to the
-	// kernel. This is less efficient, but causes RSS numbers to drop
-	// more quickly.
-	_ = os.Setenv("GODEBUG", "madvdontneed=1")
-
-	// periodically call "debug.FreeOSMemory" so
-	// that the OS could reclaim the free memory
-	go func() {
-		ticker := time.NewTicker(15 * time.Second)
-		for {
-			select {
-			case t := <-ticker.C:
-				t.Second()
-				debug.FreeOSMemory()
-			}
-		}
-	}()
-}

From 1c88667306e7a52d36a6a1cbf3eca86fd612bd7f Mon Sep 17 00:00:00 2001
From: Andrey Meshkov <am@adguard.com>
Date: Fri, 11 Sep 2020 13:21:37 +0300
Subject: [PATCH 32/34] * (home): added tests for no-mem-optimization flag

---
 home/options_test.go | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/home/options_test.go b/home/options_test.go
index 5a2b1155..afaa873f 100644
--- a/home/options_test.go
+++ b/home/options_test.go
@@ -140,6 +140,15 @@ func TestParseDisableUpdate(t *testing.T) {
 	}
 }
 
+func TestParseDisableMemoryOptimization(t *testing.T) {
+	if testParseOk(t).disableMemoryOptimization {
+		t.Fatal("empty is not disable update")
+	}
+	if !testParseOk(t, "--no-mem-optimization").disableMemoryOptimization {
+		t.Fatal("--no-mem-optimization is disable update")
+	}
+}
+
 func TestParseService(t *testing.T) {
 	if testParseOk(t).serviceControlAction != "" {
 		t.Fatal("empty is no service command")
@@ -226,12 +235,17 @@ func TestSerializeGLInet(t *testing.T) {
 	testSerialize(t, options{glinetMode: true}, "--glinet")
 }
 
+func TestSerializeDisableMemoryOptimization(t *testing.T) {
+	testSerialize(t, options{disableMemoryOptimization: true}, "--no-mem-optimization")
+}
+
 func TestSerializeMultiple(t *testing.T) {
 	testSerialize(t, options{
-		serviceControlAction: "run",
-		configFilename:       "config",
-		workDir:              "work",
-		pidFile:              "pid",
-		disableUpdate:        true,
-	}, "-c", "config", "-w", "work", "-s", "run", "--pidfile", "pid", "--no-check-update")
+		serviceControlAction:      "run",
+		configFilename:            "config",
+		workDir:                   "work",
+		pidFile:                   "pid",
+		disableUpdate:             true,
+		disableMemoryOptimization: true,
+	}, "-c", "config", "-w", "work", "-s", "run", "--pidfile", "pid", "--no-check-update", "--no-mem-optimization")
 }

From 2a5b0b8da1f85727e36a4601c51bdfb79ef2583f Mon Sep 17 00:00:00 2001
From: Artem Baskal <a.baskal@adguard.com>
Date: Mon, 14 Sep 2020 20:16:46 +0300
Subject: [PATCH 33/34] - client: Allow change minimum TTL override in UI

Close #2091 #2094 #2056

Squashed commit of the following:

commit a84384bb409bfe60c4bd6477b2249c4431aa3b63
Merge: cdc5f27f a22db5f3
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Mon Sep 14 19:59:47 2020 +0300

    Merge branch 'master' into fix/2091

commit cdc5f27f279f33c7d988f2927adc172e77e0a6af
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Mon Sep 14 15:41:00 2020 +0300

    Fix uint32 fields validation

commit 0c6fcb90f9741ae8a33bf6c4d53bd954f2033a88
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Mon Sep 14 14:43:20 2020 +0300

    Validate DNS cache configuration DNS values unit32 range

commit 1f90a1fcbc04f6c7ffb75b453e5c67e117d1c5bf
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Mon Sep 14 12:11:39 2020 +0300

    Remove the limit on cache-min-ttl

commit 72e961034cc5752a50a4afc57c7be6a93d652f7d
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Fri Sep 11 16:50:19 2020 +0300

    Fix translation

commit 6aebf4b87bb806ac0729b40418ba6056b3f71afa
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Fri Sep 11 12:53:01 2020 +0300

    - client: Allow change minimum TTL override in UI
---
 client/src/__locales/en.json                  |  7 +-
 .../components/Settings/Dhcp/FormDHCPv4.js    |  8 +--
 .../components/Settings/Dhcp/FormDHCPv6.js    | 13 ++--
 .../src/components/Settings/Dns/Cache/Form.js | 65 +++++++++----------
 .../components/Settings/Dns/Cache/index.js    | 11 ++++
 .../components/Settings/Dns/Config/Form.js    |  7 +-
 client/src/helpers/constants.js               | 13 +++-
 client/src/helpers/validators.js              | 23 -------
 8 files changed, 69 insertions(+), 78 deletions(-)

diff --git a/client/src/__locales/en.json b/client/src/__locales/en.json
index ece13f64..a5e0208b 100644
--- a/client/src/__locales/en.json
+++ b/client/src/__locales/en.json
@@ -253,7 +253,7 @@
     "rate_limit": "Rate limit",
     "edns_enable": "Enable EDNS Client Subnet",
     "edns_cs_desc": "If enabled, AdGuard Home will be sending clients' subnets to the DNS servers.",
-    "rate_limit_desc": "The number of requests per second that a single client is allowed to make (0: unlimited)",
+    "rate_limit_desc": "The number of requests per second that a single client is allowed to make (setting it to 0 means unlimited)",
     "blocking_ipv4_desc": "IP address to be returned for a blocked A request",
     "blocking_ipv6_desc": "IP address to be returned for a blocked AAAA request",
     "blocking_mode_default": "Default: Respond with REFUSED when blocked by Adblock-style rule; respond with the IP address specified in the rule when blocked by /etc/hosts-style rule",
@@ -564,10 +564,9 @@
     "enter_cache_size": "Enter cache size",
     "enter_cache_ttl_min_override": "Enter minimum TTL",
     "enter_cache_ttl_max_override": "Enter maximum TTL",
-    "cache_ttl_min_override_desc": "Override TTL value (minimum) received from upstream server. This value can't larger than 3600 (1 hour)",
+    "cache_ttl_min_override_desc": "Override TTL value (minimum) received from upstream server",
     "cache_ttl_max_override_desc": "Override TTL value (maximum) received from upstream server",
-    "min_exceeds_max_value": "Minimum value exceeds maximum value",
-    "value_not_larger_than": "Value can't be larger than {{maximum}}",
+    "ttl_cache_validation": "Minimum cache TTL value must be less than or equal to the maximum value",
     "filter_category_general": "General",
     "filter_category_security": "Security",
     "filter_category_regional": "Regional",
diff --git a/client/src/components/Settings/Dhcp/FormDHCPv4.js b/client/src/components/Settings/Dhcp/FormDHCPv4.js
index b938b6f0..873e7696 100644
--- a/client/src/components/Settings/Dhcp/FormDHCPv4.js
+++ b/client/src/components/Settings/Dhcp/FormDHCPv4.js
@@ -8,10 +8,9 @@ import {
     renderInputField,
     toNumber,
 } from '../../../helpers/form';
-import { FORM_NAME } from '../../../helpers/constants';
+import { FORM_NAME, UINT32_RANGE } from '../../../helpers/constants';
 import {
     validateIpv4,
-    validateIsPositiveValue,
     validateRequiredValue,
     validateIpv4RangeEnd,
 } from '../../../helpers/validators';
@@ -110,9 +109,10 @@ const FormDHCPv4 = ({
                         type="number"
                         className="form-control"
                         placeholder={t(ipv4placeholders.lease_duration)}
-                        validate={[validateIsPositiveValue, validateRequired]}
+                        validate={validateRequired}
                         normalize={toNumber}
-                        min={0}
+                        min={1}
+                        max={UINT32_RANGE.MAX}
                         disabled={!isInterfaceIncludesIpv4}
                     />
                 </div>
diff --git a/client/src/components/Settings/Dhcp/FormDHCPv6.js b/client/src/components/Settings/Dhcp/FormDHCPv6.js
index 80219fd6..e37a6213 100644
--- a/client/src/components/Settings/Dhcp/FormDHCPv6.js
+++ b/client/src/components/Settings/Dhcp/FormDHCPv6.js
@@ -8,12 +8,8 @@ import {
     renderInputField,
     toNumber,
 } from '../../../helpers/form';
-import { FORM_NAME } from '../../../helpers/constants';
-import {
-    validateIpv6,
-    validateIsPositiveValue,
-    validateRequiredValue,
-} from '../../../helpers/validators';
+import { FORM_NAME, UINT32_RANGE } from '../../../helpers/constants';
+import { validateIpv6, validateRequiredValue } from '../../../helpers/validators';
 
 const FormDHCPv6 = ({
     handleSubmit,
@@ -86,9 +82,10 @@ const FormDHCPv6 = ({
                     type="number"
                     className="form-control"
                     placeholder={t(ipv6placeholders.lease_duration)}
-                    validate={[validateIsPositiveValue, validateRequired]}
+                    validate={validateRequired}
                     normalizeOnBlur={toNumber}
-                    min={0}
+                    min={1}
+                    max={UINT32_RANGE.MAX}
                     disabled={!isInterfaceIncludesIpv6}
                 />
             </div>
diff --git a/client/src/components/Settings/Dns/Cache/Form.js b/client/src/components/Settings/Dns/Cache/Form.js
index c7b2d6ed..f17310c9 100644
--- a/client/src/components/Settings/Dns/Cache/Form.js
+++ b/client/src/components/Settings/Dns/Cache/Form.js
@@ -4,32 +4,30 @@ import { Field, reduxForm } from 'redux-form';
 import { Trans, useTranslation } from 'react-i18next';
 import { shallowEqual, useSelector } from 'react-redux';
 import { renderInputField, toNumber } from '../../../../helpers/form';
-import { validateBiggerOrEqualZeroValue, getMaxValueValidator, validateRequiredValue } from '../../../../helpers/validators';
-import { FORM_NAME, SECONDS_IN_HOUR } from '../../../../helpers/constants';
+import { validateRequiredValue } from '../../../../helpers/validators';
+import { CACHE_CONFIG_FIELDS, FORM_NAME, UINT32_RANGE } from '../../../../helpers/constants';
 
-const validateMaxValue3600 = getMaxValueValidator(SECONDS_IN_HOUR);
-
-const getInputFields = ({ validateRequiredValue, validateMaxValue3600 }) => [{
-    name: 'cache_size',
-    title: 'cache_size',
-    description: 'cache_size_desc',
-    placeholder: 'enter_cache_size',
-    validate: validateRequiredValue,
-},
-{
-    name: 'cache_ttl_min',
-    title: 'cache_ttl_min_override',
-    description: 'cache_ttl_min_override_desc',
-    placeholder: 'enter_cache_ttl_min_override',
-    max: SECONDS_IN_HOUR,
-    validate: validateMaxValue3600,
-},
-{
-    name: 'cache_ttl_max',
-    title: 'cache_ttl_max_override',
-    description: 'cache_ttl_max_override_desc',
-    placeholder: 'enter_cache_ttl_max_override',
-}];
+const getInputFields = (validateRequiredValue) => [
+    {
+        name: CACHE_CONFIG_FIELDS.cache_size,
+        title: 'cache_size',
+        description: 'cache_size_desc',
+        placeholder: 'enter_cache_size',
+        validate: validateRequiredValue,
+    },
+    {
+        name: CACHE_CONFIG_FIELDS.cache_ttl_min,
+        title: 'cache_ttl_min_override',
+        description: 'cache_ttl_min_override_desc',
+        placeholder: 'enter_cache_ttl_min_override',
+    },
+    {
+        name: CACHE_CONFIG_FIELDS.cache_ttl_max,
+        title: 'cache_ttl_max_override',
+        description: 'cache_ttl_max_override_desc',
+        placeholder: 'enter_cache_ttl_max_override',
+    },
+];
 
 const Form = ({
     handleSubmit, submitting, invalid,
@@ -41,17 +39,16 @@ const Form = ({
         cache_ttl_max, cache_ttl_min,
     } = useSelector((state) => state.form[FORM_NAME.CACHE].values, shallowEqual);
 
-    const minExceedsMax = cache_ttl_min > cache_ttl_max;
+    const minExceedsMax = typeof cache_ttl_min === 'number'
+            && typeof cache_ttl_max === 'number'
+            && cache_ttl_min > cache_ttl_max;
 
-    const INPUTS_FIELDS = getInputFields({
-        validateRequiredValue,
-        validateMaxValue3600,
-    });
+    const INPUTS_FIELDS = getInputFields(validateRequiredValue);
 
     return <form onSubmit={handleSubmit}>
         <div className="row">
             {INPUTS_FIELDS.map(({
-                name, title, description, placeholder, validate, max,
+                name, title, description, placeholder, validate, min = 0, max = UINT32_RANGE.MAX,
             }) => <div className="col-12" key={name}>
                 <div className="col-12 col-md-7 p-0">
                     <div className="form__group form__group--settings">
@@ -66,15 +63,15 @@ const Form = ({
                             disabled={processingSetConfig}
                             normalize={toNumber}
                             className="form-control"
-                            validate={[validateBiggerOrEqualZeroValue].concat(validate || [])}
-                            min={0}
+                            validate={validate}
+                            min={min}
                             max={max}
                         />
                     </div>
                 </div>
             </div>)}
             {minExceedsMax
-            && <span className="text-danger pl-3 pb-3">{t('min_exceeds_max_value')}</span>}
+            && <span className="text-danger pl-3 pb-3">{t('ttl_cache_validation')}</span>}
         </div>
         <button
             type="submit"
diff --git a/client/src/components/Settings/Dns/Cache/index.js b/client/src/components/Settings/Dns/Cache/index.js
index 22b8b7b6..391c17e9 100644
--- a/client/src/components/Settings/Dns/Cache/index.js
+++ b/client/src/components/Settings/Dns/Cache/index.js
@@ -1,10 +1,12 @@
 import React from 'react';
 import { useTranslation } from 'react-i18next';
 import { shallowEqual, useDispatch, useSelector } from 'react-redux';
+import { change } from 'redux-form';
 import Card from '../../../ui/Card';
 import Form from './Form';
 import { setDnsConfig } from '../../../../actions/dnsConfig';
 import { selectCompletedFields } from '../../../../helpers/helpers';
+import { CACHE_CONFIG_FIELDS, FORM_NAME } from '../../../../helpers/constants';
 
 const CacheConfig = () => {
     const { t } = useTranslation();
@@ -15,6 +17,15 @@ const CacheConfig = () => {
 
     const handleFormSubmit = (values) => {
         const completedFields = selectCompletedFields(values);
+
+        Object.entries(completedFields).forEach(([k, v]) => {
+            if ((k === CACHE_CONFIG_FIELDS.cache_ttl_min
+                    || k === CACHE_CONFIG_FIELDS.cache_ttl_max)
+                    && v === 0) {
+                dispatch(change(FORM_NAME.CACHE, k, ''));
+            }
+        });
+
         dispatch(setDnsConfig(completedFields));
     };
 
diff --git a/client/src/components/Settings/Dns/Config/Form.js b/client/src/components/Settings/Dns/Config/Form.js
index 0d4a23ee..ecdd2439 100644
--- a/client/src/components/Settings/Dns/Config/Form.js
+++ b/client/src/components/Settings/Dns/Config/Form.js
@@ -10,12 +10,11 @@ import {
     toNumber,
 } from '../../../../helpers/form';
 import {
-    validateBiggerOrEqualZeroValue,
     validateIpv4,
     validateIpv6,
     validateRequiredValue,
 } from '../../../../helpers/validators';
-import { BLOCKING_MODES, FORM_NAME } from '../../../../helpers/constants';
+import { BLOCKING_MODES, FORM_NAME, UINT32_RANGE } from '../../../../helpers/constants';
 
 const checkboxes = [
     {
@@ -87,7 +86,9 @@ const Form = ({
                         className="form-control"
                         placeholder={t('form_enter_rate_limit')}
                         normalize={toNumber}
-                        validate={[validateRequiredValue, validateBiggerOrEqualZeroValue]}
+                        validate={validateRequiredValue}
+                        min={UINT32_RANGE.MIN}
+                        max={UINT32_RANGE.MAX}
                     />
                 </div>
             </div>
diff --git a/client/src/helpers/constants.js b/client/src/helpers/constants.js
index 86ed844d..2ab176ea 100644
--- a/client/src/helpers/constants.js
+++ b/client/src/helpers/constants.js
@@ -506,9 +506,12 @@ export const FORM_NAME = {
 export const SMALL_SCREEN_SIZE = 767;
 export const MEDIUM_SCREEN_SIZE = 1023;
 
-export const SECONDS_IN_HOUR = 60 * 60;
+export const SECONDS_IN_DAY = 60 * 60 * 24;
 
-export const SECONDS_IN_DAY = SECONDS_IN_HOUR * 24;
+export const UINT32_RANGE = {
+    MIN: 0,
+    MAX: 4294967295,
+};
 
 export const DHCP_VALUES_PLACEHOLDERS = {
     ipv4: {
@@ -559,3 +562,9 @@ export const ADDRESS_TYPES = {
     CIDR: 'CIDR',
     UNKNOWN: 'UNKNOWN',
 };
+
+export const CACHE_CONFIG_FIELDS = {
+    cache_size: 'cache_size',
+    cache_ttl_min: 'cache_ttl_min',
+    cache_ttl_max: 'cache_ttl_max',
+};
diff --git a/client/src/helpers/validators.js b/client/src/helpers/validators.js
index 64c5fa49..9b853120 100644
--- a/client/src/helpers/validators.js
+++ b/client/src/helpers/validators.js
@@ -1,4 +1,3 @@
-import i18next from 'i18next';
 import {
     MAX_PORT,
     R_CIDR,
@@ -28,17 +27,6 @@ export const validateRequiredValue = (value) => {
     return 'form_error_required';
 };
 
-/**
- * @param maximum {number}
- * @returns {(value:number) => undefined|string}
- */
-export const getMaxValueValidator = (maximum) => (value) => {
-    if (value && value > maximum) {
-        return i18next.t('value_not_larger_than', { maximum });
-    }
-    return undefined;
-};
-
 /**
  * @param value {string}
  * @returns {undefined|string}
@@ -122,17 +110,6 @@ export const validateMac = (value) => {
     return undefined;
 };
 
-/**
- * @param value {number}
- * @returns {undefined|string}
- */
-export const validateIsPositiveValue = (value) => {
-    if ((value || value === 0) && value <= 0) {
-        return 'form_error_positive';
-    }
-    return undefined;
-};
-
 /**
  * @param value {number}
  * @returns {boolean|*}

From 96512433477a6b32ac4e51e73899f82dc1c2a6e1 Mon Sep 17 00:00:00 2001
From: Artem Baskal <a.baskal@adguard.com>
Date: Tue, 15 Sep 2020 10:30:34 +0300
Subject: [PATCH 34/34] - client: Make dashboard card height constant

Close #2039

Squashed commit of the following:

commit 1d6dd461558403ea0ba813d5f665ecbaab9cd8ed
Merge: 6ca80c91 2a5b0b8d
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Tue Sep 15 10:18:19 2020 +0300

    Merge branch 'master' into fix/2039

commit 6ca80c9171da61a4bc02cec409299d0cfb96da49
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Mon Sep 14 19:58:43 2020 +0300

    Fix mobile media query

commit 239c9ab29aaaef200bd2289fa116507ea5c2bf4c
Author: ArtemBaskal <a.baskal@adguard.com>
Date:   Mon Sep 14 13:59:39 2020 +0300

    - client: Make dashboard card height constant
---
 client/src/components/Dashboard/index.js | 3 +--
 client/src/components/ui/Card.css        | 8 +++++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/client/src/components/Dashboard/index.js b/client/src/components/Dashboard/index.js
index 07d8f94f..4d229ffb 100644
--- a/client/src/components/Dashboard/index.js
+++ b/client/src/components/Dashboard/index.js
@@ -82,7 +82,7 @@ const Dashboard = ({
             </div>
         </PageTitle>
         {statsProcessing && <Loading />}
-        {!statsProcessing && <div className="row row-cards">
+        {!statsProcessing && <div className="row row-cards dashboard">
             <div className="col-lg-12">
                 <Statistics
                         interval={stats.interval}
@@ -100,7 +100,6 @@ const Dashboard = ({
             <div className="col-lg-6">
                 <Counters
                         subtitle={subtitle}
-
                         refreshButton={refreshButton}
                 />
             </div>
diff --git a/client/src/components/ui/Card.css b/client/src/components/ui/Card.css
index 5930d881..eb8a7963 100644
--- a/client/src/components/ui/Card.css
+++ b/client/src/components/ui/Card.css
@@ -19,7 +19,7 @@
     max-height: 17.5rem;
 }
 
-.card-table-overflow--limited.clients__table {
+.dashboard .card-table-overflow--limited {
     max-height: 18rem;
 }
 
@@ -122,6 +122,12 @@
     }
 }
 
+@media (min-width: 992px) {
+    .dashboard .card:not(.card--full) {
+        height: 22rem;
+    }
+}
+
 .card .logs__cell--red {
     background-color: #fff4f2;
 }