access

type Blocker interface {
	// IsBlocked returns true if the req should be blocked.  req must not be
	// nil, and req.Question must have one item.
	IsBlocked(
		ctx context.Context,
		req *dns.Msg,
		rAddr netip.AddrPort,
		l *geoip.Location,
	) (isBlocked bool)
}

type DefaultProfile struct {
	// contains filtered or unexported fields
}

type EmptyBlocker struct{}

type EmptyProfile struct {
	EmptyBlocker
}

type EmptyProfileMetrics struct{}

type EmptyStandard struct{}

type Global struct {
	// contains filtered or unexported fields
}

type Interface interface {
	// IsBlockedHost returns true if host should be blocked.
	IsBlockedHost(host string, qt uint16) (blocked bool)

	// IsBlockedIP returns the status of the IP address blocking as well as the
	// rule that blocked it.
	IsBlockedIP(ip netip.Addr) (blocked bool)
}

type Profile interface {
	// Config returns the profile access configuration.
	Config() (conf *ProfileConfig)

	Blocker
}

type ProfileConfig struct {
	// AllowedNets is slice of CIDRs to be allowed.
	AllowedNets []netip.Prefix

	// BlockedNets is slice of CIDRs to be blocked.
	BlockedNets []netip.Prefix

	// AllowedNets is slice of location ASNs to be allowed.
	AllowedASN []geoip.ASN

	// BlockedASN is slice of location ASNs to be blocked.
	BlockedASN []geoip.ASN

	// BlocklistDomainRules is slice of rules to match requests.
	BlocklistDomainRules []string

	// StandardEnabled controls whether the profile should also apply standard
	// access settings.
	StandardEnabled bool
}

type ProfileConstructor struct {
	// contains filtered or unexported fields
}

type ProfileConstructorConfig struct {
	// Metrics is used for the collection of the statistics of profile access
	// managers.  It must not be nil.
	Metrics ProfileMetrics

	// Standard is the standard blocker for all profiles which have enabled this
	// feature.  It must not be nil.
	Standard Blocker
}

type ProfileMetrics interface {
	// ObserveProfileInit records the duration taken for the initialization of
	// the profile access engine.
	ObserveProfileInit(ctx context.Context, dur time.Duration)
}

type StandardBlocker struct {
	// contains filtered or unexported fields
}

type StandardBlockerConfig struct {
	// AllowedNets are the networks allowed for DNS resolution.  If empty or
	// nil, all networks are allowed, except those blocked by BlockedNets.
	AllowedNets []netip.Prefix

	// BlockedNets are the networks blocked for DNS resolution.  If empty or
	// nil, all networks are allowed, except those allowed by AllowedNets.
	BlockedNets []netip.Prefix

	// AllowedASN are the ASNs allowed for DNS resolution.  If empty or nil, all
	// ASNs are allowed, except those blocked by BlockedASN.
	AllowedASN []geoip.ASN

	// BlockedASN are the ASNs blocked for DNS resolution.  If empty or nil, all
	// ASNs are allowed, except those allowed by AllowedASN.
	BlockedASN []geoip.ASN

	// BlocklistDomainRules are the rules blocking the domains.  If empty or
	// nil, no domains are blocked.
	BlocklistDomainRules []string
}

type StandardSetter interface {
	// SetConfig sets the configuration for the standard access blocker.  conf
	// must not be nil.  Fields of conf must not be modified after calling this
	// method.  It must be safe for concurrent use.
	SetConfig(conf *StandardBlockerConfig)
}