chore(restrictednet): internal/restrictednet package (#3361)

- Go upgraded from 1.25 to 1.26
- `golangci-lint` upgraded from v2.4.0 to v2.11.4
- `mockgen` and `gomock` upgraded from `golang/mock` to `uber-go/mock` v0.6.0

.devcontainer/Dockerfile

@@ -1,3 +1,3 @@
-FROM ghcr.io/qdm12/godevcontainer:v0.21-alpine
+FROM ghcr.io/qdm12/godevcontainer:v0.22-alpine
 RUN apk add wireguard-tools htop openssl tcpdump iptables
 RUN apk add nodejs npm && npm install markdownlint-cli2 --global && apk del npm

.github/workflows/ci.yml

@@ -67,6 +67,10 @@ jobs:
           -v "$(pwd)/coverage.txt:/tmp/gobuild/coverage.txt" \
           test-container
 
+      - name: Run integration tests in test container
+        run: |
+          docker run --rm --entrypoint go test-container test -tags=integration ./internal/restrictednet
+
       - name: Verify dev cross platform compatibility
         run: docker build --target xcompile .
 

AGENTS.md

@@ -50,6 +50,7 @@ Guidance for coding agents working in this repository.
 - Prefer splitting a code line only when it triggers the `lll` linter, do not split a command or arguments list for each element
 - Use `netip` types instead of `net` types whenever possible
 - Use constants instead of variables whenever possible, especially function-local inline constants.
+- Prefer using pure functions over methods when possible. Especially if the method does not need any fields from the receiving struct, it should be a pure function.
 - Do not use `time.Sleep`, prefer using a `time.Timer` with a `select` statement also listening on a context cancelation
 - `panic`:
   - should only be used when a programming error is encountered and you should NOT return errors for programming errors (such as passing nil objects)
@@ -115,6 +116,7 @@ Mocking works with the `go.uber.org/mock` library, and the `mockgen` tool.
   - **Never** use `.AnyTimes()` on mocks. Always define the number of times a certain mock call should be called, with `.Times(3)` for example.
   - **Always** set the `.Return(...)` on the mock if the function returns something.
   - Avoid using **mock helpers** functions, prefer a bit of repetition than tight coupling and dependency
+  - Always define the gomock controller `ctrl` in the subtest and not in the parent test, or a subtest mock failing will crash all the other subtests.
 
 ### main.go
 
@@ -127,6 +129,7 @@ The Go formatter used is gofumpt.
 ### Errors
 
 - Always prefer wrapping errors with some context with `fmt.Errorf("doing this: %w", err)`
+- Use `errors.New("error message")` when creating a 'bottom' constant string error without additional context, instead of `fmt.Errorf`
 - In rare cases, you can just use `return err` notably:
   - If the function is called **recursively**, since we don't wrap the wrapping multiple times for each recursion
   - If the current function only statement is the call to another function, for example:
@@ -179,6 +182,8 @@ The Go formatter used is gofumpt.
 
 - Do not use `http.DefaultClient`, use a custom `*http.Client` with a fixed timeout and share with dependency injections.
 - Do not check for injected dependencies being `nil`, prefer to just panic on a nil pointer. By default it's fine to panic if a developer injects a dependency `nil`. `nil` does not mean use a default.
+- Prefer using a `switch { case ...}` statement over multiple consecutive `if` statements to have shorter code.
+- Prefer using `[...]T` instead of `[]T` when the length is fixed and known at compile time, to avoid unnecessary allocations.
 
 ## Validation checklist
 

Dockerfile

@@ -3,7 +3,7 @@ ARG GO_ALPINE_VERSION=3.23
 ARG GO_VERSION=1.25
 ARG XCPUTRANSLATE_VERSION=v0.9.0
 ARG GOLANGCI_LINT_VERSION=v2.4.0
-ARG MOCKGEN_VERSION=v1.6.0
+ARG MOCKGEN_VERSION=v0.6.0
 ARG BUILDPLATFORM=linux/amd64
 
 FROM --platform=${BUILDPLATFORM} ghcr.io/qdm12/xcputranslate:${XCPUTRANSLATE_VERSION} AS xcputranslate
@@ -218,7 +218,6 @@ ENV VPN_SERVICE_PROVIDER=pia \
     DNS_CACHING=on \
     DNS_UPSTREAM_IPV6=off \
     BLOCK_MALICIOUS=on \
-    BLOCK_SURVEILLANCE=off \
     BLOCK_ADS=off \
     DNS_UNBLOCK_HOSTNAMES= \
     DNS_REBINDING_PROTECTION_EXEMPT_HOSTNAMES= \

README.md

@@ -69,7 +69,7 @@ Lightweight swiss-army-knife-like VPN client to multiple VPN service providers
   - More in progress, see [#134](https://github.com/passteque/gluetun/issues/134)
 - Supports AmneziaWG only with the custom provider for now
 - DNS over TLS baked in with service provider(s) of your choice
-- DNS fine blocking of malicious/ads/surveillance hostnames and IP addresses, with live update every 24 hours
+- DNS fine blocking of malicious/ads hostnames and IP addresses, with live update every 24 hours
 - Choose the vpn network protocol, `udp` or `tcp`
 - Built in firewall kill switch to allow traffic only with needed the VPN servers and LAN devices
 - Built in Shadowsocks proxy server (protocol based on SOCKS5 with an encryption layer, tunnels TCP+UDP)

go.mod

@@ -7,12 +7,12 @@ require (
 	github.com/amnezia-vpn/amneziawg-go v0.2.18
 	github.com/breml/rootcerts v0.3.4
 	github.com/fatih/color v1.18.0
-	github.com/golang/mock v1.6.0
 	github.com/jsimonetti/rtnetlink v1.4.2
 	github.com/klauspost/compress v1.18.4
 	github.com/klauspost/pgzip v1.2.6
 	github.com/mdlayher/genetlink v1.4.0
 	github.com/mdlayher/netlink v1.9.0
+	github.com/miekg/dns v1.1.62
 	github.com/pelletier/go-toml/v2 v2.2.4
 	github.com/qdm12/dns/v2 v2.0.0-rc9.0.20260421173011-9de8e7fdbe3a
 	github.com/qdm12/gluetun-servers v0.1.0
@@ -27,6 +27,7 @@ require (
 	github.com/ti-mo/netfilter v0.5.3
 	github.com/ulikunitz/xz v0.5.15
 	github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a
+	go.uber.org/mock v0.6.0
 	golang.org/x/net v0.55.0
 	golang.org/x/sys v0.45.0
 	golang.org/x/text v0.38.0
@@ -47,7 +48,6 @@ require (
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mdlayher/socket v0.6.0 // indirect
-	github.com/miekg/dns v1.1.62 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect

go.sum

@@ -111,12 +111,12 @@ github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a h1:fZHgsYlfvtyqToslyjUt3VOPF4J7aK/3MPcK7xp3PDk=
 github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a/go.mod h1:ul22v+Nro/R083muKhosV54bj5niojjWZvU8xrevuH4=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
+go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
@@ -124,7 +124,6 @@ golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
 golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c h1:7dEasQXItcW1xKJ2+gg5VOiBnqWrJc+rq0DPKyvvdbY=
 golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c/go.mod h1:NQtJDoLvd6faHhE7m4T/1IY708gDefGGjR/iUW8yQQ8=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
@@ -132,14 +131,12 @@ golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
 golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
@@ -147,8 +144,6 @@ golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -173,14 +168,11 @@ golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
 golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
 golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=

internal/amneziawg/log_mock_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/amneziawg (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=log_mock_test.go -package amneziawg . Logger
+//
 
 // Package amneziawg is a generated GoMock package.
 package amneziawg
@@ -7,13 +12,14 @@ package amneziawg
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,71 +40,71 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Debug mocks base method.
-func (m *MockLogger) Debug(arg0 string) {
+func (m *MockLogger) Debug(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Debug", arg0)
+	m.ctrl.Call(m, "Debug", s)
 }
 
 // Debug indicates an expected call of Debug.
-func (mr *MockLoggerMockRecorder) Debug(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debug(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), s)
 }
 
 // Debugf mocks base method.
-func (m *MockLogger) Debugf(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Debugf(format string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{format}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Debugf", varargs...)
 }
 
 // Debugf indicates an expected call of Debugf.
-func (mr *MockLoggerMockRecorder) Debugf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debugf(format any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debugf", reflect.TypeOf((*MockLogger)(nil).Debugf), varargs...)
 }
 
 // Error mocks base method.
-func (m *MockLogger) Error(arg0 string) {
+func (m *MockLogger) Error(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Error", arg0)
+	m.ctrl.Call(m, "Error", s)
 }
 
 // Error indicates an expected call of Error.
-func (mr *MockLoggerMockRecorder) Error(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Error(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), s)
 }
 
 // Errorf mocks base method.
-func (m *MockLogger) Errorf(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Errorf(format string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{format}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Errorf", varargs...)
 }
 
 // Errorf indicates an expected call of Errorf.
-func (mr *MockLoggerMockRecorder) Errorf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Errorf(format any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Errorf", reflect.TypeOf((*MockLogger)(nil).Errorf), varargs...)
 }
 
 // Info mocks base method.
-func (m *MockLogger) Info(arg0 string) {
+func (m *MockLogger) Info(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Info", arg0)
+	m.ctrl.Call(m, "Info", s)
 }
 
 // Info indicates an expected call of Info.
-func (mr *MockLoggerMockRecorder) Info(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Info(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), s)
 }

internal/amneziawg/netlinker_mock_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/amneziawg (interfaces: NetLinker)
+//
+// Generated by this command:
+//
+//	mockgen -destination=netlinker_mock_test.go -package amneziawg . NetLinker
+//
 
 // Package amneziawg is a generated GoMock package.
 package amneziawg
@@ -8,14 +13,15 @@ import (
 	netip "net/netip"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	netlink "github.com/qdm12/gluetun/internal/netlink"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockNetLinker is a mock of NetLinker interface.
 type MockNetLinker struct {
 	ctrl     *gomock.Controller
 	recorder *MockNetLinkerMockRecorder
+	isgomock struct{}
 }
 
 // MockNetLinkerMockRecorder is the mock recorder for MockNetLinker.
@@ -36,17 +42,17 @@ func (m *MockNetLinker) EXPECT() *MockNetLinkerMockRecorder {
 }
 
 // AddrReplace mocks base method.
-func (m *MockNetLinker) AddrReplace(arg0 uint32, arg1 netip.Prefix) error {
+func (m *MockNetLinker) AddrReplace(linkIndex uint32, addr netip.Prefix) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AddrReplace", arg0, arg1)
+	ret := m.ctrl.Call(m, "AddrReplace", linkIndex, addr)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // AddrReplace indicates an expected call of AddrReplace.
-func (mr *MockNetLinkerMockRecorder) AddrReplace(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) AddrReplace(linkIndex, addr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrReplace", reflect.TypeOf((*MockNetLinker)(nil).AddrReplace), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrReplace", reflect.TypeOf((*MockNetLinker)(nil).AddrReplace), linkIndex, addr)
 }
 
 // IsWireguardSupported mocks base method.
@@ -65,47 +71,47 @@ func (mr *MockNetLinkerMockRecorder) IsWireguardSupported() *gomock.Call {
 }
 
 // LinkAdd mocks base method.
-func (m *MockNetLinker) LinkAdd(arg0 netlink.Link) (uint32, error) {
+func (m *MockNetLinker) LinkAdd(link netlink.Link) (uint32, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkAdd", arg0)
+	ret := m.ctrl.Call(m, "LinkAdd", link)
 	ret0, _ := ret[0].(uint32)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // LinkAdd indicates an expected call of LinkAdd.
-func (mr *MockNetLinkerMockRecorder) LinkAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkAdd(link any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkAdd", reflect.TypeOf((*MockNetLinker)(nil).LinkAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkAdd", reflect.TypeOf((*MockNetLinker)(nil).LinkAdd), link)
 }
 
 // LinkByName mocks base method.
-func (m *MockNetLinker) LinkByName(arg0 string) (netlink.Link, error) {
+func (m *MockNetLinker) LinkByName(name string) (netlink.Link, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkByName", arg0)
+	ret := m.ctrl.Call(m, "LinkByName", name)
 	ret0, _ := ret[0].(netlink.Link)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // LinkByName indicates an expected call of LinkByName.
-func (mr *MockNetLinkerMockRecorder) LinkByName(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkByName(name any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByName", reflect.TypeOf((*MockNetLinker)(nil).LinkByName), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByName", reflect.TypeOf((*MockNetLinker)(nil).LinkByName), name)
 }
 
 // LinkDel mocks base method.
-func (m *MockNetLinker) LinkDel(arg0 uint32) error {
+func (m *MockNetLinker) LinkDel(linkIndex uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkDel", arg0)
+	ret := m.ctrl.Call(m, "LinkDel", linkIndex)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkDel indicates an expected call of LinkDel.
-func (mr *MockNetLinkerMockRecorder) LinkDel(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkDel(linkIndex any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkDel", reflect.TypeOf((*MockNetLinker)(nil).LinkDel), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkDel", reflect.TypeOf((*MockNetLinker)(nil).LinkDel), linkIndex)
 }
 
 // LinkList mocks base method.
@@ -124,86 +130,86 @@ func (mr *MockNetLinkerMockRecorder) LinkList() *gomock.Call {
 }
 
 // LinkSetDown mocks base method.
-func (m *MockNetLinker) LinkSetDown(arg0 uint32) error {
+func (m *MockNetLinker) LinkSetDown(linkIndex uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkSetDown", arg0)
+	ret := m.ctrl.Call(m, "LinkSetDown", linkIndex)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkSetDown indicates an expected call of LinkSetDown.
-func (mr *MockNetLinkerMockRecorder) LinkSetDown(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkSetDown(linkIndex any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetDown", reflect.TypeOf((*MockNetLinker)(nil).LinkSetDown), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetDown", reflect.TypeOf((*MockNetLinker)(nil).LinkSetDown), linkIndex)
 }
 
 // LinkSetUp mocks base method.
-func (m *MockNetLinker) LinkSetUp(arg0 uint32) error {
+func (m *MockNetLinker) LinkSetUp(linkIndex uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkSetUp", arg0)
+	ret := m.ctrl.Call(m, "LinkSetUp", linkIndex)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkSetUp indicates an expected call of LinkSetUp.
-func (mr *MockNetLinkerMockRecorder) LinkSetUp(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkSetUp(linkIndex any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetUp", reflect.TypeOf((*MockNetLinker)(nil).LinkSetUp), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetUp", reflect.TypeOf((*MockNetLinker)(nil).LinkSetUp), linkIndex)
 }
 
 // RouteAdd mocks base method.
-func (m *MockNetLinker) RouteAdd(arg0 netlink.Route) error {
+func (m *MockNetLinker) RouteAdd(route netlink.Route) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteAdd", arg0)
+	ret := m.ctrl.Call(m, "RouteAdd", route)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RouteAdd indicates an expected call of RouteAdd.
-func (mr *MockNetLinkerMockRecorder) RouteAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteAdd(route any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteAdd", reflect.TypeOf((*MockNetLinker)(nil).RouteAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteAdd", reflect.TypeOf((*MockNetLinker)(nil).RouteAdd), route)
 }
 
 // RouteList mocks base method.
-func (m *MockNetLinker) RouteList(arg0 byte) ([]netlink.Route, error) {
+func (m *MockNetLinker) RouteList(family uint8) ([]netlink.Route, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteList", arg0)
+	ret := m.ctrl.Call(m, "RouteList", family)
 	ret0, _ := ret[0].([]netlink.Route)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RouteList indicates an expected call of RouteList.
-func (mr *MockNetLinkerMockRecorder) RouteList(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteList(family any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteList", reflect.TypeOf((*MockNetLinker)(nil).RouteList), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteList", reflect.TypeOf((*MockNetLinker)(nil).RouteList), family)
 }
 
 // RuleAdd mocks base method.
-func (m *MockNetLinker) RuleAdd(arg0 netlink.Rule) error {
+func (m *MockNetLinker) RuleAdd(rule netlink.Rule) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuleAdd", arg0)
+	ret := m.ctrl.Call(m, "RuleAdd", rule)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RuleAdd indicates an expected call of RuleAdd.
-func (mr *MockNetLinkerMockRecorder) RuleAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RuleAdd(rule any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleAdd", reflect.TypeOf((*MockNetLinker)(nil).RuleAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleAdd", reflect.TypeOf((*MockNetLinker)(nil).RuleAdd), rule)
 }
 
 // RuleDel mocks base method.
-func (m *MockNetLinker) RuleDel(arg0 netlink.Rule) error {
+func (m *MockNetLinker) RuleDel(rule netlink.Rule) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuleDel", arg0)
+	ret := m.ctrl.Call(m, "RuleDel", rule)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RuleDel indicates an expected call of RuleDel.
-func (mr *MockNetLinkerMockRecorder) RuleDel(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RuleDel(rule any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleDel", reflect.TypeOf((*MockNetLinker)(nil).RuleDel), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleDel", reflect.TypeOf((*MockNetLinker)(nil).RuleDel), rule)
 }

internal/cleanup/cleanup_test.go

@@ -4,8 +4,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_Cleanups(t *testing.T) {

internal/cleanup/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/cleanup (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=cleanup . Logger
+//
 
 // Package cleanup is a generated GoMock package.
 package cleanup
@@ -7,13 +12,14 @@ package cleanup
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -40,7 +46,7 @@ func (m *MockLogger) Debug(arg0 string) {
 }
 
 // Debug indicates an expected call of Debug.
-func (mr *MockLoggerMockRecorder) Debug(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debug(arg0 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), arg0)
 }
@@ -52,7 +58,7 @@ func (m *MockLogger) Error(arg0 string) {
 }
 
 // Error indicates an expected call of Error.
-func (mr *MockLoggerMockRecorder) Error(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Error(arg0 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), arg0)
 }

internal/command/mocks_local_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: interfaces_local.go
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_local_test.go -package=command -source=interfaces_local.go
+//
 
 // Package command is a generated GoMock package.
 package command
@@ -8,13 +13,14 @@ import (
 	io "io"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockexecCmd is a mock of execCmd interface.
 type MockexecCmd struct {
 	ctrl     *gomock.Controller
 	recorder *MockexecCmdMockRecorder
+	isgomock struct{}
 }
 
 // MockexecCmdMockRecorder is the mock recorder for MockexecCmd.

internal/command/run_test.go

@@ -4,9 +4,9 @@ import (
 	"errors"
 	"testing"
 
-	gomock "github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	gomock "go.uber.org/mock/gomock"
 )
 
 func Test_run(t *testing.T) {

internal/command/start_test.go

@@ -7,9 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	gomock "github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	gomock "go.uber.org/mock/gomock"
 )
 
 func linesToReadCloser(lines []string) io.ReadCloser {

internal/configuration/settings/deprecated.go

@@ -16,6 +16,7 @@ func readObsolete(r *reader.Reader) (warnings []string) {
 		"HEALTH_VPN_DURATION_ADDITION": "HEALTH_VPN_DURATION_ADDITION is obsolete",
 		"DNS_KEEP_NAMESERVER": "DNS_KEEP_NAMESERVER is obsolete because you should use the built-in server which now " +
 			"forwards local names to private DNS resolvers found in /etc/resolv.conf at container start",
+		"BLOCK_SURVEILLANCE": "BLOCK_SURVEILLANCE is obsolete because its DNS block lists are not longer maintained",
 	}
 	sortedKeys := slices.Collect(maps.Keys(keyToMessage))
 	slices.Sort(sortedKeys)

internal/configuration/settings/dnsblacklist.go

@@ -16,7 +16,6 @@ import (
 type DNSBlacklist struct {
 	BlockMalicious       *bool
 	BlockAds             *bool
-	BlockSurveillance    *bool
 	AllowedHosts         []string
 	AddBlockedHosts      []string
 	AddBlockedIPs        []netip.Addr
@@ -31,7 +30,6 @@ type DNSBlacklist struct {
 func (b *DNSBlacklist) setDefaults() {
 	b.BlockMalicious = gosettings.DefaultPointer(b.BlockMalicious, true)
 	b.BlockAds = gosettings.DefaultPointer(b.BlockAds, false)
-	b.BlockSurveillance = gosettings.DefaultPointer(b.BlockSurveillance, true)
 }
 
 var hostRegex = regexp.MustCompile(`^([a-zA-Z0-9]|[a-zA-Z0-9_][a-zA-Z0-9\-_]{0,61}[a-zA-Z0-9_])(\.([a-zA-Z0-9]|[a-zA-Z0-9_][a-zA-Z0-9\-_]{0,61}[a-zA-Z0-9]))*$`) //nolint:lll
@@ -65,7 +63,6 @@ func (b DNSBlacklist) copy() (copied DNSBlacklist) {
 	return DNSBlacklist{
 		BlockMalicious:                     gosettings.CopyPointer(b.BlockMalicious),
 		BlockAds:                           gosettings.CopyPointer(b.BlockAds),
-		BlockSurveillance:                  gosettings.CopyPointer(b.BlockSurveillance),
 		AllowedHosts:                       gosettings.CopySlice(b.AllowedHosts),
 		AddBlockedHosts:                    gosettings.CopySlice(b.AddBlockedHosts),
 		AddBlockedIPs:                      gosettings.CopySlice(b.AddBlockedIPs),
@@ -77,7 +74,6 @@ func (b DNSBlacklist) copy() (copied DNSBlacklist) {
 func (b *DNSBlacklist) overrideWith(other DNSBlacklist) {
 	b.BlockMalicious = gosettings.OverrideWithPointer(b.BlockMalicious, other.BlockMalicious)
 	b.BlockAds = gosettings.OverrideWithPointer(b.BlockAds, other.BlockAds)
-	b.BlockSurveillance = gosettings.OverrideWithPointer(b.BlockSurveillance, other.BlockSurveillance)
 	b.AllowedHosts = gosettings.OverrideWithSlice(b.AllowedHosts, other.AllowedHosts)
 	b.AddBlockedHosts = gosettings.OverrideWithSlice(b.AddBlockedHosts, other.AddBlockedHosts)
 	b.AddBlockedIPs = gosettings.OverrideWithSlice(b.AddBlockedIPs, other.AddBlockedIPs)
@@ -93,7 +89,6 @@ func (b DNSBlacklist) ToBlockBuilderSettings(client *http.Client) (
 		Client:               client,
 		BlockMalicious:       b.BlockMalicious,
 		BlockAds:             b.BlockAds,
-		BlockSurveillance:    b.BlockSurveillance,
 		AllowedHosts:         b.AllowedHosts,
 		AddBlockedHosts:      b.AddBlockedHosts,
 		AddBlockedIPs:        b.AddBlockedIPs,
@@ -110,7 +105,6 @@ func (b DNSBlacklist) toLinesNode() (node *gotree.Node) {
 
 	node.Appendf("Block malicious: %s", gosettings.BoolToYesNo(b.BlockMalicious))
 	node.Appendf("Block ads: %s", gosettings.BoolToYesNo(b.BlockAds))
-	node.Appendf("Block surveillance: %s", gosettings.BoolToYesNo(b.BlockSurveillance))
 
 	if len(b.AllowedHosts) > 0 {
 		allowedHostsNode := node.Append("Allowed hosts:")
@@ -156,12 +150,6 @@ func (b *DNSBlacklist) read(r *reader.Reader) (err error) {
 		return err
 	}
 
-	b.BlockSurveillance, err = r.BoolPtr("BLOCK_SURVEILLANCE",
-		reader.RetroKeys("BLOCK_NSA"))
-	if err != nil {
-		return err
-	}
-
 	b.BlockAds, err = r.BoolPtr("BLOCK_ADS")
 	if err != nil {
 		return err

internal/configuration/settings/helpers_test.go

@@ -1,6 +1,6 @@
 package settings
 
-import gomock "github.com/golang/mock/gomock"
+import gomock "go.uber.org/mock/gomock"
 
 type sourceKeyValue struct {
 	key   string

internal/configuration/settings/mocks_reader_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gosettings/reader (interfaces: Source)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_reader_test.go -package=settings github.com/qdm12/gosettings/reader Source
+//
 
 // Package settings is a generated GoMock package.
 package settings
@@ -7,13 +12,14 @@ package settings
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockSource is a mock of Source interface.
 type MockSource struct {
 	ctrl     *gomock.Controller
 	recorder *MockSourceMockRecorder
+	isgomock struct{}
 }
 
 // MockSourceMockRecorder is the mock recorder for MockSource.
@@ -34,32 +40,32 @@ func (m *MockSource) EXPECT() *MockSourceMockRecorder {
 }
 
 // Get mocks base method.
-func (m *MockSource) Get(arg0 string) (string, bool) {
+func (m *MockSource) Get(key string) (string, bool) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Get", arg0)
+	ret := m.ctrl.Call(m, "Get", key)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(bool)
 	return ret0, ret1
 }
 
 // Get indicates an expected call of Get.
-func (mr *MockSourceMockRecorder) Get(arg0 interface{}) *gomock.Call {
+func (mr *MockSourceMockRecorder) Get(key any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get", reflect.TypeOf((*MockSource)(nil).Get), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Get", reflect.TypeOf((*MockSource)(nil).Get), key)
 }
 
 // KeyTransform mocks base method.
-func (m *MockSource) KeyTransform(arg0 string) string {
+func (m *MockSource) KeyTransform(key string) string {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "KeyTransform", arg0)
+	ret := m.ctrl.Call(m, "KeyTransform", key)
 	ret0, _ := ret[0].(string)
 	return ret0
 }
 
 // KeyTransform indicates an expected call of KeyTransform.
-func (mr *MockSourceMockRecorder) KeyTransform(arg0 interface{}) *gomock.Call {
+func (mr *MockSourceMockRecorder) KeyTransform(key any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "KeyTransform", reflect.TypeOf((*MockSource)(nil).KeyTransform), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "KeyTransform", reflect.TypeOf((*MockSource)(nil).KeyTransform), key)
 }
 
 // String mocks base method.

internal/configuration/settings/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/configuration/settings (interfaces: Warner)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=settings . Warner
+//
 
 // Package settings is a generated GoMock package.
 package settings
@@ -7,13 +12,14 @@ package settings
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockWarner is a mock of Warner interface.
 type MockWarner struct {
 	ctrl     *gomock.Controller
 	recorder *MockWarnerMockRecorder
+	isgomock struct{}
 }
 
 // MockWarnerMockRecorder is the mock recorder for MockWarner.
@@ -34,13 +40,13 @@ func (m *MockWarner) EXPECT() *MockWarnerMockRecorder {
 }
 
 // Warn mocks base method.
-func (m *MockWarner) Warn(arg0 string) {
+func (m *MockWarner) Warn(message string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Warn", arg0)
+	m.ctrl.Call(m, "Warn", message)
 }
 
 // Warn indicates an expected call of Warn.
-func (mr *MockWarnerMockRecorder) Warn(arg0 interface{}) *gomock.Call {
+func (mr *MockWarnerMockRecorder) Warn(message any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockWarner)(nil).Warn), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockWarner)(nil).Warn), message)
 }

internal/configuration/settings/publicip_test.go

@@ -3,9 +3,9 @@ package settings
 import (
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gosettings/reader"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_PublicIP_read(t *testing.T) {

internal/configuration/settings/settings_test.go

@@ -59,8 +59,7 @@ func Test_Settings_String(t *testing.T) {
 |   ├── Update period: every 24h0m0s
 |   └── DNS filtering settings:
 |       ├── Block malicious: yes
-|       ├── Block ads: no
-|       └── Block surveillance: yes
+|       └── Block ads: no
 ├── Firewall settings:
 |   ├── Enabled: yes
 |   └── Iptables settings:

internal/firewall/interfaces.go

@@ -28,6 +28,8 @@ type firewallImpl interface { //nolint:interfacebloat
 	AcceptIpv6MulticastOutput(ctx context.Context, intf string) error
 	AcceptOutput(ctx context.Context, protocol, intf string,
 		ip netip.Addr, port uint16, remove bool) error
+	AcceptOutputFromIPPortToIPPort(ctx context.Context, protocol, intf string,
+		source, destination netip.AddrPort, remove bool) error
 	AcceptOutputFromIPToSubnet(ctx context.Context, intf string, assignedIP netip.Addr,
 		subnet netip.Prefix, remove bool) error
 	AcceptOutputThroughInterface(ctx context.Context, intf string, remove bool) error

internal/firewall/iptables/cmd_matcher_test.go

@@ -5,7 +5,7 @@ import (
 	"os/exec"
 	"regexp"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 )
 
 var _ gomock.Matcher = (*cmdMatcher)(nil)

internal/firewall/iptables/delete_test.go

@@ -5,8 +5,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_isDeleteMatchInstruction(t *testing.T) {

internal/firewall/iptables/iptables.go

@@ -2,6 +2,7 @@ package iptables
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/netip"
@@ -177,6 +178,29 @@ func (c *Config) AcceptOutput(ctx context.Context,
 	return c.runIP6tablesInstruction(ctx, instruction)
 }
 
+func (c *Config) AcceptOutputFromIPPortToIPPort(ctx context.Context,
+	protocol, intf string, source, destination netip.AddrPort, remove bool,
+) error {
+	if source.Addr().BitLen() != destination.Addr().BitLen() {
+		return errors.New("source and destination address families do not match")
+	}
+
+	interfaceFlag := "-o " + intf
+	if intf == "*" { // all interfaces
+		interfaceFlag = ""
+	}
+
+	instruction := fmt.Sprintf("%s OUTPUT %s -s %s -d %s -p %s -m %s --sport %d --dport %d -j ACCEPT",
+		appendOrDelete(remove), interfaceFlag, source.Addr(), destination.Addr(),
+		protocol, protocol, source.Port(), destination.Port())
+	if destination.Addr().Is4() {
+		return c.runIptablesInstruction(ctx, instruction)
+	} else if c.ip6Tables == "" {
+		return fmt.Errorf("accept output from %s to %s: %s", source, destination, needIP6Tables)
+	}
+	return c.runIP6tablesInstruction(ctx, instruction)
+}
+
 // AcceptOutputFromIPToSubnet accepts outgoing traffic from sourceIP to destinationSubnet
 // on the interface intf. If intf is empty, it is set to "*" which means all interfaces.
 // If remove is true, the rule is removed instead of added.

internal/firewall/iptables/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/firewall/iptables (interfaces: CmdRunner,Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package iptables . CmdRunner,Logger
+//
 
 // Package iptables is a generated GoMock package.
 package iptables
@@ -8,13 +13,14 @@ import (
 	exec "os/exec"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockCmdRunner is a mock of CmdRunner interface.
 type MockCmdRunner struct {
 	ctrl     *gomock.Controller
 	recorder *MockCmdRunnerMockRecorder
+	isgomock struct{}
 }
 
 // MockCmdRunnerMockRecorder is the mock recorder for MockCmdRunner.
@@ -35,24 +41,25 @@ func (m *MockCmdRunner) EXPECT() *MockCmdRunnerMockRecorder {
 }
 
 // Run mocks base method.
-func (m *MockCmdRunner) Run(arg0 *exec.Cmd) (string, error) {
+func (m *MockCmdRunner) Run(cmd *exec.Cmd) (string, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Run", arg0)
+	ret := m.ctrl.Call(m, "Run", cmd)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // Run indicates an expected call of Run.
-func (mr *MockCmdRunnerMockRecorder) Run(arg0 interface{}) *gomock.Call {
+func (mr *MockCmdRunnerMockRecorder) Run(cmd any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Run", reflect.TypeOf((*MockCmdRunner)(nil).Run), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Run", reflect.TypeOf((*MockCmdRunner)(nil).Run), cmd)
 }
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -73,25 +80,25 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Debug mocks base method.
-func (m *MockLogger) Debug(arg0 string) {
+func (m *MockLogger) Debug(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Debug", arg0)
+	m.ctrl.Call(m, "Debug", s)
 }
 
 // Debug indicates an expected call of Debug.
-func (mr *MockLoggerMockRecorder) Debug(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debug(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), s)
 }
 
 // Warn mocks base method.
-func (m *MockLogger) Warn(arg0 string) {
+func (m *MockLogger) Warn(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Warn", arg0)
+	m.ctrl.Call(m, "Warn", s)
 }
 
 // Warn indicates an expected call of Warn.
-func (mr *MockLoggerMockRecorder) Warn(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Warn(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), s)
 }

internal/firewall/iptables/support_test.go

@@ -5,8 +5,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func newAppendTestRuleMatcher(path string) *cmdMatcher {

internal/firewall/wrappers.go

@@ -25,3 +25,10 @@ func (c *Config) AcceptOutput(ctx context.Context, protocol, intf string,
 ) error {
 	return c.impl.AcceptOutput(ctx, protocol, intf, ip, port, remove)
 }
+
+func (c *Config) AcceptOutputFromIPPortToIPPort(ctx context.Context,
+	protocol, intf string, source, destination netip.AddrPort, remove bool,
+) error {
+	return c.impl.AcceptOutputFromIPPortToIPPort(ctx, protocol, intf,
+		source, destination, remove)
+}

internal/httpserver/helpers_test.go

@@ -3,7 +3,7 @@ package httpserver
 import (
 	"regexp"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 var _ Logger = (*testLogger)(nil)

internal/httpserver/logger_mock_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/httpserver (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=logger_mock_test.go -package httpserver . Logger
+//
 
 // Package httpserver is a generated GoMock package.
 package httpserver
@@ -7,13 +12,14 @@ package httpserver
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,37 +40,37 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Error mocks base method.
-func (m *MockLogger) Error(arg0 string) {
+func (m *MockLogger) Error(msg string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Error", arg0)
+	m.ctrl.Call(m, "Error", msg)
 }
 
 // Error indicates an expected call of Error.
-func (mr *MockLoggerMockRecorder) Error(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Error(msg any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), msg)
 }
 
 // Info mocks base method.
-func (m *MockLogger) Info(arg0 string) {
+func (m *MockLogger) Info(msg string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Info", arg0)
+	m.ctrl.Call(m, "Info", msg)
 }
 
 // Info indicates an expected call of Info.
-func (mr *MockLoggerMockRecorder) Info(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Info(msg any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), msg)
 }
 
 // Warn mocks base method.
-func (m *MockLogger) Warn(arg0 string) {
+func (m *MockLogger) Warn(msg string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Warn", arg0)
+	m.ctrl.Call(m, "Warn", msg)
 }
 
 // Warn indicates an expected call of Warn.
-func (mr *MockLoggerMockRecorder) Warn(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Warn(msg any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), msg)
 }

internal/httpserver/run_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	gomock "github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
+	gomock "go.uber.org/mock/gomock"
 )
 
 func Test_Server_Run_success(t *testing.T) {

internal/netlink/ipv6_test.go

@@ -9,9 +9,9 @@ import (
 	"testing"
 	"time"
 
-	gomock "github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	gomock "go.uber.org/mock/gomock"
 )
 
 func isIPv6LocallySupported() bool {

internal/netlink/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/netlink (interfaces: Firewall)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=netlink . Firewall
+//
 
 // Package netlink is a generated GoMock package.
 package netlink
@@ -9,13 +14,14 @@ import (
 	netip "net/netip"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockFirewall is a mock of Firewall interface.
 type MockFirewall struct {
 	ctrl     *gomock.Controller
 	recorder *MockFirewallMockRecorder
+	isgomock struct{}
 }
 
 // MockFirewallMockRecorder is the mock recorder for MockFirewall.
@@ -36,15 +42,15 @@ func (m *MockFirewall) EXPECT() *MockFirewallMockRecorder {
 }
 
 // AcceptOutput mocks base method.
-func (m *MockFirewall) AcceptOutput(arg0 context.Context, arg1, arg2 string, arg3 netip.Addr, arg4 uint16, arg5 bool) error {
+func (m *MockFirewall) AcceptOutput(ctx context.Context, protocol, intf string, ip netip.Addr, port uint16, remove bool) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AcceptOutput", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "AcceptOutput", ctx, protocol, intf, ip, port, remove)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // AcceptOutput indicates an expected call of AcceptOutput.
-func (mr *MockFirewallMockRecorder) AcceptOutput(arg0, arg1, arg2, arg3, arg4, arg5 interface{}) *gomock.Call {
+func (mr *MockFirewallMockRecorder) AcceptOutput(ctx, protocol, intf, ip, port, remove any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptOutput", reflect.TypeOf((*MockFirewall)(nil).AcceptOutput), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptOutput", reflect.TypeOf((*MockFirewall)(nil).AcceptOutput), ctx, protocol, intf, ip, port, remove)
 }

internal/pmtud/tcp/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/pmtud/tcp (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=tcp . Logger
+//
 
 // Package tcp is a generated GoMock package.
 package tcp
@@ -7,13 +12,14 @@ package tcp
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,47 +40,47 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Debug mocks base method.
-func (m *MockLogger) Debug(arg0 string) {
+func (m *MockLogger) Debug(msg string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Debug", arg0)
+	m.ctrl.Call(m, "Debug", msg)
 }
 
 // Debug indicates an expected call of Debug.
-func (mr *MockLoggerMockRecorder) Debug(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debug(msg any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), msg)
 }
 
 // Debugf mocks base method.
-func (m *MockLogger) Debugf(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Debugf(msg string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{msg}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Debugf", varargs...)
 }
 
 // Debugf indicates an expected call of Debugf.
-func (mr *MockLoggerMockRecorder) Debugf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debugf(msg any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{msg}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debugf", reflect.TypeOf((*MockLogger)(nil).Debugf), varargs...)
 }
 
 // Warnf mocks base method.
-func (m *MockLogger) Warnf(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Warnf(msg string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{msg}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Warnf", varargs...)
 }
 
 // Warnf indicates an expected call of Warnf.
-func (mr *MockLoggerMockRecorder) Warnf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Warnf(msg any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{msg}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warnf", reflect.TypeOf((*MockLogger)(nil).Warnf), varargs...)
 }

internal/pmtud/tcp/tcp_test.go

@@ -8,11 +8,11 @@ import (
 	"testing"
 	"time"
 
-	gomock "github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/netlink"
 	"github.com/qdm12/gluetun/internal/pmtud/constants"
 	"github.com/qdm12/gluetun/internal/pmtud/ip"
 	"github.com/stretchr/testify/require"
+	gomock "go.uber.org/mock/gomock"
 )
 
 func Test_runTest(t *testing.T) {

internal/portforward/service/command_test.go

@@ -6,9 +6,9 @@ import (
 	"context"
 	"testing"
 
-	gomock "github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/command"
 	"github.com/stretchr/testify/require"
+	gomock "go.uber.org/mock/gomock"
 )
 
 func Test_Service_runCommand(t *testing.T) {

internal/portforward/service/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/portforward/service (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=service . Logger
+//
 
 // Package service is a generated GoMock package.
 package service
@@ -7,13 +12,14 @@ package service
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,49 +40,49 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Debug mocks base method.
-func (m *MockLogger) Debug(arg0 string) {
+func (m *MockLogger) Debug(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Debug", arg0)
+	m.ctrl.Call(m, "Debug", s)
 }
 
 // Debug indicates an expected call of Debug.
-func (mr *MockLoggerMockRecorder) Debug(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debug(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), s)
 }
 
 // Error mocks base method.
-func (m *MockLogger) Error(arg0 string) {
+func (m *MockLogger) Error(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Error", arg0)
+	m.ctrl.Call(m, "Error", s)
 }
 
 // Error indicates an expected call of Error.
-func (mr *MockLoggerMockRecorder) Error(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Error(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), s)
 }
 
 // Info mocks base method.
-func (m *MockLogger) Info(arg0 string) {
+func (m *MockLogger) Info(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Info", arg0)
+	m.ctrl.Call(m, "Info", s)
 }
 
 // Info indicates an expected call of Info.
-func (mr *MockLoggerMockRecorder) Info(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Info(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), s)
 }
 
 // Warn mocks base method.
-func (m *MockLogger) Warn(arg0 string) {
+func (m *MockLogger) Warn(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Warn", arg0)
+	m.ctrl.Call(m, "Warn", s)
 }
 
 // Warn indicates an expected call of Warn.
-func (mr *MockLoggerMockRecorder) Warn(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Warn(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), s)
 }

internal/pprof/helpers_test.go

@@ -3,7 +3,7 @@ package pprof
 import (
 	"regexp"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 func boolPtr(b bool) *bool { return &b }

internal/pprof/logger_mock_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/httpserver (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=logger_mock_test.go -package pprof github.com/qdm12/gluetun/internal/httpserver Logger
+//
 
 // Package pprof is a generated GoMock package.
 package pprof
@@ -7,13 +12,14 @@ package pprof
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,37 +40,37 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Error mocks base method.
-func (m *MockLogger) Error(arg0 string) {
+func (m *MockLogger) Error(msg string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Error", arg0)
+	m.ctrl.Call(m, "Error", msg)
 }
 
 // Error indicates an expected call of Error.
-func (mr *MockLoggerMockRecorder) Error(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Error(msg any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), msg)
 }
 
 // Info mocks base method.
-func (m *MockLogger) Info(arg0 string) {
+func (m *MockLogger) Info(msg string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Info", arg0)
+	m.ctrl.Call(m, "Info", msg)
 }
 
 // Info indicates an expected call of Info.
-func (mr *MockLoggerMockRecorder) Info(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Info(msg any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), msg)
 }
 
 // Warn mocks base method.
-func (m *MockLogger) Warn(arg0 string) {
+func (m *MockLogger) Warn(msg string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Warn", arg0)
+	m.ctrl.Call(m, "Warn", msg)
 }
 
 // Warn indicates an expected call of Warn.
-func (mr *MockLoggerMockRecorder) Warn(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Warn(msg any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), msg)
 }

internal/pprof/server_test.go

@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/httpserver"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 //go:generate mockgen -destination=logger_mock_test.go -package $GOPACKAGE github.com/qdm12/gluetun/internal/httpserver Logger

internal/provider/common/mocks.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/provider/common (interfaces: ParallelResolver,Storage,Unzipper,Warner)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks.go -package common . ParallelResolver,Storage,Unzipper,Warner
+//
 
 // Package common is a generated GoMock package.
 package common
@@ -9,16 +14,17 @@ import (
 	netip "net/netip"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	settings "github.com/qdm12/gluetun/internal/configuration/settings"
 	models "github.com/qdm12/gluetun/internal/models"
 	resolver "github.com/qdm12/gluetun/internal/updater/resolver"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockParallelResolver is a mock of ParallelResolver interface.
 type MockParallelResolver struct {
 	ctrl     *gomock.Controller
 	recorder *MockParallelResolverMockRecorder
+	isgomock struct{}
 }
 
 // MockParallelResolverMockRecorder is the mock recorder for MockParallelResolver.
@@ -39,9 +45,9 @@ func (m *MockParallelResolver) EXPECT() *MockParallelResolverMockRecorder {
 }
 
 // Resolve mocks base method.
-func (m *MockParallelResolver) Resolve(arg0 context.Context, arg1 resolver.ParallelSettings) (map[string][]netip.Addr, []string, error) {
+func (m *MockParallelResolver) Resolve(ctx context.Context, arg1 resolver.ParallelSettings) (map[string][]netip.Addr, []string, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Resolve", arg0, arg1)
+	ret := m.ctrl.Call(m, "Resolve", ctx, arg1)
 	ret0, _ := ret[0].(map[string][]netip.Addr)
 	ret1, _ := ret[1].([]string)
 	ret2, _ := ret[2].(error)
@@ -49,15 +55,16 @@ func (m *MockParallelResolver) Resolve(arg0 context.Context, arg1 resolver.Paral
 }
 
 // Resolve indicates an expected call of Resolve.
-func (mr *MockParallelResolverMockRecorder) Resolve(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockParallelResolverMockRecorder) Resolve(ctx, arg1 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Resolve", reflect.TypeOf((*MockParallelResolver)(nil).Resolve), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Resolve", reflect.TypeOf((*MockParallelResolver)(nil).Resolve), ctx, arg1)
 }
 
 // MockStorage is a mock of Storage interface.
 type MockStorage struct {
 	ctrl     *gomock.Controller
 	recorder *MockStorageMockRecorder
+	isgomock struct{}
 }
 
 // MockStorageMockRecorder is the mock recorder for MockStorage.
@@ -78,24 +85,25 @@ func (m *MockStorage) EXPECT() *MockStorageMockRecorder {
 }
 
 // FilterServers mocks base method.
-func (m *MockStorage) FilterServers(arg0 string, arg1 settings.ServerSelection) ([]models.Server, error) {
+func (m *MockStorage) FilterServers(provider string, selection settings.ServerSelection) ([]models.Server, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "FilterServers", arg0, arg1)
+	ret := m.ctrl.Call(m, "FilterServers", provider, selection)
 	ret0, _ := ret[0].([]models.Server)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // FilterServers indicates an expected call of FilterServers.
-func (mr *MockStorageMockRecorder) FilterServers(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockStorageMockRecorder) FilterServers(provider, selection any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FilterServers", reflect.TypeOf((*MockStorage)(nil).FilterServers), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FilterServers", reflect.TypeOf((*MockStorage)(nil).FilterServers), provider, selection)
 }
 
 // MockUnzipper is a mock of Unzipper interface.
 type MockUnzipper struct {
 	ctrl     *gomock.Controller
 	recorder *MockUnzipperMockRecorder
+	isgomock struct{}
 }
 
 // MockUnzipperMockRecorder is the mock recorder for MockUnzipper.
@@ -116,24 +124,25 @@ func (m *MockUnzipper) EXPECT() *MockUnzipperMockRecorder {
 }
 
 // FetchAndExtract mocks base method.
-func (m *MockUnzipper) FetchAndExtract(arg0 context.Context, arg1 string) (map[string][]byte, error) {
+func (m *MockUnzipper) FetchAndExtract(ctx context.Context, url string) (map[string][]byte, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "FetchAndExtract", arg0, arg1)
+	ret := m.ctrl.Call(m, "FetchAndExtract", ctx, url)
 	ret0, _ := ret[0].(map[string][]byte)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // FetchAndExtract indicates an expected call of FetchAndExtract.
-func (mr *MockUnzipperMockRecorder) FetchAndExtract(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockUnzipperMockRecorder) FetchAndExtract(ctx, url any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FetchAndExtract", reflect.TypeOf((*MockUnzipper)(nil).FetchAndExtract), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FetchAndExtract", reflect.TypeOf((*MockUnzipper)(nil).FetchAndExtract), ctx, url)
 }
 
 // MockWarner is a mock of Warner interface.
 type MockWarner struct {
 	ctrl     *gomock.Controller
 	recorder *MockWarnerMockRecorder
+	isgomock struct{}
 }
 
 // MockWarnerMockRecorder is the mock recorder for MockWarner.
@@ -154,13 +163,13 @@ func (m *MockWarner) EXPECT() *MockWarnerMockRecorder {
 }
 
 // Warn mocks base method.
-func (m *MockWarner) Warn(arg0 string) {
+func (m *MockWarner) Warn(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Warn", arg0)
+	m.ctrl.Call(m, "Warn", s)
 }
 
 // Warn indicates an expected call of Warn.
-func (mr *MockWarnerMockRecorder) Warn(arg0 interface{}) *gomock.Call {
+func (mr *MockWarnerMockRecorder) Warn(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockWarner)(nil).Warn), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockWarner)(nil).Warn), s)
 }

internal/provider/expressvpn/connection_test.go

@@ -5,7 +5,6 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/constants/providers"
@@ -13,6 +12,7 @@ import (
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_Provider_GetConnection(t *testing.T) {

internal/provider/ipvanish/updater/servers_test.go

@@ -7,13 +7,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/constants/vpn"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/qdm12/gluetun/internal/updater/resolver"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_Updater_GetServers(t *testing.T) {

internal/provider/ivpn/connection_test.go

@@ -6,7 +6,6 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/constants/providers"
@@ -14,6 +13,7 @@ import (
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_Provider_GetConnection(t *testing.T) {

internal/provider/ivpn/updater/servers_test.go

@@ -10,13 +10,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/constants/vpn"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/qdm12/gluetun/internal/updater/resolver"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_Updater_GetServers(t *testing.T) {

internal/provider/mullvad/connection_test.go

@@ -6,7 +6,6 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/constants/providers"
@@ -14,6 +13,7 @@ import (
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_Provider_GetConnection(t *testing.T) {

internal/provider/utils/connection_test.go

@@ -6,7 +6,6 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/constants/providers"
@@ -14,6 +13,7 @@ import (
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_GetConnection(t *testing.T) {

internal/provider/vpnsecure/updater/website_test.go

@@ -7,10 +7,10 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 	"golang.org/x/net/html"
 )
 

internal/provider/windscribe/connection_test.go

@@ -6,7 +6,6 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/constants/providers"
@@ -14,6 +13,7 @@ import (
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/provider/common"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_Provider_GetConnection(t *testing.T) {

internal/restrictednet/client.go

@@ -0,0 +1,82 @@
+package restrictednet
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"strconv"
+
+	"github.com/qdm12/dns/v2/pkg/provider"
+)
+
+// Client is a client for making restricted network requests,
+// such as opening temporary firewall rules for HTTPS connections.
+// It is not meant to be high performance, although it can be used for
+// multiple requests and concurrently.
+type Client struct {
+	outboundInterface string
+	ipv6Supported     bool
+	firewall          Firewall
+	dohServers        []provider.DoHServer
+}
+
+func New(settings Settings) *Client {
+	if err := settings.validate(); err != nil {
+		panic(fmt.Sprintf("invalid settings: %v", err)) // programming error
+	}
+	dohServers := make([]provider.DoHServer, len(settings.UpstreamResolvers))
+	for i, upstreamResolver := range settings.UpstreamResolvers {
+		dohServers[i] = upstreamResolver.DoH
+	}
+
+	return &Client{
+		outboundInterface: settings.DefaultInterface,
+		ipv6Supported:     *settings.IPv6Supported,
+		firewall:          settings.Firewall,
+		dohServers:        dohServers,
+	}
+}
+
+// OpenHTTPSByHostname opens an https connection through the firewall,
+// to the hostname which in the format `host:port`. The returned cleanup
+// function must be called to remove the temporary firewall rule and close connections.
+// It first resolves the domain in hostname using DNS over HTTPS and then opens
+// the restricted HTTPS connection to the resolved IP.
+func (c *Client) OpenHTTPSByHostname(ctx context.Context, hostname string) (
+	httpClient *http.Client, cleanup func() error, err error,
+) {
+	host, portStr, err := net.SplitHostPort(hostname)
+	if err != nil {
+		return nil, nil, fmt.Errorf("splitting host and port: %w", err)
+	}
+	resolvedIPs, err := c.ResolveName(ctx, host)
+	if err != nil {
+		return nil, nil, fmt.Errorf("resolving name: %w", err)
+	} else if len(resolvedIPs) == 0 {
+		return nil, nil, fmt.Errorf("no IP address found for name %q", host)
+	}
+
+	portUint, err := strconv.ParseUint(portStr, 10, 16)
+	if err != nil {
+		return nil, nil, fmt.Errorf("parsing port: %w", err)
+	} else if portUint == 0 {
+		return nil, nil, errors.New("destination port cannot be 0")
+	}
+	port := uint16(portUint)
+
+	errs := make([]error, 0, len(resolvedIPs))
+	for _, ip := range resolvedIPs {
+		addrPort := netip.AddrPortFrom(ip, port)
+		httpClient, cleanup, err := c.OpenHTTPS(ctx, host, addrPort)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("for %s: %w", ip, err))
+			continue
+		}
+		return httpClient, cleanup, nil
+	}
+
+	return nil, nil, fmt.Errorf("opening HTTPS to %s: %w", hostname, errors.Join(errs...))
+}

internal/restrictednet/helpers_test.go

@@ -0,0 +1,7 @@
+//go:build integration
+
+package restrictednet
+
+func ptrTo[T any](value T) *T {
+	return &value
+}

internal/restrictednet/https.go

@@ -0,0 +1,202 @@
+package restrictednet
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"os"
+	"time"
+
+	"github.com/jsimonetti/rtnetlink"
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+)
+
+// OpenHTTPS opens temporary restrictive firewall output for one HTTPS destination.
+// The returned [*http.Client] must be used sequentially only, and each request must
+// have its response body fully read/discarded and then closed.
+// The returned cleanup function must be called to remove the temporary firewall rule and close connections.
+func (c *Client) OpenHTTPS(ctx context.Context, destinationTLSName string, destinationAddrPort netip.AddrPort,
+) (httpClient *http.Client, cleanup func() error, err error) {
+	fd, sourceAddrPort, err := bindSourceConnection(destinationAddrPort.Addr())
+	if err != nil {
+		return nil, nil, fmt.Errorf("binding source port: %w", err)
+	}
+
+	const remove = false
+	err = c.firewall.AcceptOutputFromIPPortToIPPort(ctx, "tcp", c.outboundInterface,
+		sourceAddrPort, destinationAddrPort, remove)
+	if err != nil {
+		closeFD(fd)
+		return nil, nil, fmt.Errorf("allowing output traffic through firewall: %w", err)
+	}
+
+	connection, err := connectSourceConnection(ctx, fd, destinationAddrPort)
+	if err != nil {
+		const remove = true
+		_ = c.firewall.AcceptOutputFromIPPortToIPPort(context.Background(), "tcp", c.outboundInterface,
+			sourceAddrPort, destinationAddrPort, remove)
+		return nil, nil, fmt.Errorf("connecting source socket: %w", err)
+	}
+
+	dial := makeDial(connection, destinationTLSName)
+	httpClient = newHTTPSClient(destinationTLSName, dial)
+	cleanup = func() error {
+		var errs []error
+		httpClient.CloseIdleConnections()
+		err := connection.Close()
+		if err != nil && !errors.Is(err, net.ErrClosed) {
+			errs = append(errs, fmt.Errorf("closing connection: %w", err))
+		}
+		const remove = true
+		err = c.firewall.AcceptOutputFromIPPortToIPPort(context.Background(), "tcp", c.outboundInterface,
+			sourceAddrPort, destinationAddrPort, remove)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("removing output traffic rule: %w", err))
+		}
+		if len(errs) > 0 {
+			return errors.Join(errs...)
+		}
+		return nil
+	}
+	return httpClient, cleanup, nil
+}
+
+type dialFunc func(ctx context.Context, network, address string) (net.Conn, error)
+
+func newHTTPSClient(destinationTLSName string, dial dialFunc) *http.Client {
+	const timeout = 5 * time.Second
+	transport := &http.Transport{
+		MaxIdleConns:        1,
+		MaxIdleConnsPerHost: 1,
+		MaxConnsPerHost:     1,
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			ServerName: destinationTLSName,
+		},
+		DialContext: dial,
+	}
+	return &http.Client{
+		Timeout:   timeout,
+		Transport: transport,
+	}
+}
+
+func makeDial(connection net.Conn, tlsName string) dialFunc {
+	_, destinationPort, err := net.SplitHostPort(connection.RemoteAddr().String())
+	if err != nil {
+		panic(err) // connection remote address should always be in the form "host:port"
+	}
+	expectedAddress := net.JoinHostPort(tlsName, destinationPort)
+	used := false
+	return func(_ context.Context, network, address string) (net.Conn, error) {
+		if used {
+			return nil, errors.New("dial function called more than once")
+		}
+		used = true
+		switch network {
+		case "tcp", "tcp4", "tcp6":
+		default:
+			return nil, fmt.Errorf("unexpected dial network %q", network)
+		}
+		if address != expectedAddress {
+			return nil, fmt.Errorf("unexpected dial address %q (expected %q)", address, expectedAddress)
+		}
+		return connection, nil
+	}
+}
+
+func bindSourceConnection(destinationIP netip.Addr) (fd int, sourceAddr netip.AddrPort, err error) {
+	sourceIP, err := sourceIPForDestination(destinationIP)
+	if err != nil {
+		return 0, netip.AddrPort{}, fmt.Errorf("finding source IP: %w", err)
+	}
+
+	family := constants.AF_INET
+	if sourceIP.Is6() {
+		family = constants.AF_INET6
+	}
+
+	fd, err = newTCPSockStream(family)
+	if err != nil {
+		return 0, netip.AddrPort{}, fmt.Errorf("creating socket: %w", err)
+	}
+
+	bindAddrPort := netip.AddrPortFrom(sourceIP, 0)
+	err = bindFD(fd, bindAddrPort)
+	if err != nil {
+		closeFD(fd)
+		return 0, netip.AddrPort{}, fmt.Errorf("binding socket: %w", err)
+	}
+
+	sourceAddr, err = fdToSourceAddr(fd)
+	if err != nil {
+		closeFD(fd)
+		return 0, netip.AddrPort{}, fmt.Errorf("getting source address: %w", err)
+	}
+
+	return fd, sourceAddr, nil
+}
+
+func connectSourceConnection(ctx context.Context, fd int, destinationAddrPort netip.AddrPort) (
+	connection net.Conn, err error,
+) {
+	err = connectFD(ctx, fd, destinationAddrPort)
+	if err != nil {
+		closeFD(fd)
+		return nil, fmt.Errorf("connecting socket: %w", err)
+	}
+
+	file := os.NewFile(uintptr(fd), "")
+	if file == nil {
+		closeFD(fd)
+		return nil, fmt.Errorf("creating socket file for destination %s", destinationAddrPort)
+	}
+	defer file.Close()
+
+	connection, err = net.FileConn(file)
+	if err != nil {
+		return nil, fmt.Errorf("wrapping socket connection: %w", err)
+	}
+
+	return connection, nil
+}
+
+func sourceIPForDestination(destinationIP netip.Addr) (srcIP netip.Addr, err error) {
+	conn, err := rtnetlink.Dial(nil)
+	if err != nil {
+		return netip.Addr{}, err
+	}
+	defer conn.Close()
+
+	family := uint8(constants.AF_INET)
+	if destinationIP.Is6() {
+		family = constants.AF_INET6
+	}
+
+	requestMessage := &rtnetlink.RouteMessage{
+		Family: family,
+		Attributes: rtnetlink.RouteAttributes{
+			Dst: destinationIP.AsSlice(),
+		},
+	}
+	messages, err := conn.Route.Get(requestMessage)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("getting routes to %s: %w", destinationIP, err)
+	}
+
+	for _, message := range messages {
+		if message.Attributes.Src == nil {
+			continue
+		}
+		if message.Attributes.Src.To4() == nil {
+			return netip.AddrFrom16([16]byte(message.Attributes.Src)), nil
+		}
+		return netip.AddrFrom4([4]byte(message.Attributes.Src)), nil
+	}
+
+	return netip.Addr{}, fmt.Errorf("no route to %s", destinationIP)
+}

internal/restrictednet/https_integration_test.go

@@ -0,0 +1,117 @@
+//go:build integration
+
+package restrictednet
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"testing"
+
+	"github.com/qdm12/dns/v2/pkg/provider"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+type listenAddrPortMatcher struct {
+	expected netip.AddrPort
+}
+
+func (m listenAddrPortMatcher) Matches(x any) bool {
+	ip, ok := x.(netip.AddrPort)
+	if !ok {
+		return false
+	}
+	if m.expected.IsValid() {
+		return ip == m.expected
+	}
+	return ip.IsValid() && ip.Addr().IsValid() && ip.Port() > 0
+}
+
+func (m listenAddrPortMatcher) String() string {
+	if m.expected.IsValid() {
+		return "is the same as " + m.expected.String()
+	}
+	return "is a valid netip.AddrPort with a valid IP and non-zero port"
+}
+
+type destinationAddrPortMatcher struct {
+	expected netip.AddrPort
+}
+
+func (m destinationAddrPortMatcher) Matches(x any) bool {
+	ip, ok := x.(netip.AddrPort)
+	if !ok {
+		return false
+	}
+	if m.expected.IsValid() {
+		return ip == m.expected
+	}
+	return ip.IsValid() && ip.Port() == m.expected.Port()
+}
+
+func (m destinationAddrPortMatcher) String() string {
+	if m.expected.IsValid() {
+		return "is the same as " + m.expected.String()
+	}
+	return "matches the port " + fmt.Sprint(m.expected.Port())
+}
+
+func Test_Client_OpenHTTPS(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	ctrl := gomock.NewController(t)
+
+	const destinationTLSName = "one.one.one.one"
+	destinationAddrPort := netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 443)
+
+	firewall := NewMockFirewall(ctrl)
+	sourceMatcher := listenAddrPortMatcher{}
+	firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
+		ctx, "tcp", "eth0", sourceMatcher, destinationAddrPort, false,
+	).DoAndReturn(func(_ context.Context,
+		_, _ string, source, _ netip.AddrPort, _ bool,
+	) error {
+		sourceMatcher.expected = source
+		return nil
+	})
+	firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
+		context.Background(), "tcp", "eth0", sourceMatcher, destinationAddrPort, true,
+	).Return(nil)
+
+	const ipv6Supported = false
+	upstreamResolvers := []provider.Provider{provider.Google()}
+	settings := Settings{
+		Firewall:          firewall,
+		DefaultInterface:  "eth0",
+		IPv6Supported:     ptrTo(ipv6Supported),
+		UpstreamResolvers: upstreamResolvers,
+	}
+	client := New(settings)
+
+	httpClient, cleanup, err := client.OpenHTTPS(ctx, destinationTLSName, destinationAddrPort)
+	require.NoError(t, err)
+	require.NotNil(t, httpClient)
+	require.NotNil(t, cleanup)
+
+	const requests = 2
+
+	for range requests {
+		request, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+destinationTLSName, nil)
+		require.NoError(t, err)
+
+		response, err := httpClient.Do(request)
+		require.NoError(t, err)
+		_, err = io.Copy(io.Discard, response.Body)
+		require.NoError(t, err)
+		err = response.Body.Close()
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, response.StatusCode)
+	}
+
+	err = cleanup()
+	require.NoError(t, err)
+}

internal/restrictednet/interfaces.go

@@ -0,0 +1,12 @@
+package restrictednet
+
+import (
+	"context"
+	"net/netip"
+)
+
+type Firewall interface {
+	AcceptOutputFromIPPortToIPPort(ctx context.Context,
+		protocol, intf string, source, destination netip.AddrPort, remove bool,
+	) error
+}

internal/restrictednet/linux.go

@@ -0,0 +1,121 @@
+//go:build linux
+
+package restrictednet
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+func closeFD(fd int) {
+	unix.Close(fd)
+}
+
+func newTCPSockStream(family int) (fd int, err error) {
+	fd, err = unix.Socket(family, unix.SOCK_STREAM, unix.IPPROTO_TCP)
+	if err != nil {
+		return 0, err
+	}
+	err = unix.SetNonblock(fd, true)
+	if err != nil {
+		_ = unix.Close(fd)
+		return 0, err
+	}
+	return fd, nil
+}
+
+func bindFD(fd int, address netip.AddrPort) error {
+	bindAddr := makeSockAddr(address)
+	return unix.Bind(fd, bindAddr)
+}
+
+func connectFD(ctx context.Context, fd int, destination netip.AddrPort) error {
+	err := unix.Connect(fd, makeSockAddr(destination))
+	switch {
+	case err == nil:
+		return nil
+	case !errors.Is(err, unix.EINPROGRESS):
+		return err
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+			bitsIndex := fd / 64 //nolint:mnd
+			if bitsIndex >= len(unix.FdSet{}.Bits) {
+				return fmt.Errorf("fd %d exceeds unix.Select FdSet capacity", fd)
+			}
+			wset := &unix.FdSet{}
+			wset.Bits[bitsIndex] |= 1 << (uint64(fd) % 64) //nolint:gosec,mnd
+			eset := &unix.FdSet{}
+			eset.Bits[bitsIndex] |= 1 << (uint64(fd) % 64) //nolint:gosec,mnd
+			const selectTimeout = 50 * time.Millisecond
+			timeval := unix.NsecToTimeval(int64(selectTimeout))
+
+			// Wait for the FD to become writable or hit an error state
+			n, err := unix.Select(fd+1, nil, wset, eset, &timeval)
+			if err != nil {
+				if errors.Is(err, unix.EINTR) {
+					continue // Syscall interrupted, try again
+				}
+				return fmt.Errorf("select error: %w", err)
+			} else if n == 0 {
+				continue // no status change yet
+			}
+
+			// Check if the socket encountered an error
+			n, err = unix.GetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_ERROR)
+			if err != nil {
+				return fmt.Errorf("getsockopt error: %w", err)
+			} else if n != 0 {
+				return fmt.Errorf("connect failed asynchronously: %w", unix.Errno(n))
+			}
+
+			return nil
+		}
+	}
+}
+
+func fdToSourceAddr(fd int) (sourceAddrPort netip.AddrPort, err error) {
+	sockAddr, err := unix.Getsockname(fd)
+	if err != nil {
+		return netip.AddrPort{}, fmt.Errorf("getting sockname: %w", err)
+	}
+
+	sourceAddrPort, err = sockAddrToAddrPort(sockAddr)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+	return sourceAddrPort, nil
+}
+
+func makeSockAddr(addressPort netip.AddrPort) unix.Sockaddr {
+	if addressPort.Addr().Is4() {
+		return &unix.SockaddrInet4{
+			Port: int(addressPort.Port()),
+			Addr: addressPort.Addr().As4(),
+		}
+	}
+	return &unix.SockaddrInet6{
+		Port: int(addressPort.Port()),
+		Addr: addressPort.Addr().As16(),
+	}
+}
+
+func sockAddrToAddrPort(sockAddr unix.Sockaddr) (addrPort netip.AddrPort, err error) {
+	switch typedSockAddr := sockAddr.(type) {
+	case *unix.SockaddrInet4:
+		return netip.AddrPortFrom(netip.AddrFrom4(typedSockAddr.Addr), uint16(typedSockAddr.Port)), nil //nolint:gosec
+	case *unix.SockaddrInet6:
+		return netip.AddrPortFrom(netip.AddrFrom16(typedSockAddr.Addr), uint16(typedSockAddr.Port)), nil //nolint:gosec
+	default:
+		return netip.AddrPort{}, fmt.Errorf("unexpected socket address type %T", typedSockAddr)
+	}
+}

internal/restrictednet/mocks_generate_test.go

@@ -0,0 +1,3 @@
+package restrictednet
+
+//go:generate mockgen -destination=mocks_test.go -package=$GOPACKAGE . Firewall

internal/restrictednet/mocks_test.go

@@ -0,0 +1,56 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/qdm12/gluetun/internal/restrictednet (interfaces: Firewall)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=restrictednet . Firewall
+//
+
+// Package restrictednet is a generated GoMock package.
+package restrictednet
+
+import (
+	context "context"
+	netip "net/netip"
+	reflect "reflect"
+
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockFirewall is a mock of Firewall interface.
+type MockFirewall struct {
+	ctrl     *gomock.Controller
+	recorder *MockFirewallMockRecorder
+	isgomock struct{}
+}
+
+// MockFirewallMockRecorder is the mock recorder for MockFirewall.
+type MockFirewallMockRecorder struct {
+	mock *MockFirewall
+}
+
+// NewMockFirewall creates a new mock instance.
+func NewMockFirewall(ctrl *gomock.Controller) *MockFirewall {
+	mock := &MockFirewall{ctrl: ctrl}
+	mock.recorder = &MockFirewallMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockFirewall) EXPECT() *MockFirewallMockRecorder {
+	return m.recorder
+}
+
+// AcceptOutputFromIPPortToIPPort mocks base method.
+func (m *MockFirewall) AcceptOutputFromIPPortToIPPort(ctx context.Context, protocol, intf string, source, destination netip.AddrPort, remove bool) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AcceptOutputFromIPPortToIPPort", ctx, protocol, intf, source, destination, remove)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// AcceptOutputFromIPPortToIPPort indicates an expected call of AcceptOutputFromIPPortToIPPort.
+func (mr *MockFirewallMockRecorder) AcceptOutputFromIPPortToIPPort(ctx, protocol, intf, source, destination, remove any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptOutputFromIPPortToIPPort", reflect.TypeOf((*MockFirewall)(nil).AcceptOutputFromIPPortToIPPort), ctx, protocol, intf, source, destination, remove)
+}

internal/restrictednet/notlinux.go

@@ -0,0 +1,28 @@
+//go:build !linux
+
+package restrictednet
+
+import (
+	"context"
+	"net/netip"
+)
+
+func closeFD(fd int) {
+	panic("not implemented")
+}
+
+func newTCPSockStream(family int) (fd int, err error) {
+	panic("not implemented")
+}
+
+func bindFD(fd int, address netip.AddrPort) error {
+	panic("not implemented")
+}
+
+func connectFD(ctx context.Context, fd int, destination netip.AddrPort) error {
+	panic("not implemented")
+}
+
+func fdToSourceAddr(fd int) (sourceAddrPort netip.AddrPort, err error) {
+	panic("not implemented")
+}

internal/restrictednet/resolve.go

@@ -0,0 +1,201 @@
+package restrictednet
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strconv"
+
+	"github.com/miekg/dns"
+)
+
+// ResolveName resolves the given host name to IP addresses using DoH servers,
+// while opening temporary restrictive firewall rules for HTTPS traffic to DoH servers.
+// The host must be a single well-formed domain name, without port or path.
+func (c *Client) ResolveName(ctx context.Context, host string) (
+	resolvedAddresses []netip.Addr, err error,
+) {
+	const maxTypes = 2
+	questionTypes := make([]uint16, 0, maxTypes)
+	if c.ipv6Supported {
+		questionTypes = append(questionTypes, dns.TypeAAAA)
+	}
+	questionTypes = append(questionTypes, dns.TypeA)
+
+	var addresses []netip.Addr
+	errs := make([]error, 0, len(questionTypes))
+	for _, questionType := range questionTypes {
+		answerAddresses, err := c.resolveOneQuestionType(ctx, host, questionType)
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+		addresses = append(addresses, answerAddresses...)
+	}
+
+	switch {
+	case len(addresses) > 0:
+		return addresses, nil
+	case len(errs) == 0:
+		return nil, nil // no address found
+	default: // errors
+		return nil, fmt.Errorf("resolving host %q: %w", host, errors.Join(errs...))
+	}
+}
+
+func (c *Client) resolveOneQuestionType(ctx context.Context,
+	host string, questionType uint16,
+) (addresses []netip.Addr, err error) {
+	queryMessage := &dns.Msg{}
+	queryMessage.SetQuestion(dns.Fqdn(host), questionType)
+	queryWire, err := queryMessage.Pack()
+	if err != nil {
+		return nil, fmt.Errorf("packing DNS query: %w", err)
+	}
+
+	// Try every DoH server and every of each of their IP until we get a non-empty
+	// successful response.
+	errs := make([]error, 0)
+	for _, dohServer := range c.dohServers {
+		dohURL, err := url.Parse(dohServer.URL)
+		if err != nil {
+			errs = append(errs,
+				fmt.Errorf("parsing DoH server URL %s: %w", dohServer.URL, err))
+			continue
+		}
+
+		dohServerIPs := make([]netip.Addr, 0, len(dohServer.IPv4)+len(dohServer.IPv6))
+		if c.ipv6Supported {
+			// Prefer IPv6 addresses if IPv6 is supported
+			dohServerIPs = append(dohServerIPs, dohServer.IPv6...)
+		}
+		dohServerIPs = append(dohServerIPs, dohServer.IPv4...)
+
+		for _, dohServerIP := range dohServerIPs {
+			const defaultDoHPort uint16 = 443
+			port := defaultDoHPort
+			if portStr := dohURL.Port(); portStr != "" {
+				port, err = parseDestinationPort(portStr)
+				if err != nil {
+					errs = append(errs, fmt.Errorf("parsing DoH server port: %w", err))
+					continue
+				}
+			}
+			dohServerAddrPort := netip.AddrPortFrom(dohServerIP, port)
+			responseMessage, err := c.doHQuery(ctx, queryWire, dohURL, dohServerAddrPort)
+			switch {
+			case err != nil:
+				errs = append(errs, fmt.Errorf("querying DoH server %q (%s): %w",
+					dohServer.URL, dohServerAddrPort, err))
+				continue
+			case responseMessage.Rcode != dns.RcodeSuccess:
+				errs = append(errs, fmt.Errorf("querying DoH server %q (%s): DNS rcode %s",
+					dohServer.URL, dohServerAddrPort, dns.RcodeToString[responseMessage.Rcode]))
+				continue
+			}
+			addresses := answersToNetipAddrs(responseMessage)
+			if len(addresses) == 0 {
+				continue
+			}
+			return addresses, nil
+		}
+	}
+
+	if len(errs) == 0 {
+		return nil, nil
+	}
+
+	return nil, fmt.Errorf("resolving %s %s: %w",
+		dns.TypeToString[questionType], host, errors.Join(errs...))
+}
+
+func (c *Client) doHQuery(ctx context.Context, queryWire []byte,
+	dohURL *url.URL, dohServerAddrPort netip.AddrPort,
+) (responseMessage *dns.Msg, err error) {
+	httpClient, cleanup, err := c.OpenHTTPS(ctx, dohURL.Hostname(), dohServerAddrPort)
+	if err != nil {
+		return nil, fmt.Errorf("opening https connection: %w", err)
+	}
+	defer func() {
+		closeErr := cleanup()
+		if err == nil && closeErr != nil {
+			err = fmt.Errorf("cleaning up https connection: %w", closeErr)
+		}
+	}()
+
+	requestBody := bytes.NewReader(queryWire)
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, dohURL.String(), requestBody)
+	if err != nil {
+		return nil, fmt.Errorf("creating request: %w", err)
+	}
+	request.Header.Set("Content-Type", "application/dns-message")
+	request.Header.Set("Accept", "application/dns-message")
+
+	response, err := httpClient.Do(request)
+	if err != nil {
+		return nil, err
+	}
+
+	responseData, err := io.ReadAll(response.Body)
+	if err != nil {
+		_ = response.Body.Close()
+		return nil, fmt.Errorf("reading response body: %w", err)
+	}
+
+	err = response.Body.Close()
+	if err != nil {
+		return nil, fmt.Errorf("closing response body: %w", err)
+	}
+
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("response status code is %s (data length %d)",
+			response.Status, len(responseData))
+	}
+
+	responseMessage = new(dns.Msg)
+	err = responseMessage.Unpack(responseData)
+	if err != nil {
+		return nil, fmt.Errorf("parsing DoH response: %w", err)
+	}
+
+	return responseMessage, nil
+}
+
+func answersToNetipAddrs(message *dns.Msg) (addresses []netip.Addr) {
+	if message == nil {
+		return nil
+	}
+	addresses = make([]netip.Addr, 0, len(message.Answer))
+	for _, answer := range message.Answer {
+		switch record := answer.(type) {
+		case *dns.A:
+			address, ok := netip.AddrFromSlice(record.A)
+			if ok {
+				addresses = append(addresses, address.Unmap())
+			}
+		case *dns.AAAA:
+			address, ok := netip.AddrFromSlice(record.AAAA)
+			if ok {
+				addresses = append(addresses, address)
+			}
+		}
+	}
+	return addresses
+}
+
+func parseDestinationPort(portStr string) (port uint16, err error) {
+	portUint, err := strconv.ParseUint(portStr, 10, 16)
+	if err != nil {
+		return 0, err
+	}
+
+	if portUint == 0 {
+		return 0, errors.New("port cannot be 0")
+	}
+	return uint16(portUint), nil
+}

internal/restrictednet/resolve_integration_test.go

@@ -0,0 +1,110 @@
+//go:build integration
+
+package restrictednet
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"testing"
+
+	"github.com/miekg/dns"
+	"github.com/qdm12/dns/v2/pkg/provider"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
+)
+
+func Test_Client_ResolveName(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	ctrl := gomock.NewController(t)
+
+	firewall := NewMockFirewall(ctrl)
+	sourceMatcher := listenAddrPortMatcher{}
+	destinationMatcher := destinationAddrPortMatcher{
+		expected: netip.AddrPortFrom(netip.Addr{}, 443),
+	}
+
+	// Add rule
+	firstCall := firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
+		ctx, "tcp", "eth0", sourceMatcher, destinationMatcher, false,
+	).DoAndReturn(func(
+		_ context.Context, _, _ string, source, destination netip.AddrPort, _ bool,
+	) error {
+		sourceMatcher.expected = source
+		destinationMatcher.expected = destination
+		return nil
+	})
+
+	// Removal rule
+	firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
+		context.Background(), "tcp", "eth0", sourceMatcher, destinationMatcher, true,
+	).Return(nil).After(firstCall)
+
+	settings := Settings{
+		DefaultInterface:  "eth0",
+		IPv6Supported:     ptrTo(false),
+		Firewall:          firewall,
+		UpstreamResolvers: []provider.Provider{provider.Cloudflare()},
+	}
+	client := New(settings)
+
+	addresses, err := client.ResolveName(ctx, "github.com")
+	require.NoError(t, err)
+	assert.NotEmpty(t, addresses)
+}
+
+func Test_answersToNetipAddrs(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		message  *dns.Msg
+		expected []netip.Addr
+	}{
+		"nil_message": {},
+		"no_answers": {
+			message:  &dns.Msg{},
+			expected: []netip.Addr{},
+		},
+		"a_record": {
+			message: &dns.Msg{Answer: []dns.RR{
+				&dns.A{
+					Hdr: dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeA, Class: dns.ClassINET},
+					A:   net.IP{1, 1, 1, 1},
+				},
+			}},
+			expected: []netip.Addr{netip.MustParseAddr("1.1.1.1")},
+		},
+		"aaaa_record": {
+			message: &dns.Msg{Answer: []dns.RR{
+				&dns.AAAA{
+					Hdr:  dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeAAAA, Class: dns.ClassINET},
+					AAAA: net.IP{0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0, 0, 0, 0, 0, 0, 0, 0, 0x88, 0x88},
+				},
+			}},
+			expected: []netip.Addr{netip.MustParseAddr("2001:4860:4860::8888")},
+		},
+		"mixed_records": {
+			message: &dns.Msg{Answer: []dns.RR{
+				&dns.A{
+					Hdr: dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeA, Class: dns.ClassINET},
+					A:   net.IP{1, 1, 1, 1},
+				},
+				&dns.AAAA{
+					Hdr:  dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeAAAA, Class: dns.ClassINET},
+					AAAA: net.IP{0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0, 0, 0, 0, 0, 0, 0, 0, 0x88, 0x88},
+				},
+			}},
+			expected: []netip.Addr{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2001:4860:4860::8888")},
+		},
+	}
+
+	for testName, testCase := range testCases {
+		t.Run(testName, func(t *testing.T) {
+			t.Parallel()
+			addresses := answersToNetipAddrs(testCase.message)
+			assert.Equal(t, testCase.expected, addresses)
+		})
+	}
+}

internal/restrictednet/settings.go

@@ -0,0 +1,28 @@
+package restrictednet
+
+import (
+	"errors"
+
+	"github.com/qdm12/dns/v2/pkg/provider"
+)
+
+type Settings struct {
+	DefaultInterface  string
+	IPv6Supported     *bool
+	Firewall          Firewall
+	UpstreamResolvers []provider.Provider
+}
+
+func (s *Settings) validate() error {
+	switch {
+	case s.DefaultInterface == "":
+		return errors.New("default interface is not set")
+	case s.IPv6Supported == nil:
+		return errors.New("IPv6 support field is not set")
+	case s.Firewall == nil:
+		return errors.New("firewall is not set")
+	case len(s.UpstreamResolvers) == 0:
+		return errors.New("no upstream resolvers provided")
+	}
+	return nil
+}

internal/routing/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/routing (interfaces: NetLinker)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=routing . NetLinker
+//
 
 // Package routing is a generated GoMock package.
 package routing
@@ -8,14 +13,15 @@ import (
 	netip "net/netip"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	netlink "github.com/qdm12/gluetun/internal/netlink"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockNetLinker is a mock of NetLinker interface.
 type MockNetLinker struct {
 	ctrl     *gomock.Controller
 	recorder *MockNetLinkerMockRecorder
+	isgomock struct{}
 }
 
 // MockNetLinkerMockRecorder is the mock recorder for MockNetLinker.
@@ -36,91 +42,91 @@ func (m *MockNetLinker) EXPECT() *MockNetLinkerMockRecorder {
 }
 
 // AddrList mocks base method.
-func (m *MockNetLinker) AddrList(arg0 uint32, arg1 byte) ([]netip.Prefix, error) {
+func (m *MockNetLinker) AddrList(linkIndex uint32, family uint8) ([]netip.Prefix, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AddrList", arg0, arg1)
+	ret := m.ctrl.Call(m, "AddrList", linkIndex, family)
 	ret0, _ := ret[0].([]netip.Prefix)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // AddrList indicates an expected call of AddrList.
-func (mr *MockNetLinkerMockRecorder) AddrList(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) AddrList(linkIndex, family any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrList", reflect.TypeOf((*MockNetLinker)(nil).AddrList), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrList", reflect.TypeOf((*MockNetLinker)(nil).AddrList), linkIndex, family)
 }
 
 // AddrReplace mocks base method.
-func (m *MockNetLinker) AddrReplace(arg0 uint32, arg1 netip.Prefix) error {
+func (m *MockNetLinker) AddrReplace(linkIndex uint32, prefix netip.Prefix) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AddrReplace", arg0, arg1)
+	ret := m.ctrl.Call(m, "AddrReplace", linkIndex, prefix)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // AddrReplace indicates an expected call of AddrReplace.
-func (mr *MockNetLinkerMockRecorder) AddrReplace(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) AddrReplace(linkIndex, prefix any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrReplace", reflect.TypeOf((*MockNetLinker)(nil).AddrReplace), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrReplace", reflect.TypeOf((*MockNetLinker)(nil).AddrReplace), linkIndex, prefix)
 }
 
 // LinkAdd mocks base method.
-func (m *MockNetLinker) LinkAdd(arg0 netlink.Link) (uint32, error) {
+func (m *MockNetLinker) LinkAdd(link netlink.Link) (uint32, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkAdd", arg0)
+	ret := m.ctrl.Call(m, "LinkAdd", link)
 	ret0, _ := ret[0].(uint32)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // LinkAdd indicates an expected call of LinkAdd.
-func (mr *MockNetLinkerMockRecorder) LinkAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkAdd(link any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkAdd", reflect.TypeOf((*MockNetLinker)(nil).LinkAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkAdd", reflect.TypeOf((*MockNetLinker)(nil).LinkAdd), link)
 }
 
 // LinkByIndex mocks base method.
-func (m *MockNetLinker) LinkByIndex(arg0 uint32) (netlink.Link, error) {
+func (m *MockNetLinker) LinkByIndex(index uint32) (netlink.Link, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkByIndex", arg0)
+	ret := m.ctrl.Call(m, "LinkByIndex", index)
 	ret0, _ := ret[0].(netlink.Link)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // LinkByIndex indicates an expected call of LinkByIndex.
-func (mr *MockNetLinkerMockRecorder) LinkByIndex(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkByIndex(index any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByIndex", reflect.TypeOf((*MockNetLinker)(nil).LinkByIndex), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByIndex", reflect.TypeOf((*MockNetLinker)(nil).LinkByIndex), index)
 }
 
 // LinkByName mocks base method.
-func (m *MockNetLinker) LinkByName(arg0 string) (netlink.Link, error) {
+func (m *MockNetLinker) LinkByName(name string) (netlink.Link, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkByName", arg0)
+	ret := m.ctrl.Call(m, "LinkByName", name)
 	ret0, _ := ret[0].(netlink.Link)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // LinkByName indicates an expected call of LinkByName.
-func (mr *MockNetLinkerMockRecorder) LinkByName(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkByName(name any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByName", reflect.TypeOf((*MockNetLinker)(nil).LinkByName), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByName", reflect.TypeOf((*MockNetLinker)(nil).LinkByName), name)
 }
 
 // LinkDel mocks base method.
-func (m *MockNetLinker) LinkDel(arg0 uint32) error {
+func (m *MockNetLinker) LinkDel(index uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkDel", arg0)
+	ret := m.ctrl.Call(m, "LinkDel", index)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkDel indicates an expected call of LinkDel.
-func (mr *MockNetLinkerMockRecorder) LinkDel(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkDel(index any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkDel", reflect.TypeOf((*MockNetLinker)(nil).LinkDel), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkDel", reflect.TypeOf((*MockNetLinker)(nil).LinkDel), index)
 }
 
 // LinkList mocks base method.
@@ -139,129 +145,129 @@ func (mr *MockNetLinkerMockRecorder) LinkList() *gomock.Call {
 }
 
 // LinkSetDown mocks base method.
-func (m *MockNetLinker) LinkSetDown(arg0 uint32) error {
+func (m *MockNetLinker) LinkSetDown(index uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkSetDown", arg0)
+	ret := m.ctrl.Call(m, "LinkSetDown", index)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkSetDown indicates an expected call of LinkSetDown.
-func (mr *MockNetLinkerMockRecorder) LinkSetDown(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkSetDown(index any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetDown", reflect.TypeOf((*MockNetLinker)(nil).LinkSetDown), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetDown", reflect.TypeOf((*MockNetLinker)(nil).LinkSetDown), index)
 }
 
 // LinkSetUp mocks base method.
-func (m *MockNetLinker) LinkSetUp(arg0 uint32) error {
+func (m *MockNetLinker) LinkSetUp(index uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkSetUp", arg0)
+	ret := m.ctrl.Call(m, "LinkSetUp", index)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkSetUp indicates an expected call of LinkSetUp.
-func (mr *MockNetLinkerMockRecorder) LinkSetUp(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkSetUp(index any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetUp", reflect.TypeOf((*MockNetLinker)(nil).LinkSetUp), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetUp", reflect.TypeOf((*MockNetLinker)(nil).LinkSetUp), index)
 }
 
 // RouteAdd mocks base method.
-func (m *MockNetLinker) RouteAdd(arg0 netlink.Route) error {
+func (m *MockNetLinker) RouteAdd(route netlink.Route) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteAdd", arg0)
+	ret := m.ctrl.Call(m, "RouteAdd", route)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RouteAdd indicates an expected call of RouteAdd.
-func (mr *MockNetLinkerMockRecorder) RouteAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteAdd(route any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteAdd", reflect.TypeOf((*MockNetLinker)(nil).RouteAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteAdd", reflect.TypeOf((*MockNetLinker)(nil).RouteAdd), route)
 }
 
 // RouteDel mocks base method.
-func (m *MockNetLinker) RouteDel(arg0 netlink.Route) error {
+func (m *MockNetLinker) RouteDel(route netlink.Route) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteDel", arg0)
+	ret := m.ctrl.Call(m, "RouteDel", route)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RouteDel indicates an expected call of RouteDel.
-func (mr *MockNetLinkerMockRecorder) RouteDel(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteDel(route any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteDel", reflect.TypeOf((*MockNetLinker)(nil).RouteDel), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteDel", reflect.TypeOf((*MockNetLinker)(nil).RouteDel), route)
 }
 
 // RouteList mocks base method.
-func (m *MockNetLinker) RouteList(arg0 byte) ([]netlink.Route, error) {
+func (m *MockNetLinker) RouteList(family uint8) ([]netlink.Route, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteList", arg0)
+	ret := m.ctrl.Call(m, "RouteList", family)
 	ret0, _ := ret[0].([]netlink.Route)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RouteList indicates an expected call of RouteList.
-func (mr *MockNetLinkerMockRecorder) RouteList(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteList(family any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteList", reflect.TypeOf((*MockNetLinker)(nil).RouteList), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteList", reflect.TypeOf((*MockNetLinker)(nil).RouteList), family)
 }
 
 // RouteReplace mocks base method.
-func (m *MockNetLinker) RouteReplace(arg0 netlink.Route) error {
+func (m *MockNetLinker) RouteReplace(route netlink.Route) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteReplace", arg0)
+	ret := m.ctrl.Call(m, "RouteReplace", route)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RouteReplace indicates an expected call of RouteReplace.
-func (mr *MockNetLinkerMockRecorder) RouteReplace(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteReplace(route any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteReplace", reflect.TypeOf((*MockNetLinker)(nil).RouteReplace), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteReplace", reflect.TypeOf((*MockNetLinker)(nil).RouteReplace), route)
 }
 
 // RuleAdd mocks base method.
-func (m *MockNetLinker) RuleAdd(arg0 netlink.Rule) error {
+func (m *MockNetLinker) RuleAdd(rule netlink.Rule) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuleAdd", arg0)
+	ret := m.ctrl.Call(m, "RuleAdd", rule)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RuleAdd indicates an expected call of RuleAdd.
-func (mr *MockNetLinkerMockRecorder) RuleAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RuleAdd(rule any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleAdd", reflect.TypeOf((*MockNetLinker)(nil).RuleAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleAdd", reflect.TypeOf((*MockNetLinker)(nil).RuleAdd), rule)
 }
 
 // RuleDel mocks base method.
-func (m *MockNetLinker) RuleDel(arg0 netlink.Rule) error {
+func (m *MockNetLinker) RuleDel(rule netlink.Rule) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuleDel", arg0)
+	ret := m.ctrl.Call(m, "RuleDel", rule)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RuleDel indicates an expected call of RuleDel.
-func (mr *MockNetLinkerMockRecorder) RuleDel(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RuleDel(rule any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleDel", reflect.TypeOf((*MockNetLinker)(nil).RuleDel), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleDel", reflect.TypeOf((*MockNetLinker)(nil).RuleDel), rule)
 }
 
 // RuleList mocks base method.
-func (m *MockNetLinker) RuleList(arg0 byte) ([]netlink.Rule, error) {
+func (m *MockNetLinker) RuleList(family uint8) ([]netlink.Rule, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuleList", arg0)
+	ret := m.ctrl.Call(m, "RuleList", family)
 	ret0, _ := ret[0].([]netlink.Rule)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RuleList indicates an expected call of RuleList.
-func (mr *MockNetLinkerMockRecorder) RuleList(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RuleList(family any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleList", reflect.TypeOf((*MockNetLinker)(nil).RuleList), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleList", reflect.TypeOf((*MockNetLinker)(nil).RuleList), family)
 }

internal/routing/rules_test.go

@@ -5,10 +5,10 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/netlink"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func makeNetipPrefix(n byte) netip.Prefix {

internal/server/middlewares/auth/middleware_test.go

@@ -8,9 +8,9 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_authHandler_ServeHTTP(t *testing.T) {

internal/server/middlewares/auth/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/server/middlewares/auth (interfaces: DebugLogger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=auth . DebugLogger
+//
 
 // Package auth is a generated GoMock package.
 package auth
@@ -7,13 +12,14 @@ package auth
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockDebugLogger is a mock of DebugLogger interface.
 type MockDebugLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockDebugLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockDebugLoggerMockRecorder is the mock recorder for MockDebugLogger.
@@ -34,35 +40,35 @@ func (m *MockDebugLogger) EXPECT() *MockDebugLoggerMockRecorder {
 }
 
 // Debugf mocks base method.
-func (m *MockDebugLogger) Debugf(arg0 string, arg1 ...interface{}) {
+func (m *MockDebugLogger) Debugf(format string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{format}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Debugf", varargs...)
 }
 
 // Debugf indicates an expected call of Debugf.
-func (mr *MockDebugLoggerMockRecorder) Debugf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockDebugLoggerMockRecorder) Debugf(format any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debugf", reflect.TypeOf((*MockDebugLogger)(nil).Debugf), varargs...)
 }
 
 // Warnf mocks base method.
-func (m *MockDebugLogger) Warnf(arg0 string, arg1 ...interface{}) {
+func (m *MockDebugLogger) Warnf(format string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{format}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Warnf", varargs...)
 }
 
 // Warnf indicates an expected call of Warnf.
-func (mr *MockDebugLoggerMockRecorder) Warnf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockDebugLoggerMockRecorder) Warnf(format any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warnf", reflect.TypeOf((*MockDebugLogger)(nil).Warnf), varargs...)
 }

internal/socks5/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/socks5 (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package=socks5 . Logger
+//
 
 // Package socks5 is a generated GoMock package.
 package socks5
@@ -7,13 +12,14 @@ package socks5
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,35 +40,35 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Infof mocks base method.
-func (m *MockLogger) Infof(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Infof(format string, a ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
-		varargs = append(varargs, a)
+	varargs := []any{format}
+	for _, a_2 := range a {
+		varargs = append(varargs, a_2)
 	}
 	m.ctrl.Call(m, "Infof", varargs...)
 }
 
 // Infof indicates an expected call of Infof.
-func (mr *MockLoggerMockRecorder) Infof(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Infof(format any, a ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, a...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Infof", reflect.TypeOf((*MockLogger)(nil).Infof), varargs...)
 }
 
 // Warnf mocks base method.
-func (m *MockLogger) Warnf(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Warnf(format string, a ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
-		varargs = append(varargs, a)
+	varargs := []any{format}
+	for _, a_2 := range a {
+		varargs = append(varargs, a_2)
 	}
 	m.ctrl.Call(m, "Warnf", varargs...)
 }
 
 // Warnf indicates an expected call of Warnf.
-func (mr *MockLoggerMockRecorder) Warnf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Warnf(format any, a ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, a...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warnf", reflect.TypeOf((*MockLogger)(nil).Warnf), varargs...)
 }

internal/socks5/socks5_test.go

@@ -13,9 +13,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 type noopLogger struct{}

internal/socks5/udp_router_integration_test.go

@@ -12,10 +12,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_udpRouter_ResolveGithubFromCloudflareDNS(t *testing.T) {

internal/storage/mocks_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/storage (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=mocks_test.go -package storage . Logger
+//
 
 // Package storage is a generated GoMock package.
 package storage
@@ -7,13 +12,14 @@ package storage
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,42 +40,42 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Info mocks base method.
-func (m *MockLogger) Info(arg0 string) {
+func (m *MockLogger) Info(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Info", arg0)
+	m.ctrl.Call(m, "Info", s)
 }
 
 // Info indicates an expected call of Info.
-func (mr *MockLoggerMockRecorder) Info(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Info(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), s)
 }
 
 // Infof mocks base method.
-func (m *MockLogger) Infof(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Infof(format string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{format}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Infof", varargs...)
 }
 
 // Infof indicates an expected call of Infof.
-func (mr *MockLoggerMockRecorder) Infof(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Infof(format any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Infof", reflect.TypeOf((*MockLogger)(nil).Infof), varargs...)
 }
 
 // Warn mocks base method.
-func (m *MockLogger) Warn(arg0 string) {
+func (m *MockLogger) Warn(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Warn", arg0)
+	m.ctrl.Call(m, "Warn", s)
 }
 
 // Warn indicates an expected call of Warn.
-func (mr *MockLoggerMockRecorder) Warn(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Warn(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), s)
 }

internal/storage/read_test.go

@@ -4,11 +4,11 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/constants/providers"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func populateProviderToVersion(providerToVersion map[string]uint16) map[string]uint16 {

internal/wireguard/address_test.go

@@ -5,9 +5,9 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_AddAddresses(t *testing.T) {

internal/wireguard/log_mock_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/wireguard (interfaces: Logger)
+//
+// Generated by this command:
+//
+//	mockgen -destination=log_mock_test.go -package wireguard . Logger
+//
 
 // Package wireguard is a generated GoMock package.
 package wireguard
@@ -7,13 +12,14 @@ package wireguard
 import (
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockLogger is a mock of Logger interface.
 type MockLogger struct {
 	ctrl     *gomock.Controller
 	recorder *MockLoggerMockRecorder
+	isgomock struct{}
 }
 
 // MockLoggerMockRecorder is the mock recorder for MockLogger.
@@ -34,71 +40,71 @@ func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
 }
 
 // Debug mocks base method.
-func (m *MockLogger) Debug(arg0 string) {
+func (m *MockLogger) Debug(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Debug", arg0)
+	m.ctrl.Call(m, "Debug", s)
 }
 
 // Debug indicates an expected call of Debug.
-func (mr *MockLoggerMockRecorder) Debug(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debug(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), s)
 }
 
 // Debugf mocks base method.
-func (m *MockLogger) Debugf(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Debugf(format string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{format}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Debugf", varargs...)
 }
 
 // Debugf indicates an expected call of Debugf.
-func (mr *MockLoggerMockRecorder) Debugf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Debugf(format any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debugf", reflect.TypeOf((*MockLogger)(nil).Debugf), varargs...)
 }
 
 // Error mocks base method.
-func (m *MockLogger) Error(arg0 string) {
+func (m *MockLogger) Error(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Error", arg0)
+	m.ctrl.Call(m, "Error", s)
 }
 
 // Error indicates an expected call of Error.
-func (mr *MockLoggerMockRecorder) Error(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Error(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Error", reflect.TypeOf((*MockLogger)(nil).Error), s)
 }
 
 // Errorf mocks base method.
-func (m *MockLogger) Errorf(arg0 string, arg1 ...interface{}) {
+func (m *MockLogger) Errorf(format string, args ...any) {
 	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0}
-	for _, a := range arg1 {
+	varargs := []any{format}
+	for _, a := range args {
 		varargs = append(varargs, a)
 	}
 	m.ctrl.Call(m, "Errorf", varargs...)
 }
 
 // Errorf indicates an expected call of Errorf.
-func (mr *MockLoggerMockRecorder) Errorf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Errorf(format any, args ...any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0}, arg1...)
+	varargs := append([]any{format}, args...)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Errorf", reflect.TypeOf((*MockLogger)(nil).Errorf), varargs...)
 }
 
 // Info mocks base method.
-func (m *MockLogger) Info(arg0 string) {
+func (m *MockLogger) Info(s string) {
 	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Info", arg0)
+	m.ctrl.Call(m, "Info", s)
 }
 
 // Info indicates an expected call of Info.
-func (mr *MockLoggerMockRecorder) Info(arg0 interface{}) *gomock.Call {
+func (mr *MockLoggerMockRecorder) Info(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), s)
 }

internal/wireguard/log_test.go

@@ -3,7 +3,7 @@ package wireguard
 import (
 	"testing"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_makeDeviceLogger(t *testing.T) {

internal/wireguard/netlinker_mock_test.go

@@ -1,5 +1,10 @@
 // Code generated by MockGen. DO NOT EDIT.
 // Source: github.com/qdm12/gluetun/internal/wireguard (interfaces: NetLinker)
+//
+// Generated by this command:
+//
+//	mockgen -destination=netlinker_mock_test.go -package wireguard . NetLinker
+//
 
 // Package wireguard is a generated GoMock package.
 package wireguard
@@ -8,14 +13,15 @@ import (
 	netip "net/netip"
 	reflect "reflect"
 
-	gomock "github.com/golang/mock/gomock"
 	netlink "github.com/qdm12/gluetun/internal/netlink"
+	gomock "go.uber.org/mock/gomock"
 )
 
 // MockNetLinker is a mock of NetLinker interface.
 type MockNetLinker struct {
 	ctrl     *gomock.Controller
 	recorder *MockNetLinkerMockRecorder
+	isgomock struct{}
 }
 
 // MockNetLinkerMockRecorder is the mock recorder for MockNetLinker.
@@ -36,17 +42,17 @@ func (m *MockNetLinker) EXPECT() *MockNetLinkerMockRecorder {
 }
 
 // AddrReplace mocks base method.
-func (m *MockNetLinker) AddrReplace(arg0 uint32, arg1 netip.Prefix) error {
+func (m *MockNetLinker) AddrReplace(linkIndex uint32, addr netip.Prefix) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AddrReplace", arg0, arg1)
+	ret := m.ctrl.Call(m, "AddrReplace", linkIndex, addr)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // AddrReplace indicates an expected call of AddrReplace.
-func (mr *MockNetLinkerMockRecorder) AddrReplace(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) AddrReplace(linkIndex, addr any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrReplace", reflect.TypeOf((*MockNetLinker)(nil).AddrReplace), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddrReplace", reflect.TypeOf((*MockNetLinker)(nil).AddrReplace), linkIndex, addr)
 }
 
 // IsWireguardSupported mocks base method.
@@ -65,47 +71,47 @@ func (mr *MockNetLinkerMockRecorder) IsWireguardSupported() *gomock.Call {
 }
 
 // LinkAdd mocks base method.
-func (m *MockNetLinker) LinkAdd(arg0 netlink.Link) (uint32, error) {
+func (m *MockNetLinker) LinkAdd(link netlink.Link) (uint32, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkAdd", arg0)
+	ret := m.ctrl.Call(m, "LinkAdd", link)
 	ret0, _ := ret[0].(uint32)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // LinkAdd indicates an expected call of LinkAdd.
-func (mr *MockNetLinkerMockRecorder) LinkAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkAdd(link any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkAdd", reflect.TypeOf((*MockNetLinker)(nil).LinkAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkAdd", reflect.TypeOf((*MockNetLinker)(nil).LinkAdd), link)
 }
 
 // LinkByName mocks base method.
-func (m *MockNetLinker) LinkByName(arg0 string) (netlink.Link, error) {
+func (m *MockNetLinker) LinkByName(name string) (netlink.Link, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkByName", arg0)
+	ret := m.ctrl.Call(m, "LinkByName", name)
 	ret0, _ := ret[0].(netlink.Link)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // LinkByName indicates an expected call of LinkByName.
-func (mr *MockNetLinkerMockRecorder) LinkByName(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkByName(name any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByName", reflect.TypeOf((*MockNetLinker)(nil).LinkByName), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkByName", reflect.TypeOf((*MockNetLinker)(nil).LinkByName), name)
 }
 
 // LinkDel mocks base method.
-func (m *MockNetLinker) LinkDel(arg0 uint32) error {
+func (m *MockNetLinker) LinkDel(linkIndex uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkDel", arg0)
+	ret := m.ctrl.Call(m, "LinkDel", linkIndex)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkDel indicates an expected call of LinkDel.
-func (mr *MockNetLinkerMockRecorder) LinkDel(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkDel(linkIndex any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkDel", reflect.TypeOf((*MockNetLinker)(nil).LinkDel), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkDel", reflect.TypeOf((*MockNetLinker)(nil).LinkDel), linkIndex)
 }
 
 // LinkList mocks base method.
@@ -124,86 +130,86 @@ func (mr *MockNetLinkerMockRecorder) LinkList() *gomock.Call {
 }
 
 // LinkSetDown mocks base method.
-func (m *MockNetLinker) LinkSetDown(arg0 uint32) error {
+func (m *MockNetLinker) LinkSetDown(linkIndex uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkSetDown", arg0)
+	ret := m.ctrl.Call(m, "LinkSetDown", linkIndex)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkSetDown indicates an expected call of LinkSetDown.
-func (mr *MockNetLinkerMockRecorder) LinkSetDown(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkSetDown(linkIndex any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetDown", reflect.TypeOf((*MockNetLinker)(nil).LinkSetDown), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetDown", reflect.TypeOf((*MockNetLinker)(nil).LinkSetDown), linkIndex)
 }
 
 // LinkSetUp mocks base method.
-func (m *MockNetLinker) LinkSetUp(arg0 uint32) error {
+func (m *MockNetLinker) LinkSetUp(linkIndex uint32) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "LinkSetUp", arg0)
+	ret := m.ctrl.Call(m, "LinkSetUp", linkIndex)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // LinkSetUp indicates an expected call of LinkSetUp.
-func (mr *MockNetLinkerMockRecorder) LinkSetUp(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) LinkSetUp(linkIndex any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetUp", reflect.TypeOf((*MockNetLinker)(nil).LinkSetUp), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LinkSetUp", reflect.TypeOf((*MockNetLinker)(nil).LinkSetUp), linkIndex)
 }
 
 // RouteAdd mocks base method.
-func (m *MockNetLinker) RouteAdd(arg0 netlink.Route) error {
+func (m *MockNetLinker) RouteAdd(route netlink.Route) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteAdd", arg0)
+	ret := m.ctrl.Call(m, "RouteAdd", route)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RouteAdd indicates an expected call of RouteAdd.
-func (mr *MockNetLinkerMockRecorder) RouteAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteAdd(route any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteAdd", reflect.TypeOf((*MockNetLinker)(nil).RouteAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteAdd", reflect.TypeOf((*MockNetLinker)(nil).RouteAdd), route)
 }
 
 // RouteList mocks base method.
-func (m *MockNetLinker) RouteList(arg0 byte) ([]netlink.Route, error) {
+func (m *MockNetLinker) RouteList(family uint8) ([]netlink.Route, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RouteList", arg0)
+	ret := m.ctrl.Call(m, "RouteList", family)
 	ret0, _ := ret[0].([]netlink.Route)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RouteList indicates an expected call of RouteList.
-func (mr *MockNetLinkerMockRecorder) RouteList(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RouteList(family any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteList", reflect.TypeOf((*MockNetLinker)(nil).RouteList), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RouteList", reflect.TypeOf((*MockNetLinker)(nil).RouteList), family)
 }
 
 // RuleAdd mocks base method.
-func (m *MockNetLinker) RuleAdd(arg0 netlink.Rule) error {
+func (m *MockNetLinker) RuleAdd(rule netlink.Rule) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuleAdd", arg0)
+	ret := m.ctrl.Call(m, "RuleAdd", rule)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RuleAdd indicates an expected call of RuleAdd.
-func (mr *MockNetLinkerMockRecorder) RuleAdd(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RuleAdd(rule any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleAdd", reflect.TypeOf((*MockNetLinker)(nil).RuleAdd), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleAdd", reflect.TypeOf((*MockNetLinker)(nil).RuleAdd), rule)
 }
 
 // RuleDel mocks base method.
-func (m *MockNetLinker) RuleDel(arg0 netlink.Rule) error {
+func (m *MockNetLinker) RuleDel(rule netlink.Rule) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuleDel", arg0)
+	ret := m.ctrl.Call(m, "RuleDel", rule)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // RuleDel indicates an expected call of RuleDel.
-func (mr *MockNetLinkerMockRecorder) RuleDel(arg0 interface{}) *gomock.Call {
+func (mr *MockNetLinkerMockRecorder) RuleDel(rule any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleDel", reflect.TypeOf((*MockNetLinker)(nil).RuleDel), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuleDel", reflect.TypeOf((*MockNetLinker)(nil).RuleDel), rule)
 }

internal/wireguard/route_test.go

@@ -5,10 +5,10 @@ import (
 	"net/netip"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/netlink"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_addRoute(t *testing.T) {

internal/wireguard/rule_test.go

@@ -4,10 +4,10 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/netlink"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/mock/gomock"
 )
 
 func Test_AddRule(t *testing.T) {