Chore(deps): Bump golang.org/x/net from 0.55.0 to 0.57.0

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.55.0 to 0.57.0. - [Commits](https://github.com/golang/net/compare/v0.55.0...v0.57.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
chore(tests): migrate to use go.uber.org/mock instead of github.com/golang/mock
2026-07-22 10:26:26 +02:00 · 2026-07-19 13:18:37 +00:00 · 2026-07-19 13:16:15 +00:00
20 changed files with 26 additions and 1035 deletions
@@ -67,10 +67,6 @@ jobs:
          -v "$(pwd)/coverage.txt:/tmp/gobuild/coverage.txt" \
          test-container

-      - name: Run integration tests in test container
-        run: |
-          docker run --rm --entrypoint go test-container test -tags=integration ./internal/restrictednet
-
      - name: Verify dev cross platform compatibility
        run: docker build --target xcompile .

@@ -85,13 +81,13 @@ jobs:
    steps:
      - uses: actions/checkout@v6

-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
          go-version-file: ./devrun/go.mod
      - run: go test ./...
        working-directory: ./devrun

-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
          go-version-file: ./ci/go.mod
      - run: go test ./...
@@ -114,7 +110,7 @@ jobs:
      - run: docker build -t qmcgaw/gluetun .

      - name: Setup Go for CI utility
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
        with:
          go-version-file: ci/go.mod

@@ -162,7 +158,7 @@ jobs:
      security-events: write
    steps:
      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - uses: github/codeql-action/init@v4
@@ -50,7 +50,6 @@ Guidance for coding agents working in this repository.
 - Prefer splitting a code line only when it triggers the `lll` linter, do not split a command or arguments list for each element
 - Use `netip` types instead of `net` types whenever possible
 - Use constants instead of variables whenever possible, especially function-local inline constants.
- Prefer using pure functions over methods when possible. Especially if the method does not need any fields from the receiving struct, it should be a pure function.
 - Do not use `time.Sleep`, prefer using a `time.Timer` with a `select` statement also listening on a context cancelation
 - `panic`:
  - should only be used when a programming error is encountered and you should NOT return errors for programming errors (such as passing nil objects)
@@ -116,7 +115,6 @@ Mocking works with the `go.uber.org/mock` library, and the `mockgen` tool.
  - **Never** use `.AnyTimes()` on mocks. Always define the number of times a certain mock call should be called, with `.Times(3)` for example.
  - **Always** set the `.Return(...)` on the mock if the function returns something.
  - Avoid using **mock helpers** functions, prefer a bit of repetition than tight coupling and dependency
-  - Always define the gomock controller `ctrl` in the subtest and not in the parent test, or a subtest mock failing will crash all the other subtests.

 ### main.go

@@ -129,7 +127,6 @@ The Go formatter used is gofumpt.
 ### Errors

 - Always prefer wrapping errors with some context with `fmt.Errorf("doing this: %w", err)`
- Use `errors.New("error message")` when creating a 'bottom' constant string error without additional context, instead of `fmt.Errorf`
 - In rare cases, you can just use `return err` notably:
  - If the function is called **recursively**, since we don't wrap the wrapping multiple times for each recursion
  - If the current function only statement is the call to another function, for example:
@@ -182,8 +179,6 @@ The Go formatter used is gofumpt.

 - Do not use `http.DefaultClient`, use a custom `*http.Client` with a fixed timeout and share with dependency injections.
 - Do not check for injected dependencies being `nil`, prefer to just panic on a nil pointer. By default it's fine to panic if a developer injects a dependency `nil`. `nil` does not mean use a default.
- Prefer using a `switch { case ...}` statement over multiple consecutive `if` statements to have shorter code.
- Prefer using `[...]T` instead of `[]T` when the length is fixed and known at compile time, to avoid unnecessary allocations.

 ## Validation checklist

@@ -3,7 +3,7 @@ ARG GO_ALPINE_VERSION=3.23
 ARG GO_VERSION=1.25
 ARG XCPUTRANSLATE_VERSION=v0.9.0
 ARG GOLANGCI_LINT_VERSION=v2.4.0
-ARG MOCKGEN_VERSION=v0.6.0
+ARG MOCKGEN_VERSION=v1.6.0
 ARG BUILDPLATFORM=linux/amd64

 FROM --platform=${BUILDPLATFORM} ghcr.io/qdm12/xcputranslate:${XCPUTRANSLATE_VERSION} AS xcputranslate
@@ -28,9 +28,9 @@ require (
 	github.com/ulikunitz/xz v0.5.15
 	github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a
 	go.uber.org/mock v0.6.0
-	golang.org/x/net v0.55.0
-	golang.org/x/sys v0.45.0
-	golang.org/x/text v0.38.0
+	golang.org/x/net v0.57.0
+	golang.org/x/sys v0.47.0
+	golang.org/x/text v0.40.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
 	gopkg.in/ini.v1 v1.67.1
@@ -56,11 +56,11 @@ require (
 	github.com/prometheus/common v0.60.1 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c // indirect
-	golang.org/x/mod v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/protobuf v1.35.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -120,27 +120,27 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c h1:7dEasQXItcW1xKJ2+gg5VOiBnqWrJc+rq0DPKyvvdbY=
 golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c/go.mod h1:NQtJDoLvd6faHhE7m4T/1IY708gDefGGjR/iUW8yQQ8=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -151,8 +151,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -162,16 +162,16 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
 golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
@@ -28,8 +28,6 @@ type firewallImpl interface { //nolint:interfacebloat
 	AcceptIpv6MulticastOutput(ctx context.Context, intf string) error
 	AcceptOutput(ctx context.Context, protocol, intf string,
 		ip netip.Addr, port uint16, remove bool) error
-	AcceptOutputFromIPPortToIPPort(ctx context.Context, protocol, intf string,
-		source, destination netip.AddrPort, remove bool) error
 	AcceptOutputFromIPToSubnet(ctx context.Context, intf string, assignedIP netip.Addr,
 		subnet netip.Prefix, remove bool) error
 	AcceptOutputThroughInterface(ctx context.Context, intf string, remove bool) error
@@ -2,7 +2,6 @@ package iptables

 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"net/netip"
@@ -178,29 +177,6 @@ func (c *Config) AcceptOutput(ctx context.Context,
 	return c.runIP6tablesInstruction(ctx, instruction)
 }

-func (c *Config) AcceptOutputFromIPPortToIPPort(ctx context.Context,
-	protocol, intf string, source, destination netip.AddrPort, remove bool,
-) error {
-	if source.Addr().BitLen() != destination.Addr().BitLen() {
-		return errors.New("source and destination address families do not match")
-	}
-
-	interfaceFlag := "-o " + intf
-	if intf == "*" { // all interfaces
-		interfaceFlag = ""
-	}
-
-	instruction := fmt.Sprintf("%s OUTPUT %s -s %s -d %s -p %s -m %s --sport %d --dport %d -j ACCEPT",
-		appendOrDelete(remove), interfaceFlag, source.Addr(), destination.Addr(),
-		protocol, protocol, source.Port(), destination.Port())
-	if destination.Addr().Is4() {
-		return c.runIptablesInstruction(ctx, instruction)
-	} else if c.ip6Tables == "" {
-		return fmt.Errorf("accept output from %s to %s: %s", source, destination, needIP6Tables)
-	}
-	return c.runIP6tablesInstruction(ctx, instruction)
-}
-
 // AcceptOutputFromIPToSubnet accepts outgoing traffic from sourceIP to destinationSubnet
 // on the interface intf. If intf is empty, it is set to "*" which means all interfaces.
 // If remove is true, the rule is removed instead of added.
@@ -25,10 +25,3 @@ func (c *Config) AcceptOutput(ctx context.Context, protocol, intf string,
 ) error {
 	return c.impl.AcceptOutput(ctx, protocol, intf, ip, port, remove)
 }
-
-func (c *Config) AcceptOutputFromIPPortToIPPort(ctx context.Context,
-	protocol, intf string, source, destination netip.AddrPort, remove bool,
-) error {
-	return c.impl.AcceptOutputFromIPPortToIPPort(ctx, protocol, intf,
-		source, destination, remove)
-}
@@ -1,82 +0,0 @@
-package restrictednet
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/netip"
-	"strconv"
-
-	"github.com/qdm12/dns/v2/pkg/provider"
-)
-
-// Client is a client for making restricted network requests,
-// such as opening temporary firewall rules for HTTPS connections.
-// It is not meant to be high performance, although it can be used for
-// multiple requests and concurrently.
-type Client struct {
-	outboundInterface string
-	ipv6Supported     bool
-	firewall          Firewall
-	dohServers        []provider.DoHServer
-}
-
-func New(settings Settings) *Client {
-	if err := settings.validate(); err != nil {
-		panic(fmt.Sprintf("invalid settings: %v", err)) // programming error
-	}
-	dohServers := make([]provider.DoHServer, len(settings.UpstreamResolvers))
-	for i, upstreamResolver := range settings.UpstreamResolvers {
-		dohServers[i] = upstreamResolver.DoH
-	}
-
-	return &Client{
-		outboundInterface: settings.DefaultInterface,
-		ipv6Supported:     *settings.IPv6Supported,
-		firewall:          settings.Firewall,
-		dohServers:        dohServers,
-	}
-}
-
-// OpenHTTPSByHostname opens an https connection through the firewall,
-// to the hostname which in the format `host:port`. The returned cleanup
-// function must be called to remove the temporary firewall rule and close connections.
-// It first resolves the domain in hostname using DNS over HTTPS and then opens
-// the restricted HTTPS connection to the resolved IP.
-func (c *Client) OpenHTTPSByHostname(ctx context.Context, hostname string) (
-	httpClient *http.Client, cleanup func() error, err error,
-) {
-	host, portStr, err := net.SplitHostPort(hostname)
-	if err != nil {
-		return nil, nil, fmt.Errorf("splitting host and port: %w", err)
-	}
-	resolvedIPs, err := c.ResolveName(ctx, host)
-	if err != nil {
-		return nil, nil, fmt.Errorf("resolving name: %w", err)
-	} else if len(resolvedIPs) == 0 {
-		return nil, nil, fmt.Errorf("no IP address found for name %q", host)
-	}
-
-	portUint, err := strconv.ParseUint(portStr, 10, 16)
-	if err != nil {
-		return nil, nil, fmt.Errorf("parsing port: %w", err)
-	} else if portUint == 0 {
-		return nil, nil, errors.New("destination port cannot be 0")
-	}
-	port := uint16(portUint)
-
-	errs := make([]error, 0, len(resolvedIPs))
-	for _, ip := range resolvedIPs {
-		addrPort := netip.AddrPortFrom(ip, port)
-		httpClient, cleanup, err := c.OpenHTTPS(ctx, host, addrPort)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("for %s: %w", ip, err))
-			continue
-		}
-		return httpClient, cleanup, nil
-	}
-
-	return nil, nil, fmt.Errorf("opening HTTPS to %s: %w", hostname, errors.Join(errs...))
-}
@@ -1,7 +0,0 @@
-//go:build integration
-
-package restrictednet
-
-func ptrTo[T any](value T) *T {
-	return &value
-}
@@ -1,202 +0,0 @@
-package restrictednet
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/netip"
-	"os"
-	"time"
-
-	"github.com/jsimonetti/rtnetlink"
-	"github.com/qdm12/gluetun/internal/pmtud/constants"
-)
-
-// OpenHTTPS opens temporary restrictive firewall output for one HTTPS destination.
-// The returned [*http.Client] must be used sequentially only, and each request must
-// have its response body fully read/discarded and then closed.
-// The returned cleanup function must be called to remove the temporary firewall rule and close connections.
-func (c *Client) OpenHTTPS(ctx context.Context, destinationTLSName string, destinationAddrPort netip.AddrPort,
-) (httpClient *http.Client, cleanup func() error, err error) {
-	fd, sourceAddrPort, err := bindSourceConnection(destinationAddrPort.Addr())
-	if err != nil {
-		return nil, nil, fmt.Errorf("binding source port: %w", err)
-	}
-
-	const remove = false
-	err = c.firewall.AcceptOutputFromIPPortToIPPort(ctx, "tcp", c.outboundInterface,
-		sourceAddrPort, destinationAddrPort, remove)
-	if err != nil {
-		closeFD(fd)
-		return nil, nil, fmt.Errorf("allowing output traffic through firewall: %w", err)
-	}
-
-	connection, err := connectSourceConnection(ctx, fd, destinationAddrPort)
-	if err != nil {
-		const remove = true
-		_ = c.firewall.AcceptOutputFromIPPortToIPPort(context.Background(), "tcp", c.outboundInterface,
-			sourceAddrPort, destinationAddrPort, remove)
-		return nil, nil, fmt.Errorf("connecting source socket: %w", err)
-	}
-
-	dial := makeDial(connection, destinationTLSName)
-	httpClient = newHTTPSClient(destinationTLSName, dial)
-	cleanup = func() error {
-		var errs []error
-		httpClient.CloseIdleConnections()
-		err := connection.Close()
-		if err != nil && !errors.Is(err, net.ErrClosed) {
-			errs = append(errs, fmt.Errorf("closing connection: %w", err))
-		}
-		const remove = true
-		err = c.firewall.AcceptOutputFromIPPortToIPPort(context.Background(), "tcp", c.outboundInterface,
-			sourceAddrPort, destinationAddrPort, remove)
-		if err != nil {
-			errs = append(errs, fmt.Errorf("removing output traffic rule: %w", err))
-		}
-		if len(errs) > 0 {
-			return errors.Join(errs...)
-		}
-		return nil
-	}
-	return httpClient, cleanup, nil
-}
-
-type dialFunc func(ctx context.Context, network, address string) (net.Conn, error)
-
-func newHTTPSClient(destinationTLSName string, dial dialFunc) *http.Client {
-	const timeout = 5 * time.Second
-	transport := &http.Transport{
-		MaxIdleConns:        1,
-		MaxIdleConnsPerHost: 1,
-		MaxConnsPerHost:     1,
-		TLSClientConfig: &tls.Config{
-			MinVersion: tls.VersionTLS12,
-			ServerName: destinationTLSName,
-		},
-		DialContext: dial,
-	}
-	return &http.Client{
-		Timeout:   timeout,
-		Transport: transport,
-	}
-}
-
-func makeDial(connection net.Conn, tlsName string) dialFunc {
-	_, destinationPort, err := net.SplitHostPort(connection.RemoteAddr().String())
-	if err != nil {
-		panic(err) // connection remote address should always be in the form "host:port"
-	}
-	expectedAddress := net.JoinHostPort(tlsName, destinationPort)
-	used := false
-	return func(_ context.Context, network, address string) (net.Conn, error) {
-		if used {
-			return nil, errors.New("dial function called more than once")
-		}
-		used = true
-		switch network {
-		case "tcp", "tcp4", "tcp6":
-		default:
-			return nil, fmt.Errorf("unexpected dial network %q", network)
-		}
-		if address != expectedAddress {
-			return nil, fmt.Errorf("unexpected dial address %q (expected %q)", address, expectedAddress)
-		}
-		return connection, nil
-	}
-}
-
-func bindSourceConnection(destinationIP netip.Addr) (fd int, sourceAddr netip.AddrPort, err error) {
-	sourceIP, err := sourceIPForDestination(destinationIP)
-	if err != nil {
-		return 0, netip.AddrPort{}, fmt.Errorf("finding source IP: %w", err)
-	}
-
-	family := constants.AF_INET
-	if sourceIP.Is6() {
-		family = constants.AF_INET6
-	}
-
-	fd, err = newTCPSockStream(family)
-	if err != nil {
-		return 0, netip.AddrPort{}, fmt.Errorf("creating socket: %w", err)
-	}
-
-	bindAddrPort := netip.AddrPortFrom(sourceIP, 0)
-	err = bindFD(fd, bindAddrPort)
-	if err != nil {
-		closeFD(fd)
-		return 0, netip.AddrPort{}, fmt.Errorf("binding socket: %w", err)
-	}
-
-	sourceAddr, err = fdToSourceAddr(fd)
-	if err != nil {
-		closeFD(fd)
-		return 0, netip.AddrPort{}, fmt.Errorf("getting source address: %w", err)
-	}
-
-	return fd, sourceAddr, nil
-}
-
-func connectSourceConnection(ctx context.Context, fd int, destinationAddrPort netip.AddrPort) (
-	connection net.Conn, err error,
-) {
-	err = connectFD(ctx, fd, destinationAddrPort)
-	if err != nil {
-		closeFD(fd)
-		return nil, fmt.Errorf("connecting socket: %w", err)
-	}
-
-	file := os.NewFile(uintptr(fd), "")
-	if file == nil {
-		closeFD(fd)
-		return nil, fmt.Errorf("creating socket file for destination %s", destinationAddrPort)
-	}
-	defer file.Close()
-
-	connection, err = net.FileConn(file)
-	if err != nil {
-		return nil, fmt.Errorf("wrapping socket connection: %w", err)
-	}
-
-	return connection, nil
-}
-
-func sourceIPForDestination(destinationIP netip.Addr) (srcIP netip.Addr, err error) {
-	conn, err := rtnetlink.Dial(nil)
-	if err != nil {
-		return netip.Addr{}, err
-	}
-	defer conn.Close()
-
-	family := uint8(constants.AF_INET)
-	if destinationIP.Is6() {
-		family = constants.AF_INET6
-	}
-
-	requestMessage := &rtnetlink.RouteMessage{
-		Family: family,
-		Attributes: rtnetlink.RouteAttributes{
-			Dst: destinationIP.AsSlice(),
-		},
-	}
-	messages, err := conn.Route.Get(requestMessage)
-	if err != nil {
-		return netip.Addr{}, fmt.Errorf("getting routes to %s: %w", destinationIP, err)
-	}
-
-	for _, message := range messages {
-		if message.Attributes.Src == nil {
-			continue
-		}
-		if message.Attributes.Src.To4() == nil {
-			return netip.AddrFrom16([16]byte(message.Attributes.Src)), nil
-		}
-		return netip.AddrFrom4([4]byte(message.Attributes.Src)), nil
-	}
-
-	return netip.Addr{}, fmt.Errorf("no route to %s", destinationIP)
-}
@@ -1,117 +0,0 @@
-//go:build integration
-
-package restrictednet
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"net/netip"
-	"testing"
-
-	"github.com/qdm12/dns/v2/pkg/provider"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
-)
-
-type listenAddrPortMatcher struct {
-	expected netip.AddrPort
-}
-
-func (m listenAddrPortMatcher) Matches(x any) bool {
-	ip, ok := x.(netip.AddrPort)
-	if !ok {
-		return false
-	}
-	if m.expected.IsValid() {
-		return ip == m.expected
-	}
-	return ip.IsValid() && ip.Addr().IsValid() && ip.Port() > 0
-}
-
-func (m listenAddrPortMatcher) String() string {
-	if m.expected.IsValid() {
-		return "is the same as " + m.expected.String()
-	}
-	return "is a valid netip.AddrPort with a valid IP and non-zero port"
-}
-
-type destinationAddrPortMatcher struct {
-	expected netip.AddrPort
-}
-
-func (m destinationAddrPortMatcher) Matches(x any) bool {
-	ip, ok := x.(netip.AddrPort)
-	if !ok {
-		return false
-	}
-	if m.expected.IsValid() {
-		return ip == m.expected
-	}
-	return ip.IsValid() && ip.Port() == m.expected.Port()
-}
-
-func (m destinationAddrPortMatcher) String() string {
-	if m.expected.IsValid() {
-		return "is the same as " + m.expected.String()
-	}
-	return "matches the port " + fmt.Sprint(m.expected.Port())
-}
-
-func Test_Client_OpenHTTPS(t *testing.T) {
-	t.Parallel()
-	ctx := t.Context()
-	ctrl := gomock.NewController(t)
-
-	const destinationTLSName = "one.one.one.one"
-	destinationAddrPort := netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 443)
-
-	firewall := NewMockFirewall(ctrl)
-	sourceMatcher := listenAddrPortMatcher{}
-	firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
-		ctx, "tcp", "eth0", sourceMatcher, destinationAddrPort, false,
-	).DoAndReturn(func(_ context.Context,
-		_, _ string, source, _ netip.AddrPort, _ bool,
-	) error {
-		sourceMatcher.expected = source
-		return nil
-	})
-	firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
-		context.Background(), "tcp", "eth0", sourceMatcher, destinationAddrPort, true,
-	).Return(nil)
-
-	const ipv6Supported = false
-	upstreamResolvers := []provider.Provider{provider.Google()}
-	settings := Settings{
-		Firewall:          firewall,
-		DefaultInterface:  "eth0",
-		IPv6Supported:     ptrTo(ipv6Supported),
-		UpstreamResolvers: upstreamResolvers,
-	}
-	client := New(settings)
-
-	httpClient, cleanup, err := client.OpenHTTPS(ctx, destinationTLSName, destinationAddrPort)
-	require.NoError(t, err)
-	require.NotNil(t, httpClient)
-	require.NotNil(t, cleanup)
-
-	const requests = 2
-
-	for range requests {
-		request, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://"+destinationTLSName, nil)
-		require.NoError(t, err)
-
-		response, err := httpClient.Do(request)
-		require.NoError(t, err)
-		_, err = io.Copy(io.Discard, response.Body)
-		require.NoError(t, err)
-		err = response.Body.Close()
-		require.NoError(t, err)
-		assert.Equal(t, http.StatusOK, response.StatusCode)
-	}
-
-	err = cleanup()
-	require.NoError(t, err)
-}
@@ -1,12 +0,0 @@
-package restrictednet
-
-import (
-	"context"
-	"net/netip"
-)
-
-type Firewall interface {
-	AcceptOutputFromIPPortToIPPort(ctx context.Context,
-		protocol, intf string, source, destination netip.AddrPort, remove bool,
-	) error
-}
@@ -1,121 +0,0 @@
-//go:build linux
-
-package restrictednet
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/netip"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-func closeFD(fd int) {
-	unix.Close(fd)
-}
-
-func newTCPSockStream(family int) (fd int, err error) {
-	fd, err = unix.Socket(family, unix.SOCK_STREAM, unix.IPPROTO_TCP)
-	if err != nil {
-		return 0, err
-	}
-	err = unix.SetNonblock(fd, true)
-	if err != nil {
-		_ = unix.Close(fd)
-		return 0, err
-	}
-	return fd, nil
-}
-
-func bindFD(fd int, address netip.AddrPort) error {
-	bindAddr := makeSockAddr(address)
-	return unix.Bind(fd, bindAddr)
-}
-
-func connectFD(ctx context.Context, fd int, destination netip.AddrPort) error {
-	err := unix.Connect(fd, makeSockAddr(destination))
-	switch {
-	case err == nil:
-		return nil
-	case !errors.Is(err, unix.EINPROGRESS):
-		return err
-	}
-
-	for {
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		default:
-			bitsIndex := fd / 64 //nolint:mnd
-			if bitsIndex >= len(unix.FdSet{}.Bits) {
-				return fmt.Errorf("fd %d exceeds unix.Select FdSet capacity", fd)
-			}
-			wset := &unix.FdSet{}
-			wset.Bits[bitsIndex] |= 1 << (uint64(fd) % 64) //nolint:gosec,mnd
-			eset := &unix.FdSet{}
-			eset.Bits[bitsIndex] |= 1 << (uint64(fd) % 64) //nolint:gosec,mnd
-			const selectTimeout = 50 * time.Millisecond
-			timeval := unix.NsecToTimeval(int64(selectTimeout))
-
-			// Wait for the FD to become writable or hit an error state
-			n, err := unix.Select(fd+1, nil, wset, eset, &timeval)
-			if err != nil {
-				if errors.Is(err, unix.EINTR) {
-					continue // Syscall interrupted, try again
-				}
-				return fmt.Errorf("select error: %w", err)
-			} else if n == 0 {
-				continue // no status change yet
-			}
-
-			// Check if the socket encountered an error
-			n, err = unix.GetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_ERROR)
-			if err != nil {
-				return fmt.Errorf("getsockopt error: %w", err)
-			} else if n != 0 {
-				return fmt.Errorf("connect failed asynchronously: %w", unix.Errno(n))
-			}
-
-			return nil
-		}
-	}
-}
-
-func fdToSourceAddr(fd int) (sourceAddrPort netip.AddrPort, err error) {
-	sockAddr, err := unix.Getsockname(fd)
-	if err != nil {
-		return netip.AddrPort{}, fmt.Errorf("getting sockname: %w", err)
-	}
-
-	sourceAddrPort, err = sockAddrToAddrPort(sockAddr)
-	if err != nil {
-		return netip.AddrPort{}, err
-	}
-	return sourceAddrPort, nil
-}
-
-func makeSockAddr(addressPort netip.AddrPort) unix.Sockaddr {
-	if addressPort.Addr().Is4() {
-		return &unix.SockaddrInet4{
-			Port: int(addressPort.Port()),
-			Addr: addressPort.Addr().As4(),
-		}
-	}
-	return &unix.SockaddrInet6{
-		Port: int(addressPort.Port()),
-		Addr: addressPort.Addr().As16(),
-	}
-}
-
-func sockAddrToAddrPort(sockAddr unix.Sockaddr) (addrPort netip.AddrPort, err error) {
-	switch typedSockAddr := sockAddr.(type) {
-	case *unix.SockaddrInet4:
-		return netip.AddrPortFrom(netip.AddrFrom4(typedSockAddr.Addr), uint16(typedSockAddr.Port)), nil //nolint:gosec
-	case *unix.SockaddrInet6:
-		return netip.AddrPortFrom(netip.AddrFrom16(typedSockAddr.Addr), uint16(typedSockAddr.Port)), nil //nolint:gosec
-	default:
-		return netip.AddrPort{}, fmt.Errorf("unexpected socket address type %T", typedSockAddr)
-	}
-}
@@ -1,3 +0,0 @@
-package restrictednet
-
-//go:generate mockgen -destination=mocks_test.go -package=$GOPACKAGE . Firewall
@@ -1,56 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/qdm12/gluetun/internal/restrictednet (interfaces: Firewall)
-//
-// Generated by this command:
-//
-//	mockgen -destination=mocks_test.go -package=restrictednet . Firewall
-//
-
-// Package restrictednet is a generated GoMock package.
-package restrictednet
-
-import (
-	context "context"
-	netip "net/netip"
-	reflect "reflect"
-
-	gomock "go.uber.org/mock/gomock"
-)
-
-// MockFirewall is a mock of Firewall interface.
-type MockFirewall struct {
-	ctrl     *gomock.Controller
-	recorder *MockFirewallMockRecorder
-	isgomock struct{}
-}
-
-// MockFirewallMockRecorder is the mock recorder for MockFirewall.
-type MockFirewallMockRecorder struct {
-	mock *MockFirewall
-}
-
-// NewMockFirewall creates a new mock instance.
-func NewMockFirewall(ctrl *gomock.Controller) *MockFirewall {
-	mock := &MockFirewall{ctrl: ctrl}
-	mock.recorder = &MockFirewallMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockFirewall) EXPECT() *MockFirewallMockRecorder {
-	return m.recorder
-}
-
-// AcceptOutputFromIPPortToIPPort mocks base method.
-func (m *MockFirewall) AcceptOutputFromIPPortToIPPort(ctx context.Context, protocol, intf string, source, destination netip.AddrPort, remove bool) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AcceptOutputFromIPPortToIPPort", ctx, protocol, intf, source, destination, remove)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// AcceptOutputFromIPPortToIPPort indicates an expected call of AcceptOutputFromIPPortToIPPort.
-func (mr *MockFirewallMockRecorder) AcceptOutputFromIPPortToIPPort(ctx, protocol, intf, source, destination, remove any) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcceptOutputFromIPPortToIPPort", reflect.TypeOf((*MockFirewall)(nil).AcceptOutputFromIPPortToIPPort), ctx, protocol, intf, source, destination, remove)
-}
@@ -1,28 +0,0 @@
-//go:build !linux
-
-package restrictednet
-
-import (
-	"context"
-	"net/netip"
-)
-
-func closeFD(fd int) {
-	panic("not implemented")
-}
-
-func newTCPSockStream(family int) (fd int, err error) {
-	panic("not implemented")
-}
-
-func bindFD(fd int, address netip.AddrPort) error {
-	panic("not implemented")
-}
-
-func connectFD(ctx context.Context, fd int, destination netip.AddrPort) error {
-	panic("not implemented")
-}
-
-func fdToSourceAddr(fd int) (sourceAddrPort netip.AddrPort, err error) {
-	panic("not implemented")
-}
@@ -1,201 +0,0 @@
-package restrictednet
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"strconv"
-
-	"github.com/miekg/dns"
-)
-
-// ResolveName resolves the given host name to IP addresses using DoH servers,
-// while opening temporary restrictive firewall rules for HTTPS traffic to DoH servers.
-// The host must be a single well-formed domain name, without port or path.
-func (c *Client) ResolveName(ctx context.Context, host string) (
-	resolvedAddresses []netip.Addr, err error,
-) {
-	const maxTypes = 2
-	questionTypes := make([]uint16, 0, maxTypes)
-	if c.ipv6Supported {
-		questionTypes = append(questionTypes, dns.TypeAAAA)
-	}
-	questionTypes = append(questionTypes, dns.TypeA)
-
-	var addresses []netip.Addr
-	errs := make([]error, 0, len(questionTypes))
-	for _, questionType := range questionTypes {
-		answerAddresses, err := c.resolveOneQuestionType(ctx, host, questionType)
-		if err != nil {
-			errs = append(errs, err)
-			continue
-		}
-		addresses = append(addresses, answerAddresses...)
-	}
-
-	switch {
-	case len(addresses) > 0:
-		return addresses, nil
-	case len(errs) == 0:
-		return nil, nil // no address found
-	default: // errors
-		return nil, fmt.Errorf("resolving host %q: %w", host, errors.Join(errs...))
-	}
-}
-
-func (c *Client) resolveOneQuestionType(ctx context.Context,
-	host string, questionType uint16,
-) (addresses []netip.Addr, err error) {
-	queryMessage := &dns.Msg{}
-	queryMessage.SetQuestion(dns.Fqdn(host), questionType)
-	queryWire, err := queryMessage.Pack()
-	if err != nil {
-		return nil, fmt.Errorf("packing DNS query: %w", err)
-	}
-
-	// Try every DoH server and every of each of their IP until we get a non-empty
-	// successful response.
-	errs := make([]error, 0)
-	for _, dohServer := range c.dohServers {
-		dohURL, err := url.Parse(dohServer.URL)
-		if err != nil {
-			errs = append(errs,
-				fmt.Errorf("parsing DoH server URL %s: %w", dohServer.URL, err))
-			continue
-		}
-
-		dohServerIPs := make([]netip.Addr, 0, len(dohServer.IPv4)+len(dohServer.IPv6))
-		if c.ipv6Supported {
-			// Prefer IPv6 addresses if IPv6 is supported
-			dohServerIPs = append(dohServerIPs, dohServer.IPv6...)
-		}
-		dohServerIPs = append(dohServerIPs, dohServer.IPv4...)
-
-		for _, dohServerIP := range dohServerIPs {
-			const defaultDoHPort uint16 = 443
-			port := defaultDoHPort
-			if portStr := dohURL.Port(); portStr != "" {
-				port, err = parseDestinationPort(portStr)
-				if err != nil {
-					errs = append(errs, fmt.Errorf("parsing DoH server port: %w", err))
-					continue
-				}
-			}
-			dohServerAddrPort := netip.AddrPortFrom(dohServerIP, port)
-			responseMessage, err := c.doHQuery(ctx, queryWire, dohURL, dohServerAddrPort)
-			switch {
-			case err != nil:
-				errs = append(errs, fmt.Errorf("querying DoH server %q (%s): %w",
-					dohServer.URL, dohServerAddrPort, err))
-				continue
-			case responseMessage.Rcode != dns.RcodeSuccess:
-				errs = append(errs, fmt.Errorf("querying DoH server %q (%s): DNS rcode %s",
-					dohServer.URL, dohServerAddrPort, dns.RcodeToString[responseMessage.Rcode]))
-				continue
-			}
-			addresses := answersToNetipAddrs(responseMessage)
-			if len(addresses) == 0 {
-				continue
-			}
-			return addresses, nil
-		}
-	}
-
-	if len(errs) == 0 {
-		return nil, nil
-	}
-
-	return nil, fmt.Errorf("resolving %s %s: %w",
-		dns.TypeToString[questionType], host, errors.Join(errs...))
-}
-
-func (c *Client) doHQuery(ctx context.Context, queryWire []byte,
-	dohURL *url.URL, dohServerAddrPort netip.AddrPort,
-) (responseMessage *dns.Msg, err error) {
-	httpClient, cleanup, err := c.OpenHTTPS(ctx, dohURL.Hostname(), dohServerAddrPort)
-	if err != nil {
-		return nil, fmt.Errorf("opening https connection: %w", err)
-	}
-	defer func() {
-		closeErr := cleanup()
-		if err == nil && closeErr != nil {
-			err = fmt.Errorf("cleaning up https connection: %w", closeErr)
-		}
-	}()
-
-	requestBody := bytes.NewReader(queryWire)
-	request, err := http.NewRequestWithContext(ctx, http.MethodPost, dohURL.String(), requestBody)
-	if err != nil {
-		return nil, fmt.Errorf("creating request: %w", err)
-	}
-	request.Header.Set("Content-Type", "application/dns-message")
-	request.Header.Set("Accept", "application/dns-message")
-
-	response, err := httpClient.Do(request)
-	if err != nil {
-		return nil, err
-	}
-
-	responseData, err := io.ReadAll(response.Body)
-	if err != nil {
-		_ = response.Body.Close()
-		return nil, fmt.Errorf("reading response body: %w", err)
-	}
-
-	err = response.Body.Close()
-	if err != nil {
-		return nil, fmt.Errorf("closing response body: %w", err)
-	}
-
-	if response.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("response status code is %s (data length %d)",
-			response.Status, len(responseData))
-	}
-
-	responseMessage = new(dns.Msg)
-	err = responseMessage.Unpack(responseData)
-	if err != nil {
-		return nil, fmt.Errorf("parsing DoH response: %w", err)
-	}
-
-	return responseMessage, nil
-}
-
-func answersToNetipAddrs(message *dns.Msg) (addresses []netip.Addr) {
-	if message == nil {
-		return nil
-	}
-	addresses = make([]netip.Addr, 0, len(message.Answer))
-	for _, answer := range message.Answer {
-		switch record := answer.(type) {
-		case *dns.A:
-			address, ok := netip.AddrFromSlice(record.A)
-			if ok {
-				addresses = append(addresses, address.Unmap())
-			}
-		case *dns.AAAA:
-			address, ok := netip.AddrFromSlice(record.AAAA)
-			if ok {
-				addresses = append(addresses, address)
-			}
-		}
-	}
-	return addresses
-}
-
-func parseDestinationPort(portStr string) (port uint16, err error) {
-	portUint, err := strconv.ParseUint(portStr, 10, 16)
-	if err != nil {
-		return 0, err
-	}
-
-	if portUint == 0 {
-		return 0, errors.New("port cannot be 0")
-	}
-	return uint16(portUint), nil
-}
@@ -1,110 +0,0 @@
-//go:build integration
-
-package restrictednet
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"testing"
-
-	"github.com/miekg/dns"
-	"github.com/qdm12/dns/v2/pkg/provider"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
-)
-
-func Test_Client_ResolveName(t *testing.T) {
-	t.Parallel()
-	ctx := t.Context()
-	ctrl := gomock.NewController(t)
-
-	firewall := NewMockFirewall(ctrl)
-	sourceMatcher := listenAddrPortMatcher{}
-	destinationMatcher := destinationAddrPortMatcher{
-		expected: netip.AddrPortFrom(netip.Addr{}, 443),
-	}
-
-	// Add rule
-	firstCall := firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
-		ctx, "tcp", "eth0", sourceMatcher, destinationMatcher, false,
-	).DoAndReturn(func(
-		_ context.Context, _, _ string, source, destination netip.AddrPort, _ bool,
-	) error {
-		sourceMatcher.expected = source
-		destinationMatcher.expected = destination
-		return nil
-	})
-
-	// Removal rule
-	firewall.EXPECT().AcceptOutputFromIPPortToIPPort(
-		context.Background(), "tcp", "eth0", sourceMatcher, destinationMatcher, true,
-	).Return(nil).After(firstCall)
-
-	settings := Settings{
-		DefaultInterface:  "eth0",
-		IPv6Supported:     ptrTo(false),
-		Firewall:          firewall,
-		UpstreamResolvers: []provider.Provider{provider.Cloudflare()},
-	}
-	client := New(settings)
-
-	addresses, err := client.ResolveName(ctx, "github.com")
-	require.NoError(t, err)
-	assert.NotEmpty(t, addresses)
-}
-
-func Test_answersToNetipAddrs(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]struct {
-		message  *dns.Msg
-		expected []netip.Addr
-	}{
-		"nil_message": {},
-		"no_answers": {
-			message:  &dns.Msg{},
-			expected: []netip.Addr{},
-		},
-		"a_record": {
-			message: &dns.Msg{Answer: []dns.RR{
-				&dns.A{
-					Hdr: dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeA, Class: dns.ClassINET},
-					A:   net.IP{1, 1, 1, 1},
-				},
-			}},
-			expected: []netip.Addr{netip.MustParseAddr("1.1.1.1")},
-		},
-		"aaaa_record": {
-			message: &dns.Msg{Answer: []dns.RR{
-				&dns.AAAA{
-					Hdr:  dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeAAAA, Class: dns.ClassINET},
-					AAAA: net.IP{0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0, 0, 0, 0, 0, 0, 0, 0, 0x88, 0x88},
-				},
-			}},
-			expected: []netip.Addr{netip.MustParseAddr("2001:4860:4860::8888")},
-		},
-		"mixed_records": {
-			message: &dns.Msg{Answer: []dns.RR{
-				&dns.A{
-					Hdr: dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeA, Class: dns.ClassINET},
-					A:   net.IP{1, 1, 1, 1},
-				},
-				&dns.AAAA{
-					Hdr:  dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeAAAA, Class: dns.ClassINET},
-					AAAA: net.IP{0x20, 0x01, 0x48, 0x60, 0x48, 0x60, 0, 0, 0, 0, 0, 0, 0, 0, 0x88, 0x88},
-				},
-			}},
-			expected: []netip.Addr{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2001:4860:4860::8888")},
-		},
-	}
-
-	for testName, testCase := range testCases {
-		t.Run(testName, func(t *testing.T) {
-			t.Parallel()
-			addresses := answersToNetipAddrs(testCase.message)
-			assert.Equal(t, testCase.expected, addresses)
-		})
-	}
-}
@@ -1,28 +0,0 @@
-package restrictednet
-
-import (
-	"errors"
-
-	"github.com/qdm12/dns/v2/pkg/provider"
-)
-
-type Settings struct {
-	DefaultInterface  string
-	IPv6Supported     *bool
-	Firewall          Firewall
-	UpstreamResolvers []provider.Provider
-}
-
-func (s *Settings) validate() error {
-	switch {
-	case s.DefaultInterface == "":
-		return errors.New("default interface is not set")
-	case s.IPv6Supported == nil:
-		return errors.New("IPv6 support field is not set")
-	case s.Firewall == nil:
-		return errors.New("firewall is not set")
-	case len(s.UpstreamResolvers) == 0:
-		return errors.New("no upstream resolvers provided")
-	}
-	return nil
-}