DNSModule+NE.swift

// SPDX-FileCopyrightText: 2026 Davide De Rosa
//
// SPDX-License-Identifier: GPL-3.0

import NetworkExtension

extension DNSModule: NESettingsApplying {
    public func apply(_ ctx: PartoutLoggerContext, to settings: inout NEPacketTunnelNetworkSettings) {
        let dnsSettings: NEDNSSettings
        let rawServers = servers.map(\.rawValue)

        // Former DNS settings are always overridden, even with empty servers
        switch protocolType {
        case .cleartext:
            guard !rawServers.isEmpty else {
                pp_log(ctx, .os, .info, "\t\tSkip DNS settings, cleartext requires non-empty servers")
                return
            }
            dnsSettings = NEDNSSettings(servers: rawServers)
            pp_log(ctx, .os, .info, "\t\tServers: \(servers.map { $0.asSensitiveAddress(ctx) })")
        case .https(let url):
            let specificSettings = NEDNSOverHTTPSSettings(servers: rawServers)
            specificSettings.serverURL = url
            dnsSettings = specificSettings
            pp_log(ctx, .os, .info, "\t\tServers: \(servers.map { $0.asSensitiveAddress(ctx) })")
            pp_log(ctx, .os, .info, "\t\tDoH URL: \(url.absoluteString.asSensitiveAddress(ctx))")
        case .tls(let hostname):
            let specificSettings = NEDNSOverTLSSettings(servers: rawServers)
            specificSettings.serverName = hostname
            dnsSettings = specificSettings
            pp_log(ctx, .os, .info, "\t\tServers: \(servers.map { $0.asSensitiveAddress(ctx) })")
            pp_log(ctx, .os, .info, "\t\tDoT hostname: \(hostname.asSensitiveAddress(ctx))")
        @unknown default:
            break
        }

        // Search domains
        domainName.map {
            dnsSettings.domainName = $0.rawValue
            pp_log(ctx, .os, .info, "\t\tDomain: \($0.asSensitiveAddress(ctx))")
        }
        searchDomains.map {
            var list = $0.map(\.rawValue)
            // Assume domain name to be first search domain
            if let domainName {
                list.insert(domainName.rawValue, at: 0)
            }
            guard !list.isEmpty else { return }
            dnsSettings.searchDomains = list
            pp_log(ctx, .os, .info, "\t\tSearch domains: \(list.map { $0.asSensitiveAddress(ctx) })")
        }

        // This is why we guard before setting .matchDomains:
        // https://git.zx2c4.com/wireguard-apple/commit/?id=20bdf46792905de8862ae7641e50e0f9f99ec946
        //
        let searchDomains = dnsSettings.searchDomains ?? []
        let canSetMatchDomains = !dnsSettings.servers.isEmpty || !searchDomains.isEmpty
        if canSetMatchDomains {
            //
            // Credit for .matchDomains:
            // https://github.com/WireGuard/wireguard-apple/pull/11
            //
            if let matchDomains, !matchDomains.isEmpty {
                dnsSettings.matchDomains = matchDomains.map(\.rawValue)
                // True if any search domain is in match domains
                dnsSettings.matchDomainsNoSearch = !matchDomains.contains {
                    searchDomains.contains($0.rawValue)
                }
            } else {
                // Add "" so that all DNS queries must first go through the tunnel's DNS.
                // NEDNSSettings.searchDomains does not work so we add the searches to
                // matchDomains, which does work.
                dnsSettings.matchDomains = [""] + searchDomains
                dnsSettings.matchDomainsNoSearch = false
            }
        }

        // Commit to tunnel settings
        settings.dnsSettings = dnsSettings
    }
}