objc2_network_extension/generated/

mod.rs

// This file has been automatically generated by `objc2`'s `header-translator`.
// DO NOT EDIT

#![allow(unused_imports)]
#![allow(deprecated)]
#![allow(non_snake_case)]
#![allow(non_camel_case_types)]
#![allow(non_upper_case_globals)]
#![allow(missing_docs)]
#![allow(clippy::too_many_arguments)]
#![allow(clippy::type_complexity)]
#![allow(clippy::upper_case_acronyms)]
#![allow(clippy::identity_op)]
#![allow(clippy::missing_safety_doc)]
#![allow(clippy::doc_lazy_continuation)]
#![allow(rustdoc::broken_intra_doc_links)]
#![allow(rustdoc::bare_urls)]
#![allow(rustdoc::unportable_markdown)]
#![allow(rustdoc::invalid_html_tags)]

#[link(name = "NetworkExtension", kind = "framework")]
extern "C" {}

use core::ffi::*;
use core::ptr::NonNull;
#[cfg(feature = "dispatch2")]
use dispatch2::*;
use objc2::__framework_prelude::*;
use objc2_foundation::*;
#[cfg(feature = "objc2-security")]
use objc2_security::*;

use crate::*;

/// Flow error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neappproxyflowerror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEAppProxyFlowError(pub NSInteger);
impl NEAppProxyFlowError {
    #[doc(alias = "NEAppProxyFlowErrorNotConnected")]
    pub const NotConnected: Self = Self(1);
    #[doc(alias = "NEAppProxyFlowErrorPeerReset")]
    pub const PeerReset: Self = Self(2);
    #[doc(alias = "NEAppProxyFlowErrorHostUnreachable")]
    pub const HostUnreachable: Self = Self(3);
    #[doc(alias = "NEAppProxyFlowErrorInvalidArgument")]
    pub const InvalidArgument: Self = Self(4);
    #[doc(alias = "NEAppProxyFlowErrorAborted")]
    pub const Aborted: Self = Self(5);
    #[doc(alias = "NEAppProxyFlowErrorRefused")]
    pub const Refused: Self = Self(6);
    #[doc(alias = "NEAppProxyFlowErrorTimedOut")]
    pub const TimedOut: Self = Self(7);
    #[doc(alias = "NEAppProxyFlowErrorInternal")]
    pub const Internal: Self = Self(8);
    #[doc(alias = "NEAppProxyFlowErrorDatagramTooLarge")]
    pub const DatagramTooLarge: Self = Self(9);
    #[doc(alias = "NEAppProxyFlowErrorReadAlreadyPending")]
    pub const ReadAlreadyPending: Self = Self(10);
}

unsafe impl Encode for NEAppProxyFlowError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEAppProxyFlowError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/neappproxyerrordomain?language=objc)
    pub static NEAppProxyErrorDomain: &'static NSString;
}

extern_class!(
    /// The NEAppProxyFlow class is an abstract base class that declares the programmatic interface for a flow of network data.
    ///
    /// NEAppProxyFlow is part of NetworkExtension.framework.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neappproxyflow?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppProxyFlow;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppProxyFlow {}
);

impl NEAppProxyFlow {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function is used by an NEProvider implementation to indicate that it is ready to handle flow data.
        ///
        /// Parameter `localEndpoint`: The address and port that should be used as the local endpoint of the socket associated with this flow. If the source application already specified a local endpoint by binding the socket then this parameter is ignored.
        ///
        /// Parameter `completionHandler`: A block that is called when the process of opening flow is complete. A nil value passed to this block indicates that the flow was opened successfully. A non-nil NSError value indicates that the flow failed to open successfully.
        #[deprecated]
        #[unsafe(method(openWithLocalEndpoint:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn openWithLocalEndpoint_completionHandler(
            &self,
            local_endpoint: Option<&NWHostEndpoint>,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// This function is used by an NEProvider implementation to indicate that it does not want to receive any more data from the flow.
        ///
        /// Parameter `error`: An error in NEAppProxyErrorDomain that should be passed to the flow's source application.
        #[unsafe(method(closeReadWithError:))]
        #[unsafe(method_family = none)]
        pub unsafe fn closeReadWithError(&self, error: Option<&NSError>);

        /// This functions is used by an NEProvider implementation to indicate that it does not have any more data to write to the flow.
        ///
        /// Parameter `error`: An error in NEAppProxyErrorDomain that should be passed to the flow's source application.
        #[unsafe(method(closeWriteWithError:))]
        #[unsafe(method_family = none)]
        pub unsafe fn closeWriteWithError(&self, error: Option<&NSError>);

        /// An NEFlowMetaData object containing meta data for the flow.
        #[unsafe(method(metaData))]
        #[unsafe(method_family = none)]
        pub unsafe fn metaData(&self) -> Retained<NEFlowMetaData>;

        /// If the flow was created by passing a hostname to a "connect by name" API such as NSURLSession or Network.framework, this property is set to the
        /// remote hostname.
        #[unsafe(method(remoteHostname))]
        #[unsafe(method_family = none)]
        pub unsafe fn remoteHostname(&self) -> Option<Retained<NSString>>;

        /// YES if the flow was bound by the application to a specific interface (contained in the networkInterface property), NO otherwise.
        #[unsafe(method(isBound))]
        #[unsafe(method_family = none)]
        pub unsafe fn isBound(&self) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppProxyFlow {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Provider stop reasons
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neproviderstopreason?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEProviderStopReason(pub NSInteger);
impl NEProviderStopReason {
    #[doc(alias = "NEProviderStopReasonNone")]
    pub const None: Self = Self(0);
    #[doc(alias = "NEProviderStopReasonUserInitiated")]
    pub const UserInitiated: Self = Self(1);
    #[doc(alias = "NEProviderStopReasonProviderFailed")]
    pub const ProviderFailed: Self = Self(2);
    #[doc(alias = "NEProviderStopReasonNoNetworkAvailable")]
    pub const NoNetworkAvailable: Self = Self(3);
    #[doc(alias = "NEProviderStopReasonUnrecoverableNetworkChange")]
    pub const UnrecoverableNetworkChange: Self = Self(4);
    #[doc(alias = "NEProviderStopReasonProviderDisabled")]
    pub const ProviderDisabled: Self = Self(5);
    #[doc(alias = "NEProviderStopReasonAuthenticationCanceled")]
    pub const AuthenticationCanceled: Self = Self(6);
    #[doc(alias = "NEProviderStopReasonConfigurationFailed")]
    pub const ConfigurationFailed: Self = Self(7);
    #[doc(alias = "NEProviderStopReasonIdleTimeout")]
    pub const IdleTimeout: Self = Self(8);
    #[doc(alias = "NEProviderStopReasonConfigurationDisabled")]
    pub const ConfigurationDisabled: Self = Self(9);
    #[doc(alias = "NEProviderStopReasonConfigurationRemoved")]
    pub const ConfigurationRemoved: Self = Self(10);
    #[doc(alias = "NEProviderStopReasonSuperceded")]
    pub const Superceded: Self = Self(11);
    #[doc(alias = "NEProviderStopReasonUserLogout")]
    pub const UserLogout: Self = Self(12);
    #[doc(alias = "NEProviderStopReasonUserSwitch")]
    pub const UserSwitch: Self = Self(13);
    #[doc(alias = "NEProviderStopReasonConnectionFailed")]
    pub const ConnectionFailed: Self = Self(14);
    #[doc(alias = "NEProviderStopReasonSleep")]
    pub const Sleep: Self = Self(15);
    #[doc(alias = "NEProviderStopReasonAppUpdate")]
    pub const AppUpdate: Self = Self(16);
    #[doc(alias = "NEProviderStopReasonInternalError")]
    pub const InternalError: Self = Self(17);
}

unsafe impl Encode for NEProviderStopReason {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEProviderStopReason {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEProvider class declares the programmatic interface that is common for all Network Extension providers.
    ///
    /// See the sub classes of NEProvider for more details. Developers of Network Extension providers should create sub classes of the sub classes of NEProvider.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neprovider?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEProvider {}
);

impl NEProvider {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function is called by the framework when the system is about to go to sleep. Subclass developers can override this method to implement custom behavior such as closing connections or pausing some network activity.
        ///
        /// Parameter `completionHandler`: When the method is finished handling the sleep event it must execute this completion handler.
        #[unsafe(method(sleepWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn sleepWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn()>,
        );

        /// This function is called by the framework immediately after the system wakes up from sleep. Subclass developers can override this method to implement custom behavior such as re-establishing connections or resuming some network activity.
        #[unsafe(method(wake))]
        #[unsafe(method_family = none)]
        pub unsafe fn wake(&self);

        /// This function can be called by subclass implementations to create a TCP connection to a given network endpoint. This function should not be overridden by subclasses.
        ///
        /// Parameter `remoteEndpoint`: An NWEndpoint object that specifies the remote network endpoint to connect to.
        ///
        /// Parameter `enableTLS`: A flag indicating if a TLS session should be negotiated on the connection.
        ///
        /// Parameter `TLSParameters`: A set of optional TLS parameters. Only valid if enableTLS is YES. If TLSParameters is nil, the default system parameters will be used for TLS negotiation.
        ///
        /// Parameter `delegate`: An object to use as the connections delegate. This object should conform to the NWTCPConnectionAuthenticationDelegate protocol.
        ///
        /// Returns: An NWTCPConnection object.
        #[deprecated = "Use nw_connection_t in Network framework instead"]
        #[unsafe(method(createTCPConnectionToEndpoint:enableTLS:TLSParameters:delegate:))]
        #[unsafe(method_family = none)]
        pub unsafe fn createTCPConnectionToEndpoint_enableTLS_TLSParameters_delegate(
            &self,
            remote_endpoint: &NWEndpoint,
            enable_tls: bool,
            tls_parameters: Option<&NWTLSParameters>,
            delegate: Option<&AnyObject>,
        ) -> Retained<NWTCPConnection>;

        /// This function can be called by subclass implementations to create a UDP session between a local network endpoint and a remote network endpoint. This function should not be overridden by subclasses.
        ///
        /// Parameter `remoteEndpoint`: An NWEndpoint object that specifies the remote endpoint to which UDP datagrams will be sent by the UDP session.
        ///
        /// Parameter `localEndpoint`: An NWHostEndpoint object that specifies the local IP address endpoint to use as the source endpoint of the UDP session.
        ///
        /// Returns: An NWUDPSession object.
        #[deprecated = "Use nw_connection_t in Network framework instead"]
        #[unsafe(method(createUDPSessionToEndpoint:fromEndpoint:))]
        #[unsafe(method_family = none)]
        pub unsafe fn createUDPSessionToEndpoint_fromEndpoint(
            &self,
            remote_endpoint: &NWEndpoint,
            local_endpoint: Option<&NWHostEndpoint>,
        ) -> Retained<NWUDPSession>;

        #[cfg(feature = "block2")]
        /// This method can be called by subclass implementations to display a message to the user.
        ///
        /// Parameter `message`: The message to be displayed.
        ///
        /// Parameter `completionHandler`: A block that is executed when the user acknowledges the message. If this method is called on a NEFilterDataProvider instance or the message cannot be displayed, then the completion handler block will be executed immediately with success parameter set to NO. If the message was successfully displayed to the user, then the completion handler block is executed with the success parameter set to YES when the user dismisses the message.
        #[deprecated]
        #[unsafe(method(displayMessage:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn displayMessage_completionHandler(
            &self,
            message: &NSString,
            completion_handler: &block2::DynBlock<dyn Fn(Bool)>,
        );

        /// Start the Network Extension machinery in a system extension (.system bundle). This class method will cause the calling system extension to start handling
        /// requests from nesessionmanager to instantiate appropriate NEProvider sub-class instances. The system extension must declare a mapping of Network Extension extension points to
        /// NEProvider sub-class instances in its Info.plist:
        /// Key: NetworkExtension
        /// Type: Dictionary containing information about the NetworkExtension capabilities of the system extension.
        ///
        /// Key: NEProviderClasses
        /// Type: Dictionary mapping NetworkExtension extension point identifiers to NEProvider sub-classes
        ///
        /// Example:
        ///
        /// <key
        /// >NetworkExtension
        /// </key
        /// >
        /// <dict
        /// >
        /// <key
        /// >NEProviderClasses
        /// </key
        /// >
        /// <dict
        /// >
        /// <key
        /// >com.apple.networkextension.app-proxy
        /// </key
        /// >
        /// <string
        /// >$(PRODUCT_MODULE_NAME).AppProxyProvider
        /// </string
        /// >
        /// <key
        /// >com.apple.networkextension.filter-data
        /// </key
        /// >
        /// <string
        /// >$(PRODUCT_MODULE_NAME).FilterDataProvider
        /// </string
        /// >
        /// </dict
        /// >
        /// </dict
        /// >
        ///
        /// This method should be called as early as possible after the system extension starts.
        #[unsafe(method(startSystemExtensionMode))]
        #[unsafe(method_family = none)]
        pub unsafe fn startSystemExtensionMode();

        /// The current default path for connections created by the provider. Use KVO to watch for network changes.
        #[deprecated = "Use nw_path_monitor_t in Network framework instead"]
        #[unsafe(method(defaultPath))]
        #[unsafe(method_family = none)]
        pub unsafe fn defaultPath(&self) -> Option<Retained<NWPath>>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Tunnel Provider error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelprovidererror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NETunnelProviderError(pub NSInteger);
impl NETunnelProviderError {
    #[doc(alias = "NETunnelProviderErrorNetworkSettingsInvalid")]
    pub const NetworkSettingsInvalid: Self = Self(1);
    #[doc(alias = "NETunnelProviderErrorNetworkSettingsCanceled")]
    pub const NetworkSettingsCanceled: Self = Self(2);
    #[doc(alias = "NETunnelProviderErrorNetworkSettingsFailed")]
    pub const NetworkSettingsFailed: Self = Self(3);
}

unsafe impl Encode for NETunnelProviderError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NETunnelProviderError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// Network traffic routing methods.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelproviderroutingmethod?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NETunnelProviderRoutingMethod(pub NSInteger);
impl NETunnelProviderRoutingMethod {
    #[doc(alias = "NETunnelProviderRoutingMethodDestinationIP")]
    pub const DestinationIP: Self = Self(1);
    #[doc(alias = "NETunnelProviderRoutingMethodSourceApplication")]
    pub const SourceApplication: Self = Self(2);
    #[doc(alias = "NETunnelProviderRoutingMethodNetworkRule")]
    pub const NetworkRule: Self = Self(3);
}

unsafe impl Encode for NETunnelProviderRoutingMethod {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NETunnelProviderRoutingMethod {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelprovidererrordomain?language=objc)
    pub static NETunnelProviderErrorDomain: &'static NSString;
}

extern_class!(
    /// The NETunnelProvider class declares the programmatic interface for an object that provides a network tunnel service.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelprovider?language=objc)
    #[unsafe(super(NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETunnelProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NETunnelProvider {}
);

impl NETunnelProvider {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function is called by the framework when the container app sends a message to the provider. Subclasses should override this method to handle the message and optionally send a response.
        ///
        /// Parameter `messageData`: An NSData object containing the message sent by the container app.
        ///
        /// Parameter `completionHandler`: A block that the method can execute to send a response to the container app. If this parameter is non-nil then the method implementation should always execute the block. If this parameter is nil then the method implementation should treat this as an indication that the container app is not expecting a response.
        #[unsafe(method(handleAppMessage:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleAppMessage_completionHandler(
            &self,
            message_data: &NSData,
            completion_handler: Option<&block2::DynBlock<dyn Fn(*mut NSData)>>,
        );

        #[cfg(feature = "block2")]
        /// This function is called by tunnel provider implementations to set the network settings of the tunnel, including IP routes, DNS servers, and virtual interface addresses depending on the tunnel type. Subclasses should not override this method. This method can be called multiple times during the lifetime of a particular tunnel. It is not necessary to call this function with nil to clear out the existing settings before calling this function with a non-nil configuration.
        ///
        /// Parameter `tunnelNetworkSettings`: An NETunnelNetworkSettings object containing all of the desired network settings for the tunnel. Pass nil to clear out the current network settings.
        ///
        /// Parameter `completionHandler`: A block that will be called by the framework when the process of setting or clearing the network settings is complete. If an error occurred during the process of setting or clearing the IP network settings then a non-nill NSError object will be passed to this block containing error details.
        #[unsafe(method(setTunnelNetworkSettings:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTunnelNetworkSettings_completionHandler(
            &self,
            tunnel_network_settings: Option<&NETunnelNetworkSettings>,
            completion_handler: Option<&block2::DynBlock<dyn Fn(*mut NSError)>>,
        );

        /// An NEVPNProtocol object containing the provider's current configuration. The value of this property may change during the lifetime of the tunnel provided by this NETunnelProvider, KVO can be used to detect when changes occur.  For different protocol types, this property will contain the corresponding subclass.   For NEVPNProtocolTypePlugin protocol type, this property will contain the NETunnelProviderProtocol subclass.  For NEVPNProtocolTypeIKEv2 protocol type, this property will contain the NEVPNProtocolIKEv2 subclass.
        #[unsafe(method(protocolConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn protocolConfiguration(&self) -> Retained<NEVPNProtocol>;

        /// An array of NEAppRule objects specifying which applications are currently being routed through the tunnel provided by this NETunnelProvider. If application-based routing is not enabled for the tunnel, then this property is set to nil.
        #[unsafe(method(appRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn appRules(&self) -> Option<Retained<NSArray<NEAppRule>>>;

        /// The method by which network traffic is routed to the tunnel. The default is NETunnelProviderRoutingMethodDestinationIP.
        #[unsafe(method(routingMethod))]
        #[unsafe(method_family = none)]
        pub unsafe fn routingMethod(&self) -> NETunnelProviderRoutingMethod;

        /// A flag that indicates to the framework if this NETunnelProvider is currently re-establishing the tunnel. Setting this flag will cause the session status visible to the user to change to "Reasserting". Clearing this flag will change the user-visible status of the session back to "Connected". Setting and clearing this flag only has an effect if the session is in the "Connected" state.
        #[unsafe(method(reasserting))]
        #[unsafe(method_family = none)]
        pub unsafe fn reasserting(&self) -> bool;

        /// Setter for [`reasserting`][Self::reasserting].
        #[unsafe(method(setReasserting:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setReasserting(&self, reasserting: bool);
    );
}

/// Methods declared on superclass `NSObject`.
impl NETunnelProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEAppProxyProvider class declares the programmatic interface for an object that implements the client side of a custom network proxy solution.
    ///
    /// NEAppProxyProvider is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neappproxyprovider?language=objc)
    #[unsafe(super(NETunnelProvider, NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppProxyProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppProxyProvider {}
);

impl NEAppProxyProvider {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function is called by the framework when a new proxy instance is being created. Subclasses must override this method to perform whatever steps are necessary to ready the proxy for handling flows of network data.
        ///
        /// Parameter `options`: A dictionary containing keys and values passed by the provider's containing app. If the containing app did not start the proxy then this parameter will be nil.
        ///
        /// Parameter `completionHandler`: A block that must be called when the process of starting the proxy is complete. If the proxy cannot be started then the subclass' implementation of this method must pass a non-nil NSError object to this block. A value of nil passed to the completion handler indicates that the proxy was successfully started.
        #[unsafe(method(startProxyWithOptions:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn startProxyWithOptions_completionHandler(
            &self,
            options: Option<&NSDictionary<NSString, AnyObject>>,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function is called by the framework when the proxy is being stopped. Subclasses must override this method to perform whatever steps are necessary to stop the proxy.
        ///
        /// Parameter `reason`: An NEProviderStopReason indicating why the proxy is being stopped.
        ///
        /// Parameter `completionHandler`: A block that must be called when the proxy is completely stopped.
        #[unsafe(method(stopProxyWithReason:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn stopProxyWithReason_completionHandler(
            &self,
            reason: NEProviderStopReason,
            completion_handler: &block2::DynBlock<dyn Fn()>,
        );

        /// This function is called by proxy provider implementations to stop the proxy when a network error is encountered that renders the proxy no longer viable. Subclasses should not override this method.
        ///
        /// Parameter `error`: An NSError object containing details about the error that the proxy provider implementation encountered.
        #[unsafe(method(cancelProxyWithError:))]
        #[unsafe(method_family = none)]
        pub unsafe fn cancelProxyWithError(&self, error: Option<&NSError>);

        /// This function is called by the framework to deliver a new network data flow to the proxy provider implementation. Subclasses must override this method to perform whatever steps are necessary to ready the proxy to receive data from the flow. The proxy provider implementation indicates that the proxy is ready to handle flow data by calling -[NEAppProxyFlow openWithLocalFlowEndpoint:completionHandler:] on the flow. If the proxy implementation decides to not handle the flow and instead terminate it, the subclass implementation of this method should return NO. If the proxy implementation decides to handle the flow, the subclass implementation of this method should return YES. In this case the proxy implementation is responsible for retaining the NEAppProxyFlow object.
        ///
        /// Parameter `flow`: The new flow
        ///
        /// Returns: YES if the proxy implementation has retained the flow and intends to handle the flow data. NO if the proxy implementation has not retained the flow and will not handle the flow data. In NETransparentProxyProvider sub-classes returning NO causes the flow to be handled by the networking stack without any proxy. In all other cases the flow is terminated when NO is returned.
        #[unsafe(method(handleNewFlow:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleNewFlow(&self, flow: &NEAppProxyFlow) -> bool;

        /// This function is called by the framework to deliver a new UDP data flow to the proxy provider implementation. Subclasses can override this method to perform whatever steps are necessary to ready the proxy to receive
        /// data from the flow. The proxy provider implementation indicates that the proxy is ready to handle flow data by calling -[NEAppProxyFlow openWithLocalEndpoint:completionHandler:] on the flow. If the proxy implementation decides
        /// to not handle the flow and instead terminate it, the subclass implementation of this method should return NO. If the proxy implementation decides to handle the flow, the subclass implementation of this method should return YES.
        /// In this case the proxy implementation is responsible for retaining the NEAppProxyUDPFlow object.
        /// The default implementation of this method calls -[NEAppProxyProvider handleNewFlow:] and returns its result.
        ///
        /// Parameter `flow`: The new UDP flow
        ///
        /// Parameter `remoteEndpoint`: The initial remote endpoint provided by the proxied app when the flow was opened.
        ///
        /// Returns: YES if the proxy implementation has retained the flow and intends to handle the flow data. NO if the proxy implementation has not retained the flow and will not handle the flow data. In NETransparentProxyProvider sub-classes returning NO causes the flow to be handled by the networking stack without any proxy. In all other cases the flow is terminated when NO is returned.
        #[deprecated]
        #[unsafe(method(handleNewUDPFlow:initialRemoteEndpoint:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleNewUDPFlow_initialRemoteEndpoint(
            &self,
            flow: &NEAppProxyUDPFlow,
            remote_endpoint: &NWEndpoint,
        ) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppProxyProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// VPN error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnerror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNError(pub NSInteger);
impl NEVPNError {
    #[doc(alias = "NEVPNErrorConfigurationInvalid")]
    pub const ConfigurationInvalid: Self = Self(1);
    #[doc(alias = "NEVPNErrorConfigurationDisabled")]
    pub const ConfigurationDisabled: Self = Self(2);
    #[doc(alias = "NEVPNErrorConnectionFailed")]
    pub const ConnectionFailed: Self = Self(3);
    #[doc(alias = "NEVPNErrorConfigurationStale")]
    pub const ConfigurationStale: Self = Self(4);
    #[doc(alias = "NEVPNErrorConfigurationReadWriteFailed")]
    pub const ConfigurationReadWriteFailed: Self = Self(5);
    #[doc(alias = "NEVPNErrorConfigurationUnknown")]
    pub const ConfigurationUnknown: Self = Self(6);
}

unsafe impl Encode for NEVPNError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnerrordomain?language=objc)
    pub static NEVPNErrorDomain: &'static NSString;
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnconfigurationchangenotification?language=objc)
    pub static NEVPNConfigurationChangeNotification: &'static NSString;
}

extern_class!(
    /// The NEVPNManager class declares the programmatic interface for an object that manages Virtual Private Network (VPN) configurations.
    ///
    /// NEVPNManager declares methods and properties for configuring and controlling a VPN.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnmanager?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEVPNManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEVPNManager {}
);

impl NEVPNManager {
    extern_methods!(
        /// Returns: The singleton NEVPNManager object for the calling process.
        #[unsafe(method(sharedManager))]
        #[unsafe(method_family = none)]
        pub unsafe fn sharedManager() -> Retained<NEVPNManager>;

        #[cfg(feature = "block2")]
        /// This function loads the current VPN configuration from the caller's VPN preferences.
        ///
        /// Parameter `completionHandler`: A block that will be called on the main thread when the load operation is completed. The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function removes the VPN configuration from the caller's VPN preferences. If the VPN is enabled, has VPN On Demand enabled, and has VPN On Demand rules, the VPN is disabled and the VPN On Demand rules are de-activated.
        ///
        /// Parameter `completionHandler`: A block that will be called on the main thread when the remove operation is completed. The NSError passed to this block will be nil if the remove operation succeeded, non-nil otherwise.
        #[unsafe(method(removeFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: Option<&block2::DynBlock<dyn Fn(*mut NSError)>>,
        );

        #[cfg(feature = "block2")]
        /// This function saves the VPN configuration in the caller's VPN preferences. If the VPN is enabled, has VPN On Demand enabled, and has VPN On Demand rules, the VPN On Demand rules are activated.
        ///
        ///
        /// Parameter `completionHandler`: A block that will be called on the main thread when the save operation is completed. The NSError passed to this block will be nil if the save operation succeeded, non-nil otherwise.
        #[unsafe(method(saveToPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn saveToPreferencesWithCompletionHandler(
            &self,
            completion_handler: Option<&block2::DynBlock<dyn Fn(*mut NSError)>>,
        );

        #[cfg(feature = "objc2-security")]
        /// This function sets an authorization object that can be used to obtain the authorization rights necessary to modify the system VPN configuration.
        ///
        /// Parameter `authorization`: The AuthorizationRef to use to obtain rights.
        #[unsafe(method(setAuthorization:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setAuthorization(&self, authorization: AuthorizationRef);

        /// An array of NEOnDemandRule objects.
        #[unsafe(method(onDemandRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn onDemandRules(&self) -> Option<Retained<NSArray<NEOnDemandRule>>>;

        /// Setter for [`onDemandRules`][Self::onDemandRules].
        #[unsafe(method(setOnDemandRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setOnDemandRules(&self, on_demand_rules: Option<&NSArray<NEOnDemandRule>>);

        /// Toggles VPN On Demand.
        #[unsafe(method(isOnDemandEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isOnDemandEnabled(&self) -> bool;

        /// Setter for [`isOnDemandEnabled`][Self::isOnDemandEnabled].
        #[unsafe(method(setOnDemandEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setOnDemandEnabled(&self, on_demand_enabled: bool);

        /// A string containing a description of the VPN.
        #[unsafe(method(localizedDescription))]
        #[unsafe(method_family = none)]
        pub unsafe fn localizedDescription(&self) -> Option<Retained<NSString>>;

        /// Setter for [`localizedDescription`][Self::localizedDescription].
        #[unsafe(method(setLocalizedDescription:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLocalizedDescription(&self, localized_description: Option<&NSString>);

        /// An NEVPNProtocol object containing the protocol-specific portion of the VPN configuration.
        #[deprecated]
        #[unsafe(method(protocol))]
        #[unsafe(method_family = none)]
        pub unsafe fn protocol(&self) -> Option<Retained<NEVPNProtocol>>;

        /// Setter for [`protocol`][Self::protocol].
        #[deprecated]
        #[unsafe(method(setProtocol:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProtocol(&self, protocol: Option<&NEVPNProtocol>);

        /// An NEVPNProtocol object containing the protocol-specific portion of the VPN configuration.
        #[unsafe(method(protocolConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn protocolConfiguration(&self) -> Option<Retained<NEVPNProtocol>>;

        /// Setter for [`protocolConfiguration`][Self::protocolConfiguration].
        #[unsafe(method(setProtocolConfiguration:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProtocolConfiguration(
            &self,
            protocol_configuration: Option<&NEVPNProtocol>,
        );

        /// The NEVPNConnection object used for controlling the VPN tunnel.
        #[unsafe(method(connection))]
        #[unsafe(method_family = none)]
        pub unsafe fn connection(&self) -> Retained<NEVPNConnection>;

        /// Toggles the enabled status of the VPN. Setting this property will disable VPN configurations of other apps. This property will be set to NO  when other VPN configurations are enabled.
        #[unsafe(method(isEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isEnabled(&self) -> bool;

        /// Setter for [`isEnabled`][Self::isEnabled].
        #[unsafe(method(setEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnabled(&self, enabled: bool);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEVPNManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NETunnelProviderManager class declares the programmatic interface for an object that is used to configure and control network tunnels provided by NETunnelProviders.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelprovidermanager?language=objc)
    #[unsafe(super(NEVPNManager, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETunnelProviderManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NETunnelProviderManager {}
);

impl NETunnelProviderManager {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function asynchronously reads all of the NETunnelProvider configurations created by the calling app that have previously been saved to disk and returns them as NETunnelProviderManager objects.
        ///
        /// Parameter `completionHandler`: A block that takes an array NETunnelProviderManager objects. The array passed to the block may be empty if no NETunnelProvider configurations were successfully read from the disk.  The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadAllFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadAllFromPreferencesWithCompletionHandler(
            completion_handler: &block2::DynBlock<
                dyn Fn(*mut NSArray<NETunnelProviderManager>, *mut NSError),
            >,
        );

        /// Create a NETunnelProviderManager instance that is used to manage a per-app VPN configuration.
        #[unsafe(method(forPerAppVPN))]
        #[unsafe(method_family = none)]
        pub unsafe fn forPerAppVPN() -> Retained<Self>;

        /// This function returns an array of NEAppRule objects.
        #[unsafe(method(copyAppRules))]
        #[unsafe(method_family = copy)]
        pub unsafe fn copyAppRules(&self) -> Option<Retained<NSArray<NEAppRule>>>;

        /// The method by which network traffic is routed to the tunnel. The default is NETunnelProviderRoutingMethodDestinationIP.
        #[unsafe(method(routingMethod))]
        #[unsafe(method_family = none)]
        pub unsafe fn routingMethod(&self) -> NETunnelProviderRoutingMethod;

        /// An array of domain strings. Only applies to per-app VPN configurations. When the per-app VPN is enabled and the user navigates in Safari to a web site within one of these domains,
        /// the web site network traffic is routed through the per-app VPN.
        #[unsafe(method(safariDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn safariDomains(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`safariDomains`][Self::safariDomains].
        #[unsafe(method(setSafariDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSafariDomains(&self, safari_domains: &NSArray<NSString>);

        /// An array of domain strings. Only applies to per-app VPN configurations. When the per-app VPN is enabled, connections from the Mail app to mail servers within
        /// one of these domains are routed through the per-app VPN.
        #[unsafe(method(mailDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn mailDomains(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`mailDomains`][Self::mailDomains].
        #[unsafe(method(setMailDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMailDomains(&self, mail_domains: &NSArray<NSString>);

        /// An array of domain strings. Only applies to per-app VPN configurations. When the per-app VPN is enabled, connections from the Calendar app to calendar servers within one of
        /// these domains are routed through the per-app VPN.
        #[unsafe(method(calendarDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn calendarDomains(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`calendarDomains`][Self::calendarDomains].
        #[unsafe(method(setCalendarDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setCalendarDomains(&self, calendar_domains: &NSArray<NSString>);

        /// An array of domain strings. Only applies to per-app VPN configurations. When the per-app VPN is enabled, connections from the Contacts app to contacts servers within one of these
        /// domains are routed through the per-app VPN.
        #[unsafe(method(contactsDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn contactsDomains(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`contactsDomains`][Self::contactsDomains].
        #[unsafe(method(setContactsDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setContactsDomains(&self, contacts_domains: &NSArray<NSString>);

        #[unsafe(method(appRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn appRules(&self) -> Retained<NSArray<NEAppRule>>;

        /// Setter for [`appRules`][Self::appRules].
        #[unsafe(method(setAppRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setAppRules(&self, app_rules: &NSArray<NEAppRule>);

        /// per-app VPN.
        #[unsafe(method(excludedDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludedDomains(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`excludedDomains`][Self::excludedDomains].
        #[unsafe(method(setExcludedDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludedDomains(&self, excluded_domains: &NSArray<NSString>);

        #[unsafe(method(associatedDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn associatedDomains(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`associatedDomains`][Self::associatedDomains].
        #[unsafe(method(setAssociatedDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setAssociatedDomains(&self, associated_domains: &NSArray<NSString>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NETunnelProviderManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEAppProxyProviderManager class declares the programmatic interface for an object that is used to configure and control network tunnels provided by NEAppProxyProviders.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neappproxyprovidermanager?language=objc)
    #[unsafe(super(NETunnelProviderManager, NEVPNManager, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppProxyProviderManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppProxyProviderManager {}
);

impl NEAppProxyProviderManager {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function asynchronously reads all of the NEAppProxy configurations associated with the calling app that have previously been saved to disk and returns them as NEAppProxyProviderManager objects.
        ///
        /// Parameter `completionHandler`: A block that takes an array NEAppProxyProviderManager objects. The array passed to the block may be empty if no NETunnelProvider configurations were successfully read from the disk.  The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadAllFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadAllFromPreferencesWithCompletionHandler(
            completion_handler: &block2::DynBlock<
                dyn Fn(*mut NSArray<NEAppProxyProviderManager>, *mut NSError),
            >,
        );
    );
}

/// Methods declared on superclass `NETunnelProviderManager`.
impl NEAppProxyProviderManager {
    extern_methods!(
        /// Create a NETunnelProviderManager instance that is used to manage a per-app VPN configuration.
        #[unsafe(method(forPerAppVPN))]
        #[unsafe(method_family = none)]
        pub unsafe fn forPerAppVPN() -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppProxyProviderManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEAppProxyTCPFlow class declares the programmatic interface of an object that is used by NEAppProxyProvider implementations to proxy the payload of TCP connections.
    ///
    /// NEAppProxyTCPFlow is part of NetworkExtension.framework
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neappproxytcpflow?language=objc)
    #[unsafe(super(NEAppProxyFlow, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppProxyTCPFlow;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppProxyTCPFlow {}
);

impl NEAppProxyTCPFlow {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// Read data from the flow.
        ///
        /// Parameter `completionHandler`: A block that will be executed when some data is read from the flow. The block is passed either the data that was read or a non-nil error if an error occurred. If data has a length of 0 then no data can be subsequently read from the flow. The completion handler is only called for the single read operation that was initiated by calling this method. If the caller wants to read more data then it should call this method again to schedule another read operation and another execution of the completion handler block.
        #[unsafe(method(readDataWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn readDataWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSData, *mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// Write data to the flow.
        ///
        /// Parameter `data`: The data to write.
        ///
        /// Parameter `completionHandler`: A block that will be executed when the data is written into the associated socket's receive buffer. The caller should use this callback as an indication that it is possible to write more data to the flow without using up excessive buffer memory. If an error occurs while writing the data then a non-nil NSError object is passed to the block.
        #[unsafe(method(writeData:withCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn writeData_withCompletionHandler(
            &self,
            data: &NSData,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// An NWEndpoint object containing information about the intended remote endpoint of the flow.
        #[deprecated]
        #[unsafe(method(remoteEndpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn remoteEndpoint(&self) -> Retained<NWEndpoint>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppProxyTCPFlow {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEAppProxyUDPFlow class declares the programmatic interface of an object that is used by NEAppProxyProvider implementations to proxy the payload of UDP datagrams.
    ///
    /// NEAppProxyUDPFlow is part of NetworkExtension.framework.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neappproxyudpflow?language=objc)
    #[unsafe(super(NEAppProxyFlow, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppProxyUDPFlow;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppProxyUDPFlow {}
);

impl NEAppProxyUDPFlow {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// Read datagrams from the flow.
        ///
        /// Parameter `completionHandler`: A block that will be executed when datagrams have been read from the flow. The block takes the datagrams that were read, the destination endpoints of the datagrams, and an NSError. If an error occurred while reading then the error parameter will be non-nil.
        #[deprecated]
        #[unsafe(method(readDatagramsWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn readDatagramsWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<
                dyn Fn(*mut NSArray<NSData>, *mut NSArray<NWEndpoint>, *mut NSError),
            >,
        );

        #[cfg(feature = "block2")]
        /// Write datagrams to the flow.
        ///
        /// Parameter `datagrams`: An array of NSData objects containing the data to be written.
        ///
        /// Parameter `remoteEndpoints`: The source endpoints of the datagrams.
        ///
        /// Parameter `completionHandler`: A block that will be executed when the datagrams have been written to the corresponding socket's receive buffer.
        #[deprecated]
        #[unsafe(method(writeDatagrams:sentByEndpoints:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn writeDatagrams_sentByEndpoints_completionHandler(
            &self,
            datagrams: &NSArray<NSData>,
            remote_endpoints: &NSArray<NWEndpoint>,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// An NWEndpoint object containing the local endpoint of the flow's corresponding socket.
        #[deprecated]
        #[unsafe(method(localEndpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn localEndpoint(&self) -> Option<Retained<NWEndpoint>>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppProxyUDPFlow {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEAppRule class declares the programmatic interface for an object that contains the match conditions for a rule that is used to match network traffic originated by applications.
    ///
    /// NEAppRule is used in the context of a Network Extension configuration to specify what traffic should be made available to the Network Extension.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neapprule?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppRule;
);

extern_conformance!(
    unsafe impl NSCoding for NEAppRule {}
);

extern_conformance!(
    unsafe impl NSCopying for NEAppRule {}
);

unsafe impl CopyingHelper for NEAppRule {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppRule {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEAppRule {}
);

impl NEAppRule {
    extern_methods!(
        /// Initializes a newly-allocated NEAppRule object.
        ///
        /// Parameter `signingIdentifier`: The signing identifier of the executable that matches the rule.
        #[unsafe(method(initWithSigningIdentifier:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithSigningIdentifier(
            this: Allocated<Self>,
            signing_identifier: &NSString,
        ) -> Retained<Self>;

        /// Initializes a newly-allocated NEAppRule object.
        ///
        /// Parameter `signingIdentifier`: The signing identifier of the executable that matches the rule.
        ///
        /// Parameter `designatedRequirement`: The designated requirement of the executable that matches the rule.
        #[unsafe(method(initWithSigningIdentifier:designatedRequirement:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithSigningIdentifier_designatedRequirement(
            this: Allocated<Self>,
            signing_identifier: &NSString,
            designated_requirement: &NSString,
        ) -> Retained<Self>;

        /// A string containing a signing identifier. If the code signature of the executable being evaluated has a signing identifier equal to this string and all other conditions of the rule match, then the rule matches.
        #[unsafe(method(matchSigningIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchSigningIdentifier(&self) -> Retained<NSString>;

        /// A string containing a designated requirement. If the code signature of the exectuable being evaluated has a designated requirement equal to this string and all other conditions of the rule match, then the rule matches. This property is required on Mac OS X.
        #[unsafe(method(matchDesignatedRequirement))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDesignatedRequirement(&self) -> Retained<NSString>;

        /// A string containing a file system path. If the file system path of the executable being evaluated is equal to this string and all other conditions of the rule match, then the rule matches. This property is optional.
        #[unsafe(method(matchPath))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchPath(&self) -> Option<Retained<NSString>>;

        /// Setter for [`matchPath`][Self::matchPath].
        #[unsafe(method(setMatchPath:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchPath(&self, match_path: Option<&NSString>);

        /// An array of strings. This property is actually read-only. If the destination host of the network traffic being evaluated has a suffix equal to one of the strings in this array and all other conditions of the rule match, then the rule matches. This property is optional.
        #[unsafe(method(matchDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDomains(&self) -> Option<Retained<NSArray>>;

        /// Setter for [`matchDomains`][Self::matchDomains].
        #[unsafe(method(setMatchDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchDomains(&self, match_domains: Option<&NSArray>);

        /// An array of NEAppRule objects. Use this property to restrict this rule to only match network traffic that is generated by one or more "helper tool" processes that are spawned by the app that matches this rule.
        /// For example, to match network traffic generated by the "curl" command line tool when the tool is run from Terminal.app, create an NEAppRule for Terminal.app and set the app rule's matchTools property to an array that
        /// contains an NEAppRule for the "curl" command line tool.
        /// Set this property to nil (which is the default) to match all network traffic generated by the matching app and all helper tool processes spawned by the matching app.
        #[unsafe(method(matchTools))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchTools(&self) -> Option<Retained<NSArray<NEAppRule>>>;

        /// Setter for [`matchTools`][Self::matchTools].
        #[unsafe(method(setMatchTools:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchTools(&self, match_tools: Option<&NSArray<NEAppRule>>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppRule {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// DNS proxy error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsproxymanagererror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEDNSProxyManagerError(pub NSInteger);
impl NEDNSProxyManagerError {
    #[doc(alias = "NEDNSProxyManagerErrorConfigurationInvalid")]
    pub const ConfigurationInvalid: Self = Self(1);
    #[doc(alias = "NEDNSProxyManagerErrorConfigurationDisabled")]
    pub const ConfigurationDisabled: Self = Self(2);
    #[doc(alias = "NEDNSProxyManagerErrorConfigurationStale")]
    pub const ConfigurationStale: Self = Self(3);
    #[doc(alias = "NEDNSProxyManagerErrorConfigurationCannotBeRemoved")]
    pub const ConfigurationCannotBeRemoved: Self = Self(4);
}

unsafe impl Encode for NEDNSProxyManagerError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEDNSProxyManagerError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsproxyerrordomain?language=objc)
    pub static NEDNSProxyErrorDomain: &'static NSString;
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsproxyconfigurationdidchangenotification?language=objc)
    pub static NEDNSProxyConfigurationDidChangeNotification: &'static NSString;
}

extern_class!(
    /// The NEDNSProxyManager class declares the programmatic interface for an object that manages DNS proxy configurations.
    ///
    /// NEDNSProxyManager declares methods and properties for configuring and controlling a DNS proxy.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsproxymanager?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEDNSProxyManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEDNSProxyManager {}
);

impl NEDNSProxyManager {
    extern_methods!(
        /// Returns: The singleton NEDNSProxyManager object for the calling process.
        #[unsafe(method(sharedManager))]
        #[unsafe(method_family = none)]
        pub unsafe fn sharedManager() -> Retained<NEDNSProxyManager>;

        #[cfg(feature = "block2")]
        /// This function loads the current DNS proxy configuration from the caller's DNS proxy preferences.
        ///
        /// Parameter `completionHandler`: A block that will be called when the load operation is completed. The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function removes the DNS proxy configuration from the caller's DNS proxy preferences. If the DNS proxy is enabled, the DNS proxy becomes disabled.
        ///
        /// Parameter `completionHandler`: A block that will be called when the remove operation is completed. The NSError passed to this block will be nil if the remove operation succeeded, non-nil otherwise.
        #[unsafe(method(removeFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function saves the DNS proxy configuration in the caller's DNS proxy preferences. If the DNS proxy is enabled, it will become active.
        ///
        /// Parameter `completionHandler`: A block that will be called when the save operation is completed. The NSError passed to this block will be nil if the save operation succeeded, non-nil otherwise.
        #[unsafe(method(saveToPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn saveToPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// A string containing a description of the DNS proxy.
        #[unsafe(method(localizedDescription))]
        #[unsafe(method_family = none)]
        pub unsafe fn localizedDescription(&self) -> Option<Retained<NSString>>;

        /// Setter for [`localizedDescription`][Self::localizedDescription].
        #[unsafe(method(setLocalizedDescription:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLocalizedDescription(&self, localized_description: Option<&NSString>);

        /// An NEDNSProxyProviderProtocol object containing the provider-specific portion of the DNS proxy configuration.
        #[unsafe(method(providerProtocol))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerProtocol(&self) -> Option<Retained<NEDNSProxyProviderProtocol>>;

        /// Setter for [`providerProtocol`][Self::providerProtocol].
        #[unsafe(method(setProviderProtocol:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderProtocol(
            &self,
            provider_protocol: Option<&NEDNSProxyProviderProtocol>,
        );

        /// Toggles the enabled status of the DNS proxy. Setting this property will disable DNS proxy configurations of other apps. This property will be set to NO when other DNS proxy configurations are enabled.
        #[unsafe(method(isEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isEnabled(&self) -> bool;

        /// Setter for [`isEnabled`][Self::isEnabled].
        #[unsafe(method(setEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnabled(&self, enabled: bool);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEDNSProxyManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEDNSProxyProvider class declares the programmatic interface for an object that implements the client side of a custom DNS proxy solution.
    ///
    /// NEDNSProxyProvider is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsproxyprovider?language=objc)
    #[unsafe(super(NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEDNSProxyProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEDNSProxyProvider {}
);

impl NEDNSProxyProvider {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function is called by the framework when a new proxy instance is being created. Subclasses must override this method to perform whatever steps are necessary to ready the proxy for handling flows of network data.
        ///
        /// Parameter `options`: A dictionary containing keys and values passed by the provider's containing app. If the containing app did not start the proxy then this parameter will be nil.
        ///
        /// Parameter `completionHandler`: A block that must be called when the process of starting the proxy is complete. If the proxy cannot be started then the subclass' implementation of this method must pass a non-nil NSError object to this block. A value of nil passed to the completion handler indicates that the proxy was successfully started.
        #[unsafe(method(startProxyWithOptions:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn startProxyWithOptions_completionHandler(
            &self,
            options: Option<&NSDictionary<NSString, AnyObject>>,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function is called by the framework when the proxy is being stopped. Subclasses must override this method to perform whatever steps are necessary to stop the proxy.
        ///
        /// Parameter `reason`: An NEProviderStopReason indicating why the proxy is being stopped.
        ///
        /// Parameter `completionHandler`: A block that must be called when the proxy is completely stopped.
        #[unsafe(method(stopProxyWithReason:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn stopProxyWithReason_completionHandler(
            &self,
            reason: NEProviderStopReason,
            completion_handler: &block2::DynBlock<dyn Fn()>,
        );

        /// This function is called by proxy provider implementations to stop the proxy when a network error is encountered that renders the proxy no longer viable. Subclasses should not override this method.
        ///
        /// Parameter `error`: An NSError object containing details about the error that the proxy provider implementation encountered.
        #[unsafe(method(cancelProxyWithError:))]
        #[unsafe(method_family = none)]
        pub unsafe fn cancelProxyWithError(&self, error: Option<&NSError>);

        /// This function is called by the framework to deliver a new network data flow to the proxy provider implementation. Subclasses must override this method to perform whatever steps are necessary to ready the proxy to receive data from the flow. The proxy provider implementation indicates that the proxy is ready to handle flow data by calling -[NEAppProxyFlow openWithLocalFlowEndpoint:completionHandler:] on the flow. If the proxy implementation decides to not handle the flow and instead terminate it, the subclass implementation of this method should return NO. If the proxy implementation decides to handle the flow, the subclass implementation of this method should return YES. In this case the proxy implementation is responsible for retaining the NEAppProxyFlow object.
        ///
        /// Parameter `flow`: The new flow
        ///
        /// Returns: YES if the proxy implementation has retained the flow and intends to handle the flow data. NO if the proxy implementation has not retained the flow and will not handle the flow data. In this case the flow is terminated.
        #[unsafe(method(handleNewFlow:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleNewFlow(&self, flow: &NEAppProxyFlow) -> bool;

        /// This function is called by the framework to deliver a new UDP data flow to the proxy provider implementation. Subclasses can override this method to perform whatever steps are necessary to ready the proxy to receive
        /// data from the flow. The proxy provider implementation indicates that the proxy is ready to handle flow data by calling -[NEAppProxyFlow openWithLocalEndpoint:completionHandler:] on the flow. If the proxy implementation decides
        /// to not handle the flow and instead terminate it, the subclass implementation of this method should return NO. If the proxy implementation decides to handle the flow, the subclass implementation of this method should return YES.
        /// In this case the proxy implementation is responsible for retaining the NEAppProxyUDPFlow object.
        /// The default implementation of this method calls -[NEAppProxyProvider handleNewFlow:] and returns its result.
        ///
        /// Parameter `flow`: The new UDP flow
        ///
        /// Parameter `remoteEndpoint`: The initial remote endpoint provided by the proxied app when the flow was opened.
        ///
        /// Returns: YES if the proxy implementation has retained the flow and intends to handle the flow data. NO if the proxy implementation has not retained the flow and will not handle the flow data. In this case the flow is terminated.
        #[deprecated]
        #[unsafe(method(handleNewUDPFlow:initialRemoteEndpoint:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleNewUDPFlow_initialRemoteEndpoint(
            &self,
            flow: &NEAppProxyUDPFlow,
            remote_endpoint: &NWEndpoint,
        ) -> bool;

        /// The current system DNS settings. Use KVO to watch for changes.
        #[unsafe(method(systemDNSSettings))]
        #[unsafe(method_family = none)]
        pub unsafe fn systemDNSSettings(&self) -> Option<Retained<NSArray<NEDNSSettings>>>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEDNSProxyProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEProxyServer class declares the programmatic interface for an object that contains settings for a proxy server.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neproxyserver?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEProxyServer;
);

extern_conformance!(
    unsafe impl NSCoding for NEProxyServer {}
);

extern_conformance!(
    unsafe impl NSCopying for NEProxyServer {}
);

unsafe impl CopyingHelper for NEProxyServer {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEProxyServer {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEProxyServer {}
);

impl NEProxyServer {
    extern_methods!(
        /// This function initializes a newly-allocated NEProxyServer object
        ///
        /// Parameter `address`: The string representation of the proxy server IP address.
        ///
        /// Parameter `port`: The TCP port of the proxy server.
        #[unsafe(method(initWithAddress:port:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithAddress_port(
            this: Allocated<Self>,
            address: &NSString,
            port: NSInteger,
        ) -> Retained<Self>;

        /// The string representation of the proxy server IP address.
        #[unsafe(method(address))]
        #[unsafe(method_family = none)]
        pub unsafe fn address(&self) -> Retained<NSString>;

        /// The TCP port of the proxy server.
        #[unsafe(method(port))]
        #[unsafe(method_family = none)]
        pub unsafe fn port(&self) -> NSInteger;

        /// A flag indicating if the server requires authentication credentials.
        #[unsafe(method(authenticationRequired))]
        #[unsafe(method_family = none)]
        pub unsafe fn authenticationRequired(&self) -> bool;

        /// Setter for [`authenticationRequired`][Self::authenticationRequired].
        #[unsafe(method(setAuthenticationRequired:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setAuthenticationRequired(&self, authentication_required: bool);

        /// The username portion of the authentication credential to use when communicating with the proxy server.
        #[unsafe(method(username))]
        #[unsafe(method_family = none)]
        pub unsafe fn username(&self) -> Option<Retained<NSString>>;

        /// Setter for [`username`][Self::username].
        #[unsafe(method(setUsername:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUsername(&self, username: Option<&NSString>);

        /// The password portion of the authentication credential to use when communicating with the proxy server. This property is only saved persistently if the username property is non-nil and non-empty and if the authenticationRequired flag is set.
        #[unsafe(method(password))]
        #[unsafe(method_family = none)]
        pub unsafe fn password(&self) -> Option<Retained<NSString>>;

        /// Setter for [`password`][Self::password].
        #[unsafe(method(setPassword:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setPassword(&self, password: Option<&NSString>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEProxyServer {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEProxySettings class declares the programmatic interface for an object that contains proxy settings.
    ///
    /// NEProxySettings is used in the context of a Network Extension configuration to specify the proxy that should be used for network traffic when the Network Extension is active.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neproxysettings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEProxySettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEProxySettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEProxySettings {}
);

unsafe impl CopyingHelper for NEProxySettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEProxySettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEProxySettings {}
);

impl NEProxySettings {
    extern_methods!(
        /// A boolean indicating if proxy auto-configuration is enabled.
        #[unsafe(method(autoProxyConfigurationEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn autoProxyConfigurationEnabled(&self) -> bool;

        /// Setter for [`autoProxyConfigurationEnabled`][Self::autoProxyConfigurationEnabled].
        #[unsafe(method(setAutoProxyConfigurationEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setAutoProxyConfigurationEnabled(
            &self,
            auto_proxy_configuration_enabled: bool,
        );

        /// A URL specifying where the PAC script is located.
        #[unsafe(method(proxyAutoConfigurationURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn proxyAutoConfigurationURL(&self) -> Option<Retained<NSURL>>;

        /// Setter for [`proxyAutoConfigurationURL`][Self::proxyAutoConfigurationURL].
        #[unsafe(method(setProxyAutoConfigurationURL:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProxyAutoConfigurationURL(
            &self,
            proxy_auto_configuration_url: Option<&NSURL>,
        );

        /// A string containing the PAC JavaScript source code.
        #[unsafe(method(proxyAutoConfigurationJavaScript))]
        #[unsafe(method_family = none)]
        pub unsafe fn proxyAutoConfigurationJavaScript(&self) -> Option<Retained<NSString>>;

        /// Setter for [`proxyAutoConfigurationJavaScript`][Self::proxyAutoConfigurationJavaScript].
        #[unsafe(method(setProxyAutoConfigurationJavaScript:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProxyAutoConfigurationJavaScript(
            &self,
            proxy_auto_configuration_java_script: Option<&NSString>,
        );

        /// A boolean indicating if the static HTTP proxy is enabled.
        #[unsafe(method(HTTPEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn HTTPEnabled(&self) -> bool;

        /// Setter for [`HTTPEnabled`][Self::HTTPEnabled].
        #[unsafe(method(setHTTPEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setHTTPEnabled(&self, http_enabled: bool);

        /// A NEProxyServer object containing the HTTP proxy server settings.
        #[unsafe(method(HTTPServer))]
        #[unsafe(method_family = none)]
        pub unsafe fn HTTPServer(&self) -> Option<Retained<NEProxyServer>>;

        /// Setter for [`HTTPServer`][Self::HTTPServer].
        #[unsafe(method(setHTTPServer:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setHTTPServer(&self, http_server: Option<&NEProxyServer>);

        /// A boolean indicating if the static HTTPS proxy is enabled.
        #[unsafe(method(HTTPSEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn HTTPSEnabled(&self) -> bool;

        /// Setter for [`HTTPSEnabled`][Self::HTTPSEnabled].
        #[unsafe(method(setHTTPSEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setHTTPSEnabled(&self, https_enabled: bool);

        /// A NEProxyServer object containing the HTTPS proxy server settings.
        #[unsafe(method(HTTPSServer))]
        #[unsafe(method_family = none)]
        pub unsafe fn HTTPSServer(&self) -> Option<Retained<NEProxyServer>>;

        /// Setter for [`HTTPSServer`][Self::HTTPSServer].
        #[unsafe(method(setHTTPSServer:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setHTTPSServer(&self, https_server: Option<&NEProxyServer>);

        /// A flag indicating if the proxy settings should not be used for network destinations specified using single-label host names.
        #[unsafe(method(excludeSimpleHostnames))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludeSimpleHostnames(&self) -> bool;

        /// Setter for [`excludeSimpleHostnames`][Self::excludeSimpleHostnames].
        #[unsafe(method(setExcludeSimpleHostnames:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludeSimpleHostnames(&self, exclude_simple_hostnames: bool);

        /// An array of domain strings. If the destination host name of a connection shares a suffix with one of these strings then the proxy settings will not be used for the connection.
        #[unsafe(method(exceptionList))]
        #[unsafe(method_family = none)]
        pub unsafe fn exceptionList(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`exceptionList`][Self::exceptionList].
        #[unsafe(method(setExceptionList:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExceptionList(&self, exception_list: Option<&NSArray<NSString>>);

        /// An array of domain strings. If the destination host name of a connection shares a suffix with one of these strings then the proxy settings will be used for the connection. Otherwise the proxy settings will not be used. If this property is nil then all connections to which the Network Extension applies will use the proxy settings.
        #[unsafe(method(matchDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDomains(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`matchDomains`][Self::matchDomains].
        #[unsafe(method(setMatchDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchDomains(&self, match_domains: Option<&NSArray<NSString>>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEProxySettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEVPNProtocol class declares the programmatic interface of an object that manages the protocol-specific portion of a VPN configuration.
    ///
    /// NEVPNProtocol is an abstract base class from which other protocol-specific classes are derived.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnprotocol?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEVPNProtocol;
);

extern_conformance!(
    unsafe impl NSCoding for NEVPNProtocol {}
);

extern_conformance!(
    unsafe impl NSCopying for NEVPNProtocol {}
);

unsafe impl CopyingHelper for NEVPNProtocol {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEVPNProtocol {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEVPNProtocol {}
);

impl NEVPNProtocol {
    extern_methods!(
        /// The VPN server. Depending on the protocol, may be an IP address, host name, or URL.
        #[unsafe(method(serverAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn serverAddress(&self) -> Option<Retained<NSString>>;

        /// Setter for [`serverAddress`][Self::serverAddress].
        #[unsafe(method(setServerAddress:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setServerAddress(&self, server_address: Option<&NSString>);

        /// The username component of the VPN authentication credential.
        #[unsafe(method(username))]
        #[unsafe(method_family = none)]
        pub unsafe fn username(&self) -> Option<Retained<NSString>>;

        /// Setter for [`username`][Self::username].
        #[unsafe(method(setUsername:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUsername(&self, username: Option<&NSString>);

        /// The password component of the VPN authentication credential. The value is a persistent reference to a keychain item with the kSecClassGenericPassword class.
        #[unsafe(method(passwordReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn passwordReference(&self) -> Option<Retained<NSData>>;

        /// Setter for [`passwordReference`][Self::passwordReference].
        #[unsafe(method(setPasswordReference:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setPasswordReference(&self, password_reference: Option<&NSData>);

        /// The certificate and private key component of the VPN authentication credential. The value is a persistent reference to a keychain item with the kSecClassIdentity class.
        #[unsafe(method(identityReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityReference(&self) -> Option<Retained<NSData>>;

        /// Setter for [`identityReference`][Self::identityReference].
        #[unsafe(method(setIdentityReference:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityReference(&self, identity_reference: Option<&NSData>);

        /// The PKCS12 data for the VPN authentication identity. The value is a NSData in PKCS12 format.
        #[unsafe(method(identityData))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityData(&self) -> Option<Retained<NSData>>;

        /// Setter for [`identityData`][Self::identityData].
        #[unsafe(method(setIdentityData:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityData(&self, identity_data: Option<&NSData>);

        /// The password to be used to decrypt the PKCS12 identity data.
        #[unsafe(method(identityDataPassword))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityDataPassword(&self) -> Option<Retained<NSString>>;

        /// Setter for [`identityDataPassword`][Self::identityDataPassword].
        #[unsafe(method(setIdentityDataPassword:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityDataPassword(&self, identity_data_password: Option<&NSString>);

        /// If YES, the VPN connection will be disconnected when the device goes to sleep. The default is NO.
        #[unsafe(method(disconnectOnSleep))]
        #[unsafe(method_family = none)]
        pub unsafe fn disconnectOnSleep(&self) -> bool;

        /// Setter for [`disconnectOnSleep`][Self::disconnectOnSleep].
        #[unsafe(method(setDisconnectOnSleep:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDisconnectOnSleep(&self, disconnect_on_sleep: bool);

        /// An NEProxySettings object containing the proxy settings to use for connections routed through the tunnel.
        #[unsafe(method(proxySettings))]
        #[unsafe(method_family = none)]
        pub unsafe fn proxySettings(&self) -> Option<Retained<NEProxySettings>>;

        /// Setter for [`proxySettings`][Self::proxySettings].
        #[unsafe(method(setProxySettings:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProxySettings(&self, proxy_settings: Option<&NEProxySettings>);

        /// If this property is set to YES then all network traffic is routed through the tunnel, with some exclusions. Several of the exclusions
        /// can be controlled with the excludeLocalNetworks, excludeCellularServices, excludeAPNs and excludeDeviceCommunication properties. See the documentation for those properties.
        /// The following traffic is always excluded from the tunnel:
        /// - Traffic necessary for connecting and maintaining the device's network connection, such as DHCP.
        /// - Traffic necessary for connecting to captive networks.
        /// - Certain cellular services traffic that is not routable over the internet and is instead directly routed to the cellular network. See the
        /// excludeCellularServices property for more details.
        /// - Network communication with a companion device such as a watchOS device.
        /// The default value of this property is NO.
        #[unsafe(method(includeAllNetworks))]
        #[unsafe(method_family = none)]
        pub unsafe fn includeAllNetworks(&self) -> bool;

        /// Setter for [`includeAllNetworks`][Self::includeAllNetworks].
        #[unsafe(method(setIncludeAllNetworks:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIncludeAllNetworks(&self, include_all_networks: bool);

        /// If YES, all traffic destined for local networks will be excluded from the tunnel. The default is NO on macOS and YES on iOS.
        #[unsafe(method(excludeLocalNetworks))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludeLocalNetworks(&self) -> bool;

        /// Setter for [`excludeLocalNetworks`][Self::excludeLocalNetworks].
        #[unsafe(method(setExcludeLocalNetworks:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludeLocalNetworks(&self, exclude_local_networks: bool);

        /// If includeAllNetworks is set to YES and this property is set to YES, then internet-routable network traffic for cellular services
        /// (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) is excluded from the tunnel. Note that some cellular carriers route cellular services traffic
        /// directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel. The default value of this
        /// property is YES.
        #[unsafe(method(excludeCellularServices))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludeCellularServices(&self) -> bool;

        /// Setter for [`excludeCellularServices`][Self::excludeCellularServices].
        #[unsafe(method(setExcludeCellularServices:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludeCellularServices(&self, exclude_cellular_services: bool);

        /// If includeAllNetworks is set to YES and this property is set to YES, then network traffic for the Apple Push Notification service (APNs)
        /// is excluded from the tunnel. The default value of this property is YES.
        #[unsafe(method(excludeAPNs))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludeAPNs(&self) -> bool;

        /// Setter for [`excludeAPNs`][Self::excludeAPNs].
        #[unsafe(method(setExcludeAPNs:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludeAPNs(&self, exclude_ap_ns: bool);

        /// If includeAllNetworks is set to YES and this property is set to YES, then network traffic used for communicating with devices connected via USB or Wi-Fi is excluded
        /// from the tunnel. For example, Xcode uses a network tunnel to communicate with connected development devices like iPhone, iPad and TV. The default value of this
        /// property is YES.
        #[unsafe(method(excludeDeviceCommunication))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludeDeviceCommunication(&self) -> bool;

        /// Setter for [`excludeDeviceCommunication`][Self::excludeDeviceCommunication].
        #[unsafe(method(setExcludeDeviceCommunication:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludeDeviceCommunication(&self, exclude_device_communication: bool);

        /// If YES, route rules for this tunnel will take precendence over any locally-defined routes. The default is NO.
        #[unsafe(method(enforceRoutes))]
        #[unsafe(method_family = none)]
        pub unsafe fn enforceRoutes(&self) -> bool;

        /// Setter for [`enforceRoutes`][Self::enforceRoutes].
        #[unsafe(method(setEnforceRoutes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnforceRoutes(&self, enforce_routes: bool);

        /// Identification string of the associated Cellular slice.  If present, VPN tunnel will be scoped to the associated Cellular slice whenever slice is active.
        /// Otherwise, VPN tunnel will fallback onto the primary interface.
        #[unsafe(method(sliceUUID))]
        #[unsafe(method_family = none)]
        pub unsafe fn sliceUUID(&self) -> Option<Retained<NSString>>;

        /// Setter for [`sliceUUID`][Self::sliceUUID].
        #[unsafe(method(setSliceUUID:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSliceUUID(&self, slice_uuid: Option<&NSString>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEVPNProtocol {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEDNSProxyProviderProtocol class declares the programmatic interface for an object that contains NEDNSProxyProvider-specific configuration settings.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsproxyproviderprotocol?language=objc)
    #[unsafe(super(NEVPNProtocol, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEDNSProxyProviderProtocol;
);

extern_conformance!(
    unsafe impl NSCoding for NEDNSProxyProviderProtocol {}
);

extern_conformance!(
    unsafe impl NSCopying for NEDNSProxyProviderProtocol {}
);

unsafe impl CopyingHelper for NEDNSProxyProviderProtocol {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEDNSProxyProviderProtocol {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEDNSProxyProviderProtocol {}
);

impl NEDNSProxyProviderProtocol {
    extern_methods!(
        /// A dictionary containing NEDNSProxyProvider vendor-specific configuration parameters. This dictionary is passed as-is to NEDNSProxyProviders when a DNS proxy is started.
        #[unsafe(method(providerConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerConfiguration(
            &self,
        ) -> Option<Retained<NSDictionary<NSString, AnyObject>>>;

        /// Setter for [`providerConfiguration`][Self::providerConfiguration].
        #[unsafe(method(setProviderConfiguration:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderConfiguration(
            &self,
            provider_configuration: Option<&NSDictionary<NSString, AnyObject>>,
        );

        /// A string containing the bundle identifier of the NEDNSProxyProvider to be used by this configuration.
        #[unsafe(method(providerBundleIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerBundleIdentifier(&self) -> Option<Retained<NSString>>;

        /// Setter for [`providerBundleIdentifier`][Self::providerBundleIdentifier].
        #[unsafe(method(setProviderBundleIdentifier:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderBundleIdentifier(
            &self,
            provider_bundle_identifier: Option<&NSString>,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NEDNSProxyProviderProtocol {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// DNS protocol variants
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsprotocol?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEDNSProtocol(pub NSInteger);
impl NEDNSProtocol {
    #[doc(alias = "NEDNSProtocolCleartext")]
    pub const Cleartext: Self = Self(1);
    #[doc(alias = "NEDNSProtocolTLS")]
    pub const TLS: Self = Self(2);
    #[doc(alias = "NEDNSProtocolHTTPS")]
    pub const HTTPS: Self = Self(3);
}

unsafe impl Encode for NEDNSProtocol {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEDNSProtocol {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEDNSSettings class declares the programmatic interface for an object that contains DNS settings.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednssettings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEDNSSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEDNSSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEDNSSettings {}
);

unsafe impl CopyingHelper for NEDNSSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEDNSSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEDNSSettings {}
);

impl NEDNSSettings {
    extern_methods!(
        /// The DNS protocol used by the settings.
        #[unsafe(method(dnsProtocol))]
        #[unsafe(method_family = none)]
        pub unsafe fn dnsProtocol(&self) -> NEDNSProtocol;

        /// Initialize a newly-allocated NEDNSSettings object.
        ///
        /// Parameter `servers`: An array of DNS server IP address strings.
        #[unsafe(method(initWithServers:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithServers(
            this: Allocated<Self>,
            servers: &NSArray<NSString>,
        ) -> Retained<Self>;

        /// An array of DNS server address strings.
        #[unsafe(method(servers))]
        #[unsafe(method_family = none)]
        pub unsafe fn servers(&self) -> Retained<NSArray<NSString>>;

        /// An array of DNS server search domain strings.
        #[unsafe(method(searchDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn searchDomains(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`searchDomains`][Self::searchDomains].
        #[unsafe(method(setSearchDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSearchDomains(&self, search_domains: Option<&NSArray<NSString>>);

        /// A string containing the DNS domain.
        #[unsafe(method(domainName))]
        #[unsafe(method_family = none)]
        pub unsafe fn domainName(&self) -> Option<Retained<NSString>>;

        /// Setter for [`domainName`][Self::domainName].
        #[unsafe(method(setDomainName:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDomainName(&self, domain_name: Option<&NSString>);

        /// An array of strings containing domain strings. If this property is non-nil, the DNS settings will only be used to resolve host names within the specified domains.
        #[unsafe(method(matchDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDomains(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`matchDomains`][Self::matchDomains].
        #[unsafe(method(setMatchDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchDomains(&self, match_domains: Option<&NSArray<NSString>>);

        /// A boolean indicating if the match domains should be appended to the search domain list.  Default is NO (match domains will be appended to the search domain list).
        #[unsafe(method(matchDomainsNoSearch))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDomainsNoSearch(&self) -> bool;

        /// Setter for [`matchDomainsNoSearch`][Self::matchDomainsNoSearch].
        #[unsafe(method(setMatchDomainsNoSearch:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchDomainsNoSearch(&self, match_domains_no_search: bool);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEDNSSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsovertlssettings?language=objc)
    #[unsafe(super(NEDNSSettings, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEDNSOverTLSSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEDNSOverTLSSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEDNSOverTLSSettings {}
);

unsafe impl CopyingHelper for NEDNSOverTLSSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEDNSOverTLSSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEDNSOverTLSSettings {}
);

impl NEDNSOverTLSSettings {
    extern_methods!(
        /// The name of the server to use for TLS certificate validation.
        #[unsafe(method(serverName))]
        #[unsafe(method_family = none)]
        pub unsafe fn serverName(&self) -> Option<Retained<NSString>>;

        /// Setter for [`serverName`][Self::serverName].
        #[unsafe(method(setServerName:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setServerName(&self, server_name: Option<&NSString>);

        /// The optional certificate identity keychain reference to use as a TLS client certificate.
        #[unsafe(method(identityReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityReference(&self) -> Option<Retained<NSData>>;

        /// Setter for [`identityReference`][Self::identityReference].
        #[unsafe(method(setIdentityReference:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityReference(&self, identity_reference: Option<&NSData>);
    );
}

/// Methods declared on superclass `NEDNSSettings`.
impl NEDNSOverTLSSettings {
    extern_methods!(
        /// Initialize a newly-allocated NEDNSSettings object.
        ///
        /// Parameter `servers`: An array of DNS server IP address strings.
        #[unsafe(method(initWithServers:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithServers(
            this: Allocated<Self>,
            servers: &NSArray<NSString>,
        ) -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEDNSOverTLSSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednsoverhttpssettings?language=objc)
    #[unsafe(super(NEDNSSettings, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEDNSOverHTTPSSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEDNSOverHTTPSSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEDNSOverHTTPSSettings {}
);

unsafe impl CopyingHelper for NEDNSOverHTTPSSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEDNSOverHTTPSSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEDNSOverHTTPSSettings {}
);

impl NEDNSOverHTTPSSettings {
    extern_methods!(
        /// The URL to which to make DNS-over-HTTPS requests. The format should be an HTTPS URL with the path indicating the location of the DNS-over-HTTPS server, such as: "https://dnsserver.example.net/dns-query".
        #[unsafe(method(serverURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn serverURL(&self) -> Option<Retained<NSURL>>;

        /// Setter for [`serverURL`][Self::serverURL].
        #[unsafe(method(setServerURL:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setServerURL(&self, server_url: Option<&NSURL>);

        /// The optional certificate identity keychain reference to use as a TLS client certificate.
        #[unsafe(method(identityReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityReference(&self) -> Option<Retained<NSData>>;

        /// Setter for [`identityReference`][Self::identityReference].
        #[unsafe(method(setIdentityReference:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityReference(&self, identity_reference: Option<&NSData>);
    );
}

/// Methods declared on superclass `NEDNSSettings`.
impl NEDNSOverHTTPSSettings {
    extern_methods!(
        /// Initialize a newly-allocated NEDNSSettings object.
        ///
        /// Parameter `servers`: An array of DNS server IP address strings.
        #[unsafe(method(initWithServers:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithServers(
            this: Allocated<Self>,
            servers: &NSArray<NSString>,
        ) -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEDNSOverHTTPSSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// DNS Settings Manager error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednssettingsmanagererror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEDNSSettingsManagerError(pub NSInteger);
impl NEDNSSettingsManagerError {
    #[doc(alias = "NEDNSSettingsManagerErrorConfigurationInvalid")]
    pub const ConfigurationInvalid: Self = Self(1);
    #[doc(alias = "NEDNSSettingsManagerErrorConfigurationDisabled")]
    pub const ConfigurationDisabled: Self = Self(2);
    #[doc(alias = "NEDNSSettingsManagerErrorConfigurationStale")]
    pub const ConfigurationStale: Self = Self(3);
    #[doc(alias = "NEDNSSettingsManagerErrorConfigurationCannotBeRemoved")]
    pub const ConfigurationCannotBeRemoved: Self = Self(4);
}

unsafe impl Encode for NEDNSSettingsManagerError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEDNSSettingsManagerError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednssettingserrordomain?language=objc)
    pub static NEDNSSettingsErrorDomain: &'static NSString;
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednssettingsconfigurationdidchangenotification?language=objc)
    pub static NEDNSSettingsConfigurationDidChangeNotification: &'static NSString;
}

extern_class!(
    /// The NEDNSSettingsManager class declares the programmatic interface for an object that manages DNS settings configurations.
    ///
    /// NEDNSSettingsManager declares methods and properties for configuring and controlling DNS settings on the system.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nednssettingsmanager?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEDNSSettingsManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEDNSSettingsManager {}
);

impl NEDNSSettingsManager {
    extern_methods!(
        /// Returns: The singleton NEDNSSettingsManager object for the calling process.
        #[unsafe(method(sharedManager))]
        #[unsafe(method_family = none)]
        pub unsafe fn sharedManager() -> Retained<NEDNSSettingsManager>;

        #[cfg(feature = "block2")]
        /// This function loads the current DNS settings configuration from the caller's DNS settings preferences.
        ///
        /// Parameter `completionHandler`: A block that will be called when the load operation is completed. The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function removes the DNS settings configuration from the caller's DNS settings preferences. If the DNS settings are enabled, the DNS settings becomes disabled.
        ///
        /// Parameter `completionHandler`: A block that will be called when the remove operation is completed. The NSError passed to this block will be nil if the remove operation succeeded, non-nil otherwise.
        #[unsafe(method(removeFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function saves the DNS settingsconfiguration in the caller's DNS settings preferences. If the DNS settings are enabled, they will become active.
        ///
        /// Parameter `completionHandler`: A block that will be called when the save operation is completed. The NSError passed to this block will be nil if the save operation succeeded, non-nil otherwise.
        #[unsafe(method(saveToPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn saveToPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// A string containing a description of the DNS settings.
        #[unsafe(method(localizedDescription))]
        #[unsafe(method_family = none)]
        pub unsafe fn localizedDescription(&self) -> Option<Retained<NSString>>;

        /// Setter for [`localizedDescription`][Self::localizedDescription].
        #[unsafe(method(setLocalizedDescription:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLocalizedDescription(&self, localized_description: Option<&NSString>);

        /// An NEDNSSettings object containing the DNS resolver configuration to apply to the system.
        #[unsafe(method(dnsSettings))]
        #[unsafe(method_family = none)]
        pub unsafe fn dnsSettings(&self) -> Option<Retained<NEDNSSettings>>;

        /// Setter for [`dnsSettings`][Self::dnsSettings].
        #[unsafe(method(setDnsSettings:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDnsSettings(&self, dns_settings: Option<&NEDNSSettings>);

        /// An array of NEOnDemandRule objects. If nil, the associated DNS settings will always apply. If non-nil, the array describes the networks on which the DNS configuration should take effect or not.
        #[unsafe(method(onDemandRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn onDemandRules(&self) -> Option<Retained<NSArray<NEOnDemandRule>>>;

        /// Setter for [`onDemandRules`][Self::onDemandRules].
        #[unsafe(method(setOnDemandRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setOnDemandRules(&self, on_demand_rules: Option<&NSArray<NEOnDemandRule>>);

        /// Checks the enabled status of the DNS settings. DNS settings must be enabled by the user in Settings or System Preferences.
        #[unsafe(method(isEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isEnabled(&self) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEDNSSettingsManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// IP protocols
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nenetworkruleprotocol?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NENetworkRuleProtocol(pub NSInteger);
impl NENetworkRuleProtocol {
    #[doc(alias = "NENetworkRuleProtocolAny")]
    pub const Any: Self = Self(0);
    #[doc(alias = "NENetworkRuleProtocolTCP")]
    pub const TCP: Self = Self(1);
    #[doc(alias = "NENetworkRuleProtocolUDP")]
    pub const UDP: Self = Self(2);
}

unsafe impl Encode for NENetworkRuleProtocol {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NENetworkRuleProtocol {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// The direction of network traffic
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netrafficdirection?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NETrafficDirection(pub NSInteger);
impl NETrafficDirection {
    #[doc(alias = "NETrafficDirectionAny")]
    pub const Any: Self = Self(0);
    #[doc(alias = "NETrafficDirectionInbound")]
    pub const Inbound: Self = Self(1);
    #[doc(alias = "NETrafficDirectionOutbound")]
    pub const Outbound: Self = Self(2);
}

unsafe impl Encode for NETrafficDirection {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NETrafficDirection {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NENetworkRule class declares the programmatic interface of an object that contains a specification of a rule that matches the attributes of network traffic.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nenetworkrule?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NENetworkRule;
);

extern_conformance!(
    unsafe impl NSCoding for NENetworkRule {}
);

extern_conformance!(
    unsafe impl NSCopying for NENetworkRule {}
);

unsafe impl CopyingHelper for NENetworkRule {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NENetworkRule {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NENetworkRule {}
);

impl NENetworkRule {
    extern_methods!(
        /// Initialize a newly-allocated NENetworkRule object that matches network traffic destined for a host within a specific network.
        ///
        /// Parameter `networkEndpoint`: An endpoint object that contains the port and address or network that the rule matches. This endpoint must contain an address, not a hostname.
        /// If the address is a wildcard address (0.0.0.0 or ::) then the rule will match all destinations except for loopback (127.0.0.1 or ::1). To match loopback traffic set the address to the loopback address.
        /// If the port string of the endpoint is "0" or is the empty string, then the rule will match traffic on any port destined for the given address or network.
        ///
        /// Parameter `destinationPrefix`: An integer that in combination with the address in the endpoint specifies the destination network that the rule matches.
        ///
        /// Parameter `protocol`: A NENetworkRuleProtocol value indicating the protocol that the rule matches.
        ///
        /// Returns: The initialized NENetworkRule instance.
        #[deprecated]
        #[unsafe(method(initWithDestinationNetwork:prefix:protocol:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithDestinationNetwork_prefix_protocol(
            this: Allocated<Self>,
            network_endpoint: &NWHostEndpoint,
            destination_prefix: NSUInteger,
            protocol: NENetworkRuleProtocol,
        ) -> Retained<Self>;

        /// Initialize a newly-allocated NENetworkRule object that matches network traffic destined for a host within a specific DNS domain.
        ///
        /// Parameter `hostEndpoint`: An endpoint object that contains the port and hostname or domain that the rule matches. This endpoint must contain a hostname, not an address.
        /// If the port string of the NWHostEndpoint is "0" or is the empty string, then the rule will match traffic on any port destined for the given hostname or domain.
        /// If the hostname string of the endpoint consists of a single label, then the rule will match traffic destined to the specific host with that single label as its name.
        /// If the hostname string of the endpoint consists of 2 or more labels, then the rule will match traffic destined to hosts within the domain specified by the hostname string.
        /// Examples:
        /// [[NENetworkRule alloc] initWithDestinationHost:[NWHostEndpoint endpointWithHostname:
        /// "
        /// com" port:@"0"] protocol:NENetworkRuleProtocolAny] - matches all TCP and UDP traffic to the host named "com".
        /// [[NENetworkRule alloc] initWithDestinationHost:[NWHostEndpoint endpointWithHostname:
        /// "
        /// example.com" port:@"0"] protocol:NENetworkRuleProtocolAny] - matches all TCP and UDP traffic to hosts in the "example.com" DNS domain, including all DNS queries for names in the example.com DNS domain.
        /// [[NENetworkRule alloc] initWithDestinationHost:[NWHostEndpoint endpointWithHostname:
        /// "
        /// example.com" port:@"53"] protocol:NENetworkRuleProtocolAny] - matches all DNS queries/responses for hosts in the "example.com" domain.
        /// [[NENetworkRule alloc] initWithDestinationHost:[NWHostEndpoint endpointWithHostname:
        /// "
        /// example.com" port:@"443"] protocol:NENetworkRuleProtocolTCP] - matches all TCP port 443 traffic to hosts in the "example.com" domain.
        ///
        /// Parameter `protocol`: A NENetworkRuleProtocol value indicating the protocol that the rule matches.
        ///
        /// Returns: The initialized NENetworkRule instance.
        #[deprecated]
        #[unsafe(method(initWithDestinationHost:protocol:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithDestinationHost_protocol(
            this: Allocated<Self>,
            host_endpoint: &NWHostEndpoint,
            protocol: NENetworkRuleProtocol,
        ) -> Retained<Self>;

        /// Initialize a newly-allocated NENetworkRule object that matches traffic by remote network, local network, protocol, and direction. If both remoteNetwork and localNetwork are nil
        /// then the rule will match all traffic of the given protocol and direction, except for loopback traffic. To match loopback traffic create a NENetworkRule with remoteNetwork and/or localNetwork properties that
        /// explicitly match traffic to the loopback address (127.0.0.1 or ::1).
        ///
        /// Parameter `remoteNetwork`: An endpoint object that contains the remote port and the remote address or network that the rule matches. This endpoint must contain an address, not a hostname.
        /// If the address is a wildcard address (0.0.0.0 or ::) then the rule will match all destinations except for loopback (127.0.0.1 or ::1). To match loopback traffic set the address to the loopback address.
        /// If the port string of the endpoint is "0" or is the empty string, then the rule will match traffic on any port coming from the remote network.
        /// Pass nil to cause the rule to match any remote network.
        ///
        /// Parameter `remotePrefix`: An integer that in combination with the address in remoteNetwork specifies the remote network that the rule matches.
        ///
        /// Parameter `localNetwork`: An endpoint object that contains the local port and the local address or network that the rule matches. This endpoint must contain an address, not a hostname.
        /// If the address is a wildcard address (0.0.0.0 or ::) then the rule will match all local networks except for loopback (127.0.0.1 or ::1). To match loopback traffic set the address to the loopback address.
        /// If the port string of the endpoint is "0" or is the empty string, then the rule will match traffic on any port coming from the local network.
        /// Pass nil to cause the rule to match any local network.
        ///
        /// Parameter `localPrefix`: An integer that in combination with the address in localNetwork specifies the local network that the rule matches. This parameter
        /// is ignored if localNetwork is nil.
        ///
        /// Parameter `protocol`: A NENetworkRuleProtocol value indicating the protocol that the rule matches.
        ///
        /// Parameter `direction`: A NETrafficDirection value indicating the direction of network traffic that the rule matches.
        ///
        /// Returns: The initialized NENetworkRule instance.
        #[deprecated]
        #[unsafe(method(initWithRemoteNetwork:remotePrefix:localNetwork:localPrefix:protocol:direction:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithRemoteNetwork_remotePrefix_localNetwork_localPrefix_protocol_direction(
            this: Allocated<Self>,
            remote_network: Option<&NWHostEndpoint>,
            remote_prefix: NSUInteger,
            local_network: Option<&NWHostEndpoint>,
            local_prefix: NSUInteger,
            protocol: NENetworkRuleProtocol,
            direction: NETrafficDirection,
        ) -> Retained<Self>;

        /// The remote endpoint that the rule matches.
        #[deprecated]
        #[unsafe(method(matchRemoteEndpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchRemoteEndpoint(&self) -> Option<Retained<NWHostEndpoint>>;

        /// A number that specifies the remote sub-network that the rule matches. This property is set to NSNotFound for rules where matchRemoteEndpoint does not contain an IP address.
        #[unsafe(method(matchRemotePrefix))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchRemotePrefix(&self) -> NSUInteger;

        /// The local network that the rule matches.
        #[deprecated]
        #[unsafe(method(matchLocalNetwork))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchLocalNetwork(&self) -> Option<Retained<NWHostEndpoint>>;

        /// A number that specifies the local sub-network that the rule matches. This property is set to NSNotFound for rules with a nil matchLocalNetwork property.
        #[unsafe(method(matchLocalPrefix))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchLocalPrefix(&self) -> NSUInteger;

        /// A NENetworkRuleProtocol value containing the protocol that the rule matches.
        #[unsafe(method(matchProtocol))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchProtocol(&self) -> NENetworkRuleProtocol;

        /// A NETrafficDirection value indicating the network traffic direction that the rule matches.
        #[unsafe(method(matchDirection))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDirection(&self) -> NETrafficDirection;
    );
}

/// Methods declared on superclass `NSObject`.
impl NENetworkRule {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterFlow class declares the programmatic interface of an object that represents a flow of network data to be filtered.
    ///
    /// NEFilterFlow is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterflow?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterFlow;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterFlow {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterFlow {}
);

unsafe impl CopyingHelper for NEFilterFlow {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterFlow {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterFlow {}
);

impl NEFilterFlow {
    extern_methods!(
        /// The flow's HTTP request URL. Will be nil if the flow did not originate from WebKit.
        #[unsafe(method(URL))]
        #[unsafe(method_family = none)]
        pub unsafe fn URL(&self) -> Option<Retained<NSURL>>;

        /// A byte string that uniquely identifies the binary for each build of the source application of the flow.
        #[unsafe(method(sourceAppUniqueIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceAppUniqueIdentifier(&self) -> Option<Retained<NSData>>;

        /// A string containing the identifier of the source application of the flow. This identifier stays the same for all versions and builds of the application. This identifier is unique among all applications.
        #[unsafe(method(sourceAppIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceAppIdentifier(&self) -> Option<Retained<NSString>>;

        /// The short version string of the source application. Will be nil if the app info is unavailable.
        #[unsafe(method(sourceAppVersion))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceAppVersion(&self) -> Option<Retained<NSString>>;

        /// Initial direction of the flow (outgoing or incoming flow)
        #[unsafe(method(direction))]
        #[unsafe(method_family = none)]
        pub unsafe fn direction(&self) -> NETrafficDirection;

        /// Audit token of the source application of the flow.
        #[unsafe(method(sourceAppAuditToken))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceAppAuditToken(&self) -> Option<Retained<NSData>>;

        /// The audit token of the process that created the flow. In cases where the connection was created by a system process on behalf of the source application,
        /// sourceProcessAuditToken will be different from sourceAppAuditToken and will contain the audit token of the system process. In cases where the source application directly
        /// created the connection sourceAppAuditToken and sourceProcessAuditToken will be identical.
        #[unsafe(method(sourceProcessAuditToken))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceProcessAuditToken(&self) -> Option<Retained<NSData>>;

        /// The unique identifier of the flow.
        #[unsafe(method(identifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn identifier(&self) -> Retained<NSUUID>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterFlow {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterBrowserFlow class declares the programmatic interface of an object that represents a flow of network data to be filtered, which is originated from NEFilterSource.
    ///
    /// NEFilterBrowserFlow is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterbrowserflow?language=objc)
    #[unsafe(super(NEFilterFlow, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterBrowserFlow;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterBrowserFlow {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterBrowserFlow {}
);

unsafe impl CopyingHelper for NEFilterBrowserFlow {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterBrowserFlow {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterBrowserFlow {}
);

impl NEFilterBrowserFlow {
    extern_methods!(
        /// The NSURLRequest of the flow. This property is always nil for the control providers.
        #[unsafe(method(request))]
        #[unsafe(method_family = none)]
        pub unsafe fn request(&self) -> Option<Retained<NSURLRequest>>;

        /// The NSURLResponse of the flow. This will be nil until the request is sent to the server and the response headers are received. And this property is always nil for the control providers.
        #[unsafe(method(response))]
        #[unsafe(method_family = none)]
        pub unsafe fn response(&self) -> Option<Retained<NSURLResponse>>;

        /// The parent URL for the current flow which is created to load the sub frames because the flow with the parent URL was allowed. Will be nil if the parent flow does not exist.
        #[unsafe(method(parentURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn parentURL(&self) -> Option<Retained<NSURL>>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterBrowserFlow {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterSocketFlow class declares the programmatic interface of an object that represents a flow of network data to be filtered, which is originated from the socket.
    ///
    /// NEFilterSocketFlow is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltersocketflow?language=objc)
    #[unsafe(super(NEFilterFlow, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterSocketFlow;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterSocketFlow {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterSocketFlow {}
);

unsafe impl CopyingHelper for NEFilterSocketFlow {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterSocketFlow {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterSocketFlow {}
);

impl NEFilterSocketFlow {
    extern_methods!(
        /// The flow's remote endpoint. This endpoint object may be nil when [NEFilterDataProvider handleNewFlow:] is invoked and if so will be populated upon receiving network data.
        /// In such a case, filtering on the flow may still be performed based on its socket type, socket family or socket protocol.
        #[deprecated]
        #[unsafe(method(remoteEndpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn remoteEndpoint(&self) -> Option<Retained<NWEndpoint>>;

        /// The flow's remote hostname. This property is only non-nil if the flow was created using Network.framework or NSURLSession.
        #[unsafe(method(remoteHostname))]
        #[unsafe(method_family = none)]
        pub unsafe fn remoteHostname(&self) -> Option<Retained<NSString>>;

        /// The flow's local endpoint. This endpoint object may be nil when [NEFilterDataProvider handleNewFlow:] is invoked and if so will be populated upon receiving network data.
        /// In such a case, filtering on the flow may still be performed based on its socket type, socket family or socket protocol.
        #[deprecated]
        #[unsafe(method(localEndpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn localEndpoint(&self) -> Option<Retained<NWEndpoint>>;

        /// Socket family of the socket flow, such as PF_INET.
        #[unsafe(method(socketFamily))]
        #[unsafe(method_family = none)]
        pub unsafe fn socketFamily(&self) -> c_int;

        /// Socket type of the socket flow, such as SOCK_STREAM.
        #[unsafe(method(socketType))]
        #[unsafe(method_family = none)]
        pub unsafe fn socketType(&self) -> c_int;

        /// Socket protocol of the socket flow, such as IPPROTO_TCP.
        #[unsafe(method(socketProtocol))]
        #[unsafe(method_family = none)]
        pub unsafe fn socketProtocol(&self) -> c_int;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterSocketFlow {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterProvider class is an abstract base class that declares the programmatic interface of an
    /// object that implements a socket filter.
    ///
    /// NEFilterProvider is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterprovider?language=objc)
    #[unsafe(super(NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterProvider {}
);

impl NEFilterProvider {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function is called by the framework when the content filter is being started. Subclasses must
        /// override this method and perform whatever steps are necessary to start the filter.
        ///
        /// Parameter `completionHandler`: A block that must be called when the process of starting the filter is complete. If the
        /// filter was started successfully, subclass implementations must pass the nil value to this block. If an error occurred
        /// while starting the filter, sublcass implementations must pass a non-nil NSError containing more details about the error.
        #[unsafe(method(startFilterWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn startFilterWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function is called by the framework when the content filter is being stopped. Subclasses must
        /// override this method and perform whatever steps are necessary to stop the filter.
        ///
        /// Parameter `reason`: An NEProviderStopReason indicating why the filter is being stopped.
        ///
        /// Parameter `completionHandler`: A block that must be called when the process of stopping the filter is complete.
        #[unsafe(method(stopFilterWithReason:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn stopFilterWithReason_completionHandler(
            &self,
            reason: NEProviderStopReason,
            completion_handler: &block2::DynBlock<dyn Fn()>,
        );

        /// An NEContentFilterConfiguration object containing the current filter configuration. The value of this
        /// property can change during the lifetime of a filter. Filter implementations can use KVO to be notified when the
        /// configuration changes.
        #[unsafe(method(filterConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterConfiguration(&self) -> Retained<NEFilterProviderConfiguration>;

        /// This function is called by the framework when the data provider extension returns a verdict with the report property set to True.
        /// Subclass implementations may override this method to handle the flow report.
        ///
        /// Parameter `report`: The report being delivered.
        #[unsafe(method(handleReport:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleReport(&self, report: &NEFilterReport);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// A NEFilterReportFrequency controls the frequency of periodic reports.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterreportfrequency?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEFilterReportFrequency(pub NSInteger);
impl NEFilterReportFrequency {
    #[doc(alias = "NEFilterReportFrequencyNone")]
    pub const None: Self = Self(0);
    #[doc(alias = "NEFilterReportFrequencyLow")]
    pub const Low: Self = Self(1);
    #[doc(alias = "NEFilterReportFrequencyMedium")]
    pub const Medium: Self = Self(2);
    #[doc(alias = "NEFilterReportFrequencyHigh")]
    pub const High: Self = Self(3);
}

unsafe impl Encode for NEFilterReportFrequency {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEFilterReportFrequency {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEFilterVerdict class declares the programmatic interface for an object that is the verdict for a
    /// flow of network data.
    ///
    /// NEFilterVerdict is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterverdict?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterVerdict;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterVerdict {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterVerdict {}
);

unsafe impl CopyingHelper for NEFilterVerdict {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterVerdict {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterVerdict {}
);

impl NEFilterVerdict {
    extern_methods!(
        /// Whether or not to send a report to the control provider's -[NEFilterProvider handleReport:]
        /// method when processing this verdict and when the flow is closed. Since the data provider does not need to wait
        /// for a response from the control provider before continuing to process the flow, this is a more efficient way to
        /// report a flow to the control provider than returning a "need rules" verdict. If the verdict originates in the
        /// control provider, this property has no effect. This property applies when the action taken upon a flow is allow,
        /// deny, remediate, or filterData (filterData for new flows only). Setting this flag on a verdict for a socket
        /// flow will also cause the data provider's -[NEFilterProvider handleReport:] method to be called when the flow
        /// is closed.
        #[unsafe(method(shouldReport))]
        #[unsafe(method_family = none)]
        pub unsafe fn shouldReport(&self) -> bool;

        /// Setter for [`shouldReport`][Self::shouldReport].
        #[unsafe(method(setShouldReport:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setShouldReport(&self, should_report: bool);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterVerdict {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterNewFlowVerdict declares the programmatic interface of an object that is the verdict for a
    /// new flow of network data before any of the flow's data has been seen by the filter.
    ///
    /// NEFilterNewFlowVerdict is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilternewflowverdict?language=objc)
    #[unsafe(super(NEFilterVerdict, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterNewFlowVerdict;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterNewFlowVerdict {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterNewFlowVerdict {}
);

unsafe impl CopyingHelper for NEFilterNewFlowVerdict {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterNewFlowVerdict {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterNewFlowVerdict {}
);

impl NEFilterNewFlowVerdict {
    extern_methods!(
        /// The frequency at which the data provider's -[NEFilterProvider handleReport:] method is called with a NEFilterReport instance with an event of NEFilterReportEventFlowStatistics.
        /// The default value is NEFilterReportFrequencyNone, so by default no statistics are reported.
        #[unsafe(method(statisticsReportFrequency))]
        #[unsafe(method_family = none)]
        pub unsafe fn statisticsReportFrequency(&self) -> NEFilterReportFrequency;

        /// Setter for [`statisticsReportFrequency`][Self::statisticsReportFrequency].
        #[unsafe(method(setStatisticsReportFrequency:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setStatisticsReportFrequency(
            &self,
            statistics_report_frequency: NEFilterReportFrequency,
        );

        /// This class method returns a verdict indicating that control provider needs to be asked how to handle
        /// the new flow. The control provider can either drop or allow the flow, or update the rules and ask the data provider
        /// to decide on the new flow again.
        ///
        /// Returns: The NEFilterNewFlowVerdict object.
        #[unsafe(method(needRulesVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn needRulesVerdict() -> Retained<NEFilterNewFlowVerdict>;

        /// This class method returns a verdict indicating that the flow should be allowed.
        ///
        /// Returns: The NEFilterNewFlowVerdict object.
        #[unsafe(method(allowVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn allowVerdict() -> Retained<NEFilterNewFlowVerdict>;

        /// This class method returns a verdict indicating that the flow should be dropped.
        ///
        /// Returns: The NEFilterNewFlowVerdict object.
        #[unsafe(method(dropVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn dropVerdict() -> Retained<NEFilterNewFlowVerdict>;

        /// This class method returns a verdict indicating that a "content blocked" page should be displayed to
        /// the user. The block page should contain a link to the given URL.
        ///
        /// Parameter `remediationURLMapKey`: Remediation map key used by data plugin to get remediation url
        ///
        /// Returns: The NEFilterNewFlowVerdict object.
        #[unsafe(method(remediateVerdictWithRemediationURLMapKey:remediationButtonTextMapKey:))]
        #[unsafe(method_family = none)]
        pub unsafe fn remediateVerdictWithRemediationURLMapKey_remediationButtonTextMapKey(
            remediation_url_map_key: &NSString,
            remediation_button_text_map_key: &NSString,
        ) -> Retained<NEFilterNewFlowVerdict>;

        /// This class method returns a verdict indicating that safe search URL for the new should be specified
        ///
        /// Parameter `urlAppendMapKey`: URL Append map key to be used by the data plugin to notify what the url should be appended with
        ///
        /// Returns: The NEFilterNewFlowVerdict object.
        #[unsafe(method(URLAppendStringVerdictWithMapKey:))]
        #[unsafe(method_family = none)]
        pub unsafe fn URLAppendStringVerdictWithMapKey(
            url_append_map_key: &NSString,
        ) -> Retained<NEFilterNewFlowVerdict>;

        /// This class method returns a new flow verdict indicating that the filter needs to make a decision about
        /// a new flow after seeing a portion of the flow's data.
        ///
        /// Parameter `filterInbound`: A boolean indicating if the filter needs to see inbound data
        ///
        /// Parameter `peekInboundBytes`: The number of inbound bytes that the filter needs to see in the subsequent call to
        /// -[NEFilterDataProvider handleInboundDataFromFlow:readBytesStartOffset:readBytes:].
        ///
        /// Parameter `filterOutbound`: boolean indicating if the filter needs to see outbound data
        ///
        /// Parameter `peekOutboundBytes`: The number of outbound bytes that the filter needs to see in the subsequent call to
        /// -[NEFilterDataProvider handleOutboundDataFromFlow:readBytesStartOffset:readBytes:].
        ///
        /// Returns: The new flow verdict.
        #[unsafe(method(filterDataVerdictWithFilterInbound:peekInboundBytes:filterOutbound:peekOutboundBytes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterDataVerdictWithFilterInbound_peekInboundBytes_filterOutbound_peekOutboundBytes(
            filter_inbound: bool,
            peek_inbound_bytes: NSUInteger,
            filter_outbound: bool,
            peek_outbound_bytes: NSUInteger,
        ) -> Retained<NEFilterNewFlowVerdict>;

        /// This class method returns a verdict indicating that none of the data provider's handler callbacks shall be called for the flow until after the flow is resumed
        /// by a call to -[NEFilterDataProvider resumeFlow:withVerdict:]. TCP flows may be paused indefinitely. UDP flows will be dropped if not resumed within 10 seconds of
        /// being paused. It is invalid to pause a flow that is already paused.
        ///
        /// Returns: The NEFilterNewFlowVerdict object.
        #[unsafe(method(pauseVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn pauseVerdict() -> Retained<NEFilterNewFlowVerdict>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterNewFlowVerdict {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterControlVerdict declares the programmatic interface of an object that is the verdict for a
    /// new flow of network data by the control provider.
    ///
    /// NEFilterControlVerdict is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltercontrolverdict?language=objc)
    #[unsafe(super(NEFilterNewFlowVerdict, NEFilterVerdict, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterControlVerdict;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterControlVerdict {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterControlVerdict {}
);

unsafe impl CopyingHelper for NEFilterControlVerdict {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterControlVerdict {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterControlVerdict {}
);

impl NEFilterControlVerdict {
    extern_methods!(
        /// This class method returns a verdict indicating that the flow should be allowed to go through, and also
        /// tell the data provider whether to update its rules or not.
        ///
        /// Parameter `updateRules`: YES if the control provider has updated the rules and wants to communicate that to the data provider
        ///
        /// Returns: The NEFilterControlVerdict object.
        #[unsafe(method(allowVerdictWithUpdateRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn allowVerdictWithUpdateRules(
            update_rules: bool,
        ) -> Retained<NEFilterControlVerdict>;

        /// This class method returns a verdict indicating that the flow should be dropped, and also tell the data
        /// provider whether to update its rules or not.
        ///
        /// Parameter `updateRules`: YES if the control provider has updated the rules and wants to communicate that to the data provider
        ///
        /// Returns: The NEFilterControlVerdict object.
        #[unsafe(method(dropVerdictWithUpdateRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn dropVerdictWithUpdateRules(
            update_rules: bool,
        ) -> Retained<NEFilterControlVerdict>;

        /// This class method returns a verdict indicating that the flow should be handled by the data provider,
        /// and the rules needed by the data provider have been set.
        ///
        /// Returns: The NEFilterControlVerdict object.
        #[unsafe(method(updateRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn updateRules() -> Retained<NEFilterControlVerdict>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterControlVerdict {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// A NEFilterAction represents the possible actions taken upon a NEFilterFlow that can be reported by the
/// data provider extension to the control provider extension.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilteraction?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEFilterAction(pub NSInteger);
impl NEFilterAction {
    #[doc(alias = "NEFilterActionInvalid")]
    pub const Invalid: Self = Self(0);
    #[doc(alias = "NEFilterActionAllow")]
    pub const Allow: Self = Self(1);
    #[doc(alias = "NEFilterActionDrop")]
    pub const Drop: Self = Self(2);
    #[doc(alias = "NEFilterActionRemediate")]
    pub const Remediate: Self = Self(3);
    #[doc(alias = "NEFilterActionFilterData")]
    pub const FilterData: Self = Self(4);
}

unsafe impl Encode for NEFilterAction {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEFilterAction {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// A NEFilterReportEvent represents the event that is being reported by the NEFilterReport.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterreportevent?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEFilterReportEvent(pub NSInteger);
impl NEFilterReportEvent {
    #[doc(alias = "NEFilterReportEventNewFlow")]
    pub const NewFlow: Self = Self(1);
    #[doc(alias = "NEFilterReportEventDataDecision")]
    pub const DataDecision: Self = Self(2);
    #[doc(alias = "NEFilterReportEventFlowClosed")]
    pub const FlowClosed: Self = Self(3);
    #[doc(alias = "NEFilterReportEventStatistics")]
    pub const Statistics: Self = Self(4);
}

unsafe impl Encode for NEFilterReportEvent {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEFilterReportEvent {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEFilterReport declares the programmatic interface of an object that is a report of actions taken by
    /// the data provider.
    ///
    /// NEFilterReport is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterreport?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterReport;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterReport {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterReport {}
);

unsafe impl CopyingHelper for NEFilterReport {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterReport {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterReport {}
);

impl NEFilterReport {
    extern_methods!(
        /// The flow on which the described action was taken.
        #[unsafe(method(flow))]
        #[unsafe(method_family = none)]
        pub unsafe fn flow(&self) -> Option<Retained<NEFilterFlow>>;

        /// The action taken upon the reported flow.
        #[unsafe(method(action))]
        #[unsafe(method_family = none)]
        pub unsafe fn action(&self) -> NEFilterAction;

        /// The type of event that the report is reporting.
        #[unsafe(method(event))]
        #[unsafe(method_family = none)]
        pub unsafe fn event(&self) -> NEFilterReportEvent;

        /// The number of inbound bytes received from the flow. This property is only non-zero when the report event is NEFilterReportEventFlowClosed or NEFilterReportEventFlowStatistics.
        #[unsafe(method(bytesInboundCount))]
        #[unsafe(method_family = none)]
        pub unsafe fn bytesInboundCount(&self) -> NSUInteger;

        /// The number of outbound bytes sent on the flow. This property is only non-zero when the report event is NEFilterReportEventFlowClosed or NEFilterReportEventFlowStatistics.
        #[unsafe(method(bytesOutboundCount))]
        #[unsafe(method_family = none)]
        pub unsafe fn bytesOutboundCount(&self) -> NSUInteger;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterReport {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterControlProvider class declares the programmatic interface for an object that is responsible for installing filtering rules on the device.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltercontrolprovider?language=objc)
    #[unsafe(super(NEFilterProvider, NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterControlProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterControlProvider {}
);

impl NEFilterControlProvider {
    extern_methods!(
        /// A dictionary containing custom strings to be inserted into the "content blocked" page displayed in WebKit. Each key in this dictionary corresponds to a string in the "content blocked" page. The value of each key is a dictionary that maps keys to the custom strings to be inserted into the "content blocked" page. The keys for the sub-dictionaries are defined by the control provider. When the data provider creates a "remediate" verdict using [NEFilterDataVerdict remediateVerdictWithRemediationURLMapKey:remediationButtonTextMapKey:], it passes the key corresponding to the custom string to be inserted into the "content blocked" page.
        ///
        /// Here is a sample remediationMap dictionary:
        ///
        /// remediationMap =
        /// @
        /// { NEFilterProviderRemediationMapRemediationURLs :
        /// @
        /// {
        /// "
        /// RemediateKey1" : @"http://www.remediation_url_1.com",
        /// "
        /// RemediateKey2" : @"http://www.remediation_url_2.com"
        /// },
        /// NEFilterProviderRemediationMapRemediationButtonTexts :
        /// @
        /// {
        /// "
        /// RemediationButtonText1" : @"Remediate URL"
        /// }
        /// };
        #[unsafe(method(remediationMap))]
        #[unsafe(method_family = none)]
        pub unsafe fn remediationMap(
            &self,
        ) -> Option<Retained<NSDictionary<NSString, NSDictionary<NSString, NSObject>>>>;

        /// Setter for [`remediationMap`][Self::remediationMap].
        #[unsafe(method(setRemediationMap:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setRemediationMap(
            &self,
            remediation_map: Option<&NSDictionary<NSString, NSDictionary<NSString, NSObject>>>,
        );

        /// A dictionary containing strings to be appended to URLs.
        #[unsafe(method(URLAppendStringMap))]
        #[unsafe(method_family = none)]
        pub unsafe fn URLAppendStringMap(
            &self,
        ) -> Option<Retained<NSDictionary<NSString, NSString>>>;

        /// Setter for [`URLAppendStringMap`][Self::URLAppendStringMap].
        #[unsafe(method(setURLAppendStringMap:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setURLAppendStringMap(
            &self,
            url_append_string_map: Option<&NSDictionary<NSString, NSString>>,
        );

        #[cfg(feature = "block2")]
        /// This function is called by the framework when the NEFilterDataProvider indicates that the filtering verdict for the given flow is NEFilterRemediateVerdictNeedRules. Subclass implementations must override this method and implement whatever steps are necessary to remediate the given flow.
        ///
        /// Parameter `flow`: An NEFilterFlow object containing details about the flow that requires remediation.
        ///
        /// Parameter `completionHandler`: A block that must be called when the NEFilterControlProvider is ready for the NEFilterDataProvider to re-process the new flow. NEFilterControlVerdict stores the verdict through which the control provider determines if a flow needs to be dropped or allowed. The verdict also indicates if the control plugin wants the data plugin to update its rules and handle the verdict.
        #[unsafe(method(handleRemediationForFlow:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleRemediationForFlow_completionHandler(
            &self,
            flow: &NEFilterFlow,
            completion_handler: &block2::DynBlock<dyn Fn(NonNull<NEFilterControlVerdict>)>,
        );

        #[cfg(feature = "block2")]
        /// This function is called by the framework when the NEFilterDataProvider indicates that the filtering verdict for the given flow is NEFilterNewFlowVerdictNeedRules. Subclass implementations must override this method and implement whatever steps are necessary to fetch new rules pertaining to the given flow and place them on disk in a location accessible by the NEFilterDataProvider.
        ///
        /// Parameter `flow`: An NEFilterFlow object containing details about the flow that requires a rules update.
        ///
        /// Parameter `completionHandler`: A block that must be called when the NEFilterControlProvider is ready for the NEFilterDataProvider to re-process the new flow. NEFilterControlVerdict stores the verdict through which the control provider determines if a flow needs to be dropped or allowed. The verdict also indicates if the control plugin wants the data plugin to update its rules and handle the verdict.
        #[unsafe(method(handleNewFlow:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleNewFlow_completionHandler(
            &self,
            flow: &NEFilterFlow,
            completion_handler: &block2::DynBlock<dyn Fn(NonNull<NEFilterControlVerdict>)>,
        );

        /// This function is called by filter control implementations to notify the data provider "out of band" that the rules changed.
        #[unsafe(method(notifyRulesChanged))]
        #[unsafe(method_family = none)]
        pub unsafe fn notifyRulesChanged(&self);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterControlProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Attribute flags describing data
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterdataattribute?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEFilterDataAttribute(pub NSInteger);
impl NEFilterDataAttribute {
    #[doc(alias = "NEFilterDataAttributeHasIPHeader")]
    pub const HasIPHeader: Self = Self(0x00000001);
}

unsafe impl Encode for NEFilterDataAttribute {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEFilterDataAttribute {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEFilterDataProvider class declares the programmatic interface for an object that evaluates network data flows based on a set of locally-available rules and makes decisions about whether to block or allow the flows.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterdataprovider?language=objc)
    #[unsafe(super(NEFilterProvider, NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterDataProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterDataProvider {}
);

impl NEFilterDataProvider {
    extern_methods!(
        /// This function is called by the framework when a filtering decision needs to be made about a new network data flow. Subclasses must override this method to implement the steps necessary to match the flow against some locally stored rules and return an appropriate verdict.
        ///
        /// Parameter `flow`: An NEFilterFlow object containing details about the new flow.
        ///
        /// Returns: An NEFilterNewFlowVerdict object containing the verdict for the new flow.
        #[unsafe(method(handleNewFlow:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleNewFlow(&self, flow: &NEFilterFlow)
            -> Retained<NEFilterNewFlowVerdict>;

        /// This function is called by the framework when a filtering decision needs to be made about some inbound data that the filter previously requested access to via the NEFilterFlowDataVerdict or the NEFilterNewFlowVerdict. Subclasses must override this method.
        ///
        /// Parameter `flow`: The NEFilterFlow from which the data was read.
        ///
        /// Parameter `offset`: The offset in bytes from the start of the flow's inbound data at which readBytes begins.
        ///
        /// Parameter `readBytes`: The data that was read.  For non-UDP/TCP flows, since data may optionally include the IP header, readBytes includes a 4-bytes NEFilterDataAttribute field preceding the user data.  Handler must examine the NEFilterDataAttribute field and handle the data accordingly.
        ///
        /// Returns: An NEFilterFlowDataVerdict containing the verdict for the flow.
        #[unsafe(method(handleInboundDataFromFlow:readBytesStartOffset:readBytes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleInboundDataFromFlow_readBytesStartOffset_readBytes(
            &self,
            flow: &NEFilterFlow,
            offset: NSUInteger,
            read_bytes: &NSData,
        ) -> Retained<NEFilterDataVerdict>;

        /// This function is called by the framework when a filtering decision needs to be made about some outbound data that the filter previously requested access to via the NEFilterFlowDataVerdict or the NEFilterNewFlowVerdict. Subclasses must override this method.
        ///
        /// Parameter `flow`: The NEFilterFlow from which the data was read.
        ///
        /// Parameter `offset`: The offset in bytes from the start of the flow's outbound data at which readBytes begins.
        ///
        /// Parameter `readBytes`: The data that was read.  For non-UDP/TCP flows, since data may optionally include the IP header, readBytes includes a 4-bytes NEFilterDataAttribute field preceding the user data.  Handler must examine the NEFilterDataAttribute field and handle the data accordingly.
        ///
        /// Returns: An NEFilterFlowDataVerdict containing the verdict for the flow.
        #[unsafe(method(handleOutboundDataFromFlow:readBytesStartOffset:readBytes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleOutboundDataFromFlow_readBytesStartOffset_readBytes(
            &self,
            flow: &NEFilterFlow,
            offset: NSUInteger,
            read_bytes: &NSData,
        ) -> Retained<NEFilterDataVerdict>;

        /// This function is called by the framework after all of the inbound data for a flow has been seen by the filter. Subclasses must override this method to return an appropriate pass/block result.
        ///
        /// Parameter `flow`: The flow
        ///
        /// Returns: The final NEFilterFlowDataVerdict verdict for the flow.
        #[unsafe(method(handleInboundDataCompleteForFlow:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleInboundDataCompleteForFlow(
            &self,
            flow: &NEFilterFlow,
        ) -> Retained<NEFilterDataVerdict>;

        /// This function is called by the framework after all of the outbound data for a flow has been seen by the filter. Subclasses must override this method to return an appropriate pass/block result.
        ///
        /// Parameter `flow`: The flow
        ///
        /// Returns: The final NEFilterFlowDataVerdict verdict for the flow.
        #[unsafe(method(handleOutboundDataCompleteForFlow:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleOutboundDataCompleteForFlow(
            &self,
            flow: &NEFilterFlow,
        ) -> Retained<NEFilterDataVerdict>;

        /// This function is called by the framework after the user requests remediation for a blocked flow. Subclasses must override this method to return an appropriate pass/block result.
        ///
        /// Parameter `flow`: The flow
        ///
        /// Returns: The final NEFilterRemediationVerdict verdict for the flow.
        #[unsafe(method(handleRemediationForFlow:))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleRemediationForFlow(
            &self,
            flow: &NEFilterFlow,
        ) -> Retained<NEFilterRemediationVerdict>;

        /// This function is called by the framework when -[NEFilterControlProvider notifyRulesChanged] is called. Subclasses should override this method to reload new rules from disk.
        #[unsafe(method(handleRulesChanged))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleRulesChanged(&self);

        #[cfg(feature = "block2")]
        /// The provider calls this function to apply the current set of filtering rules associated with the provider and also change the default filtering action.
        ///
        /// Parameter `settings`: A NEFilterSettings object containing the filter settings to apply to the system. Pass nil to revert to the default settings, which are an
        /// empty list of rules and a default action of NEFilterActionFilterData.
        ///
        /// Parameter `completionHandler`: A block that will be executed when the settings have been applied to the system. If an error occurs then the error parameter will be non-nil.
        #[unsafe(method(applySettings:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn applySettings_completionHandler(
            &self,
            settings: Option<&NEFilterSettings>,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// This function is called by the provider to resume a flow that was previously paused by the provider returning a pause verdict.
        ///
        /// Parameter `flow`: The flow to resume
        ///
        /// Parameter `verdict`: The next NEFilterDataVerdict for the flow. This verdict is used as the verdict corresponding to the
        /// flow handler callback (handleNewFlow:, handleInboundDataFromFlow:, etc.) that returned the pause verdict that
        /// paused the flow. This must be either a NEFilterDataVerdict or a NEFilterNewFlowVerdict. It is invalid to resume
        /// a flow that is not paused.
        #[unsafe(method(resumeFlow:withVerdict:))]
        #[unsafe(method_family = none)]
        pub unsafe fn resumeFlow_withVerdict(&self, flow: &NEFilterFlow, verdict: &NEFilterVerdict);

        /// This function is called by the provider to update the verdict for a flow outside the context of any NEFilterDataProvider callback.
        ///
        /// Parameter `flow`: The NEFilterSocketFlow to update the verdict for.
        ///
        /// Parameter `verdict`: The NEFilterDataVerdict. Must be a +[NEFilterDataVerdict allowVerdict], a +[NEFilterDataVerdict dropVerdict], or a +[NEFilterDataVerdict dataVerdictWithPassBytes:peekBytes:].
        ///
        /// Parameter `direction`: The direction to which the verdict applies. Pass NETrafficDirectionAny to update the verdict for both the inbound and outbound directions. This parameter is ignored if the verdict is +[NEFilterDataVerdict dropVerdict].
        #[unsafe(method(updateFlow:usingVerdict:forDirection:))]
        #[unsafe(method_family = none)]
        pub unsafe fn updateFlow_usingVerdict_forDirection(
            &self,
            flow: &NEFilterSocketFlow,
            verdict: &NEFilterDataVerdict,
            direction: NETrafficDirection,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterDataProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterDataVerdict class declares the programmatic interface of an object that is the verdict for a flow of network data after some of the data has been seen by the filter.
    ///
    /// NEFilterDataVerdict is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterdataverdict?language=objc)
    #[unsafe(super(NEFilterVerdict, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterDataVerdict;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterDataVerdict {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterDataVerdict {}
);

unsafe impl CopyingHelper for NEFilterDataVerdict {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterDataVerdict {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterDataVerdict {}
);

impl NEFilterDataVerdict {
    extern_methods!(
        /// The frequency at which the data provider's -[NEFilterProvider handleReport:] method is called with a NEFilterReport instance with an event of NEFilterReportEventFlowStatistics.
        /// The default value is NEFilterReportFrequencyNone, so by default no statistics are reported.
        #[unsafe(method(statisticsReportFrequency))]
        #[unsafe(method_family = none)]
        pub unsafe fn statisticsReportFrequency(&self) -> NEFilterReportFrequency;

        /// Setter for [`statisticsReportFrequency`][Self::statisticsReportFrequency].
        #[unsafe(method(setStatisticsReportFrequency:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setStatisticsReportFrequency(
            &self,
            statistics_report_frequency: NEFilterReportFrequency,
        );

        /// This class method returns a verdict indicating that the flow should be allowed.
        ///
        /// Returns: The NEFilterDataVerdict object.
        #[unsafe(method(allowVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn allowVerdict() -> Retained<NEFilterDataVerdict>;

        /// This class method returns a verdict indicating that the flow should be dropped.
        ///
        /// Returns: The NEFilterDataVerdict object.
        #[unsafe(method(dropVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn dropVerdict() -> Retained<NEFilterDataVerdict>;

        /// This class method returns a verdict indicating that a "content blocked" page should be displayed to the user. The block page should contain a link to the given URL.
        ///
        /// Parameter `remediationURLMapKey`: Remediation map key used by data plugin to get remediation url. Passing nil will result into data provider being notified with the callback handleRemediationForFlow:
        ///
        /// Parameter `remediationButtonTextMapKey`: Remediation button map key used by the data plugin to get the remediation button text. Passing nil will set the button text to "Request Access"
        ///
        /// Returns: The NEFilterDataVerdict object.
        #[unsafe(method(remediateVerdictWithRemediationURLMapKey:remediationButtonTextMapKey:))]
        #[unsafe(method_family = none)]
        pub unsafe fn remediateVerdictWithRemediationURLMapKey_remediationButtonTextMapKey(
            remediation_url_map_key: Option<&NSString>,
            remediation_button_text_map_key: Option<&NSString>,
        ) -> Retained<NEFilterDataVerdict>;

        /// This class method returns a data verdict indicating that the filter is passing a given number of bytes through the filter and needs to see a given number of bytes after the bytes that are passed.
        ///
        /// Parameter `passBytes`: The number of bytes to pass through the filter.
        ///
        /// Parameter `peekBytes`: The number of bytes after the end of the bytes passed that the filter wants to see in the next call to -[NEFilterDataProvider handleOutboundDataFromFlow:readBytesStartOffset:readBytes:] or -[NEFilterDataProvider handleInboundDataFromFlow:readBytesStartOffset:readBytes:].
        ///
        /// Returns: The data flow verdict.
        #[unsafe(method(dataVerdictWithPassBytes:peekBytes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn dataVerdictWithPassBytes_peekBytes(
            pass_bytes: NSUInteger,
            peek_bytes: NSUInteger,
        ) -> Retained<NEFilterDataVerdict>;

        /// This class method returns a verdict indicating that control provider needs to be asked how to handle the data flow. The control provider can either drop or allow the flow, or update the rules and ask the data provider to decide on the data flow again.
        ///
        /// Returns: The NEFilterDataVerdict object.
        #[unsafe(method(needRulesVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn needRulesVerdict() -> Retained<NEFilterDataVerdict>;

        /// This class method returns a verdict indicating that none of the data provider's handler callbacks shall be called for the flow until after the flow is resumed
        /// by a call to -[NEFilterDataProvider resumeFlow:withVerdict:]. TCP flows may be paused indefinitely. UDP flows will be dropped if not resumed within 10 seconds of
        /// being paused. It is invalid to pause a flow that is already paused.
        ///
        /// Returns: The NEFilterDataVerdict object.
        #[unsafe(method(pauseVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn pauseVerdict() -> Retained<NEFilterDataVerdict>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterDataVerdict {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterRemediationVerdict class declares the programmatic interface of an object that is the verdict for a flow which has been blocked by the filter, but the user has made a request for remediation.
    ///
    /// NEFilterRemediationVerdict is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterremediationverdict?language=objc)
    #[unsafe(super(NEFilterVerdict, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterRemediationVerdict;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterRemediationVerdict {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterRemediationVerdict {}
);

unsafe impl CopyingHelper for NEFilterRemediationVerdict {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterRemediationVerdict {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterRemediationVerdict {}
);

impl NEFilterRemediationVerdict {
    extern_methods!(
        /// This class method returns a verdict indicating that the flow should be allowed.
        ///
        /// Returns: The NEFilterRemediationVerdict object.
        #[unsafe(method(allowVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn allowVerdict() -> Retained<NEFilterRemediationVerdict>;

        /// This class method returns a verdict indicating that the flow should be dropped.
        ///
        /// Returns: The NEFilterRemediationVerdict object.
        #[unsafe(method(dropVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn dropVerdict() -> Retained<NEFilterRemediationVerdict>;

        /// This class method returns a verdict indicating that control provider needs to be asked how to handle the remediation. The control provider can either drop or allow the flow, or update the rules and ask the data provider to decide on the data flow again.
        ///
        /// Returns: The NEFilterRemediationVerdict object.
        #[unsafe(method(needRulesVerdict))]
        #[unsafe(method_family = none)]
        pub unsafe fn needRulesVerdict() -> Retained<NEFilterRemediationVerdict>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterRemediationVerdict {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Filter error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltermanagererror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEFilterManagerError(pub NSInteger);
impl NEFilterManagerError {
    #[doc(alias = "NEFilterManagerErrorConfigurationInvalid")]
    pub const ConfigurationInvalid: Self = Self(1);
    #[doc(alias = "NEFilterManagerErrorConfigurationDisabled")]
    pub const ConfigurationDisabled: Self = Self(2);
    #[doc(alias = "NEFilterManagerErrorConfigurationStale")]
    pub const ConfigurationStale: Self = Self(3);
    #[doc(alias = "NEFilterManagerErrorConfigurationCannotBeRemoved")]
    pub const ConfigurationCannotBeRemoved: Self = Self(4);
    #[doc(alias = "NEFilterManagerErrorConfigurationPermissionDenied")]
    pub const ConfigurationPermissionDenied: Self = Self(5);
    #[doc(alias = "NEFilterManagerErrorConfigurationInternalError")]
    pub const ConfigurationInternalError: Self = Self(6);
}

unsafe impl Encode for NEFilterManagerError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEFilterManagerError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltererrordomain?language=objc)
    pub static NEFilterErrorDomain: &'static NSString;
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterconfigurationdidchangenotification?language=objc)
    pub static NEFilterConfigurationDidChangeNotification: &'static NSString;
}

/// Filter grade
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltermanagergrade?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEFilterManagerGrade(pub NSInteger);
impl NEFilterManagerGrade {
    #[doc(alias = "NEFilterManagerGradeFirewall")]
    pub const Firewall: Self = Self(1);
    #[doc(alias = "NEFilterManagerGradeInspector")]
    pub const Inspector: Self = Self(2);
}

unsafe impl Encode for NEFilterManagerGrade {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEFilterManagerGrade {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEFilterManager class declares the programmatic interface for an object that manages content filtering configurations.
    ///
    /// NEFilterManager declares methods and properties for configuring and controlling a filter.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltermanager?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterManager {}
);

impl NEFilterManager {
    extern_methods!(
        /// Returns: The singleton NEFilterManager object for the calling process.
        #[unsafe(method(sharedManager))]
        #[unsafe(method_family = none)]
        pub unsafe fn sharedManager() -> Retained<NEFilterManager>;

        #[cfg(feature = "block2")]
        /// This function loads the current filter configuration from the caller's filter preferences.
        ///
        /// Parameter `completionHandler`: A block that will be called when the load operation is completed. The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function removes the filter configuration from the caller's filter preferences. If the filter is enabled, the filter becomes disabled.
        ///
        /// Parameter `completionHandler`: A block that will be called when the remove operation is completed. The NSError passed to this block will be nil if the remove operation succeeded, non-nil otherwise.
        #[unsafe(method(removeFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function saves the filter configuration in the caller's filter preferences. If the filter is enabled, it will become active.
        ///
        /// Parameter `completionHandler`: A block that will be called when the save operation is completed. The NSError passed to this block will be nil if the save operation succeeded, non-nil otherwise.
        #[unsafe(method(saveToPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn saveToPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// A string containing a description of the filter.
        #[unsafe(method(localizedDescription))]
        #[unsafe(method_family = none)]
        pub unsafe fn localizedDescription(&self) -> Option<Retained<NSString>>;

        /// Setter for [`localizedDescription`][Self::localizedDescription].
        #[unsafe(method(setLocalizedDescription:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLocalizedDescription(&self, localized_description: Option<&NSString>);

        /// An NEFilterProviderConfiguration object containing the provider-specific portion of the filter configuration.
        #[unsafe(method(providerConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerConfiguration(
            &self,
        ) -> Option<Retained<NEFilterProviderConfiguration>>;

        /// Setter for [`providerConfiguration`][Self::providerConfiguration].
        #[unsafe(method(setProviderConfiguration:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderConfiguration(
            &self,
            provider_configuration: Option<&NEFilterProviderConfiguration>,
        );

        /// Toggles the enabled status of the filter. On iOS, setting this property will disable filter configurations of other apps, and this property will be set to NO when other filter configurations are enabled.
        /// On macOS, up to 4 filter configurations of the same grade can be enabled simultaneously.
        #[unsafe(method(isEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isEnabled(&self) -> bool;

        /// Setter for [`isEnabled`][Self::isEnabled].
        #[unsafe(method(setEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnabled(&self, enabled: bool);

        /// The grade of the filter. The default grade is NEFilterManagerGradeFirewall.
        #[unsafe(method(grade))]
        #[unsafe(method_family = none)]
        pub unsafe fn grade(&self) -> NEFilterManagerGrade;

        /// Setter for [`grade`][Self::grade].
        #[unsafe(method(setGrade:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setGrade(&self, grade: NEFilterManagerGrade);

        /// Causes the content filter to disable any other installed encrypted DNS settings, including iCloud Private Relay system-wide DNS encryption. This should only be used if
        /// the content filter expects to intercept cleartext UDP DNS packets.
        #[unsafe(method(disableEncryptedDNSSettings))]
        #[unsafe(method_family = none)]
        pub unsafe fn disableEncryptedDNSSettings(&self) -> bool;

        /// Setter for [`disableEncryptedDNSSettings`][Self::disableEncryptedDNSSettings].
        #[unsafe(method(setDisableEncryptedDNSSettings:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDisableEncryptedDNSSettings(&self, disable_encrypted_dns_settings: bool);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterPacketContext class identifies the current filtering context.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterpacketcontext?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterPacketContext;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterPacketContext {}
);

impl NEFilterPacketContext {
    extern_methods!();
}

/// Methods declared on superclass `NSObject`.
impl NEFilterPacketContext {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Verdict for a packet
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterpacketproviderverdict?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEFilterPacketProviderVerdict(pub NSInteger);
impl NEFilterPacketProviderVerdict {
    #[doc(alias = "NEFilterPacketProviderVerdictAllow")]
    pub const Allow: Self = Self(0);
    #[doc(alias = "NEFilterPacketProviderVerdictDrop")]
    pub const Drop: Self = Self(1);
    #[doc(alias = "NEFilterPacketProviderVerdictDelay")]
    pub const Delay: Self = Self(2);
}

unsafe impl Encode for NEFilterPacketProviderVerdict {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEFilterPacketProviderVerdict {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEFilterPacketProvider class declares the programmatic interface for an object that evaluates network packets decisions about whether to block, allow, or delay the packets.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterpacketprovider?language=objc)
    #[unsafe(super(NEFilterProvider, NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterPacketProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterPacketProvider {}
);

impl NEFilterPacketProvider {
    extern_methods!(
        /// This function is used to delay a packet currently presented by packetHandler.
        /// This function is only valid within the packetHandler block and a verdict of
        /// NEFilterPacketProviderVerdictDelay must be returned after a packet is delayed.  A delayed
        /// packet will be prevented from continuing its journey through the networking stack until
        /// it is either allowed by calling allow() or is dropped by being released.
        ///
        /// Parameter `context`: The context of the current packet filter which is passed to the packetHandler block.
        /// The packetHandler block must pass this context when calling delayCurrentPacket().
        #[unsafe(method(delayCurrentPacket:))]
        #[unsafe(method_family = none)]
        pub unsafe fn delayCurrentPacket(
            &self,
            context: &NEFilterPacketContext,
        ) -> Retained<NEPacket>;

        /// This function is used to allow a previously-delayed packet to continue its journey into or out of the networking stack.
        ///
        /// Parameter `packet`: A NEPacket object that contains the data of the packet that was previously delayed by the NEFilterPacketProvider.
        #[unsafe(method(allowPacket:))]
        #[unsafe(method_family = none)]
        pub unsafe fn allowPacket(&self, packet: &NEPacket);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterPacketProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterProviderConfiguration class declares the programmatic interface of an object that configures a plugin-based content filter.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterproviderconfiguration?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterProviderConfiguration;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterProviderConfiguration {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterProviderConfiguration {}
);

unsafe impl CopyingHelper for NEFilterProviderConfiguration {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterProviderConfiguration {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterProviderConfiguration {}
);

impl NEFilterProviderConfiguration {
    extern_methods!(
        /// If YES, the filter plugin will be allowed to filter browser traffic. If NO, the filter plugin will not see any browser flows. Defaults to NO. At least one of filterBrowsers and filterSockets should be set to YES to make the filter take effect.
        #[deprecated = "filterBrowsers is not supported on macOS"]
        #[unsafe(method(filterBrowsers))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterBrowsers(&self) -> bool;

        /// Setter for [`filterBrowsers`][Self::filterBrowsers].
        #[deprecated = "filterBrowsers is not supported on macOS"]
        #[unsafe(method(setFilterBrowsers:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setFilterBrowsers(&self, filter_browsers: bool);

        /// If YES, the filter plugin will be allowed to filter socket traffic. If NO, the filter plugin will not see any socket flows. Defaults to NO. At least one of filterBrowsers and filterSockets should be set to YES to make the filter take effect.
        #[unsafe(method(filterSockets))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterSockets(&self) -> bool;

        /// Setter for [`filterSockets`][Self::filterSockets].
        #[unsafe(method(setFilterSockets:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setFilterSockets(&self, filter_sockets: bool);

        /// If YES, a NEFilterPacketProvider will be instantiated and will be allowed to filter packets.
        #[unsafe(method(filterPackets))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterPackets(&self) -> bool;

        /// Setter for [`filterPackets`][Self::filterPackets].
        #[unsafe(method(setFilterPackets:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setFilterPackets(&self, filter_packets: bool);

        /// An optional dictionary of plugin-specific keys to be passed to the plugin.
        #[unsafe(method(vendorConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn vendorConfiguration(
            &self,
        ) -> Option<Retained<NSDictionary<NSString, AnyObject>>>;

        /// Setter for [`vendorConfiguration`][Self::vendorConfiguration].
        #[unsafe(method(setVendorConfiguration:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setVendorConfiguration(
            &self,
            vendor_configuration: Option<&NSDictionary<NSString, AnyObject>>,
        );

        /// The optional address of the server used to support the filter.
        #[unsafe(method(serverAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn serverAddress(&self) -> Option<Retained<NSString>>;

        /// Setter for [`serverAddress`][Self::serverAddress].
        #[unsafe(method(setServerAddress:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setServerAddress(&self, server_address: Option<&NSString>);

        /// The optional username associated with the filter.
        #[unsafe(method(username))]
        #[unsafe(method_family = none)]
        pub unsafe fn username(&self) -> Option<Retained<NSString>>;

        /// Setter for [`username`][Self::username].
        #[unsafe(method(setUsername:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUsername(&self, username: Option<&NSString>);

        /// The optional organization associated with the filter.
        #[unsafe(method(organization))]
        #[unsafe(method_family = none)]
        pub unsafe fn organization(&self) -> Option<Retained<NSString>>;

        /// Setter for [`organization`][Self::organization].
        #[unsafe(method(setOrganization:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setOrganization(&self, organization: Option<&NSString>);

        /// The optional password keychain reference associated with the filter.
        #[unsafe(method(passwordReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn passwordReference(&self) -> Option<Retained<NSData>>;

        /// Setter for [`passwordReference`][Self::passwordReference].
        #[unsafe(method(setPasswordReference:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setPasswordReference(&self, password_reference: Option<&NSData>);

        /// The optional certificate identity keychain reference associated with the filter.
        #[unsafe(method(identityReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityReference(&self) -> Option<Retained<NSData>>;

        /// Setter for [`identityReference`][Self::identityReference].
        #[unsafe(method(setIdentityReference:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityReference(&self, identity_reference: Option<&NSData>);

        /// A string containing the bundle identifier of the NEFilterDataProvider app extension or system extension.
        /// If this property is nil, then the bundle identifier of the NEFilterDataProvider extension in the calling app's
        /// bundle is used, and if the calling app's bundle contains more than one NEFilterDataProvider extension then which one will
        /// be used is undefined.
        #[unsafe(method(filterDataProviderBundleIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterDataProviderBundleIdentifier(&self) -> Option<Retained<NSString>>;

        /// Setter for [`filterDataProviderBundleIdentifier`][Self::filterDataProviderBundleIdentifier].
        #[unsafe(method(setFilterDataProviderBundleIdentifier:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setFilterDataProviderBundleIdentifier(
            &self,
            filter_data_provider_bundle_identifier: Option<&NSString>,
        );

        /// A string containing the bundle identifier of the NEFilterPacketProvider app extension or system extension.
        /// If this property is nil, then the bundle identifier of the NEFilterPacketProvider extension in the calling app's
        /// bundle is used, and if the calling app's bundle contains more than one NEFilterPacketProvider extension then which one will
        /// be used is undefined.
        #[unsafe(method(filterPacketProviderBundleIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterPacketProviderBundleIdentifier(&self) -> Option<Retained<NSString>>;

        /// Setter for [`filterPacketProviderBundleIdentifier`][Self::filterPacketProviderBundleIdentifier].
        #[unsafe(method(setFilterPacketProviderBundleIdentifier:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setFilterPacketProviderBundleIdentifier(
            &self,
            filter_packet_provider_bundle_identifier: Option<&NSString>,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterProviderConfiguration {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterRule class declares the programmatic interface of an object that defines a rule for matching network traffic and the action to take when the rule matches.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefilterrule?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterRule;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterRule {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterRule {}
);

unsafe impl CopyingHelper for NEFilterRule {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterRule {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterRule {}
);

impl NEFilterRule {
    extern_methods!(
        /// Initialize a newly-allocated NEFilterRule object
        ///
        /// Parameter `networkRule`: A NENetworkRule object that defines the network traffic characteristics that this rule matches.
        ///
        /// Parameter `action`: The action to take when this rule matches.
        #[unsafe(method(initWithNetworkRule:action:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithNetworkRule_action(
            this: Allocated<Self>,
            network_rule: &NENetworkRule,
            action: NEFilterAction,
        ) -> Retained<Self>;

        /// The NENetworkRule that defines the network traffic characteristics that this rule matches.
        #[unsafe(method(networkRule))]
        #[unsafe(method_family = none)]
        pub unsafe fn networkRule(&self) -> Retained<NENetworkRule>;

        /// The action to take when this rule matches network traffic.
        #[unsafe(method(action))]
        #[unsafe(method_family = none)]
        pub unsafe fn action(&self) -> NEFilterAction;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterRule {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFilterSettings class declares the programmatic interface for an object that contains filter settings.
    ///
    /// NEFilterSettings is used by NEFilterDataProviders to communicate the desired settings for the filter to the framework. The framework takes care of applying the contained settings to the system.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nefiltersettings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFilterSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEFilterSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFilterSettings {}
);

unsafe impl CopyingHelper for NEFilterSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFilterSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFilterSettings {}
);

impl NEFilterSettings {
    extern_methods!(
        /// Initialize a newly-allocated NEFilterSettings object with a set of filtering rules and a default filter action to takke if none
        /// of the rules match.
        ///
        /// Parameter `rules`: An NSArray containing an ordered list of NEFilterRule objects. The maximum number of rules that this array can contain is 1000.
        ///
        /// Parameter `defaultAction`: The NEFilterAction to take for flows of network (non-loopback) data that do not match any of the specified rules. The default defaultAction is
        /// NEFilterActionFilterData. If defaultAction is NEFilterActionAllow or NEFilterActionDrop, then the rules array must contain at least one NEFilterRule.
        /// The default action for loopback traffic is NEFilterActionAllow and cannot be changed. To filter loopback traffic you must include rules in the rules array that specifically match loopback traffic
        /// and have an action of NEFilterActionFilterData.
        ///
        /// Returns: the newly-initialized NEFilterSettings object.
        #[unsafe(method(initWithRules:defaultAction:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithRules_defaultAction(
            this: Allocated<Self>,
            rules: &NSArray<NEFilterRule>,
            default_action: NEFilterAction,
        ) -> Retained<Self>;

        /// An NSArray containing an ordered list of NEFilterRuleObjects. After the NEFilterSettings are applied to the system,
        /// each network flow is matched against these rules in order, and the NEFilterAction of the first rule that matches is taken:
        /// NEFilterActionAllow: Allow the flow of data to proceed on its journey through the networking stack without consulting this provider.
        /// NEFilterActionDrop: Drop the flow without consulting this provider.
        /// NEFilterActionFilterData: Call this provider's handleNewFlow: method with the flow.
        #[unsafe(method(rules))]
        #[unsafe(method_family = none)]
        pub unsafe fn rules(&self) -> Retained<NSArray<NEFilterRule>>;

        /// An NEFilterAction containing the default action to take for flows of network data that do not match any of the specified rules.
        #[unsafe(method(defaultAction))]
        #[unsafe(method_family = none)]
        pub unsafe fn defaultAction(&self) -> NEFilterAction;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFilterSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEFlowMetaData class declares the programmatic interface for an object that contains extra information about a flow.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neflowmetadata?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEFlowMetaData;
);

extern_conformance!(
    unsafe impl NSCoding for NEFlowMetaData {}
);

extern_conformance!(
    unsafe impl NSCopying for NEFlowMetaData {}
);

unsafe impl CopyingHelper for NEFlowMetaData {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEFlowMetaData {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEFlowMetaData {}
);

impl NEFlowMetaData {
    extern_methods!(
        /// A byte string that uniquely identifies the binary for each build of the source application of the flow. The data object may be empty in cases where the flow originates from a system process.
        #[unsafe(method(sourceAppUniqueIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceAppUniqueIdentifier(&self) -> Retained<NSData>;

        /// A string containing the signing identifier (almost always equivalent to the bundle identifier) of the source app of the flow. The string may be empty in cases where the flow originates from a system process.
        #[unsafe(method(sourceAppSigningIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceAppSigningIdentifier(&self) -> Retained<NSString>;

        /// Audit token of the source application of the flow.
        #[unsafe(method(sourceAppAuditToken))]
        #[unsafe(method_family = none)]
        pub unsafe fn sourceAppAuditToken(&self) -> Option<Retained<NSData>>;

        /// The identifier of the content filter flow corresponding to this flow.
        #[unsafe(method(filterFlowIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn filterFlowIdentifier(&self) -> Option<Retained<NSUUID>>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEFlowMetaData {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Wi-Fi network security type
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotnetworksecuritytype?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotNetworkSecurityType(pub NSInteger);
impl NEHotspotNetworkSecurityType {
    #[doc(alias = "NEHotspotNetworkSecurityTypeOpen")]
    pub const Open: Self = Self(0);
    #[doc(alias = "NEHotspotNetworkSecurityTypeWEP")]
    pub const WEP: Self = Self(1);
    #[doc(alias = "NEHotspotNetworkSecurityTypePersonal")]
    pub const Personal: Self = Self(2);
    #[doc(alias = "NEHotspotNetworkSecurityTypeEnterprise")]
    pub const Enterprise: Self = Self(3);
    #[doc(alias = "NEHotspotNetworkSecurityTypeUnknown")]
    pub const Unknown: Self = Self(4);
}

unsafe impl Encode for NEHotspotNetworkSecurityType {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotNetworkSecurityType {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEHotspotNetwork class provides a class method to get the SSID and BSSID of
    /// the current Wi-Fi network.
    ///
    /// NEHotspotNetwork is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotnetwork?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotNetwork;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotNetwork {}
);

impl NEHotspotNetwork {
    extern_methods!(
        /// The SSID of the Wi-Fi network.
        #[unsafe(method(SSID))]
        #[unsafe(method_family = none)]
        pub unsafe fn SSID(&self) -> Retained<NSString>;

        /// The BSSID of the Wi-Fi network.
        #[unsafe(method(BSSID))]
        #[unsafe(method_family = none)]
        pub unsafe fn BSSID(&self) -> Retained<NSString>;

        /// The security type of the Wi-Fi network.
        #[unsafe(method(securityType))]
        #[unsafe(method_family = none)]
        pub unsafe fn securityType(&self) -> NEHotspotNetworkSecurityType;

        #[cfg(feature = "block2")]
        /// This method returns SSID, BSSID and security type of the current Wi-Fi network when the
        /// requesting application meets one of following 4 requirements -.
        /// 1. application is using CoreLocation API and has user's authorization to access precise location.
        /// 2. application has used NEHotspotConfiguration API to configure the current Wi-Fi network.
        /// 3. application has active VPN configurations installed.
        /// 4. application has active NEDNSSettingsManager configuration installed.
        /// An application will receive nil if it fails to meet any of the above 4 requirements.
        /// An application will receive nil if does not have the "com.apple.developer.networking.wifi-info" entitlement.
        ///
        /// Parameter `completionHandler`: A block that will be executed when current Wi-Fi network details are
        /// obtained from the system. The NEHotspotNetwork object passed to this block will be nil if the requesting
        /// application fails to meet above requirements, non-nil otherwise. NEHotspotNetwork object contains only valid
        /// SSID, BSSID and security type values, when the block is passed non-nil object.This block is executed on application's
        /// main queue.
        #[unsafe(method(fetchCurrentWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn fetchCurrentWithCompletionHandler(
            completion_handler: &block2::DynBlock<dyn Fn(*mut NEHotspotNetwork)>,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotNetwork {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// The type of the NEHotspotHelperCommand object.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspothelpercommandtype?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotHelperCommandType(pub NSInteger);
impl NEHotspotHelperCommandType {
    #[doc(alias = "kNEHotspotHelperCommandTypeNone")]
    pub const None: Self = Self(0);
    #[doc(alias = "kNEHotspotHelperCommandTypeFilterScanList")]
    pub const FilterScanList: Self = Self(1);
    #[doc(alias = "kNEHotspotHelperCommandTypeEvaluate")]
    pub const Evaluate: Self = Self(2);
    #[doc(alias = "kNEHotspotHelperCommandTypeAuthenticate")]
    pub const Authenticate: Self = Self(3);
    #[doc(alias = "kNEHotspotHelperCommandTypePresentUI")]
    pub const PresentUI: Self = Self(4);
    #[doc(alias = "kNEHotspotHelperCommandTypeMaintain")]
    pub const Maintain: Self = Self(5);
    #[doc(alias = "kNEHotspotHelperCommandTypeLogoff")]
    pub const Logoff: Self = Self(6);
}

unsafe impl Encode for NEHotspotHelperCommandType {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotHelperCommandType {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// The result of processing the NEHotspotHelperCommand.
///
/// The HotspotHelper provides the result of
/// processing the NEHotspotHelperCommand when it instantiates
/// its NEHotspotHelperResponse.
///
///
///
/// interaction. This result is only valid in response to a command with type
/// kNEHotspotHelperCommandTypeAuthenticate.
///
/// recognize the command type.
///
/// authentication again. This result is only valid in response to a
/// command with type kNEHotspotHelperCommandTypeMaintain.
///
/// authenticate, the helper determined that it can't perform the
/// authentication. This result is only valid in response to commands of type
/// kNEHotspotHelperCommandTypeAuthenticate and
/// kNEHotspotHelperCommandTypePresentUI.
///
/// it is temporarily unable to perform the authentication.
/// This result is only valid in response to commands of type
/// kNEHotspotHelperCommandTypeAuthenticate and
/// kNEHotspotHelperCommandTypePresentUI.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspothelperresult?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotHelperResult(pub NSInteger);
impl NEHotspotHelperResult {
    #[doc(alias = "kNEHotspotHelperResultSuccess")]
    pub const Success: Self = Self(0);
    #[doc(alias = "kNEHotspotHelperResultFailure")]
    pub const Failure: Self = Self(1);
    #[doc(alias = "kNEHotspotHelperResultUIRequired")]
    pub const UIRequired: Self = Self(2);
    #[doc(alias = "kNEHotspotHelperResultCommandNotRecognized")]
    pub const CommandNotRecognized: Self = Self(3);
    #[doc(alias = "kNEHotspotHelperResultAuthenticationRequired")]
    pub const AuthenticationRequired: Self = Self(4);
    #[doc(alias = "kNEHotspotHelperResultUnsupportedNetwork")]
    pub const UnsupportedNetwork: Self = Self(5);
    #[doc(alias = "kNEHotspotHelperResultTemporaryFailure")]
    pub const TemporaryFailure: Self = Self(6);
}

unsafe impl Encode for NEHotspotHelperResult {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotHelperResult {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// The HotspotHelper's confidence in its ability to handle the network.
///
/// The HotspotHelper indicates its confidence in being able to handle the
/// given hotspot network.
///
/// the network.
///
/// in being able to handle the network.
///
/// in being able to handle the network.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspothelperconfidence?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotHelperConfidence(pub NSInteger);
impl NEHotspotHelperConfidence {
    #[doc(alias = "kNEHotspotHelperConfidenceNone")]
    pub const None: Self = Self(0);
    #[doc(alias = "kNEHotspotHelperConfidenceLow")]
    pub const Low: Self = Self(1);
    #[doc(alias = "kNEHotspotHelperConfidenceHigh")]
    pub const High: Self = Self(2);
}

unsafe impl Encode for NEHotspotHelperConfidence {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotHelperConfidence {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// HotspotHelper.
/// Extends NEHotspotNetwork class to support conveying information about the
/// network to the HotspotHelper. When the HotspotHelper is asked to evaluate
/// the current network or filter the Wi-Fi scan list, it annotates the NEHotspotNetwork
/// via the setConfidence method.
impl NEHotspotNetwork {
    extern_methods!(
        /// The signal strength for the Wi-Fi network. The value lies within
        /// the range 0.0 (weak/no signal) to 1.0 (strong signal).
        #[unsafe(method(signalStrength))]
        #[unsafe(method_family = none)]
        pub unsafe fn signalStrength(&self) -> c_double;

        /// Indicates whether the network is secure
        #[unsafe(method(isSecure))]
        #[unsafe(method_family = none)]
        pub unsafe fn isSecure(&self) -> bool;

        /// Indicates whether the network was joined automatically
        /// (YES) or joined by the user (NO).
        #[unsafe(method(didAutoJoin))]
        #[unsafe(method_family = none)]
        pub unsafe fn didAutoJoin(&self) -> bool;

        /// Indicates whether the network was just joined. Useful in the
        /// Maintaining state to differentiate whether the Maintain command
        /// is for the initial join, or the subsequent periodic callback.
        #[unsafe(method(didJustJoin))]
        #[unsafe(method_family = none)]
        pub unsafe fn didJustJoin(&self) -> bool;

        /// Indicates whether the HotspotHelper is the chosen helper for
        /// the network. The NEHotspotNetwork must have been instantiated via a
        /// call to the +[NEHotspotHelper supportedNetworkInterfaces] method. This
        /// is useful to restore state after the HotspotHelper application is quit
        /// and restarted.
        #[unsafe(method(isChosenHelper))]
        #[unsafe(method_family = none)]
        pub unsafe fn isChosenHelper(&self) -> bool;

        /// Indicate the confidence in being able to handle the network.
        ///
        /// Use this method to indicate the confidence in being able to
        /// successfully authenticate to the given network. Used in the response
        /// to the kNEHotspotHelperCommandTypeEvaluate and
        /// kNEHotspotHelperCommandTypeFilterScanList commands.
        #[unsafe(method(setConfidence:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setConfidence(&self, confidence: NEHotspotHelperConfidence);

        /// Provide the password for a secure network
        ///
        /// The HotspotHelper may set a password for a secure network. The format
        /// password string must adhere to IEEE 802.11 guidelines appropriate for
        /// the particular security scheme.
        ///
        /// Used only in the response to the kNEHotspotHelperCommandTypeFilterScanList
        /// command.
        #[unsafe(method(setPassword:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setPassword(&self, password: &NSString);
    );
}

extern_class!(
    /// An NEHotspotHelperCommand object is provided to the helper's
    /// command handler block. The HotspotHelper processes the command
    /// instantiates an NEHotspotHelperResponse object, sets the annotated
    /// network or networkList (Evaluate/FilterScanList only),
    /// then delivers it.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspothelpercommand?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotHelperCommand;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotHelperCommand {}
);

impl NEHotspotHelperCommand {
    extern_methods!(
        /// The type of the command.
        #[unsafe(method(commandType))]
        #[unsafe(method_family = none)]
        pub unsafe fn commandType(&self) -> NEHotspotHelperCommandType;

        /// The network associated with the command. May be nil.
        #[unsafe(method(network))]
        #[unsafe(method_family = none)]
        pub unsafe fn network(&self) -> Option<Retained<NEHotspotNetwork>>;

        /// The list of networks associated with a command. Will be nil unless
        /// the command type is kNEHotspotHelperCommandTypeFilterScanList.
        /// This property returns an NSArray of NEHotspotNetwork.
        #[unsafe(method(networkList))]
        #[unsafe(method_family = none)]
        pub unsafe fn networkList(&self) -> Option<Retained<NSArray<NEHotspotNetwork>>>;

        /// Create a response to the command.
        ///
        /// Instantiate an NEHotspotHelperResponse for the command.
        ///
        /// Returns: NEHotspotHelperResponse with the specified result.
        #[unsafe(method(createResponse:))]
        #[unsafe(method_family = none)]
        pub unsafe fn createResponse(
            &self,
            result: NEHotspotHelperResult,
        ) -> Retained<NEHotspotHelperResponse>;

        /// Create a new TCP connection over the interface associated with the command.
        ///
        /// Instantiate an NWTCPConnection to the specified endpoint
        /// bound to the network interface associated with the command.
        ///
        /// Returns: non-nil NWTCPConnection object if successful, nil otherwise
        #[deprecated = "Use the `interface` property with `nw_parameters_require_interface`"]
        #[unsafe(method(createTCPConnection:))]
        #[unsafe(method_family = none)]
        pub unsafe fn createTCPConnection(
            &self,
            endpoint: &NWEndpoint,
        ) -> Retained<NWTCPConnection>;

        /// Create a new UDP session over the interface associated with the command.
        ///
        /// Instantiate an NWUDPSession to the specified endpoint
        /// bound to the network interface associated with the command.
        ///
        /// Returns: non-nil NWUDPSession object if successful, nil otherwise
        #[deprecated = "Use the `interface` property with `nw_parameters_require_interface`"]
        #[unsafe(method(createUDPSession:))]
        #[unsafe(method_family = none)]
        pub unsafe fn createUDPSession(&self, endpoint: &NWEndpoint) -> Retained<NWUDPSession>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotHelperCommand {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The HotspotHelper creates an NEHotspotHelperResponse object to provide
    /// the results of running the corresponding NEHotspotHelperCommand.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspothelperresponse?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotHelperResponse;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotHelperResponse {}
);

impl NEHotspotHelperResponse {
    extern_methods!(
        /// Set the network that conveys the confidence level.
        ///
        /// Provide the annotated NEHotspotNetwork object in the response to the
        /// kNEHotspotHelperCommandTypeEvaluate command. The helper sets the
        /// confidence in the network object to indicate its ability to handle
        /// the current network.
        #[unsafe(method(setNetwork:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setNetwork(&self, network: &NEHotspotNetwork);

        /// Set the list of handled networks.
        ///
        /// Provide an NSArray of annotated NEHotspotNetwork objects in response
        /// to the kNEHotspotHelperCommandTypeFilterScanList command.
        /// The helper provides the list of network objects that it is capable of
        /// handling with at least low confidence. Networks that it has no
        /// confidence in handling should not be specified.
        #[unsafe(method(setNetworkList:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setNetworkList(&self, network_list: &NSArray<NEHotspotNetwork>);

        /// Delivers the response to the command.
        ///
        /// Deliver the NEHotspotHelperResponse to the HotspotHelper infrastructure.
        #[unsafe(method(deliver))]
        #[unsafe(method_family = none)]
        pub unsafe fn deliver(&self);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotHelperResponse {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// The type definition for the HotspotHelper's command handler block.
///
/// The application provides a block of this type when it
/// invokes the +[NEHotspotHelper registerWithOptions:queue:handler] method.
/// The block is invoked every time there is a command to be processed.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspothelperhandler?language=objc)
#[cfg(feature = "block2")]
pub type NEHotspotHelperHandler = *mut block2::DynBlock<dyn Fn(NonNull<NEHotspotHelperCommand>)>;

extern_class!(
    /// The NEHotspotHelper class allows an application to register itself as a
    /// HotspotHelper.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspothelper?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotHelper;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotHelper {}
);

impl NEHotspotHelper {
    extern_methods!(
        #[cfg(all(feature = "block2", feature = "dispatch2"))]
        /// Register the application as a HotspotHelper.
        ///
        /// Once this API is invoked successfully, the application becomes
        /// eligible to be launched in the background and participate in
        /// various hotspot related functions.
        ///
        /// This function should be called once when the application starts up.
        /// Invoking it again will have no effect and result in FALSE being returned.
        ///
        /// The 'options' dictionary may be nil, or contain the single property
        /// kNEHotspotHelperOptionDisplayName.
        ///
        ///
        /// Parameter `options`: If not nil, 'options' is an NSDictionary containing
        /// kNEHotspotHelperOption* keys (currently just
        /// kNEHotspotHelperOptionDisplayName).
        ///
        /// Parameter `queue`: The dispatch_queue_t to invoke the handle block on.
        ///
        /// Parameter `handler`: The NEHotspotHelperHandler block to execute to process
        /// helper commands.
        ///
        /// Returns: YES if the registration was successful, NO otherwise.
        ///
        /// Note: Notes
        ///
        /// Note: 1
        /// The application's Info.plist MUST include a UIBackgroundModes array
        /// containing 'network-authentication'.
        ///
        /// Note: 2
        /// The application MUST set 'com.apple.developer.networking.HotspotHelper'
        /// as one of its entitlements. The value of the entitlement is a boolean
        /// value true.
        #[unsafe(method(registerWithOptions:queue:handler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn registerWithOptions_queue_handler(
            options: Option<&NSDictionary<NSString, NSObject>>,
            queue: &DispatchQueue,
            handler: NEHotspotHelperHandler,
        ) -> bool;

        /// Terminate the authentication session.
        ///
        /// The application invokes this method when it wants to logoff from the
        /// current network. Invoking this method causes an NEHotspotHelperCommand
        /// of type kNEHotspotHelperCommandTypeLogoff to be issued to the application's
        /// 'handler' block (see +[NEHotspotHelper registerWithOptions:queue:handler]).
        ///
        /// 'network' must correspond to the currently associated Wi-Fi network
        /// i.e. it must have come from the NEHotspotHelperCommand's 'network' property
        /// or from the +[NEHotspotHelper supportedInterfaces] method.
        ///
        /// Returns: YES if the logoff command was successfully queued, NO otherwise.
        ///
        /// Note: Notes
        ///
        /// Note: 1
        /// The application MUST NOT actually logoff from the network until it
        /// receives the command to logoff.
        ///
        /// Note: 2
        /// After the application invokes -[NEHotspotHelperResponse deliver] indicating
        /// kNEHotspotHelperResultSuccess, the Wi-Fi network is disassociated.
        #[unsafe(method(logoff:))]
        #[unsafe(method_family = none)]
        pub unsafe fn logoff(network: &NEHotspotNetwork) -> bool;

        /// Return the list of network interfaces managed by the
        /// HotspotHelper infrastructure.
        ///
        /// Each network interface is represented by an NEHotspotNetwork object.
        /// Currently, the returned array contains exactly one NEHotspotNetwork
        /// object representing the Wi-Fi interface.
        ///
        /// The main purpose of this method is to allow a HotspotHelper to provide
        /// accurate status in its UI at times when it has not been given a command
        /// to process. This method coupled with -[NEHotspotNetwork isChosenHelper]
        /// allows the application to know whether it is the one that is handling
        /// the current network.
        ///
        /// Returns: nil if no network interfaces are being managed,
        /// non-nil NSArray of NEHotspotNetwork objects otherwise.
        #[unsafe(method(supportedNetworkInterfaces))]
        #[unsafe(method_family = none)]
        pub unsafe fn supportedNetworkInterfaces() -> Option<Retained<NSArray>>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotHelper {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

mod private_NSMutableURLRequestNEHotspotHelper {
    pub trait Sealed {}
}

/// Category "NEHotspotHelper" on [`NSMutableURLRequest`].
/// Extend NSMutableURLRequest to include a method to bind the
/// request to the network interface associated with the specified
/// NEHotspotHelperCommand object.
#[doc(alias = "NEHotspotHelper")]
pub unsafe trait NSMutableURLRequestNEHotspotHelper:
    ClassType + Sized + private_NSMutableURLRequestNEHotspotHelper::Sealed
{
    extern_methods!(
        /// Binds the NSMutableURLRequest to the network interface associated with
        /// the NEHotspotHelperCommand object.
        #[unsafe(method(bindToHotspotHelperCommand:))]
        #[unsafe(method_family = none)]
        unsafe fn bindToHotspotHelperCommand(&self, command: &NEHotspotHelperCommand);
    );
}

impl private_NSMutableURLRequestNEHotspotHelper::Sealed for NSMutableURLRequest {}
unsafe impl NSMutableURLRequestNEHotspotHelper for NSMutableURLRequest {}

/// EAP Type.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotconfigurationeaptype?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotConfigurationEAPType(pub NSInteger);
impl NEHotspotConfigurationEAPType {
    #[doc(alias = "NEHotspotConfigurationEAPTypeEAPTLS")]
    pub const EAPTLS: Self = Self(13);
    #[doc(alias = "NEHotspotConfigurationEAPTypeEAPTTLS")]
    pub const EAPTTLS: Self = Self(21);
    #[doc(alias = "NEHotspotConfigurationEAPTypeEAPPEAP")]
    pub const EAPPEAP: Self = Self(25);
    #[doc(alias = "NEHotspotConfigurationEAPTypeEAPFAST")]
    pub const EAPFAST: Self = Self(43);
}

unsafe impl Encode for NEHotspotConfigurationEAPType {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotConfigurationEAPType {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// TTLS Inner Authentication Type.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotconfigurationttlsinnerauthenticationtype?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotConfigurationTTLSInnerAuthenticationType(pub NSInteger);
impl NEHotspotConfigurationTTLSInnerAuthenticationType {
    #[doc(alias = "NEHotspotConfigurationEAPTTLSInnerAuthenticationPAP")]
    pub const EAPTTLSInnerAuthenticationPAP: Self = Self(0);
    #[doc(alias = "NEHotspotConfigurationEAPTTLSInnerAuthenticationCHAP")]
    pub const EAPTTLSInnerAuthenticationCHAP: Self = Self(1);
    #[doc(alias = "NEHotspotConfigurationEAPTTLSInnerAuthenticationMSCHAP")]
    pub const EAPTTLSInnerAuthenticationMSCHAP: Self = Self(2);
    #[doc(alias = "NEHotspotConfigurationEAPTTLSInnerAuthenticationMSCHAPv2")]
    pub const EAPTTLSInnerAuthenticationMSCHAPv2: Self = Self(3);
    #[doc(alias = "NEHotspotConfigurationEAPTTLSInnerAuthenticationEAP")]
    pub const EAPTTLSInnerAuthenticationEAP: Self = Self(4);
}

unsafe impl Encode for NEHotspotConfigurationTTLSInnerAuthenticationType {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotConfigurationTTLSInnerAuthenticationType {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// TLS version to use during TLS handshke.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotconfigurationeaptlsversion?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotConfigurationEAPTLSVersion(pub NSInteger);
impl NEHotspotConfigurationEAPTLSVersion {
    #[doc(alias = "NEHotspotConfigurationEAPTLSVersion_1_0")]
    pub const Version_1_0: Self = Self(0);
    #[doc(alias = "NEHotspotConfigurationEAPTLSVersion_1_1")]
    pub const Version_1_1: Self = Self(1);
    #[doc(alias = "NEHotspotConfigurationEAPTLSVersion_1_2")]
    pub const Version_1_2: Self = Self(2);
}

unsafe impl Encode for NEHotspotConfigurationEAPTLSVersion {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotConfigurationEAPTLSVersion {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// NEHotspotHS20Settings class provides a set of properties that are required
    /// to discover and negotiate Hotspot 2.0 Wi-Fi networks.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspoths20settings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotHS20Settings;
);

extern_conformance!(
    unsafe impl NSCoding for NEHotspotHS20Settings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEHotspotHS20Settings {}
);

unsafe impl CopyingHelper for NEHotspotHS20Settings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotHS20Settings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEHotspotHS20Settings {}
);

impl NEHotspotHS20Settings {
    extern_methods!(
        /// Domain Name of Legacy Hotspot or Hotspot 2.0 Wi-Fi Network.
        /// This Domain Name is used for Wi-Fi Hotspot 2.0 negotiation.
        #[unsafe(method(domainName))]
        #[unsafe(method_family = none)]
        pub unsafe fn domainName(&self) -> Retained<NSString>;

        /// If set to YES, allows connection to networks of roaming service
        /// providers. Defaults to NO.
        #[unsafe(method(isRoamingEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isRoamingEnabled(&self) -> bool;

        /// Setter for [`isRoamingEnabled`][Self::isRoamingEnabled].
        #[unsafe(method(setRoamingEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setRoamingEnabled(&self, roaming_enabled: bool);

        /// Array of Roaming Consortium Organization Identifiers used
        /// for Wi-Fi Hotspot 2.0 negotiation.
        #[unsafe(method(roamingConsortiumOIs))]
        #[unsafe(method_family = none)]
        pub unsafe fn roamingConsortiumOIs(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`roamingConsortiumOIs`][Self::roamingConsortiumOIs].
        #[unsafe(method(setRoamingConsortiumOIs:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setRoamingConsortiumOIs(&self, roaming_consortium_o_is: &NSArray<NSString>);

        /// Array of Network Access Identifier Realm names used for
        /// Wi-Fi Hotspot 2.0 negotiation.
        #[unsafe(method(naiRealmNames))]
        #[unsafe(method_family = none)]
        pub unsafe fn naiRealmNames(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`naiRealmNames`][Self::naiRealmNames].
        #[unsafe(method(setNaiRealmNames:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setNaiRealmNames(&self, nai_realm_names: &NSArray<NSString>);

        /// Array of Mobile Country Code (MCC)/Mobile Network Code (MNC)
        /// pairs used for Wi-Fi Hotspot 2.0 negotiation. Each string must contain
        /// exactly six digits.
        #[unsafe(method(MCCAndMNCs))]
        #[unsafe(method_family = none)]
        pub unsafe fn MCCAndMNCs(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`MCCAndMNCs`][Self::MCCAndMNCs].
        #[unsafe(method(setMCCAndMNCs:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMCCAndMNCs(&self, mcc_and_mn_cs: &NSArray<NSString>);

        /// A designated initializer to instantiate a new NEHotspotHSSettings object.
        /// This initializer is used to configure Legacy Hotspot or HS2.0 Wi-Fi Networks.
        ///
        ///
        /// Parameter `domainName`: The domain name of HS2.0 Wi-Fi Network
        ///
        /// Parameter `roamingEnabled`: If YES, allows connections to networks of roaming service providers.
        #[unsafe(method(initWithDomainName:roamingEnabled:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithDomainName_roamingEnabled(
            this: Allocated<Self>,
            domain_name: &NSString,
            roaming_enabled: bool,
        ) -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotHS20Settings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// NEHotspotEAPSettings class provides a set of properties that are required
    /// to configure a WPA/WPA2 Enterprise or Hotspot 2.0 Wi-Fi networks.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspoteapsettings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotEAPSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEHotspotEAPSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEHotspotEAPSettings {}
);

unsafe impl CopyingHelper for NEHotspotEAPSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotEAPSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEHotspotEAPSettings {}
);

impl NEHotspotEAPSettings {
    extern_methods!(
        /// Array of supported EAP Types. Refer to NEHotspotConfigurationEAPType
        /// for valid values.
        #[unsafe(method(supportedEAPTypes))]
        #[unsafe(method_family = none)]
        pub unsafe fn supportedEAPTypes(&self) -> Retained<NSArray<NSNumber>>;

        /// Setter for [`supportedEAPTypes`][Self::supportedEAPTypes].
        #[unsafe(method(setSupportedEAPTypes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSupportedEAPTypes(&self, supported_eap_types: &NSArray<NSNumber>);

        /// A UTF-8 encoded string containing username component of the user authentication
        /// credentials. Length of this property must be between 1 and 253 characters.
        #[unsafe(method(username))]
        #[unsafe(method_family = none)]
        pub unsafe fn username(&self) -> Retained<NSString>;

        /// Setter for [`username`][Self::username].
        #[unsafe(method(setUsername:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUsername(&self, username: &NSString);

        /// Identity string to be used in EAP-Response/Identity of the outer phase. This key is only
        /// relevant to TTLS, PEAP, and EAP-FAST.
        #[unsafe(method(outerIdentity))]
        #[unsafe(method_family = none)]
        pub unsafe fn outerIdentity(&self) -> Retained<NSString>;

        /// Setter for [`outerIdentity`][Self::outerIdentity].
        #[unsafe(method(setOuterIdentity:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setOuterIdentity(&self, outer_identity: &NSString);

        /// Specifies the inner authentication used by the TTLS module.
        /// Possible values are PAP, CHAP, MSCHAP, MSCHAPv2, and EAP. Defaults to EAP.
        #[unsafe(method(ttlsInnerAuthenticationType))]
        #[unsafe(method_family = none)]
        pub unsafe fn ttlsInnerAuthenticationType(
            &self,
        ) -> NEHotspotConfigurationTTLSInnerAuthenticationType;

        /// Setter for [`ttlsInnerAuthenticationType`][Self::ttlsInnerAuthenticationType].
        #[unsafe(method(setTtlsInnerAuthenticationType:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTtlsInnerAuthenticationType(
            &self,
            ttls_inner_authentication_type: NEHotspotConfigurationTTLSInnerAuthenticationType,
        );

        /// The password component of the 802.1X authentication credential.
        /// Length of this property must be between 1 and 64 characters.
        #[unsafe(method(password))]
        #[unsafe(method_family = none)]
        pub unsafe fn password(&self) -> Retained<NSString>;

        /// Setter for [`password`][Self::password].
        #[unsafe(method(setPassword:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setPassword(&self, password: &NSString);

        /// Array of server certificate common names that will be used to verify server's certificate.
        /// The string could have wildcards to specify the name, such as "*.mycompany.net". If a server presents
        /// a certificate with DNSName or Common Name that isn't in this list, it won't be trusted.
        #[unsafe(method(trustedServerNames))]
        #[unsafe(method_family = none)]
        pub unsafe fn trustedServerNames(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`trustedServerNames`][Self::trustedServerNames].
        #[unsafe(method(setTrustedServerNames:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTrustedServerNames(&self, trusted_server_names: &NSArray<NSString>);

        /// If YES, supports two-factor authentication for EAP-TTLS, PEAP, or EAP-FAST.
        /// If NO, allows for zero-factor authentication for EAP-TLS. The default is YES for EAP-TLS,
        /// and NO for other EAP types.
        #[unsafe(method(isTLSClientCertificateRequired))]
        #[unsafe(method_family = none)]
        pub unsafe fn isTLSClientCertificateRequired(&self) -> bool;

        /// Setter for [`isTLSClientCertificateRequired`][Self::isTLSClientCertificateRequired].
        #[unsafe(method(setTlsClientCertificateRequired:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTlsClientCertificateRequired(&self, tls_client_certificate_required: bool);

        /// TLS version to use during the TLS handshake.
        /// Default value is NEHotspotConfigurationEAPTLSVersion_1_2.
        #[unsafe(method(preferredTLSVersion))]
        #[unsafe(method_family = none)]
        pub unsafe fn preferredTLSVersion(&self) -> NEHotspotConfigurationEAPTLSVersion;

        /// Setter for [`preferredTLSVersion`][Self::preferredTLSVersion].
        #[unsafe(method(setPreferredTLSVersion:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setPreferredTLSVersion(
            &self,
            preferred_tls_version: NEHotspotConfigurationEAPTLSVersion,
        );

        #[cfg(feature = "objc2-security")]
        /// Setter to configure the EAP peer identity. The application needs to store
        /// this identity in keychain access group "$(TeamIdentifierPrefix)com.apple.networkextensionsharing".
        /// The API uses SecItemCopyMatching to obtain persistent reference for this identity from application's
        /// keychain and uses that at the time of EAP authentication.
        /// This property is mandatory when EAP-TLS is desired or tlsClientCertificateRequired is set to YES.
        ///
        ///
        /// Parameter `identity`: The identity of the EAP Peer. This is a SecIdentityRef object that contains
        /// a SecKeyRef object and an associated SecCertificateRef object.
        ///
        /// Returns: returns NO if the parameter is not an object of SecIdentityRef type or if the persistent reference
        /// is not found in the application's keychain else returns YES.
        #[unsafe(method(setIdentity:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentity(&self, identity: &SecIdentity) -> bool;

        /// Setter to configure an array of trusted server certificates used for trust evaluation of
        /// the server certificate.
        ///
        ///
        /// Parameter `certificates`: Each value in the array is a SecCertificateRef object. Application needs to store
        /// the certificates in keychain access group "$(TeamIdentifierPrefix)com.apple.networkextensionsharing".
        /// The API uses SecItemCopyMatching to obtain persistent reference for each certificate from application's
        /// keychain and uses that at the time os EAP authentication.
        /// Number of elements in the array cannot be more than 10.
        ///
        ///
        /// Returns: returns NO if any element in the array is not an object of type SecCertificateRef or if API
        /// fails to find persistent reference for each element from the application's keychain else return YES.
        #[unsafe(method(setTrustedServerCertificates:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTrustedServerCertificates(&self, certificates: &NSArray) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotEAPSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEHotspotConfiguration class represents set of properties that are required
    /// to configure a Wi-Fi Network.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotconfiguration?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotConfiguration;
);

extern_conformance!(
    unsafe impl NSCoding for NEHotspotConfiguration {}
);

extern_conformance!(
    unsafe impl NSCopying for NEHotspotConfiguration {}
);

unsafe impl CopyingHelper for NEHotspotConfiguration {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotConfiguration {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEHotspotConfiguration {}
);

impl NEHotspotConfiguration {
    extern_methods!(
        /// SSID of the Wi-Fi Network.
        #[unsafe(method(SSID))]
        #[unsafe(method_family = none)]
        pub unsafe fn SSID(&self) -> Retained<NSString>;

        /// Prefix string of SSID of the Wi-Fi Network.
        #[unsafe(method(SSIDPrefix))]
        #[unsafe(method_family = none)]
        pub unsafe fn SSIDPrefix(&self) -> Retained<NSString>;

        /// if set to YES the configuration will not be persisted. Default is NO.
        #[unsafe(method(joinOnce))]
        #[unsafe(method_family = none)]
        pub unsafe fn joinOnce(&self) -> bool;

        /// Setter for [`joinOnce`][Self::joinOnce].
        #[unsafe(method(setJoinOnce:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setJoinOnce(&self, join_once: bool);

        /// The lifetime of the configuration in days. The configuration is stored for the
        /// number of days specified by this property. The minimum value is 1 day and maximum value is 365 days.
        /// A configuration does not get deleted automatically if this property is not set or set to an invalid value.
        /// This property does not apply to Enterprise and HS2.0 networks.
        #[unsafe(method(lifeTimeInDays))]
        #[unsafe(method_family = none)]
        pub unsafe fn lifeTimeInDays(&self) -> Retained<NSNumber>;

        /// Setter for [`lifeTimeInDays`][Self::lifeTimeInDays].
        #[unsafe(method(setLifeTimeInDays:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLifeTimeInDays(&self, life_time_in_days: &NSNumber);

        /// if set to YES the system will perform active scan of the SSID. Default is NO.
        #[unsafe(method(hidden))]
        #[unsafe(method_family = none)]
        pub unsafe fn hidden(&self) -> bool;

        /// Setter for [`hidden`][Self::hidden].
        #[unsafe(method(setHidden:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setHidden(&self, hidden: bool);

        /// A designated initializer to instantiate a new NEHotspotConfiguration object.
        /// This initializer is used to configure open Wi-Fi Networks.
        ///
        ///
        /// Parameter `SSID`: The SSID of the open Wi-Fi Network.
        /// Length of SSID must be between 1 and 32 characters.
        #[unsafe(method(initWithSSID:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithSSID(this: Allocated<Self>, ssid: &NSString) -> Retained<Self>;

        /// A designated initializer to instantiate a new NEHotspotConfiguration object.
        /// This initializer is used configure either WEP or WPA/WPA2 Personal Wi-Fi Networks.
        ///
        ///
        /// Parameter `SSID`: The SSID of the WEP or WPA/WPA2 Personal Wi-Fi Network
        ///
        /// Parameter `passphrase`: The passphrase credential.
        /// For WPA/WPA2 Personal networks: between 8 and 63 characters.
        /// For Static WEP(64bit)  : 10 Hex Digits
        /// For Static WEP(128bit) : 26 Hex Digits
        ///
        /// Parameter `isWEP`: YES specifies WEP Wi-Fi Network else WPA/WPA2 Personal Wi-Fi Network
        #[unsafe(method(initWithSSID:passphrase:isWEP:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithSSID_passphrase_isWEP(
            this: Allocated<Self>,
            ssid: &NSString,
            passphrase: &NSString,
            is_wep: bool,
        ) -> Retained<Self>;

        /// A designated initializer to instantiate a new NEHotspotConfiguration object.
        /// This initializer is used configure WPA/WPA2 Enterprise Wi-Fi Networks.
        ///
        ///
        /// Parameter `SSID`: The SSID of WPA/WPA2 Enterprise Wi-Fi Network
        ///
        /// Parameter `eapSettings`: EAP configuration
        #[unsafe(method(initWithSSID:eapSettings:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithSSID_eapSettings(
            this: Allocated<Self>,
            ssid: &NSString,
            eap_settings: &NEHotspotEAPSettings,
        ) -> Retained<Self>;

        /// A designated initializer to instantiate a new NEHotspotConfiguration object.
        /// This initializer is used configure HS2.0 Wi-Fi Networks.
        ///
        ///
        /// Parameter `hs20Settings`: Hotspot 2.0 configuration
        ///
        /// Parameter `eapSettings`: EAP configuration
        #[unsafe(method(initWithHS20Settings:eapSettings:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithHS20Settings_eapSettings(
            this: Allocated<Self>,
            hs20_settings: &NEHotspotHS20Settings,
            eap_settings: &NEHotspotEAPSettings,
        ) -> Retained<Self>;

        /// A designated initializer to instantiate a new NEHotspotConfiguration object.
        /// This initializer is used to configure open Wi-Fi Networks.
        ///
        ///
        /// Parameter `SSIDPrefix`: The prefix string of SSID of the open Wi-Fi Network.
        /// Length of SSIDPrefix must be between 3 and 32 characters.
        #[unsafe(method(initWithSSIDPrefix:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithSSIDPrefix(
            this: Allocated<Self>,
            ssid_prefix: &NSString,
        ) -> Retained<Self>;

        /// A designated initializer to instantiate a new NEHotspotConfiguration object.
        /// This initializer is used configure either WEP or WPA/WPA2 Personal Wi-Fi Networks.
        ///
        ///
        /// Parameter `SSIDPrefix`: The prefix string of SSID of the WEP or WPA/WPA2 Personal Wi-Fi Network.
        /// Length of SSIDPrefix must be between 3 and 32 characters.
        ///
        /// Parameter `passphrase`: The passphrase credential.
        /// For WPA/WPA2 Personal networks: between 8 and 63 characters.
        /// For Static WEP(64bit)  : 10 Hex Digits
        /// For Static WEP(128bit) : 26 Hex Digits
        ///
        /// Parameter `isWEP`: YES specifies WEP Wi-Fi Network else WPA/WPA2 Personal Wi-Fi Network
        #[unsafe(method(initWithSSIDPrefix:passphrase:isWEP:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithSSIDPrefix_passphrase_isWEP(
            this: Allocated<Self>,
            ssid_prefix: &NSString,
            passphrase: &NSString,
            is_wep: bool,
        ) -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotConfiguration {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotconfigurationerrordomain?language=objc)
    pub static NEHotspotConfigurationErrorDomain: &'static NSString;
}

/// Hotspot Configuration error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotconfigurationerror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEHotspotConfigurationError(pub NSInteger);
impl NEHotspotConfigurationError {
    #[doc(alias = "NEHotspotConfigurationErrorInvalid")]
    pub const Invalid: Self = Self(0);
    #[doc(alias = "NEHotspotConfigurationErrorInvalidSSID")]
    pub const InvalidSSID: Self = Self(1);
    #[doc(alias = "NEHotspotConfigurationErrorInvalidWPAPassphrase")]
    pub const InvalidWPAPassphrase: Self = Self(2);
    #[doc(alias = "NEHotspotConfigurationErrorInvalidWEPPassphrase")]
    pub const InvalidWEPPassphrase: Self = Self(3);
    #[doc(alias = "NEHotspotConfigurationErrorInvalidEAPSettings")]
    pub const InvalidEAPSettings: Self = Self(4);
    #[doc(alias = "NEHotspotConfigurationErrorInvalidHS20Settings")]
    pub const InvalidHS20Settings: Self = Self(5);
    #[doc(alias = "NEHotspotConfigurationErrorInvalidHS20DomainName")]
    pub const InvalidHS20DomainName: Self = Self(6);
    #[doc(alias = "NEHotspotConfigurationErrorUserDenied")]
    pub const UserDenied: Self = Self(7);
    #[doc(alias = "NEHotspotConfigurationErrorInternal")]
    pub const Internal: Self = Self(8);
    #[doc(alias = "NEHotspotConfigurationErrorPending")]
    pub const Pending: Self = Self(9);
    #[doc(alias = "NEHotspotConfigurationErrorSystemConfiguration")]
    pub const SystemConfiguration: Self = Self(10);
    #[doc(alias = "NEHotspotConfigurationErrorUnknown")]
    pub const Unknown: Self = Self(11);
    #[doc(alias = "NEHotspotConfigurationErrorJoinOnceNotSupported")]
    pub const JoinOnceNotSupported: Self = Self(12);
    #[doc(alias = "NEHotspotConfigurationErrorAlreadyAssociated")]
    pub const AlreadyAssociated: Self = Self(13);
    #[doc(alias = "NEHotspotConfigurationErrorApplicationIsNotInForeground")]
    pub const ApplicationIsNotInForeground: Self = Self(14);
    #[doc(alias = "NEHotspotConfigurationErrorInvalidSSIDPrefix")]
    pub const InvalidSSIDPrefix: Self = Self(15);
    #[doc(alias = "NEHotspotConfigurationErrorUserUnauthorized")]
    pub const UserUnauthorized: Self = Self(16);
    #[doc(alias = "NEHotspotConfigurationErrorSystemDenied")]
    pub const SystemDenied: Self = Self(17);
}

unsafe impl Encode for NEHotspotConfigurationError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEHotspotConfigurationError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEHotspotConfigurationManager class allows an application to
    /// Add/Update/Remove Wi-Fi Network Configuraton.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nehotspotconfigurationmanager?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEHotspotConfigurationManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEHotspotConfigurationManager {}
);

impl NEHotspotConfigurationManager {
    extern_methods!(
        #[unsafe(method(sharedManager))]
        #[unsafe(method_family = none)]
        pub unsafe fn sharedManager() -> Retained<NEHotspotConfigurationManager>;

        #[cfg(feature = "block2")]
        /// This function adds or updates a Wi-Fi network configuration.
        ///
        /// Parameter `configuration`: NEHotspotConfiguration object containing the Wi-Fi network configuration.
        ///
        /// Parameter `completionHandler`: A block that will be called when add/update operation is completed.
        /// Pass nil if application does not intend to receive the result.
        /// The NSError passed to this block will be nil if the configuration is successfully stored, non-nil otherwise.
        /// If the configuration is found invalid or API encounters some other error then completionHandler is called
        /// with instance of NSError containing appropriate error code. This API attempts to join the Wi-Fi network
        /// if the configuration is successfully added or updated and the network is found nearby.
        #[unsafe(method(applyConfiguration:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn applyConfiguration_completionHandler(
            &self,
            configuration: &NEHotspotConfiguration,
            completion_handler: Option<&block2::DynBlock<dyn Fn(*mut NSError)>>,
        );

        /// This function removes Wi-Fi configuration.
        /// If the joinOnce property was set to YES, invoking this method will disassociate from the Wi-Fi network
        /// after the configuration is removed.
        ///
        /// Parameter `SSID`: Wi-Fi SSID for which the configuration is to be deleted.
        #[unsafe(method(removeConfigurationForSSID:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeConfigurationForSSID(&self, ssid: &NSString);

        /// This function removes Wi-Fi configuration.
        ///
        /// Parameter `domainName`: HS2.0 domainName for which the configuration is to be deleted.
        #[unsafe(method(removeConfigurationForHS20DomainName:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeConfigurationForHS20DomainName(&self, domain_name: &NSString);

        #[cfg(feature = "block2")]
        /// This function returns array of SSIDs and HS2.0 Domain Names that the calling application has configured.
        /// It returns nil if there are no networks configurred by the calling application.
        #[unsafe(method(getConfiguredSSIDsWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn getConfiguredSSIDsWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(NonNull<NSArray<NSString>>)>,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NEHotspotConfigurationManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEIPv4Settings class declares the programmatic interface for an object that contains IPv4 settings.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neipv4settings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEIPv4Settings;
);

extern_conformance!(
    unsafe impl NSCoding for NEIPv4Settings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEIPv4Settings {}
);

unsafe impl CopyingHelper for NEIPv4Settings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEIPv4Settings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEIPv4Settings {}
);

impl NEIPv4Settings {
    extern_methods!(
        /// Initialize a newly-allocated NEIPv4Settings object.
        ///
        /// Parameter `addresses`: An array of IPv4 addresses represented as dotted decimal strings.
        ///
        /// Parameter `subnetMasks`: An array of IPv4 subnet masks represented as dotted decimal strings.
        ///
        /// Returns: The initialized object.
        #[unsafe(method(initWithAddresses:subnetMasks:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithAddresses_subnetMasks(
            this: Allocated<Self>,
            addresses: &NSArray<NSString>,
            subnet_masks: &NSArray<NSString>,
        ) -> Retained<Self>;

        /// Create a NEIPv4Settings object that will obtain IP addresses and netmasks using DHCP.
        ///
        /// Returns: The initialized object.
        #[unsafe(method(settingsWithAutomaticAddressing))]
        #[unsafe(method_family = none)]
        pub unsafe fn settingsWithAutomaticAddressing() -> Retained<Self>;

        /// An array of IPv4 addresses represented as dotted decimal strings. These addresses will be set on the virtual interface used by the VPN tunnel.
        #[unsafe(method(addresses))]
        #[unsafe(method_family = none)]
        pub unsafe fn addresses(&self) -> Retained<NSArray<NSString>>;

        /// An array of IPv4 subnet masks represented as dotted decimal strings. These subnet masks will be set along with their corresponding addresses from the addresses array on the virtual interface used by the VPN tunnel.
        #[unsafe(method(subnetMasks))]
        #[unsafe(method_family = none)]
        pub unsafe fn subnetMasks(&self) -> Retained<NSArray<NSString>>;

        /// The address of the next-hop gateway router represented as a dotted decimal string. This property is ignored for TUN interfaces.
        #[unsafe(method(router))]
        #[unsafe(method_family = none)]
        pub unsafe fn router(&self) -> Option<Retained<NSString>>;

        /// Setter for [`router`][Self::router].
        #[unsafe(method(setRouter:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setRouter(&self, router: Option<&NSString>);

        /// An array of NEIPv4Route objects. Traffic matching these routes will be routed through the virtual interface used by the VPN tunnel.
        #[unsafe(method(includedRoutes))]
        #[unsafe(method_family = none)]
        pub unsafe fn includedRoutes(&self) -> Option<Retained<NSArray<NEIPv4Route>>>;

        /// Setter for [`includedRoutes`][Self::includedRoutes].
        #[unsafe(method(setIncludedRoutes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIncludedRoutes(&self, included_routes: Option<&NSArray<NEIPv4Route>>);

        /// An array of NEIPv4Route objects. Traffic matching these routes will be routed through the current primary physical interface of the device.
        #[unsafe(method(excludedRoutes))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludedRoutes(&self) -> Option<Retained<NSArray<NEIPv4Route>>>;

        /// Setter for [`excludedRoutes`][Self::excludedRoutes].
        #[unsafe(method(setExcludedRoutes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludedRoutes(&self, excluded_routes: Option<&NSArray<NEIPv4Route>>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEIPv4Settings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEIPv4Route class declares the programmatic interface for an object that contains settings for an IPv4 route.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neipv4route?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEIPv4Route;
);

extern_conformance!(
    unsafe impl NSCoding for NEIPv4Route {}
);

extern_conformance!(
    unsafe impl NSCopying for NEIPv4Route {}
);

unsafe impl CopyingHelper for NEIPv4Route {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEIPv4Route {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEIPv4Route {}
);

impl NEIPv4Route {
    extern_methods!(
        /// Initialize a newly-allocated NEIPv4Route.
        ///
        /// Parameter `address`: The IPv4 address of the destination network.
        ///
        /// Parameter `subnetMask`: The subnet mask of the destination network.
        ///
        /// Returns: The initialized NEIPv4Route.
        #[unsafe(method(initWithDestinationAddress:subnetMask:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithDestinationAddress_subnetMask(
            this: Allocated<Self>,
            address: &NSString,
            subnet_mask: &NSString,
        ) -> Retained<Self>;

        /// An IPv4 address represented as a dotted decimal string.
        #[unsafe(method(destinationAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn destinationAddress(&self) -> Retained<NSString>;

        /// An IPv4 subnet mask represented as a dotted decimal string. This mask in combination with the destinationAddress property is used to determine the destination network of the route.
        #[unsafe(method(destinationSubnetMask))]
        #[unsafe(method_family = none)]
        pub unsafe fn destinationSubnetMask(&self) -> Retained<NSString>;

        /// The IPv4 address of the route's gateway. If this property is nil then the route's gateway will be set to the tunnel's virtual interface.
        #[unsafe(method(gatewayAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn gatewayAddress(&self) -> Option<Retained<NSString>>;

        /// Setter for [`gatewayAddress`][Self::gatewayAddress].
        #[unsafe(method(setGatewayAddress:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setGatewayAddress(&self, gateway_address: Option<&NSString>);

        /// Returns: A route object that represents the IPv4 default route.
        #[unsafe(method(defaultRoute))]
        #[unsafe(method_family = none)]
        pub unsafe fn defaultRoute() -> Retained<NEIPv4Route>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEIPv4Route {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEIPv6Settings class declares the programmatic interface for an object that contains IPv6 settings.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neipv6settings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEIPv6Settings;
);

extern_conformance!(
    unsafe impl NSCoding for NEIPv6Settings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEIPv6Settings {}
);

unsafe impl CopyingHelper for NEIPv6Settings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEIPv6Settings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEIPv6Settings {}
);

impl NEIPv6Settings {
    extern_methods!(
        /// Initialize a newly-allocated NEIPv6Settings object.
        ///
        /// Parameter `addresses`: An array of IPv6 addresses represented as dotted decimal strings.
        ///
        /// Parameter `networkPrefixLengths`: An array of NSNumber objects each containing the length in bits of the network prefix of the corresponding address in the addresses parameter.
        ///
        /// Returns: The initialized object.
        #[unsafe(method(initWithAddresses:networkPrefixLengths:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithAddresses_networkPrefixLengths(
            this: Allocated<Self>,
            addresses: &NSArray<NSString>,
            network_prefix_lengths: &NSArray<NSNumber>,
        ) -> Retained<Self>;

        /// Create a NEIPv6Settings object that will obtain IP addresses and netmasks automatically.
        #[unsafe(method(settingsWithAutomaticAddressing))]
        #[unsafe(method_family = none)]
        pub unsafe fn settingsWithAutomaticAddressing() -> Retained<Self>;

        /// Create a NEIPv6Settings object that will only use link-local IPv6 addresses.
        #[unsafe(method(settingsWithLinkLocalAddressing))]
        #[unsafe(method_family = none)]
        pub unsafe fn settingsWithLinkLocalAddressing() -> Retained<Self>;

        /// An array of IPv6 addresses represented strings. These addresses will be set on the virtual interface used by the VPN tunnel.
        #[unsafe(method(addresses))]
        #[unsafe(method_family = none)]
        pub unsafe fn addresses(&self) -> Retained<NSArray<NSString>>;

        /// An array of NSNumber objects each representing the length in bits of the network prefix of the corresponding address in the addresses property.
        #[unsafe(method(networkPrefixLengths))]
        #[unsafe(method_family = none)]
        pub unsafe fn networkPrefixLengths(&self) -> Retained<NSArray<NSNumber>>;

        /// An array of NEIPv6Route objects. Traffic matching these routes will be routed through the virtual interface used by the VPN tunnel.
        #[unsafe(method(includedRoutes))]
        #[unsafe(method_family = none)]
        pub unsafe fn includedRoutes(&self) -> Option<Retained<NSArray<NEIPv6Route>>>;

        /// Setter for [`includedRoutes`][Self::includedRoutes].
        #[unsafe(method(setIncludedRoutes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIncludedRoutes(&self, included_routes: Option<&NSArray<NEIPv6Route>>);

        /// An array of NEIPv6Route objects. Traffic matching these routes will be routed through the current primary physical interface of the device.
        #[unsafe(method(excludedRoutes))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludedRoutes(&self) -> Option<Retained<NSArray<NEIPv6Route>>>;

        /// Setter for [`excludedRoutes`][Self::excludedRoutes].
        #[unsafe(method(setExcludedRoutes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludedRoutes(&self, excluded_routes: Option<&NSArray<NEIPv6Route>>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEIPv6Settings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEIPv6Route class declares the programmatic interface for an object that contains settings for an IPv6 route.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neipv6route?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEIPv6Route;
);

extern_conformance!(
    unsafe impl NSCoding for NEIPv6Route {}
);

extern_conformance!(
    unsafe impl NSCopying for NEIPv6Route {}
);

unsafe impl CopyingHelper for NEIPv6Route {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEIPv6Route {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEIPv6Route {}
);

impl NEIPv6Route {
    extern_methods!(
        /// Initialize a newly-allocated NEIPv6Route.
        ///
        /// Parameter `address`: The IPv6 address of the destination network.
        ///
        /// Parameter `networkPrefixLength`: A number containing the length in bits of the network prefix of the destination network.
        ///
        /// Returns: The initialized NEIPv6Route.
        #[unsafe(method(initWithDestinationAddress:networkPrefixLength:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithDestinationAddress_networkPrefixLength(
            this: Allocated<Self>,
            address: &NSString,
            network_prefix_length: &NSNumber,
        ) -> Retained<Self>;

        /// An IPv6 address represented as a string.
        #[unsafe(method(destinationAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn destinationAddress(&self) -> Retained<NSString>;

        /// A number containing the length in bits of the network prefix of the destination network. This prefix in combination with the destinationAddress property is used to determine the destination network of the route.
        #[unsafe(method(destinationNetworkPrefixLength))]
        #[unsafe(method_family = none)]
        pub unsafe fn destinationNetworkPrefixLength(&self) -> Retained<NSNumber>;

        /// The IPv6 address of the route's gateway. If this property is nil then the route's gateway will be set to the tunnel's virtual interface.
        #[unsafe(method(gatewayAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn gatewayAddress(&self) -> Option<Retained<NSString>>;

        /// Setter for [`gatewayAddress`][Self::gatewayAddress].
        #[unsafe(method(setGatewayAddress:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setGatewayAddress(&self, gateway_address: Option<&NSString>);

        /// Returns: A route object that represents the IPv6 default route.
        #[unsafe(method(defaultRoute))]
        #[unsafe(method_family = none)]
        pub unsafe fn defaultRoute() -> Retained<NEIPv6Route>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEIPv6Route {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NETunnelNetworkSettings class declares the programmatic interface for an object that contains network settings.
    ///
    /// NETunnelNetworkSettings is used by NETunnelProviders to communicate the desired network settings for the tunnel to the framework. The framework takes care of applying the contained settings to the system.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelnetworksettings?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETunnelNetworkSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NETunnelNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NETunnelNetworkSettings {}
);

unsafe impl CopyingHelper for NETunnelNetworkSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NETunnelNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NETunnelNetworkSettings {}
);

impl NETunnelNetworkSettings {
    extern_methods!(
        /// This function initializes a newly-allocated NETunnelNetworkSettings object with a given tunnel remote address.
        ///
        /// Parameter `address`: The address of the remote endpoint that is providing the tunnel service.
        #[unsafe(method(initWithTunnelRemoteAddress:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithTunnelRemoteAddress(
            this: Allocated<Self>,
            address: &NSString,
        ) -> Retained<Self>;

        /// A string containing the IP address of the remote endpoint that is providing the tunnel service.
        #[unsafe(method(tunnelRemoteAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn tunnelRemoteAddress(&self) -> Retained<NSString>;

        /// An NEDNSSettings object that contains the desired tunnel DNS settings.
        #[unsafe(method(DNSSettings))]
        #[unsafe(method_family = none)]
        pub unsafe fn DNSSettings(&self) -> Option<Retained<NEDNSSettings>>;

        /// Setter for [`DNSSettings`][Self::DNSSettings].
        #[unsafe(method(setDNSSettings:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDNSSettings(&self, dns_settings: Option<&NEDNSSettings>);

        /// An NEProxySettings object that contains the desired tunnel proxy settings.
        #[unsafe(method(proxySettings))]
        #[unsafe(method_family = none)]
        pub unsafe fn proxySettings(&self) -> Option<Retained<NEProxySettings>>;

        /// Setter for [`proxySettings`][Self::proxySettings].
        #[unsafe(method(setProxySettings:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProxySettings(&self, proxy_settings: Option<&NEProxySettings>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NETunnelNetworkSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEPacketTunnelNetworkSettings class declares the programmatic interface for an object that contains IP network settings.
    ///
    /// NEPacketTunnelNetworkSettings is used by NEPacketTunnelProviders to communicate the desired IP network settings for the packet tunnel to the framework. The framework takes care of applying the contained settings to the system.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nepackettunnelnetworksettings?language=objc)
    #[unsafe(super(NETunnelNetworkSettings, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEPacketTunnelNetworkSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEPacketTunnelNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEPacketTunnelNetworkSettings {}
);

unsafe impl CopyingHelper for NEPacketTunnelNetworkSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEPacketTunnelNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEPacketTunnelNetworkSettings {}
);

impl NEPacketTunnelNetworkSettings {
    extern_methods!(
        /// An NEIPv4Settings object that contains the desired tunnel IPv4 settings.
        #[unsafe(method(IPv4Settings))]
        #[unsafe(method_family = none)]
        pub unsafe fn IPv4Settings(&self) -> Option<Retained<NEIPv4Settings>>;

        /// Setter for [`IPv4Settings`][Self::IPv4Settings].
        #[unsafe(method(setIPv4Settings:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIPv4Settings(&self, i_pv4_settings: Option<&NEIPv4Settings>);

        /// An NEIPv6Settings object that contains the desired tunnel IPv6 settings.
        #[unsafe(method(IPv6Settings))]
        #[unsafe(method_family = none)]
        pub unsafe fn IPv6Settings(&self) -> Option<Retained<NEIPv6Settings>>;

        /// Setter for [`IPv6Settings`][Self::IPv6Settings].
        #[unsafe(method(setIPv6Settings:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIPv6Settings(&self, i_pv6_settings: Option<&NEIPv6Settings>);

        /// An NSNumber object containing the number of bytes of overhead appended to each outbound packet through the tunnel. The MTU for the TUN interface is computed by subtracting this value from the MTU of the primary physical interface.
        #[unsafe(method(tunnelOverheadBytes))]
        #[unsafe(method_family = none)]
        pub unsafe fn tunnelOverheadBytes(&self) -> Option<Retained<NSNumber>>;

        /// Setter for [`tunnelOverheadBytes`][Self::tunnelOverheadBytes].
        #[unsafe(method(setTunnelOverheadBytes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTunnelOverheadBytes(&self, tunnel_overhead_bytes: Option<&NSNumber>);

        /// An NSNumber object containing the Maximum Transmission Unit (MTU) size in bytes to assign to the TUN interface. If this property is set, the tunnelOverheadBytes property is ignored.
        #[unsafe(method(MTU))]
        #[unsafe(method_family = none)]
        pub unsafe fn MTU(&self) -> Option<Retained<NSNumber>>;

        /// Setter for [`MTU`][Self::MTU].
        #[unsafe(method(setMTU:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMTU(&self, mtu: Option<&NSNumber>);
    );
}

/// Methods declared on superclass `NETunnelNetworkSettings`.
impl NEPacketTunnelNetworkSettings {
    extern_methods!(
        /// This function initializes a newly-allocated NETunnelNetworkSettings object with a given tunnel remote address.
        ///
        /// Parameter `address`: The address of the remote endpoint that is providing the tunnel service.
        #[unsafe(method(initWithTunnelRemoteAddress:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithTunnelRemoteAddress(
            this: Allocated<Self>,
            address: &NSString,
        ) -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEPacketTunnelNetworkSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEEthernetTunnelNetworkSettings class declares the programmatic interface for an object that contains network settings.
    ///
    /// NEEthernetTunnelNetworkSettings is used by NEEthernetTunnelProviders to communicate the desired network settings for the packet tunnel to the framework. The framework takes care of applying the contained settings to the system.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neethernettunnelnetworksettings?language=objc)
    #[unsafe(super(NEPacketTunnelNetworkSettings, NETunnelNetworkSettings, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEEthernetTunnelNetworkSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NEEthernetTunnelNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NEEthernetTunnelNetworkSettings {}
);

unsafe impl CopyingHelper for NEEthernetTunnelNetworkSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEEthernetTunnelNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEEthernetTunnelNetworkSettings {}
);

impl NEEthernetTunnelNetworkSettings {
    extern_methods!(
        /// This function initializes a newly-allocated NEEthernetTunnelNetworkSettings object with a given tunnel remote address and MAC address.
        ///
        /// Parameter `address`: The address of the remote endpoint that is providing the tunnel service.
        ///
        /// Parameter `ethernetAddress`: The ethernet address to be assigned to the tunnel interface. This string should be in the format "xx:xx:xx:xx:xx:xx", where each xx is a hexidecimal number between 0 and ff.
        ///
        /// Parameter `mtu`: The MTU (Maxium Transmission Unit) in bytes to be assigned to the tunnel interface.
        #[unsafe(method(initWithTunnelRemoteAddress:ethernetAddress:mtu:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithTunnelRemoteAddress_ethernetAddress_mtu(
            this: Allocated<Self>,
            address: &NSString,
            ethernet_address: &NSString,
            mtu: NSInteger,
        ) -> Retained<Self>;

        /// An NSString object containing the ethernet address of the tunnel interface.
        #[unsafe(method(ethernetAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn ethernetAddress(&self) -> Retained<NSString>;
    );
}

/// Methods declared on superclass `NETunnelNetworkSettings`.
impl NEEthernetTunnelNetworkSettings {
    extern_methods!(
        /// This function initializes a newly-allocated NETunnelNetworkSettings object with a given tunnel remote address.
        ///
        /// Parameter `address`: The address of the remote endpoint that is providing the tunnel service.
        #[unsafe(method(initWithTunnelRemoteAddress:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithTunnelRemoteAddress(
            this: Allocated<Self>,
            address: &NSString,
        ) -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEEthernetTunnelNetworkSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEPacketTunnelProvider class declares the programmatic interface of an object that implements the client side of a custom IP packet tunneling protocol.
    ///
    /// NEPacketTunnelProvider is part of NetworkExtension.framework.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nepackettunnelprovider?language=objc)
    #[unsafe(super(NETunnelProvider, NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEPacketTunnelProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEPacketTunnelProvider {}
);

impl NEPacketTunnelProvider {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function is called by the framework when a new tunnel is being created. Subclasses must override this method to perform whatever steps are necessary to establish the tunnel.
        ///
        /// Parameter `options`: A dictionary containing keys and values passed by the provider's containing app. If the containing app did not start the tunnel then this parameter will be nil.
        ///
        /// Parameter `completionHandler`: A block that must be called when the process of starting the tunnel is complete. If the tunnel cannot be established then the subclass' implementation of this method must pass a non-nil NSError object to this block. A value of nil passed to the completion handler indicates that the tunnel was successfully established.
        #[unsafe(method(startTunnelWithOptions:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn startTunnelWithOptions_completionHandler(
            &self,
            options: Option<&NSDictionary<NSString, NSObject>>,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function is called by the framework when the tunnel is being destroyed. Subclasses must override this method to perform whatever steps are necessary to tear down the tunnel.
        ///
        /// Parameter `reason`: An NEProviderStopReason indicating why the tunnel is being stopped.
        ///
        /// Parameter `completionHandler`: A block that must be called when the tunnel is completely torn down.
        #[unsafe(method(stopTunnelWithReason:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn stopTunnelWithReason_completionHandler(
            &self,
            reason: NEProviderStopReason,
            completion_handler: &block2::DynBlock<dyn Fn()>,
        );

        /// This function is called by tunnel provider implementations to initiate tunnel destruction when a network error is encountered that renders the tunnel no longer viable. Subclasses should not override this method.
        ///
        /// Parameter `error`: An NSError object containing details about the error that the tunnel provider implementation encountered.
        #[unsafe(method(cancelTunnelWithError:))]
        #[unsafe(method_family = none)]
        pub unsafe fn cancelTunnelWithError(&self, error: Option<&NSError>);

        /// An NEPacketFlow object that the tunnel provider implementation should use to receive packets from the network stack and inject packets into the network stack. Every time the tunnel is started the packet flow object is in an initialized state and must be explicitly opened before any packets can be received or injected.
        #[unsafe(method(packetFlow))]
        #[unsafe(method_family = none)]
        pub unsafe fn packetFlow(&self) -> Retained<NEPacketTunnelFlow>;

        /// This function can be called by subclass implementations to create a TCP connection to a given network endpoint, through the tunnel established by the provider. This function should not be overridden by subclasses.
        ///
        /// Parameter `remoteEndpoint`: An NWEndpoint object that specifies the remote network endpoint to connect to.
        ///
        /// Parameter `enableTLS`: A flag indicating if a TLS session should be negotiated on the connection.
        ///
        /// Parameter `TLSParameters`: A set of optional TLS parameters. Only valid if enableTLS is YES. If TLSParameters is nil, the default system parameters will be used for TLS negotiation.
        ///
        /// Parameter `delegate`: An object to use as the connection delegate. This object should conform to the NWTCPConnectionAuthenticationDelegate protocol.
        ///
        /// Returns: An NWTCPConnection object.
        #[deprecated = "Use the `virtualInterface` property with `nw_parameters_require_interface`"]
        #[unsafe(method(createTCPConnectionThroughTunnelToEndpoint:enableTLS:TLSParameters:delegate:))]
        #[unsafe(method_family = none)]
        pub unsafe fn createTCPConnectionThroughTunnelToEndpoint_enableTLS_TLSParameters_delegate(
            &self,
            remote_endpoint: &NWEndpoint,
            enable_tls: bool,
            tls_parameters: Option<&NWTLSParameters>,
            delegate: Option<&AnyObject>,
        ) -> Retained<NWTCPConnection>;

        /// This function can be called by subclass implementations to create a UDP session between a local network endpoint and a remote network endpoint, through the tunnel established by the provider. This function should not be overridden by subclasses.
        ///
        /// Parameter `remoteEndpoint`: An NWEndpoint object that specifies the remote endpoint to which UDP datagrams will be sent by the UDP session.
        ///
        /// Parameter `localEndpoint`: An NWHostEndpoint object that specifies the local IP address endpoint to use as the source endpoint of the UDP session.
        ///
        /// Returns: An NWUDPSession object.
        #[deprecated = "Use the `virtualInterface` property with `nw_parameters_require_interface`"]
        #[unsafe(method(createUDPSessionThroughTunnelToEndpoint:fromEndpoint:))]
        #[unsafe(method_family = none)]
        pub unsafe fn createUDPSessionThroughTunnelToEndpoint_fromEndpoint(
            &self,
            remote_endpoint: &NWEndpoint,
            local_endpoint: Option<&NWHostEndpoint>,
        ) -> Retained<NWUDPSession>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEPacketTunnelProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEEthernetTunnelProvider class declares the programmatic interface of an object that implements the client side of a custom link-layer packet tunneling protocol.
    ///
    /// NEEthernetTunnelProvider is part of NetworkExtension.framework.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neethernettunnelprovider?language=objc)
    #[unsafe(super(NEPacketTunnelProvider, NETunnelProvider, NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEEthernetTunnelProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEEthernetTunnelProvider {}
);

impl NEEthernetTunnelProvider {
    extern_methods!();
}

/// Methods declared on superclass `NSObject`.
impl NEEthernetTunnelProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// On Demand rule actions
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neondemandruleaction?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEOnDemandRuleAction(pub NSInteger);
impl NEOnDemandRuleAction {
    #[doc(alias = "NEOnDemandRuleActionConnect")]
    pub const Connect: Self = Self(1);
    #[doc(alias = "NEOnDemandRuleActionDisconnect")]
    pub const Disconnect: Self = Self(2);
    #[doc(alias = "NEOnDemandRuleActionEvaluateConnection")]
    pub const EvaluateConnection: Self = Self(3);
    #[doc(alias = "NEOnDemandRuleActionIgnore")]
    pub const Ignore: Self = Self(4);
}

unsafe impl Encode for NEOnDemandRuleAction {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEOnDemandRuleAction {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// On Demand rule network interface types
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neondemandruleinterfacetype?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEOnDemandRuleInterfaceType(pub NSInteger);
impl NEOnDemandRuleInterfaceType {
    #[doc(alias = "NEOnDemandRuleInterfaceTypeAny")]
    pub const Any: Self = Self(0);
    #[doc(alias = "NEOnDemandRuleInterfaceTypeEthernet")]
    pub const Ethernet: Self = Self(1);
    #[doc(alias = "NEOnDemandRuleInterfaceTypeWiFi")]
    pub const WiFi: Self = Self(2);
    #[doc(alias = "NEOnDemandRuleInterfaceTypeCellular")]
    pub const Cellular: Self = Self(3);
}

unsafe impl Encode for NEOnDemandRuleInterfaceType {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEOnDemandRuleInterfaceType {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEOnDemandRule class declares the programmatic interface for an object that defines an On Demand rule.
    ///
    /// NEOnDemandRule is an abstract base class from which other action-specific rule classes are derived.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neondemandrule?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEOnDemandRule;
);

extern_conformance!(
    unsafe impl NSCoding for NEOnDemandRule {}
);

extern_conformance!(
    unsafe impl NSCopying for NEOnDemandRule {}
);

unsafe impl CopyingHelper for NEOnDemandRule {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEOnDemandRule {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEOnDemandRule {}
);

impl NEOnDemandRule {
    extern_methods!(
        /// The rule's action
        #[unsafe(method(action))]
        #[unsafe(method_family = none)]
        pub unsafe fn action(&self) -> NEOnDemandRuleAction;

        /// An array of NSString objects. If the current default search domain is equal to one of the strings in this array and all of the other conditions in the rule match, then the rule matches. If this property is nil (the default), then the current default search domain does not factor into the rule match.
        #[unsafe(method(DNSSearchDomainMatch))]
        #[unsafe(method_family = none)]
        pub unsafe fn DNSSearchDomainMatch(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`DNSSearchDomainMatch`][Self::DNSSearchDomainMatch].
        #[unsafe(method(setDNSSearchDomainMatch:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDNSSearchDomainMatch(
            &self,
            dns_search_domain_match: Option<&NSArray<NSString>>,
        );

        /// An array of DNS server IP addresses represented as NSString objects. If each of the current default DNS servers is equal to one of the strings in this array and all of the other conditions in the rule match, then the rule matches. If this property is nil (the default), then the default DNS servers do not factor into the rule match.
        #[unsafe(method(DNSServerAddressMatch))]
        #[unsafe(method_family = none)]
        pub unsafe fn DNSServerAddressMatch(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`DNSServerAddressMatch`][Self::DNSServerAddressMatch].
        #[unsafe(method(setDNSServerAddressMatch:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDNSServerAddressMatch(
            &self,
            dns_server_address_match: Option<&NSArray<NSString>>,
        );

        /// The type of interface that this rule matches. If the current primary network interface is of this type and all of the other conditions in the rule match, then the rule matches. If this property is 0 (the default), then the current primary interface type does not factor into the rule match.
        #[unsafe(method(interfaceTypeMatch))]
        #[unsafe(method_family = none)]
        pub unsafe fn interfaceTypeMatch(&self) -> NEOnDemandRuleInterfaceType;

        /// Setter for [`interfaceTypeMatch`][Self::interfaceTypeMatch].
        #[unsafe(method(setInterfaceTypeMatch:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setInterfaceTypeMatch(
            &self,
            interface_type_match: NEOnDemandRuleInterfaceType,
        );

        /// An array of NSString objects. If the Service Set Identifier (SSID) of the current primary connected network matches one of the strings in this array and all of the other conditions in the rule match, then the rule matches. If this property is nil (the default), then the current primary connected network SSID does not factor into the rule match.
        #[unsafe(method(SSIDMatch))]
        #[unsafe(method_family = none)]
        pub unsafe fn SSIDMatch(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`SSIDMatch`][Self::SSIDMatch].
        #[unsafe(method(setSSIDMatch:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSSIDMatch(&self, ssid_match: Option<&NSArray<NSString>>);

        /// An HTTP or HTTPS URL. If a request sent to this URL results in a HTTP 200 OK response and all of the other conditions in the rule match, then then rule matches. If this property is nil (the default), then an HTTP request does not factor into the rule match.
        #[unsafe(method(probeURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn probeURL(&self) -> Option<Retained<NSURL>>;

        /// Setter for [`probeURL`][Self::probeURL].
        #[unsafe(method(setProbeURL:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProbeURL(&self, probe_url: Option<&NSURL>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEOnDemandRule {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEOnDemandRuleConnect class declares the programmatic interface for an object that defines an On Demand rule with the "Connect" action.
    ///
    /// When rules of this class match, the VPN connection is started whenever an application running on the system opens a network connection.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neondemandruleconnect?language=objc)
    #[unsafe(super(NEOnDemandRule, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEOnDemandRuleConnect;
);

extern_conformance!(
    unsafe impl NSCoding for NEOnDemandRuleConnect {}
);

extern_conformance!(
    unsafe impl NSCopying for NEOnDemandRuleConnect {}
);

unsafe impl CopyingHelper for NEOnDemandRuleConnect {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEOnDemandRuleConnect {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEOnDemandRuleConnect {}
);

impl NEOnDemandRuleConnect {
    extern_methods!();
}

/// Methods declared on superclass `NSObject`.
impl NEOnDemandRuleConnect {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEOnDemandRuleDisconnect class declares the programmatic interface for an object that defines an On Demand rule with the "Disconnect" action.
    ///
    /// When rules of this class match, the VPN connection is not started, and the VPN connection is disconnected if it is not currently disconnected.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neondemandruledisconnect?language=objc)
    #[unsafe(super(NEOnDemandRule, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEOnDemandRuleDisconnect;
);

extern_conformance!(
    unsafe impl NSCoding for NEOnDemandRuleDisconnect {}
);

extern_conformance!(
    unsafe impl NSCopying for NEOnDemandRuleDisconnect {}
);

unsafe impl CopyingHelper for NEOnDemandRuleDisconnect {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEOnDemandRuleDisconnect {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEOnDemandRuleDisconnect {}
);

impl NEOnDemandRuleDisconnect {
    extern_methods!();
}

/// Methods declared on superclass `NSObject`.
impl NEOnDemandRuleDisconnect {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEOnDemandRuleIgnore class declares the programmatic interface for an object that defines an On Demand rule with the "Ignore" action.
    ///
    /// When rules of this class match, the VPN connection is not started, and the current status of the VPN connection is left unchanged.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neondemandruleignore?language=objc)
    #[unsafe(super(NEOnDemandRule, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEOnDemandRuleIgnore;
);

extern_conformance!(
    unsafe impl NSCoding for NEOnDemandRuleIgnore {}
);

extern_conformance!(
    unsafe impl NSCopying for NEOnDemandRuleIgnore {}
);

unsafe impl CopyingHelper for NEOnDemandRuleIgnore {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEOnDemandRuleIgnore {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEOnDemandRuleIgnore {}
);

impl NEOnDemandRuleIgnore {
    extern_methods!();
}

/// Methods declared on superclass `NSObject`.
impl NEOnDemandRuleIgnore {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEOnDemandRuleEvaluateConnection class declares the programmatic interface for an object that defines an On Demand rule with the "Evaluate Connection" action.
    ///
    /// When rules of this class match, the properties of the network connection being established are matched against a set of connection rules. The action of the matched rule (if any) is used to determine whether or not the VPN will be started.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neondemandruleevaluateconnection?language=objc)
    #[unsafe(super(NEOnDemandRule, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEOnDemandRuleEvaluateConnection;
);

extern_conformance!(
    unsafe impl NSCoding for NEOnDemandRuleEvaluateConnection {}
);

extern_conformance!(
    unsafe impl NSCopying for NEOnDemandRuleEvaluateConnection {}
);

unsafe impl CopyingHelper for NEOnDemandRuleEvaluateConnection {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEOnDemandRuleEvaluateConnection {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEOnDemandRuleEvaluateConnection {}
);

impl NEOnDemandRuleEvaluateConnection {
    extern_methods!(
        /// An array of NEEvaluateConnectionRule objects. Each NEEvaluateConnectionRule object is evaluated in order against the properties of the network connection being established.
        #[unsafe(method(connectionRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn connectionRules(&self)
            -> Option<Retained<NSArray<NEEvaluateConnectionRule>>>;

        /// Setter for [`connectionRules`][Self::connectionRules].
        #[unsafe(method(setConnectionRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setConnectionRules(
            &self,
            connection_rules: Option<&NSArray<NEEvaluateConnectionRule>>,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NEOnDemandRuleEvaluateConnection {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Evaluate Connection rule actions
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neevaluateconnectionruleaction?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEEvaluateConnectionRuleAction(pub NSInteger);
impl NEEvaluateConnectionRuleAction {
    #[doc(alias = "NEEvaluateConnectionRuleActionConnectIfNeeded")]
    pub const ConnectIfNeeded: Self = Self(1);
    #[doc(alias = "NEEvaluateConnectionRuleActionNeverConnect")]
    pub const NeverConnect: Self = Self(2);
}

unsafe impl Encode for NEEvaluateConnectionRuleAction {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEEvaluateConnectionRuleAction {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEEvaluateConnectionRule class declares the programmatic interface for an object that associates properties of network connections with an action.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neevaluateconnectionrule?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEEvaluateConnectionRule;
);

extern_conformance!(
    unsafe impl NSCoding for NEEvaluateConnectionRule {}
);

extern_conformance!(
    unsafe impl NSCopying for NEEvaluateConnectionRule {}
);

unsafe impl CopyingHelper for NEEvaluateConnectionRule {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEEvaluateConnectionRule {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEEvaluateConnectionRule {}
);

impl NEEvaluateConnectionRule {
    extern_methods!(
        /// Initialize an NEEvaluateConnectionRule instance with a list of destination host domains and an action
        #[unsafe(method(initWithMatchDomains:andAction:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithMatchDomains_andAction(
            this: Allocated<Self>,
            domains: &NSArray<NSString>,
            action: NEEvaluateConnectionRuleAction,
        ) -> Retained<Self>;

        /// The action to take if the properties of the network connection being established match the rule.
        #[unsafe(method(action))]
        #[unsafe(method_family = none)]
        pub unsafe fn action(&self) -> NEEvaluateConnectionRuleAction;

        /// An array of NSString objects. If the host name of the destination of the network connection being established shares a suffix with one of the strings in this array, then the rule matches.
        #[unsafe(method(matchDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDomains(&self) -> Retained<NSArray<NSString>>;

        /// An array of NSString objects. If the rule matches the connection being established and the action is NEEvaluateConnectionRuleActionConnectIfNeeded, the DNS servers specified in this array are used to resolve the host name of the destination while evaluating connectivity to the destination. If the resolution fails for any reason, the VPN is started.
        #[unsafe(method(useDNSServers))]
        #[unsafe(method_family = none)]
        pub unsafe fn useDNSServers(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`useDNSServers`][Self::useDNSServers].
        #[unsafe(method(setUseDNSServers:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUseDNSServers(&self, use_dns_servers: Option<&NSArray<NSString>>);

        /// An HTTP or HTTPS URL. If the rule matches the connection being established and the action is NEEvaluateConnectionRuleActionConnectIfNeeded and a request sent to this URL results in a response with an HTTP response code other than 200, then the VPN is started.
        #[unsafe(method(probeURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn probeURL(&self) -> Option<Retained<NSURL>>;

        /// Setter for [`probeURL`][Self::probeURL].
        #[unsafe(method(setProbeURL:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProbeURL(&self, probe_url: Option<&NSURL>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEEvaluateConnectionRule {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// An NEPacket object represents the data, protocol family, and metadata associated with an IP packet.
    /// These packets are used to read and write on an NEPacketTunnelFlow.
    ///
    /// NEPacket is part of NetworkExtension.framework
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nepacket?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEPacket;
);

extern_conformance!(
    unsafe impl NSCoding for NEPacket {}
);

extern_conformance!(
    unsafe impl NSCopying for NEPacket {}
);

unsafe impl CopyingHelper for NEPacket {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEPacket {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEPacket {}
);

impl NEPacket {
    extern_methods!(
        #[cfg(feature = "libc")]
        /// Initializes a new NEPacket object with data and protocol family.
        ///
        /// Parameter `data`: The content of the packet.
        ///
        /// Parameter `protocolFamily`: The protocol family of the packet (such as AF_INET or AF_INET6).
        #[unsafe(method(initWithData:protocolFamily:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithData_protocolFamily(
            this: Allocated<Self>,
            data: &NSData,
            protocol_family: libc::sa_family_t,
        ) -> Retained<Self>;

        /// The data content of the packet.
        #[unsafe(method(data))]
        #[unsafe(method_family = none)]
        pub unsafe fn data(&self) -> Retained<NSData>;

        #[cfg(feature = "libc")]
        /// The protocol family of the packet (such as AF_INET or AF_INET6).
        #[unsafe(method(protocolFamily))]
        #[unsafe(method_family = none)]
        pub unsafe fn protocolFamily(&self) -> libc::sa_family_t;

        /// The direction of the packet.
        #[unsafe(method(direction))]
        #[unsafe(method_family = none)]
        pub unsafe fn direction(&self) -> NETrafficDirection;

        /// Metadata about the source application and flow for this packet.
        /// This property will only be non-nil when the routing method for the NEPacketTunnelProvider
        /// is NETunnelProviderRoutingMethodSourceApplication.
        #[unsafe(method(metadata))]
        #[unsafe(method_family = none)]
        pub unsafe fn metadata(&self) -> Option<Retained<NEFlowMetaData>>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEPacket {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEPacketTunnelFlow class declares the programmatic interface of an object that is used by NEPacketTunnelProvider implementations to tunnel IP packets.
    ///
    /// NEPacketTunnelFlow is part of NetworkExtension.framework
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nepackettunnelflow?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEPacketTunnelFlow;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEPacketTunnelFlow {}
);

impl NEPacketTunnelFlow {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// Read available IP packets from the flow.
        ///
        /// Parameter `completionHandler`: A block that will be executed to handle the packets. This block takes an array of NSData objects and an array of NSNumber objects. The NSData and NSNumber in corresponding indicies in the array represent one packet. If after handling the packets the caller wants to read more packets then the caller must call this method again.
        #[unsafe(method(readPacketsWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn readPacketsWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<
                dyn Fn(NonNull<NSArray<NSData>>, NonNull<NSArray<NSNumber>>),
            >,
        );

        /// Write multiple IP packets to the flow.
        ///
        /// Parameter `packets`: An array of NSData objects, each containing packet data to be written.
        ///
        /// Parameter `protocols`: An array of NSNumber objects. Each number contains the protocol of the packet in the corresponding index in the packets array.
        #[unsafe(method(writePackets:withProtocols:))]
        #[unsafe(method_family = none)]
        pub unsafe fn writePackets_withProtocols(
            &self,
            packets: &NSArray<NSData>,
            protocols: &NSArray<NSNumber>,
        ) -> bool;

        #[cfg(feature = "block2")]
        /// Read available IP packets from the flow.
        ///
        /// Parameter `completionHandler`: A block that will be executed to handle the packets. This block takes an array of NEPacket objects. If after handling the packets the caller wants to read more packets then the caller must call this method again.
        #[unsafe(method(readPacketObjectsWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn readPacketObjectsWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(NonNull<NSArray<NEPacket>>)>,
        );

        /// Write multiple IP packets to the flow.
        ///
        /// Parameter `packets`: An array of NEPacket objects, each containing packet data and protocol family to be written.
        #[unsafe(method(writePacketObjects:))]
        #[unsafe(method_family = none)]
        pub unsafe fn writePacketObjects(&self, packets: &NSArray<NEPacket>) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEPacketTunnelFlow {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NERelay class declares the programmatic interface of an object that
    /// manages the details of a relay's configuration, such as authentication and URL details.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nerelay?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NERelay;
);

extern_conformance!(
    unsafe impl NSCoding for NERelay {}
);

extern_conformance!(
    unsafe impl NSCopying for NERelay {}
);

unsafe impl CopyingHelper for NERelay {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NERelay {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NERelay {}
);

impl NERelay {
    extern_methods!(
        /// The URL of the relay accessible over HTTP/3.
        #[unsafe(method(HTTP3RelayURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn HTTP3RelayURL(&self) -> Option<Retained<NSURL>>;

        /// Setter for [`HTTP3RelayURL`][Self::HTTP3RelayURL].
        #[unsafe(method(setHTTP3RelayURL:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setHTTP3RelayURL(&self, http3_relay_url: Option<&NSURL>);

        /// The URL of the relay accessible over HTTP/2.
        #[unsafe(method(HTTP2RelayURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn HTTP2RelayURL(&self) -> Option<Retained<NSURL>>;

        /// Setter for [`HTTP2RelayURL`][Self::HTTP2RelayURL].
        #[unsafe(method(setHTTP2RelayURL:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setHTTP2RelayURL(&self, http2_relay_url: Option<&NSURL>);

        /// The URL of a DNS-over-HTTPS (DoH) resolver accessible via the relay.
        #[unsafe(method(dnsOverHTTPSURL))]
        #[unsafe(method_family = none)]
        pub unsafe fn dnsOverHTTPSURL(&self) -> Option<Retained<NSURL>>;

        /// Setter for [`dnsOverHTTPSURL`][Self::dnsOverHTTPSURL].
        #[unsafe(method(setDnsOverHTTPSURL:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDnsOverHTTPSURL(&self, dns_over_httpsurl: Option<&NSURL>);

        /// An IPv4 address prefix (such as "192.0.2.0/24") that will be used to synthesize
        /// DNS answers for apps that use `getaddrinfo()` to resolve domains included in `matchDomains`
        #[unsafe(method(syntheticDNSAnswerIPv4Prefix))]
        #[unsafe(method_family = none)]
        pub unsafe fn syntheticDNSAnswerIPv4Prefix(&self) -> Option<Retained<NSString>>;

        /// Setter for [`syntheticDNSAnswerIPv4Prefix`][Self::syntheticDNSAnswerIPv4Prefix].
        #[unsafe(method(setSyntheticDNSAnswerIPv4Prefix:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSyntheticDNSAnswerIPv4Prefix(
            &self,
            synthetic_dns_answer_i_pv4_prefix: Option<&NSString>,
        );

        /// An IPv6 address prefix (such as "2001:DB8::/32") that will be used to synthesize
        /// DNS answers for apps that use `getaddrinfo()` to resolve domains included in `matchDomains`
        #[unsafe(method(syntheticDNSAnswerIPv6Prefix))]
        #[unsafe(method_family = none)]
        pub unsafe fn syntheticDNSAnswerIPv6Prefix(&self) -> Option<Retained<NSString>>;

        /// Setter for [`syntheticDNSAnswerIPv6Prefix`][Self::syntheticDNSAnswerIPv6Prefix].
        #[unsafe(method(setSyntheticDNSAnswerIPv6Prefix:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSyntheticDNSAnswerIPv6Prefix(
            &self,
            synthetic_dns_answer_i_pv6_prefix: Option<&NSString>,
        );

        /// Additional HTTP header field names and values to be added to all relay requests.
        #[unsafe(method(additionalHTTPHeaderFields))]
        #[unsafe(method_family = none)]
        pub unsafe fn additionalHTTPHeaderFields(
            &self,
        ) -> Retained<NSDictionary<NSString, NSString>>;

        /// Setter for [`additionalHTTPHeaderFields`][Self::additionalHTTPHeaderFields].
        #[unsafe(method(setAdditionalHTTPHeaderFields:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setAdditionalHTTPHeaderFields(
            &self,
            additional_http_header_fields: &NSDictionary<NSString, NSString>,
        );

        /// TLS 1.3 raw public keys to use to authenticate the relay servers.
        #[unsafe(method(rawPublicKeys))]
        #[unsafe(method_family = none)]
        pub unsafe fn rawPublicKeys(&self) -> Option<Retained<NSArray<NSData>>>;

        /// Setter for [`rawPublicKeys`][Self::rawPublicKeys].
        #[unsafe(method(setRawPublicKeys:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setRawPublicKeys(&self, raw_public_keys: Option<&NSArray<NSData>>);

        /// The PKCS12 data for the relay client authentication. The value is a NSData in PKCS12 format.
        #[unsafe(method(identityData))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityData(&self) -> Option<Retained<NSData>>;

        /// Setter for [`identityData`][Self::identityData].
        #[unsafe(method(setIdentityData:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityData(&self, identity_data: Option<&NSData>);

        /// The password to be used to decrypt the PKCS12 identity data.
        #[unsafe(method(identityDataPassword))]
        #[unsafe(method_family = none)]
        pub unsafe fn identityDataPassword(&self) -> Option<Retained<NSString>>;

        /// Setter for [`identityDataPassword`][Self::identityDataPassword].
        #[unsafe(method(setIdentityDataPassword:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIdentityDataPassword(&self, identity_data_password: Option<&NSString>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NERelay {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// NERelay Manager error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nerelaymanagererror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NERelayManagerError(pub NSInteger);
impl NERelayManagerError {
    #[doc(alias = "NERelayManagerErrorConfigurationInvalid")]
    pub const ConfigurationInvalid: Self = Self(1);
    #[doc(alias = "NERelayManagerErrorConfigurationDisabled")]
    pub const ConfigurationDisabled: Self = Self(2);
    #[doc(alias = "NERelayManagerErrorConfigurationStale")]
    pub const ConfigurationStale: Self = Self(3);
    #[doc(alias = "NERelayManagerErrorConfigurationCannotBeRemoved")]
    pub const ConfigurationCannotBeRemoved: Self = Self(4);
}

unsafe impl Encode for NERelayManagerError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NERelayManagerError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nerelayerrordomain?language=objc)
    pub static NERelayErrorDomain: &'static NSString;
}

/// NERelay Manager error codes detected by the client while trying to use this relay
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nerelaymanagerclienterror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NERelayManagerClientError(pub NSInteger);
impl NERelayManagerClientError {
    #[doc(alias = "NERelayManagerClientErrorNone")]
    pub const None: Self = Self(1);
    #[doc(alias = "NERelayManagerClientErrorDNSFailed")]
    pub const DNSFailed: Self = Self(2);
    #[doc(alias = "NERelayManagerClientErrorServerUnreachable")]
    pub const ServerUnreachable: Self = Self(3);
    #[doc(alias = "NERelayManagerClientErrorServerDisconnected")]
    pub const ServerDisconnected: Self = Self(4);
    #[doc(alias = "NERelayManagerClientErrorCertificateMissing")]
    pub const CertificateMissing: Self = Self(5);
    #[doc(alias = "NERelayManagerClientErrorCertificateInvalid")]
    pub const CertificateInvalid: Self = Self(6);
    #[doc(alias = "NERelayManagerClientErrorCertificateExpired")]
    pub const CertificateExpired: Self = Self(7);
    #[doc(alias = "NERelayManagerClientErrorServerCertificateInvalid")]
    pub const ServerCertificateInvalid: Self = Self(8);
    #[doc(alias = "NERelayManagerClientErrorServerCertificateExpired")]
    pub const ServerCertificateExpired: Self = Self(9);
    #[doc(alias = "NERelayManagerClientErrorOther")]
    pub const Other: Self = Self(10);
}

unsafe impl Encode for NERelayManagerClientError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NERelayManagerClientError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nerelayclienterrordomain?language=objc)
    pub static NERelayClientErrorDomain: &'static NSString;
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nerelayconfigurationdidchangenotification?language=objc)
    pub static NERelayConfigurationDidChangeNotification: &'static NSString;
}

extern_class!(
    /// The NERelayManager class declares the programmatic interface for an object that manages relay configurations.
    ///
    /// NERelayManager declares methods and properties for configuring and controlling relay settings on the system.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nerelaymanager?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NERelayManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NERelayManager {}
);

impl NERelayManager {
    extern_methods!(
        /// Returns: The singleton NERelayManager object for the calling process.
        #[unsafe(method(sharedManager))]
        #[unsafe(method_family = none)]
        pub unsafe fn sharedManager() -> Retained<NERelayManager>;

        #[cfg(feature = "block2")]
        /// This function loads the current relay configuration from the caller's relay preferences.
        ///
        /// Parameter `completionHandler`: A block that will be called when the load operation is completed. The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function removes the relay configuration from the caller's relay preferences. If the relay is enabled, the relay becomes disabled.
        ///
        /// Parameter `completionHandler`: A block that will be called when the remove operation is completed. The NSError passed to this block will be nil if the remove operation succeeded, non-nil otherwise.
        #[unsafe(method(removeFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function saves the relay configuration in the caller's relay preferences. If the relay are enabled, they will become active.
        ///
        /// Parameter `completionHandler`: A block that will be called when the save operation is completed. The NSError passed to this block will be nil if the save operation succeeded, non-nil otherwise.
        #[unsafe(method(saveToPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn saveToPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This function will get errors that the client detected while using this relay configuration within the specified time period.  Errors will be from the NERelayClientErrorDomain and the NERelayManagerClientErrorNone value will be set for successful connections.
        ///
        /// Parameter `seconds`: A NSTimeInterval that specifies how many seconds to report errors for.  The maximum supported value is 24 hours and any larger values will be automatically reduced to 24 hours.
        ///
        /// Parameter `completionHandler`: A block that will be called when once the errors have been collected. The NSArray will contain a list of NERelayManagerClientError values detected within the last number of seconds as specified by the "seconds" parameter.  The values will be ordered from the error most recently detected to the oldest.  The error value of NERelayManagerClientErrorNone indicates the last successful use of the relay without error.  The NSArray will be empty if there are no values detected within the specified time period or nil if there was a problem in retrieving the errors.
        #[unsafe(method(getLastClientErrors:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn getLastClientErrors_completionHandler(
            &self,
            seconds: NSTimeInterval,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSArray<NSError>)>,
        );

        /// A string containing a description of the relay.
        #[unsafe(method(localizedDescription))]
        #[unsafe(method_family = none)]
        pub unsafe fn localizedDescription(&self) -> Option<Retained<NSString>>;

        /// Setter for [`localizedDescription`][Self::localizedDescription].
        #[unsafe(method(setLocalizedDescription:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLocalizedDescription(&self, localized_description: Option<&NSString>);

        /// Toggles the enabled status of the relay.
        #[unsafe(method(isEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isEnabled(&self) -> bool;

        /// Setter for [`isEnabled`][Self::isEnabled].
        #[unsafe(method(setEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnabled(&self, enabled: bool);

        /// Determines if the user will have the ability to enable and disable the relay
        #[unsafe(method(isUIToggleEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isUIToggleEnabled(&self) -> bool;

        /// Setter for [`isUIToggleEnabled`][Self::isUIToggleEnabled].
        #[unsafe(method(setUIToggleEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUIToggleEnabled(&self, ui_toggle_enabled: bool);

        /// An array of relay configurations describing one or more relay hops.
        #[unsafe(method(relays))]
        #[unsafe(method_family = none)]
        pub unsafe fn relays(&self) -> Option<Retained<NSArray<NERelay>>>;

        /// Setter for [`relays`][Self::relays].
        #[unsafe(method(setRelays:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setRelays(&self, relays: Option<&NSArray<NERelay>>);

        /// An array of strings containing domain names. If this property is non-nil, the relay will be used to access hosts within the specified domains. If this and the match FQDNs property is nil, the relay will be used for all domains.
        #[unsafe(method(matchDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchDomains(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`matchDomains`][Self::matchDomains].
        #[unsafe(method(setMatchDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchDomains(&self, match_domains: Option<&NSArray<NSString>>);

        /// An array of strings containing Fully Qualified Domain Names (FQDNs). If this property is non-nil, the relay will be used to access the specified hosts.  If this and the matchDomains property is nil, the relay will be used for all domains.
        #[unsafe(method(matchFQDNs))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchFQDNs(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`matchFQDNs`][Self::matchFQDNs].
        #[unsafe(method(setMatchFQDNs:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchFQDNs(&self, match_fqd_ns: Option<&NSArray<NSString>>);

        /// An array of strings containing domain names. If the destination host name of a connection shares a suffix with one of these strings then the relay will not be used.
        #[unsafe(method(excludedDomains))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludedDomains(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`excludedDomains`][Self::excludedDomains].
        #[unsafe(method(setExcludedDomains:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludedDomains(&self, excluded_domains: Option<&NSArray<NSString>>);

        /// An array of strings containing Fully Qualified Domain Names (FQDNs). If the destination host matches one of these strings then the relay will not be used.  An excluded FQDN takes priority over the matchDomain property.  This means the relay will not be used if the hostname matches an FQDN in this array even if the matchDomains contains a domain that would have been considered a match.
        #[unsafe(method(excludedFQDNs))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludedFQDNs(&self) -> Option<Retained<NSArray<NSString>>>;

        /// Setter for [`excludedFQDNs`][Self::excludedFQDNs].
        #[unsafe(method(setExcludedFQDNs:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludedFQDNs(&self, excluded_fqd_ns: Option<&NSArray<NSString>>);

        /// An array of NEOnDemandRule objects. If nil, the associated relay will always apply. If non-nil, the array describes the networks on which the relay should be used or not.
        #[unsafe(method(onDemandRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn onDemandRules(&self) -> Option<Retained<NSArray<NEOnDemandRule>>>;

        /// Setter for [`onDemandRules`][Self::onDemandRules].
        #[unsafe(method(setOnDemandRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setOnDemandRules(&self, on_demand_rules: Option<&NSArray<NEOnDemandRule>>);

        #[cfg(feature = "block2")]
        /// This function asynchronously reads all of the NERelay configurations created by the calling app that have previously been saved to disk and returns them as NERelayManager objects.
        ///
        /// Parameter `completionHandler`: A block that takes an array NERelayManager objects. The array passed to the block may be empty if no NERelay configurations were successfully read from the disk.  The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadAllManagersFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadAllManagersFromPreferencesWithCompletionHandler(
            completion_handler: &block2::DynBlock<
                dyn Fn(NonNull<NSArray<NERelayManager>>, *mut NSError),
            >,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NERelayManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NETransparentProxyManager class declares the programmatic interface for an object that is used to configure and control transparent proxies provided by NEAppProxyProviders.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netransparentproxymanager?language=objc)
    #[unsafe(super(NEVPNManager, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETransparentProxyManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NETransparentProxyManager {}
);

impl NETransparentProxyManager {
    extern_methods!(
        #[cfg(feature = "block2")]
        /// This function asynchronously reads all of the transparent proxy configurations associated with the calling app that have previously been saved to disk and returns them as NETransparentProxyManager objects.
        ///
        /// Parameter `completionHandler`: A block that takes an array NETransparentProxyManager objects. The array passed to the block may be empty if no transparent proxy configurations were successfully read from the disk.  The NSError passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadAllFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadAllFromPreferencesWithCompletionHandler(
            completion_handler: &block2::DynBlock<
                dyn Fn(*mut NSArray<NETransparentProxyManager>, *mut NSError),
            >,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NETransparentProxyManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NETransparentProxyNetworkSettings class declares the programmatic interface for an object that contains network settings.
    ///
    /// NETransparentProxyNetworkSettings is used by NEAppProxyProviders to communicate the desired network settings for the proxy to the framework. The framework takes care of applying the contained settings to the system.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netransparentproxynetworksettings?language=objc)
    #[unsafe(super(NETunnelNetworkSettings, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETransparentProxyNetworkSettings;
);

extern_conformance!(
    unsafe impl NSCoding for NETransparentProxyNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSCopying for NETransparentProxyNetworkSettings {}
);

unsafe impl CopyingHelper for NETransparentProxyNetworkSettings {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NETransparentProxyNetworkSettings {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NETransparentProxyNetworkSettings {}
);

impl NETransparentProxyNetworkSettings {
    extern_methods!(
        /// An array of NENetworkRule objects that collectively specify the traffic that will be routed through the transparent proxy. The following restrictions
        /// apply to each NENetworkRule in this list:
        /// Restrictions for rules with an address endpoint:
        /// If the port string of the endpoint is "0" or is the empty string, then the address of the endpoint must be a non-wildcard address (i.e. "0.0.0.0" or "::").
        /// If the address is a wildcard address (i.e. "0.0.0.0" or "::"), then the port string of the endpoint must be non-empty and must not be "0".
        /// A port string of "53" is not allowed. Destination Domain-based rules must be used to match DNS traffic.
        /// The matchLocalNetwork property must be nil.
        /// The matchDirection property must be NETrafficDirectionOutbound.
        #[unsafe(method(includedNetworkRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn includedNetworkRules(&self) -> Option<Retained<NSArray<NENetworkRule>>>;

        /// Setter for [`includedNetworkRules`][Self::includedNetworkRules].
        #[unsafe(method(setIncludedNetworkRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIncludedNetworkRules(
            &self,
            included_network_rules: Option<&NSArray<NENetworkRule>>,
        );

        /// An array of NENetworkRule objects that collectively specify the traffic that will not be routed through the transparent proxy. The following restrictions
        /// apply to each NENetworkRule in this list:
        /// Restrictions for rules with an address endpoint:
        /// If the port string of the endpoint is "0" or is the empty string, then the address of the endpoint must be a non-wildcard address (i.e. "0.0.0.0" or "::").
        /// If the address is a wildcard address (i.e. "0.0.0.0" or "::"), then the port string of the endpoint must be non-empty and must not be "0".
        /// A port string of "53" is not allowed. Destination Domain-based rules must be used to match DNS traffic.
        /// The matchLocalNetwork property must be nil.
        /// The matchDirection property must be NETrafficDirectionOutbound.
        #[unsafe(method(excludedNetworkRules))]
        #[unsafe(method_family = none)]
        pub unsafe fn excludedNetworkRules(&self) -> Option<Retained<NSArray<NENetworkRule>>>;

        /// Setter for [`excludedNetworkRules`][Self::excludedNetworkRules].
        #[unsafe(method(setExcludedNetworkRules:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setExcludedNetworkRules(
            &self,
            excluded_network_rules: Option<&NSArray<NENetworkRule>>,
        );
    );
}

/// Methods declared on superclass `NETunnelNetworkSettings`.
impl NETransparentProxyNetworkSettings {
    extern_methods!(
        /// This function initializes a newly-allocated NETunnelNetworkSettings object with a given tunnel remote address.
        ///
        /// Parameter `address`: The address of the remote endpoint that is providing the tunnel service.
        #[unsafe(method(initWithTunnelRemoteAddress:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithTunnelRemoteAddress(
            this: Allocated<Self>,
            address: &NSString,
        ) -> Retained<Self>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NETransparentProxyNetworkSettings {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NETransparentProxyProvider class declares the programmatic interface for an object that implements the client side of a custom transparent network proxy solution.
    /// The NETransparentProxyProvider class has the following behavior differences from its super class NEAppProxyProvider:
    /// - Returning NO from handleNewFlow: and handleNewUDPFlow:initialRemoteEndpoint: causes the flow to proceed to communicate directly with the flow's ultimate destination, instead of closing the flow with a "Connection Refused" error.
    /// - NEDNSSettings and NEProxySettings specified within NETransparentProxyNetworkSettings are ignored. Flows that match the includedNetworkRules within NETransparentProxyNetworkSettings will use the same DNS and proxy settings that other flows on the system are currently using.
    /// - Flows that are created using a "connect by name" API (such as Network.framework or NSURLSession) that match the includedNetworkRules will not bypass DNS resolution.
    ///
    /// NETransparentProxyProvider is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netransparentproxyprovider?language=objc)
    #[unsafe(super(NEAppProxyProvider, NETunnelProvider, NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETransparentProxyProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NETransparentProxyProvider {}
);

impl NETransparentProxyProvider {
    extern_methods!();
}

/// Methods declared on superclass `NSObject`.
impl NETransparentProxyProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// VPN status codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnstatus?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNStatus(pub NSInteger);
impl NEVPNStatus {
    #[doc(alias = "NEVPNStatusInvalid")]
    pub const Invalid: Self = Self(0);
    #[doc(alias = "NEVPNStatusDisconnected")]
    pub const Disconnected: Self = Self(1);
    #[doc(alias = "NEVPNStatusConnecting")]
    pub const Connecting: Self = Self(2);
    #[doc(alias = "NEVPNStatusConnected")]
    pub const Connected: Self = Self(3);
    #[doc(alias = "NEVPNStatusReasserting")]
    pub const Reasserting: Self = Self(4);
    #[doc(alias = "NEVPNStatusDisconnecting")]
    pub const Disconnecting: Self = Self(5);
}

unsafe impl Encode for NEVPNStatus {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNStatus {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnstatusdidchangenotification?language=objc)
    pub static NEVPNStatusDidChangeNotification: &'static NSString;
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnconnectionstartoptionusername?language=objc)
    pub static NEVPNConnectionStartOptionUsername: &'static NSString;
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnconnectionstartoptionpassword?language=objc)
    pub static NEVPNConnectionStartOptionPassword: &'static NSString;
}

/// VPN error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnconnectionerror?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNConnectionError(pub NSInteger);
impl NEVPNConnectionError {
    #[doc(alias = "NEVPNConnectionErrorOverslept")]
    pub const Overslept: Self = Self(1);
    #[doc(alias = "NEVPNConnectionErrorNoNetworkAvailable")]
    pub const NoNetworkAvailable: Self = Self(2);
    /// way that the VPN connection could not be maintained.
    #[doc(alias = "NEVPNConnectionErrorUnrecoverableNetworkChange")]
    pub const UnrecoverableNetworkChange: Self = Self(3);
    #[doc(alias = "NEVPNConnectionErrorConfigurationFailed")]
    pub const ConfigurationFailed: Self = Self(4);
    #[doc(alias = "NEVPNConnectionErrorServerAddressResolutionFailed")]
    pub const ServerAddressResolutionFailed: Self = Self(5);
    #[doc(alias = "NEVPNConnectionErrorServerNotResponding")]
    pub const ServerNotResponding: Self = Self(6);
    #[doc(alias = "NEVPNConnectionErrorServerDead")]
    pub const ServerDead: Self = Self(7);
    #[doc(alias = "NEVPNConnectionErrorAuthenticationFailed")]
    pub const AuthenticationFailed: Self = Self(8);
    #[doc(alias = "NEVPNConnectionErrorClientCertificateInvalid")]
    pub const ClientCertificateInvalid: Self = Self(9);
    #[doc(alias = "NEVPNConnectionErrorClientCertificateNotYetValid")]
    pub const ClientCertificateNotYetValid: Self = Self(10);
    #[doc(alias = "NEVPNConnectionErrorClientCertificateExpired")]
    pub const ClientCertificateExpired: Self = Self(11);
    #[doc(alias = "NEVPNConnectionErrorPluginFailed")]
    pub const PluginFailed: Self = Self(12);
    #[doc(alias = "NEVPNConnectionErrorConfigurationNotFound")]
    pub const ConfigurationNotFound: Self = Self(13);
    #[doc(alias = "NEVPNConnectionErrorPluginDisabled")]
    pub const PluginDisabled: Self = Self(14);
    #[doc(alias = "NEVPNConnectionErrorNegotiationFailed")]
    pub const NegotiationFailed: Self = Self(15);
    #[doc(alias = "NEVPNConnectionErrorServerDisconnected")]
    pub const ServerDisconnected: Self = Self(16);
    #[doc(alias = "NEVPNConnectionErrorServerCertificateInvalid")]
    pub const ServerCertificateInvalid: Self = Self(17);
    #[doc(alias = "NEVPNConnectionErrorServerCertificateNotYetValid")]
    pub const ServerCertificateNotYetValid: Self = Self(18);
    #[doc(alias = "NEVPNConnectionErrorServerCertificateExpired")]
    pub const ServerCertificateExpired: Self = Self(19);
}

unsafe impl Encode for NEVPNConnectionError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNConnectionError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnconnectionerrordomain?language=objc)
    pub static NEVPNConnectionErrorDomain: &'static NSString;
}

extern_class!(
    /// The NEVPNConnection class declares the programmatic interface for an object that manages VPN connections.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnconnection?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEVPNConnection;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEVPNConnection {}
);

impl NEVPNConnection {
    extern_methods!(
        /// This function is used to start the VPN tunnel using the current VPN configuration. The VPN tunnel connection process is started and this function returns immediately.
        ///
        /// Parameter `error`: If the VPN tunnel was started successfully, this parameter is set to nil. Otherwise this parameter is set to the error that occurred. Possible errors include:
        /// 1. NEVPNErrorConfigurationInvalid
        /// 2. NEVPNErrorConfigurationDisabled
        ///
        /// Returns: YES if the VPN tunnel was started successfully, NO if an error occurred.
        #[unsafe(method(startVPNTunnelAndReturnError:_))]
        #[unsafe(method_family = none)]
        pub unsafe fn startVPNTunnelAndReturnError(&self) -> Result<(), Retained<NSError>>;

        /// This function is used to start the VPN tunnel using the current VPN configuration. The VPN tunnel connection process is started and this function returns immediately.
        ///
        /// Parameter `options`: A dictionary that will be passed to the tunnel provider during the process of starting the tunnel.
        /// If not nil, 'options' is an NSDictionary may contain the following keys
        /// NEVPNConnectionStartOptionUsername
        /// NEVPNConnectionStartOptionPassword
        ///
        /// Parameter `error`: If the VPN tunnel was started successfully, this parameter is set to nil. Otherwise this parameter is set to the error that occurred. Possible errors include:
        /// 1. NEVPNErrorConfigurationInvalid
        /// 2. NEVPNErrorConfigurationDisabled
        ///
        /// Returns: YES if the VPN tunnel was started successfully, NO if an error occurred.
        #[unsafe(method(startVPNTunnelWithOptions:andReturnError:_))]
        #[unsafe(method_family = none)]
        pub unsafe fn startVPNTunnelWithOptions_andReturnError(
            &self,
            options: Option<&NSDictionary<NSString, NSObject>>,
        ) -> Result<(), Retained<NSError>>;

        /// This function is used to stop the VPN tunnel. The VPN tunnel disconnect process is started and this function returns immediately.
        #[unsafe(method(stopVPNTunnel))]
        #[unsafe(method_family = none)]
        pub unsafe fn stopVPNTunnel(&self);

        #[cfg(feature = "block2")]
        /// Retrive the most recent error that caused the VPN to disconnect. If the error was generated by the VPN system (including the IPsec client) then the error will be in the NEVPNConnectionErrorDomain error domain. If the error was generated by a tunnel provider app extension then the error will be the NSError that the provider passed when disconnecting the tunnel.
        ///
        /// Parameter `handler`: A block which takes an optional NSError that will be called when the error is obtained.
        #[unsafe(method(fetchLastDisconnectErrorWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn fetchLastDisconnectErrorWithCompletionHandler(
            &self,
            handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// The current status of the VPN.
        #[unsafe(method(status))]
        #[unsafe(method_family = none)]
        pub unsafe fn status(&self) -> NEVPNStatus;

        /// The date and time when the connection status changed to NEVPNStatusConnected. This property is nil if the connection is not fully established.
        #[unsafe(method(connectedDate))]
        #[unsafe(method_family = none)]
        pub unsafe fn connectedDate(&self) -> Option<Retained<NSDate>>;

        /// The NEVPNManager associated with this NEVPNConnection.
        #[unsafe(method(manager))]
        #[unsafe(method_family = none)]
        pub unsafe fn manager(&self) -> Retained<NEVPNManager>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEVPNConnection {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// This file declares the NETunnelProviderSession API. The NETunnelProviderSession API is used to control network tunnel services provided by NETunnelProvider implementations.
    ///
    /// This API is part of NetworkExtension.framework.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelprovidersession?language=objc)
    #[unsafe(super(NEVPNConnection, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETunnelProviderSession;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NETunnelProviderSession {}
);

impl NETunnelProviderSession {
    extern_methods!(
        /// This function is used to start the tunnel using the configuration associated with this connection object. The tunnel connection process is started and this function returns immediately.
        ///
        /// Parameter `options`: A dictionary that will be passed as-is to the tunnel provider during the process of starting the tunnel.
        ///
        /// Parameter `error`: If the tunnel was started successfully, this parameter is set to nil. Otherwise this parameter is set to the error that occurred. Possible errors include:
        /// 1. NEVPNErrorConfigurationInvalid
        /// 2. NEVPNErrorConfigurationDisabled
        ///
        /// Returns: YES if the tunnel was started successfully, NO if an error occurred.
        #[unsafe(method(startTunnelWithOptions:andReturnError:_))]
        #[unsafe(method_family = none)]
        pub unsafe fn startTunnelWithOptions_andReturnError(
            &self,
            options: Option<&NSDictionary<NSString, AnyObject>>,
        ) -> Result<(), Retained<NSError>>;

        /// This function is used to stop the tunnel. The tunnel disconnect process is started and this function returns immediately.
        #[unsafe(method(stopTunnel))]
        #[unsafe(method_family = none)]
        pub unsafe fn stopTunnel(&self);

        #[cfg(feature = "block2")]
        /// This function sends a message to the NETunnelProvider and provides a way to receive a response.
        ///
        /// Parameter `messageData`: An NSData object containing the message to be sent.
        ///
        /// Parameter `error`: If the message was sent successfully, this parameter is set to nil. Otherwise this parameter is set to the error that occurred. Possible errors include:
        /// 1. NEVPNErrorConfigurationInvalid
        /// 2. NEVPNErrorConfigurationDisabled
        ///
        /// Parameter `responseHandler`: A block that handles the response. Can be set to nil if no response is expected.
        ///
        /// Returns: YES if the message was sent successfully, NO if an error occurred.
        #[unsafe(method(sendProviderMessage:returnError:responseHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn sendProviderMessage_returnError_responseHandler(
            &self,
            message_data: &NSData,
            error: Option<&mut Option<Retained<NSError>>>,
            response_handler: Option<&block2::DynBlock<dyn Fn(*mut NSData)>>,
        ) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NETunnelProviderSession {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NETunnelProviderProtocol class declares the programmatic interface for an object that contains NETunnelProvider-specific configuration settings.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/netunnelproviderprotocol?language=objc)
    #[unsafe(super(NEVPNProtocol, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NETunnelProviderProtocol;
);

extern_conformance!(
    unsafe impl NSCoding for NETunnelProviderProtocol {}
);

extern_conformance!(
    unsafe impl NSCopying for NETunnelProviderProtocol {}
);

unsafe impl CopyingHelper for NETunnelProviderProtocol {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NETunnelProviderProtocol {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NETunnelProviderProtocol {}
);

impl NETunnelProviderProtocol {
    extern_methods!(
        /// A dictionary containing NETunnelProvider vendor-specific configuration parameters. This dictionary is passed as-is to NETunnelProviders when a tunnel is started.
        #[unsafe(method(providerConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerConfiguration(
            &self,
        ) -> Option<Retained<NSDictionary<NSString, AnyObject>>>;

        /// Setter for [`providerConfiguration`][Self::providerConfiguration].
        #[unsafe(method(setProviderConfiguration:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderConfiguration(
            &self,
            provider_configuration: Option<&NSDictionary<NSString, AnyObject>>,
        );

        /// A string containing the bundle identifier of the NETunnelProvider to be used by this configuration.
        #[unsafe(method(providerBundleIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerBundleIdentifier(&self) -> Option<Retained<NSString>>;

        /// Setter for [`providerBundleIdentifier`][Self::providerBundleIdentifier].
        #[unsafe(method(setProviderBundleIdentifier:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderBundleIdentifier(
            &self,
            provider_bundle_identifier: Option<&NSString>,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NETunnelProviderProtocol {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Internet Key Exchange (IKE) authentication methods used to authenticate with the IPSec server.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikeauthenticationmethod?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNIKEAuthenticationMethod(pub NSInteger);
impl NEVPNIKEAuthenticationMethod {
    #[doc(alias = "NEVPNIKEAuthenticationMethodNone")]
    pub const None: Self = Self(0);
    #[doc(alias = "NEVPNIKEAuthenticationMethodCertificate")]
    pub const Certificate: Self = Self(1);
    #[doc(alias = "NEVPNIKEAuthenticationMethodSharedSecret")]
    pub const SharedSecret: Self = Self(2);
}

unsafe impl Encode for NEVPNIKEAuthenticationMethod {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNIKEAuthenticationMethod {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEVPNProtocolIPSec class declares the programmatic interface of an object that manages the IPSec-specific portion of a VPN configuration.
    ///
    /// Instances of this class use IKE version 1 for key negotiation.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnprotocolipsec?language=objc)
    #[unsafe(super(NEVPNProtocol, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEVPNProtocolIPSec;
);

extern_conformance!(
    unsafe impl NSCoding for NEVPNProtocolIPSec {}
);

extern_conformance!(
    unsafe impl NSCopying for NEVPNProtocolIPSec {}
);

unsafe impl CopyingHelper for NEVPNProtocolIPSec {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEVPNProtocolIPSec {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEVPNProtocolIPSec {}
);

impl NEVPNProtocolIPSec {
    extern_methods!(
        /// The method used to authenticate with the IPSec server. Note that if this property is set to NEVPNIKEAuthenticationMethodNone, extended authentication will still be negotiated if useExtendedAuthentication is set to YES.
        #[unsafe(method(authenticationMethod))]
        #[unsafe(method_family = none)]
        pub unsafe fn authenticationMethod(&self) -> NEVPNIKEAuthenticationMethod;

        /// Setter for [`authenticationMethod`][Self::authenticationMethod].
        #[unsafe(method(setAuthenticationMethod:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setAuthenticationMethod(
            &self,
            authentication_method: NEVPNIKEAuthenticationMethod,
        );

        /// A flag indicating if extended authentication will be negotiated. This authentication is in addition to the IKE authentication used to authenticate the endpoints of the IKE session.
        /// For IKE version 1, when this flag is set X-Auth authentication will be negotiated as part of the IKE session, using the username and password properties as the credential.
        /// For IKE version 2, when this flag is set EAP authentication will be negotiated as part of the IKE session, using the username, password, and/or identity properties as the credential depending on which EAP method the server requires.
        #[unsafe(method(useExtendedAuthentication))]
        #[unsafe(method_family = none)]
        pub unsafe fn useExtendedAuthentication(&self) -> bool;

        /// Setter for [`useExtendedAuthentication`][Self::useExtendedAuthentication].
        #[unsafe(method(setUseExtendedAuthentication:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUseExtendedAuthentication(&self, use_extended_authentication: bool);

        /// A persistent reference to a keychain item of class kSecClassGenericPassword containing the IKE shared secret.
        #[unsafe(method(sharedSecretReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn sharedSecretReference(&self) -> Option<Retained<NSData>>;

        /// Setter for [`sharedSecretReference`][Self::sharedSecretReference].
        #[unsafe(method(setSharedSecretReference:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSharedSecretReference(&self, shared_secret_reference: Option<&NSData>);

        /// A string identifying the local IPSec endpoint for authentication purposes.
        #[unsafe(method(localIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn localIdentifier(&self) -> Option<Retained<NSString>>;

        /// Setter for [`localIdentifier`][Self::localIdentifier].
        #[unsafe(method(setLocalIdentifier:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLocalIdentifier(&self, local_identifier: Option<&NSString>);

        /// A string identifying the remote IPSec endpoint for authentication purposes.
        #[unsafe(method(remoteIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn remoteIdentifier(&self) -> Option<Retained<NSString>>;

        /// Setter for [`remoteIdentifier`][Self::remoteIdentifier].
        #[unsafe(method(setRemoteIdentifier:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setRemoteIdentifier(&self, remote_identifier: Option<&NSString>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEVPNProtocolIPSec {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// IKEv2 Encryption Algorithms
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2encryptionalgorithm?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNIKEv2EncryptionAlgorithm(pub NSInteger);
impl NEVPNIKEv2EncryptionAlgorithm {
    #[doc(alias = "NEVPNIKEv2EncryptionAlgorithmDES")]
    #[deprecated = "Use an encryption algorithm with 256-bit keys instead"]
    pub const AlgorithmDES: Self = Self(1);
    #[doc(alias = "NEVPNIKEv2EncryptionAlgorithm3DES")]
    #[deprecated = "Use an encryption algorithm with 256-bit keys instead"]
    pub const Algorithm3DES: Self = Self(2);
    #[doc(alias = "NEVPNIKEv2EncryptionAlgorithmAES128")]
    #[deprecated = "Use an encryption algorithm with 256-bit keys instead"]
    pub const AlgorithmAES128: Self = Self(3);
    #[doc(alias = "NEVPNIKEv2EncryptionAlgorithmAES256")]
    pub const AlgorithmAES256: Self = Self(4);
    #[doc(alias = "NEVPNIKEv2EncryptionAlgorithmAES128GCM")]
    #[deprecated = "Use an encryption algorithm with 256-bit keys instead"]
    pub const AlgorithmAES128GCM: Self = Self(5);
    #[doc(alias = "NEVPNIKEv2EncryptionAlgorithmAES256GCM")]
    pub const AlgorithmAES256GCM: Self = Self(6);
    #[doc(alias = "NEVPNIKEv2EncryptionAlgorithmChaCha20Poly1305")]
    pub const AlgorithmChaCha20Poly1305: Self = Self(7);
}

unsafe impl Encode for NEVPNIKEv2EncryptionAlgorithm {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNIKEv2EncryptionAlgorithm {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// IKEv2 Integrity Algorithms
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2integrityalgorithm?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNIKEv2IntegrityAlgorithm(pub NSInteger);
impl NEVPNIKEv2IntegrityAlgorithm {
    #[doc(alias = "NEVPNIKEv2IntegrityAlgorithmSHA96")]
    #[deprecated = "Use SHA-2 for integrity protection instead"]
    pub const SHA96: Self = Self(1);
    #[doc(alias = "NEVPNIKEv2IntegrityAlgorithmSHA160")]
    #[deprecated = "Use SHA-2 for integrity protection instead"]
    pub const SHA160: Self = Self(2);
    #[doc(alias = "NEVPNIKEv2IntegrityAlgorithmSHA256")]
    pub const SHA256: Self = Self(3);
    #[doc(alias = "NEVPNIKEv2IntegrityAlgorithmSHA384")]
    pub const SHA384: Self = Self(4);
    #[doc(alias = "NEVPNIKEv2IntegrityAlgorithmSHA512")]
    pub const SHA512: Self = Self(5);
}

unsafe impl Encode for NEVPNIKEv2IntegrityAlgorithm {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNIKEv2IntegrityAlgorithm {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// IKEv2 Dead Peer Detection Rates
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2deadpeerdetectionrate?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNIKEv2DeadPeerDetectionRate(pub NSInteger);
impl NEVPNIKEv2DeadPeerDetectionRate {
    #[doc(alias = "NEVPNIKEv2DeadPeerDetectionRateNone")]
    pub const None: Self = Self(0);
    #[doc(alias = "NEVPNIKEv2DeadPeerDetectionRateLow")]
    pub const Low: Self = Self(1);
    #[doc(alias = "NEVPNIKEv2DeadPeerDetectionRateMedium")]
    pub const Medium: Self = Self(2);
    #[doc(alias = "NEVPNIKEv2DeadPeerDetectionRateHigh")]
    pub const High: Self = Self(3);
}

unsafe impl Encode for NEVPNIKEv2DeadPeerDetectionRate {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNIKEv2DeadPeerDetectionRate {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// IKEv2 Diffie Hellman groups
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2diffiehellmangroup?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNIKEv2DiffieHellmanGroup(pub NSInteger);
impl NEVPNIKEv2DiffieHellmanGroup {
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroupInvalid")]
    pub const GroupInvalid: Self = Self(0);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup1")]
    #[deprecated = "Use Diffie Hellman group 14 or greater instead"]
    pub const Group1: Self = Self(1);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup2")]
    #[deprecated = "Use Diffie Hellman group 14 or greater instead"]
    pub const Group2: Self = Self(2);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup5")]
    #[deprecated = "Use Diffie Hellman group 14 or greater instead"]
    pub const Group5: Self = Self(5);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup14")]
    pub const Group14: Self = Self(14);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup15")]
    pub const Group15: Self = Self(15);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup16")]
    pub const Group16: Self = Self(16);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup17")]
    pub const Group17: Self = Self(17);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup18")]
    pub const Group18: Self = Self(18);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup19")]
    pub const Group19: Self = Self(19);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup20")]
    pub const Group20: Self = Self(20);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup21")]
    pub const Group21: Self = Self(21);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup31")]
    pub const Group31: Self = Self(31);
    #[doc(alias = "NEVPNIKEv2DiffieHellmanGroup32")]
    pub const Group32: Self = Self(32);
}

unsafe impl Encode for NEVPNIKEv2DiffieHellmanGroup {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNIKEv2DiffieHellmanGroup {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// IKEv2 Certificate types
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2certificatetype?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNIKEv2CertificateType(pub NSInteger);
impl NEVPNIKEv2CertificateType {
    #[doc(alias = "NEVPNIKEv2CertificateTypeRSA")]
    pub const RSA: Self = Self(1);
    #[doc(alias = "NEVPNIKEv2CertificateTypeECDSA256")]
    pub const ECDSA256: Self = Self(2);
    #[doc(alias = "NEVPNIKEv2CertificateTypeECDSA384")]
    pub const ECDSA384: Self = Self(3);
    #[doc(alias = "NEVPNIKEv2CertificateTypeECDSA521")]
    pub const ECDSA521: Self = Self(4);
    #[doc(alias = "NEVPNIKEv2CertificateTypeEd25519")]
    pub const Ed25519: Self = Self(5);
    #[doc(alias = "NEVPNIKEv2CertificateTypeRSAPSS")]
    pub const RSAPSS: Self = Self(6);
}

unsafe impl Encode for NEVPNIKEv2CertificateType {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNIKEv2CertificateType {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

/// TLS Versions for use in EAP-TLS
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2tlsversion?language=objc)
// NS_ENUM
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEVPNIKEv2TLSVersion(pub NSInteger);
impl NEVPNIKEv2TLSVersion {
    #[doc(alias = "NEVPNIKEv2TLSVersionDefault")]
    pub const VersionDefault: Self = Self(0);
    #[doc(alias = "NEVPNIKEv2TLSVersion1_0")]
    pub const Version1_0: Self = Self(1);
    #[doc(alias = "NEVPNIKEv2TLSVersion1_1")]
    pub const Version1_1: Self = Self(2);
    #[doc(alias = "NEVPNIKEv2TLSVersion1_2")]
    pub const Version1_2: Self = Self(3);
}

unsafe impl Encode for NEVPNIKEv2TLSVersion {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEVPNIKEv2TLSVersion {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEVPNIKEv2SecurityAssociationParameters class declares the programmatic interface of an object that manages parameters for an IPSec Security Association
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2securityassociationparameters?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEVPNIKEv2SecurityAssociationParameters;
);

extern_conformance!(
    unsafe impl NSCoding for NEVPNIKEv2SecurityAssociationParameters {}
);

extern_conformance!(
    unsafe impl NSCopying for NEVPNIKEv2SecurityAssociationParameters {}
);

unsafe impl CopyingHelper for NEVPNIKEv2SecurityAssociationParameters {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEVPNIKEv2SecurityAssociationParameters {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEVPNIKEv2SecurityAssociationParameters {}
);

impl NEVPNIKEv2SecurityAssociationParameters {
    extern_methods!(
        /// The algorithm used by the Security Association to encrypt and decrypt data. On macOS and iOS, the default is NEVPNIKEv2EncryptionAlgorithmAES256 starting in macOS 11 and iOS 14.
        /// Prior to that the default was NEVPNIKEv2EncryptionAlgorithm3DES. On tvOS, the default is NEVPNIKEv2EncryptionAlgorithmAES256GCM.
        #[unsafe(method(encryptionAlgorithm))]
        #[unsafe(method_family = none)]
        pub unsafe fn encryptionAlgorithm(&self) -> NEVPNIKEv2EncryptionAlgorithm;

        /// Setter for [`encryptionAlgorithm`][Self::encryptionAlgorithm].
        #[unsafe(method(setEncryptionAlgorithm:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEncryptionAlgorithm(
            &self,
            encryption_algorithm: NEVPNIKEv2EncryptionAlgorithm,
        );

        /// The algorithm used by the Security Association to verify the integrity of data.  The IKE psedo-random function algorithm will be inferred based on the integrity algorithm.
        /// Default is NEVPNIKEv2IntegrityAlgorithmSHA256 starting in macOS 11, iOS 14, and tvOS 17.  Prior to that the default was NEVPNIKEv2IntegrityAlgorithmSHA96.
        #[unsafe(method(integrityAlgorithm))]
        #[unsafe(method_family = none)]
        pub unsafe fn integrityAlgorithm(&self) -> NEVPNIKEv2IntegrityAlgorithm;

        /// Setter for [`integrityAlgorithm`][Self::integrityAlgorithm].
        #[unsafe(method(setIntegrityAlgorithm:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIntegrityAlgorithm(
            &self,
            integrity_algorithm: NEVPNIKEv2IntegrityAlgorithm,
        );

        /// The Diffie Hellman group used by the Security Association. Default is NEVPNIKEv2DiffieHellmanGroup14 starting in macOS 11, iOS 14, and tvOS 17. Prior to that the default was NEVPNIKEv2DiffieHellmanGroup2.
        #[unsafe(method(diffieHellmanGroup))]
        #[unsafe(method_family = none)]
        pub unsafe fn diffieHellmanGroup(&self) -> NEVPNIKEv2DiffieHellmanGroup;

        /// Setter for [`diffieHellmanGroup`][Self::diffieHellmanGroup].
        #[unsafe(method(setDiffieHellmanGroup:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDiffieHellmanGroup(
            &self,
            diffie_hellman_group: NEVPNIKEv2DiffieHellmanGroup,
        );

        /// The life time of the Security Association, in minutes. Default is 60 for IKE Security Associations, and 30 for Child Security Associations. Before the lifetime is reached, IKEv2 will attempt to rekey the Security Association to maintain the connection.
        #[unsafe(method(lifetimeMinutes))]
        #[unsafe(method_family = none)]
        pub unsafe fn lifetimeMinutes(&self) -> i32;

        /// Setter for [`lifetimeMinutes`][Self::lifetimeMinutes].
        #[unsafe(method(setLifetimeMinutes:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLifetimeMinutes(&self, lifetime_minutes: i32);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEVPNIKEv2SecurityAssociationParameters {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEVPNIKEv2PPKConfiguration class declares the programmatic interface of an object that manages parameters for a Post-quantum Pre-shared Key (PPK)
    ///
    /// Instances of this class conform to RFC 8784.
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnikev2ppkconfiguration?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEVPNIKEv2PPKConfiguration;
);

extern_conformance!(
    unsafe impl NSCopying for NEVPNIKEv2PPKConfiguration {}
);

unsafe impl CopyingHelper for NEVPNIKEv2PPKConfiguration {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEVPNIKEv2PPKConfiguration {}
);

impl NEVPNIKEv2PPKConfiguration {
    extern_methods!(
        /// Initialize a newly-allocated NEVPNIKEv2PPKConfiguration object.
        ///
        /// Parameter `identifier`: The identifier for the PPK.
        ///
        /// Parameter `keychainReference`: A persistent reference to a keychain item of class kSecClassGenericPassword containing the PPK.
        #[unsafe(method(initWithIdentifier:keychainReference:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithIdentifier_keychainReference(
            this: Allocated<Self>,
            identifier: &NSString,
            keychain_reference: &NSData,
        ) -> Retained<Self>;

        /// The identifer for the PPK.
        #[unsafe(method(identifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn identifier(&self) -> Retained<NSString>;

        /// A persistent reference to a keychain item of class kSecClassGenericPassword containing the PPK.
        #[unsafe(method(keychainReference))]
        #[unsafe(method_family = none)]
        pub unsafe fn keychainReference(&self) -> Retained<NSData>;

        /// Boolean indicating whether use of the PPK is mandatory or not. Default is YES.
        #[unsafe(method(isMandatory))]
        #[unsafe(method_family = none)]
        pub unsafe fn isMandatory(&self) -> bool;

        /// Setter for [`isMandatory`][Self::isMandatory].
        #[unsafe(method(setIsMandatory:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setIsMandatory(&self, is_mandatory: bool);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEVPNIKEv2PPKConfiguration {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEVPNProtocolIKEv2 class declares the programmatic interface of an object that manages the IKEv2-specific portion of a VPN configuration.
    ///
    /// Instances of this class use IKE version 2 for key negotiation.
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nevpnprotocolikev2?language=objc)
    #[unsafe(super(NEVPNProtocolIPSec, NEVPNProtocol, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEVPNProtocolIKEv2;
);

extern_conformance!(
    unsafe impl NSCoding for NEVPNProtocolIKEv2 {}
);

extern_conformance!(
    unsafe impl NSCopying for NEVPNProtocolIKEv2 {}
);

unsafe impl CopyingHelper for NEVPNProtocolIKEv2 {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEVPNProtocolIKEv2 {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEVPNProtocolIKEv2 {}
);

impl NEVPNProtocolIKEv2 {
    extern_methods!(
        /// How frequently the IKEv2 client will run the dead peer detection algorithm.  Default is NEVPNIKEv2DeadPeerDetectionRateMedium.
        #[unsafe(method(deadPeerDetectionRate))]
        #[unsafe(method_family = none)]
        pub unsafe fn deadPeerDetectionRate(&self) -> NEVPNIKEv2DeadPeerDetectionRate;

        /// Setter for [`deadPeerDetectionRate`][Self::deadPeerDetectionRate].
        #[unsafe(method(setDeadPeerDetectionRate:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDeadPeerDetectionRate(
            &self,
            dead_peer_detection_rate: NEVPNIKEv2DeadPeerDetectionRate,
        );

        /// A string containing the Subject Common Name field of the Certificate Authority certificate that issued the IKEv2 server's certificate.
        #[unsafe(method(serverCertificateIssuerCommonName))]
        #[unsafe(method_family = none)]
        pub unsafe fn serverCertificateIssuerCommonName(&self) -> Option<Retained<NSString>>;

        /// Setter for [`serverCertificateIssuerCommonName`][Self::serverCertificateIssuerCommonName].
        #[unsafe(method(setServerCertificateIssuerCommonName:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setServerCertificateIssuerCommonName(
            &self,
            server_certificate_issuer_common_name: Option<&NSString>,
        );

        /// A string containing the value to verify in the IKEv2 server certificate's Subject Common Name field.
        #[unsafe(method(serverCertificateCommonName))]
        #[unsafe(method_family = none)]
        pub unsafe fn serverCertificateCommonName(&self) -> Option<Retained<NSString>>;

        /// Setter for [`serverCertificateCommonName`][Self::serverCertificateCommonName].
        #[unsafe(method(setServerCertificateCommonName:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setServerCertificateCommonName(
            &self,
            server_certificate_common_name: Option<&NSString>,
        );

        /// contains the type of certificate if an certificate is configured.  Default is RSA.
        #[unsafe(method(certificateType))]
        #[unsafe(method_family = none)]
        pub unsafe fn certificateType(&self) -> NEVPNIKEv2CertificateType;

        /// Setter for [`certificateType`][Self::certificateType].
        #[unsafe(method(setCertificateType:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setCertificateType(&self, certificate_type: NEVPNIKEv2CertificateType);

        /// Boolean indicating if client should use INTERNAL_IP4_SUBNET / INTERNAL_IP6_SUBNET attributes.  Default is False.
        #[unsafe(method(useConfigurationAttributeInternalIPSubnet))]
        #[unsafe(method_family = none)]
        pub unsafe fn useConfigurationAttributeInternalIPSubnet(&self) -> bool;

        /// Setter for [`useConfigurationAttributeInternalIPSubnet`][Self::useConfigurationAttributeInternalIPSubnet].
        #[unsafe(method(setUseConfigurationAttributeInternalIPSubnet:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setUseConfigurationAttributeInternalIPSubnet(
            &self,
            use_configuration_attribute_internal_ip_subnet: bool,
        );

        /// Parameters for the IKE SA
        #[unsafe(method(IKESecurityAssociationParameters))]
        #[unsafe(method_family = none)]
        pub unsafe fn IKESecurityAssociationParameters(
            &self,
        ) -> Retained<NEVPNIKEv2SecurityAssociationParameters>;

        /// Parameters for the child SA
        #[unsafe(method(childSecurityAssociationParameters))]
        #[unsafe(method_family = none)]
        pub unsafe fn childSecurityAssociationParameters(
            &self,
        ) -> Retained<NEVPNIKEv2SecurityAssociationParameters>;

        /// Disable MOBIKE negotiation. Default is NO.
        #[unsafe(method(disableMOBIKE))]
        #[unsafe(method_family = none)]
        pub unsafe fn disableMOBIKE(&self) -> bool;

        /// Setter for [`disableMOBIKE`][Self::disableMOBIKE].
        #[unsafe(method(setDisableMOBIKE:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDisableMOBIKE(&self, disable_mobike: bool);

        /// Disable Server Redirect. Default is NO.
        #[unsafe(method(disableRedirect))]
        #[unsafe(method_family = none)]
        pub unsafe fn disableRedirect(&self) -> bool;

        /// Setter for [`disableRedirect`][Self::disableRedirect].
        #[unsafe(method(setDisableRedirect:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDisableRedirect(&self, disable_redirect: bool);

        /// Enable Perfect Forward Secrecy. Default is NO.
        #[unsafe(method(enablePFS))]
        #[unsafe(method_family = none)]
        pub unsafe fn enablePFS(&self) -> bool;

        /// Setter for [`enablePFS`][Self::enablePFS].
        #[unsafe(method(setEnablePFS:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnablePFS(&self, enable_pfs: bool);

        /// Enable certificate revocation check. Default is NO.
        #[unsafe(method(enableRevocationCheck))]
        #[unsafe(method_family = none)]
        pub unsafe fn enableRevocationCheck(&self) -> bool;

        /// Setter for [`enableRevocationCheck`][Self::enableRevocationCheck].
        #[unsafe(method(setEnableRevocationCheck:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnableRevocationCheck(&self, enable_revocation_check: bool);

        /// Require positive certificate revocation check response for peer certificate validation to pass. Default is NO.
        #[unsafe(method(strictRevocationCheck))]
        #[unsafe(method_family = none)]
        pub unsafe fn strictRevocationCheck(&self) -> bool;

        /// Setter for [`strictRevocationCheck`][Self::strictRevocationCheck].
        #[unsafe(method(setStrictRevocationCheck:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setStrictRevocationCheck(&self, strict_revocation_check: bool);

        /// Sets a minimum TLS version to allow for EAP-TLS authentication. Default is NEVPNIKEv2TLSVersionDefault.
        #[unsafe(method(minimumTLSVersion))]
        #[unsafe(method_family = none)]
        pub unsafe fn minimumTLSVersion(&self) -> NEVPNIKEv2TLSVersion;

        /// Setter for [`minimumTLSVersion`][Self::minimumTLSVersion].
        #[unsafe(method(setMinimumTLSVersion:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMinimumTLSVersion(&self, minimum_tls_version: NEVPNIKEv2TLSVersion);

        /// Sets a maximum TLS version to allow for EAP-TLS authentication. Default is NEVPNIKEv2TLSVersionDefault.
        #[unsafe(method(maximumTLSVersion))]
        #[unsafe(method_family = none)]
        pub unsafe fn maximumTLSVersion(&self) -> NEVPNIKEv2TLSVersion;

        /// Setter for [`maximumTLSVersion`][Self::maximumTLSVersion].
        #[unsafe(method(setMaximumTLSVersion:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMaximumTLSVersion(&self, maximum_tls_version: NEVPNIKEv2TLSVersion);

        /// Enable Fallback is used to support Wi-Fi Assist. Wi-Fi Assist allows connections for foreground apps to switch over
        /// to Cellular Data when WiFi connectivity is poor. By setting the EnableFallback key, the device will bring up a tunnel over
        /// Cellular Data to carry traffic that is eligible for Wi-Fi Assist and also requires VPN. Enabling fallback requires that the
        /// server support multiple tunnels for a single user. Default is NO.
        #[unsafe(method(enableFallback))]
        #[unsafe(method_family = none)]
        pub unsafe fn enableFallback(&self) -> bool;

        /// Setter for [`enableFallback`][Self::enableFallback].
        #[unsafe(method(setEnableFallback:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnableFallback(&self, enable_fallback: bool);

        /// Maximum Transmission Unit (MTU) size in bytes to assign to the tunnel interface.
        #[unsafe(method(mtu))]
        #[unsafe(method_family = none)]
        pub unsafe fn mtu(&self) -> NSUInteger;

        /// Setter for [`mtu`][Self::mtu].
        #[unsafe(method(setMtu:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMtu(&self, mtu: NSUInteger);

        /// Configuration for the use of a Post-quantum Pre-shared Key (PPK).
        #[unsafe(method(ppkConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn ppkConfiguration(&self) -> Option<Retained<NEVPNIKEv2PPKConfiguration>>;

        /// Setter for [`ppkConfiguration`][Self::ppkConfiguration].
        #[unsafe(method(setPpkConfiguration:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setPpkConfiguration(
            &self,
            ppk_configuration: Option<&NEVPNIKEv2PPKConfiguration>,
        );
    );
}

/// Methods declared on superclass `NSObject`.
impl NEVPNProtocolIKEv2 {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern "C" {
    /// [Apple's documentation](https://developer.apple.com/documentation/networkextension/neapppusherrordomain?language=objc)
    pub static NEAppPushErrorDomain: &'static NSErrorDomain;
}

/// App Push Manager error codes
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neapppushmanagererror?language=objc)
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NEAppPushManagerError(pub NSInteger);
impl NEAppPushManagerError {
    #[doc(alias = "NEAppPushManagerErrorConfigurationInvalid")]
    pub const ConfigurationInvalid: Self = Self(1);
    #[doc(alias = "NEAppPushManagerErrorConfigurationNotLoaded")]
    pub const ConfigurationNotLoaded: Self = Self(2);
    #[doc(alias = "NEAppPushManagerErrorInternalError")]
    pub const InternalError: Self = Self(3);
    #[doc(alias = "NEAppPushManagerErrorInactiveSession")]
    pub const InactiveSession: Self = Self(4);
}

unsafe impl Encode for NEAppPushManagerError {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NEAppPushManagerError {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// The NEPrivateLTENetwork class declares an object that contains the parameters of a private LTE network.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neprivateltenetwork?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEPrivateLTENetwork;
);

extern_conformance!(
    unsafe impl NSCoding for NEPrivateLTENetwork {}
);

extern_conformance!(
    unsafe impl NSCopying for NEPrivateLTENetwork {}
);

unsafe impl CopyingHelper for NEPrivateLTENetwork {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NEPrivateLTENetwork {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NEPrivateLTENetwork {}
);

impl NEPrivateLTENetwork {
    extern_methods!(
        /// Mobile Country Code of the private LTE network.
        #[unsafe(method(mobileCountryCode))]
        #[unsafe(method_family = none)]
        pub unsafe fn mobileCountryCode(&self) -> Retained<NSString>;

        /// Setter for [`mobileCountryCode`][Self::mobileCountryCode].
        #[unsafe(method(setMobileCountryCode:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMobileCountryCode(&self, mobile_country_code: &NSString);

        /// Mobile Network Code of the private LTE network.
        #[unsafe(method(mobileNetworkCode))]
        #[unsafe(method_family = none)]
        pub unsafe fn mobileNetworkCode(&self) -> Retained<NSString>;

        /// Setter for [`mobileNetworkCode`][Self::mobileNetworkCode].
        #[unsafe(method(setMobileNetworkCode:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMobileNetworkCode(&self, mobile_network_code: &NSString);

        /// Tracking Area Code of the private LTE network. This property is only applicable for band 48 private LTE networks.
        #[unsafe(method(trackingAreaCode))]
        #[unsafe(method_family = none)]
        pub unsafe fn trackingAreaCode(&self) -> Option<Retained<NSString>>;

        /// Setter for [`trackingAreaCode`][Self::trackingAreaCode].
        #[unsafe(method(setTrackingAreaCode:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTrackingAreaCode(&self, tracking_area_code: Option<&NSString>);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEPrivateLTENetwork {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// The NEAppPushManager class declares a programmatic interface to configure NEAppPushProvider.
    ///
    /// NEAppPushManager declares methods and properties for configuring and managing life cycle of app push provider.
    ///
    /// Instances of this class are thread safe.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neapppushmanager?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppPushManager;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppPushManager {}
);

impl NEAppPushManager {
    extern_methods!(
        /// An array of Wi-Fi SSID strings. If the SSID string of current Wi-Fi network matches with one of these strings then the NEAppPushProvider
        /// is started. The upper limit of number of SSIDs is 10.
        #[unsafe(method(matchSSIDs))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchSSIDs(&self) -> Retained<NSArray<NSString>>;

        /// Setter for [`matchSSIDs`][Self::matchSSIDs].
        #[unsafe(method(setMatchSSIDs:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchSSIDs(&self, match_ssi_ds: &NSArray<NSString>);

        /// An array of NEPrivateLTENetwork objects. If the properties of current private LTE network match with properties of one of these NEPrivateLTENetwork objects then the
        /// NEAppPushProvider is started. The upper limit of number of private LTE networks is 10. For private LTE networks that are not band 48, the device must be supervised in order to perform the match
        #[unsafe(method(matchPrivateLTENetworks))]
        #[unsafe(method_family = none)]
        pub unsafe fn matchPrivateLTENetworks(&self) -> Retained<NSArray<NEPrivateLTENetwork>>;

        /// Setter for [`matchPrivateLTENetworks`][Self::matchPrivateLTENetworks].
        #[unsafe(method(setMatchPrivateLTENetworks:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMatchPrivateLTENetworks(
            &self,
            match_private_lte_networks: &NSArray<NEPrivateLTENetwork>,
        );

        /// A dictionary containing vendor-specific key-value pairs, where the data type of values must be one of the data types supported by property list. Values of user defined data
        /// type are not supported. This dictionary is passed as-is to NEAppPushProvider when is it is started or notified for other specified reasons.
        #[unsafe(method(providerConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerConfiguration(&self) -> Retained<NSDictionary<NSString, AnyObject>>;

        /// Setter for [`providerConfiguration`][Self::providerConfiguration].
        #[unsafe(method(setProviderConfiguration:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderConfiguration(
            &self,
            provider_configuration: &NSDictionary<NSString, AnyObject>,
        );

        /// A string containing the bundle identifier of the NEAppPushProvider.
        #[unsafe(method(providerBundleIdentifier))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerBundleIdentifier(&self) -> Option<Retained<NSString>>;

        /// Setter for [`providerBundleIdentifier`][Self::providerBundleIdentifier].
        #[unsafe(method(setProviderBundleIdentifier:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setProviderBundleIdentifier(
            &self,
            provider_bundle_identifier: Option<&NSString>,
        );

        /// An instance of type NEAppPushDelegate that is required to receive incoming call informarion from the provider.
        #[unsafe(method(delegate))]
        #[unsafe(method_family = none)]
        pub unsafe fn delegate(&self) -> Option<Retained<ProtocolObject<dyn NEAppPushDelegate>>>;

        /// This is a [weak property][objc2::topics::weak_property].
        /// Setter for [`delegate`][Self::delegate].
        #[unsafe(method(setDelegate:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setDelegate(&self, delegate: Option<&ProtocolObject<dyn NEAppPushDelegate>>);

        #[cfg(feature = "block2")]
        /// This class method asynchronously reads all of the saved configurations and returns them as an array of NEAppPushManager objects.
        ///
        /// Parameter `completionHandler`: A block that takes an array of NEAppPushManager objects. The array passed to the block may be empty if no configurations
        /// were successfully read from the disk. The NSError object passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadAllFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadAllFromPreferencesWithCompletionHandler(
            completion_handler: &block2::DynBlock<
                dyn Fn(*mut NSArray<NEAppPushManager>, *mut NSError),
            >,
        );

        #[cfg(feature = "block2")]
        /// This method loads the saved configuration from the persistent store.
        ///
        /// Parameter `completionHandler`: A block that will be called when the load operation is completed. The NSError object passed to this block will be nil if the load operation succeeded, non-nil otherwise.
        #[unsafe(method(loadFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn loadFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This method removes the configuration from the persistent store.
        ///
        /// Parameter `completionHandler`: A block that will be called when the remove operation is completed. The NSError object passed to this block will be nil if the remove operation succeeded, non-nil otherwise.
        #[unsafe(method(removeFromPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn removeFromPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// This method saves the configuration in the persistent store.
        ///
        /// Parameter `completionHandler`: A block that will be called when the save operation is completed. The NSError object passed to this block will be nil if the save operation succeeded, non-nil otherwise.
        #[unsafe(method(saveToPreferencesWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn saveToPreferencesWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// A string containing a description of the app push manager.
        #[unsafe(method(localizedDescription))]
        #[unsafe(method_family = none)]
        pub unsafe fn localizedDescription(&self) -> Option<Retained<NSString>>;

        /// Setter for [`localizedDescription`][Self::localizedDescription].
        #[unsafe(method(setLocalizedDescription:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setLocalizedDescription(&self, localized_description: Option<&NSString>);

        /// Toggles the enabled status of the configuration. This property will be set to NO when the same app saves another configuration that overlaps with this configuration.
        #[unsafe(method(isEnabled))]
        #[unsafe(method_family = none)]
        pub unsafe fn isEnabled(&self) -> bool;

        /// Setter for [`isEnabled`][Self::isEnabled].
        #[unsafe(method(setEnabled:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setEnabled(&self, enabled: bool);

        /// If set to YES, it indicates the associated configuration is in use. Use KVO to watch for changes.
        #[unsafe(method(isActive))]
        #[unsafe(method_family = none)]
        pub unsafe fn isActive(&self) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppPushManager {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_protocol!(
    /// Delegate for NEAppPushManager.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neapppushdelegate?language=objc)
    pub unsafe trait NEAppPushDelegate: NSObjectProtocol {
        /// This delegate method is called when the provider reports incoming call using reportIncomingCommunicationWithUserInfo method.
        ///
        /// Parameter `userInfo`: A dictionary of custom information that the provider passes to reportIncomingCommunicationWithUserInfo method.
        #[unsafe(method(appPushManager:didReceiveIncomingCallWithUserInfo:))]
        #[unsafe(method_family = none)]
        unsafe fn appPushManager_didReceiveIncomingCallWithUserInfo(
            &self,
            manager: &NEAppPushManager,
            user_info: &NSDictionary,
        );
    }
);

extern_class!(
    /// The NEAppPushProvider class declares a programmatic interface to manage a life cycle of app push provider. It also allows the provider to handle outgoing
    /// communication message from the containing app, and pass incoming call message to the containing app.
    /// NEAppPushProvider is part of NetworkExtension.framework
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/neapppushprovider?language=objc)
    #[unsafe(super(NEProvider, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    pub struct NEAppPushProvider;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NEAppPushProvider {}
);

impl NEAppPushProvider {
    extern_methods!(
        /// A dictionary containing current vendor-specific configuration parameters. This dictionary is provided by NEAppPushManager. Use KVO to watch for changes.
        #[unsafe(method(providerConfiguration))]
        #[unsafe(method_family = none)]
        pub unsafe fn providerConfiguration(
            &self,
        ) -> Option<Retained<NSDictionary<NSString, AnyObject>>>;

        #[cfg(feature = "block2")]
        /// This method is called by the framework when the provider is started. Subclasses must override this method to create a connection with its server.
        ///
        /// Parameter `completionHandler`: A block that must be called when the provider establishes a connection with the server. If the providers fails to create a connection,
        /// the subclass' implementation of this method must pass a non-nil NSError object to this block. A value of nil passed to the completion handler indicates that the connection
        /// was successfully created.
        #[deprecated]
        #[unsafe(method(startWithCompletionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn startWithCompletionHandler(
            &self,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// This method is called by the framework when the provider is started. Subclasses must override this method to create a connection with its server.
        #[unsafe(method(start))]
        #[unsafe(method_family = none)]
        pub unsafe fn start(&self);

        #[cfg(feature = "block2")]
        /// This method is called by the framework when the app push provider needs to be stopped. Subclasses must override this method to perform necessary tasks.
        ///
        /// Parameter `reason`: An NEProviderStopReason indicating why the provider was stopped.
        ///
        /// Parameter `completionHandler`: A block that must be called when the provider is completely stopped.
        #[unsafe(method(stopWithReason:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn stopWithReason_completionHandler(
            &self,
            reason: NEProviderStopReason,
            completion_handler: &block2::DynBlock<dyn Fn()>,
        );

        /// This function is called by the provider when it determines incoming call on the conection.
        ///
        /// Parameter `userInfo`: A dictionary of custom information associated with the incoming call. This dictionary is passed to containg app as-is.
        #[unsafe(method(reportIncomingCallWithUserInfo:))]
        #[unsafe(method_family = none)]
        pub unsafe fn reportIncomingCallWithUserInfo(&self, user_info: &NSDictionary);

        /// This function is called by the provider when it receives a Push to Talk message on the connection.
        ///
        /// Parameter `userInfo`: A dictionary of custom information associated with the Push to Talk message, such as the active remote participant. This dictionary is passed to the PTChannelManagerDelegate of the containing app if the user is joined to a Push to Talk channel.
        #[unsafe(method(reportPushToTalkMessageWithUserInfo:))]
        #[unsafe(method_family = none)]
        pub unsafe fn reportPushToTalkMessageWithUserInfo(&self, user_info: &NSDictionary);

        /// This method is called by the framework periodically after every 60 seconds. Subclasses must override this method to perform necessary tasks.
        #[unsafe(method(handleTimerEvent))]
        #[unsafe(method_family = none)]
        pub unsafe fn handleTimerEvent(&self);
    );
}

/// Methods declared on superclass `NSObject`.
impl NEAppPushProvider {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// NWEndpoint is a generic class to represent network endpoints, such as a port on a remote server.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwendpoint?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    #[deprecated = "Use nw_endpoint_t in Network framework instead, see deprecation notice in <NetworkExtension/NWEndpoint.h>"]
    pub struct NWEndpoint;
);

extern_conformance!(
    unsafe impl NSCoding for NWEndpoint {}
);

extern_conformance!(
    unsafe impl NSCopying for NWEndpoint {}
);

unsafe impl CopyingHelper for NWEndpoint {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NWEndpoint {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NWEndpoint {}
);

impl NWEndpoint {
    extern_methods!();
}

/// Methods declared on superclass `NSObject`.
impl NWEndpoint {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// NWHostEndpoint is a subclass of NWEndpoint. It represents an endpoint backed by a
    /// hostname and port. Note that a hostname string may be an IP or IPv6 address.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwhostendpoint?language=objc)
    #[unsafe(super(NWEndpoint, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    #[deprecated = "Use `nw_endpoint_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWHostEndpoint.h>"]
    pub struct NWHostEndpoint;
);

extern_conformance!(
    unsafe impl NSCoding for NWHostEndpoint {}
);

extern_conformance!(
    unsafe impl NSCopying for NWHostEndpoint {}
);

unsafe impl CopyingHelper for NWHostEndpoint {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NWHostEndpoint {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NWHostEndpoint {}
);

impl NWHostEndpoint {
    extern_methods!(
        /// Parameter `hostname`: A string representation of the hostname or address, such as www.apple.com or 10.0.0.1.
        ///
        /// Parameter `port`: A string containing the port on the host, such as 80.
        ///
        /// Returns: An initialized NWHostEndpoint object.
        #[deprecated = "Use `nw_endpoint_create_host` in Network framework instead, see deprecation notice in <NetworkExtension/NWHostEndpoint.h>"]
        #[unsafe(method(endpointWithHostname:port:))]
        #[unsafe(method_family = none)]
        pub unsafe fn endpointWithHostname_port(
            hostname: &NSString,
            port: &NSString,
        ) -> Retained<Self>;

        /// The endpoint's hostname.
        #[deprecated = "Use `nw_endpoint_get_hostname` in Network framework instead, see deprecation notice in <NetworkExtension/NWHostEndpoint.h>"]
        #[unsafe(method(hostname))]
        #[unsafe(method_family = none)]
        pub unsafe fn hostname(&self) -> Retained<NSString>;

        /// The endpoint's port.
        #[deprecated = "Use `nw_endpoint_get_port` in Network framework instead, see deprecation notice in <NetworkExtension/NWHostEndpoint.h>"]
        #[unsafe(method(port))]
        #[unsafe(method_family = none)]
        pub unsafe fn port(&self) -> Retained<NSString>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NWHostEndpoint {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// NWBonjourServiceEndpoint is a subclass of NWEndpoint. It represents an endpoint
    /// backed by a Bonjour service, specified with a name, type, and domain. For example, the
    /// Bonjour service MyMusicStudio._music._tcp.local. has the name "MyMusicStudio",
    /// the type "_music._tcp", and the domain "local".
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwbonjourserviceendpoint?language=objc)
    #[unsafe(super(NWEndpoint, NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    #[deprecated = "Use `nw_endpoint_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWBonjourServiceEndpoint.h>"]
    pub struct NWBonjourServiceEndpoint;
);

extern_conformance!(
    unsafe impl NSCoding for NWBonjourServiceEndpoint {}
);

extern_conformance!(
    unsafe impl NSCopying for NWBonjourServiceEndpoint {}
);

unsafe impl CopyingHelper for NWBonjourServiceEndpoint {
    type Result = Self;
}

extern_conformance!(
    unsafe impl NSObjectProtocol for NWBonjourServiceEndpoint {}
);

extern_conformance!(
    unsafe impl NSSecureCoding for NWBonjourServiceEndpoint {}
);

impl NWBonjourServiceEndpoint {
    extern_methods!(
        /// Parameter `name`: The Bonjour service name.
        ///
        /// Parameter `type`: The Bonjour service type.
        ///
        /// Parameter `domain`: The Bonjour service domain.
        ///
        /// Returns: An initialized NWBonjourServiceEndpoint object.
        #[deprecated = "Use `nw_endpoint_create_bonjour_service` in Network framework instead, see deprecation notice in <NetworkExtension/NWBonjourServiceEndpoint.h>"]
        #[unsafe(method(endpointWithName:type:domain:))]
        #[unsafe(method_family = none)]
        pub unsafe fn endpointWithName_type_domain(
            name: &NSString,
            r#type: &NSString,
            domain: &NSString,
        ) -> Retained<Self>;

        /// The endpoint's Bonjour service name.
        #[deprecated = "Use `nw_endpoint_get_bonjour_service_name` in Network framework instead, see deprecation notice in <NetworkExtension/NWBonjourServiceEndpoint.h>"]
        #[unsafe(method(name))]
        #[unsafe(method_family = none)]
        pub unsafe fn name(&self) -> Retained<NSString>;

        /// The endpoint's Bonjour service type.
        #[deprecated = "Use `nw_endpoint_get_bonjour_service_type` in Network framework instead, see deprecation notice in <NetworkExtension/NWBonjourServiceEndpoint.h>"]
        #[unsafe(method(type))]
        #[unsafe(method_family = none)]
        pub unsafe fn r#type(&self) -> Retained<NSString>;

        /// The endpoint's Bonjour service domain.
        #[deprecated = "Use `nw_endpoint_get_bonjour_service_domain` in Network framework instead, see deprecation notice in <NetworkExtension/NWBonjourServiceEndpoint.h>"]
        #[unsafe(method(domain))]
        #[unsafe(method_family = none)]
        pub unsafe fn domain(&self) -> Retained<NSString>;
    );
}

/// Methods declared on superclass `NSObject`.
impl NWBonjourServiceEndpoint {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Path status values
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwpathstatus?language=objc)
// NS_ENUM
#[deprecated = "Use `nw_path_status_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NWPathStatus(pub NSInteger);
impl NWPathStatus {
    #[doc(alias = "NWPathStatusInvalid")]
    #[deprecated = "Use `nw_path_status_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
    pub const Invalid: Self = Self(0);
    #[doc(alias = "NWPathStatusSatisfied")]
    #[deprecated = "Use `nw_path_status_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
    pub const Satisfied: Self = Self(1);
    #[doc(alias = "NWPathStatusUnsatisfied")]
    #[deprecated = "Use `nw_path_status_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
    pub const Unsatisfied: Self = Self(2);
    /// a connection attempt.
    #[doc(alias = "NWPathStatusSatisfiable")]
    #[deprecated = "Use `nw_path_status_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
    pub const Satisfiable: Self = Self(3);
}

unsafe impl Encode for NWPathStatus {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NWPathStatus {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// A network path, represented with NWPath, expresses the viability status and
    /// properties of the path that a networking connection will take on the device. For example,
    /// if the path status is NWPathStatusSatisfied, then a connection could use that path.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwpath?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    #[deprecated = "Use `nw_path_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
    pub struct NWPath;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NWPath {}
);

impl NWPath {
    extern_methods!(
        /// The evaluated NWPathStatus of the NWPath.
        #[deprecated = "Use `nw_path_get_status` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
        #[unsafe(method(status))]
        #[unsafe(method_family = none)]
        pub unsafe fn status(&self) -> NWPathStatus;

        /// Returns YES if the path is considered expensive, as when using a cellular data plan.
        #[deprecated = "Use `nw_path_is_expensive` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
        #[unsafe(method(isExpensive))]
        #[unsafe(method_family = none)]
        pub unsafe fn isExpensive(&self) -> bool;

        /// Returns YES if the path is considered constrained, as when it is in save data mode.
        #[deprecated = "Use `nw_path_is_constrained` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
        #[unsafe(method(isConstrained))]
        #[unsafe(method_family = none)]
        pub unsafe fn isConstrained(&self) -> bool;

        /// Parameter `path`: An NWPath object to compare.
        ///
        /// Returns: YES if the two path objects have the same content, NO otherwise.
        #[deprecated = "Use `nw_path_is_equal` in Network framework instead, see deprecation notice in <NetworkExtension/NWPath.h>"]
        #[unsafe(method(isEqualToPath:))]
        #[unsafe(method_family = none)]
        pub unsafe fn isEqualToPath(&self, path: &NWPath) -> bool;
    );
}

/// Methods declared on superclass `NSObject`.
impl NWPath {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

/// Defined connection states. New types may be defined in the future.
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwtcpconnectionstate?language=objc)
// NS_ENUM
#[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NWTCPConnectionState(pub NSInteger);
impl NWTCPConnectionState {
    #[doc(alias = "NWTCPConnectionStateInvalid")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub const Invalid: Self = Self(0);
    #[doc(alias = "NWTCPConnectionStateConnecting")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub const Connecting: Self = Self(1);
    /// waiting for better condition(s) before trying again.
    #[doc(alias = "NWTCPConnectionStateWaiting")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub const Waiting: Self = Self(2);
    /// to transfer data. If TLS is in use, the TLS handshake would have finished when the connection
    /// is in this state.
    #[doc(alias = "NWTCPConnectionStateConnected")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub const Connected: Self = Self(3);
    /// possible to transfer data. The application should call cancellation method to clean up resources
    /// when the connection is in this state.
    #[doc(alias = "NWTCPConnectionStateDisconnected")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub const Disconnected: Self = Self(4);
    /// the cancellation method.
    #[doc(alias = "NWTCPConnectionStateCancelled")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub const Cancelled: Self = Self(5);
}

unsafe impl Encode for NWTCPConnectionState {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NWTCPConnectionState {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// Establish TCP connections to an endpoint, and send and receive data on the TCP connection.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwtcpconnection?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    #[deprecated = "Use `nw_connection_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub struct NWTCPConnection;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NWTCPConnection {}
);

impl NWTCPConnection {
    extern_methods!(
        /// This convenience initializer can be used to create a new connection that would only
        /// be connected if there exists a better path (as determined by the system) to the destination
        /// endpoint of the original connection. It will be initialized using the same destination endpoint
        /// and set of parameters from the original connection.
        ///
        /// If the original connection becomes disconnected or cancelled, the new "upgrade" connection
        /// would automatically be considered better.
        ///
        /// The caller should create an NWTCPConnection and watch for the hasBetterPath property.
        /// When this property is YES, the caller should attempt to create a new upgrade
        /// connection, with the goal to start transferring data on the new better path as soon as
        /// possible to reduce power and potentially monetary cost. When the new upgrade connection
        /// becomes connected and when the caller wraps up the previous caller session on
        /// the original connection, the caller can start using the new upgrade connection and
        /// tear down the original one.
        ///
        ///
        /// Parameter `connection`: The original connection from which the caller will upgrade
        ///
        /// Returns: An initialized NWTCPConnection
        #[deprecated = "Use `nw_connection_create` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(initWithUpgradeForConnection:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithUpgradeForConnection(
            this: Allocated<Self>,
            connection: &NWTCPConnection,
        ) -> Retained<Self>;

        /// The status of the connection. Use KVO to watch this property to get updates.
        #[deprecated = "Use `nw_connection_set_state_changed_handler` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(state))]
        #[unsafe(method_family = none)]
        pub unsafe fn state(&self) -> NWTCPConnectionState;

        /// YES if the connection can read and write data, NO otherwise. Use KVO to watch this property.
        #[deprecated = "Use `nw_connection_set_viability_changed_handler` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(isViable))]
        #[unsafe(method_family = none)]
        pub unsafe fn isViable(&self) -> bool;

        /// YES if the system determines there is a better path the destination can be reached if
        /// the caller creates a new connection using the same endpoint and parameters. This can
        /// be done using the convenience upgrade initializer method.
        /// Use KVO to watch this property to get updates.
        #[deprecated = "Use `nw_connection_set_better_path_available_handler` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(hasBetterPath))]
        #[unsafe(method_family = none)]
        pub unsafe fn hasBetterPath(&self) -> bool;

        /// The destination endpoint with which this connection was created.
        #[deprecated = "Use `nw_connection_copy_endpoint` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(endpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn endpoint(&self) -> Retained<NWEndpoint>;

        /// The network path over which the connection was established. The caller can query
        /// additional properties from the NWPath object for more information.
        ///
        /// Note that this contains a snapshot of information at the time of connection establishment
        /// for this connection only. As a result, some underlying properties might change in time and
        /// might not reflect the path for other connections that might be established at different times.
        #[deprecated = "Use `nw_connection_copy_current_path` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(connectedPath))]
        #[unsafe(method_family = none)]
        pub unsafe fn connectedPath(&self) -> Option<Retained<NWPath>>;

        /// The IP address endpoint from which the connection was connected.
        #[deprecated = "Use `nw_path_copy_effective_local_endpoint` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(localAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn localAddress(&self) -> Option<Retained<NWEndpoint>>;

        /// The IP address endpoint to which the connection was connected.
        #[deprecated = "Use `nw_path_copy_effective_remote_endpoint` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(remoteAddress))]
        #[unsafe(method_family = none)]
        pub unsafe fn remoteAddress(&self) -> Option<Retained<NWEndpoint>>;

        /// When the connection is connected to a Bonjour service endpoint, the TXT record associated
        /// with the Bonjour service is available via this property. Beware that the value comes from
        /// the network. Care must be taken when parsing this potentially malicious value.
        #[deprecated = "Use `nw_endpoint_copy_txt_record` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(txtRecord))]
        #[unsafe(method_family = none)]
        pub unsafe fn txtRecord(&self) -> Option<Retained<NSData>>;

        /// The connection-wide error property indicates any fatal error that occurred while
        /// processing the connection or performing data reading or writing.
        #[deprecated = "Use `nw_connection_set_state_changed_handler` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(error))]
        #[unsafe(method_family = none)]
        pub unsafe fn error(&self) -> Option<Retained<NSError>>;

        /// Cancel the connection. This will clean up the resources associated with this object
        /// and transition this object to NWTCPConnectionStateCancelled state.
        #[deprecated = "Use `nw_connection_cancel` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(cancel))]
        #[unsafe(method_family = none)]
        pub unsafe fn cancel(&self);

        #[cfg(feature = "block2")]
        /// Read "length" number of bytes. See readMinimumLength:maximumLength:completionHandler:
        /// for a complete discussion of the callback behavior.
        ///
        /// Parameter `length`: The exact number of bytes the application wants to read
        ///
        /// Parameter `completion`: The completion handler to be invoked when there is data to read or an error occurred
        #[deprecated = "Use `nw_connection_receive` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(readLength:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn readLength_completionHandler(
            &self,
            length: NSUInteger,
            completion: &block2::DynBlock<dyn Fn(*mut NSData, *mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// Read the requested range of bytes. The completion handler will be invoked when:
        /// - Exactly "length" number of bytes have been read. 'data' will be non-nil.
        ///
        /// - Fewer than "length" number of bytes, including 0 bytes, have been read, and the connection's
        /// read side has been closed. 'data' might be nil, depending on whether there was any data to be
        /// read when the connection's read side was closed.
        ///
        /// - Some fatal error has occurred, and 'data' will be nil.
        ///
        /// To know when to schedule a read again, check for the condition whether an error has occurred.
        ///
        /// For better performance, the caller should pick the effective minimum and maximum lengths.
        /// For example, if the caller absolutely needs a specific number of bytes before it can
        /// make any progress, use that value as the minimum. The maximum bytes can be the upperbound
        /// that the caller wants to read. Typically, the minimum length can be the caller
        /// protocol fixed-size header and the maximum length can be the maximum size of the payload or
        /// the size of the current read buffer.
        ///
        ///
        /// Parameter `minimum`: The minimum number of bytes the caller wants to read
        ///
        /// Parameter `maximum`: The maximum number of bytes the caller wants to read
        ///
        /// Parameter `completion`: The completion handler to be invoked when there is data to read or an error occurred
        #[deprecated = "Use `nw_connection_receive` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(readMinimumLength:maximumLength:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn readMinimumLength_maximumLength_completionHandler(
            &self,
            minimum: NSUInteger,
            maximum: NSUInteger,
            completion: &block2::DynBlock<dyn Fn(*mut NSData, *mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// Write the given data object content. Callers should wait until the completionHandler is executed
        /// before issuing another write.
        ///
        /// Parameter `data`: The data object whose content will be written
        ///
        /// Parameter `completion`: The completion handler to be invoked when the data content has been written or an error has occurred.
        /// If the error is nil, the write succeeded and the caller can write more data.
        #[deprecated = "Use `nw_connection_send` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(write:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn write_completionHandler(
            &self,
            data: &NSData,
            completion: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// Close this connection's write side such that further write requests won't succeed.
        /// Note that this has the effect of closing the read side of the peer connection.
        /// When the connection's read side and write side are closed, the connection is considered
        /// disconnected and will transition to the appropriate state.
        #[deprecated = "Use `nw_connection_send` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[unsafe(method(writeClose))]
        #[unsafe(method_family = none)]
        pub unsafe fn writeClose(&self);
    );
}

/// Methods declared on superclass `NSObject`.
impl NWTCPConnection {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_protocol!(
    /// Allows the caller to take custom actions on some connection events.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwtcpconnectionauthenticationdelegate?language=objc)
    #[deprecated = "Use `sec_protocol_options_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
    pub unsafe trait NWTCPConnectionAuthenticationDelegate: NSObjectProtocol {
        /// The caller can implement this optional protocol method to decide whether it
        /// wants to provide the identity for this connection for authentication. If this delegate
        /// method is not implemented, the return value will default to YES if
        /// provideIdentityForConnection:completionHandler: is implemented.
        ///
        /// Parameter `connection`: The connection sending this message
        ///
        /// Returns: YES to provide the identity for this connection, in which case, the delegate method
        /// provideIdentityForConnection:completionHandler: will be called.
        #[deprecated = "Use `sec_protocol_options_set_challenge_block` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[optional]
        #[unsafe(method(shouldProvideIdentityForConnection:))]
        #[unsafe(method_family = none)]
        unsafe fn shouldProvideIdentityForConnection(&self, connection: &NWTCPConnection) -> bool;

        #[cfg(all(feature = "block2", feature = "objc2-security"))]
        /// The caller can implement this optional protocol method to provide the identity
        /// and an optional certificate chain to be used for authentication.
        ///
        /// Parameter `connection`: The connection sending this message
        ///
        /// Parameter `completion`: The completion handler for passing identity and certificate chain to the connection.
        /// The "identity" argument is required and must not be nil. The "certificateChain" argument is optional,
        /// and is an array of one or more SecCertificateRef objects. The certificate chain must contain objects
        /// of type SecCertificateRef only. If the certificate chain is set, it will be used. Otherwise, the leaf
        /// certificate will be extracted from the SecIdentityRef object and will be used for authentication.
        ///
        /// The caller is responsible for keeping the argument object(s) alive for the duration of the
        /// completion handler invocation.
        #[deprecated = "Use `sec_protocol_options_set_challenge_block` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[optional]
        #[unsafe(method(provideIdentityForConnection:completionHandler:))]
        #[unsafe(method_family = none)]
        unsafe fn provideIdentityForConnection_completionHandler(
            &self,
            connection: &NWTCPConnection,
            completion: &block2::DynBlock<
                dyn Fn(NonNull<SecIdentity>, NonNull<NSArray<AnyObject>>),
            >,
        );

        /// The caller can implement this optional protocol method to decide whether it
        /// wants to take over the default trust evaluation for this connection. If this delegate method
        /// is not implemented, the return value will default to YES if
        /// provideIdentityForConnection:completionHandler: is implemented.
        ///
        /// Parameter `connection`: The connection sending this message
        ///
        /// Returns: YES to take over the default trust evaluation, in which case, the delegate method
        /// evaluateTrustForConnection:peerCertificateChain:completionHandler: will be called.
        #[deprecated = "Use `sec_protocol_options_set_verify_block` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[optional]
        #[unsafe(method(shouldEvaluateTrustForConnection:))]
        #[unsafe(method_family = none)]
        unsafe fn shouldEvaluateTrustForConnection(&self, connection: &NWTCPConnection) -> bool;

        #[cfg(all(feature = "block2", feature = "objc2-security"))]
        /// The caller can implement this optional protocol method to set up custom policies
        /// for peer certificate trust evaluation. If the delegate method is implemented, the caller
        /// is responsible for creating and setting up the SecTrustRef object and passing it to the
        /// completion handler. Otherwise, the default trust evaluation policy is used for the connection.
        ///
        /// Parameter `connection`: The connection sending this message
        ///
        /// Parameter `peerCertificateChain`: The peer certificate chain
        ///
        /// Parameter `completion`: The completion handler for passing the SecTrustRef object to the connection.
        /// The SecTrustRef object "trust" is required and must not be nil. It will be evaluated using
        /// SecTrustEvaluate() if necessary. The caller is responsible for keeping the argument object
        /// alive for the duration of the completion handler invocation.
        #[deprecated = "Use `sec_protocol_options_set_verify_block` in Network framework instead, see deprecation notice in <NetworkExtension/NWTCPConnection.h>"]
        #[optional]
        #[unsafe(method(evaluateTrustForConnection:peerCertificateChain:completionHandler:))]
        #[unsafe(method_family = none)]
        unsafe fn evaluateTrustForConnection_peerCertificateChain_completionHandler(
            &self,
            connection: &NWTCPConnection,
            peer_certificate_chain: &NSArray<AnyObject>,
            completion: &block2::DynBlock<dyn Fn(NonNull<SecTrust>)>,
        );
    }
);

/// UDP session state values
///
/// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwudpsessionstate?language=objc)
// NS_ENUM
#[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
#[repr(transparent)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct NWUDPSessionState(pub NSInteger);
impl NWUDPSessionState {
    #[doc(alias = "NWUDPSessionStateInvalid")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
    pub const Invalid: Self = Self(0);
    /// attempting to make the session ready.
    #[doc(alias = "NWUDPSessionStateWaiting")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
    pub const Waiting: Self = Self(1);
    #[doc(alias = "NWUDPSessionStatePreparing")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
    pub const Preparing: Self = Self(2);
    #[doc(alias = "NWUDPSessionStateReady")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
    pub const Ready: Self = Self(3);
    /// at this time, either due to problems with the path or the client rejecting the
    /// endpoints.
    #[doc(alias = "NWUDPSessionStateFailed")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
    pub const Failed: Self = Self(4);
    #[doc(alias = "NWUDPSessionStateCancelled")]
    #[deprecated = "Use `nw_connection_state_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
    pub const Cancelled: Self = Self(5);
}

unsafe impl Encode for NWUDPSessionState {
    const ENCODING: Encoding = NSInteger::ENCODING;
}

unsafe impl RefEncode for NWUDPSessionState {
    const ENCODING_REF: Encoding = Encoding::Pointer(&Self::ENCODING);
}

extern_class!(
    /// Open UDP datagram sessions to an endpoint, and send and receive datagrams.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwudpsession?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    #[deprecated = "Use `nw_connection_t` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
    pub struct NWUDPSession;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NWUDPSession {}
);

impl NWUDPSession {
    extern_methods!(
        /// This convenience initializer can be used to create a new session based on the
        /// original session's endpoint and parameters.
        ///
        /// The application should create an NWUDPSession and watch the "hasBetterPath" property.
        /// When this property is YES, it should call initWithUpgradeForSession: to create a new
        /// session, with the goal to start transferring data on the new better path as soon as
        /// possible to reduce power and potentially monetary cost. When the new "upgrade" session
        /// becomes ready and when the application wraps up the previous application session on
        /// the original session, the application can start using the new "upgrade" session and
        /// tear down the original one.
        ///
        ///
        /// Parameter `session`: The original session from which the application will upgrade
        ///
        /// Returns: An initialized NWUDPSession object.
        #[deprecated = "Use `nw_connection_create` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(initWithUpgradeForSession:))]
        #[unsafe(method_family = init)]
        pub unsafe fn initWithUpgradeForSession(
            this: Allocated<Self>,
            session: &NWUDPSession,
        ) -> Retained<Self>;

        /// The current state of the UDP session. If the state is NWUDPSessionStateReady,
        /// then the connection is eligible for reading and writing. The state will be
        /// NWUDPSessionStateFailed if the endpoint could not be resolved, or all endpoints have been
        /// rejected. Use KVO to watch for changes.
        #[deprecated = "Use `nw_connection_set_state_changed_handler` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(state))]
        #[unsafe(method_family = none)]
        pub unsafe fn state(&self) -> NWUDPSessionState;

        /// The provided endpoint.
        #[deprecated = "Use `nw_connection_copy_endpoint` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(endpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn endpoint(&self) -> Retained<NWEndpoint>;

        /// The currently targeted remote endpoint. Use KVO to watch for changes.
        #[deprecated = "Use `nw_connection_copy_current_path` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(resolvedEndpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn resolvedEndpoint(&self) -> Option<Retained<NWEndpoint>>;

        /// YES if the connection can read and write data, NO otherwise.
        /// Use KVO to watch this property.
        #[deprecated = "Use `nw_connection_set_viability_changed_handler` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(isViable))]
        #[unsafe(method_family = none)]
        pub unsafe fn isViable(&self) -> bool;

        /// YES if there is another path available that is preferred over the currentPath.
        /// To take advantage of this path, create a new UDPSession. Use KVO to watch for changes.
        #[deprecated = "Use `nw_connection_set_better_path_available_handler` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(hasBetterPath))]
        #[unsafe(method_family = none)]
        pub unsafe fn hasBetterPath(&self) -> bool;

        /// The current evaluated path for the resolvedEndpoint. Use KVO to watch for changes.
        #[deprecated = "Use `nw_connection_copy_current_path` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(currentPath))]
        #[unsafe(method_family = none)]
        pub unsafe fn currentPath(&self) -> Option<Retained<NWPath>>;

        /// Mark the current value of resolvedEndpoint as unusable, and try to switch to the
        /// next available endpoint. This should be used when the caller has attempted to communicate
        /// with the current resolvedEndpoint, and the caller has determined that it is unusable. If
        /// there are no other resolved endpoints, the session will move to the failed state.
        #[deprecated = "Use `nw_connection_cancel_current_endpoint` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(tryNextResolvedEndpoint))]
        #[unsafe(method_family = none)]
        pub unsafe fn tryNextResolvedEndpoint(&self);

        /// The maximum size of a datagram to be written currently. If a datagram is written
        /// with a longer length, the datagram may be fragmented or encounter an error. Note that this
        /// value is not guaranteed to be the maximum datagram length for end-to-end communication
        /// across the network. Use KVO to watch for changes.
        #[deprecated = "Use `nw_connection_get_maximum_datagram_size` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(maximumDatagramLength))]
        #[unsafe(method_family = none)]
        pub unsafe fn maximumDatagramLength(&self) -> NSUInteger;

        #[cfg(feature = "block2")]
        /// Set a read handler for datagrams. Reads will be scheduled by the system, so this
        /// method only needs to be called once for a session.
        ///
        /// Parameter `handler`: A handler called when datagrams have been read, or when an error has occurred.
        ///
        /// Parameter `maxDatagrams`: The maximum number of datagrams to send to the handler.
        #[deprecated = "Use `nw_connection_receive` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(setReadHandler:maxDatagrams:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setReadHandler_maxDatagrams(
            &self,
            handler: &block2::DynBlock<dyn Fn(*mut NSArray<NSData>, *mut NSError)>,
            max_datagrams: NSUInteger,
        );

        #[cfg(feature = "block2")]
        /// Write multiple datagrams. Callers should wait until the completionHandler is executed
        /// before issuing another write.
        ///
        /// Parameter `datagramArray`: An NSArray of NSData objects, containing the ordered list datagrams to write.
        ///
        /// Parameter `completionHandler`: A handler called when the write request has either succeeded or failed.
        #[deprecated = "Use `nw_connection_send` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(writeMultipleDatagrams:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn writeMultipleDatagrams_completionHandler(
            &self,
            datagram_array: &NSArray<NSData>,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        #[cfg(feature = "block2")]
        /// Write a single datagram. Callers should wait until the completionHandler is executed
        /// before issuing another write.
        ///
        /// Parameter `datagram`: An NSData containing the datagram to write.
        ///
        /// Parameter `completionHandler`: A handler called when the write request has either succeeded or failed.
        #[deprecated = "Use `nw_connection_send` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(writeDatagram:completionHandler:))]
        #[unsafe(method_family = none)]
        pub unsafe fn writeDatagram_completionHandler(
            &self,
            datagram: &NSData,
            completion_handler: &block2::DynBlock<dyn Fn(*mut NSError)>,
        );

        /// Move into the NWUDPSessionStateCancelled state. The connection will be terminated,
        /// and all handlers will be cancelled.
        #[deprecated = "Use `nw_connection_cancel` in Network framework instead, see deprecation notice in <NetworkExtension/NWUDPSession.h>"]
        #[unsafe(method(cancel))]
        #[unsafe(method_family = none)]
        pub unsafe fn cancel(&self);
    );
}

/// Methods declared on superclass `NSObject`.
impl NWUDPSession {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}

extern_class!(
    /// DEPRECATION NOTICE
    ///
    /// NW object wrappers are hidden in Swift 6. To continue accessing them, you
    /// can prepend double underscores to the symbol name.
    ///
    /// See also [Apple's documentation](https://developer.apple.com/documentation/networkextension/nwtlsparameters?language=objc)
    #[unsafe(super(NSObject))]
    #[derive(Debug, PartialEq, Eq, Hash)]
    #[deprecated = "Use `sec_protocol_options_t` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
    pub struct NWTLSParameters;
);

extern_conformance!(
    unsafe impl NSObjectProtocol for NWTLSParameters {}
);

impl NWTLSParameters {
    extern_methods!(
        /// The session ID for the associated connection, used for TLS session resumption.
        /// This property is optional when using TLS.
        #[deprecated = "Use `sec_protocol_options_set_tls_resumption_enabled` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(TLSSessionID))]
        #[unsafe(method_family = none)]
        pub unsafe fn TLSSessionID(&self) -> Option<Retained<NSData>>;

        /// Setter for [`TLSSessionID`][Self::TLSSessionID].
        #[deprecated = "Use `sec_protocol_options_set_tls_resumption_enabled` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(setTLSSessionID:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setTLSSessionID(&self, tls_session_id: Option<&NSData>);

        /// The set of allowed cipher suites, as defined in
        /// <Security
        /// /CipherSuite.h>.
        /// If set to nil, the default cipher suites will be used.
        #[deprecated = "Use `sec_protocol_options_append_tls_ciphersuite` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(SSLCipherSuites))]
        #[unsafe(method_family = none)]
        pub unsafe fn SSLCipherSuites(&self) -> Option<Retained<NSSet<NSNumber>>>;

        /// Setter for [`SSLCipherSuites`][Self::SSLCipherSuites].
        #[deprecated = "Use `sec_protocol_options_append_tls_ciphersuite` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(setSSLCipherSuites:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setSSLCipherSuites(&self, ssl_cipher_suites: Option<&NSSet<NSNumber>>);

        /// The minimum allowed SSLProtocol value. as defined in
        /// <Security
        /// /SecureTransport.h>.
        /// If set, the SSL handshake will not accept any protocol version older than the minimum.
        #[deprecated = "Use `sec_protocol_options_set_min_tls_protocol_version` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(minimumSSLProtocolVersion))]
        #[unsafe(method_family = none)]
        pub unsafe fn minimumSSLProtocolVersion(&self) -> NSUInteger;

        /// Setter for [`minimumSSLProtocolVersion`][Self::minimumSSLProtocolVersion].
        #[deprecated = "Use `sec_protocol_options_set_min_tls_protocol_version` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(setMinimumSSLProtocolVersion:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMinimumSSLProtocolVersion(&self, minimum_ssl_protocol_version: NSUInteger);

        /// The maximum allowed SSLProtocol value. as defined in
        /// <Security
        /// /SecureTransport.h>.
        /// If set, the SSL handshake will not accept any protocol version newer than the maximum.
        /// This property should be used with caution, since it may limit the use of preferred
        /// SSL protocols.
        #[deprecated = "Use `sec_protocol_options_set_max_tls_protocol_version` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(maximumSSLProtocolVersion))]
        #[unsafe(method_family = none)]
        pub unsafe fn maximumSSLProtocolVersion(&self) -> NSUInteger;

        /// Setter for [`maximumSSLProtocolVersion`][Self::maximumSSLProtocolVersion].
        #[deprecated = "Use `sec_protocol_options_set_max_tls_protocol_version` in Security framework instead, see deprecation notice in <NetworkExtension/NWTLSParameters.h>"]
        #[unsafe(method(setMaximumSSLProtocolVersion:))]
        #[unsafe(method_family = none)]
        pub unsafe fn setMaximumSSLProtocolVersion(&self, maximum_ssl_protocol_version: NSUInteger);
    );
}

/// Methods declared on superclass `NSObject`.
impl NWTLSParameters {
    extern_methods!(
        #[unsafe(method(init))]
        #[unsafe(method_family = init)]
        pub unsafe fn init(this: Allocated<Self>) -> Retained<Self>;

        #[unsafe(method(new))]
        #[unsafe(method_family = new)]
        pub unsafe fn new() -> Retained<Self>;
    );
}