package dns

// MsgAcceptFunc is used early in the server code to accept or reject a message with RcodeFormatError.
// It returns a MsgAcceptAction to indicate what should happen with the message.
type MsgAcceptFunc func(dh Header) MsgAcceptAction

// DefaultMsgAcceptFunc checks the request and will reject if:
//
// * isn't a request (don't respond in that case)
//
// * opcode isn't OpcodeQuery or OpcodeNotify
//
// * does not have exactly 1 question in the question section
//
// * has more than 1 RR in the Answer section
//
// * has more than 0 RRs in the Authority section
//
// * has more than 2 RRs in the Additional section
var DefaultMsgAcceptFunc MsgAcceptFunc = defaultMsgAcceptFunc

// MsgAcceptAction represents the action to be taken.
type MsgAcceptAction int

// Allowed returned values from a MsgAcceptFunc.
const (
        MsgAccept               MsgAcceptAction = iota // Accept the message
        MsgReject                                      // Reject the message with a RcodeFormatError
        MsgIgnore                                      // Ignore the error and send nothing back.
        MsgRejectNotImplemented                        // Reject the message with a RcodeNotImplemented
)

func defaultMsgAcceptFunc(dh Header) MsgAcceptAction {
        if isResponse := dh.Bits&_QR != 0; isResponse {
                return MsgIgnore
        }

        // Don't allow dynamic updates, because then the sections can contain a whole bunch of RRs.
        opcode := int(dh.Bits>>11) & 0xF
        if opcode != OpcodeQuery && opcode != OpcodeNotify {
                return MsgRejectNotImplemented
        }

        if dh.Qdcount != 1 {
                return MsgReject
        }
        // NOTIFY requests can have a SOA in the ANSWER section. See RFC 1996 Section 3.7 and 3.11.
        if dh.Ancount > 1 {
                return MsgReject
        }
        // IXFR request could have one SOA RR in the NS section. See RFC 1995, section 3.
        if dh.Nscount > 1 {
                return MsgReject
        }
        if dh.Arcount > 2 {
                return MsgReject
        }
        return MsgAccept
}

package dns

// A client implementation.

import (
        "context"
        "crypto/tls"
        "encoding/binary"
        "io"
        "net"
        "strings"
        "time"
)

const (
        dnsTimeout     time.Duration = 2 * time.Second
        tcpIdleTimeout time.Duration = 8 * time.Second
)

func isPacketConn(c net.Conn) bool {
        if _, ok := c.(net.PacketConn); !ok {
                return false
        }

        if ua, ok := c.LocalAddr().(*net.UnixAddr); ok {
                return ua.Net == "unixgram" || ua.Net == "unixpacket"
        }

        return true
}

// A Conn represents a connection to a DNS server.
type Conn struct {
        net.Conn                         // a net.Conn holding the connection
        UDPSize        uint16            // minimum receive buffer for UDP messages
        TsigSecret     map[string]string // secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
        TsigProvider   TsigProvider      // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.
        tsigRequestMAC string
}

func (co *Conn) tsigProvider() TsigProvider {
        if co.TsigProvider != nil {
                return co.TsigProvider
        }
        // tsigSecretProvider will return ErrSecret if co.TsigSecret is nil.
        return tsigSecretProvider(co.TsigSecret)
}

// A Client defines parameters for a DNS client.
type Client struct {
        Net       string      // if "tcp" or "tcp-tls" (DNS over TLS) a TCP query will be initiated, otherwise an UDP one (default is "" for UDP)
        UDPSize   uint16      // minimum receive buffer for UDP messages
        TLSConfig *tls.Config // TLS connection configuration
        Dialer    *net.Dialer // a net.Dialer used to set local address, timeouts and more
        // Timeout is a cumulative timeout for dial, write and read, defaults to 0 (disabled) - overrides DialTimeout, ReadTimeout,
        // WriteTimeout when non-zero. Can be overridden with net.Dialer.Timeout (see Client.ExchangeWithDialer and
        // Client.Dialer) or context.Context.Deadline (see ExchangeContext)
        Timeout      time.Duration
        DialTimeout  time.Duration     // net.DialTimeout, defaults to 2 seconds, or net.Dialer.Timeout if expiring earlier - overridden by Timeout when that value is non-zero
        ReadTimeout  time.Duration     // net.Conn.SetReadTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
        WriteTimeout time.Duration     // net.Conn.SetWriteTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
        TsigSecret   map[string]string // secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
        TsigProvider TsigProvider      // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.

        // SingleInflight previously serialised multiple concurrent queries for the
        // same Qname, Qtype and Qclass to ensure only one would be in flight at a
        // time.
        //
        // Deprecated: This is a no-op. Callers should implement their own in flight
        // query caching if needed. See github.com/miekg/dns/issues/1449.
        SingleInflight bool
}

// Exchange performs a synchronous UDP query. It sends the message m to the address
// contained in a and waits for a reply. Exchange does not retry a failed query, nor
// will it fall back to TCP in case of truncation.
// See client.Exchange for more information on setting larger buffer sizes.
func Exchange(m *Msg, a string) (r *Msg, err error) {
        client := Client{Net: "udp"}
        r, _, err = client.Exchange(m, a)
        return r, err
}

func (c *Client) dialTimeout() time.Duration {
        if c.Timeout != 0 {
                return c.Timeout
        }
        if c.DialTimeout != 0 {
                return c.DialTimeout
        }
        return dnsTimeout
}

func (c *Client) readTimeout() time.Duration {
        if c.ReadTimeout != 0 {
                return c.ReadTimeout
        }
        return dnsTimeout
}

func (c *Client) writeTimeout() time.Duration {
        if c.WriteTimeout != 0 {
                return c.WriteTimeout
        }
        return dnsTimeout
}

// Dial connects to the address on the named network.
func (c *Client) Dial(address string) (conn *Conn, err error) {
        return c.DialContext(context.Background(), address)
}

// DialContext connects to the address on the named network, with a context.Context.
func (c *Client) DialContext(ctx context.Context, address string) (conn *Conn, err error) {
        // create a new dialer with the appropriate timeout
        var d net.Dialer
        if c.Dialer == nil {
                d = net.Dialer{Timeout: c.getTimeoutForRequest(c.dialTimeout())}
        } else {
                d = *c.Dialer
        }

        network := c.Net
        if network == "" {
                network = "udp"
        }

        useTLS := strings.HasPrefix(network, "tcp") && strings.HasSuffix(network, "-tls")

        conn = new(Conn)
        if useTLS {
                network = strings.TrimSuffix(network, "-tls")

                tlsDialer := tls.Dialer{
                        NetDialer: &d,
                        Config:    c.TLSConfig,
                }
                conn.Conn, err = tlsDialer.DialContext(ctx, network, address)
        } else {
                conn.Conn, err = d.DialContext(ctx, network, address)
        }
        if err != nil {
                return nil, err
        }
        conn.UDPSize = c.UDPSize
        return conn, nil
}

// Exchange performs a synchronous query. It sends the message m to the address
// contained in a and waits for a reply. Basic use pattern with a *dns.Client:
//
//        c := new(dns.Client)
//        in, rtt, err := c.Exchange(message, "127.0.0.1:53")
//
// Exchange does not retry a failed query, nor will it fall back to TCP in
// case of truncation.
// It is up to the caller to create a message that allows for larger responses to be
// returned. Specifically this means adding an EDNS0 OPT RR that will advertise a larger
// buffer, see SetEdns0. Messages without an OPT RR will fallback to the historic limit
// of 512 bytes
// To specify a local address or a timeout, the caller has to set the `Client.Dialer`
// attribute appropriately
func (c *Client) Exchange(m *Msg, address string) (r *Msg, rtt time.Duration, err error) {
        co, err := c.Dial(address)

        if err != nil {
                return nil, 0, err
        }
        defer co.Close()
        return c.ExchangeWithConn(m, co)
}

// ExchangeWithConn has the same behavior as Exchange, just with a predetermined connection
// that will be used instead of creating a new one.
// Usage pattern with a *dns.Client:
//
//        c := new(dns.Client)
//        // connection management logic goes here
//
//        conn := c.Dial(address)
//        in, rtt, err := c.ExchangeWithConn(message, conn)
//
// This allows users of the library to implement their own connection management,
// as opposed to Exchange, which will always use new connections and incur the added overhead
// that entails when using "tcp" and especially "tcp-tls" clients.
func (c *Client) ExchangeWithConn(m *Msg, conn *Conn) (r *Msg, rtt time.Duration, err error) {
        return c.ExchangeWithConnContext(context.Background(), m, conn)
}

// ExchangeWithConnContext has the same behaviour as ExchangeWithConn and
// additionally obeys deadlines from the passed Context.
func (c *Client) ExchangeWithConnContext(ctx context.Context, m *Msg, co *Conn) (r *Msg, rtt time.Duration, err error) {
        opt := m.IsEdns0()
        // If EDNS0 is used use that for size.
        if opt != nil && opt.UDPSize() >= MinMsgSize {
                co.UDPSize = opt.UDPSize()
        }
        // Otherwise use the client's configured UDP size.
        if opt == nil && c.UDPSize >= MinMsgSize {
                co.UDPSize = c.UDPSize
        }

        // write with the appropriate write timeout
        t := time.Now()
        writeDeadline := t.Add(c.getTimeoutForRequest(c.writeTimeout()))
        readDeadline := t.Add(c.getTimeoutForRequest(c.readTimeout()))
        if deadline, ok := ctx.Deadline(); ok {
                if deadline.Before(writeDeadline) {
                        writeDeadline = deadline
                }
                if deadline.Before(readDeadline) {
                        readDeadline = deadline
                }
        }
        co.SetWriteDeadline(writeDeadline)
        co.SetReadDeadline(readDeadline)

        co.TsigSecret, co.TsigProvider = c.TsigSecret, c.TsigProvider

        if err = co.WriteMsg(m); err != nil {
                return nil, 0, err
        }

        if isPacketConn(co.Conn) {
                for {
                        r, err = co.ReadMsg()
                        // Ignore replies with mismatched IDs because they might be
                        // responses to earlier queries that timed out.
                        if err != nil || r.Id == m.Id {
                                break
                        }
                }
        } else {
                r, err = co.ReadMsg()
                if err == nil && r.Id != m.Id {
                        err = ErrId
                }
        }
        rtt = time.Since(t)
        return r, rtt, err
}

// ReadMsg reads a message from the connection co.
// If the received message contains a TSIG record the transaction signature
// is verified. This method always tries to return the message, however if an
// error is returned there are no guarantees that the returned message is a
// valid representation of the packet read.
func (co *Conn) ReadMsg() (*Msg, error) {
        p, err := co.ReadMsgHeader(nil)
        if err != nil {
                return nil, err
        }

        m := new(Msg)
        if err := m.Unpack(p); err != nil {
                // If an error was returned, we still want to allow the user to use
                // the message, but naively they can just check err if they don't want
                // to use an erroneous message
                return m, err
        }
        if t := m.IsTsig(); t != nil {
                // Need to work on the original message p, as that was used to calculate the tsig.
                err = TsigVerifyWithProvider(p, co.tsigProvider(), co.tsigRequestMAC, false)
        }
        return m, err
}

// ReadMsgHeader reads a DNS message, parses and populates hdr (when hdr is not nil).
// Returns message as a byte slice to be parsed with Msg.Unpack later on.
// Note that error handling on the message body is not possible as only the header is parsed.
func (co *Conn) ReadMsgHeader(hdr *Header) ([]byte, error) {
        var (
                p   []byte
                n   int
                err error
        )

        if isPacketConn(co.Conn) {
                if co.UDPSize > MinMsgSize {
                        p = make([]byte, co.UDPSize)
                } else {
                        p = make([]byte, MinMsgSize)
                }
                n, err = co.Read(p)
        } else {
                var length uint16
                if err := binary.Read(co.Conn, binary.BigEndian, &length); err != nil {
                        return nil, err
                }

                p = make([]byte, length)
                n, err = io.ReadFull(co.Conn, p)
        }

        if err != nil {
                return nil, err
        } else if n < headerSize {
                return nil, ErrShortRead
        }

        p = p[:n]
        if hdr != nil {
                dh, _, err := unpackMsgHdr(p, 0)
                if err != nil {
                        return nil, err
                }
                *hdr = dh
        }
        return p, err
}

// Read implements the net.Conn read method.
func (co *Conn) Read(p []byte) (n int, err error) {
        if co.Conn == nil {
                return 0, ErrConnEmpty
        }

        if isPacketConn(co.Conn) {
                // UDP connection
                return co.Conn.Read(p)
        }

        var length uint16
        if err := binary.Read(co.Conn, binary.BigEndian, &length); err != nil {
                return 0, err
        }
        if int(length) > len(p) {
                return 0, io.ErrShortBuffer
        }

        return io.ReadFull(co.Conn, p[:length])
}

// WriteMsg sends a message through the connection co.
// If the message m contains a TSIG record the transaction
// signature is calculated.
func (co *Conn) WriteMsg(m *Msg) (err error) {
        var out []byte
        if t := m.IsTsig(); t != nil {
                // Set tsigRequestMAC for the next read, although only used in zone transfers.
                out, co.tsigRequestMAC, err = TsigGenerateWithProvider(m, co.tsigProvider(), co.tsigRequestMAC, false)
        } else {
                out, err = m.Pack()
        }
        if err != nil {
                return err
        }
        _, err = co.Write(out)
        return err
}

// Write implements the net.Conn Write method.
func (co *Conn) Write(p []byte) (int, error) {
        if len(p) > MaxMsgSize {
                return 0, &Error{err: "message too large"}
        }

        if isPacketConn(co.Conn) {
                return co.Conn.Write(p)
        }

        msg := make([]byte, 2+len(p))
        binary.BigEndian.PutUint16(msg, uint16(len(p)))
        copy(msg[2:], p)
        return co.Conn.Write(msg)
}

// Return the appropriate timeout for a specific request
func (c *Client) getTimeoutForRequest(timeout time.Duration) time.Duration {
        var requestTimeout time.Duration
        if c.Timeout != 0 {
                requestTimeout = c.Timeout
        } else {
                requestTimeout = timeout
        }
        // net.Dialer.Timeout has priority if smaller than the timeouts computed so
        // far
        if c.Dialer != nil && c.Dialer.Timeout != 0 {
                if c.Dialer.Timeout < requestTimeout {
                        requestTimeout = c.Dialer.Timeout
                }
        }
        return requestTimeout
}

// Dial connects to the address on the named network.
func Dial(network, address string) (conn *Conn, err error) {
        conn = new(Conn)
        conn.Conn, err = net.Dial(network, address)
        if err != nil {
                return nil, err
        }
        return conn, nil
}

// ExchangeContext performs a synchronous UDP query, like Exchange. It
// additionally obeys deadlines from the passed Context.
func ExchangeContext(ctx context.Context, m *Msg, a string) (r *Msg, err error) {
        client := Client{Net: "udp"}
        r, _, err = client.ExchangeContext(ctx, m, a)
        // ignoring rtt to leave the original ExchangeContext API unchanged, but
        // this function will go away
        return r, err
}

// ExchangeConn performs a synchronous query. It sends the message m via the connection
// c and waits for a reply. The connection c is not closed by ExchangeConn.
// Deprecated: This function is going away, but can easily be mimicked:
//
//        co := &dns.Conn{Conn: c} // c is your net.Conn
//        co.WriteMsg(m)
//        in, _  := co.ReadMsg()
//        co.Close()
func ExchangeConn(c net.Conn, m *Msg) (r *Msg, err error) {
        println("dns: ExchangeConn: this function is deprecated")
        co := new(Conn)
        co.Conn = c
        if err = co.WriteMsg(m); err != nil {
                return nil, err
        }
        r, err = co.ReadMsg()
        if err == nil && r.Id != m.Id {
                err = ErrId
        }
        return r, err
}

// DialTimeout acts like Dial but takes a timeout.
func DialTimeout(network, address string, timeout time.Duration) (conn *Conn, err error) {
        client := Client{Net: network, Dialer: &net.Dialer{Timeout: timeout}}
        return client.Dial(address)
}

// DialWithTLS connects to the address on the named network with TLS.
func DialWithTLS(network, address string, tlsConfig *tls.Config) (conn *Conn, err error) {
        if !strings.HasSuffix(network, "-tls") {
                network += "-tls"
        }
        client := Client{Net: network, TLSConfig: tlsConfig}
        return client.Dial(address)
}

// DialTimeoutWithTLS acts like DialWithTLS but takes a timeout.
func DialTimeoutWithTLS(network, address string, tlsConfig *tls.Config, timeout time.Duration) (conn *Conn, err error) {
        if !strings.HasSuffix(network, "-tls") {
                network += "-tls"
        }
        client := Client{Net: network, Dialer: &net.Dialer{Timeout: timeout}, TLSConfig: tlsConfig}
        return client.Dial(address)
}

// ExchangeContext acts like Exchange, but honors the deadline on the provided
// context, if present. If there is both a context deadline and a configured
// timeout on the client, the earliest of the two takes effect.
func (c *Client) ExchangeContext(ctx context.Context, m *Msg, a string) (r *Msg, rtt time.Duration, err error) {
        conn, err := c.DialContext(ctx, a)
        if err != nil {
                return nil, 0, err
        }
        defer conn.Close()

        return c.ExchangeWithConnContext(ctx, m, conn)
}

package dns

import (
        "bufio"
        "io"
        "os"
        "strconv"
        "strings"
)

// ClientConfig wraps the contents of the /etc/resolv.conf file.
type ClientConfig struct {
        Servers  []string // servers to use
        Search   []string // suffixes to append to local name
        Port     string   // what port to use
        Ndots    int      // number of dots in name to trigger absolute lookup
        Timeout  int      // seconds before giving up on packet
        Attempts int      // lost packets before giving up on server, not used in the package dns
}

// ClientConfigFromFile parses a resolv.conf(5) like file and returns
// a *ClientConfig.
func ClientConfigFromFile(resolvconf string) (*ClientConfig, error) {
        file, err := os.Open(resolvconf)
        if err != nil {
                return nil, err
        }
        defer file.Close()
        return ClientConfigFromReader(file)
}

// ClientConfigFromReader works like ClientConfigFromFile but takes an io.Reader as argument
func ClientConfigFromReader(resolvconf io.Reader) (*ClientConfig, error) {
        c := new(ClientConfig)
        scanner := bufio.NewScanner(resolvconf)
        c.Servers = make([]string, 0)
        c.Search = make([]string, 0)
        c.Port = "53"
        c.Ndots = 1
        c.Timeout = 5
        c.Attempts = 2

        for scanner.Scan() {
                if err := scanner.Err(); err != nil {
                        return nil, err
                }
                line := scanner.Text()
                f := strings.Fields(line)
                if len(f) < 1 {
                        continue
                }
                switch f[0] {
                case "nameserver": // add one name server
                        if len(f) > 1 {
                                // One more check: make sure server name is
                                // just an IP address.  Otherwise we need DNS
                                // to look it up.
                                name := f[1]
                                c.Servers = append(c.Servers, name)
                        }

                case "domain": // set search path to just this domain
                        if len(f) > 1 {
                                c.Search = make([]string, 1)
                                c.Search[0] = f[1]
                        } else {
                                c.Search = make([]string, 0)
                        }

                case "search": // set search path to given servers
                        c.Search = cloneSlice(f[1:])

                case "options": // magic options
                        for _, s := range f[1:] {
                                switch {
                                case len(s) >= 6 && s[:6] == "ndots:":
                                        n, _ := strconv.Atoi(s[6:])
                                        if n < 0 {
                                                n = 0
                                        } else if n > 15 {
                                                n = 15
                                        }
                                        c.Ndots = n
                                case len(s) >= 8 && s[:8] == "timeout:":
                                        n, _ := strconv.Atoi(s[8:])
                                        if n < 1 {
                                                n = 1
                                        }
                                        c.Timeout = n
                                case len(s) >= 9 && s[:9] == "attempts:":
                                        n, _ := strconv.Atoi(s[9:])
                                        if n < 1 {
                                                n = 1
                                        }
                                        c.Attempts = n
                                case s == "rotate":
                                        /* not imp */
                                }
                        }
                }
        }
        return c, nil
}

// NameList returns all of the names that should be queried based on the
// config. It is based off of go's net/dns name building, but it does not
// check the length of the resulting names.
func (c *ClientConfig) NameList(name string) []string {
        // if this domain is already fully qualified, no append needed.
        if IsFqdn(name) {
                return []string{name}
        }

        // Check to see if the name has more labels than Ndots. Do this before making
        // the domain fully qualified.
        hasNdots := CountLabel(name) > c.Ndots
        // Make the domain fully qualified.
        name = Fqdn(name)

        // Make a list of names based off search.
        names := []string{}

        // If name has enough dots, try that first.
        if hasNdots {
                names = append(names, name)
        }
        for _, s := range c.Search {
                names = append(names, Fqdn(name+s))
        }
        // If we didn't have enough dots, try after suffixes.
        if !hasNdots {
                names = append(names, name)
        }
        return names
}

package dns

import (
        "crypto/sha256"
        "crypto/sha512"
        "crypto/x509"
        "encoding/hex"
        "errors"
)

// CertificateToDANE converts a certificate to a hex string as used in the TLSA or SMIMEA records.
func CertificateToDANE(selector, matchingType uint8, cert *x509.Certificate) (string, error) {
        switch matchingType {
        case 0:
                switch selector {
                case 0:
                        return hex.EncodeToString(cert.Raw), nil
                case 1:
                        return hex.EncodeToString(cert.RawSubjectPublicKeyInfo), nil
                }
        case 1:
                h := sha256.New()
                switch selector {
                case 0:
                        h.Write(cert.Raw)
                        return hex.EncodeToString(h.Sum(nil)), nil
                case 1:
                        h.Write(cert.RawSubjectPublicKeyInfo)
                        return hex.EncodeToString(h.Sum(nil)), nil
                }
        case 2:
                h := sha512.New()
                switch selector {
                case 0:
                        h.Write(cert.Raw)
                        return hex.EncodeToString(h.Sum(nil)), nil
                case 1:
                        h.Write(cert.RawSubjectPublicKeyInfo)
                        return hex.EncodeToString(h.Sum(nil)), nil
                }
        }
        return "", errors.New("dns: bad MatchingType or Selector")
}

package dns

import (
        "errors"
        "net"
        "strconv"
        "strings"
)

const hexDigit = "0123456789abcdef"

// Everything is assumed in ClassINET.

// SetReply creates a reply message from a request message.
func (dns *Msg) SetReply(request *Msg) *Msg {
        dns.Id = request.Id
        dns.Response = true
        dns.Opcode = request.Opcode
        if dns.Opcode == OpcodeQuery {
                dns.RecursionDesired = request.RecursionDesired // Copy rd bit
                dns.CheckingDisabled = request.CheckingDisabled // Copy cd bit
        }
        dns.Rcode = RcodeSuccess
        if len(request.Question) > 0 {
                dns.Question = []Question{request.Question[0]}
        }
        return dns
}

// SetQuestion creates a question message, it sets the Question
// section, generates an Id and sets the RecursionDesired (RD)
// bit to true.
func (dns *Msg) SetQuestion(z string, t uint16) *Msg {
        dns.Id = Id()
        dns.RecursionDesired = true
        dns.Question = make([]Question, 1)
        dns.Question[0] = Question{z, t, ClassINET}
        return dns
}

// SetNotify creates a notify message, it sets the Question
// section, generates an Id and sets the Authoritative (AA)
// bit to true.
func (dns *Msg) SetNotify(z string) *Msg {
        dns.Opcode = OpcodeNotify
        dns.Authoritative = true
        dns.Id = Id()
        dns.Question = make([]Question, 1)
        dns.Question[0] = Question{z, TypeSOA, ClassINET}
        return dns
}

// SetRcode creates an error message suitable for the request.
func (dns *Msg) SetRcode(request *Msg, rcode int) *Msg {
        dns.SetReply(request)
        dns.Rcode = rcode
        return dns
}

// SetRcodeFormatError creates a message with FormError set.
func (dns *Msg) SetRcodeFormatError(request *Msg) *Msg {
        dns.Rcode = RcodeFormatError
        dns.Opcode = OpcodeQuery
        dns.Response = true
        dns.Authoritative = false
        dns.Id = request.Id
        return dns
}

// SetUpdate makes the message a dynamic update message. It
// sets the ZONE section to: z, TypeSOA, ClassINET.
func (dns *Msg) SetUpdate(z string) *Msg {
        dns.Id = Id()
        dns.Response = false
        dns.Opcode = OpcodeUpdate
        dns.Compress = false // BIND9 cannot handle compression
        dns.Question = make([]Question, 1)
        dns.Question[0] = Question{z, TypeSOA, ClassINET}
        return dns
}

// SetIxfr creates message for requesting an IXFR.
func (dns *Msg) SetIxfr(z string, serial uint32, ns, mbox string) *Msg {
        dns.Id = Id()
        dns.Question = make([]Question, 1)
        dns.Ns = make([]RR, 1)
        s := new(SOA)
        s.Hdr = RR_Header{z, TypeSOA, ClassINET, defaultTtl, 0}
        s.Serial = serial
        s.Ns = ns
        s.Mbox = mbox
        dns.Question[0] = Question{z, TypeIXFR, ClassINET}
        dns.Ns[0] = s
        return dns
}

// SetAxfr creates message for requesting an AXFR.
func (dns *Msg) SetAxfr(z string) *Msg {
        dns.Id = Id()
        dns.Question = make([]Question, 1)
        dns.Question[0] = Question{z, TypeAXFR, ClassINET}
        return dns
}

// SetTsig appends a TSIG RR to the message.
// This is only a skeleton TSIG RR that is added as the last RR in the
// additional section. The TSIG is calculated when the message is being send.
func (dns *Msg) SetTsig(z, algo string, fudge uint16, timesigned int64) *Msg {
        t := new(TSIG)
        t.Hdr = RR_Header{z, TypeTSIG, ClassANY, 0, 0}
        t.Algorithm = algo
        t.Fudge = fudge
        t.TimeSigned = uint64(timesigned)
        t.OrigId = dns.Id
        dns.Extra = append(dns.Extra, t)
        return dns
}

// SetEdns0 appends a EDNS0 OPT RR to the message.
// TSIG should always the last RR in a message.
func (dns *Msg) SetEdns0(udpsize uint16, do bool) *Msg {
        e := new(OPT)
        e.Hdr.Name = "."
        e.Hdr.Rrtype = TypeOPT
        e.SetUDPSize(udpsize)
        if do {
                e.SetDo()
        }
        dns.Extra = append(dns.Extra, e)
        return dns
}

// IsTsig checks if the message has a TSIG record as the last record
// in the additional section. It returns the TSIG record found or nil.
func (dns *Msg) IsTsig() *TSIG {
        if len(dns.Extra) > 0 {
                if dns.Extra[len(dns.Extra)-1].Header().Rrtype == TypeTSIG {
                        return dns.Extra[len(dns.Extra)-1].(*TSIG)
                }
        }
        return nil
}

// IsEdns0 checks if the message has a EDNS0 (OPT) record, any EDNS0
// record in the additional section will do. It returns the OPT record
// found or nil.
func (dns *Msg) IsEdns0() *OPT {
        // RFC 6891, Section 6.1.1 allows the OPT record to appear
        // anywhere in the additional record section, but it's usually at
        // the end so start there.
        for i := len(dns.Extra) - 1; i >= 0; i-- {
                if dns.Extra[i].Header().Rrtype == TypeOPT {
                        return dns.Extra[i].(*OPT)
                }
        }
        return nil
}

// popEdns0 is like IsEdns0, but it removes the record from the message.
func (dns *Msg) popEdns0() *OPT {
        // RFC 6891, Section 6.1.1 allows the OPT record to appear
        // anywhere in the additional record section, but it's usually at
        // the end so start there.
        for i := len(dns.Extra) - 1; i >= 0; i-- {
                if dns.Extra[i].Header().Rrtype == TypeOPT {
                        opt := dns.Extra[i].(*OPT)
                        dns.Extra = append(dns.Extra[:i], dns.Extra[i+1:]...)
                        return opt
                }
        }
        return nil
}

// IsDomainName checks if s is a valid domain name, it returns the number of
// labels and true, when a domain name is valid.  Note that non fully qualified
// domain name is considered valid, in this case the last label is counted in
// the number of labels.  When false is returned the number of labels is not
// defined.  Also note that this function is extremely liberal; almost any
// string is a valid domain name as the DNS is 8 bit protocol. It checks if each
// label fits in 63 characters and that the entire name will fit into the 255
// octet wire format limit.
func IsDomainName(s string) (labels int, ok bool) {
        // XXX: The logic in this function was copied from packDomainName and
        // should be kept in sync with that function.

        const lenmsg = 256

        if len(s) == 0 { // Ok, for instance when dealing with update RR without any rdata.
                return 0, false
        }

        s = Fqdn(s)

        // Each dot ends a segment of the name. Except for escaped dots (\.), which
        // are normal dots.

        var (
                off    int
                begin  int
                wasDot bool
                escape bool
        )
        for i := 0; i < len(s); i++ {
                switch s[i] {
                case '\\':
                        escape = !escape
                        if off+1 > lenmsg {
                                return labels, false
                        }

                        // check for \DDD
                        if isDDD(s[i+1:]) {
                                i += 3
                                begin += 3
                        } else {
                                i++
                                begin++
                        }

                        wasDot = false
                case '.':
                        escape = false
                        if i == 0 && len(s) > 1 {
                                // leading dots are not legal except for the root zone
                                return labels, false
                        }

                        if wasDot {
                                // two dots back to back is not legal
                                return labels, false
                        }
                        wasDot = true

                        labelLen := i - begin
                        if labelLen >= 1<<6 { // top two bits of length must be clear
                                return labels, false
                        }

                        // off can already (we're in a loop) be bigger than lenmsg
                        // this happens when a name isn't fully qualified
                        off += 1 + labelLen
                        if off > lenmsg {
                                return labels, false
                        }

                        labels++
                        begin = i + 1
                default:
                        escape = false
                        wasDot = false
                }
        }
        if escape {
                return labels, false
        }
        return labels, true
}

// IsSubDomain checks if child is indeed a child of the parent. If child and parent
// are the same domain true is returned as well.
func IsSubDomain(parent, child string) bool {
        // Entire child is contained in parent
        return CompareDomainName(parent, child) == CountLabel(parent)
}

// IsMsg sanity checks buf and returns an error if it isn't a valid DNS packet.
// The checking is performed on the binary payload.
func IsMsg(buf []byte) error {
        // Header
        if len(buf) < headerSize {
                return errors.New("dns: bad message header")
        }
        // Header: Opcode
        // TODO(miek): more checks here, e.g. check all header bits.
        return nil
}

// IsFqdn checks if a domain name is fully qualified.
func IsFqdn(s string) bool {
        // Check for (and remove) a trailing dot, returning if there isn't one.
        if s == "" || s[len(s)-1] != '.' {
                return false
        }
        s = s[:len(s)-1]

        // If we don't have an escape sequence before the final dot, we know it's
        // fully qualified and can return here.
        if s == "" || s[len(s)-1] != '\\' {
                return true
        }

        // Otherwise we have to check if the dot is escaped or not by checking if
        // there are an odd or even number of escape sequences before the dot.
        i := strings.LastIndexFunc(s, func(r rune) bool {
                return r != '\\'
        })
        return (len(s)-i)%2 != 0
}

// IsRRset reports whether a set of RRs is a valid RRset as defined by RFC 2181.
// This means the RRs need to have the same type, name, and class.
func IsRRset(rrset []RR) bool {
        if len(rrset) == 0 {
                return false
        }

        baseH := rrset[0].Header()
        for _, rr := range rrset[1:] {
                curH := rr.Header()
                if curH.Rrtype != baseH.Rrtype || curH.Class != baseH.Class || curH.Name != baseH.Name {
                        // Mismatch between the records, so this is not a valid rrset for
                        // signing/verifying
                        return false
                }
        }

        return true
}

// Fqdn return the fully qualified domain name from s.
// If s is already fully qualified, it behaves as the identity function.
func Fqdn(s string) string {
        if IsFqdn(s) {
                return s
        }
        return s + "."
}

// CanonicalName returns the domain name in canonical form. A name in canonical
// form is lowercase and fully qualified. Only US-ASCII letters are affected. See
// Section 6.2 in RFC 4034.
func CanonicalName(s string) string {
        return strings.Map(func(r rune) rune {
                if r >= 'A' && r <= 'Z' {
                        r += 'a' - 'A'
                }
                return r
        }, Fqdn(s))
}

// Copied from the official Go code.

// ReverseAddr returns the in-addr.arpa. or ip6.arpa. hostname of the IP
// address suitable for reverse DNS (PTR) record lookups or an error if it fails
// to parse the IP address.
func ReverseAddr(addr string) (arpa string, err error) {
        ip := net.ParseIP(addr)
        if ip == nil {
                return "", &Error{err: "unrecognized address: " + addr}
        }
        if v4 := ip.To4(); v4 != nil {
                buf := make([]byte, 0, net.IPv4len*4+len("in-addr.arpa."))
                // Add it, in reverse, to the buffer
                for i := len(v4) - 1; i >= 0; i-- {
                        buf = strconv.AppendInt(buf, int64(v4[i]), 10)
                        buf = append(buf, '.')
                }
                // Append "in-addr.arpa." and return (buf already has the final .)
                buf = append(buf, "in-addr.arpa."...)
                return string(buf), nil
        }
        // Must be IPv6
        buf := make([]byte, 0, net.IPv6len*4+len("ip6.arpa."))
        // Add it, in reverse, to the buffer
        for i := len(ip) - 1; i >= 0; i-- {
                v := ip[i]
                buf = append(buf, hexDigit[v&0xF], '.', hexDigit[v>>4], '.')
        }
        // Append "ip6.arpa." and return (buf already has the final .)
        buf = append(buf, "ip6.arpa."...)
        return string(buf), nil
}

// String returns the string representation for the type t.
func (t Type) String() string {
        if t1, ok := TypeToString[uint16(t)]; ok {
                return t1
        }
        return "TYPE" + strconv.Itoa(int(t))
}

// String returns the string representation for the class c.
func (c Class) String() string {
        if s, ok := ClassToString[uint16(c)]; ok {
                // Only emit mnemonics when they are unambiguous, specially ANY is in both.
                if _, ok := StringToType[s]; !ok {
                        return s
                }
        }
        return "CLASS" + strconv.Itoa(int(c))
}

// String returns the string representation for the name n.
func (n Name) String() string {
        return sprintName(string(n))
}

package dns

import (
        "encoding/hex"
        "strconv"
)

const (
        year68     = 1 << 31 // For RFC1982 (Serial Arithmetic) calculations in 32 bits.
        defaultTtl = 3600    // Default internal TTL.

        // DefaultMsgSize is the standard default for messages larger than 512 bytes.
        DefaultMsgSize = 4096
        // MinMsgSize is the minimal size of a DNS packet.
        MinMsgSize = 512
        // MaxMsgSize is the largest possible DNS packet.
        MaxMsgSize = 65535
)

// Error represents a DNS error.
type Error struct{ err string }

func (e *Error) Error() string {
        if e == nil {
                return "dns: <nil>"
        }
        return "dns: " + e.err
}

// An RR represents a resource record.
type RR interface {
        // Header returns the header of an resource record. The header contains
        // everything up to the rdata.
        Header() *RR_Header
        // String returns the text representation of the resource record.
        String() string

        // copy returns a copy of the RR
        copy() RR

        // len returns the length (in octets) of the compressed or uncompressed RR in wire format.
        //
        // If compression is nil, the uncompressed size will be returned, otherwise the compressed
        // size will be returned and domain names will be added to the map for future compression.
        len(off int, compression map[string]struct{}) int

        // pack packs the records RDATA into wire format. The header will
        // already have been packed into msg.
        pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error)

        // unpack unpacks an RR from wire format.
        //
        // This will only be called on a new and empty RR type with only the header populated. It
        // will only be called if the record's RDATA is non-empty.
        unpack(msg []byte, off int) (off1 int, err error)

        // parse parses an RR from zone file format.
        //
        // This will only be called on a new and empty RR type with only the header populated.
        parse(c *zlexer, origin string) *ParseError

        // isDuplicate returns whether the two RRs are duplicates.
        isDuplicate(r2 RR) bool
}

// RR_Header is the header all DNS resource records share.
type RR_Header struct {
        Name     string `dns:"cdomain-name"`
        Rrtype   uint16
        Class    uint16
        Ttl      uint32
        Rdlength uint16 // Length of data after header.
}

// Header returns itself. This is here to make RR_Header implements the RR interface.
func (h *RR_Header) Header() *RR_Header { return h }

// Just to implement the RR interface.
func (h *RR_Header) copy() RR { return nil }

func (h *RR_Header) String() string {
        var s string

        if h.Rrtype == TypeOPT {
                s = ";"
                // and maybe other things
        }

        s += sprintName(h.Name) + "\t"
        s += strconv.FormatInt(int64(h.Ttl), 10) + "\t"
        s += Class(h.Class).String() + "\t"
        s += Type(h.Rrtype).String() + "\t"
        return s
}

func (h *RR_Header) len(off int, compression map[string]struct{}) int {
        l := domainNameLen(h.Name, off, compression, true)
        l += 10 // rrtype(2) + class(2) + ttl(4) + rdlength(2)
        return l
}

func (h *RR_Header) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        // RR_Header has no RDATA to pack.
        return off, nil
}

func (h *RR_Header) unpack(msg []byte, off int) (int, error) {
        panic("dns: internal error: unpack should never be called on RR_Header")
}

func (h *RR_Header) parse(c *zlexer, origin string) *ParseError {
        panic("dns: internal error: parse should never be called on RR_Header")
}

// ToRFC3597 converts a known RR to the unknown RR representation from RFC 3597.
func (rr *RFC3597) ToRFC3597(r RR) error {
        buf := make([]byte, Len(r))
        headerEnd, off, err := packRR(r, buf, 0, compressionMap{}, false)
        if err != nil {
                return err
        }
        buf = buf[:off]

        *rr = RFC3597{Hdr: *r.Header()}
        rr.Hdr.Rdlength = uint16(off - headerEnd)

        if noRdata(rr.Hdr) {
                return nil
        }

        _, err = rr.unpack(buf, headerEnd)
        return err
}

// fromRFC3597 converts an unknown RR representation from RFC 3597 to the known RR type.
func (rr *RFC3597) fromRFC3597(r RR) error {
        hdr := r.Header()
        *hdr = rr.Hdr

        // Can't overflow uint16 as the length of Rdata is validated in (*RFC3597).parse.
        // We can only get here when rr was constructed with that method.
        hdr.Rdlength = uint16(hex.DecodedLen(len(rr.Rdata)))

        if noRdata(*hdr) {
                // Dynamic update.
                return nil
        }

        // rr.pack requires an extra allocation and a copy so we just decode Rdata
        // manually, it's simpler anyway.
        msg, err := hex.DecodeString(rr.Rdata)
        if err != nil {
                return err
        }

        _, err = r.unpack(msg, 0)
        return err
}

package dns

import (
        "bytes"
        "crypto"
        "crypto/ecdsa"
        "crypto/ed25519"
        "crypto/elliptic"
        "crypto/rand"
        "crypto/rsa"
        _ "crypto/sha1"   // need its init function
        _ "crypto/sha256" // need its init function
        _ "crypto/sha512" // need its init function
        "encoding/asn1"
        "encoding/binary"
        "encoding/hex"
        "math/big"
        "sort"
        "strings"
        "time"
)

// DNSSEC encryption algorithm codes.
const (
        _ uint8 = iota
        RSAMD5
        DH
        DSA
        _ // Skip 4, RFC 6725, section 2.1
        RSASHA1
        DSANSEC3SHA1
        RSASHA1NSEC3SHA1
        RSASHA256
        _ // Skip 9, RFC 6725, section 2.1
        RSASHA512
        _ // Skip 11, RFC 6725, section 2.1
        ECCGOST
        ECDSAP256SHA256
        ECDSAP384SHA384
        ED25519
        ED448
        INDIRECT   uint8 = 252
        PRIVATEDNS uint8 = 253 // Private (experimental keys)
        PRIVATEOID uint8 = 254
)

// AlgorithmToString is a map of algorithm IDs to algorithm names.
var AlgorithmToString = map[uint8]string{
        RSAMD5:           "RSAMD5",
        DH:               "DH",
        DSA:              "DSA",
        RSASHA1:          "RSASHA1",
        DSANSEC3SHA1:     "DSA-NSEC3-SHA1",
        RSASHA1NSEC3SHA1: "RSASHA1-NSEC3-SHA1",
        RSASHA256:        "RSASHA256",
        RSASHA512:        "RSASHA512",
        ECCGOST:          "ECC-GOST",
        ECDSAP256SHA256:  "ECDSAP256SHA256",
        ECDSAP384SHA384:  "ECDSAP384SHA384",
        ED25519:          "ED25519",
        ED448:            "ED448",
        INDIRECT:         "INDIRECT",
        PRIVATEDNS:       "PRIVATEDNS",
        PRIVATEOID:       "PRIVATEOID",
}

// AlgorithmToHash is a map of algorithm crypto hash IDs to crypto.Hash's.
// For newer algorithm that do their own hashing (i.e. ED25519) the returned value
// is 0, implying no (external) hashing should occur. The non-exported identityHash is then
// used.
var AlgorithmToHash = map[uint8]crypto.Hash{
        RSAMD5:           crypto.MD5, // Deprecated in RFC 6725
        DSA:              crypto.SHA1,
        RSASHA1:          crypto.SHA1,
        RSASHA1NSEC3SHA1: crypto.SHA1,
        RSASHA256:        crypto.SHA256,
        ECDSAP256SHA256:  crypto.SHA256,
        ECDSAP384SHA384:  crypto.SHA384,
        RSASHA512:        crypto.SHA512,
        ED25519:          0,
}

// DNSSEC hashing algorithm codes.
const (
        _      uint8 = iota
        SHA1         // RFC 4034
        SHA256       // RFC 4509
        GOST94       // RFC 5933
        SHA384       // Experimental
        SHA512       // Experimental
)

// HashToString is a map of hash IDs to names.
var HashToString = map[uint8]string{
        SHA1:   "SHA1",
        SHA256: "SHA256",
        GOST94: "GOST94",
        SHA384: "SHA384",
        SHA512: "SHA512",
}

// DNSKEY flag values.
const (
        SEP    = 1
        REVOKE = 1 << 7
        ZONE   = 1 << 8
)

// The RRSIG needs to be converted to wireformat with some of the rdata (the signature) missing.
type rrsigWireFmt struct {
        TypeCovered uint16
        Algorithm   uint8
        Labels      uint8
        OrigTtl     uint32
        Expiration  uint32
        Inception   uint32
        KeyTag      uint16
        SignerName  string `dns:"domain-name"`
        /* No Signature */
}

// Used for converting DNSKEY's rdata to wirefmt.
type dnskeyWireFmt struct {
        Flags     uint16
        Protocol  uint8
        Algorithm uint8
        PublicKey string `dns:"base64"`
        /* Nothing is left out */
}

// KeyTag calculates the keytag (or key-id) of the DNSKEY.
func (k *DNSKEY) KeyTag() uint16 {
        if k == nil {
                return 0
        }
        var keytag int
        switch k.Algorithm {
        case RSAMD5:
                // This algorithm has been deprecated, but keep this key-tag calculation.
                // Look at the bottom two bytes of the modules, which the last item in the pubkey.
                // See https://www.rfc-editor.org/errata/eid193 .
                modulus, _ := fromBase64([]byte(k.PublicKey))
                if len(modulus) > 1 {
                        x := binary.BigEndian.Uint16(modulus[len(modulus)-3:])
                        keytag = int(x)
                }
        default:
                keywire := new(dnskeyWireFmt)
                keywire.Flags = k.Flags
                keywire.Protocol = k.Protocol
                keywire.Algorithm = k.Algorithm
                keywire.PublicKey = k.PublicKey
                wire := make([]byte, DefaultMsgSize)
                n, err := packKeyWire(keywire, wire)
                if err != nil {
                        return 0
                }
                wire = wire[:n]
                for i, v := range wire {
                        if i&1 != 0 {
                                keytag += int(v) // must be larger than uint32
                        } else {
                                keytag += int(v) << 8
                        }
                }
                keytag += keytag >> 16 & 0xFFFF
                keytag &= 0xFFFF
        }
        return uint16(keytag)
}

// ToDS converts a DNSKEY record to a DS record.
func (k *DNSKEY) ToDS(h uint8) *DS {
        if k == nil {
                return nil
        }
        ds := new(DS)
        ds.Hdr.Name = k.Hdr.Name
        ds.Hdr.Class = k.Hdr.Class
        ds.Hdr.Rrtype = TypeDS
        ds.Hdr.Ttl = k.Hdr.Ttl
        ds.Algorithm = k.Algorithm
        ds.DigestType = h
        ds.KeyTag = k.KeyTag()

        keywire := new(dnskeyWireFmt)
        keywire.Flags = k.Flags
        keywire.Protocol = k.Protocol
        keywire.Algorithm = k.Algorithm
        keywire.PublicKey = k.PublicKey
        wire := make([]byte, DefaultMsgSize)
        n, err := packKeyWire(keywire, wire)
        if err != nil {
                return nil
        }
        wire = wire[:n]

        owner := make([]byte, 255)
        off, err1 := PackDomainName(CanonicalName(k.Hdr.Name), owner, 0, nil, false)
        if err1 != nil {
                return nil
        }
        owner = owner[:off]
        // RFC4034:
        // digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);
        // "|" denotes concatenation
        // DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key.

        var hash crypto.Hash
        switch h {
        case SHA1:
                hash = crypto.SHA1
        case SHA256:
                hash = crypto.SHA256
        case SHA384:
                hash = crypto.SHA384
        case SHA512:
                hash = crypto.SHA512
        default:
                return nil
        }

        s := hash.New()
        s.Write(owner)
        s.Write(wire)
        ds.Digest = hex.EncodeToString(s.Sum(nil))
        return ds
}

// ToCDNSKEY converts a DNSKEY record to a CDNSKEY record.
func (k *DNSKEY) ToCDNSKEY() *CDNSKEY {
        c := &CDNSKEY{DNSKEY: *k}
        c.Hdr = k.Hdr
        c.Hdr.Rrtype = TypeCDNSKEY
        return c
}

// ToCDS converts a DS record to a CDS record.
func (d *DS) ToCDS() *CDS {
        c := &CDS{DS: *d}
        c.Hdr = d.Hdr
        c.Hdr.Rrtype = TypeCDS
        return c
}

// Sign signs an RRSet. The signature needs to be filled in with the values:
// Inception, Expiration, KeyTag, SignerName and Algorithm.  The rest is copied
// from the RRset. Sign returns a non-nill error when the signing went OK.
// There is no check if RRSet is a proper (RFC 2181) RRSet.  If OrigTTL is non
// zero, it is used as-is, otherwise the TTL of the RRset is used as the
// OrigTTL.
func (rr *RRSIG) Sign(k crypto.Signer, rrset []RR) error {
        if k == nil {
                return ErrPrivKey
        }
        // s.Inception and s.Expiration may be 0 (rollover etc.), the rest must be set
        if rr.KeyTag == 0 || len(rr.SignerName) == 0 || rr.Algorithm == 0 {
                return ErrKey
        }

        h0 := rrset[0].Header()
        rr.Hdr.Rrtype = TypeRRSIG
        rr.Hdr.Name = h0.Name
        rr.Hdr.Class = h0.Class
        if rr.OrigTtl == 0 { // If set don't override
                rr.OrigTtl = h0.Ttl
        }
        rr.TypeCovered = h0.Rrtype
        rr.Labels = uint8(CountLabel(h0.Name))

        if strings.HasPrefix(h0.Name, "*") {
                rr.Labels-- // wildcard, remove from label count
        }

        sigwire := new(rrsigWireFmt)
        sigwire.TypeCovered = rr.TypeCovered
        sigwire.Algorithm = rr.Algorithm
        sigwire.Labels = rr.Labels
        sigwire.OrigTtl = rr.OrigTtl
        sigwire.Expiration = rr.Expiration
        sigwire.Inception = rr.Inception
        sigwire.KeyTag = rr.KeyTag
        // For signing, lowercase this name
        sigwire.SignerName = CanonicalName(rr.SignerName)

        // Create the desired binary blob
        signdata := make([]byte, DefaultMsgSize)
        n, err := packSigWire(sigwire, signdata)
        if err != nil {
                return err
        }
        signdata = signdata[:n]
        wire, err := rawSignatureData(rrset, rr)
        if err != nil {
                return err
        }

        h, cryptohash, err := hashFromAlgorithm(rr.Algorithm)
        if err != nil {
                return err
        }

        switch rr.Algorithm {
        case RSAMD5, DSA, DSANSEC3SHA1:
                // See RFC 6944.
                return ErrAlg
        default:
                h.Write(signdata)
                h.Write(wire)

                signature, err := sign(k, h.Sum(nil), cryptohash, rr.Algorithm)
                if err != nil {
                        return err
                }

                rr.Signature = toBase64(signature)
                return nil
        }
}

func sign(k crypto.Signer, hashed []byte, hash crypto.Hash, alg uint8) ([]byte, error) {
        signature, err := k.Sign(rand.Reader, hashed, hash)
        if err != nil {
                return nil, err
        }

        switch alg {
        case RSASHA1, RSASHA1NSEC3SHA1, RSASHA256, RSASHA512, ED25519:
                return signature, nil
        case ECDSAP256SHA256, ECDSAP384SHA384:
                ecdsaSignature := &struct {
                        R, S *big.Int
                }{}
                if _, err := asn1.Unmarshal(signature, ecdsaSignature); err != nil {
                        return nil, err
                }

                var intlen int
                switch alg {
                case ECDSAP256SHA256:
                        intlen = 32
                case ECDSAP384SHA384:
                        intlen = 48
                }

                signature := intToBytes(ecdsaSignature.R, intlen)
                signature = append(signature, intToBytes(ecdsaSignature.S, intlen)...)
                return signature, nil
        default:
                return nil, ErrAlg
        }
}

// Verify validates an RRSet with the signature and key. This is only the
// cryptographic test, the signature validity period must be checked separately.
// This function copies the rdata of some RRs (to lowercase domain names) for the validation to work.
// It also checks that the Zone Key bit (RFC 4034 2.1.1) is set on the DNSKEY
// and that the Protocol field is set to 3 (RFC 4034 2.1.2).
func (rr *RRSIG) Verify(k *DNSKEY, rrset []RR) error {
        // First the easy checks
        if !IsRRset(rrset) {
                return ErrRRset
        }
        if rr.KeyTag != k.KeyTag() {
                return ErrKey
        }
        if rr.Hdr.Class != k.Hdr.Class {
                return ErrKey
        }
        if rr.Algorithm != k.Algorithm {
                return ErrKey
        }
        if !strings.EqualFold(rr.SignerName, k.Hdr.Name) {
                return ErrKey
        }
        if k.Protocol != 3 {
                return ErrKey
        }
        // RFC 4034 2.1.1 If bit 7 has value 0, then the DNSKEY record holds some
        // other type of DNS public key and MUST NOT be used to verify RRSIGs that
        // cover RRsets.
        if k.Flags&ZONE == 0 {
                return ErrKey
        }

        // IsRRset checked that we have at least one RR and that the RRs in
        // the set have consistent type, class, and name. Also check that type and
        // class matches the RRSIG record.
        if h0 := rrset[0].Header(); h0.Class != rr.Hdr.Class || h0.Rrtype != rr.TypeCovered {
                return ErrRRset
        }

        // RFC 4035 5.3.2.  Reconstructing the Signed Data
        // Copy the sig, except the rrsig data
        sigwire := new(rrsigWireFmt)
        sigwire.TypeCovered = rr.TypeCovered
        sigwire.Algorithm = rr.Algorithm
        sigwire.Labels = rr.Labels
        sigwire.OrigTtl = rr.OrigTtl
        sigwire.Expiration = rr.Expiration
        sigwire.Inception = rr.Inception
        sigwire.KeyTag = rr.KeyTag
        sigwire.SignerName = CanonicalName(rr.SignerName)
        // Create the desired binary blob
        signeddata := make([]byte, DefaultMsgSize)
        n, err := packSigWire(sigwire, signeddata)
        if err != nil {
                return err
        }
        signeddata = signeddata[:n]
        wire, err := rawSignatureData(rrset, rr)
        if err != nil {
                return err
        }

        sigbuf := rr.sigBuf() // Get the binary signature data
        // TODO(miek)
        // remove the domain name and assume its ours?
        // if rr.Algorithm == PRIVATEDNS { // PRIVATEOID
        // }

        h, cryptohash, err := hashFromAlgorithm(rr.Algorithm)
        if err != nil {
                return err
        }

        switch rr.Algorithm {
        case RSASHA1, RSASHA1NSEC3SHA1, RSASHA256, RSASHA512:
                // TODO(mg): this can be done quicker, ie. cache the pubkey data somewhere??
                pubkey := k.publicKeyRSA() // Get the key
                if pubkey == nil {
                        return ErrKey
                }

                h.Write(signeddata)
                h.Write(wire)
                return rsa.VerifyPKCS1v15(pubkey, cryptohash, h.Sum(nil), sigbuf)

        case ECDSAP256SHA256, ECDSAP384SHA384:
                pubkey := k.publicKeyECDSA()
                if pubkey == nil {
                        return ErrKey
                }

                // Split sigbuf into the r and s coordinates
                r := new(big.Int).SetBytes(sigbuf[:len(sigbuf)/2])
                s := new(big.Int).SetBytes(sigbuf[len(sigbuf)/2:])

                h.Write(signeddata)
                h.Write(wire)
                if ecdsa.Verify(pubkey, h.Sum(nil), r, s) {
                        return nil
                }
                return ErrSig

        case ED25519:
                pubkey := k.publicKeyED25519()
                if pubkey == nil {
                        return ErrKey
                }

                if ed25519.Verify(pubkey, append(signeddata, wire...), sigbuf) {
                        return nil
                }
                return ErrSig

        default:
                return ErrAlg
        }
}

// ValidityPeriod uses RFC1982 serial arithmetic to calculate
// if a signature period is valid. If t is the zero time, the
// current time is taken other t is. Returns true if the signature
// is valid at the given time, otherwise returns false.
func (rr *RRSIG) ValidityPeriod(t time.Time) bool {
        var utc int64
        if t.IsZero() {
                utc = time.Now().UTC().Unix()
        } else {
                utc = t.UTC().Unix()
        }
        modi := (int64(rr.Inception) - utc) / year68
        mode := (int64(rr.Expiration) - utc) / year68
        ti := int64(rr.Inception) + modi*year68
        te := int64(rr.Expiration) + mode*year68
        return ti <= utc && utc <= te
}

// Return the signatures base64 encoding sigdata as a byte slice.
func (rr *RRSIG) sigBuf() []byte {
        sigbuf, err := fromBase64([]byte(rr.Signature))
        if err != nil {
                return nil
        }
        return sigbuf
}

// publicKeyRSA returns the RSA public key from a DNSKEY record.
func (k *DNSKEY) publicKeyRSA() *rsa.PublicKey {
        keybuf, err := fromBase64([]byte(k.PublicKey))
        if err != nil {
                return nil
        }

        if len(keybuf) < 1+1+64 {
                // Exponent must be at least 1 byte and modulus at least 64
                return nil
        }

        // RFC 2537/3110, section 2. RSA Public KEY Resource Records
        // Length is in the 0th byte, unless its zero, then it
        // it in bytes 1 and 2 and its a 16 bit number
        explen := uint16(keybuf[0])
        keyoff := 1
        if explen == 0 {
                explen = uint16(keybuf[1])<<8 | uint16(keybuf[2])
                keyoff = 3
        }

        if explen > 4 || explen == 0 || keybuf[keyoff] == 0 {
                // Exponent larger than supported by the crypto package,
                // empty, or contains prohibited leading zero.
                return nil
        }

        modoff := keyoff + int(explen)
        modlen := len(keybuf) - modoff
        if modlen < 64 || modlen > 512 || keybuf[modoff] == 0 {
                // Modulus is too small, large, or contains prohibited leading zero.
                return nil
        }

        pubkey := new(rsa.PublicKey)

        var expo uint64
        // The exponent of length explen is between keyoff and modoff.
        for _, v := range keybuf[keyoff:modoff] {
                expo <<= 8
                expo |= uint64(v)
        }
        if expo > 1<<31-1 {
                // Larger exponent than supported by the crypto package.
                return nil
        }

        pubkey.E = int(expo)
        pubkey.N = new(big.Int).SetBytes(keybuf[modoff:])
        return pubkey
}

// publicKeyECDSA returns the Curve public key from the DNSKEY record.
func (k *DNSKEY) publicKeyECDSA() *ecdsa.PublicKey {
        keybuf, err := fromBase64([]byte(k.PublicKey))
        if err != nil {
                return nil
        }
        pubkey := new(ecdsa.PublicKey)
        switch k.Algorithm {
        case ECDSAP256SHA256:
                pubkey.Curve = elliptic.P256()
                if len(keybuf) != 64 {
                        // wrongly encoded key
                        return nil
                }
        case ECDSAP384SHA384:
                pubkey.Curve = elliptic.P384()
                if len(keybuf) != 96 {
                        // Wrongly encoded key
                        return nil
                }
        }
        pubkey.X = new(big.Int).SetBytes(keybuf[:len(keybuf)/2])
        pubkey.Y = new(big.Int).SetBytes(keybuf[len(keybuf)/2:])
        return pubkey
}

func (k *DNSKEY) publicKeyED25519() ed25519.PublicKey {
        keybuf, err := fromBase64([]byte(k.PublicKey))
        if err != nil {
                return nil
        }
        if len(keybuf) != ed25519.PublicKeySize {
                return nil
        }
        return keybuf
}

type wireSlice [][]byte

func (p wireSlice) Len() int      { return len(p) }
func (p wireSlice) Swap(i, j int) { p[i], p[j] = p[j], p[i] }
func (p wireSlice) Less(i, j int) bool {
        _, ioff, _ := UnpackDomainName(p[i], 0)
        _, joff, _ := UnpackDomainName(p[j], 0)
        return bytes.Compare(p[i][ioff+10:], p[j][joff+10:]) < 0
}

// Return the raw signature data.
func rawSignatureData(rrset []RR, s *RRSIG) (buf []byte, err error) {
        wires := make(wireSlice, len(rrset))
        for i, r := range rrset {
                r1 := r.copy()
                h := r1.Header()
                h.Ttl = s.OrigTtl
                labels := SplitDomainName(h.Name)
                // 6.2. Canonical RR Form. (4) - wildcards
                if len(labels) > int(s.Labels) {
                        // Wildcard
                        h.Name = "*." + strings.Join(labels[len(labels)-int(s.Labels):], ".") + "."
                }
                // RFC 4034: 6.2.  Canonical RR Form. (2) - domain name to lowercase
                h.Name = CanonicalName(h.Name)
                // 6.2. Canonical RR Form. (3) - domain rdata to lowercase.
                //   NS, MD, MF, CNAME, SOA, MB, MG, MR, PTR,
                //   HINFO, MINFO, MX, RP, AFSDB, RT, SIG, PX, NXT, NAPTR, KX,
                //   SRV, DNAME, A6
                //
                // RFC 6840 - Clarifications and Implementation Notes for DNS Security (DNSSEC):
                //        Section 6.2 of [RFC4034] also erroneously lists HINFO as a record
                //        that needs conversion to lowercase, and twice at that.  Since HINFO
                //        records contain no domain names, they are not subject to case
                //        conversion.
                switch x := r1.(type) {
                case *NS:
                        x.Ns = CanonicalName(x.Ns)
                case *MD:
                        x.Md = CanonicalName(x.Md)
                case *MF:
                        x.Mf = CanonicalName(x.Mf)
                case *CNAME:
                        x.Target = CanonicalName(x.Target)
                case *SOA:
                        x.Ns = CanonicalName(x.Ns)
                        x.Mbox = CanonicalName(x.Mbox)
                case *MB:
                        x.Mb = CanonicalName(x.Mb)
                case *MG:
                        x.Mg = CanonicalName(x.Mg)
                case *MR:
                        x.Mr = CanonicalName(x.Mr)
                case *PTR:
                        x.Ptr = CanonicalName(x.Ptr)
                case *MINFO:
                        x.Rmail = CanonicalName(x.Rmail)
                        x.Email = CanonicalName(x.Email)
                case *MX:
                        x.Mx = CanonicalName(x.Mx)
                case *RP:
                        x.Mbox = CanonicalName(x.Mbox)
                        x.Txt = CanonicalName(x.Txt)
                case *AFSDB:
                        x.Hostname = CanonicalName(x.Hostname)
                case *RT:
                        x.Host = CanonicalName(x.Host)
                case *SIG:
                        x.SignerName = CanonicalName(x.SignerName)
                case *PX:
                        x.Map822 = CanonicalName(x.Map822)
                        x.Mapx400 = CanonicalName(x.Mapx400)
                case *NAPTR:
                        x.Replacement = CanonicalName(x.Replacement)
                case *KX:
                        x.Exchanger = CanonicalName(x.Exchanger)
                case *SRV:
                        x.Target = CanonicalName(x.Target)
                case *DNAME:
                        x.Target = CanonicalName(x.Target)
                }
                // 6.2. Canonical RR Form. (5) - origTTL
                wire := make([]byte, Len(r1)+1) // +1 to be safe(r)
                off, err1 := PackRR(r1, wire, 0, nil, false)
                if err1 != nil {
                        return nil, err1
                }
                wire = wire[:off]
                wires[i] = wire
        }
        sort.Sort(wires)
        for i, wire := range wires {
                if i > 0 && bytes.Equal(wire, wires[i-1]) {
                        continue
                }
                buf = append(buf, wire...)
        }
        return buf, nil
}

func packSigWire(sw *rrsigWireFmt, msg []byte) (int, error) {
        // copied from zmsg.go RRSIG packing
        off, err := packUint16(sw.TypeCovered, msg, 0)
        if err != nil {
                return off, err
        }
        off, err = packUint8(sw.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(sw.Labels, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(sw.OrigTtl, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(sw.Expiration, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(sw.Inception, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(sw.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = PackDomainName(sw.SignerName, msg, off, nil, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func packKeyWire(dw *dnskeyWireFmt, msg []byte) (int, error) {
        // copied from zmsg.go DNSKEY packing
        off, err := packUint16(dw.Flags, msg, 0)
        if err != nil {
                return off, err
        }
        off, err = packUint8(dw.Protocol, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(dw.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(dw.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

package dns

import (
        "crypto"
        "crypto/ecdsa"
        "crypto/ed25519"
        "crypto/elliptic"
        "crypto/rand"
        "crypto/rsa"
        "math/big"
)

// Generate generates a DNSKEY of the given bit size.
// The public part is put inside the DNSKEY record.
// The Algorithm in the key must be set as this will define
// what kind of DNSKEY will be generated.
// The ECDSA algorithms imply a fixed keysize, in that case
// bits should be set to the size of the algorithm.
func (k *DNSKEY) Generate(bits int) (crypto.PrivateKey, error) {
        switch k.Algorithm {
        case RSASHA1, RSASHA256, RSASHA1NSEC3SHA1:
                if bits < 512 || bits > 4096 {
                        return nil, ErrKeySize
                }
        case RSASHA512:
                if bits < 1024 || bits > 4096 {
                        return nil, ErrKeySize
                }
        case ECDSAP256SHA256:
                if bits != 256 {
                        return nil, ErrKeySize
                }
        case ECDSAP384SHA384:
                if bits != 384 {
                        return nil, ErrKeySize
                }
        case ED25519:
                if bits != 256 {
                        return nil, ErrKeySize
                }
        default:
                return nil, ErrAlg
        }

        switch k.Algorithm {
        case RSASHA1, RSASHA256, RSASHA512, RSASHA1NSEC3SHA1:
                priv, err := rsa.GenerateKey(rand.Reader, bits)
                if err != nil {
                        return nil, err
                }
                k.setPublicKeyRSA(priv.PublicKey.E, priv.PublicKey.N)
                return priv, nil
        case ECDSAP256SHA256, ECDSAP384SHA384:
                var c elliptic.Curve
                switch k.Algorithm {
                case ECDSAP256SHA256:
                        c = elliptic.P256()
                case ECDSAP384SHA384:
                        c = elliptic.P384()
                }
                priv, err := ecdsa.GenerateKey(c, rand.Reader)
                if err != nil {
                        return nil, err
                }
                k.setPublicKeyECDSA(priv.PublicKey.X, priv.PublicKey.Y)
                return priv, nil
        case ED25519:
                pub, priv, err := ed25519.GenerateKey(rand.Reader)
                if err != nil {
                        return nil, err
                }
                k.setPublicKeyED25519(pub)
                return priv, nil
        default:
                return nil, ErrAlg
        }
}

// Set the public key (the value E and N)
func (k *DNSKEY) setPublicKeyRSA(_E int, _N *big.Int) bool {
        if _E == 0 || _N == nil {
                return false
        }
        buf := exponentToBuf(_E)
        buf = append(buf, _N.Bytes()...)
        k.PublicKey = toBase64(buf)
        return true
}

// Set the public key for Elliptic Curves
func (k *DNSKEY) setPublicKeyECDSA(_X, _Y *big.Int) bool {
        if _X == nil || _Y == nil {
                return false
        }
        var intlen int
        switch k.Algorithm {
        case ECDSAP256SHA256:
                intlen = 32
        case ECDSAP384SHA384:
                intlen = 48
        }
        k.PublicKey = toBase64(curveToBuf(_X, _Y, intlen))
        return true
}

// Set the public key for Ed25519
func (k *DNSKEY) setPublicKeyED25519(_K ed25519.PublicKey) bool {
        if _K == nil {
                return false
        }
        k.PublicKey = toBase64(_K)
        return true
}

// Set the public key (the values E and N) for RSA
// RFC 3110: Section 2. RSA Public KEY Resource Records
func exponentToBuf(_E int) []byte {
        var buf []byte
        i := big.NewInt(int64(_E)).Bytes()
        if len(i) < 256 {
                buf = make([]byte, 1, 1+len(i))
                buf[0] = uint8(len(i))
        } else {
                buf = make([]byte, 3, 3+len(i))
                buf[0] = 0
                buf[1] = uint8(len(i) >> 8)
                buf[2] = uint8(len(i))
        }
        buf = append(buf, i...)
        return buf
}

// Set the public key for X and Y for Curve. The two
// values are just concatenated.
func curveToBuf(_X, _Y *big.Int, intlen int) []byte {
        buf := intToBytes(_X, intlen)
        buf = append(buf, intToBytes(_Y, intlen)...)
        return buf
}

package dns

import (
        "bufio"
        "crypto"
        "crypto/ecdsa"
        "crypto/ed25519"
        "crypto/rsa"
        "io"
        "math/big"
        "strconv"
        "strings"
)

// NewPrivateKey returns a PrivateKey by parsing the string s.
// s should be in the same form of the BIND private key files.
func (k *DNSKEY) NewPrivateKey(s string) (crypto.PrivateKey, error) {
        if s == "" || s[len(s)-1] != '\n' { // We need a closing newline
                return k.ReadPrivateKey(strings.NewReader(s+"\n"), "")
        }
        return k.ReadPrivateKey(strings.NewReader(s), "")
}

// ReadPrivateKey reads a private key from the io.Reader q. The string file is
// only used in error reporting.
// The public key must be known, because some cryptographic algorithms embed
// the public inside the privatekey.
func (k *DNSKEY) ReadPrivateKey(q io.Reader, file string) (crypto.PrivateKey, error) {
        m, err := parseKey(q, file)
        if m == nil {
                return nil, err
        }
        if _, ok := m["private-key-format"]; !ok {
                return nil, ErrPrivKey
        }
        if m["private-key-format"] != "v1.2" && m["private-key-format"] != "v1.3" {
                return nil, ErrPrivKey
        }
        // TODO(mg): check if the pubkey matches the private key
        algoStr, _, _ := strings.Cut(m["algorithm"], " ")
        algo, err := strconv.ParseUint(algoStr, 10, 8)
        if err != nil {
                return nil, ErrPrivKey
        }
        switch uint8(algo) {
        case RSASHA1, RSASHA1NSEC3SHA1, RSASHA256, RSASHA512:
                priv, err := readPrivateKeyRSA(m)
                if err != nil {
                        return nil, err
                }
                pub := k.publicKeyRSA()
                if pub == nil {
                        return nil, ErrKey
                }
                priv.PublicKey = *pub
                return priv, nil
        case ECDSAP256SHA256, ECDSAP384SHA384:
                priv, err := readPrivateKeyECDSA(m)
                if err != nil {
                        return nil, err
                }
                pub := k.publicKeyECDSA()
                if pub == nil {
                        return nil, ErrKey
                }
                priv.PublicKey = *pub
                return priv, nil
        case ED25519:
                return readPrivateKeyED25519(m)
        default:
                return nil, ErrAlg
        }
}

// Read a private key (file) string and create a public key. Return the private key.
func readPrivateKeyRSA(m map[string]string) (*rsa.PrivateKey, error) {
        p := new(rsa.PrivateKey)
        p.Primes = []*big.Int{nil, nil}
        for k, v := range m {
                switch k {
                case "modulus", "publicexponent", "privateexponent", "prime1", "prime2":
                        v1, err := fromBase64([]byte(v))
                        if err != nil {
                                return nil, err
                        }
                        switch k {
                        case "modulus":
                                p.PublicKey.N = new(big.Int).SetBytes(v1)
                        case "publicexponent":
                                i := new(big.Int).SetBytes(v1)
                                p.PublicKey.E = int(i.Int64()) // int64 should be large enough
                        case "privateexponent":
                                p.D = new(big.Int).SetBytes(v1)
                        case "prime1":
                                p.Primes[0] = new(big.Int).SetBytes(v1)
                        case "prime2":
                                p.Primes[1] = new(big.Int).SetBytes(v1)
                        }
                case "exponent1", "exponent2", "coefficient":
                        // not used in Go (yet)
                case "created", "publish", "activate":
                        // not used in Go (yet)
                }
        }
        return p, nil
}

func readPrivateKeyECDSA(m map[string]string) (*ecdsa.PrivateKey, error) {
        p := new(ecdsa.PrivateKey)
        p.D = new(big.Int)
        // TODO: validate that the required flags are present
        for k, v := range m {
                switch k {
                case "privatekey":
                        v1, err := fromBase64([]byte(v))
                        if err != nil {
                                return nil, err
                        }
                        p.D.SetBytes(v1)
                case "created", "publish", "activate":
                        /* not used in Go (yet) */
                }
        }
        return p, nil
}

func readPrivateKeyED25519(m map[string]string) (ed25519.PrivateKey, error) {
        var p ed25519.PrivateKey
        // TODO: validate that the required flags are present
        for k, v := range m {
                switch k {
                case "privatekey":
                        p1, err := fromBase64([]byte(v))
                        if err != nil {
                                return nil, err
                        }
                        if len(p1) != ed25519.SeedSize {
                                return nil, ErrPrivKey
                        }
                        p = ed25519.NewKeyFromSeed(p1)
                case "created", "publish", "activate":
                        /* not used in Go (yet) */
                }
        }
        return p, nil
}

// parseKey reads a private key from r. It returns a map[string]string,
// with the key-value pairs, or an error when the file is not correct.
func parseKey(r io.Reader, file string) (map[string]string, error) {
        m := make(map[string]string)
        var k string

        c := newKLexer(r)

        for l, ok := c.Next(); ok; l, ok = c.Next() {
                // It should alternate
                switch l.value {
                case zKey:
                        k = l.token
                case zValue:
                        if k == "" {
                                return nil, &ParseError{file: file, err: "no private key seen", lex: l}
                        }

                        m[strings.ToLower(k)] = l.token
                        k = ""
                }
        }

        // Surface any read errors from r.
        if err := c.Err(); err != nil {
                return nil, &ParseError{file: file, err: err.Error()}
        }

        return m, nil
}

type klexer struct {
        br io.ByteReader

        readErr error

        line   int
        column int

        key bool

        eol bool // end-of-line
}

func newKLexer(r io.Reader) *klexer {
        br, ok := r.(io.ByteReader)
        if !ok {
                br = bufio.NewReaderSize(r, 1024)
        }

        return &klexer{
                br: br,

                line: 1,

                key: true,
        }
}

func (kl *klexer) Err() error {
        if kl.readErr == io.EOF {
                return nil
        }

        return kl.readErr
}

// readByte returns the next byte from the input
func (kl *klexer) readByte() (byte, bool) {
        if kl.readErr != nil {
                return 0, false
        }

        c, err := kl.br.ReadByte()
        if err != nil {
                kl.readErr = err
                return 0, false
        }

        // delay the newline handling until the next token is delivered,
        // fixes off-by-one errors when reporting a parse error.
        if kl.eol {
                kl.line++
                kl.column = 0
                kl.eol = false
        }

        if c == '\n' {
                kl.eol = true
        } else {
                kl.column++
        }

        return c, true
}

func (kl *klexer) Next() (lex, bool) {
        var (
                l lex

                str strings.Builder

                commt bool
        )

        for x, ok := kl.readByte(); ok; x, ok = kl.readByte() {
                l.line, l.column = kl.line, kl.column

                switch x {
                case ':':
                        if commt || !kl.key {
                                break
                        }

                        kl.key = false

                        // Next token is a space, eat it
                        kl.readByte()

                        l.value = zKey
                        l.token = str.String()
                        return l, true
                case ';':
                        commt = true
                case '\n':
                        if commt {
                                // Reset a comment
                                commt = false
                        }

                        if kl.key && str.Len() == 0 {
                                // ignore empty lines
                                break
                        }

                        kl.key = true

                        l.value = zValue
                        l.token = str.String()
                        return l, true
                default:
                        if commt {
                                break
                        }

                        str.WriteByte(x)
                }
        }

        if kl.readErr != nil && kl.readErr != io.EOF {
                // Don't return any tokens after a read error occurs.
                return lex{value: zEOF}, false
        }

        if str.Len() > 0 {
                // Send remainder
                l.value = zValue
                l.token = str.String()
                return l, true
        }

        return lex{value: zEOF}, false
}

package dns

import (
        "crypto"
        "crypto/ecdsa"
        "crypto/ed25519"
        "crypto/rsa"
        "math/big"
        "strconv"
)

const format = "Private-key-format: v1.3\n"

var bigIntOne = big.NewInt(1)

// PrivateKeyString converts a PrivateKey to a string. This string has the same
// format as the private-key-file of BIND9 (Private-key-format: v1.3).
// It needs some info from the key (the algorithm), so its a method of the DNSKEY.
// It supports *rsa.PrivateKey, *ecdsa.PrivateKey and ed25519.PrivateKey.
func (r *DNSKEY) PrivateKeyString(p crypto.PrivateKey) string {
        algorithm := strconv.Itoa(int(r.Algorithm))
        algorithm += " (" + AlgorithmToString[r.Algorithm] + ")"

        switch p := p.(type) {
        case *rsa.PrivateKey:
                modulus := toBase64(p.PublicKey.N.Bytes())
                e := big.NewInt(int64(p.PublicKey.E))
                publicExponent := toBase64(e.Bytes())
                privateExponent := toBase64(p.D.Bytes())
                prime1 := toBase64(p.Primes[0].Bytes())
                prime2 := toBase64(p.Primes[1].Bytes())
                // Calculate Exponent1/2 and Coefficient as per: http://en.wikipedia.org/wiki/RSA#Using_the_Chinese_remainder_algorithm
                // and from: http://code.google.com/p/go/issues/detail?id=987
                p1 := new(big.Int).Sub(p.Primes[0], bigIntOne)
                q1 := new(big.Int).Sub(p.Primes[1], bigIntOne)
                exp1 := new(big.Int).Mod(p.D, p1)
                exp2 := new(big.Int).Mod(p.D, q1)
                coeff := new(big.Int).ModInverse(p.Primes[1], p.Primes[0])

                exponent1 := toBase64(exp1.Bytes())
                exponent2 := toBase64(exp2.Bytes())
                coefficient := toBase64(coeff.Bytes())

                return format +
                        "Algorithm: " + algorithm + "\n" +
                        "Modulus: " + modulus + "\n" +
                        "PublicExponent: " + publicExponent + "\n" +
                        "PrivateExponent: " + privateExponent + "\n" +
                        "Prime1: " + prime1 + "\n" +
                        "Prime2: " + prime2 + "\n" +
                        "Exponent1: " + exponent1 + "\n" +
                        "Exponent2: " + exponent2 + "\n" +
                        "Coefficient: " + coefficient + "\n"

        case *ecdsa.PrivateKey:
                var intlen int
                switch r.Algorithm {
                case ECDSAP256SHA256:
                        intlen = 32
                case ECDSAP384SHA384:
                        intlen = 48
                }
                private := toBase64(intToBytes(p.D, intlen))
                return format +
                        "Algorithm: " + algorithm + "\n" +
                        "PrivateKey: " + private + "\n"

        case ed25519.PrivateKey:
                private := toBase64(p.Seed())
                return format +
                        "Algorithm: " + algorithm + "\n" +
                        "PrivateKey: " + private + "\n"

        default:
                return ""
        }
}

package dns

//go:generate go run duplicate_generate.go

// IsDuplicate checks of r1 and r2 are duplicates of each other, excluding the TTL.
// So this means the header data is equal *and* the RDATA is the same. Returns true
// if so, otherwise false. It's a protocol violation to have identical RRs in a message.
func IsDuplicate(r1, r2 RR) bool {
        // Check whether the record header is identical.
        if !r1.Header().isDuplicate(r2.Header()) {
                return false
        }

        // Check whether the RDATA is identical.
        return r1.isDuplicate(r2)
}

func (r1 *RR_Header) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*RR_Header)
        if !ok {
                return false
        }
        if r1.Class != r2.Class {
                return false
        }
        if r1.Rrtype != r2.Rrtype {
                return false
        }
        if !isDuplicateName(r1.Name, r2.Name) {
                return false
        }
        // ignore TTL
        return true
}

// isDuplicateName checks if the domain names s1 and s2 are equal.
func isDuplicateName(s1, s2 string) bool { return equal(s1, s2) }

package dns

import (
        "encoding/binary"
        "encoding/hex"
        "errors"
        "fmt"
        "net"
        "strconv"
)

// EDNS0 Option codes.
const (
        EDNS0LLQ          = 0x1     // long lived queries: http://tools.ietf.org/html/draft-sekar-dns-llq-01
        EDNS0UL           = 0x2     // update lease draft: http://files.dns-sd.org/draft-sekar-dns-ul.txt
        EDNS0NSID         = 0x3     // nsid (See RFC 5001)
        EDNS0ESU          = 0x4     // ENUM Source-URI draft: https://datatracker.ietf.org/doc/html/draft-kaplan-enum-source-uri-00
        EDNS0DAU          = 0x5     // DNSSEC Algorithm Understood
        EDNS0DHU          = 0x6     // DS Hash Understood
        EDNS0N3U          = 0x7     // NSEC3 Hash Understood
        EDNS0SUBNET       = 0x8     // client-subnet (See RFC 7871)
        EDNS0EXPIRE       = 0x9     // EDNS0 expire
        EDNS0COOKIE       = 0xa     // EDNS0 Cookie
        EDNS0TCPKEEPALIVE = 0xb     // EDNS0 tcp keep alive (See RFC 7828)
        EDNS0PADDING      = 0xc     // EDNS0 padding (See RFC 7830)
        EDNS0EDE          = 0xf     // EDNS0 extended DNS errors (See RFC 8914)
        EDNS0LOCALSTART   = 0xFDE9  // Beginning of range reserved for local/experimental use (See RFC 6891)
        EDNS0LOCALEND     = 0xFFFE  // End of range reserved for local/experimental use (See RFC 6891)
        _DO               = 1 << 15 // DNSSEC OK
)

// makeDataOpt is used to unpack the EDNS0 option(s) from a message.
func makeDataOpt(code uint16) EDNS0 {
        // All the EDNS0.* constants above need to be in this switch.
        switch code {
        case EDNS0LLQ:
                return new(EDNS0_LLQ)
        case EDNS0UL:
                return new(EDNS0_UL)
        case EDNS0NSID:
                return new(EDNS0_NSID)
        case EDNS0DAU:
                return new(EDNS0_DAU)
        case EDNS0DHU:
                return new(EDNS0_DHU)
        case EDNS0N3U:
                return new(EDNS0_N3U)
        case EDNS0SUBNET:
                return new(EDNS0_SUBNET)
        case EDNS0EXPIRE:
                return new(EDNS0_EXPIRE)
        case EDNS0COOKIE:
                return new(EDNS0_COOKIE)
        case EDNS0TCPKEEPALIVE:
                return new(EDNS0_TCP_KEEPALIVE)
        case EDNS0PADDING:
                return new(EDNS0_PADDING)
        case EDNS0EDE:
                return new(EDNS0_EDE)
        case EDNS0ESU:
                return new(EDNS0_ESU)
        default:
                e := new(EDNS0_LOCAL)
                e.Code = code
                return e
        }
}

// OPT is the EDNS0 RR appended to messages to convey extra (meta) information. See RFC 6891.
type OPT struct {
        Hdr    RR_Header
        Option []EDNS0 `dns:"opt"`
}

func (rr *OPT) String() string {
        s := "\n;; OPT PSEUDOSECTION:\n; EDNS: version " + strconv.Itoa(int(rr.Version())) + "; "
        if rr.Do() {
                s += "flags: do; "
        } else {
                s += "flags:; "
        }
        if rr.Hdr.Ttl&0x7FFF != 0 {
                s += fmt.Sprintf("MBZ: 0x%04x, ", rr.Hdr.Ttl&0x7FFF)
        }
        s += "udp: " + strconv.Itoa(int(rr.UDPSize()))

        for _, o := range rr.Option {
                switch o.(type) {
                case *EDNS0_NSID:
                        s += "\n; NSID: " + o.String()
                        h, e := o.pack()
                        var r string
                        if e == nil {
                                for _, c := range h {
                                        r += "(" + string(c) + ")"
                                }
                                s += "  " + r
                        }
                case *EDNS0_SUBNET:
                        s += "\n; SUBNET: " + o.String()
                case *EDNS0_COOKIE:
                        s += "\n; COOKIE: " + o.String()
                case *EDNS0_EXPIRE:
                        s += "\n; EXPIRE: " + o.String()
                case *EDNS0_TCP_KEEPALIVE:
                        s += "\n; KEEPALIVE: " + o.String()
                case *EDNS0_UL:
                        s += "\n; UPDATE LEASE: " + o.String()
                case *EDNS0_LLQ:
                        s += "\n; LONG LIVED QUERIES: " + o.String()
                case *EDNS0_DAU:
                        s += "\n; DNSSEC ALGORITHM UNDERSTOOD: " + o.String()
                case *EDNS0_DHU:
                        s += "\n; DS HASH UNDERSTOOD: " + o.String()
                case *EDNS0_N3U:
                        s += "\n; NSEC3 HASH UNDERSTOOD: " + o.String()
                case *EDNS0_LOCAL:
                        s += "\n; LOCAL OPT: " + o.String()
                case *EDNS0_PADDING:
                        s += "\n; PADDING: " + o.String()
                case *EDNS0_EDE:
                        s += "\n; EDE: " + o.String()
                case *EDNS0_ESU:
                        s += "\n; ESU: " + o.String()
                }
        }
        return s
}

func (rr *OPT) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        for _, o := range rr.Option {
                l += 4 // Account for 2-byte option code and 2-byte option length.
                lo, _ := o.pack()
                l += len(lo)
        }
        return l
}

func (*OPT) parse(c *zlexer, origin string) *ParseError {
        return &ParseError{err: "OPT records do not have a presentation format"}
}

func (rr *OPT) isDuplicate(r2 RR) bool { return false }

// Version returns the EDNS version used. Only zero is defined.
func (rr *OPT) Version() uint8 {
        return uint8(rr.Hdr.Ttl & 0x00FF0000 >> 16)
}

// SetVersion sets the version of EDNS. This is usually zero.
func (rr *OPT) SetVersion(v uint8) {
        rr.Hdr.Ttl = rr.Hdr.Ttl&0xFF00FFFF | uint32(v)<<16
}

// ExtendedRcode returns the EDNS extended RCODE field (the upper 8 bits of the TTL).
func (rr *OPT) ExtendedRcode() int {
        return int(rr.Hdr.Ttl&0xFF000000>>24) << 4
}

// SetExtendedRcode sets the EDNS extended RCODE field.
//
// If the RCODE is not an extended RCODE, will reset the extended RCODE field to 0.
func (rr *OPT) SetExtendedRcode(v uint16) {
        rr.Hdr.Ttl = rr.Hdr.Ttl&0x00FFFFFF | uint32(v>>4)<<24
}

// UDPSize returns the UDP buffer size.
func (rr *OPT) UDPSize() uint16 {
        return rr.Hdr.Class
}

// SetUDPSize sets the UDP buffer size.
func (rr *OPT) SetUDPSize(size uint16) {
        rr.Hdr.Class = size
}

// Do returns the value of the DO (DNSSEC OK) bit.
func (rr *OPT) Do() bool {
        return rr.Hdr.Ttl&_DO == _DO
}

// SetDo sets the DO (DNSSEC OK) bit.
// If we pass an argument, set the DO bit to that value.
// It is possible to pass 2 or more arguments, but they will be ignored.
func (rr *OPT) SetDo(do ...bool) {
        if len(do) == 1 {
                if do[0] {
                        rr.Hdr.Ttl |= _DO
                } else {
                        rr.Hdr.Ttl &^= _DO
                }
        } else {
                rr.Hdr.Ttl |= _DO
        }
}

// Z returns the Z part of the OPT RR as a uint16 with only the 15 least significant bits used.
func (rr *OPT) Z() uint16 {
        return uint16(rr.Hdr.Ttl & 0x7FFF)
}

// SetZ sets the Z part of the OPT RR, note only the 15 least significant bits of z are used.
func (rr *OPT) SetZ(z uint16) {
        rr.Hdr.Ttl = rr.Hdr.Ttl&^0x7FFF | uint32(z&0x7FFF)
}

// EDNS0 defines an EDNS0 Option. An OPT RR can have multiple options appended to it.
type EDNS0 interface {
        // Option returns the option code for the option.
        Option() uint16
        // pack returns the bytes of the option data.
        pack() ([]byte, error)
        // unpack sets the data as found in the buffer. Is also sets
        // the length of the slice as the length of the option data.
        unpack([]byte) error
        // String returns the string representation of the option.
        String() string
        // copy returns a deep-copy of the option.
        copy() EDNS0
}

// EDNS0_NSID option is used to retrieve a nameserver
// identifier. When sending a request Nsid must be set to the empty string
// The identifier is an opaque string encoded as hex.
// Basic use pattern for creating an nsid option:
//
//        o := new(dns.OPT)
//        o.Hdr.Name = "."
//        o.Hdr.Rrtype = dns.TypeOPT
//        e := new(dns.EDNS0_NSID)
//        e.Code = dns.EDNS0NSID
//        e.Nsid = "AA"
//        o.Option = append(o.Option, e)
type EDNS0_NSID struct {
        Code uint16 // always EDNS0NSID
        Nsid string // string needs to be hex encoded
}

func (e *EDNS0_NSID) pack() ([]byte, error) {
        h, err := hex.DecodeString(e.Nsid)
        if err != nil {
                return nil, err
        }
        return h, nil
}

// Option implements the EDNS0 interface.
func (e *EDNS0_NSID) Option() uint16        { return EDNS0NSID } // Option returns the option code.
func (e *EDNS0_NSID) unpack(b []byte) error { e.Nsid = hex.EncodeToString(b); return nil }
func (e *EDNS0_NSID) String() string        { return e.Nsid }
func (e *EDNS0_NSID) copy() EDNS0           { return &EDNS0_NSID{e.Code, e.Nsid} }

// EDNS0_SUBNET is the subnet option that is used to give the remote nameserver
// an idea of where the client lives. See RFC 7871. It can then give back a different
// answer depending on the location or network topology.
// Basic use pattern for creating an subnet option:
//
//        o := new(dns.OPT)
//        o.Hdr.Name = "."
//        o.Hdr.Rrtype = dns.TypeOPT
//        e := new(dns.EDNS0_SUBNET)
//        e.Code = dns.EDNS0SUBNET // by default this is filled in through unpacking OPT packets (unpackDataOpt)
//        e.Family = 1        // 1 for IPv4 source address, 2 for IPv6
//        e.SourceNetmask = 32        // 32 for IPV4, 128 for IPv6
//        e.SourceScope = 0
//        e.Address = net.ParseIP("127.0.0.1").To4()        // for IPv4
//        // e.Address = net.ParseIP("2001:7b8:32a::2")        // for IPV6
//        o.Option = append(o.Option, e)
//
// This code will parse all the available bits when unpacking (up to optlen).
// When packing it will apply SourceNetmask. If you need more advanced logic,
// patches welcome and good luck.
type EDNS0_SUBNET struct {
        Code          uint16 // always EDNS0SUBNET
        Family        uint16 // 1 for IP, 2 for IP6
        SourceNetmask uint8
        SourceScope   uint8
        Address       net.IP
}

// Option implements the EDNS0 interface.
func (e *EDNS0_SUBNET) Option() uint16 { return EDNS0SUBNET }

func (e *EDNS0_SUBNET) pack() ([]byte, error) {
        b := make([]byte, 4)
        binary.BigEndian.PutUint16(b[0:], e.Family)
        b[2] = e.SourceNetmask
        b[3] = e.SourceScope
        switch e.Family {
        case 0:
                // "dig" sets AddressFamily to 0 if SourceNetmask is also 0
                // We might don't need to complain either
                if e.SourceNetmask != 0 {
                        return nil, errors.New("dns: bad address family")
                }
        case 1:
                if e.SourceNetmask > net.IPv4len*8 {
                        return nil, errors.New("dns: bad netmask")
                }
                if len(e.Address.To4()) != net.IPv4len {
                        return nil, errors.New("dns: bad address")
                }
                ip := e.Address.To4().Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv4len*8))
                needLength := (e.SourceNetmask + 8 - 1) / 8 // division rounding up
                b = append(b, ip[:needLength]...)
        case 2:
                if e.SourceNetmask > net.IPv6len*8 {
                        return nil, errors.New("dns: bad netmask")
                }
                if len(e.Address) != net.IPv6len {
                        return nil, errors.New("dns: bad address")
                }
                ip := e.Address.Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv6len*8))
                needLength := (e.SourceNetmask + 8 - 1) / 8 // division rounding up
                b = append(b, ip[:needLength]...)
        default:
                return nil, errors.New("dns: bad address family")
        }
        return b, nil
}

func (e *EDNS0_SUBNET) unpack(b []byte) error {
        if len(b) < 4 {
                return ErrBuf
        }
        e.Family = binary.BigEndian.Uint16(b)
        e.SourceNetmask = b[2]
        e.SourceScope = b[3]
        switch e.Family {
        case 0:
                // "dig" sets AddressFamily to 0 if SourceNetmask is also 0
                // It's okay to accept such a packet
                if e.SourceNetmask != 0 {
                        return errors.New("dns: bad address family")
                }
                e.Address = net.IPv4(0, 0, 0, 0)
        case 1:
                if e.SourceNetmask > net.IPv4len*8 || e.SourceScope > net.IPv4len*8 {
                        return errors.New("dns: bad netmask")
                }
                addr := make(net.IP, net.IPv4len)
                copy(addr, b[4:])
                e.Address = addr.To16()
        case 2:
                if e.SourceNetmask > net.IPv6len*8 || e.SourceScope > net.IPv6len*8 {
                        return errors.New("dns: bad netmask")
                }
                addr := make(net.IP, net.IPv6len)
                copy(addr, b[4:])
                e.Address = addr
        default:
                return errors.New("dns: bad address family")
        }
        return nil
}

func (e *EDNS0_SUBNET) String() (s string) {
        if e.Address == nil {
                s = "<nil>"
        } else if e.Address.To4() != nil {
                s = e.Address.String()
        } else {
                s = "[" + e.Address.String() + "]"
        }
        s += "/" + strconv.Itoa(int(e.SourceNetmask)) + "/" + strconv.Itoa(int(e.SourceScope))
        return
}

func (e *EDNS0_SUBNET) copy() EDNS0 {
        return &EDNS0_SUBNET{
                e.Code,
                e.Family,
                e.SourceNetmask,
                e.SourceScope,
                e.Address,
        }
}

// The EDNS0_COOKIE option is used to add a DNS Cookie to a message.
//
//        o := new(dns.OPT)
//        o.Hdr.Name = "."
//        o.Hdr.Rrtype = dns.TypeOPT
//        e := new(dns.EDNS0_COOKIE)
//        e.Code = dns.EDNS0COOKIE
//        e.Cookie = "24a5ac.."
//        o.Option = append(o.Option, e)
//
// The Cookie field consists out of a client cookie (RFC 7873 Section 4), that is
// always 8 bytes. It may then optionally be followed by the server cookie. The server
// cookie is of variable length, 8 to a maximum of 32 bytes. In other words:
//
//        cCookie := o.Cookie[:16]
//        sCookie := o.Cookie[16:]
//
// There is no guarantee that the Cookie string has a specific length.
type EDNS0_COOKIE struct {
        Code   uint16 // always EDNS0COOKIE
        Cookie string // hex encoded cookie data
}

func (e *EDNS0_COOKIE) pack() ([]byte, error) {
        h, err := hex.DecodeString(e.Cookie)
        if err != nil {
                return nil, err
        }
        return h, nil
}

// Option implements the EDNS0 interface.
func (e *EDNS0_COOKIE) Option() uint16        { return EDNS0COOKIE }
func (e *EDNS0_COOKIE) unpack(b []byte) error { e.Cookie = hex.EncodeToString(b); return nil }
func (e *EDNS0_COOKIE) String() string        { return e.Cookie }
func (e *EDNS0_COOKIE) copy() EDNS0           { return &EDNS0_COOKIE{e.Code, e.Cookie} }

// The EDNS0_UL (Update Lease) (draft RFC) option is used to tell the server to set
// an expiration on an update RR. This is helpful for clients that cannot clean
// up after themselves. This is a draft RFC and more information can be found at
// https://tools.ietf.org/html/draft-sekar-dns-ul-02
//
//        o := new(dns.OPT)
//        o.Hdr.Name = "."
//        o.Hdr.Rrtype = dns.TypeOPT
//        e := new(dns.EDNS0_UL)
//        e.Code = dns.EDNS0UL
//        e.Lease = 120 // in seconds
//        o.Option = append(o.Option, e)
type EDNS0_UL struct {
        Code     uint16 // always EDNS0UL
        Lease    uint32
        KeyLease uint32
}

// Option implements the EDNS0 interface.
func (e *EDNS0_UL) Option() uint16 { return EDNS0UL }
func (e *EDNS0_UL) String() string { return fmt.Sprintf("%d %d", e.Lease, e.KeyLease) }
func (e *EDNS0_UL) copy() EDNS0    { return &EDNS0_UL{e.Code, e.Lease, e.KeyLease} }

// Copied: http://golang.org/src/pkg/net/dnsmsg.go
func (e *EDNS0_UL) pack() ([]byte, error) {
        var b []byte
        if e.KeyLease == 0 {
                b = make([]byte, 4)
        } else {
                b = make([]byte, 8)
                binary.BigEndian.PutUint32(b[4:], e.KeyLease)
        }
        binary.BigEndian.PutUint32(b, e.Lease)
        return b, nil
}

func (e *EDNS0_UL) unpack(b []byte) error {
        switch len(b) {
        case 4:
                e.KeyLease = 0
        case 8:
                e.KeyLease = binary.BigEndian.Uint32(b[4:])
        default:
                return ErrBuf
        }
        e.Lease = binary.BigEndian.Uint32(b)
        return nil
}

// EDNS0_LLQ stands for Long Lived Queries: http://tools.ietf.org/html/draft-sekar-dns-llq-01
// Implemented for completeness, as the EDNS0 type code is assigned.
type EDNS0_LLQ struct {
        Code      uint16 // always EDNS0LLQ
        Version   uint16
        Opcode    uint16
        Error     uint16
        Id        uint64
        LeaseLife uint32
}

// Option implements the EDNS0 interface.
func (e *EDNS0_LLQ) Option() uint16 { return EDNS0LLQ }

func (e *EDNS0_LLQ) pack() ([]byte, error) {
        b := make([]byte, 18)
        binary.BigEndian.PutUint16(b[0:], e.Version)
        binary.BigEndian.PutUint16(b[2:], e.Opcode)
        binary.BigEndian.PutUint16(b[4:], e.Error)
        binary.BigEndian.PutUint64(b[6:], e.Id)
        binary.BigEndian.PutUint32(b[14:], e.LeaseLife)
        return b, nil
}

func (e *EDNS0_LLQ) unpack(b []byte) error {
        if len(b) < 18 {
                return ErrBuf
        }
        e.Version = binary.BigEndian.Uint16(b[0:])
        e.Opcode = binary.BigEndian.Uint16(b[2:])
        e.Error = binary.BigEndian.Uint16(b[4:])
        e.Id = binary.BigEndian.Uint64(b[6:])
        e.LeaseLife = binary.BigEndian.Uint32(b[14:])
        return nil
}

func (e *EDNS0_LLQ) String() string {
        s := strconv.FormatUint(uint64(e.Version), 10) + " " + strconv.FormatUint(uint64(e.Opcode), 10) +
                " " + strconv.FormatUint(uint64(e.Error), 10) + " " + strconv.FormatUint(e.Id, 10) +
                " " + strconv.FormatUint(uint64(e.LeaseLife), 10)
        return s
}

func (e *EDNS0_LLQ) copy() EDNS0 {
        return &EDNS0_LLQ{e.Code, e.Version, e.Opcode, e.Error, e.Id, e.LeaseLife}
}

// EDNS0_DAU implements the EDNS0 "DNSSEC Algorithm Understood" option. See RFC 6975.
type EDNS0_DAU struct {
        Code    uint16 // always EDNS0DAU
        AlgCode []uint8
}

// Option implements the EDNS0 interface.
func (e *EDNS0_DAU) Option() uint16        { return EDNS0DAU }
func (e *EDNS0_DAU) pack() ([]byte, error) { return cloneSlice(e.AlgCode), nil }
func (e *EDNS0_DAU) unpack(b []byte) error { e.AlgCode = cloneSlice(b); return nil }

func (e *EDNS0_DAU) String() string {
        s := ""
        for _, alg := range e.AlgCode {
                if a, ok := AlgorithmToString[alg]; ok {
                        s += " " + a
                } else {
                        s += " " + strconv.Itoa(int(alg))
                }
        }
        return s
}
func (e *EDNS0_DAU) copy() EDNS0 { return &EDNS0_DAU{e.Code, e.AlgCode} }

// EDNS0_DHU implements the EDNS0 "DS Hash Understood" option. See RFC 6975.
type EDNS0_DHU struct {
        Code    uint16 // always EDNS0DHU
        AlgCode []uint8
}

// Option implements the EDNS0 interface.
func (e *EDNS0_DHU) Option() uint16        { return EDNS0DHU }
func (e *EDNS0_DHU) pack() ([]byte, error) { return cloneSlice(e.AlgCode), nil }
func (e *EDNS0_DHU) unpack(b []byte) error { e.AlgCode = cloneSlice(b); return nil }

func (e *EDNS0_DHU) String() string {
        s := ""
        for _, alg := range e.AlgCode {
                if a, ok := HashToString[alg]; ok {
                        s += " " + a
                } else {
                        s += " " + strconv.Itoa(int(alg))
                }
        }
        return s
}
func (e *EDNS0_DHU) copy() EDNS0 { return &EDNS0_DHU{e.Code, e.AlgCode} }

// EDNS0_N3U implements the EDNS0 "NSEC3 Hash Understood" option. See RFC 6975.
type EDNS0_N3U struct {
        Code    uint16 // always EDNS0N3U
        AlgCode []uint8
}

// Option implements the EDNS0 interface.
func (e *EDNS0_N3U) Option() uint16        { return EDNS0N3U }
func (e *EDNS0_N3U) pack() ([]byte, error) { return cloneSlice(e.AlgCode), nil }
func (e *EDNS0_N3U) unpack(b []byte) error { e.AlgCode = cloneSlice(b); return nil }

func (e *EDNS0_N3U) String() string {
        // Re-use the hash map
        s := ""
        for _, alg := range e.AlgCode {
                if a, ok := HashToString[alg]; ok {
                        s += " " + a
                } else {
                        s += " " + strconv.Itoa(int(alg))
                }
        }
        return s
}
func (e *EDNS0_N3U) copy() EDNS0 { return &EDNS0_N3U{e.Code, e.AlgCode} }

// EDNS0_EXPIRE implements the EDNS0 option as described in RFC 7314.
type EDNS0_EXPIRE struct {
        Code   uint16 // always EDNS0EXPIRE
        Expire uint32
        Empty  bool // Empty is used to signal an empty Expire option in a backwards compatible way, it's not used on the wire.
}

// Option implements the EDNS0 interface.
func (e *EDNS0_EXPIRE) Option() uint16 { return EDNS0EXPIRE }
func (e *EDNS0_EXPIRE) copy() EDNS0    { return &EDNS0_EXPIRE{e.Code, e.Expire, e.Empty} }

func (e *EDNS0_EXPIRE) pack() ([]byte, error) {
        if e.Empty {
                return []byte{}, nil
        }
        b := make([]byte, 4)
        binary.BigEndian.PutUint32(b, e.Expire)
        return b, nil
}

func (e *EDNS0_EXPIRE) unpack(b []byte) error {
        if len(b) == 0 {
                // zero-length EXPIRE query, see RFC 7314 Section 2
                e.Empty = true
                return nil
        }
        if len(b) < 4 {
                return ErrBuf
        }
        e.Expire = binary.BigEndian.Uint32(b)
        e.Empty = false
        return nil
}

func (e *EDNS0_EXPIRE) String() (s string) {
        if e.Empty {
                return ""
        }
        return strconv.FormatUint(uint64(e.Expire), 10)
}

// The EDNS0_LOCAL option is used for local/experimental purposes. The option
// code is recommended to be within the range [EDNS0LOCALSTART, EDNS0LOCALEND]
// (RFC6891), although any unassigned code can actually be used.  The content of
// the option is made available in Data, unaltered.
// Basic use pattern for creating a local option:
//
//        o := new(dns.OPT)
//        o.Hdr.Name = "."
//        o.Hdr.Rrtype = dns.TypeOPT
//        e := new(dns.EDNS0_LOCAL)
//        e.Code = dns.EDNS0LOCALSTART
//        e.Data = []byte{72, 82, 74}
//        o.Option = append(o.Option, e)
type EDNS0_LOCAL struct {
        Code uint16
        Data []byte
}

// Option implements the EDNS0 interface.
func (e *EDNS0_LOCAL) Option() uint16 { return e.Code }

func (e *EDNS0_LOCAL) String() string {
        return strconv.FormatInt(int64(e.Code), 10) + ":0x" + hex.EncodeToString(e.Data)
}

func (e *EDNS0_LOCAL) copy() EDNS0 {
        return &EDNS0_LOCAL{e.Code, cloneSlice(e.Data)}
}

func (e *EDNS0_LOCAL) pack() ([]byte, error) {
        return cloneSlice(e.Data), nil
}

func (e *EDNS0_LOCAL) unpack(b []byte) error {
        e.Data = cloneSlice(b)
        return nil
}

// EDNS0_TCP_KEEPALIVE is an EDNS0 option that instructs the server to keep
// the TCP connection alive. See RFC 7828.
type EDNS0_TCP_KEEPALIVE struct {
        Code uint16 // always EDNSTCPKEEPALIVE

        // Timeout is an idle timeout value for the TCP connection, specified in
        // units of 100 milliseconds, encoded in network byte order. If set to 0,
        // pack will return a nil slice.
        Timeout uint16

        // Length is the option's length.
        // Deprecated: this field is deprecated and is always equal to 0.
        Length uint16
}

// Option implements the EDNS0 interface.
func (e *EDNS0_TCP_KEEPALIVE) Option() uint16 { return EDNS0TCPKEEPALIVE }

func (e *EDNS0_TCP_KEEPALIVE) pack() ([]byte, error) {
        if e.Timeout > 0 {
                b := make([]byte, 2)
                binary.BigEndian.PutUint16(b, e.Timeout)
                return b, nil
        }
        return nil, nil
}

func (e *EDNS0_TCP_KEEPALIVE) unpack(b []byte) error {
        switch len(b) {
        case 0:
        case 2:
                e.Timeout = binary.BigEndian.Uint16(b)
        default:
                return fmt.Errorf("dns: length mismatch, want 0/2 but got %d", len(b))
        }
        return nil
}

func (e *EDNS0_TCP_KEEPALIVE) String() string {
        s := "use tcp keep-alive"
        if e.Timeout == 0 {
                s += ", timeout omitted"
        } else {
                s += fmt.Sprintf(", timeout %dms", e.Timeout*100)
        }
        return s
}

func (e *EDNS0_TCP_KEEPALIVE) copy() EDNS0 { return &EDNS0_TCP_KEEPALIVE{e.Code, e.Timeout, e.Length} }

// EDNS0_PADDING option is used to add padding to a request/response. The default
// value of padding SHOULD be 0x0 but other values MAY be used, for instance if
// compression is applied before encryption which may break signatures.
type EDNS0_PADDING struct {
        Padding []byte
}

// Option implements the EDNS0 interface.
func (e *EDNS0_PADDING) Option() uint16        { return EDNS0PADDING }
func (e *EDNS0_PADDING) pack() ([]byte, error) { return cloneSlice(e.Padding), nil }
func (e *EDNS0_PADDING) unpack(b []byte) error { e.Padding = cloneSlice(b); return nil }
func (e *EDNS0_PADDING) String() string        { return fmt.Sprintf("%0X", e.Padding) }
func (e *EDNS0_PADDING) copy() EDNS0           { return &EDNS0_PADDING{cloneSlice(e.Padding)} }

// Extended DNS Error Codes (RFC 8914).
const (
        ExtendedErrorCodeOther uint16 = iota
        ExtendedErrorCodeUnsupportedDNSKEYAlgorithm
        ExtendedErrorCodeUnsupportedDSDigestType
        ExtendedErrorCodeStaleAnswer
        ExtendedErrorCodeForgedAnswer
        ExtendedErrorCodeDNSSECIndeterminate
        ExtendedErrorCodeDNSBogus
        ExtendedErrorCodeSignatureExpired
        ExtendedErrorCodeSignatureNotYetValid
        ExtendedErrorCodeDNSKEYMissing
        ExtendedErrorCodeRRSIGsMissing
        ExtendedErrorCodeNoZoneKeyBitSet
        ExtendedErrorCodeNSECMissing
        ExtendedErrorCodeCachedError
        ExtendedErrorCodeNotReady
        ExtendedErrorCodeBlocked
        ExtendedErrorCodeCensored
        ExtendedErrorCodeFiltered
        ExtendedErrorCodeProhibited
        ExtendedErrorCodeStaleNXDOMAINAnswer
        ExtendedErrorCodeNotAuthoritative
        ExtendedErrorCodeNotSupported
        ExtendedErrorCodeNoReachableAuthority
        ExtendedErrorCodeNetworkError
        ExtendedErrorCodeInvalidData
        ExtendedErrorCodeSignatureExpiredBeforeValid
        ExtendedErrorCodeTooEarly
        ExtendedErrorCodeUnsupportedNSEC3IterValue
        ExtendedErrorCodeUnableToConformToPolicy
        ExtendedErrorCodeSynthesized
        ExtendedErrorCodeInvalidQueryType
)

// ExtendedErrorCodeToString maps extended error info codes to a human readable
// description.
var ExtendedErrorCodeToString = map[uint16]string{
        ExtendedErrorCodeOther:                       "Other",
        ExtendedErrorCodeUnsupportedDNSKEYAlgorithm:  "Unsupported DNSKEY Algorithm",
        ExtendedErrorCodeUnsupportedDSDigestType:     "Unsupported DS Digest Type",
        ExtendedErrorCodeStaleAnswer:                 "Stale Answer",
        ExtendedErrorCodeForgedAnswer:                "Forged Answer",
        ExtendedErrorCodeDNSSECIndeterminate:         "DNSSEC Indeterminate",
        ExtendedErrorCodeDNSBogus:                    "DNSSEC Bogus",
        ExtendedErrorCodeSignatureExpired:            "Signature Expired",
        ExtendedErrorCodeSignatureNotYetValid:        "Signature Not Yet Valid",
        ExtendedErrorCodeDNSKEYMissing:               "DNSKEY Missing",
        ExtendedErrorCodeRRSIGsMissing:               "RRSIGs Missing",
        ExtendedErrorCodeNoZoneKeyBitSet:             "No Zone Key Bit Set",
        ExtendedErrorCodeNSECMissing:                 "NSEC Missing",
        ExtendedErrorCodeCachedError:                 "Cached Error",
        ExtendedErrorCodeNotReady:                    "Not Ready",
        ExtendedErrorCodeBlocked:                     "Blocked",
        ExtendedErrorCodeCensored:                    "Censored",
        ExtendedErrorCodeFiltered:                    "Filtered",
        ExtendedErrorCodeProhibited:                  "Prohibited",
        ExtendedErrorCodeStaleNXDOMAINAnswer:         "Stale NXDOMAIN Answer",
        ExtendedErrorCodeNotAuthoritative:            "Not Authoritative",
        ExtendedErrorCodeNotSupported:                "Not Supported",
        ExtendedErrorCodeNoReachableAuthority:        "No Reachable Authority",
        ExtendedErrorCodeNetworkError:                "Network Error",
        ExtendedErrorCodeInvalidData:                 "Invalid Data",
        ExtendedErrorCodeSignatureExpiredBeforeValid: "Signature Expired Before Valid",
        ExtendedErrorCodeTooEarly:                    "Too Early",
        ExtendedErrorCodeUnsupportedNSEC3IterValue:   "Unsupported NSEC3 Iterations Value",
        ExtendedErrorCodeUnableToConformToPolicy:     "Unable To Conform To Policy",
        ExtendedErrorCodeSynthesized:                 "Synthesized",
        ExtendedErrorCodeInvalidQueryType:            "Invalid Query Type",
}

// StringToExtendedErrorCode is a map from human readable descriptions to
// extended error info codes.
var StringToExtendedErrorCode = reverseInt16(ExtendedErrorCodeToString)

// EDNS0_EDE option is used to return additional information about the cause of
// DNS errors.
type EDNS0_EDE struct {
        InfoCode  uint16
        ExtraText string
}

// Option implements the EDNS0 interface.
func (e *EDNS0_EDE) Option() uint16 { return EDNS0EDE }
func (e *EDNS0_EDE) copy() EDNS0    { return &EDNS0_EDE{e.InfoCode, e.ExtraText} }

func (e *EDNS0_EDE) String() string {
        info := strconv.FormatUint(uint64(e.InfoCode), 10)
        if s, ok := ExtendedErrorCodeToString[e.InfoCode]; ok {
                info += fmt.Sprintf(" (%s)", s)
        }
        return fmt.Sprintf("%s: (%s)", info, e.ExtraText)
}

func (e *EDNS0_EDE) pack() ([]byte, error) {
        b := make([]byte, 2+len(e.ExtraText))
        binary.BigEndian.PutUint16(b[0:], e.InfoCode)
        copy(b[2:], e.ExtraText)
        return b, nil
}

func (e *EDNS0_EDE) unpack(b []byte) error {
        if len(b) < 2 {
                return ErrBuf
        }
        e.InfoCode = binary.BigEndian.Uint16(b[0:])
        e.ExtraText = string(b[2:])
        return nil
}

// The EDNS0_ESU option for ENUM Source-URI Extension.
type EDNS0_ESU struct {
        Code uint16 // always EDNS0ESU
        Uri  string
}

func (e *EDNS0_ESU) Option() uint16        { return EDNS0ESU }
func (e *EDNS0_ESU) String() string        { return e.Uri }
func (e *EDNS0_ESU) copy() EDNS0           { return &EDNS0_ESU{e.Code, e.Uri} }
func (e *EDNS0_ESU) pack() ([]byte, error) { return []byte(e.Uri), nil }
func (e *EDNS0_ESU) unpack(b []byte) error {
        e.Uri = string(b)
        return nil
}

package dns

import (
        "net"
        "reflect"
        "strconv"
)

// NumField returns the number of rdata fields r has.
func NumField(r RR) int {
        return reflect.ValueOf(r).Elem().NumField() - 1 // Remove RR_Header
}

// Field returns the rdata field i as a string. Fields are indexed starting from 1.
// RR types that holds slice data, for instance the NSEC type bitmap will return a single
// string where the types are concatenated using a space.
// Accessing non existing fields will cause a panic.
func Field(r RR, i int) string {
        if i == 0 {
                return ""
        }
        d := reflect.ValueOf(r).Elem().Field(i)
        switch d.Kind() {
        case reflect.String:
                return d.String()
        case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
                return strconv.FormatInt(d.Int(), 10)
        case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
                return strconv.FormatUint(d.Uint(), 10)
        case reflect.Slice:
                switch reflect.ValueOf(r).Elem().Type().Field(i).Tag {
                case `dns:"a"`:
                        // TODO(miek): Hmm store this as 16 bytes
                        if d.Len() < net.IPv4len {
                                return ""
                        }
                        if d.Len() < net.IPv6len {
                                return net.IPv4(byte(d.Index(0).Uint()),
                                        byte(d.Index(1).Uint()),
                                        byte(d.Index(2).Uint()),
                                        byte(d.Index(3).Uint())).String()
                        }
                        return net.IPv4(byte(d.Index(12).Uint()),
                                byte(d.Index(13).Uint()),
                                byte(d.Index(14).Uint()),
                                byte(d.Index(15).Uint())).String()
                case `dns:"aaaa"`:
                        if d.Len() < net.IPv6len {
                                return ""
                        }
                        return net.IP{
                                byte(d.Index(0).Uint()),
                                byte(d.Index(1).Uint()),
                                byte(d.Index(2).Uint()),
                                byte(d.Index(3).Uint()),
                                byte(d.Index(4).Uint()),
                                byte(d.Index(5).Uint()),
                                byte(d.Index(6).Uint()),
                                byte(d.Index(7).Uint()),
                                byte(d.Index(8).Uint()),
                                byte(d.Index(9).Uint()),
                                byte(d.Index(10).Uint()),
                                byte(d.Index(11).Uint()),
                                byte(d.Index(12).Uint()),
                                byte(d.Index(13).Uint()),
                                byte(d.Index(14).Uint()),
                                byte(d.Index(15).Uint()),
                        }.String()
                case `dns:"nsec"`:
                        if d.Len() == 0 {
                                return ""
                        }
                        s := Type(d.Index(0).Uint()).String()
                        for i := 1; i < d.Len(); i++ {
                                s += " " + Type(d.Index(i).Uint()).String()
                        }
                        return s
                default:
                        // if it does not have a tag its a string slice
                        fallthrough
                case `dns:"txt"`:
                        if d.Len() == 0 {
                                return ""
                        }
                        s := d.Index(0).String()
                        for i := 1; i < d.Len(); i++ {
                                s += " " + d.Index(i).String()
                        }
                        return s
                }
        }
        return ""
}

//go:build fuzz
// +build fuzz

package dns

import "strings"

func Fuzz(data []byte) int {
        msg := new(Msg)

        if err := msg.Unpack(data); err != nil {
                return 0
        }
        if _, err := msg.Pack(); err != nil {
                return 0
        }

        return 1
}

func FuzzNewRR(data []byte) int {
        str := string(data)
        // Do not fuzz lines that include the $INCLUDE keyword and hint the fuzzer
        // at avoiding them.
        // See GH#1025 for context.
        if strings.Contains(strings.ToUpper(str), "$INCLUDE") {
                return -1
        }
        if _, err := NewRR(str); err != nil {
                return 0
        }
        return 1
}

package dns

import (
        "bytes"
        "fmt"
        "io"
        "strconv"
        "strings"
)

// Parse the $GENERATE statement as used in BIND9 zones.
// See http://www.zytrax.com/books/dns/ch8/generate.html for instance.
// We are called after '$GENERATE '. After which we expect:
// * the range (12-24/2)
// * lhs (ownername)
// * [[ttl][class]]
// * type
// * rhs (rdata)
// But we are lazy here, only the range is parsed *all* occurrences
// of $ after that are interpreted.
func (zp *ZoneParser) generate(l lex) (RR, bool) {
        token := l.token
        step := int64(1)
        if i := strings.IndexByte(token, '/'); i >= 0 {
                if i+1 == len(token) {
                        return zp.setParseError("bad step in $GENERATE range", l)
                }

                s, err := strconv.ParseInt(token[i+1:], 10, 64)
                if err != nil || s <= 0 {
                        return zp.setParseError("bad step in $GENERATE range", l)
                }

                step = s
                token = token[:i]
        }

        startStr, endStr, ok := strings.Cut(token, "-")
        if !ok {
                return zp.setParseError("bad start-stop in $GENERATE range", l)
        }

        start, err := strconv.ParseInt(startStr, 10, 64)
        if err != nil {
                return zp.setParseError("bad start in $GENERATE range", l)
        }

        end, err := strconv.ParseInt(endStr, 10, 64)
        if err != nil {
                return zp.setParseError("bad stop in $GENERATE range", l)
        }
        if end < 0 || start < 0 || end < start || (end-start)/step > 65535 {
                return zp.setParseError("bad range in $GENERATE range", l)
        }

        // _BLANK
        l, ok = zp.c.Next()
        if !ok || l.value != zBlank {
                return zp.setParseError("garbage after $GENERATE range", l)
        }

        // Create a complete new string, which we then parse again.
        var s string
        for l, ok := zp.c.Next(); ok; l, ok = zp.c.Next() {
                if l.err {
                        return zp.setParseError("bad data in $GENERATE directive", l)
                }
                if l.value == zNewline {
                        break
                }

                s += l.token
        }

        r := &generateReader{
                s: s,

                cur:   start,
                start: start,
                end:   end,
                step:  step,

                file: zp.file,
                lex:  &l,
        }
        zp.sub = NewZoneParser(r, zp.origin, zp.file)
        zp.sub.includeDepth, zp.sub.includeAllowed = zp.includeDepth, zp.includeAllowed
        zp.sub.generateDisallowed = true
        zp.sub.SetDefaultTTL(defaultTtl)
        return zp.subNext()
}

type generateReader struct {
        s  string
        si int

        cur   int64
        start int64
        end   int64
        step  int64

        mod bytes.Buffer

        escape bool

        eof bool

        file string
        lex  *lex
}

func (r *generateReader) parseError(msg string, end int) *ParseError {
        r.eof = true // Make errors sticky.

        l := *r.lex
        l.token = r.s[r.si-1 : end]
        l.column += r.si // l.column starts one zBLANK before r.s

        return &ParseError{file: r.file, err: msg, lex: l}
}

func (r *generateReader) Read(p []byte) (int, error) {
        // NewZLexer, through NewZoneParser, should use ReadByte and
        // not end up here.

        panic("not implemented")
}

func (r *generateReader) ReadByte() (byte, error) {
        if r.eof {
                return 0, io.EOF
        }
        if r.mod.Len() > 0 {
                return r.mod.ReadByte()
        }

        if r.si >= len(r.s) {
                r.si = 0
                r.cur += r.step

                r.eof = r.cur > r.end || r.cur < 0
                return '\n', nil
        }

        si := r.si
        r.si++

        switch r.s[si] {
        case '\\':
                if r.escape {
                        r.escape = false
                        return '\\', nil
                }

                r.escape = true
                return r.ReadByte()
        case '$':
                if r.escape {
                        r.escape = false
                        return '$', nil
                }

                mod := "%d"

                if si >= len(r.s)-1 {
                        // End of the string
                        fmt.Fprintf(&r.mod, mod, r.cur)
                        return r.mod.ReadByte()
                }

                if r.s[si+1] == '$' {
                        r.si++
                        return '$', nil
                }

                var offset int64

                // Search for { and }
                if r.s[si+1] == '{' {
                        // Modifier block
                        sep := strings.Index(r.s[si+2:], "}")
                        if sep < 0 {
                                return 0, r.parseError("bad modifier in $GENERATE", len(r.s))
                        }

                        var errMsg string
                        mod, offset, errMsg = modToPrintf(r.s[si+2 : si+2+sep])
                        if errMsg != "" {
                                return 0, r.parseError(errMsg, si+3+sep)
                        }
                        if r.start+offset < 0 || r.end+offset > 1<<31-1 {
                                return 0, r.parseError("bad offset in $GENERATE", si+3+sep)
                        }

                        r.si += 2 + sep // Jump to it
                }

                fmt.Fprintf(&r.mod, mod, r.cur+offset)
                return r.mod.ReadByte()
        default:
                if r.escape { // Pretty useless here
                        r.escape = false
                        return r.ReadByte()
                }

                return r.s[si], nil
        }
}

// Convert a $GENERATE modifier 0,0,d to something Printf can deal with.
func modToPrintf(s string) (string, int64, string) {
        // Modifier is { offset [ ,width [ ,base ] ] } - provide default
        // values for optional width and type, if necessary.
        offStr, s, ok0 := strings.Cut(s, ",")
        widthStr, s, ok1 := strings.Cut(s, ",")
        base, _, ok2 := strings.Cut(s, ",")
        if !ok0 {
                widthStr = "0"
        }
        if !ok1 {
                base = "d"
        }
        if ok2 {
                return "", 0, "bad modifier in $GENERATE"
        }

        switch base {
        case "o", "d", "x", "X":
        default:
                return "", 0, "bad base in $GENERATE"
        }

        offset, err := strconv.ParseInt(offStr, 10, 64)
        if err != nil {
                return "", 0, "bad offset in $GENERATE"
        }

        width, err := strconv.ParseUint(widthStr, 10, 8)
        if err != nil {
                return "", 0, "bad width in $GENERATE"
        }

        if width == 0 {
                return "%" + base, offset, ""
        }

        return "%0" + widthStr + base, offset, ""
}

package dns

import (
        "bytes"
        "crypto"
        "hash"
)

// identityHash will not hash, it only buffers the data written into it and returns it as-is.
type identityHash struct {
        b *bytes.Buffer
}

// Implement the hash.Hash interface.

func (i identityHash) Write(b []byte) (int, error) { return i.b.Write(b) }
func (i identityHash) Size() int                   { return i.b.Len() }
func (i identityHash) BlockSize() int              { return 1024 }
func (i identityHash) Reset()                      { i.b.Reset() }
func (i identityHash) Sum(b []byte) []byte         { return append(b, i.b.Bytes()...) }

func hashFromAlgorithm(alg uint8) (hash.Hash, crypto.Hash, error) {
        hashnumber, ok := AlgorithmToHash[alg]
        if !ok {
                return nil, 0, ErrAlg
        }
        if hashnumber == 0 {
                return identityHash{b: &bytes.Buffer{}}, hashnumber, nil
        }
        return hashnumber.New(), hashnumber, nil
}

package dns

// Holds a bunch of helper functions for dealing with labels.

// SplitDomainName splits a name string into it's labels.
// www.miek.nl. returns []string{"www", "miek", "nl"}
// .www.miek.nl. returns []string{"", "www", "miek", "nl"},
// The root label (.) returns nil. Note that using
// strings.Split(s) will work in most cases, but does not handle
// escaped dots (\.) for instance.
// s must be a syntactically valid domain name, see IsDomainName.
func SplitDomainName(s string) (labels []string) {
        if s == "" {
                return nil
        }
        fqdnEnd := 0 // offset of the final '.' or the length of the name
        idx := Split(s)
        begin := 0
        if IsFqdn(s) {
                fqdnEnd = len(s) - 1
        } else {
                fqdnEnd = len(s)
        }

        switch len(idx) {
        case 0:
                return nil
        case 1:
                // no-op
        default:
                for _, end := range idx[1:] {
                        labels = append(labels, s[begin:end-1])
                        begin = end
                }
        }

        return append(labels, s[begin:fqdnEnd])
}

// CompareDomainName compares the names s1 and s2 and
// returns how many labels they have in common starting from the *right*.
// The comparison stops at the first inequality. The names are downcased
// before the comparison.
//
// www.miek.nl. and miek.nl. have two labels in common: miek and nl
// www.miek.nl. and www.bla.nl. have one label in common: nl
//
// s1 and s2 must be syntactically valid domain names.
func CompareDomainName(s1, s2 string) (n int) {
        // the first check: root label
        if s1 == "." || s2 == "." {
                return 0
        }

        l1 := Split(s1)
        l2 := Split(s2)

        j1 := len(l1) - 1 // end
        i1 := len(l1) - 2 // start
        j2 := len(l2) - 1
        i2 := len(l2) - 2
        // the second check can be done here: last/only label
        // before we fall through into the for-loop below
        if equal(s1[l1[j1]:], s2[l2[j2]:]) {
                n++
        } else {
                return
        }
        for {
                if i1 < 0 || i2 < 0 {
                        break
                }
                if equal(s1[l1[i1]:l1[j1]], s2[l2[i2]:l2[j2]]) {
                        n++
                } else {
                        break
                }
                j1--
                i1--
                j2--
                i2--
        }
        return
}

// CountLabel counts the number of labels in the string s.
// s must be a syntactically valid domain name.
func CountLabel(s string) (labels int) {
        if s == "." {
                return
        }
        off := 0
        end := false
        for {
                off, end = NextLabel(s, off)
                labels++
                if end {
                        return
                }
        }
}

// Split splits a name s into its label indexes.
// www.miek.nl. returns []int{0, 4, 9}, www.miek.nl also returns []int{0, 4, 9}.
// The root name (.) returns nil. Also see SplitDomainName.
// s must be a syntactically valid domain name.
func Split(s string) []int {
        if s == "." {
                return nil
        }
        idx := make([]int, 1, 3)
        off := 0
        end := false

        for {
                off, end = NextLabel(s, off)
                if end {
                        return idx
                }
                idx = append(idx, off)
        }
}

// NextLabel returns the index of the start of the next label in the
// string s starting at offset. A negative offset will cause a panic.
// The bool end is true when the end of the string has been reached.
// Also see PrevLabel.
func NextLabel(s string, offset int) (i int, end bool) {
        if s == "" {
                return 0, true
        }
        for i = offset; i < len(s)-1; i++ {
                if s[i] != '.' {
                        continue
                }
                j := i - 1
                for j >= 0 && s[j] == '\\' {
                        j--
                }

                if (j-i)%2 == 0 {
                        continue
                }

                return i + 1, false
        }
        return i + 1, true
}

// PrevLabel returns the index of the label when starting from the right and
// jumping n labels to the left.
// The bool start is true when the start of the string has been overshot.
// Also see NextLabel.
func PrevLabel(s string, n int) (i int, start bool) {
        if s == "" {
                return 0, true
        }
        if n == 0 {
                return len(s), false
        }

        l := len(s) - 1
        if s[l] == '.' {
                l--
        }

        for ; l >= 0 && n > 0; l-- {
                if s[l] != '.' {
                        continue
                }
                j := l - 1
                for j >= 0 && s[j] == '\\' {
                        j--
                }

                if (j-l)%2 == 0 {
                        continue
                }

                n--
                if n == 0 {
                        return l + 1, false
                }
        }

        return 0, n > 1
}

// equal compares a and b while ignoring case. It returns true when equal otherwise false.
func equal(a, b string) bool {
        // might be lifted into API function.
        la := len(a)
        lb := len(b)
        if la != lb {
                return false
        }

        for i := la - 1; i >= 0; i-- {
                ai := a[i]
                bi := b[i]
                if ai >= 'A' && ai <= 'Z' {
                        ai |= 'a' - 'A'
                }
                if bi >= 'A' && bi <= 'Z' {
                        bi |= 'a' - 'A'
                }
                if ai != bi {
                        return false
                }
        }
        return true
}

//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd
// +build aix darwin dragonfly freebsd linux netbsd openbsd

package dns

import (
        "context"
        "net"
        "syscall"

        "golang.org/x/sys/unix"
)

const supportsReusePort = true

func reuseportControl(network, address string, c syscall.RawConn) error {
        var opErr error
        err := c.Control(func(fd uintptr) {
                opErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_REUSEPORT, 1)
        })
        if err != nil {
                return err
        }

        return opErr
}

const supportsReuseAddr = true

func reuseaddrControl(network, address string, c syscall.RawConn) error {
        var opErr error
        err := c.Control(func(fd uintptr) {
                opErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_REUSEADDR, 1)
        })
        if err != nil {
                return err
        }

        return opErr
}

func listenTCP(network, addr string, reuseport, reuseaddr bool) (net.Listener, error) {
        var lc net.ListenConfig
        switch {
        case reuseaddr && reuseport:
        case reuseport:
                lc.Control = reuseportControl
        case reuseaddr:
                lc.Control = reuseaddrControl
        }

        return lc.Listen(context.Background(), network, addr)
}

func listenUDP(network, addr string, reuseport, reuseaddr bool) (net.PacketConn, error) {
        var lc net.ListenConfig
        switch {
        case reuseaddr && reuseport:
        case reuseport:
                lc.Control = reuseportControl
        case reuseaddr:
                lc.Control = reuseaddrControl
        }

        return lc.ListenPacket(context.Background(), network, addr)
}

// DNS packet assembly, see RFC 1035. Converting from - Unpack() -
// and to - Pack() - wire format.
// All the packers and unpackers take a (msg []byte, off int)
// and return (off1 int, ok bool).  If they return ok==false, they
// also return off1==len(msg), so that the next unpacker will
// also fail.  This lets us avoid checks of ok until the end of a
// packing sequence.

package dns

//go:generate go run msg_generate.go

import (
        "crypto/rand"
        "encoding/binary"
        "fmt"
        "math/big"
        "strconv"
        "strings"
)

const (
        maxCompressionOffset    = 2 << 13 // We have 14 bits for the compression pointer
        maxDomainNameWireOctets = 255     // See RFC 1035 section 2.3.4

        // This is the maximum number of compression pointers that should occur in a
        // semantically valid message. Each label in a domain name must be at least one
        // octet and is separated by a period. The root label won't be represented by a
        // compression pointer to a compression pointer, hence the -2 to exclude the
        // smallest valid root label.
        //
        // It is possible to construct a valid message that has more compression pointers
        // than this, and still doesn't loop, by pointing to a previous pointer. This is
        // not something a well written implementation should ever do, so we leave them
        // to trip the maximum compression pointer check.
        maxCompressionPointers = (maxDomainNameWireOctets+1)/2 - 2

        // This is the maximum length of a domain name in presentation format. The
        // maximum wire length of a domain name is 255 octets (see above), with the
        // maximum label length being 63. The wire format requires one extra byte over
        // the presentation format, reducing the number of octets by 1. Each label in
        // the name will be separated by a single period, with each octet in the label
        // expanding to at most 4 bytes (\DDD). If all other labels are of the maximum
        // length, then the final label can only be 61 octets long to not exceed the
        // maximum allowed wire length.
        maxDomainNamePresentationLength = 61*4 + 1 + 63*4 + 1 + 63*4 + 1 + 63*4 + 1
)

// Errors defined in this package.
var (
        ErrAlg           error = &Error{err: "bad algorithm"}                  // ErrAlg indicates an error with the (DNSSEC) algorithm.
        ErrAuth          error = &Error{err: "bad authentication"}             // ErrAuth indicates an error in the TSIG authentication.
        ErrBuf           error = &Error{err: "buffer size too small"}          // ErrBuf indicates that the buffer used is too small for the message.
        ErrConnEmpty     error = &Error{err: "conn has no connection"}         // ErrConnEmpty indicates a connection is being used before it is initialized.
        ErrExtendedRcode error = &Error{err: "bad extended rcode"}             // ErrExtendedRcode ...
        ErrFqdn          error = &Error{err: "domain must be fully qualified"} // ErrFqdn indicates that a domain name does not have a closing dot.
        ErrId            error = &Error{err: "id mismatch"}                    // ErrId indicates there is a mismatch with the message's ID.
        ErrKeyAlg        error = &Error{err: "bad key algorithm"}              // ErrKeyAlg indicates that the algorithm in the key is not valid.
        ErrKey           error = &Error{err: "bad key"}
        ErrKeySize       error = &Error{err: "bad key size"}
        ErrLongDomain    error = &Error{err: fmt.Sprintf("domain name exceeded %d wire-format octets", maxDomainNameWireOctets)}
        ErrNoSig         error = &Error{err: "no signature found"}
        ErrPrivKey       error = &Error{err: "bad private key"}
        ErrRcode         error = &Error{err: "bad rcode"}
        ErrRdata         error = &Error{err: "bad rdata"}
        ErrRRset         error = &Error{err: "bad rrset"}
        ErrSecret        error = &Error{err: "no secrets defined"}
        ErrShortRead     error = &Error{err: "short read"}
        ErrSig           error = &Error{err: "bad signature"} // ErrSig indicates that a signature can not be cryptographically validated.
        ErrSoa           error = &Error{err: "no SOA"}        // ErrSOA indicates that no SOA RR was seen when doing zone transfers.
        ErrTime          error = &Error{err: "bad time"}      // ErrTime indicates a timing error in TSIG authentication.
)

// Id by default returns a 16-bit random number to be used as a message id. The
// number is drawn from a cryptographically secure random number generator.
// This being a variable the function can be reassigned to a custom function.
// For instance, to make it return a static value for testing:
//
//        dns.Id = func() uint16 { return 3 }
var Id = id

// id returns a 16 bits random number to be used as a
// message id. The random provided should be good enough.
func id() uint16 {
        var output uint16
        err := binary.Read(rand.Reader, binary.BigEndian, &output)
        if err != nil {
                panic("dns: reading random id failed: " + err.Error())
        }
        return output
}

// MsgHdr is a a manually-unpacked version of (id, bits).
type MsgHdr struct {
        Id                 uint16
        Response           bool
        Opcode             int
        Authoritative      bool
        Truncated          bool
        RecursionDesired   bool
        RecursionAvailable bool
        Zero               bool
        AuthenticatedData  bool
        CheckingDisabled   bool
        Rcode              int
}

// Msg contains the layout of a DNS message.
type Msg struct {
        MsgHdr
        Compress bool       `json:"-"` // If true, the message will be compressed when converted to wire format.
        Question []Question // Holds the RR(s) of the question section.
        Answer   []RR       // Holds the RR(s) of the answer section.
        Ns       []RR       // Holds the RR(s) of the authority section.
        Extra    []RR       // Holds the RR(s) of the additional section.
}

// ClassToString is a maps Classes to strings for each CLASS wire type.
var ClassToString = map[uint16]string{
        ClassINET:   "IN",
        ClassCSNET:  "CS",
        ClassCHAOS:  "CH",
        ClassHESIOD: "HS",
        ClassNONE:   "NONE",
        ClassANY:    "ANY",
}

// OpcodeToString maps Opcodes to strings.
var OpcodeToString = map[int]string{
        OpcodeQuery:  "QUERY",
        OpcodeIQuery: "IQUERY",
        OpcodeStatus: "STATUS",
        OpcodeNotify: "NOTIFY",
        OpcodeUpdate: "UPDATE",
}

// RcodeToString maps Rcodes to strings.
var RcodeToString = map[int]string{
        RcodeSuccess:        "NOERROR",
        RcodeFormatError:    "FORMERR",
        RcodeServerFailure:  "SERVFAIL",
        RcodeNameError:      "NXDOMAIN",
        RcodeNotImplemented: "NOTIMP",
        RcodeRefused:        "REFUSED",
        RcodeYXDomain:       "YXDOMAIN", // See RFC 2136
        RcodeYXRrset:        "YXRRSET",
        RcodeNXRrset:        "NXRRSET",
        RcodeNotAuth:        "NOTAUTH",
        RcodeNotZone:        "NOTZONE",
        RcodeBadSig:         "BADSIG", // Also known as RcodeBadVers, see RFC 6891
        //        RcodeBadVers:        "BADVERS",
        RcodeBadKey:    "BADKEY",
        RcodeBadTime:   "BADTIME",
        RcodeBadMode:   "BADMODE",
        RcodeBadName:   "BADNAME",
        RcodeBadAlg:    "BADALG",
        RcodeBadTrunc:  "BADTRUNC",
        RcodeBadCookie: "BADCOOKIE",
}

// compressionMap is used to allow a more efficient compression map
// to be used for internal packDomainName calls without changing the
// signature or functionality of public API.
//
// In particular, map[string]uint16 uses 25% less per-entry memory
// than does map[string]int.
type compressionMap struct {
        ext map[string]int    // external callers
        int map[string]uint16 // internal callers
}

func (m compressionMap) valid() bool {
        return m.int != nil || m.ext != nil
}

func (m compressionMap) insert(s string, pos int) {
        if m.ext != nil {
                m.ext[s] = pos
        } else {
                m.int[s] = uint16(pos)
        }
}

func (m compressionMap) find(s string) (int, bool) {
        if m.ext != nil {
                pos, ok := m.ext[s]
                return pos, ok
        }

        pos, ok := m.int[s]
        return int(pos), ok
}

// Domain names are a sequence of counted strings
// split at the dots. They end with a zero-length string.

// PackDomainName packs a domain name s into msg[off:].
// If compression is wanted compress must be true and the compression
// map needs to hold a mapping between domain names and offsets
// pointing into msg.
func PackDomainName(s string, msg []byte, off int, compression map[string]int, compress bool) (off1 int, err error) {
        return packDomainName(s, msg, off, compressionMap{ext: compression}, compress)
}

func packDomainName(s string, msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        // XXX: A logical copy of this function exists in IsDomainName and
        // should be kept in sync with this function.

        ls := len(s)
        if ls == 0 { // Ok, for instance when dealing with update RR without any rdata.
                return off, nil
        }

        // If not fully qualified, error out.
        if !IsFqdn(s) {
                return len(msg), ErrFqdn
        }

        // Each dot ends a segment of the name.
        // We trade each dot byte for a length byte.
        // Except for escaped dots (\.), which are normal dots.
        // There is also a trailing zero.

        // Compression
        pointer := -1

        // Emit sequence of counted strings, chopping at dots.
        var (
                begin     int
                compBegin int
                compOff   int
                bs        []byte
                wasDot    bool
        )
loop:
        for i := 0; i < ls; i++ {
                var c byte
                if bs == nil {
                        c = s[i]
                } else {
                        c = bs[i]
                }

                switch c {
                case '\\':
                        if off+1 > len(msg) {
                                return len(msg), ErrBuf
                        }

                        if bs == nil {
                                bs = []byte(s)
                        }

                        // check for \DDD
                        if isDDD(bs[i+1:]) {
                                bs[i] = dddToByte(bs[i+1:])
                                copy(bs[i+1:ls-3], bs[i+4:])
                                ls -= 3
                                compOff += 3
                        } else {
                                copy(bs[i:ls-1], bs[i+1:])
                                ls--
                                compOff++
                        }

                        wasDot = false
                case '.':
                        if i == 0 && len(s) > 1 {
                                // leading dots are not legal except for the root zone
                                return len(msg), ErrRdata
                        }

                        if wasDot {
                                // two dots back to back is not legal
                                return len(msg), ErrRdata
                        }
                        wasDot = true

                        labelLen := i - begin
                        if labelLen >= 1<<6 { // top two bits of length must be clear
                                return len(msg), ErrRdata
                        }

                        // off can already (we're in a loop) be bigger than len(msg)
                        // this happens when a name isn't fully qualified
                        if off+1+labelLen > len(msg) {
                                return len(msg), ErrBuf
                        }

                        // Don't try to compress '.'
                        // We should only compress when compress is true, but we should also still pick
                        // up names that can be used for *future* compression(s).
                        if compression.valid() && !isRootLabel(s, bs, begin, ls) {
                                if p, ok := compression.find(s[compBegin:]); ok {
                                        // The first hit is the longest matching dname
                                        // keep the pointer offset we get back and store
                                        // the offset of the current name, because that's
                                        // where we need to insert the pointer later

                                        // If compress is true, we're allowed to compress this dname
                                        if compress {
                                                pointer = p // Where to point to
                                                break loop
                                        }
                                } else if off < maxCompressionOffset {
                                        // Only offsets smaller than maxCompressionOffset can be used.
                                        compression.insert(s[compBegin:], off)
                                }
                        }

                        // The following is covered by the length check above.
                        msg[off] = byte(labelLen)

                        if bs == nil {
                                copy(msg[off+1:], s[begin:i])
                        } else {
                                copy(msg[off+1:], bs[begin:i])
                        }
                        off += 1 + labelLen

                        begin = i + 1
                        compBegin = begin + compOff
                default:
                        wasDot = false
                }
        }

        // Root label is special
        if isRootLabel(s, bs, 0, ls) {
                return off, nil
        }

        // If we did compression and we find something add the pointer here
        if pointer != -1 {
                // We have two bytes (14 bits) to put the pointer in
                binary.BigEndian.PutUint16(msg[off:], uint16(pointer^0xC000))
                return off + 2, nil
        }

        if off < len(msg) {
                msg[off] = 0
        }

        return off + 1, nil
}

// isRootLabel returns whether s or bs, from off to end, is the root
// label ".".
//
// If bs is nil, s will be checked, otherwise bs will be checked.
func isRootLabel(s string, bs []byte, off, end int) bool {
        if bs == nil {
                return s[off:end] == "."
        }

        return end-off == 1 && bs[off] == '.'
}

// Unpack a domain name.
// In addition to the simple sequences of counted strings above,
// domain names are allowed to refer to strings elsewhere in the
// packet, to avoid repeating common suffixes when returning
// many entries in a single domain.  The pointers are marked
// by a length byte with the top two bits set.  Ignoring those
// two bits, that byte and the next give a 14 bit offset from msg[0]
// where we should pick up the trail.
// Note that if we jump elsewhere in the packet,
// we return off1 == the offset after the first pointer we found,
// which is where the next record will start.
// In theory, the pointers are only allowed to jump backward.
// We let them jump anywhere and stop jumping after a while.

// UnpackDomainName unpacks a domain name into a string. It returns
// the name, the new offset into msg and any error that occurred.
//
// When an error is encountered, the unpacked name will be discarded
// and len(msg) will be returned as the offset.
func UnpackDomainName(msg []byte, off int) (string, int, error) {
        s := make([]byte, 0, maxDomainNamePresentationLength)
        off1 := 0
        lenmsg := len(msg)
        budget := maxDomainNameWireOctets
        ptr := 0 // number of pointers followed
Loop:
        for {
                if off >= lenmsg {
                        return "", lenmsg, ErrBuf
                }
                c := int(msg[off])
                off++
                switch c & 0xC0 {
                case 0x00:
                        if c == 0x00 {
                                // end of name
                                break Loop
                        }
                        // literal string
                        if off+c > lenmsg {
                                return "", lenmsg, ErrBuf
                        }
                        budget -= c + 1 // +1 for the label separator
                        if budget <= 0 {
                                return "", lenmsg, ErrLongDomain
                        }
                        for _, b := range msg[off : off+c] {
                                if isDomainNameLabelSpecial(b) {
                                        s = append(s, '\\', b)
                                } else if b < ' ' || b > '~' {
                                        s = append(s, escapeByte(b)...)
                                } else {
                                        s = append(s, b)
                                }
                        }
                        s = append(s, '.')
                        off += c
                case 0xC0:
                        // pointer to somewhere else in msg.
                        // remember location after first ptr,
                        // since that's how many bytes we consumed.
                        // also, don't follow too many pointers --
                        // maybe there's a loop.
                        if off >= lenmsg {
                                return "", lenmsg, ErrBuf
                        }
                        c1 := msg[off]
                        off++
                        if ptr == 0 {
                                off1 = off
                        }
                        if ptr++; ptr > maxCompressionPointers {
                                return "", lenmsg, &Error{err: "too many compression pointers"}
                        }
                        // pointer should guarantee that it advances and points forwards at least
                        // but the condition on previous three lines guarantees that it's
                        // at least loop-free
                        off = (c^0xC0)<<8 | int(c1)
                default:
                        // 0x80 and 0x40 are reserved
                        return "", lenmsg, ErrRdata
                }
        }
        if ptr == 0 {
                off1 = off
        }
        if len(s) == 0 {
                return ".", off1, nil
        }
        return string(s), off1, nil
}

func packTxt(txt []string, msg []byte, offset int) (int, error) {
        if len(txt) == 0 {
                if offset >= len(msg) {
                        return offset, ErrBuf
                }
                msg[offset] = 0
                return offset, nil
        }
        var err error
        for _, s := range txt {
                offset, err = packTxtString(s, msg, offset)
                if err != nil {
                        return offset, err
                }
        }
        return offset, nil
}

func packTxtString(s string, msg []byte, offset int) (int, error) {
        lenByteOffset := offset
        if offset >= len(msg) || len(s) > 256*4+1 /* If all \DDD */ {
                return offset, ErrBuf
        }
        offset++
        for i := 0; i < len(s); i++ {
                if len(msg) <= offset {
                        return offset, ErrBuf
                }
                if s[i] == '\\' {
                        i++
                        if i == len(s) {
                                break
                        }
                        // check for \DDD
                        if isDDD(s[i:]) {
                                msg[offset] = dddToByte(s[i:])
                                i += 2
                        } else {
                                msg[offset] = s[i]
                        }
                } else {
                        msg[offset] = s[i]
                }
                offset++
        }
        l := offset - lenByteOffset - 1
        if l > 255 {
                return offset, &Error{err: "string exceeded 255 bytes in txt"}
        }
        msg[lenByteOffset] = byte(l)
        return offset, nil
}

func packOctetString(s string, msg []byte, offset int) (int, error) {
        if offset >= len(msg) || len(s) > 256*4+1 {
                return offset, ErrBuf
        }
        for i := 0; i < len(s); i++ {
                if len(msg) <= offset {
                        return offset, ErrBuf
                }
                if s[i] == '\\' {
                        i++
                        if i == len(s) {
                                break
                        }
                        // check for \DDD
                        if isDDD(s[i:]) {
                                msg[offset] = dddToByte(s[i:])
                                i += 2
                        } else {
                                msg[offset] = s[i]
                        }
                } else {
                        msg[offset] = s[i]
                }
                offset++
        }
        return offset, nil
}

func unpackTxt(msg []byte, off0 int) (ss []string, off int, err error) {
        off = off0
        var s string
        for off < len(msg) && err == nil {
                s, off, err = unpackString(msg, off)
                if err == nil {
                        ss = append(ss, s)
                }
        }
        return
}

// Helpers for dealing with escaped bytes
func isDigit(b byte) bool { return b >= '0' && b <= '9' }

func isDDD[T ~[]byte | ~string](s T) bool {
        return len(s) >= 3 && isDigit(s[0]) && isDigit(s[1]) && isDigit(s[2])
}

func dddToByte[T ~[]byte | ~string](s T) byte {
        _ = s[2] // bounds check hint to compiler; see golang.org/issue/14808
        return byte((s[0]-'0')*100 + (s[1]-'0')*10 + (s[2] - '0'))
}

// Helper function for packing and unpacking
func intToBytes(i *big.Int, length int) []byte {
        buf := i.Bytes()
        if len(buf) < length {
                b := make([]byte, length)
                copy(b[length-len(buf):], buf)
                return b
        }
        return buf
}

// PackRR packs a resource record rr into msg[off:].
// See PackDomainName for documentation about the compression.
func PackRR(rr RR, msg []byte, off int, compression map[string]int, compress bool) (off1 int, err error) {
        headerEnd, off1, err := packRR(rr, msg, off, compressionMap{ext: compression}, compress)
        if err == nil {
                // packRR no longer sets the Rdlength field on the rr, but
                // callers might be expecting it so we set it here.
                rr.Header().Rdlength = uint16(off1 - headerEnd)
        }
        return off1, err
}

func packRR(rr RR, msg []byte, off int, compression compressionMap, compress bool) (headerEnd int, off1 int, err error) {
        if rr == nil {
                return len(msg), len(msg), &Error{err: "nil rr"}
        }

        headerEnd, err = rr.Header().packHeader(msg, off, compression, compress)
        if err != nil {
                return headerEnd, len(msg), err
        }

        off1, err = rr.pack(msg, headerEnd, compression, compress)
        if err != nil {
                return headerEnd, len(msg), err
        }

        rdlength := off1 - headerEnd
        if int(uint16(rdlength)) != rdlength { // overflow
                return headerEnd, len(msg), ErrRdata
        }

        // The RDLENGTH field is the last field in the header and we set it here.
        binary.BigEndian.PutUint16(msg[headerEnd-2:], uint16(rdlength))
        return headerEnd, off1, nil
}

// UnpackRR unpacks msg[off:] into an RR.
func UnpackRR(msg []byte, off int) (rr RR, off1 int, err error) {
        h, off, msg, err := unpackHeader(msg, off)
        if err != nil {
                return nil, len(msg), err
        }

        return UnpackRRWithHeader(h, msg, off)
}

// UnpackRRWithHeader unpacks the record type specific payload given an existing
// RR_Header.
func UnpackRRWithHeader(h RR_Header, msg []byte, off int) (rr RR, off1 int, err error) {
        if newFn, ok := TypeToRR[h.Rrtype]; ok {
                rr = newFn()
                *rr.Header() = h
        } else {
                rr = &RFC3597{Hdr: h}
        }

        if off < 0 || off > len(msg) {
                return &h, off, &Error{err: "bad off"}
        }

        end := off + int(h.Rdlength)
        if end < off || end > len(msg) {
                return &h, end, &Error{err: "bad rdlength"}
        }

        if noRdata(h) {
                return rr, off, nil
        }

        off, err = rr.unpack(msg, off)
        if err != nil {
                return nil, end, err
        }
        if off != end {
                return &h, end, &Error{err: "bad rdlength"}
        }

        return rr, off, nil
}

// unpackRRslice unpacks msg[off:] into an []RR.
// If we cannot unpack the whole array, then it will return nil
func unpackRRslice(l int, msg []byte, off int) (dst1 []RR, off1 int, err error) {
        var r RR
        // Don't pre-allocate, l may be under attacker control
        var dst []RR
        for i := 0; i < l; i++ {
                off1 := off
                r, off, err = UnpackRR(msg, off)
                if err != nil {
                        off = len(msg)
                        break
                }
                // If offset does not increase anymore, l is a lie
                if off1 == off {
                        break
                }
                dst = append(dst, r)
        }
        if err != nil && off == len(msg) {
                dst = nil
        }
        return dst, off, err
}

// Convert a MsgHdr to a string, with dig-like headers:
//
// ;; opcode: QUERY, status: NOERROR, id: 48404
//
// ;; flags: qr aa rd ra;
func (h *MsgHdr) String() string {
        if h == nil {
                return "<nil> MsgHdr"
        }

        s := ";; opcode: " + OpcodeToString[h.Opcode]
        s += ", status: " + RcodeToString[h.Rcode]
        s += ", id: " + strconv.Itoa(int(h.Id)) + "\n"

        s += ";; flags:"
        if h.Response {
                s += " qr"
        }
        if h.Authoritative {
                s += " aa"
        }
        if h.Truncated {
                s += " tc"
        }
        if h.RecursionDesired {
                s += " rd"
        }
        if h.RecursionAvailable {
                s += " ra"
        }
        if h.Zero { // Hmm
                s += " z"
        }
        if h.AuthenticatedData {
                s += " ad"
        }
        if h.CheckingDisabled {
                s += " cd"
        }

        s += ";"
        return s
}

// Pack packs a Msg: it is converted to wire format.
// If the dns.Compress is true the message will be in compressed wire format.
func (dns *Msg) Pack() (msg []byte, err error) {
        return dns.PackBuffer(nil)
}

// PackBuffer packs a Msg, using the given buffer buf. If buf is too small a new buffer is allocated.
func (dns *Msg) PackBuffer(buf []byte) (msg []byte, err error) {
        // If this message can't be compressed, avoid filling the
        // compression map and creating garbage.
        if dns.Compress && dns.isCompressible() {
                compression := make(map[string]uint16) // Compression pointer mappings.
                return dns.packBufferWithCompressionMap(buf, compressionMap{int: compression}, true)
        }

        return dns.packBufferWithCompressionMap(buf, compressionMap{}, false)
}

// packBufferWithCompressionMap packs a Msg, using the given buffer buf.
func (dns *Msg) packBufferWithCompressionMap(buf []byte, compression compressionMap, compress bool) (msg []byte, err error) {
        if dns.Rcode < 0 || dns.Rcode > 0xFFF {
                return nil, ErrRcode
        }

        // Set extended rcode unconditionally if we have an opt, this will allow
        // resetting the extended rcode bits if they need to.
        if opt := dns.IsEdns0(); opt != nil {
                opt.SetExtendedRcode(uint16(dns.Rcode))
        } else if dns.Rcode > 0xF {
                // If Rcode is an extended one and opt is nil, error out.
                return nil, ErrExtendedRcode
        }

        // Convert convenient Msg into wire-like Header.
        var dh Header
        dh.Id = dns.Id
        dh.Bits = uint16(dns.Opcode)<<11 | uint16(dns.Rcode&0xF)
        if dns.Response {
                dh.Bits |= _QR
        }
        if dns.Authoritative {
                dh.Bits |= _AA
        }
        if dns.Truncated {
                dh.Bits |= _TC
        }
        if dns.RecursionDesired {
                dh.Bits |= _RD
        }
        if dns.RecursionAvailable {
                dh.Bits |= _RA
        }
        if dns.Zero {
                dh.Bits |= _Z
        }
        if dns.AuthenticatedData {
                dh.Bits |= _AD
        }
        if dns.CheckingDisabled {
                dh.Bits |= _CD
        }

        dh.Qdcount = uint16(len(dns.Question))
        dh.Ancount = uint16(len(dns.Answer))
        dh.Nscount = uint16(len(dns.Ns))
        dh.Arcount = uint16(len(dns.Extra))

        // We need the uncompressed length here, because we first pack it and then compress it.
        msg = buf
        uncompressedLen := msgLenWithCompressionMap(dns, nil)
        if packLen := uncompressedLen + 1; len(msg) < packLen {
                msg = make([]byte, packLen)
        }

        // Pack it in: header and then the pieces.
        off := 0
        off, err = dh.pack(msg, off, compression, compress)
        if err != nil {
                return nil, err
        }
        for _, r := range dns.Question {
                off, err = r.pack(msg, off, compression, compress)
                if err != nil {
                        return nil, err
                }
        }
        for _, r := range dns.Answer {
                _, off, err = packRR(r, msg, off, compression, compress)
                if err != nil {
                        return nil, err
                }
        }
        for _, r := range dns.Ns {
                _, off, err = packRR(r, msg, off, compression, compress)
                if err != nil {
                        return nil, err
                }
        }
        for _, r := range dns.Extra {
                _, off, err = packRR(r, msg, off, compression, compress)
                if err != nil {
                        return nil, err
                }
        }
        return msg[:off], nil
}

func (dns *Msg) unpack(dh Header, msg []byte, off int) (err error) {
        // If we are at the end of the message we should return *just* the
        // header. This can still be useful to the caller. 9.9.9.9 sends these
        // when responding with REFUSED for instance.
        if off == len(msg) {
                // reset sections before returning
                dns.Question, dns.Answer, dns.Ns, dns.Extra = nil, nil, nil, nil
                return nil
        }

        // Qdcount, Ancount, Nscount, Arcount can't be trusted, as they are
        // attacker controlled. This means we can't use them to pre-allocate
        // slices.
        dns.Question = nil
        for i := 0; i < int(dh.Qdcount); i++ {
                off1 := off
                var q Question
                q, off, err = unpackQuestion(msg, off)
                if err != nil {
                        return err
                }
                if off1 == off { // Offset does not increase anymore, dh.Qdcount is a lie!
                        dh.Qdcount = uint16(i)
                        break
                }
                dns.Question = append(dns.Question, q)
        }

        dns.Answer, off, err = unpackRRslice(int(dh.Ancount), msg, off)
        // The header counts might have been wrong so we need to update it
        dh.Ancount = uint16(len(dns.Answer))
        if err == nil {
                dns.Ns, off, err = unpackRRslice(int(dh.Nscount), msg, off)
        }
        // The header counts might have been wrong so we need to update it
        dh.Nscount = uint16(len(dns.Ns))
        if err == nil {
                dns.Extra, _, err = unpackRRslice(int(dh.Arcount), msg, off)
        }
        // The header counts might have been wrong so we need to update it
        dh.Arcount = uint16(len(dns.Extra))

        // Set extended Rcode
        if opt := dns.IsEdns0(); opt != nil {
                dns.Rcode |= opt.ExtendedRcode()
        }

        // TODO(miek) make this an error?
        // use PackOpt to let people tell how detailed the error reporting should be?
        // if off != len(msg) {
        //         // println("dns: extra bytes in dns packet", off, "<", len(msg))
        // }
        return err

}

// Unpack unpacks a binary message to a Msg structure.
func (dns *Msg) Unpack(msg []byte) (err error) {
        dh, off, err := unpackMsgHdr(msg, 0)
        if err != nil {
                return err
        }

        dns.setHdr(dh)
        return dns.unpack(dh, msg, off)
}

// Convert a complete message to a string with dig-like output.
func (dns *Msg) String() string {
        if dns == nil {
                return "<nil> MsgHdr"
        }
        s := dns.MsgHdr.String() + " "
        if dns.MsgHdr.Opcode == OpcodeUpdate {
                s += "ZONE: " + strconv.Itoa(len(dns.Question)) + ", "
                s += "PREREQ: " + strconv.Itoa(len(dns.Answer)) + ", "
                s += "UPDATE: " + strconv.Itoa(len(dns.Ns)) + ", "
                s += "ADDITIONAL: " + strconv.Itoa(len(dns.Extra)) + "\n"
        } else {
                s += "QUERY: " + strconv.Itoa(len(dns.Question)) + ", "
                s += "ANSWER: " + strconv.Itoa(len(dns.Answer)) + ", "
                s += "AUTHORITY: " + strconv.Itoa(len(dns.Ns)) + ", "
                s += "ADDITIONAL: " + strconv.Itoa(len(dns.Extra)) + "\n"
        }
        opt := dns.IsEdns0()
        if opt != nil {
                // OPT PSEUDOSECTION
                s += opt.String() + "\n"
        }
        if len(dns.Question) > 0 {
                if dns.MsgHdr.Opcode == OpcodeUpdate {
                        s += "\n;; ZONE SECTION:\n"
                } else {
                        s += "\n;; QUESTION SECTION:\n"
                }
                for _, r := range dns.Question {
                        s += r.String() + "\n"
                }
        }
        if len(dns.Answer) > 0 {
                if dns.MsgHdr.Opcode == OpcodeUpdate {
                        s += "\n;; PREREQUISITE SECTION:\n"
                } else {
                        s += "\n;; ANSWER SECTION:\n"
                }
                for _, r := range dns.Answer {
                        if r != nil {
                                s += r.String() + "\n"
                        }
                }
        }
        if len(dns.Ns) > 0 {
                if dns.MsgHdr.Opcode == OpcodeUpdate {
                        s += "\n;; UPDATE SECTION:\n"
                } else {
                        s += "\n;; AUTHORITY SECTION:\n"
                }
                for _, r := range dns.Ns {
                        if r != nil {
                                s += r.String() + "\n"
                        }
                }
        }
        if len(dns.Extra) > 0 && (opt == nil || len(dns.Extra) > 1) {
                s += "\n;; ADDITIONAL SECTION:\n"
                for _, r := range dns.Extra {
                        if r != nil && r.Header().Rrtype != TypeOPT {
                                s += r.String() + "\n"
                        }
                }
        }
        return s
}

// isCompressible returns whether the msg may be compressible.
func (dns *Msg) isCompressible() bool {
        // If we only have one question, there is nothing we can ever compress.
        return len(dns.Question) > 1 || len(dns.Answer) > 0 ||
                len(dns.Ns) > 0 || len(dns.Extra) > 0
}

// Len returns the message length when in (un)compressed wire format.
// If dns.Compress is true compression it is taken into account. Len()
// is provided to be a faster way to get the size of the resulting packet,
// than packing it, measuring the size and discarding the buffer.
func (dns *Msg) Len() int {
        // If this message can't be compressed, avoid filling the
        // compression map and creating garbage.
        if dns.Compress && dns.isCompressible() {
                compression := make(map[string]struct{})
                return msgLenWithCompressionMap(dns, compression)
        }

        return msgLenWithCompressionMap(dns, nil)
}

func msgLenWithCompressionMap(dns *Msg, compression map[string]struct{}) int {
        l := headerSize

        for _, r := range dns.Question {
                l += r.len(l, compression)
        }
        for _, r := range dns.Answer {
                if r != nil {
                        l += r.len(l, compression)
                }
        }
        for _, r := range dns.Ns {
                if r != nil {
                        l += r.len(l, compression)
                }
        }
        for _, r := range dns.Extra {
                if r != nil {
                        l += r.len(l, compression)
                }
        }

        return l
}

func domainNameLen(s string, off int, compression map[string]struct{}, compress bool) int {
        if s == "" || s == "." {
                return 1
        }

        escaped := strings.Contains(s, "\\")

        if compression != nil && (compress || off < maxCompressionOffset) {
                // compressionLenSearch will insert the entry into the compression
                // map if it doesn't contain it.
                if l, ok := compressionLenSearch(compression, s, off); ok && compress {
                        if escaped {
                                return escapedNameLen(s[:l]) + 2
                        }

                        return l + 2
                }
        }

        if escaped {
                return escapedNameLen(s) + 1
        }

        return len(s) + 1
}

func escapedNameLen(s string) int {
        nameLen := len(s)
        for i := 0; i < len(s); i++ {
                if s[i] != '\\' {
                        continue
                }

                if isDDD(s[i+1:]) {
                        nameLen -= 3
                        i += 3
                } else {
                        nameLen--
                        i++
                }
        }

        return nameLen
}

func compressionLenSearch(c map[string]struct{}, s string, msgOff int) (int, bool) {
        for off, end := 0, false; !end; off, end = NextLabel(s, off) {
                if _, ok := c[s[off:]]; ok {
                        return off, true
                }

                if msgOff+off < maxCompressionOffset {
                        c[s[off:]] = struct{}{}
                }
        }

        return 0, false
}

// Copy returns a new RR which is a deep-copy of r.
func Copy(r RR) RR { return r.copy() }

// Len returns the length (in octets) of the uncompressed RR in wire format.
func Len(r RR) int { return r.len(0, nil) }

// Copy returns a new *Msg which is a deep-copy of dns.
func (dns *Msg) Copy() *Msg { return dns.CopyTo(new(Msg)) }

// CopyTo copies the contents to the provided message using a deep-copy and returns the copy.
func (dns *Msg) CopyTo(r1 *Msg) *Msg {
        r1.MsgHdr = dns.MsgHdr
        r1.Compress = dns.Compress

        if len(dns.Question) > 0 {
                // TODO(miek): Question is an immutable value, ok to do a shallow-copy
                r1.Question = cloneSlice(dns.Question)
        }

        rrArr := make([]RR, len(dns.Answer)+len(dns.Ns)+len(dns.Extra))
        r1.Answer, rrArr = rrArr[:0:len(dns.Answer)], rrArr[len(dns.Answer):]
        r1.Ns, rrArr = rrArr[:0:len(dns.Ns)], rrArr[len(dns.Ns):]
        r1.Extra = rrArr[:0:len(dns.Extra)]

        for _, r := range dns.Answer {
                r1.Answer = append(r1.Answer, r.copy())
        }

        for _, r := range dns.Ns {
                r1.Ns = append(r1.Ns, r.copy())
        }

        for _, r := range dns.Extra {
                r1.Extra = append(r1.Extra, r.copy())
        }

        return r1
}

func (q *Question) pack(msg []byte, off int, compression compressionMap, compress bool) (int, error) {
        off, err := packDomainName(q.Name, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        off, err = packUint16(q.Qtype, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(q.Qclass, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func unpackQuestion(msg []byte, off int) (Question, int, error) {
        var (
                q   Question
                err error
        )
        q.Name, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return q, off, err
        }
        if off == len(msg) {
                return q, off, nil
        }
        q.Qtype, off, err = unpackUint16(msg, off)
        if err != nil {
                return q, off, err
        }
        if off == len(msg) {
                return q, off, nil
        }
        q.Qclass, off, err = unpackUint16(msg, off)
        if off == len(msg) {
                return q, off, nil
        }
        return q, off, err
}

func (dh *Header) pack(msg []byte, off int, compression compressionMap, compress bool) (int, error) {
        off, err := packUint16(dh.Id, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(dh.Bits, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(dh.Qdcount, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(dh.Ancount, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(dh.Nscount, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(dh.Arcount, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func unpackMsgHdr(msg []byte, off int) (Header, int, error) {
        var (
                dh  Header
                err error
        )
        dh.Id, off, err = unpackUint16(msg, off)
        if err != nil {
                return dh, off, err
        }
        dh.Bits, off, err = unpackUint16(msg, off)
        if err != nil {
                return dh, off, err
        }
        dh.Qdcount, off, err = unpackUint16(msg, off)
        if err != nil {
                return dh, off, err
        }
        dh.Ancount, off, err = unpackUint16(msg, off)
        if err != nil {
                return dh, off, err
        }
        dh.Nscount, off, err = unpackUint16(msg, off)
        if err != nil {
                return dh, off, err
        }
        dh.Arcount, off, err = unpackUint16(msg, off)
        if err != nil {
                return dh, off, err
        }
        return dh, off, nil
}

// setHdr set the header in the dns using the binary data in dh.
func (dns *Msg) setHdr(dh Header) {
        dns.Id = dh.Id
        dns.Response = dh.Bits&_QR != 0
        dns.Opcode = int(dh.Bits>>11) & 0xF
        dns.Authoritative = dh.Bits&_AA != 0
        dns.Truncated = dh.Bits&_TC != 0
        dns.RecursionDesired = dh.Bits&_RD != 0
        dns.RecursionAvailable = dh.Bits&_RA != 0
        dns.Zero = dh.Bits&_Z != 0 // _Z covers the zero bit, which should be zero; not sure why we set it to the opposite.
        dns.AuthenticatedData = dh.Bits&_AD != 0
        dns.CheckingDisabled = dh.Bits&_CD != 0
        dns.Rcode = int(dh.Bits & 0xF)
}

package dns

import (
        "encoding/base32"
        "encoding/base64"
        "encoding/binary"
        "encoding/hex"
        "net"
        "sort"
        "strings"
)

// helper functions called from the generated zmsg.go

// These function are named after the tag to help pack/unpack, if there is no tag it is the name
// of the type they pack/unpack (string, int, etc). We prefix all with unpackData or packData, so packDataA or
// packDataDomainName.

func unpackDataA(msg []byte, off int) (net.IP, int, error) {
        if off+net.IPv4len > len(msg) {
                return nil, len(msg), &Error{err: "overflow unpacking a"}
        }
        return cloneSlice(msg[off : off+net.IPv4len]), off + net.IPv4len, nil
}

func packDataA(a net.IP, msg []byte, off int) (int, error) {
        switch len(a) {
        case net.IPv4len, net.IPv6len:
                // It must be a slice of 4, even if it is 16, we encode only the first 4
                if off+net.IPv4len > len(msg) {
                        return len(msg), &Error{err: "overflow packing a"}
                }

                copy(msg[off:], a.To4())
                off += net.IPv4len
        case 0:
                // Allowed, for dynamic updates.
        default:
                return len(msg), &Error{err: "overflow packing a"}
        }
        return off, nil
}

func unpackDataAAAA(msg []byte, off int) (net.IP, int, error) {
        if off+net.IPv6len > len(msg) {
                return nil, len(msg), &Error{err: "overflow unpacking aaaa"}
        }
        return cloneSlice(msg[off : off+net.IPv6len]), off + net.IPv6len, nil
}

func packDataAAAA(aaaa net.IP, msg []byte, off int) (int, error) {
        switch len(aaaa) {
        case net.IPv6len:
                if off+net.IPv6len > len(msg) {
                        return len(msg), &Error{err: "overflow packing aaaa"}
                }

                copy(msg[off:], aaaa)
                off += net.IPv6len
        case 0:
                // Allowed, dynamic updates.
        default:
                return len(msg), &Error{err: "overflow packing aaaa"}
        }
        return off, nil
}

// unpackHeader unpacks an RR header, returning the offset to the end of the header and a
// re-sliced msg according to the expected length of the RR.
func unpackHeader(msg []byte, off int) (rr RR_Header, off1 int, truncmsg []byte, err error) {
        hdr := RR_Header{}
        if off == len(msg) {
                return hdr, off, msg, nil
        }

        hdr.Name, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return hdr, len(msg), msg, err
        }
        hdr.Rrtype, off, err = unpackUint16(msg, off)
        if err != nil {
                return hdr, len(msg), msg, err
        }
        hdr.Class, off, err = unpackUint16(msg, off)
        if err != nil {
                return hdr, len(msg), msg, err
        }
        hdr.Ttl, off, err = unpackUint32(msg, off)
        if err != nil {
                return hdr, len(msg), msg, err
        }
        hdr.Rdlength, off, err = unpackUint16(msg, off)
        if err != nil {
                return hdr, len(msg), msg, err
        }
        msg, err = truncateMsgFromRdlength(msg, off, hdr.Rdlength)
        return hdr, off, msg, err
}

// packHeader packs an RR header, returning the offset to the end of the header.
// See PackDomainName for documentation about the compression.
func (hdr RR_Header) packHeader(msg []byte, off int, compression compressionMap, compress bool) (int, error) {
        if off == len(msg) {
                return off, nil
        }

        off, err := packDomainName(hdr.Name, msg, off, compression, compress)
        if err != nil {
                return len(msg), err
        }
        off, err = packUint16(hdr.Rrtype, msg, off)
        if err != nil {
                return len(msg), err
        }
        off, err = packUint16(hdr.Class, msg, off)
        if err != nil {
                return len(msg), err
        }
        off, err = packUint32(hdr.Ttl, msg, off)
        if err != nil {
                return len(msg), err
        }
        off, err = packUint16(0, msg, off) // The RDLENGTH field will be set later in packRR.
        if err != nil {
                return len(msg), err
        }
        return off, nil
}

// helper helper functions.

// truncateMsgFromRdLength truncates msg to match the expected length of the RR.
// Returns an error if msg is smaller than the expected size.
func truncateMsgFromRdlength(msg []byte, off int, rdlength uint16) (truncmsg []byte, err error) {
        lenrd := off + int(rdlength)
        if lenrd > len(msg) {
                return msg, &Error{err: "overflowing header size"}
        }
        return msg[:lenrd], nil
}

var base32HexNoPadEncoding = base32.HexEncoding.WithPadding(base32.NoPadding)

func fromBase32(s []byte) (buf []byte, err error) {
        for i, b := range s {
                if b >= 'a' && b <= 'z' {
                        s[i] = b - 32
                }
        }
        buflen := base32HexNoPadEncoding.DecodedLen(len(s))
        buf = make([]byte, buflen)
        n, err := base32HexNoPadEncoding.Decode(buf, s)
        buf = buf[:n]
        return
}

func toBase32(b []byte) string {
        return base32HexNoPadEncoding.EncodeToString(b)
}

func fromBase64(s []byte) (buf []byte, err error) {
        buflen := base64.StdEncoding.DecodedLen(len(s))
        buf = make([]byte, buflen)
        n, err := base64.StdEncoding.Decode(buf, s)
        buf = buf[:n]
        return
}

func toBase64(b []byte) string { return base64.StdEncoding.EncodeToString(b) }

// dynamicUpdate returns true if the Rdlength is zero.
func noRdata(h RR_Header) bool { return h.Rdlength == 0 }

func unpackUint8(msg []byte, off int) (i uint8, off1 int, err error) {
        if off+1 > len(msg) {
                return 0, len(msg), &Error{err: "overflow unpacking uint8"}
        }
        return msg[off], off + 1, nil
}

func packUint8(i uint8, msg []byte, off int) (off1 int, err error) {
        if off+1 > len(msg) {
                return len(msg), &Error{err: "overflow packing uint8"}
        }
        msg[off] = i
        return off + 1, nil
}

func unpackUint16(msg []byte, off int) (i uint16, off1 int, err error) {
        if off+2 > len(msg) {
                return 0, len(msg), &Error{err: "overflow unpacking uint16"}
        }
        return binary.BigEndian.Uint16(msg[off:]), off + 2, nil
}

func packUint16(i uint16, msg []byte, off int) (off1 int, err error) {
        if off+2 > len(msg) {
                return len(msg), &Error{err: "overflow packing uint16"}
        }
        binary.BigEndian.PutUint16(msg[off:], i)
        return off + 2, nil
}

func unpackUint32(msg []byte, off int) (i uint32, off1 int, err error) {
        if off+4 > len(msg) {
                return 0, len(msg), &Error{err: "overflow unpacking uint32"}
        }
        return binary.BigEndian.Uint32(msg[off:]), off + 4, nil
}

func packUint32(i uint32, msg []byte, off int) (off1 int, err error) {
        if off+4 > len(msg) {
                return len(msg), &Error{err: "overflow packing uint32"}
        }
        binary.BigEndian.PutUint32(msg[off:], i)
        return off + 4, nil
}

func unpackUint48(msg []byte, off int) (i uint64, off1 int, err error) {
        if off+6 > len(msg) {
                return 0, len(msg), &Error{err: "overflow unpacking uint64 as uint48"}
        }
        // Used in TSIG where the last 48 bits are occupied, so for now, assume a uint48 (6 bytes)
        i = uint64(msg[off])<<40 | uint64(msg[off+1])<<32 | uint64(msg[off+2])<<24 | uint64(msg[off+3])<<16 |
                uint64(msg[off+4])<<8 | uint64(msg[off+5])
        off += 6
        return i, off, nil
}

func packUint48(i uint64, msg []byte, off int) (off1 int, err error) {
        if off+6 > len(msg) {
                return len(msg), &Error{err: "overflow packing uint64 as uint48"}
        }
        msg[off] = byte(i >> 40)
        msg[off+1] = byte(i >> 32)
        msg[off+2] = byte(i >> 24)
        msg[off+3] = byte(i >> 16)
        msg[off+4] = byte(i >> 8)
        msg[off+5] = byte(i)
        off += 6
        return off, nil
}

func unpackUint64(msg []byte, off int) (i uint64, off1 int, err error) {
        if off+8 > len(msg) {
                return 0, len(msg), &Error{err: "overflow unpacking uint64"}
        }
        return binary.BigEndian.Uint64(msg[off:]), off + 8, nil
}

func packUint64(i uint64, msg []byte, off int) (off1 int, err error) {
        if off+8 > len(msg) {
                return len(msg), &Error{err: "overflow packing uint64"}
        }
        binary.BigEndian.PutUint64(msg[off:], i)
        off += 8
        return off, nil
}

func unpackString(msg []byte, off int) (string, int, error) {
        if off+1 > len(msg) {
                return "", off, &Error{err: "overflow unpacking txt"}
        }
        l := int(msg[off])
        off++
        if off+l > len(msg) {
                return "", off, &Error{err: "overflow unpacking txt"}
        }
        var s strings.Builder
        consumed := 0
        for i, b := range msg[off : off+l] {
                switch {
                case b == '"' || b == '\\':
                        if consumed == 0 {
                                s.Grow(l * 2)
                        }
                        s.Write(msg[off+consumed : off+i])
                        s.WriteByte('\\')
                        s.WriteByte(b)
                        consumed = i + 1
                case b < ' ' || b > '~': // unprintable
                        if consumed == 0 {
                                s.Grow(l * 2)
                        }
                        s.Write(msg[off+consumed : off+i])
                        s.WriteString(escapeByte(b))
                        consumed = i + 1
                }
        }
        if consumed == 0 { // no escaping needed
                return string(msg[off : off+l]), off + l, nil
        }
        s.Write(msg[off+consumed : off+l])
        return s.String(), off + l, nil
}

func packString(s string, msg []byte, off int) (int, error) {
        off, err := packTxtString(s, msg, off)
        if err != nil {
                return len(msg), err
        }
        return off, nil
}

func unpackStringBase32(msg []byte, off, end int) (string, int, error) {
        if end > len(msg) {
                return "", len(msg), &Error{err: "overflow unpacking base32"}
        }
        s := toBase32(msg[off:end])
        return s, end, nil
}

func packStringBase32(s string, msg []byte, off int) (int, error) {
        b32, err := fromBase32([]byte(s))
        if err != nil {
                return len(msg), err
        }
        if off+len(b32) > len(msg) {
                return len(msg), &Error{err: "overflow packing base32"}
        }
        copy(msg[off:off+len(b32)], b32)
        off += len(b32)
        return off, nil
}

func unpackStringBase64(msg []byte, off, end int) (string, int, error) {
        // Rest of the RR is base64 encoded value, so we don't need an explicit length
        // to be set. Thus far all RR's that have base64 encoded fields have those as their
        // last one. What we do need is the end of the RR!
        if end > len(msg) {
                return "", len(msg), &Error{err: "overflow unpacking base64"}
        }
        s := toBase64(msg[off:end])
        return s, end, nil
}

func packStringBase64(s string, msg []byte, off int) (int, error) {
        b64, err := fromBase64([]byte(s))
        if err != nil {
                return len(msg), err
        }
        if off+len(b64) > len(msg) {
                return len(msg), &Error{err: "overflow packing base64"}
        }
        copy(msg[off:off+len(b64)], b64)
        off += len(b64)
        return off, nil
}

func unpackStringHex(msg []byte, off, end int) (string, int, error) {
        // Rest of the RR is hex encoded value, so we don't need an explicit length
        // to be set. NSEC and TSIG have hex fields with a length field.
        // What we do need is the end of the RR!
        if end > len(msg) {
                return "", len(msg), &Error{err: "overflow unpacking hex"}
        }

        s := hex.EncodeToString(msg[off:end])
        return s, end, nil
}

func packStringHex(s string, msg []byte, off int) (int, error) {
        h, err := hex.DecodeString(s)
        if err != nil {
                return len(msg), err
        }
        if off+len(h) > len(msg) {
                return len(msg), &Error{err: "overflow packing hex"}
        }
        copy(msg[off:off+len(h)], h)
        off += len(h)
        return off, nil
}

func unpackStringAny(msg []byte, off, end int) (string, int, error) {
        if end > len(msg) {
                return "", len(msg), &Error{err: "overflow unpacking anything"}
        }
        return string(msg[off:end]), end, nil
}

func packStringAny(s string, msg []byte, off int) (int, error) {
        if off+len(s) > len(msg) {
                return len(msg), &Error{err: "overflow packing anything"}
        }
        copy(msg[off:off+len(s)], s)
        off += len(s)
        return off, nil
}

func unpackStringTxt(msg []byte, off int) ([]string, int, error) {
        txt, off, err := unpackTxt(msg, off)
        if err != nil {
                return nil, len(msg), err
        }
        return txt, off, nil
}

func packStringTxt(s []string, msg []byte, off int) (int, error) {
        off, err := packTxt(s, msg, off)
        if err != nil {
                return len(msg), err
        }
        return off, nil
}

func unpackDataOpt(msg []byte, off int) ([]EDNS0, int, error) {
        var edns []EDNS0
        for off < len(msg) {
                if off+4 > len(msg) {
                        return nil, len(msg), &Error{err: "overflow unpacking opt"}
                }
                code := binary.BigEndian.Uint16(msg[off:])
                off += 2
                optlen := binary.BigEndian.Uint16(msg[off:])
                off += 2
                if off+int(optlen) > len(msg) {
                        return nil, len(msg), &Error{err: "overflow unpacking opt"}
                }
                opt := makeDataOpt(code)
                if err := opt.unpack(msg[off : off+int(optlen)]); err != nil {
                        return nil, len(msg), err
                }
                edns = append(edns, opt)
                off += int(optlen)
        }
        return edns, off, nil
}

func packDataOpt(options []EDNS0, msg []byte, off int) (int, error) {
        for _, el := range options {
                b, err := el.pack()
                if err != nil || off+4 > len(msg) {
                        return len(msg), &Error{err: "overflow packing opt"}
                }
                binary.BigEndian.PutUint16(msg[off:], el.Option())      // Option code
                binary.BigEndian.PutUint16(msg[off+2:], uint16(len(b))) // Length
                off += 4
                if off+len(b) > len(msg) {
                        return len(msg), &Error{err: "overflow packing opt"}
                }
                // Actual data
                copy(msg[off:off+len(b)], b)
                off += len(b)
        }
        return off, nil
}

func unpackStringOctet(msg []byte, off int) (string, int, error) {
        s := string(msg[off:])
        return s, len(msg), nil
}

func packStringOctet(s string, msg []byte, off int) (int, error) {
        off, err := packOctetString(s, msg, off)
        if err != nil {
                return len(msg), err
        }
        return off, nil
}

func unpackDataNsec(msg []byte, off int) ([]uint16, int, error) {
        var nsec []uint16
        length, window, lastwindow := 0, 0, -1
        for off < len(msg) {
                if off+2 > len(msg) {
                        return nsec, len(msg), &Error{err: "overflow unpacking NSEC(3)"}
                }
                window = int(msg[off])
                length = int(msg[off+1])
                off += 2
                if window <= lastwindow {
                        // RFC 4034: Blocks are present in the NSEC RR RDATA in
                        // increasing numerical order.
                        return nsec, len(msg), &Error{err: "out of order NSEC(3) block in type bitmap"}
                }
                if length == 0 {
                        // RFC 4034: Blocks with no types present MUST NOT be included.
                        return nsec, len(msg), &Error{err: "empty NSEC(3) block in type bitmap"}
                }
                if length > 32 {
                        return nsec, len(msg), &Error{err: "NSEC(3) block too long in type bitmap"}
                }
                if off+length > len(msg) {
                        return nsec, len(msg), &Error{err: "overflowing NSEC(3) block in type bitmap"}
                }

                // Walk the bytes in the window and extract the type bits
                for j, b := range msg[off : off+length] {
                        // Check the bits one by one, and set the type
                        if b&0x80 == 0x80 {
                                nsec = append(nsec, uint16(window*256+j*8+0))
                        }
                        if b&0x40 == 0x40 {
                                nsec = append(nsec, uint16(window*256+j*8+1))
                        }
                        if b&0x20 == 0x20 {
                                nsec = append(nsec, uint16(window*256+j*8+2))
                        }
                        if b&0x10 == 0x10 {
                                nsec = append(nsec, uint16(window*256+j*8+3))
                        }
                        if b&0x8 == 0x8 {
                                nsec = append(nsec, uint16(window*256+j*8+4))
                        }
                        if b&0x4 == 0x4 {
                                nsec = append(nsec, uint16(window*256+j*8+5))
                        }
                        if b&0x2 == 0x2 {
                                nsec = append(nsec, uint16(window*256+j*8+6))
                        }
                        if b&0x1 == 0x1 {
                                nsec = append(nsec, uint16(window*256+j*8+7))
                        }
                }
                off += length
                lastwindow = window
        }
        return nsec, off, nil
}

// typeBitMapLen is a helper function which computes the "maximum" length of
// a the NSEC Type BitMap field.
func typeBitMapLen(bitmap []uint16) int {
        var l int
        var lastwindow, lastlength uint16
        for _, t := range bitmap {
                window := t / 256
                length := (t-window*256)/8 + 1
                if window > lastwindow && lastlength != 0 { // New window, jump to the new offset
                        l += int(lastlength) + 2
                        lastlength = 0
                }
                if window < lastwindow || length < lastlength {
                        // packDataNsec would return Error{err: "nsec bits out of order"} here, but
                        // when computing the length, we want do be liberal.
                        continue
                }
                lastwindow, lastlength = window, length
        }
        l += int(lastlength) + 2
        return l
}

func packDataNsec(bitmap []uint16, msg []byte, off int) (int, error) {
        if len(bitmap) == 0 {
                return off, nil
        }
        if off > len(msg) {
                return off, &Error{err: "overflow packing nsec"}
        }
        toZero := msg[off:]
        if maxLen := typeBitMapLen(bitmap); maxLen < len(toZero) {
                toZero = toZero[:maxLen]
        }
        for i := range toZero {
                toZero[i] = 0
        }
        var lastwindow, lastlength uint16
        for _, t := range bitmap {
                window := t / 256
                length := (t-window*256)/8 + 1
                if window > lastwindow && lastlength != 0 { // New window, jump to the new offset
                        off += int(lastlength) + 2
                        lastlength = 0
                }
                if window < lastwindow || length < lastlength {
                        return len(msg), &Error{err: "nsec bits out of order"}
                }
                if off+2+int(length) > len(msg) {
                        return len(msg), &Error{err: "overflow packing nsec"}
                }
                // Setting the window #
                msg[off] = byte(window)
                // Setting the octets length
                msg[off+1] = byte(length)
                // Setting the bit value for the type in the right octet
                msg[off+1+int(length)] |= byte(1 << (7 - t%8))
                lastwindow, lastlength = window, length
        }
        off += int(lastlength) + 2
        return off, nil
}

func unpackDataSVCB(msg []byte, off int) ([]SVCBKeyValue, int, error) {
        var xs []SVCBKeyValue
        var code uint16
        var length uint16
        var err error
        for off < len(msg) {
                code, off, err = unpackUint16(msg, off)
                if err != nil {
                        return nil, len(msg), &Error{err: "overflow unpacking SVCB"}
                }
                length, off, err = unpackUint16(msg, off)
                if err != nil || off+int(length) > len(msg) {
                        return nil, len(msg), &Error{err: "overflow unpacking SVCB"}
                }
                e := makeSVCBKeyValue(SVCBKey(code))
                if e == nil {
                        return nil, len(msg), &Error{err: "bad SVCB key"}
                }
                if err := e.unpack(msg[off : off+int(length)]); err != nil {
                        return nil, len(msg), err
                }
                if len(xs) > 0 && e.Key() <= xs[len(xs)-1].Key() {
                        return nil, len(msg), &Error{err: "SVCB keys not in strictly increasing order"}
                }
                xs = append(xs, e)
                off += int(length)
        }
        return xs, off, nil
}

func packDataSVCB(pairs []SVCBKeyValue, msg []byte, off int) (int, error) {
        pairs = cloneSlice(pairs)
        sort.Slice(pairs, func(i, j int) bool {
                return pairs[i].Key() < pairs[j].Key()
        })
        prev := svcb_RESERVED
        for _, el := range pairs {
                if el.Key() == prev {
                        return len(msg), &Error{err: "repeated SVCB keys are not allowed"}
                }
                prev = el.Key()
                packed, err := el.pack()
                if err != nil {
                        return len(msg), err
                }
                off, err = packUint16(uint16(el.Key()), msg, off)
                if err != nil {
                        return len(msg), &Error{err: "overflow packing SVCB"}
                }
                off, err = packUint16(uint16(len(packed)), msg, off)
                if err != nil || off+len(packed) > len(msg) {
                        return len(msg), &Error{err: "overflow packing SVCB"}
                }
                copy(msg[off:off+len(packed)], packed)
                off += len(packed)
        }
        return off, nil
}

func unpackDataDomainNames(msg []byte, off, end int) ([]string, int, error) {
        var (
                servers []string
                s       string
                err     error
        )
        if end > len(msg) {
                return nil, len(msg), &Error{err: "overflow unpacking domain names"}
        }
        for off < end {
                s, off, err = UnpackDomainName(msg, off)
                if err != nil {
                        return servers, len(msg), err
                }
                servers = append(servers, s)
        }
        return servers, off, nil
}

func packDataDomainNames(names []string, msg []byte, off int, compression compressionMap, compress bool) (int, error) {
        var err error
        for _, name := range names {
                off, err = packDomainName(name, msg, off, compression, compress)
                if err != nil {
                        return len(msg), err
                }
        }
        return off, nil
}

func packDataApl(data []APLPrefix, msg []byte, off int) (int, error) {
        var err error
        for i := range data {
                off, err = packDataAplPrefix(&data[i], msg, off)
                if err != nil {
                        return len(msg), err
                }
        }
        return off, nil
}

func packDataAplPrefix(p *APLPrefix, msg []byte, off int) (int, error) {
        if len(p.Network.IP) != len(p.Network.Mask) {
                return len(msg), &Error{err: "address and mask lengths don't match"}
        }

        var err error
        prefix, _ := p.Network.Mask.Size()
        addr := p.Network.IP.Mask(p.Network.Mask)[:(prefix+7)/8]

        switch len(p.Network.IP) {
        case net.IPv4len:
                off, err = packUint16(1, msg, off)
        case net.IPv6len:
                off, err = packUint16(2, msg, off)
        default:
                err = &Error{err: "unrecognized address family"}
        }
        if err != nil {
                return len(msg), err
        }

        off, err = packUint8(uint8(prefix), msg, off)
        if err != nil {
                return len(msg), err
        }

        var n uint8
        if p.Negation {
                n = 0x80
        }

        // trim trailing zero bytes as specified in RFC3123 Sections 4.1 and 4.2.
        i := len(addr) - 1
        for ; i >= 0 && addr[i] == 0; i-- {
        }
        addr = addr[:i+1]

        adflen := uint8(len(addr)) & 0x7f
        off, err = packUint8(n|adflen, msg, off)
        if err != nil {
                return len(msg), err
        }

        if off+len(addr) > len(msg) {
                return len(msg), &Error{err: "overflow packing APL prefix"}
        }
        off += copy(msg[off:], addr)

        return off, nil
}

func unpackDataApl(msg []byte, off int) ([]APLPrefix, int, error) {
        var result []APLPrefix
        for off < len(msg) {
                prefix, end, err := unpackDataAplPrefix(msg, off)
                if err != nil {
                        return nil, len(msg), err
                }
                off = end
                result = append(result, prefix)
        }
        return result, off, nil
}

func unpackDataAplPrefix(msg []byte, off int) (APLPrefix, int, error) {
        family, off, err := unpackUint16(msg, off)
        if err != nil {
                return APLPrefix{}, len(msg), &Error{err: "overflow unpacking APL prefix"}
        }
        prefix, off, err := unpackUint8(msg, off)
        if err != nil {
                return APLPrefix{}, len(msg), &Error{err: "overflow unpacking APL prefix"}
        }
        nlen, off, err := unpackUint8(msg, off)
        if err != nil {
                return APLPrefix{}, len(msg), &Error{err: "overflow unpacking APL prefix"}
        }

        var ip []byte
        switch family {
        case 1:
                ip = make([]byte, net.IPv4len)
        case 2:
                ip = make([]byte, net.IPv6len)
        default:
                return APLPrefix{}, len(msg), &Error{err: "unrecognized APL address family"}
        }
        if int(prefix) > 8*len(ip) {
                return APLPrefix{}, len(msg), &Error{err: "APL prefix too long"}
        }
        afdlen := int(nlen & 0x7f)
        if afdlen > len(ip) {
                return APLPrefix{}, len(msg), &Error{err: "APL length too long"}
        }
        if off+afdlen > len(msg) {
                return APLPrefix{}, len(msg), &Error{err: "overflow unpacking APL address"}
        }

        // Address MUST NOT contain trailing zero bytes per RFC3123 Sections 4.1 and 4.2.
        off += copy(ip, msg[off:off+afdlen])
        if afdlen > 0 {
                last := ip[afdlen-1]
                if last == 0 {
                        return APLPrefix{}, len(msg), &Error{err: "extra APL address bits"}
                }
        }
        ipnet := net.IPNet{
                IP:   ip,
                Mask: net.CIDRMask(int(prefix), 8*len(ip)),
        }

        return APLPrefix{
                Negation: (nlen & 0x80) != 0,
                Network:  ipnet,
        }, off, nil
}

func unpackIPSECGateway(msg []byte, off int, gatewayType uint8) (net.IP, string, int, error) {
        var retAddr net.IP
        var retString string
        var err error

        switch gatewayType {
        case IPSECGatewayNone: // do nothing
        case IPSECGatewayIPv4:
                retAddr, off, err = unpackDataA(msg, off)
        case IPSECGatewayIPv6:
                retAddr, off, err = unpackDataAAAA(msg, off)
        case IPSECGatewayHost:
                retString, off, err = UnpackDomainName(msg, off)
        }

        return retAddr, retString, off, err
}

func packIPSECGateway(gatewayAddr net.IP, gatewayString string, msg []byte, off int, gatewayType uint8, compression compressionMap, compress bool) (int, error) {
        var err error

        switch gatewayType {
        case IPSECGatewayNone: // do nothing
        case IPSECGatewayIPv4:
                off, err = packDataA(gatewayAddr, msg, off)
        case IPSECGatewayIPv6:
                off, err = packDataAAAA(gatewayAddr, msg, off)
        case IPSECGatewayHost:
                off, err = packDomainName(gatewayString, msg, off, compression, compress)
        }

        return off, err
}

package dns

// Truncate ensures the reply message will fit into the requested buffer
// size by removing records that exceed the requested size.
//
// It will first check if the reply fits without compression and then with
// compression. If it won't fit with compression, Truncate then walks the
// record adding as many records as possible without exceeding the
// requested buffer size.
//
// If the message fits within the requested size without compression,
// Truncate will set the message's Compress attribute to false. It is
// the caller's responsibility to set it back to true if they wish to
// compress the payload regardless of size.
//
// The TC bit will be set if any records were excluded from the message.
// If the TC bit is already set on the message it will be retained.
// TC indicates that the client should retry over TCP.
//
// According to RFC 2181, the TC bit should only be set if not all of the
// "required" RRs can be included in the response. Unfortunately, we have
// no way of knowing which RRs are required so we set the TC bit if any RR
// had to be omitted from the response.
//
// The appropriate buffer size can be retrieved from the requests OPT
// record, if present, and is transport specific otherwise. dns.MinMsgSize
// should be used for UDP requests without an OPT record, and
// dns.MaxMsgSize for TCP requests without an OPT record.
func (dns *Msg) Truncate(size int) {
        if dns.IsTsig() != nil {
                // To simplify this implementation, we don't perform
                // truncation on responses with a TSIG record.
                return
        }

        // RFC 6891 mandates that the payload size in an OPT record
        // less than 512 (MinMsgSize) bytes must be treated as equal to 512 bytes.
        //
        // For ease of use, we impose that restriction here.
        if size < MinMsgSize {
                size = MinMsgSize
        }

        l := msgLenWithCompressionMap(dns, nil) // uncompressed length
        if l <= size {
                // Don't waste effort compressing this message.
                dns.Compress = false
                return
        }

        dns.Compress = true

        edns0 := dns.popEdns0()
        if edns0 != nil {
                // Account for the OPT record that gets added at the end,
                // by subtracting that length from our budget.
                //
                // The EDNS(0) OPT record must have the root domain and
                // it's length is thus unaffected by compression.
                size -= Len(edns0)
        }

        compression := make(map[string]struct{})

        l = headerSize
        for _, r := range dns.Question {
                l += r.len(l, compression)
        }

        var numAnswer int
        if l < size {
                l, numAnswer = truncateLoop(dns.Answer, size, l, compression)
        }

        var numNS int
        if l < size {
                l, numNS = truncateLoop(dns.Ns, size, l, compression)
        }

        var numExtra int
        if l < size {
                _, numExtra = truncateLoop(dns.Extra, size, l, compression)
        }

        // See the function documentation for when we set this.
        dns.Truncated = dns.Truncated || len(dns.Answer) > numAnswer ||
                len(dns.Ns) > numNS || len(dns.Extra) > numExtra

        dns.Answer = dns.Answer[:numAnswer]
        dns.Ns = dns.Ns[:numNS]
        dns.Extra = dns.Extra[:numExtra]

        if edns0 != nil {
                // Add the OPT record back onto the additional section.
                dns.Extra = append(dns.Extra, edns0)
        }
}

func truncateLoop(rrs []RR, size, l int, compression map[string]struct{}) (int, int) {
        for i, r := range rrs {
                if r == nil {
                        continue
                }

                l += r.len(l, compression)
                if l > size {
                        // Return size, rather than l prior to this record,
                        // to prevent any further records being added.
                        return size, i
                }
                if l == size {
                        return l, i + 1
                }
        }

        return l, len(rrs)
}

package dns

import (
        "crypto/sha1"
        "encoding/hex"
        "strings"
)

// HashName hashes a string (label) according to RFC 5155. It returns the hashed string in uppercase.
func HashName(label string, ha uint8, iter uint16, salt string) string {
        if ha != SHA1 {
                return ""
        }

        wireSalt := make([]byte, hex.DecodedLen(len(salt)))
        n, err := packStringHex(salt, wireSalt, 0)
        if err != nil {
                return ""
        }
        wireSalt = wireSalt[:n]

        name := make([]byte, 255)
        off, err := PackDomainName(strings.ToLower(label), name, 0, nil, false)
        if err != nil {
                return ""
        }
        name = name[:off]

        s := sha1.New()
        // k = 0
        s.Write(name)
        s.Write(wireSalt)
        nsec3 := s.Sum(nil)

        // k > 0
        for k := uint16(0); k < iter; k++ {
                s.Reset()
                s.Write(nsec3)
                s.Write(wireSalt)
                nsec3 = s.Sum(nsec3[:0])
        }

        return toBase32(nsec3)
}

// Cover returns true if a name is covered by the NSEC3 record.
func (rr *NSEC3) Cover(name string) bool {
        nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
        owner := strings.ToUpper(rr.Hdr.Name)
        labelIndices := Split(owner)
        if len(labelIndices) < 2 {
                return false
        }
        ownerHash := owner[:labelIndices[1]-1]
        ownerZone := owner[labelIndices[1]:]
        if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
                return false
        }

        nextHash := rr.NextDomain

        // if empty interval found, try cover wildcard hashes so nameHash shouldn't match with ownerHash
        if ownerHash == nextHash && nameHash != ownerHash { // empty interval
                return true
        }
        if ownerHash > nextHash { // end of zone
                if nameHash > ownerHash { // covered since there is nothing after ownerHash
                        return true
                }
                return nameHash < nextHash // if nameHash is before beginning of zone it is covered
        }
        if nameHash < ownerHash { // nameHash is before ownerHash, not covered
                return false
        }
        return nameHash < nextHash // if nameHash is before nextHash is it covered (between ownerHash and nextHash)
}

// Match returns true if a name matches the NSEC3 record
func (rr *NSEC3) Match(name string) bool {
        nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
        owner := strings.ToUpper(rr.Hdr.Name)
        labelIndices := Split(owner)
        if len(labelIndices) < 2 {
                return false
        }
        ownerHash := owner[:labelIndices[1]-1]
        ownerZone := owner[labelIndices[1]:]
        if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
                return false
        }
        if ownerHash == nameHash {
                return true
        }
        return false
}

package dns

import "strings"

// PrivateRdata is an interface used for implementing "Private Use" RR types, see
// RFC 6895. This allows one to experiment with new RR types, without requesting an
// official type code. Also see dns.PrivateHandle and dns.PrivateHandleRemove.
type PrivateRdata interface {
        // String returns the text presentation of the Rdata of the Private RR.
        String() string
        // Parse parses the Rdata of the private RR.
        Parse([]string) error
        // Pack is used when packing a private RR into a buffer.
        Pack([]byte) (int, error)
        // Unpack is used when unpacking a private RR from a buffer.
        Unpack([]byte) (int, error)
        // Copy copies the Rdata into the PrivateRdata argument.
        Copy(PrivateRdata) error
        // Len returns the length in octets of the Rdata.
        Len() int
}

// PrivateRR represents an RR that uses a PrivateRdata user-defined type.
// It mocks normal RRs and implements dns.RR interface.
type PrivateRR struct {
        Hdr  RR_Header
        Data PrivateRdata

        generator func() PrivateRdata // for copy
}

// Header return the RR header of r.
func (r *PrivateRR) Header() *RR_Header { return &r.Hdr }

func (r *PrivateRR) String() string { return r.Hdr.String() + r.Data.String() }

// Private len and copy parts to satisfy RR interface.
func (r *PrivateRR) len(off int, compression map[string]struct{}) int {
        l := r.Hdr.len(off, compression)
        l += r.Data.Len()
        return l
}

func (r *PrivateRR) copy() RR {
        // make new RR like this:
        rr := &PrivateRR{r.Hdr, r.generator(), r.generator}

        if err := r.Data.Copy(rr.Data); err != nil {
                panic("dns: got value that could not be used to copy Private rdata: " + err.Error())
        }

        return rr
}

func (r *PrivateRR) pack(msg []byte, off int, compression compressionMap, compress bool) (int, error) {
        n, err := r.Data.Pack(msg[off:])
        if err != nil {
                return len(msg), err
        }
        off += n
        return off, nil
}

func (r *PrivateRR) unpack(msg []byte, off int) (int, error) {
        off1, err := r.Data.Unpack(msg[off:])
        off += off1
        return off, err
}

func (r *PrivateRR) parse(c *zlexer, origin string) *ParseError {
        var l lex
        text := make([]string, 0, 2) // could be 0..N elements, median is probably 1
Fetch:
        for {
                // TODO(miek): we could also be returning _QUOTE, this might or might not
                // be an issue (basically parsing TXT becomes hard)
                switch l, _ = c.Next(); l.value {
                case zNewline, zEOF:
                        break Fetch
                case zString:
                        text = append(text, l.token)
                }
        }

        err := r.Data.Parse(text)
        if err != nil {
                return &ParseError{wrappedErr: err, lex: l}
        }

        return nil
}

func (r *PrivateRR) isDuplicate(r2 RR) bool { return false }

// PrivateHandle registers a private resource record type. It requires
// string and numeric representation of private RR type and generator function as argument.
func PrivateHandle(rtypestr string, rtype uint16, generator func() PrivateRdata) {
        rtypestr = strings.ToUpper(rtypestr)

        TypeToRR[rtype] = func() RR { return &PrivateRR{RR_Header{}, generator(), generator} }
        TypeToString[rtype] = rtypestr
        StringToType[rtypestr] = rtype
}

// PrivateHandleRemove removes definitions required to support private RR type.
func PrivateHandleRemove(rtype uint16) {
        rtypestr, ok := TypeToString[rtype]
        if ok {
                delete(TypeToRR, rtype)
                delete(TypeToString, rtype)
                delete(StringToType, rtypestr)
        }
}

package dns

// StringToType is the reverse of TypeToString, needed for string parsing.
var StringToType = reverseInt16(TypeToString)

// StringToClass is the reverse of ClassToString, needed for string parsing.
var StringToClass = reverseInt16(ClassToString)

// StringToOpcode is a map of opcodes to strings.
var StringToOpcode = reverseInt(OpcodeToString)

// StringToRcode is a map of rcodes to strings.
var StringToRcode = reverseInt(RcodeToString)

func init() {
        // Preserve previous NOTIMP typo, see github.com/miekg/dns/issues/733.
        StringToRcode["NOTIMPL"] = RcodeNotImplemented
}

// StringToAlgorithm is the reverse of AlgorithmToString.
var StringToAlgorithm = reverseInt8(AlgorithmToString)

// StringToHash is a map of names to hash IDs.
var StringToHash = reverseInt8(HashToString)

// StringToCertType is the reverseof CertTypeToString.
var StringToCertType = reverseInt16(CertTypeToString)

// Reverse a map
func reverseInt8(m map[uint8]string) map[string]uint8 {
        n := make(map[string]uint8, len(m))
        for u, s := range m {
                n[s] = u
        }
        return n
}

func reverseInt16(m map[uint16]string) map[string]uint16 {
        n := make(map[string]uint16, len(m))
        for u, s := range m {
                n[s] = u
        }
        return n
}

func reverseInt(m map[int]string) map[string]int {
        n := make(map[string]int, len(m))
        for u, s := range m {
                n[s] = u
        }
        return n
}

package dns

// Dedup removes identical RRs from rrs. It preserves the original ordering.
// The lowest TTL of any duplicates is used in the remaining one. Dedup modifies
// rrs.
// m is used to store the RRs temporary. If it is nil a new map will be allocated.
func Dedup(rrs []RR, m map[string]RR) []RR {

        if m == nil {
                m = make(map[string]RR)
        }
        // Save the keys, so we don't have to call normalizedString twice.
        keys := make([]*string, 0, len(rrs))

        for _, r := range rrs {
                key := normalizedString(r)
                keys = append(keys, &key)
                if mr, ok := m[key]; ok {
                        // Shortest TTL wins.
                        rh, mrh := r.Header(), mr.Header()
                        if mrh.Ttl > rh.Ttl {
                                mrh.Ttl = rh.Ttl
                        }
                        continue
                }

                m[key] = r
        }
        // If the length of the result map equals the amount of RRs we got,
        // it means they were all different. We can then just return the original rrset.
        if len(m) == len(rrs) {
                return rrs
        }

        j := 0
        for i, r := range rrs {
                // If keys[i] lives in the map, we should copy and remove it.
                if _, ok := m[*keys[i]]; ok {
                        delete(m, *keys[i])
                        rrs[j] = r
                        j++
                }

                if len(m) == 0 {
                        break
                }
        }

        return rrs[:j]
}

// normalizedString returns a normalized string from r. The TTL
// is removed and the domain name is lowercased. We go from this:
// DomainName<TAB>TTL<TAB>CLASS<TAB>TYPE<TAB>RDATA to:
// lowercasename<TAB>CLASS<TAB>TYPE...
func normalizedString(r RR) string {
        // A string Go DNS makes has: domainname<TAB>TTL<TAB>...
        b := []byte(r.String())

        // find the first non-escaped tab, then another, so we capture where the TTL lives.
        esc := false
        ttlStart, ttlEnd := 0, 0
        for i := 0; i < len(b) && ttlEnd == 0; i++ {
                switch {
                case b[i] == '\\':
                        esc = !esc
                case b[i] == '\t' && !esc:
                        if ttlStart == 0 {
                                ttlStart = i
                                continue
                        }
                        if ttlEnd == 0 {
                                ttlEnd = i
                        }
                case b[i] >= 'A' && b[i] <= 'Z' && !esc:
                        b[i] += 32
                default:
                        esc = false
                }
        }

        // remove TTL.
        copy(b[ttlStart:], b[ttlEnd:])
        cut := ttlEnd - ttlStart
        return string(b[:len(b)-cut])
}

package dns

import (
        "bufio"
        "fmt"
        "io"
        "io/fs"
        "os"
        "path"
        "path/filepath"
        "strconv"
        "strings"
)

const maxTok = 512 // Token buffer start size, and growth size amount.

// The maximum depth of $INCLUDE directives supported by the
// ZoneParser API.
const maxIncludeDepth = 7

// Tokenize a RFC 1035 zone file. The tokenizer will normalize it:
// * Add ownernames if they are left blank;
// * Suppress sequences of spaces;
// * Make each RR fit on one line (_NEWLINE is send as last)
// * Handle comments: ;
// * Handle braces - anywhere.
const (
        // Zonefile
        zEOF = iota
        zString
        zBlank
        zQuote
        zNewline
        zRrtpe
        zOwner
        zClass
        zDirOrigin   // $ORIGIN
        zDirTTL      // $TTL
        zDirInclude  // $INCLUDE
        zDirGenerate // $GENERATE

        // Privatekey file
        zValue
        zKey

        zExpectOwnerDir      // Ownername
        zExpectOwnerBl       // Whitespace after the ownername
        zExpectAny           // Expect rrtype, ttl or class
        zExpectAnyNoClass    // Expect rrtype or ttl
        zExpectAnyNoClassBl  // The whitespace after _EXPECT_ANY_NOCLASS
        zExpectAnyNoTTL      // Expect rrtype or class
        zExpectAnyNoTTLBl    // Whitespace after _EXPECT_ANY_NOTTL
        zExpectRrtype        // Expect rrtype
        zExpectRrtypeBl      // Whitespace BEFORE rrtype
        zExpectRdata         // The first element of the rdata
        zExpectDirTTLBl      // Space after directive $TTL
        zExpectDirTTL        // Directive $TTL
        zExpectDirOriginBl   // Space after directive $ORIGIN
        zExpectDirOrigin     // Directive $ORIGIN
        zExpectDirIncludeBl  // Space after directive $INCLUDE
        zExpectDirInclude    // Directive $INCLUDE
        zExpectDirGenerate   // Directive $GENERATE
        zExpectDirGenerateBl // Space after directive $GENERATE
)

// ParseError is a parsing error. It contains the parse error and the location in the io.Reader
// where the error occurred.
type ParseError struct {
        file       string
        err        string
        wrappedErr error
        lex        lex
}

func (e *ParseError) Error() (s string) {
        if e.file != "" {
                s = e.file + ": "
        }
        if e.err == "" && e.wrappedErr != nil {
                e.err = e.wrappedErr.Error()
        }
        s += "dns: " + e.err + ": " + strconv.QuoteToASCII(e.lex.token) + " at line: " +
                strconv.Itoa(e.lex.line) + ":" + strconv.Itoa(e.lex.column)
        return
}

func (e *ParseError) Unwrap() error { return e.wrappedErr }

type lex struct {
        token  string // text of the token
        err    bool   // when true, token text has lexer error
        value  uint8  // value: zString, _BLANK, etc.
        torc   uint16 // type or class as parsed in the lexer, we only need to look this up in the grammar
        line   int    // line in the file
        column int    // column in the file
}

// ttlState describes the state necessary to fill in an omitted RR TTL
type ttlState struct {
        ttl           uint32 // ttl is the current default TTL
        isByDirective bool   // isByDirective indicates whether ttl was set by a $TTL directive
}

// NewRR reads a string s and returns the first RR.
// If s contains no records, NewRR will return nil with no error.
//
// The class defaults to IN, TTL defaults to 3600, and
// origin for resolving relative domain names defaults to the DNS root (.).
// Full zone file syntax is supported, including directives like $TTL and $ORIGIN.
// All fields of the returned RR are set from the read data, except RR.Header().Rdlength which is set to 0.
func NewRR(s string) (RR, error) {
        if len(s) > 0 && s[len(s)-1] != '\n' { // We need a closing newline
                return ReadRR(strings.NewReader(s+"\n"), "")
        }
        return ReadRR(strings.NewReader(s), "")
}

// ReadRR reads the RR contained in r.
//
// The string file is used in error reporting and to resolve relative
// $INCLUDE directives.
//
// See NewRR for more documentation.
func ReadRR(r io.Reader, file string) (RR, error) {
        zp := NewZoneParser(r, ".", file)
        zp.SetDefaultTTL(defaultTtl)
        zp.SetIncludeAllowed(true)
        rr, _ := zp.Next()
        return rr, zp.Err()
}

// ZoneParser is a parser for an RFC 1035 style zonefile.
//
// Each parsed RR in the zone is returned sequentially from Next. An
// optional comment can be retrieved with Comment.
//
// The directives $INCLUDE, $ORIGIN, $TTL and $GENERATE are all
// supported. Although $INCLUDE is disabled by default.
// Note that $GENERATE's range support up to a maximum of 65535 steps.
//
// Basic usage pattern when reading from a string (z) containing the
// zone data:
//
//        zp := NewZoneParser(strings.NewReader(z), "", "")
//
//        for rr, ok := zp.Next(); ok; rr, ok = zp.Next() {
//                // Do something with rr
//        }
//
//        if err := zp.Err(); err != nil {
//                // log.Println(err)
//        }
//
// Comments specified after an RR (and on the same line!) are
// returned too:
//
//        foo. IN A 10.0.0.1 ; this is a comment
//
// The text "; this is comment" is returned from Comment. Comments inside
// the RR are returned concatenated along with the RR. Comments on a line
// by themselves are discarded.
//
// Callers should not assume all returned data in an Resource Record is
// syntactically correct, e.g. illegal base64 in RRSIGs will be returned as-is.
type ZoneParser struct {
        c *zlexer

        parseErr *ParseError

        origin string
        file   string

        defttl *ttlState

        h RR_Header

        // sub is used to parse $INCLUDE files and $GENERATE directives.
        // Next, by calling subNext, forwards the resulting RRs from this
        // sub parser to the calling code.
        sub  *ZoneParser
        r    io.Reader
        fsys fs.FS

        includeDepth uint8

        includeAllowed     bool
        generateDisallowed bool
}

// NewZoneParser returns an RFC 1035 style zonefile parser that reads
// from r.
//
// The string file is used in error reporting and to resolve relative
// $INCLUDE directives. The string origin is used as the initial
// origin, as if the file would start with an $ORIGIN directive.
func NewZoneParser(r io.Reader, origin, file string) *ZoneParser {
        var pe *ParseError
        if origin != "" {
                origin = Fqdn(origin)
                if _, ok := IsDomainName(origin); !ok {
                        pe = &ParseError{file: file, err: "bad initial origin name"}
                }
        }

        return &ZoneParser{
                c: newZLexer(r),

                parseErr: pe,

                origin: origin,
                file:   file,
        }
}

// SetDefaultTTL sets the parsers default TTL to ttl.
func (zp *ZoneParser) SetDefaultTTL(ttl uint32) {
        zp.defttl = &ttlState{ttl, false}
}

// SetIncludeAllowed controls whether $INCLUDE directives are
// allowed. $INCLUDE directives are not supported by default.
//
// The $INCLUDE directive will open and read from a user controlled
// file on the system. Even if the file is not a valid zonefile, the
// contents of the file may be revealed in error messages, such as:
//
//        /etc/passwd: dns: not a TTL: "root:x:0:0:root:/root:/bin/bash" at line: 1:31
//        /etc/shadow: dns: not a TTL: "root:$6$<redacted>::0:99999:7:::" at line: 1:125
func (zp *ZoneParser) SetIncludeAllowed(v bool) {
        zp.includeAllowed = v
}

// SetIncludeFS provides an [fs.FS] to use when looking for the target of
// $INCLUDE directives.  ($INCLUDE must still be enabled separately by calling
// [ZoneParser.SetIncludeAllowed].)  If fsys is nil, [os.Open] will be used.
//
// When fsys is an on-disk FS, the ability of $INCLUDE to reach files from
// outside its root directory depends upon the FS implementation.  For
// instance, [os.DirFS] will refuse to open paths like "../../etc/passwd",
// however it will still follow links which may point anywhere on the system.
//
// FS paths are slash-separated on all systems, even Windows.  $INCLUDE paths
// containing other characters such as backslash and colon may be accepted as
// valid, but those characters will never be interpreted by an FS
// implementation as path element separators.  See [fs.ValidPath] for more
// details.
func (zp *ZoneParser) SetIncludeFS(fsys fs.FS) {
        zp.fsys = fsys
}

// Err returns the first non-EOF error that was encountered by the
// ZoneParser.
func (zp *ZoneParser) Err() error {
        if zp.parseErr != nil {
                return zp.parseErr
        }

        if zp.sub != nil {
                if err := zp.sub.Err(); err != nil {
                        return err
                }
        }

        return zp.c.Err()
}

func (zp *ZoneParser) setParseError(err string, l lex) (RR, bool) {
        zp.parseErr = &ParseError{file: zp.file, err: err, lex: l}
        return nil, false
}

// Comment returns an optional text comment that occurred alongside
// the RR.
func (zp *ZoneParser) Comment() string {
        if zp.parseErr != nil {
                return ""
        }

        if zp.sub != nil {
                return zp.sub.Comment()
        }

        return zp.c.Comment()
}

func (zp *ZoneParser) subNext() (RR, bool) {
        if rr, ok := zp.sub.Next(); ok {
                return rr, true
        }

        if zp.sub.r != nil {
                if c, ok := zp.sub.r.(io.Closer); ok {
                        c.Close()
                }
                zp.sub.r = nil
        }

        if zp.sub.Err() != nil {
                // We have errors to surface.
                return nil, false
        }

        zp.sub = nil
        return zp.Next()
}

// Next advances the parser to the next RR in the zonefile and
// returns the (RR, true). It will return (nil, false) when the
// parsing stops, either by reaching the end of the input or an
// error. After Next returns (nil, false), the Err method will return
// any error that occurred during parsing.
func (zp *ZoneParser) Next() (RR, bool) {
        if zp.parseErr != nil {
                return nil, false
        }
        if zp.sub != nil {
                return zp.subNext()
        }

        // 6 possible beginnings of a line (_ is a space):
        //
        //   0. zRRTYPE                              -> all omitted until the rrtype
        //   1. zOwner _ zRrtype                     -> class/ttl omitted
        //   2. zOwner _ zString _ zRrtype           -> class omitted
        //   3. zOwner _ zString _ zClass  _ zRrtype -> ttl/class
        //   4. zOwner _ zClass  _ zRrtype           -> ttl omitted
        //   5. zOwner _ zClass  _ zString _ zRrtype -> class/ttl (reversed)
        //
        // After detecting these, we know the zRrtype so we can jump to functions
        // handling the rdata for each of these types.

        st := zExpectOwnerDir // initial state
        h := &zp.h

        for l, ok := zp.c.Next(); ok; l, ok = zp.c.Next() {
                // zlexer spotted an error already
                if l.err {
                        return zp.setParseError(l.token, l)
                }

                switch st {
                case zExpectOwnerDir:
                        // We can also expect a directive, like $TTL or $ORIGIN
                        if zp.defttl != nil {
                                h.Ttl = zp.defttl.ttl
                        }

                        h.Class = ClassINET

                        switch l.value {
                        case zNewline:
                                st = zExpectOwnerDir
                        case zOwner:
                                name, ok := toAbsoluteName(l.token, zp.origin)
                                if !ok {
                                        return zp.setParseError("bad owner name", l)
                                }

                                h.Name = name

                                st = zExpectOwnerBl
                        case zDirTTL:
                                st = zExpectDirTTLBl
                        case zDirOrigin:
                                st = zExpectDirOriginBl
                        case zDirInclude:
                                st = zExpectDirIncludeBl
                        case zDirGenerate:
                                st = zExpectDirGenerateBl
                        case zRrtpe:
                                h.Rrtype = l.torc

                                st = zExpectRdata
                        case zClass:
                                h.Class = l.torc

                                st = zExpectAnyNoClassBl
                        case zBlank:
                                // Discard, can happen when there is nothing on the
                                // line except the RR type
                        case zString:
                                ttl, ok := stringToTTL(l.token)
                                if !ok {
                                        return zp.setParseError("not a TTL", l)
                                }

                                h.Ttl = ttl

                                if zp.defttl == nil || !zp.defttl.isByDirective {
                                        zp.defttl = &ttlState{ttl, false}
                                }

                                st = zExpectAnyNoTTLBl
                        default:
                                return zp.setParseError("syntax error at beginning", l)
                        }
                case zExpectDirIncludeBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank after $INCLUDE-directive", l)
                        }

                        st = zExpectDirInclude
                case zExpectDirInclude:
                        if l.value != zString {
                                return zp.setParseError("expecting $INCLUDE value, not this...", l)
                        }

                        neworigin := zp.origin // There may be optionally a new origin set after the filename, if not use current one
                        switch l, _ := zp.c.Next(); l.value {
                        case zBlank:
                                l, _ := zp.c.Next()
                                if l.value == zString {
                                        name, ok := toAbsoluteName(l.token, zp.origin)
                                        if !ok {
                                                return zp.setParseError("bad origin name", l)
                                        }

                                        neworigin = name
                                }
                        case zNewline, zEOF:
                                // Ok
                        default:
                                return zp.setParseError("garbage after $INCLUDE", l)
                        }

                        if !zp.includeAllowed {
                                return zp.setParseError("$INCLUDE directive not allowed", l)
                        }
                        if zp.includeDepth >= maxIncludeDepth {
                                return zp.setParseError("too deeply nested $INCLUDE", l)
                        }

                        // Start with the new file
                        includePath := l.token
                        var r1 io.Reader
                        var e1 error
                        if zp.fsys != nil {
                                // fs.FS always uses / as separator, even on Windows, so use
                                // path instead of filepath here:
                                if !path.IsAbs(includePath) {
                                        includePath = path.Join(path.Dir(zp.file), includePath)
                                }

                                // os.DirFS, and probably others, expect all paths to be
                                // relative, so clean the path and remove leading / if
                                // present:
                                includePath = strings.TrimLeft(path.Clean(includePath), "/")

                                r1, e1 = zp.fsys.Open(includePath)
                        } else {
                                if !filepath.IsAbs(includePath) {
                                        includePath = filepath.Join(filepath.Dir(zp.file), includePath)
                                }
                                r1, e1 = os.Open(includePath)
                        }
                        if e1 != nil {
                                var as string
                                if includePath != l.token {
                                        as = fmt.Sprintf(" as `%s'", includePath)
                                }
                                zp.parseErr = &ParseError{
                                        file:       zp.file,
                                        wrappedErr: fmt.Errorf("failed to open `%s'%s: %w", l.token, as, e1),
                                        lex:        l,
                                }
                                return nil, false
                        }

                        zp.sub = NewZoneParser(r1, neworigin, includePath)
                        zp.sub.defttl, zp.sub.includeDepth, zp.sub.r = zp.defttl, zp.includeDepth+1, r1
                        zp.sub.SetIncludeAllowed(true)
                        zp.sub.SetIncludeFS(zp.fsys)
                        return zp.subNext()
                case zExpectDirTTLBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank after $TTL-directive", l)
                        }

                        st = zExpectDirTTL
                case zExpectDirTTL:
                        if l.value != zString {
                                return zp.setParseError("expecting $TTL value, not this...", l)
                        }

                        if err := slurpRemainder(zp.c); err != nil {
                                return zp.setParseError(err.err, err.lex)
                        }

                        ttl, ok := stringToTTL(l.token)
                        if !ok {
                                return zp.setParseError("expecting $TTL value, not this...", l)
                        }

                        zp.defttl = &ttlState{ttl, true}

                        st = zExpectOwnerDir
                case zExpectDirOriginBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank after $ORIGIN-directive", l)
                        }

                        st = zExpectDirOrigin
                case zExpectDirOrigin:
                        if l.value != zString {
                                return zp.setParseError("expecting $ORIGIN value, not this...", l)
                        }

                        if err := slurpRemainder(zp.c); err != nil {
                                return zp.setParseError(err.err, err.lex)
                        }

                        name, ok := toAbsoluteName(l.token, zp.origin)
                        if !ok {
                                return zp.setParseError("bad origin name", l)
                        }

                        zp.origin = name

                        st = zExpectOwnerDir
                case zExpectDirGenerateBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank after $GENERATE-directive", l)
                        }

                        st = zExpectDirGenerate
                case zExpectDirGenerate:
                        if zp.generateDisallowed {
                                return zp.setParseError("nested $GENERATE directive not allowed", l)
                        }
                        if l.value != zString {
                                return zp.setParseError("expecting $GENERATE value, not this...", l)
                        }

                        return zp.generate(l)
                case zExpectOwnerBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank after owner", l)
                        }

                        st = zExpectAny
                case zExpectAny:
                        switch l.value {
                        case zRrtpe:
                                if zp.defttl == nil {
                                        return zp.setParseError("missing TTL with no previous value", l)
                                }

                                h.Rrtype = l.torc

                                st = zExpectRdata
                        case zClass:
                                h.Class = l.torc

                                st = zExpectAnyNoClassBl
                        case zString:
                                ttl, ok := stringToTTL(l.token)
                                if !ok {
                                        return zp.setParseError("not a TTL", l)
                                }

                                h.Ttl = ttl

                                if zp.defttl == nil || !zp.defttl.isByDirective {
                                        zp.defttl = &ttlState{ttl, false}
                                }

                                st = zExpectAnyNoTTLBl
                        default:
                                return zp.setParseError("expecting RR type, TTL or class, not this...", l)
                        }
                case zExpectAnyNoClassBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank before class", l)
                        }

                        st = zExpectAnyNoClass
                case zExpectAnyNoTTLBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank before TTL", l)
                        }

                        st = zExpectAnyNoTTL
                case zExpectAnyNoTTL:
                        switch l.value {
                        case zClass:
                                h.Class = l.torc

                                st = zExpectRrtypeBl
                        case zRrtpe:
                                h.Rrtype = l.torc

                                st = zExpectRdata
                        default:
                                return zp.setParseError("expecting RR type or class, not this...", l)
                        }
                case zExpectAnyNoClass:
                        switch l.value {
                        case zString:
                                ttl, ok := stringToTTL(l.token)
                                if !ok {
                                        return zp.setParseError("not a TTL", l)
                                }

                                h.Ttl = ttl

                                if zp.defttl == nil || !zp.defttl.isByDirective {
                                        zp.defttl = &ttlState{ttl, false}
                                }

                                st = zExpectRrtypeBl
                        case zRrtpe:
                                h.Rrtype = l.torc

                                st = zExpectRdata
                        default:
                                return zp.setParseError("expecting RR type or TTL, not this...", l)
                        }
                case zExpectRrtypeBl:
                        if l.value != zBlank {
                                return zp.setParseError("no blank before RR type", l)
                        }

                        st = zExpectRrtype
                case zExpectRrtype:
                        if l.value != zRrtpe {
                                return zp.setParseError("unknown RR type", l)
                        }

                        h.Rrtype = l.torc

                        st = zExpectRdata
                case zExpectRdata:
                        var (
                                rr             RR
                                parseAsRFC3597 bool
                        )
                        if newFn, ok := TypeToRR[h.Rrtype]; ok {
                                rr = newFn()
                                *rr.Header() = *h

                                // We may be parsing a known RR type using the RFC3597 format.
                                // If so, we handle that here in a generic way.
                                //
                                // This is also true for PrivateRR types which will have the
                                // RFC3597 parsing done for them and the Unpack method called
                                // to populate the RR instead of simply deferring to Parse.
                                if zp.c.Peek().token == "\\#" {
                                        parseAsRFC3597 = true
                                }
                        } else {
                                rr = &RFC3597{Hdr: *h}
                        }

                        _, isPrivate := rr.(*PrivateRR)
                        if !isPrivate && zp.c.Peek().token == "" {
                                // This is a dynamic update rr.

                                if err := slurpRemainder(zp.c); err != nil {
                                        return zp.setParseError(err.err, err.lex)
                                }

                                return rr, true
                        } else if l.value == zNewline {
                                return zp.setParseError("unexpected newline", l)
                        }

                        parseAsRR := rr
                        if parseAsRFC3597 {
                                parseAsRR = &RFC3597{Hdr: *h}
                        }

                        if err := parseAsRR.parse(zp.c, zp.origin); err != nil {
                                // err is a concrete *ParseError without the file field set.
                                // The setParseError call below will construct a new
                                // *ParseError with file set to zp.file.

                                // err.lex may be nil in which case we substitute our current
                                // lex token.
                                if err.lex == (lex{}) {
                                        return zp.setParseError(err.err, l)
                                }

                                return zp.setParseError(err.err, err.lex)
                        }

                        if parseAsRFC3597 {
                                err := parseAsRR.(*RFC3597).fromRFC3597(rr)
                                if err != nil {
                                        return zp.setParseError(err.Error(), l)
                                }
                        }

                        return rr, true
                }
        }

        // If we get here, we and the h.Rrtype is still zero, we haven't parsed anything, this
        // is not an error, because an empty zone file is still a zone file.
        return nil, false
}

type zlexer struct {
        br io.ByteReader

        readErr error

        line   int
        column int

        comBuf  string
        comment string

        l       lex
        cachedL *lex

        brace  int
        quote  bool
        space  bool
        commt  bool
        rrtype bool
        owner  bool

        nextL bool

        eol bool // end-of-line
}

func newZLexer(r io.Reader) *zlexer {
        br, ok := r.(io.ByteReader)
        if !ok {
                br = bufio.NewReaderSize(r, 1024)
        }

        return &zlexer{
                br: br,

                line: 1,

                owner: true,
        }
}

func (zl *zlexer) Err() error {
        if zl.readErr == io.EOF {
                return nil
        }

        return zl.readErr
}

// readByte returns the next byte from the input
func (zl *zlexer) readByte() (byte, bool) {
        if zl.readErr != nil {
                return 0, false
        }

        c, err := zl.br.ReadByte()
        if err != nil {
                zl.readErr = err
                return 0, false
        }

        // delay the newline handling until the next token is delivered,
        // fixes off-by-one errors when reporting a parse error.
        if zl.eol {
                zl.line++
                zl.column = 0
                zl.eol = false
        }

        if c == '\n' {
                zl.eol = true
        } else {
                zl.column++
        }

        return c, true
}

func (zl *zlexer) Peek() lex {
        if zl.nextL {
                return zl.l
        }

        l, ok := zl.Next()
        if !ok {
                return l
        }

        if zl.nextL {
                // Cache l. Next returns zl.cachedL then zl.l.
                zl.cachedL = &l
        } else {
                // In this case l == zl.l, so we just tell Next to return zl.l.
                zl.nextL = true
        }

        return l
}

func (zl *zlexer) Next() (lex, bool) {
        l := &zl.l
        switch {
        case zl.cachedL != nil:
                l, zl.cachedL = zl.cachedL, nil
                return *l, true
        case zl.nextL:
                zl.nextL = false
                return *l, true
        case l.err:
                // Parsing errors should be sticky.
                return lex{value: zEOF}, false
        }

        var (
                str = make([]byte, maxTok) // Hold string text
                com = make([]byte, maxTok) // Hold comment text

                stri int // Offset in str (0 means empty)
                comi int // Offset in com (0 means empty)

                escape bool
        )

        if zl.comBuf != "" {
                comi = copy(com[:], zl.comBuf)
                zl.comBuf = ""
        }

        zl.comment = ""

        for x, ok := zl.readByte(); ok; x, ok = zl.readByte() {
                l.line, l.column = zl.line, zl.column

                if stri >= len(str) {
                        // if buffer length is insufficient, increase it.
                        str = append(str[:], make([]byte, maxTok)...)
                }
                if comi >= len(com) {
                        // if buffer length is insufficient, increase it.
                        com = append(com[:], make([]byte, maxTok)...)
                }

                switch x {
                case ' ', '\t':
                        if escape || zl.quote {
                                // Inside quotes or escaped this is legal.
                                str[stri] = x
                                stri++

                                escape = false
                                break
                        }

                        if zl.commt {
                                com[comi] = x
                                comi++
                                break
                        }

                        var retL lex
                        if stri == 0 {
                                // Space directly in the beginning, handled in the grammar
                        } else if zl.owner {
                                // If we have a string and it's the first, make it an owner
                                l.value = zOwner
                                l.token = string(str[:stri])

                                // escape $... start with a \ not a $, so this will work
                                switch strings.ToUpper(l.token) {
                                case "$TTL":
                                        l.value = zDirTTL
                                case "$ORIGIN":
                                        l.value = zDirOrigin
                                case "$INCLUDE":
                                        l.value = zDirInclude
                                case "$GENERATE":
                                        l.value = zDirGenerate
                                }

                                retL = *l
                        } else {
                                l.value = zString
                                l.token = string(str[:stri])

                                if !zl.rrtype {
                                        tokenUpper := strings.ToUpper(l.token)
                                        if t, ok := StringToType[tokenUpper]; ok {
                                                l.value = zRrtpe
                                                l.torc = t

                                                zl.rrtype = true
                                        } else if strings.HasPrefix(tokenUpper, "TYPE") {
                                                t, ok := typeToInt(l.token)
                                                if !ok {
                                                        l.token = "unknown RR type"
                                                        l.err = true
                                                        return *l, true
                                                }

                                                l.value = zRrtpe
                                                l.torc = t

                                                zl.rrtype = true
                                        }

                                        if t, ok := StringToClass[tokenUpper]; ok {
                                                l.value = zClass
                                                l.torc = t
                                        } else if strings.HasPrefix(tokenUpper, "CLASS") {
                                                t, ok := classToInt(l.token)
                                                if !ok {
                                                        l.token = "unknown class"
                                                        l.err = true
                                                        return *l, true
                                                }

                                                l.value = zClass
                                                l.torc = t
                                        }
                                }

                                retL = *l
                        }

                        zl.owner = false

                        if !zl.space {
                                zl.space = true

                                l.value = zBlank
                                l.token = " "

                                if retL == (lex{}) {
                                        return *l, true
                                }

                                zl.nextL = true
                        }

                        if retL != (lex{}) {
                                return retL, true
                        }
                case ';':
                        if escape || zl.quote {
                                // Inside quotes or escaped this is legal.
                                str[stri] = x
                                stri++

                                escape = false
                                break
                        }

                        zl.commt = true
                        zl.comBuf = ""

                        if comi > 1 {
                                // A newline was previously seen inside a comment that
                                // was inside braces and we delayed adding it until now.
                                com[comi] = ' ' // convert newline to space
                                comi++
                                if comi >= len(com) {
                                        l.token = "comment length insufficient for parsing"
                                        l.err = true
                                        return *l, true
                                }
                        }

                        com[comi] = ';'
                        comi++

                        if stri > 0 {
                                zl.comBuf = string(com[:comi])

                                l.value = zString
                                l.token = string(str[:stri])
                                return *l, true
                        }
                case '\r':
                        escape = false

                        if zl.quote {
                                str[stri] = x
                                stri++
                        }

                        // discard if outside of quotes
                case '\n':
                        escape = false

                        // Escaped newline
                        if zl.quote {
                                str[stri] = x
                                stri++
                                break
                        }

                        if zl.commt {
                                // Reset a comment
                                zl.commt = false
                                zl.rrtype = false

                                // If not in a brace this ends the comment AND the RR
                                if zl.brace == 0 {
                                        zl.owner = true

                                        l.value = zNewline
                                        l.token = "\n"
                                        zl.comment = string(com[:comi])
                                        return *l, true
                                }

                                zl.comBuf = string(com[:comi])
                                break
                        }

                        if zl.brace == 0 {
                                // If there is previous text, we should output it here
                                var retL lex
                                if stri != 0 {
                                        l.value = zString
                                        l.token = string(str[:stri])

                                        if !zl.rrtype {
                                                tokenUpper := strings.ToUpper(l.token)
                                                if t, ok := StringToType[tokenUpper]; ok {
                                                        zl.rrtype = true

                                                        l.value = zRrtpe
                                                        l.torc = t
                                                }
                                        }

                                        retL = *l
                                }

                                l.value = zNewline
                                l.token = "\n"

                                zl.comment = zl.comBuf
                                zl.comBuf = ""
                                zl.rrtype = false
                                zl.owner = true

                                if retL != (lex{}) {
                                        zl.nextL = true
                                        return retL, true
                                }

                                return *l, true
                        }
                case '\\':
                        // comments do not get escaped chars, everything is copied
                        if zl.commt {
                                com[comi] = x
                                comi++
                                break
                        }

                        // something already escaped must be in string
                        if escape {
                                str[stri] = x
                                stri++

                                escape = false
                                break
                        }

                        // something escaped outside of string gets added to string
                        str[stri] = x
                        stri++

                        escape = true
                case '"':
                        if zl.commt {
                                com[comi] = x
                                comi++
                                break
                        }

                        if escape {
                                str[stri] = x
                                stri++

                                escape = false
                                break
                        }

                        zl.space = false

                        // send previous gathered text and the quote
                        var retL lex
                        if stri != 0 {
                                l.value = zString
                                l.token = string(str[:stri])

                                retL = *l
                        }

                        // send quote itself as separate token
                        l.value = zQuote
                        l.token = "\""

                        zl.quote = !zl.quote

                        if retL != (lex{}) {
                                zl.nextL = true
                                return retL, true
                        }

                        return *l, true
                case '(', ')':
                        if zl.commt {
                                com[comi] = x
                                comi++
                                break
                        }

                        if escape || zl.quote {
                                // Inside quotes or escaped this is legal.
                                str[stri] = x
                                stri++

                                escape = false
                                break
                        }

                        switch x {
                        case ')':
                                zl.brace--

                                if zl.brace < 0 {
                                        l.token = "extra closing brace"
                                        l.err = true
                                        return *l, true
                                }
                        case '(':
                                zl.brace++
                        }
                default:
                        escape = false

                        if zl.commt {
                                com[comi] = x
                                comi++
                                break
                        }

                        str[stri] = x
                        stri++

                        zl.space = false
                }
        }

        if zl.readErr != nil && zl.readErr != io.EOF {
                // Don't return any tokens after a read error occurs.
                return lex{value: zEOF}, false
        }

        var retL lex
        if stri > 0 {
                // Send remainder of str
                l.value = zString
                l.token = string(str[:stri])
                retL = *l

                if comi <= 0 {
                        return retL, true
                }
        }

        if comi > 0 {
                // Send remainder of com
                l.value = zNewline
                l.token = "\n"
                zl.comment = string(com[:comi])

                if retL != (lex{}) {
                        zl.nextL = true
                        return retL, true
                }

                return *l, true
        }

        if zl.brace != 0 {
                l.token = "unbalanced brace"
                l.err = true
                return *l, true
        }

        return lex{value: zEOF}, false
}

func (zl *zlexer) Comment() string {
        if zl.l.err {
                return ""
        }

        return zl.comment
}

// Extract the class number from CLASSxx
func classToInt(token string) (uint16, bool) {
        offset := 5
        if len(token) < offset+1 {
                return 0, false
        }
        class, err := strconv.ParseUint(token[offset:], 10, 16)
        if err != nil {
                return 0, false
        }
        return uint16(class), true
}

// Extract the rr number from TYPExxx
func typeToInt(token string) (uint16, bool) {
        offset := 4
        if len(token) < offset+1 {
                return 0, false
        }
        typ, err := strconv.ParseUint(token[offset:], 10, 16)
        if err != nil {
                return 0, false
        }
        return uint16(typ), true
}

// stringToTTL parses things like 2w, 2m, etc, and returns the time in seconds.
func stringToTTL(token string) (uint32, bool) {
        var s, i uint32
        for _, c := range token {
                switch c {
                case 's', 'S':
                        s += i
                        i = 0
                case 'm', 'M':
                        s += i * 60
                        i = 0
                case 'h', 'H':
                        s += i * 60 * 60
                        i = 0
                case 'd', 'D':
                        s += i * 60 * 60 * 24
                        i = 0
                case 'w', 'W':
                        s += i * 60 * 60 * 24 * 7
                        i = 0
                case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
                        i *= 10
                        i += uint32(c) - '0'
                default:
                        return 0, false
                }
        }
        return s + i, true
}

// Parse LOC records' <digits>[.<digits>][mM] into a
// mantissa exponent format. Token should contain the entire
// string (i.e. no spaces allowed)
func stringToCm(token string) (e, m uint8, ok bool) {
        if token[len(token)-1] == 'M' || token[len(token)-1] == 'm' {
                token = token[0 : len(token)-1]
        }

        var (
                meters, cmeters, val int
                err                  error
        )
        mStr, cmStr, hasCM := strings.Cut(token, ".")
        if hasCM {
                // There's no point in having more than 2 digits in this part, and would rather make the implementation complicated ('123' should be treated as '12').
                // So we simply reject it.
                // We also make sure the first character is a digit to reject '+-' signs.
                cmeters, err = strconv.Atoi(cmStr)
                if err != nil || len(cmStr) > 2 || cmStr[0] < '0' || cmStr[0] > '9' {
                        return
                }
                if len(cmStr) == 1 {
                        // 'nn.1' must be treated as 'nn-meters and 10cm, not 1cm.
                        cmeters *= 10
                }
        }
        // This slightly ugly condition will allow omitting the 'meter' part, like .01 (meaning 0.01m = 1cm).
        if !hasCM || mStr != "" {
                meters, err = strconv.Atoi(mStr)
                // RFC1876 states the max value is 90000000.00.  The latter two conditions enforce it.
                if err != nil || mStr[0] < '0' || mStr[0] > '9' || meters > 90000000 || (meters == 90000000 && cmeters != 0) {
                        return
                }
        }

        if meters > 0 {
                e = 2
                val = meters
        } else {
                e = 0
                val = cmeters
        }
        for val >= 10 {
                e++
                val /= 10
        }
        return e, uint8(val), true
}

func toAbsoluteName(name, origin string) (absolute string, ok bool) {
        // check for an explicit origin reference
        if name == "@" {
                // require a nonempty origin
                if origin == "" {
                        return "", false
                }
                return origin, true
        }

        // require a valid domain name
        _, ok = IsDomainName(name)
        if !ok || name == "" {
                return "", false
        }

        // check if name is already absolute
        if IsFqdn(name) {
                return name, true
        }

        // require a nonempty origin
        if origin == "" {
                return "", false
        }
        return appendOrigin(name, origin), true
}

func appendOrigin(name, origin string) string {
        if origin == "." {
                return name + origin
        }
        return name + "." + origin
}

// LOC record helper function
func locCheckNorth(token string, latitude uint32) (uint32, bool) {
        if latitude > 90*1000*60*60 {
                return latitude, false
        }
        switch token {
        case "n", "N":
                return LOC_EQUATOR + latitude, true
        case "s", "S":
                return LOC_EQUATOR - latitude, true
        }
        return latitude, false
}

// LOC record helper function
func locCheckEast(token string, longitude uint32) (uint32, bool) {
        if longitude > 180*1000*60*60 {
                return longitude, false
        }
        switch token {
        case "e", "E":
                return LOC_EQUATOR + longitude, true
        case "w", "W":
                return LOC_EQUATOR - longitude, true
        }
        return longitude, false
}

// "Eat" the rest of the "line"
func slurpRemainder(c *zlexer) *ParseError {
        l, _ := c.Next()
        switch l.value {
        case zBlank:
                l, _ = c.Next()
                if l.value != zNewline && l.value != zEOF {
                        return &ParseError{err: "garbage after rdata", lex: l}
                }
        case zNewline:
        case zEOF:
        default:
                return &ParseError{err: "garbage after rdata", lex: l}
        }
        return nil
}

// Parse a 64 bit-like ipv6 address: "0014:4fff:ff20:ee64"
// Used for NID and L64 record.
func stringToNodeID(l lex) (uint64, *ParseError) {
        if len(l.token) < 19 {
                return 0, &ParseError{file: l.token, err: "bad NID/L64 NodeID/Locator64", lex: l}
        }
        // There must be three colons at fixes positions, if not its a parse error
        if l.token[4] != ':' && l.token[9] != ':' && l.token[14] != ':' {
                return 0, &ParseError{file: l.token, err: "bad NID/L64 NodeID/Locator64", lex: l}
        }
        s := l.token[0:4] + l.token[5:9] + l.token[10:14] + l.token[15:19]
        u, err := strconv.ParseUint(s, 16, 64)
        if err != nil {
                return 0, &ParseError{file: l.token, err: "bad NID/L64 NodeID/Locator64", lex: l}
        }
        return u, nil
}

package dns

import (
        "encoding/base64"
        "errors"
        "fmt"
        "net"
        "strconv"
        "strings"
)

// A remainder of the rdata with embedded spaces, return the parsed string (sans the spaces)
// or an error
func endingToString(c *zlexer, errstr string) (string, *ParseError) {
        var s strings.Builder
        l, _ := c.Next() // zString
        for l.value != zNewline && l.value != zEOF {
                if l.err {
                        return s.String(), &ParseError{err: errstr, lex: l}
                }
                switch l.value {
                case zString:
                        s.WriteString(l.token)
                case zBlank: // Ok
                default:
                        return "", &ParseError{err: errstr, lex: l}
                }
                l, _ = c.Next()
        }

        return s.String(), nil
}

// A remainder of the rdata with embedded spaces, split on unquoted whitespace
// and return the parsed string slice or an error
func endingToTxtSlice(c *zlexer, errstr string) ([]string, *ParseError) {
        // Get the remaining data until we see a zNewline
        l, _ := c.Next()
        if l.err {
                return nil, &ParseError{err: errstr, lex: l}
        }

        // Build the slice
        s := make([]string, 0)
        quote := false
        empty := false
        for l.value != zNewline && l.value != zEOF {
                if l.err {
                        return nil, &ParseError{err: errstr, lex: l}
                }
                switch l.value {
                case zString:
                        empty = false
                        // split up tokens that are larger than 255 into 255-chunks
                        sx := []string{}
                        p := 0
                        for {
                                i, ok := escapedStringOffset(l.token[p:], 255)
                                if !ok {
                                        return nil, &ParseError{err: errstr, lex: l}
                                }
                                if i != -1 && p+i != len(l.token) {
                                        sx = append(sx, l.token[p:p+i])
                                } else {
                                        sx = append(sx, l.token[p:])
                                        break

                                }
                                p += i
                        }
                        s = append(s, sx...)
                case zBlank:
                        if quote {
                                // zBlank can only be seen in between txt parts.
                                return nil, &ParseError{err: errstr, lex: l}
                        }
                case zQuote:
                        if empty && quote {
                                s = append(s, "")
                        }
                        quote = !quote
                        empty = true
                default:
                        return nil, &ParseError{err: errstr, lex: l}
                }
                l, _ = c.Next()
        }

        if quote {
                return nil, &ParseError{err: errstr, lex: l}
        }

        return s, nil
}

func (rr *A) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        rr.A = net.ParseIP(l.token)
        // IPv4 addresses cannot include ":".
        // We do this rather than use net.IP's To4() because
        // To4() treats IPv4-mapped IPv6 addresses as being
        // IPv4.
        isIPv4 := !strings.Contains(l.token, ":")
        if rr.A == nil || !isIPv4 || l.err {
                return &ParseError{err: "bad A A", lex: l}
        }
        return slurpRemainder(c)
}

func (rr *AAAA) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        rr.AAAA = net.ParseIP(l.token)
        // IPv6 addresses must include ":", and IPv4
        // addresses cannot include ":".
        isIPv6 := strings.Contains(l.token, ":")
        if rr.AAAA == nil || !isIPv6 || l.err {
                return &ParseError{err: "bad AAAA AAAA", lex: l}
        }
        return slurpRemainder(c)
}

func (rr *NS) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad NS Ns", lex: l}
        }
        rr.Ns = name
        return slurpRemainder(c)
}

func (rr *PTR) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad PTR Ptr", lex: l}
        }
        rr.Ptr = name
        return slurpRemainder(c)
}

func (rr *NSAPPTR) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad NSAP-PTR Ptr", lex: l}
        }
        rr.Ptr = name
        return slurpRemainder(c)
}

func (rr *RP) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        mbox, mboxOk := toAbsoluteName(l.token, o)
        if l.err || !mboxOk {
                return &ParseError{err: "bad RP Mbox", lex: l}
        }
        rr.Mbox = mbox

        c.Next() // zBlank
        l, _ = c.Next()
        rr.Txt = l.token

        txt, txtOk := toAbsoluteName(l.token, o)
        if l.err || !txtOk {
                return &ParseError{err: "bad RP Txt", lex: l}
        }
        rr.Txt = txt

        return slurpRemainder(c)
}

func (rr *MR) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad MR Mr", lex: l}
        }
        rr.Mr = name
        return slurpRemainder(c)
}

func (rr *MB) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad MB Mb", lex: l}
        }
        rr.Mb = name
        return slurpRemainder(c)
}

func (rr *MG) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad MG Mg", lex: l}
        }
        rr.Mg = name
        return slurpRemainder(c)
}

func (rr *HINFO) parse(c *zlexer, o string) *ParseError {
        chunks, e := endingToTxtSlice(c, "bad HINFO Fields")
        if e != nil {
                return e
        }

        if ln := len(chunks); ln == 0 {
                return nil
        } else if ln == 1 {
                // Can we split it?
                if out := strings.Fields(chunks[0]); len(out) > 1 {
                        chunks = out
                } else {
                        chunks = append(chunks, "")
                }
        }

        rr.Cpu = chunks[0]
        rr.Os = strings.Join(chunks[1:], " ")
        return nil
}

// according to RFC 1183 the parsing is identical to HINFO, so just use that code.
func (rr *ISDN) parse(c *zlexer, o string) *ParseError {
        chunks, e := endingToTxtSlice(c, "bad ISDN Fields")
        if e != nil {
                return e
        }

        if ln := len(chunks); ln == 0 {
                return nil
        } else if ln == 1 {
                // Can we split it?
                if out := strings.Fields(chunks[0]); len(out) > 1 {
                        chunks = out
                } else {
                        chunks = append(chunks, "")
                }
        }

        rr.Address = chunks[0]
        rr.SubAddress = strings.Join(chunks[1:], " ")

        return nil
}

func (rr *MINFO) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        rmail, rmailOk := toAbsoluteName(l.token, o)
        if l.err || !rmailOk {
                return &ParseError{err: "bad MINFO Rmail", lex: l}
        }
        rr.Rmail = rmail

        c.Next() // zBlank
        l, _ = c.Next()
        rr.Email = l.token

        email, emailOk := toAbsoluteName(l.token, o)
        if l.err || !emailOk {
                return &ParseError{err: "bad MINFO Email", lex: l}
        }
        rr.Email = email

        return slurpRemainder(c)
}

func (rr *MF) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad MF Mf", lex: l}
        }
        rr.Mf = name
        return slurpRemainder(c)
}

func (rr *MD) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad MD Md", lex: l}
        }
        rr.Md = name
        return slurpRemainder(c)
}

func (rr *MX) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad MX Pref", lex: l}
        }
        rr.Preference = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Mx = l.token

        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad MX Mx", lex: l}
        }
        rr.Mx = name

        return slurpRemainder(c)
}

func (rr *RT) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil {
                return &ParseError{err: "bad RT Preference", lex: l}
        }
        rr.Preference = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Host = l.token

        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad RT Host", lex: l}
        }
        rr.Host = name

        return slurpRemainder(c)
}

func (rr *AFSDB) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad AFSDB Subtype", lex: l}
        }
        rr.Subtype = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Hostname = l.token

        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad AFSDB Hostname", lex: l}
        }
        rr.Hostname = name
        return slurpRemainder(c)
}

func (rr *X25) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        if l.err {
                return &ParseError{err: "bad X25 PSDNAddress", lex: l}
        }
        rr.PSDNAddress = l.token
        return slurpRemainder(c)
}

func (rr *KX) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad KX Pref", lex: l}
        }
        rr.Preference = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Exchanger = l.token

        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad KX Exchanger", lex: l}
        }
        rr.Exchanger = name
        return slurpRemainder(c)
}

func (rr *CNAME) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad CNAME Target", lex: l}
        }
        rr.Target = name
        return slurpRemainder(c)
}

func (rr *DNAME) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad DNAME Target", lex: l}
        }
        rr.Target = name
        return slurpRemainder(c)
}

func (rr *SOA) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        ns, nsOk := toAbsoluteName(l.token, o)
        if l.err || !nsOk {
                return &ParseError{err: "bad SOA Ns", lex: l}
        }
        rr.Ns = ns

        c.Next() // zBlank
        l, _ = c.Next()
        rr.Mbox = l.token

        mbox, mboxOk := toAbsoluteName(l.token, o)
        if l.err || !mboxOk {
                return &ParseError{err: "bad SOA Mbox", lex: l}
        }
        rr.Mbox = mbox

        c.Next() // zBlank

        var (
                v  uint32
                ok bool
        )
        for i := 0; i < 5; i++ {
                l, _ = c.Next()
                if l.err {
                        return &ParseError{err: "bad SOA zone parameter", lex: l}
                }
                if j, err := strconv.ParseUint(l.token, 10, 32); err != nil {
                        if i == 0 {
                                // Serial must be a number
                                return &ParseError{err: "bad SOA zone parameter", lex: l}
                        }
                        // We allow other fields to be unitful duration strings
                        if v, ok = stringToTTL(l.token); !ok {
                                return &ParseError{err: "bad SOA zone parameter", lex: l}

                        }
                } else {
                        v = uint32(j)
                }
                switch i {
                case 0:
                        rr.Serial = v
                        c.Next() // zBlank
                case 1:
                        rr.Refresh = v
                        c.Next() // zBlank
                case 2:
                        rr.Retry = v
                        c.Next() // zBlank
                case 3:
                        rr.Expire = v
                        c.Next() // zBlank
                case 4:
                        rr.Minttl = v
                }
        }
        return slurpRemainder(c)
}

func (rr *SRV) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad SRV Priority", lex: l}
        }
        rr.Priority = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e1 := strconv.ParseUint(l.token, 10, 16)
        if e1 != nil || l.err {
                return &ParseError{err: "bad SRV Weight", lex: l}
        }
        rr.Weight = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e2 := strconv.ParseUint(l.token, 10, 16)
        if e2 != nil || l.err {
                return &ParseError{err: "bad SRV Port", lex: l}
        }
        rr.Port = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Target = l.token

        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad SRV Target", lex: l}
        }
        rr.Target = name
        return slurpRemainder(c)
}

func (rr *NAPTR) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad NAPTR Order", lex: l}
        }
        rr.Order = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e1 := strconv.ParseUint(l.token, 10, 16)
        if e1 != nil || l.err {
                return &ParseError{err: "bad NAPTR Preference", lex: l}
        }
        rr.Preference = uint16(i)

        // Flags
        c.Next()        // zBlank
        l, _ = c.Next() // _QUOTE
        if l.value != zQuote {
                return &ParseError{err: "bad NAPTR Flags", lex: l}
        }
        l, _ = c.Next() // Either String or Quote
        if l.value == zString {
                rr.Flags = l.token
                l, _ = c.Next() // _QUOTE
                if l.value != zQuote {
                        return &ParseError{err: "bad NAPTR Flags", lex: l}
                }
        } else if l.value == zQuote {
                rr.Flags = ""
        } else {
                return &ParseError{err: "bad NAPTR Flags", lex: l}
        }

        // Service
        c.Next()        // zBlank
        l, _ = c.Next() // _QUOTE
        if l.value != zQuote {
                return &ParseError{err: "bad NAPTR Service", lex: l}
        }
        l, _ = c.Next() // Either String or Quote
        if l.value == zString {
                rr.Service = l.token
                l, _ = c.Next() // _QUOTE
                if l.value != zQuote {
                        return &ParseError{err: "bad NAPTR Service", lex: l}
                }
        } else if l.value == zQuote {
                rr.Service = ""
        } else {
                return &ParseError{err: "bad NAPTR Service", lex: l}
        }

        // Regexp
        c.Next()        // zBlank
        l, _ = c.Next() // _QUOTE
        if l.value != zQuote {
                return &ParseError{err: "bad NAPTR Regexp", lex: l}
        }
        l, _ = c.Next() // Either String or Quote
        if l.value == zString {
                rr.Regexp = l.token
                l, _ = c.Next() // _QUOTE
                if l.value != zQuote {
                        return &ParseError{err: "bad NAPTR Regexp", lex: l}
                }
        } else if l.value == zQuote {
                rr.Regexp = ""
        } else {
                return &ParseError{err: "bad NAPTR Regexp", lex: l}
        }

        // After quote no space??
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Replacement = l.token

        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad NAPTR Replacement", lex: l}
        }
        rr.Replacement = name
        return slurpRemainder(c)
}

func (rr *TALINK) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        previousName, previousNameOk := toAbsoluteName(l.token, o)
        if l.err || !previousNameOk {
                return &ParseError{err: "bad TALINK PreviousName", lex: l}
        }
        rr.PreviousName = previousName

        c.Next() // zBlank
        l, _ = c.Next()
        rr.NextName = l.token

        nextName, nextNameOk := toAbsoluteName(l.token, o)
        if l.err || !nextNameOk {
                return &ParseError{err: "bad TALINK NextName", lex: l}
        }
        rr.NextName = nextName

        return slurpRemainder(c)
}

func (rr *LOC) parse(c *zlexer, o string) *ParseError {
        // Non zero defaults for LOC record, see RFC 1876, Section 3.
        rr.Size = 0x12     // 1e2 cm (1m)
        rr.HorizPre = 0x16 // 1e6 cm (10000m)
        rr.VertPre = 0x13  // 1e3 cm (10m)
        ok := false

        // North
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 32)
        if e != nil || l.err || i > 90 {
                return &ParseError{err: "bad LOC Latitude", lex: l}
        }
        rr.Latitude = 1000 * 60 * 60 * uint32(i)

        c.Next() // zBlank
        // Either number, 'N' or 'S'
        l, _ = c.Next()
        if rr.Latitude, ok = locCheckNorth(l.token, rr.Latitude); ok {
                goto East
        }
        if i, err := strconv.ParseUint(l.token, 10, 32); err != nil || l.err || i > 59 {
                return &ParseError{err: "bad LOC Latitude minutes", lex: l}
        } else {
                rr.Latitude += 1000 * 60 * uint32(i)
        }

        c.Next() // zBlank
        l, _ = c.Next()
        if i, err := strconv.ParseFloat(l.token, 64); err != nil || l.err || i < 0 || i >= 60 {
                return &ParseError{err: "bad LOC Latitude seconds", lex: l}
        } else {
                rr.Latitude += uint32(1000 * i)
        }
        c.Next() // zBlank
        // Either number, 'N' or 'S'
        l, _ = c.Next()
        if rr.Latitude, ok = locCheckNorth(l.token, rr.Latitude); ok {
                goto East
        }
        // If still alive, flag an error
        return &ParseError{err: "bad LOC Latitude North/South", lex: l}

East:
        // East
        c.Next() // zBlank
        l, _ = c.Next()
        if i, err := strconv.ParseUint(l.token, 10, 32); err != nil || l.err || i > 180 {
                return &ParseError{err: "bad LOC Longitude", lex: l}
        } else {
                rr.Longitude = 1000 * 60 * 60 * uint32(i)
        }
        c.Next() // zBlank
        // Either number, 'E' or 'W'
        l, _ = c.Next()
        if rr.Longitude, ok = locCheckEast(l.token, rr.Longitude); ok {
                goto Altitude
        }
        if i, err := strconv.ParseUint(l.token, 10, 32); err != nil || l.err || i > 59 {
                return &ParseError{err: "bad LOC Longitude minutes", lex: l}
        } else {
                rr.Longitude += 1000 * 60 * uint32(i)
        }
        c.Next() // zBlank
        l, _ = c.Next()
        if i, err := strconv.ParseFloat(l.token, 64); err != nil || l.err || i < 0 || i >= 60 {
                return &ParseError{err: "bad LOC Longitude seconds", lex: l}
        } else {
                rr.Longitude += uint32(1000 * i)
        }
        c.Next() // zBlank
        // Either number, 'E' or 'W'
        l, _ = c.Next()
        if rr.Longitude, ok = locCheckEast(l.token, rr.Longitude); ok {
                goto Altitude
        }
        // If still alive, flag an error
        return &ParseError{err: "bad LOC Longitude East/West", lex: l}

Altitude:
        c.Next() // zBlank
        l, _ = c.Next()
        if l.token == "" || l.err {
                return &ParseError{err: "bad LOC Altitude", lex: l}
        }
        if l.token[len(l.token)-1] == 'M' || l.token[len(l.token)-1] == 'm' {
                l.token = l.token[0 : len(l.token)-1]
        }
        if i, err := strconv.ParseFloat(l.token, 64); err != nil {
                return &ParseError{err: "bad LOC Altitude", lex: l}
        } else {
                rr.Altitude = uint32(i*100.0 + 10000000.0 + 0.5)
        }

        // And now optionally the other values
        l, _ = c.Next()
        count := 0
        for l.value != zNewline && l.value != zEOF {
                switch l.value {
                case zString:
                        switch count {
                        case 0: // Size
                                exp, m, ok := stringToCm(l.token)
                                if !ok {
                                        return &ParseError{err: "bad LOC Size", lex: l}
                                }
                                rr.Size = exp&0x0f | m<<4&0xf0
                        case 1: // HorizPre
                                exp, m, ok := stringToCm(l.token)
                                if !ok {
                                        return &ParseError{err: "bad LOC HorizPre", lex: l}
                                }
                                rr.HorizPre = exp&0x0f | m<<4&0xf0
                        case 2: // VertPre
                                exp, m, ok := stringToCm(l.token)
                                if !ok {
                                        return &ParseError{err: "bad LOC VertPre", lex: l}
                                }
                                rr.VertPre = exp&0x0f | m<<4&0xf0
                        }
                        count++
                case zBlank:
                        // Ok
                default:
                        return &ParseError{err: "bad LOC Size, HorizPre or VertPre", lex: l}
                }
                l, _ = c.Next()
        }
        return nil
}

func (rr *HIP) parse(c *zlexer, o string) *ParseError {
        // HitLength is not represented
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad HIP PublicKeyAlgorithm", lex: l}
        }
        rr.PublicKeyAlgorithm = uint8(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        if l.token == "" || l.err {
                return &ParseError{err: "bad HIP Hit", lex: l}
        }
        rr.Hit = l.token // This can not contain spaces, see RFC 5205 Section 6.
        rr.HitLength = uint8(len(rr.Hit)) / 2

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        if l.token == "" || l.err {
                return &ParseError{err: "bad HIP PublicKey", lex: l}
        }
        rr.PublicKey = l.token // This cannot contain spaces
        decodedPK, decodedPKerr := base64.StdEncoding.DecodeString(rr.PublicKey)
        if decodedPKerr != nil {
                return &ParseError{err: "bad HIP PublicKey", lex: l}
        }
        rr.PublicKeyLength = uint16(len(decodedPK))

        // RendezvousServers (if any)
        l, _ = c.Next()
        var xs []string
        for l.value != zNewline && l.value != zEOF {
                switch l.value {
                case zString:
                        name, nameOk := toAbsoluteName(l.token, o)
                        if l.err || !nameOk {
                                return &ParseError{err: "bad HIP RendezvousServers", lex: l}
                        }
                        xs = append(xs, name)
                case zBlank:
                        // Ok
                default:
                        return &ParseError{err: "bad HIP RendezvousServers", lex: l}
                }
                l, _ = c.Next()
        }

        rr.RendezvousServers = xs
        return nil
}

func (rr *CERT) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        if v, ok := StringToCertType[l.token]; ok {
                rr.Type = v
        } else if i, err := strconv.ParseUint(l.token, 10, 16); err != nil {
                return &ParseError{err: "bad CERT Type", lex: l}
        } else {
                rr.Type = uint16(i)
        }
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad CERT KeyTag", lex: l}
        }
        rr.KeyTag = uint16(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        if v, ok := StringToAlgorithm[l.token]; ok {
                rr.Algorithm = v
        } else if i, err := strconv.ParseUint(l.token, 10, 8); err != nil {
                return &ParseError{err: "bad CERT Algorithm", lex: l}
        } else {
                rr.Algorithm = uint8(i)
        }
        s, e1 := endingToString(c, "bad CERT Certificate")
        if e1 != nil {
                return e1
        }
        rr.Certificate = s
        return nil
}

func (rr *OPENPGPKEY) parse(c *zlexer, o string) *ParseError {
        s, e := endingToString(c, "bad OPENPGPKEY PublicKey")
        if e != nil {
                return e
        }
        rr.PublicKey = s
        return nil
}

func (rr *CSYNC) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        j, e := strconv.ParseUint(l.token, 10, 32)
        if e != nil {
                // Serial must be a number
                return &ParseError{err: "bad CSYNC serial", lex: l}
        }
        rr.Serial = uint32(j)

        c.Next() // zBlank

        l, _ = c.Next()
        j, e1 := strconv.ParseUint(l.token, 10, 16)
        if e1 != nil {
                // Serial must be a number
                return &ParseError{err: "bad CSYNC flags", lex: l}
        }
        rr.Flags = uint16(j)

        rr.TypeBitMap = make([]uint16, 0)
        var (
                k  uint16
                ok bool
        )
        l, _ = c.Next()
        for l.value != zNewline && l.value != zEOF {
                switch l.value {
                case zBlank:
                        // Ok
                case zString:
                        tokenUpper := strings.ToUpper(l.token)
                        if k, ok = StringToType[tokenUpper]; !ok {
                                if k, ok = typeToInt(l.token); !ok {
                                        return &ParseError{err: "bad CSYNC TypeBitMap", lex: l}
                                }
                        }
                        rr.TypeBitMap = append(rr.TypeBitMap, k)
                default:
                        return &ParseError{err: "bad CSYNC TypeBitMap", lex: l}
                }
                l, _ = c.Next()
        }
        return nil
}

func (rr *ZONEMD) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 32)
        if e != nil || l.err {
                return &ParseError{err: "bad ZONEMD Serial", lex: l}
        }
        rr.Serial = uint32(i)

        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad ZONEMD Scheme", lex: l}
        }
        rr.Scheme = uint8(i)

        c.Next() // zBlank
        l, _ = c.Next()
        i, err := strconv.ParseUint(l.token, 10, 8)
        if err != nil || l.err {
                return &ParseError{err: "bad ZONEMD Hash Algorithm", lex: l}
        }
        rr.Hash = uint8(i)

        s, e2 := endingToString(c, "bad ZONEMD Digest")
        if e2 != nil {
                return e2
        }
        rr.Digest = s
        return nil
}

func (rr *SIG) parse(c *zlexer, o string) *ParseError { return rr.RRSIG.parse(c, o) }

func (rr *RRSIG) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        tokenUpper := strings.ToUpper(l.token)
        if t, ok := StringToType[tokenUpper]; !ok {
                if strings.HasPrefix(tokenUpper, "TYPE") {
                        t, ok = typeToInt(l.token)
                        if !ok {
                                return &ParseError{err: "bad RRSIG Typecovered", lex: l}
                        }
                        rr.TypeCovered = t
                } else {
                        return &ParseError{err: "bad RRSIG Typecovered", lex: l}
                }
        } else {
                rr.TypeCovered = t
        }

        c.Next() // zBlank
        l, _ = c.Next()
        if l.err {
                return &ParseError{err: "bad RRSIG Algorithm", lex: l}
        }
        i, e := strconv.ParseUint(l.token, 10, 8)
        rr.Algorithm = uint8(i) // if 0 we'll check the mnemonic in the if
        if e != nil {
                v, ok := StringToAlgorithm[l.token]
                if !ok {
                        return &ParseError{err: "bad RRSIG Algorithm", lex: l}
                }
                rr.Algorithm = v
        }

        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad RRSIG Labels", lex: l}
        }
        rr.Labels = uint8(i)

        c.Next() // zBlank
        l, _ = c.Next()
        i, e2 := strconv.ParseUint(l.token, 10, 32)
        if e2 != nil || l.err {
                return &ParseError{err: "bad RRSIG OrigTtl", lex: l}
        }
        rr.OrigTtl = uint32(i)

        c.Next() // zBlank
        l, _ = c.Next()
        if i, err := StringToTime(l.token); err != nil {
                // Try to see if all numeric and use it as epoch
                if i, err := strconv.ParseUint(l.token, 10, 32); err == nil {
                        rr.Expiration = uint32(i)
                } else {
                        return &ParseError{err: "bad RRSIG Expiration", lex: l}
                }
        } else {
                rr.Expiration = i
        }

        c.Next() // zBlank
        l, _ = c.Next()
        if i, err := StringToTime(l.token); err != nil {
                if i, err := strconv.ParseUint(l.token, 10, 32); err == nil {
                        rr.Inception = uint32(i)
                } else {
                        return &ParseError{err: "bad RRSIG Inception", lex: l}
                }
        } else {
                rr.Inception = i
        }

        c.Next() // zBlank
        l, _ = c.Next()
        i, e3 := strconv.ParseUint(l.token, 10, 16)
        if e3 != nil || l.err {
                return &ParseError{err: "bad RRSIG KeyTag", lex: l}
        }
        rr.KeyTag = uint16(i)

        c.Next() // zBlank
        l, _ = c.Next()
        rr.SignerName = l.token
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad RRSIG SignerName", lex: l}
        }
        rr.SignerName = name

        s, e4 := endingToString(c, "bad RRSIG Signature")
        if e4 != nil {
                return e4
        }
        rr.Signature = s

        return nil
}

func (rr *NXT) parse(c *zlexer, o string) *ParseError { return rr.NSEC.parse(c, o) }

func (rr *NSEC) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad NSEC NextDomain", lex: l}
        }
        rr.NextDomain = name

        rr.TypeBitMap = make([]uint16, 0)
        var (
                k  uint16
                ok bool
        )
        l, _ = c.Next()
        for l.value != zNewline && l.value != zEOF {
                switch l.value {
                case zBlank:
                        // Ok
                case zString:
                        tokenUpper := strings.ToUpper(l.token)
                        if k, ok = StringToType[tokenUpper]; !ok {
                                if k, ok = typeToInt(l.token); !ok {
                                        return &ParseError{err: "bad NSEC TypeBitMap", lex: l}
                                }
                        }
                        rr.TypeBitMap = append(rr.TypeBitMap, k)
                default:
                        return &ParseError{err: "bad NSEC TypeBitMap", lex: l}
                }
                l, _ = c.Next()
        }
        return nil
}

func (rr *NSEC3) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad NSEC3 Hash", lex: l}
        }
        rr.Hash = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad NSEC3 Flags", lex: l}
        }
        rr.Flags = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e2 := strconv.ParseUint(l.token, 10, 16)
        if e2 != nil || l.err {
                return &ParseError{err: "bad NSEC3 Iterations", lex: l}
        }
        rr.Iterations = uint16(i)
        c.Next()
        l, _ = c.Next()
        if l.token == "" || l.err {
                return &ParseError{err: "bad NSEC3 Salt", lex: l}
        }
        if l.token != "-" {
                rr.SaltLength = uint8(len(l.token)) / 2
                rr.Salt = l.token
        }

        c.Next()
        l, _ = c.Next()
        if l.token == "" || l.err {
                return &ParseError{err: "bad NSEC3 NextDomain", lex: l}
        }
        rr.HashLength = 20 // Fix for NSEC3 (sha1 160 bits)
        rr.NextDomain = l.token

        rr.TypeBitMap = make([]uint16, 0)
        var (
                k  uint16
                ok bool
        )
        l, _ = c.Next()
        for l.value != zNewline && l.value != zEOF {
                switch l.value {
                case zBlank:
                        // Ok
                case zString:
                        tokenUpper := strings.ToUpper(l.token)
                        if k, ok = StringToType[tokenUpper]; !ok {
                                if k, ok = typeToInt(l.token); !ok {
                                        return &ParseError{err: "bad NSEC3 TypeBitMap", lex: l}
                                }
                        }
                        rr.TypeBitMap = append(rr.TypeBitMap, k)
                default:
                        return &ParseError{err: "bad NSEC3 TypeBitMap", lex: l}
                }
                l, _ = c.Next()
        }
        return nil
}

func (rr *NSEC3PARAM) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad NSEC3PARAM Hash", lex: l}
        }
        rr.Hash = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad NSEC3PARAM Flags", lex: l}
        }
        rr.Flags = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e2 := strconv.ParseUint(l.token, 10, 16)
        if e2 != nil || l.err {
                return &ParseError{err: "bad NSEC3PARAM Iterations", lex: l}
        }
        rr.Iterations = uint16(i)
        c.Next()
        l, _ = c.Next()
        if l.token != "-" {
                rr.SaltLength = uint8(len(l.token) / 2)
                rr.Salt = l.token
        }
        return slurpRemainder(c)
}

func (rr *EUI48) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        if len(l.token) != 17 || l.err {
                return &ParseError{err: "bad EUI48 Address", lex: l}
        }
        addr := make([]byte, 12)
        dash := 0
        for i := 0; i < 10; i += 2 {
                addr[i] = l.token[i+dash]
                addr[i+1] = l.token[i+1+dash]
                dash++
                if l.token[i+1+dash] != '-' {
                        return &ParseError{err: "bad EUI48 Address", lex: l}
                }
        }
        addr[10] = l.token[15]
        addr[11] = l.token[16]

        i, e := strconv.ParseUint(string(addr), 16, 48)
        if e != nil {
                return &ParseError{err: "bad EUI48 Address", lex: l}
        }
        rr.Address = i
        return slurpRemainder(c)
}

func (rr *EUI64) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        if len(l.token) != 23 || l.err {
                return &ParseError{err: "bad EUI64 Address", lex: l}
        }
        addr := make([]byte, 16)
        dash := 0
        for i := 0; i < 14; i += 2 {
                addr[i] = l.token[i+dash]
                addr[i+1] = l.token[i+1+dash]
                dash++
                if l.token[i+1+dash] != '-' {
                        return &ParseError{err: "bad EUI64 Address", lex: l}
                }
        }
        addr[14] = l.token[21]
        addr[15] = l.token[22]

        i, e := strconv.ParseUint(string(addr), 16, 64)
        if e != nil {
                return &ParseError{err: "bad EUI68 Address", lex: l}
        }
        rr.Address = i
        return slurpRemainder(c)
}

func (rr *SSHFP) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad SSHFP Algorithm", lex: l}
        }
        rr.Algorithm = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad SSHFP Type", lex: l}
        }
        rr.Type = uint8(i)
        c.Next() // zBlank
        s, e2 := endingToString(c, "bad SSHFP Fingerprint")
        if e2 != nil {
                return e2
        }
        rr.FingerPrint = s
        return nil
}

func (rr *DNSKEY) parseDNSKEY(c *zlexer, o, typ string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad " + typ + " Flags", lex: l}
        }
        rr.Flags = uint16(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad " + typ + " Protocol", lex: l}
        }
        rr.Protocol = uint8(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e2 := strconv.ParseUint(l.token, 10, 8)
        if e2 != nil || l.err {
                return &ParseError{err: "bad " + typ + " Algorithm", lex: l}
        }
        rr.Algorithm = uint8(i)
        s, e3 := endingToString(c, "bad "+typ+" PublicKey")
        if e3 != nil {
                return e3
        }
        rr.PublicKey = s
        return nil
}

func (rr *DNSKEY) parse(c *zlexer, o string) *ParseError  { return rr.parseDNSKEY(c, o, "DNSKEY") }
func (rr *KEY) parse(c *zlexer, o string) *ParseError     { return rr.parseDNSKEY(c, o, "KEY") }
func (rr *CDNSKEY) parse(c *zlexer, o string) *ParseError { return rr.parseDNSKEY(c, o, "CDNSKEY") }
func (rr *DS) parse(c *zlexer, o string) *ParseError      { return rr.parseDS(c, o, "DS") }
func (rr *DLV) parse(c *zlexer, o string) *ParseError     { return rr.parseDS(c, o, "DLV") }
func (rr *CDS) parse(c *zlexer, o string) *ParseError     { return rr.parseDS(c, o, "CDS") }

func (rr *IPSECKEY) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        num, err := strconv.ParseUint(l.token, 10, 8)
        if err != nil || l.err {
                return &ParseError{err: "bad IPSECKEY value", lex: l}
        }
        rr.Precedence = uint8(num)
        c.Next() // zBlank

        l, _ = c.Next()
        num, err = strconv.ParseUint(l.token, 10, 8)
        if err != nil || l.err {
                return &ParseError{err: "bad IPSECKEY value", lex: l}
        }
        rr.GatewayType = uint8(num)
        c.Next() // zBlank

        l, _ = c.Next()
        num, err = strconv.ParseUint(l.token, 10, 8)
        if err != nil || l.err {
                return &ParseError{err: "bad IPSECKEY value", lex: l}
        }
        rr.Algorithm = uint8(num)
        c.Next() // zBlank

        l, _ = c.Next()
        if l.err {
                return &ParseError{err: "bad IPSECKEY gateway", lex: l}
        }

        rr.GatewayAddr, rr.GatewayHost, err = parseAddrHostUnion(l.token, o, rr.GatewayType)
        if err != nil {
                return &ParseError{wrappedErr: fmt.Errorf("IPSECKEY %w", err), lex: l}
        }

        c.Next() // zBlank

        s, pErr := endingToString(c, "bad IPSECKEY PublicKey")
        if pErr != nil {
                return pErr
        }
        rr.PublicKey = s
        return slurpRemainder(c)
}

func (rr *AMTRELAY) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        num, err := strconv.ParseUint(l.token, 10, 8)
        if err != nil || l.err {
                return &ParseError{err: "bad AMTRELAY value", lex: l}
        }
        rr.Precedence = uint8(num)
        c.Next() // zBlank

        l, _ = c.Next()
        if l.err || !(l.token == "0" || l.token == "1") {
                return &ParseError{err: "bad discovery value", lex: l}
        }
        if l.token == "1" {
                rr.GatewayType = 0x80
        }

        c.Next() // zBlank

        l, _ = c.Next()
        num, err = strconv.ParseUint(l.token, 10, 8)
        if err != nil || l.err {
                return &ParseError{err: "bad AMTRELAY value", lex: l}
        }
        rr.GatewayType |= uint8(num)
        c.Next() // zBlank

        l, _ = c.Next()
        if l.err {
                return &ParseError{err: "bad AMTRELAY gateway", lex: l}
        }

        rr.GatewayAddr, rr.GatewayHost, err = parseAddrHostUnion(l.token, o, rr.GatewayType&0x7f)
        if err != nil {
                return &ParseError{wrappedErr: fmt.Errorf("AMTRELAY %w", err), lex: l}
        }

        return slurpRemainder(c)
}

// same constants and parsing between IPSECKEY and AMTRELAY
func parseAddrHostUnion(token, o string, gatewayType uint8) (addr net.IP, host string, err error) {
        switch gatewayType {
        case IPSECGatewayNone:
                if token != "." {
                        return addr, host, errors.New("gateway type none with gateway set")
                }
        case IPSECGatewayIPv4, IPSECGatewayIPv6:
                addr = net.ParseIP(token)
                if addr == nil {
                        return addr, host, errors.New("gateway IP invalid")
                }
                if (addr.To4() == nil) == (gatewayType == IPSECGatewayIPv4) {
                        return addr, host, errors.New("gateway IP family mismatch")
                }
        case IPSECGatewayHost:
                var ok bool
                host, ok = toAbsoluteName(token, o)
                if !ok {
                        return addr, host, errors.New("invalid gateway host")
                }
        }

        return addr, host, nil
}

func (rr *RKEY) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad RKEY Flags", lex: l}
        }
        rr.Flags = uint16(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad RKEY Protocol", lex: l}
        }
        rr.Protocol = uint8(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        i, e2 := strconv.ParseUint(l.token, 10, 8)
        if e2 != nil || l.err {
                return &ParseError{err: "bad RKEY Algorithm", lex: l}
        }
        rr.Algorithm = uint8(i)
        s, e3 := endingToString(c, "bad RKEY PublicKey")
        if e3 != nil {
                return e3
        }
        rr.PublicKey = s
        return nil
}

func (rr *EID) parse(c *zlexer, o string) *ParseError {
        s, e := endingToString(c, "bad EID Endpoint")
        if e != nil {
                return e
        }
        rr.Endpoint = s
        return nil
}

func (rr *NIMLOC) parse(c *zlexer, o string) *ParseError {
        s, e := endingToString(c, "bad NIMLOC Locator")
        if e != nil {
                return e
        }
        rr.Locator = s
        return nil
}

func (rr *GPOS) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        _, e := strconv.ParseFloat(l.token, 64)
        if e != nil || l.err {
                return &ParseError{err: "bad GPOS Longitude", lex: l}
        }
        rr.Longitude = l.token
        c.Next() // zBlank
        l, _ = c.Next()
        _, e1 := strconv.ParseFloat(l.token, 64)
        if e1 != nil || l.err {
                return &ParseError{err: "bad GPOS Latitude", lex: l}
        }
        rr.Latitude = l.token
        c.Next() // zBlank
        l, _ = c.Next()
        _, e2 := strconv.ParseFloat(l.token, 64)
        if e2 != nil || l.err {
                return &ParseError{err: "bad GPOS Altitude", lex: l}
        }
        rr.Altitude = l.token
        return slurpRemainder(c)
}

func (rr *DS) parseDS(c *zlexer, o, typ string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad " + typ + " KeyTag", lex: l}
        }
        rr.KeyTag = uint16(i)
        c.Next() // zBlank
        l, _ = c.Next()
        if i, err := strconv.ParseUint(l.token, 10, 8); err != nil {
                tokenUpper := strings.ToUpper(l.token)
                i, ok := StringToAlgorithm[tokenUpper]
                if !ok || l.err {
                        return &ParseError{err: "bad " + typ + " Algorithm", lex: l}
                }
                rr.Algorithm = i
        } else {
                rr.Algorithm = uint8(i)
        }
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad " + typ + " DigestType", lex: l}
        }
        rr.DigestType = uint8(i)
        s, e2 := endingToString(c, "bad "+typ+" Digest")
        if e2 != nil {
                return e2
        }
        rr.Digest = s
        return nil
}

func (rr *TA) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad TA KeyTag", lex: l}
        }
        rr.KeyTag = uint16(i)
        c.Next() // zBlank
        l, _ = c.Next()
        if i, err := strconv.ParseUint(l.token, 10, 8); err != nil {
                tokenUpper := strings.ToUpper(l.token)
                i, ok := StringToAlgorithm[tokenUpper]
                if !ok || l.err {
                        return &ParseError{err: "bad TA Algorithm", lex: l}
                }
                rr.Algorithm = i
        } else {
                rr.Algorithm = uint8(i)
        }
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad TA DigestType", lex: l}
        }
        rr.DigestType = uint8(i)
        s, e2 := endingToString(c, "bad TA Digest")
        if e2 != nil {
                return e2
        }
        rr.Digest = s
        return nil
}

func (rr *TLSA) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad TLSA Usage", lex: l}
        }
        rr.Usage = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad TLSA Selector", lex: l}
        }
        rr.Selector = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e2 := strconv.ParseUint(l.token, 10, 8)
        if e2 != nil || l.err {
                return &ParseError{err: "bad TLSA MatchingType", lex: l}
        }
        rr.MatchingType = uint8(i)
        // So this needs be e2 (i.e. different than e), because...??t
        s, e3 := endingToString(c, "bad TLSA Certificate")
        if e3 != nil {
                return e3
        }
        rr.Certificate = s
        return nil
}

func (rr *SMIMEA) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad SMIMEA Usage", lex: l}
        }
        rr.Usage = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad SMIMEA Selector", lex: l}
        }
        rr.Selector = uint8(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e2 := strconv.ParseUint(l.token, 10, 8)
        if e2 != nil || l.err {
                return &ParseError{err: "bad SMIMEA MatchingType", lex: l}
        }
        rr.MatchingType = uint8(i)
        // So this needs be e2 (i.e. different than e), because...??t
        s, e3 := endingToString(c, "bad SMIMEA Certificate")
        if e3 != nil {
                return e3
        }
        rr.Certificate = s
        return nil
}

func (rr *RFC3597) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        if l.token != "\\#" {
                return &ParseError{err: "bad RFC3597 Rdata", lex: l}
        }

        c.Next() // zBlank
        l, _ = c.Next()
        rdlength, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad RFC3597 Rdata ", lex: l}
        }

        s, e1 := endingToString(c, "bad RFC3597 Rdata")
        if e1 != nil {
                return e1
        }
        if int(rdlength)*2 != len(s) {
                return &ParseError{err: "bad RFC3597 Rdata", lex: l}
        }
        rr.Rdata = s
        return nil
}

func (rr *SPF) parse(c *zlexer, o string) *ParseError {
        s, e := endingToTxtSlice(c, "bad SPF Txt")
        if e != nil {
                return e
        }
        rr.Txt = s
        return nil
}

func (rr *AVC) parse(c *zlexer, o string) *ParseError {
        s, e := endingToTxtSlice(c, "bad AVC Txt")
        if e != nil {
                return e
        }
        rr.Txt = s
        return nil
}

func (rr *TXT) parse(c *zlexer, o string) *ParseError {
        // no zBlank reading here, because all this rdata is TXT
        s, e := endingToTxtSlice(c, "bad TXT Txt")
        if e != nil {
                return e
        }
        rr.Txt = s
        return nil
}

// identical to setTXT
func (rr *NINFO) parse(c *zlexer, o string) *ParseError {
        s, e := endingToTxtSlice(c, "bad NINFO ZSData")
        if e != nil {
                return e
        }
        rr.ZSData = s
        return nil
}

func (rr *URI) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad URI Priority", lex: l}
        }
        rr.Priority = uint16(i)
        c.Next() // zBlank
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 16)
        if e1 != nil || l.err {
                return &ParseError{err: "bad URI Weight", lex: l}
        }
        rr.Weight = uint16(i)

        c.Next() // zBlank
        s, e2 := endingToTxtSlice(c, "bad URI Target")
        if e2 != nil {
                return e2
        }
        if len(s) != 1 {
                return &ParseError{err: "bad URI Target", lex: l}
        }
        rr.Target = s[0]
        return nil
}

func (rr *DHCID) parse(c *zlexer, o string) *ParseError {
        // awesome record to parse!
        s, e := endingToString(c, "bad DHCID Digest")
        if e != nil {
                return e
        }
        rr.Digest = s
        return nil
}

func (rr *NID) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad NID Preference", lex: l}
        }
        rr.Preference = uint16(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        u, e1 := stringToNodeID(l)
        if e1 != nil || l.err {
                return e1
        }
        rr.NodeID = u
        return slurpRemainder(c)
}

func (rr *L32) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad L32 Preference", lex: l}
        }
        rr.Preference = uint16(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Locator32 = net.ParseIP(l.token)
        if rr.Locator32 == nil || l.err {
                return &ParseError{err: "bad L32 Locator", lex: l}
        }
        return slurpRemainder(c)
}

func (rr *LP) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad LP Preference", lex: l}
        }
        rr.Preference = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Fqdn = l.token
        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{err: "bad LP Fqdn", lex: l}
        }
        rr.Fqdn = name
        return slurpRemainder(c)
}

func (rr *L64) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad L64 Preference", lex: l}
        }
        rr.Preference = uint16(i)
        c.Next()        // zBlank
        l, _ = c.Next() // zString
        u, e1 := stringToNodeID(l)
        if e1 != nil || l.err {
                return e1
        }
        rr.Locator64 = u
        return slurpRemainder(c)
}

func (rr *UID) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 32)
        if e != nil || l.err {
                return &ParseError{err: "bad UID Uid", lex: l}
        }
        rr.Uid = uint32(i)
        return slurpRemainder(c)
}

func (rr *GID) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 32)
        if e != nil || l.err {
                return &ParseError{err: "bad GID Gid", lex: l}
        }
        rr.Gid = uint32(i)
        return slurpRemainder(c)
}

func (rr *UINFO) parse(c *zlexer, o string) *ParseError {
        s, e := endingToTxtSlice(c, "bad UINFO Uinfo")
        if e != nil {
                return e
        }
        if ln := len(s); ln == 0 {
                return nil
        }
        rr.Uinfo = s[0] // silently discard anything after the first character-string
        return nil
}

func (rr *PX) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{err: "bad PX Preference", lex: l}
        }
        rr.Preference = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Map822 = l.token
        map822, map822Ok := toAbsoluteName(l.token, o)
        if l.err || !map822Ok {
                return &ParseError{err: "bad PX Map822", lex: l}
        }
        rr.Map822 = map822

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Mapx400 = l.token
        mapx400, mapx400Ok := toAbsoluteName(l.token, o)
        if l.err || !mapx400Ok {
                return &ParseError{err: "bad PX Mapx400", lex: l}
        }
        rr.Mapx400 = mapx400
        return slurpRemainder(c)
}

func (rr *CAA) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad CAA Flag", lex: l}
        }
        rr.Flag = uint8(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        if l.value != zString {
                return &ParseError{err: "bad CAA Tag", lex: l}
        }
        rr.Tag = l.token

        c.Next() // zBlank
        s, e1 := endingToTxtSlice(c, "bad CAA Value")
        if e1 != nil {
                return e1
        }
        if len(s) != 1 {
                return &ParseError{err: "bad CAA Value", lex: l}
        }
        rr.Value = s[0]
        return nil
}

func (rr *TKEY) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()

        // Algorithm
        if l.value != zString {
                return &ParseError{err: "bad TKEY algorithm", lex: l}
        }
        rr.Algorithm = l.token
        c.Next() // zBlank

        // Get the key length and key values
        l, _ = c.Next()
        i, e := strconv.ParseUint(l.token, 10, 8)
        if e != nil || l.err {
                return &ParseError{err: "bad TKEY key length", lex: l}
        }
        rr.KeySize = uint16(i)
        c.Next() // zBlank
        l, _ = c.Next()
        if l.value != zString {
                return &ParseError{err: "bad TKEY key", lex: l}
        }
        rr.Key = l.token
        c.Next() // zBlank

        // Get the otherdata length and string data
        l, _ = c.Next()
        i, e1 := strconv.ParseUint(l.token, 10, 8)
        if e1 != nil || l.err {
                return &ParseError{err: "bad TKEY otherdata length", lex: l}
        }
        rr.OtherLen = uint16(i)
        c.Next() // zBlank
        l, _ = c.Next()
        if l.value != zString {
                return &ParseError{err: "bad TKEY otherday", lex: l}
        }
        rr.OtherData = l.token
        return nil
}

func (rr *APL) parse(c *zlexer, o string) *ParseError {
        var prefixes []APLPrefix

        for {
                l, _ := c.Next()
                if l.value == zNewline || l.value == zEOF {
                        break
                }
                if l.value == zBlank && prefixes != nil {
                        continue
                }
                if l.value != zString {
                        return &ParseError{err: "unexpected APL field", lex: l}
                }

                // Expected format: [!]afi:address/prefix

                colon := strings.IndexByte(l.token, ':')
                if colon == -1 {
                        return &ParseError{err: "missing colon in APL field", lex: l}
                }

                family, cidr := l.token[:colon], l.token[colon+1:]

                var negation bool
                if family != "" && family[0] == '!' {
                        negation = true
                        family = family[1:]
                }

                afi, e := strconv.ParseUint(family, 10, 16)
                if e != nil {
                        return &ParseError{wrappedErr: fmt.Errorf("failed to parse APL family: %w", e), lex: l}
                }
                var addrLen int
                switch afi {
                case 1:
                        addrLen = net.IPv4len
                case 2:
                        addrLen = net.IPv6len
                default:
                        return &ParseError{err: "unrecognized APL family", lex: l}
                }

                ip, subnet, e1 := net.ParseCIDR(cidr)
                if e1 != nil {
                        return &ParseError{wrappedErr: fmt.Errorf("failed to parse APL address: %w", e1), lex: l}
                }
                if !ip.Equal(subnet.IP) {
                        return &ParseError{err: "extra bits in APL address", lex: l}
                }

                if len(subnet.IP) != addrLen {
                        return &ParseError{err: "address mismatch with the APL family", lex: l}
                }

                prefixes = append(prefixes, APLPrefix{
                        Negation: negation,
                        Network:  *subnet,
                })
        }

        rr.Prefixes = prefixes
        return nil
}

// escapedStringOffset finds the offset within a string (which may contain escape
// sequences) that corresponds to a certain byte offset. If the input offset is
// out of bounds, -1 is returned (which is *not* considered an error).
func escapedStringOffset(s string, desiredByteOffset int) (int, bool) {
        if desiredByteOffset == 0 {
                return 0, true
        }

        currentByteOffset, i := 0, 0

        for i < len(s) {
                currentByteOffset += 1

                // Skip escape sequences
                if s[i] != '\\' {
                        // Single plain byte, not an escape sequence.
                        i++
                } else if isDDD(s[i+1:]) {
                        // Skip backslash and DDD.
                        i += 4
                } else if len(s[i+1:]) < 1 {
                        // No character following the backslash; that's an error.
                        return 0, false
                } else {
                        // Skip backslash and following byte.
                        i += 2
                }

                if currentByteOffset >= desiredByteOffset {
                        return i, true
                }
        }

        return -1, true
}

package dns

import (
        "sync"
)

// ServeMux is an DNS request multiplexer. It matches the zone name of
// each incoming request against a list of registered patterns add calls
// the handler for the pattern that most closely matches the zone name.
//
// ServeMux is DNSSEC aware, meaning that queries for the DS record are
// redirected to the parent zone (if that is also registered), otherwise
// the child gets the query.
//
// ServeMux is also safe for concurrent access from multiple goroutines.
//
// The zero ServeMux is empty and ready for use.
type ServeMux struct {
        z map[string]Handler
        m sync.RWMutex
}

// NewServeMux allocates and returns a new ServeMux.
func NewServeMux() *ServeMux {
        return new(ServeMux)
}

// DefaultServeMux is the default ServeMux used by Serve.
var DefaultServeMux = NewServeMux()

func (mux *ServeMux) match(q string, t uint16) Handler {
        mux.m.RLock()
        defer mux.m.RUnlock()
        if mux.z == nil {
                return nil
        }

        q = CanonicalName(q)

        var handler Handler
        for off, end := 0, false; !end; off, end = NextLabel(q, off) {
                if h, ok := mux.z[q[off:]]; ok {
                        if t != TypeDS {
                                return h
                        }
                        // Continue for DS to see if we have a parent too, if so delegate to the parent
                        handler = h
                }
        }

        // Wildcard match, if we have found nothing try the root zone as a last resort.
        if h, ok := mux.z["."]; ok {
                return h
        }

        return handler
}

// Handle adds a handler to the ServeMux for pattern.
func (mux *ServeMux) Handle(pattern string, handler Handler) {
        if pattern == "" {
                panic("dns: invalid pattern " + pattern)
        }
        mux.m.Lock()
        if mux.z == nil {
                mux.z = make(map[string]Handler)
        }
        mux.z[CanonicalName(pattern)] = handler
        mux.m.Unlock()
}

// HandleFunc adds a handler function to the ServeMux for pattern.
func (mux *ServeMux) HandleFunc(pattern string, handler func(ResponseWriter, *Msg)) {
        mux.Handle(pattern, HandlerFunc(handler))
}

// HandleRemove deregisters the handler specific for pattern from the ServeMux.
func (mux *ServeMux) HandleRemove(pattern string) {
        if pattern == "" {
                panic("dns: invalid pattern " + pattern)
        }
        mux.m.Lock()
        delete(mux.z, CanonicalName(pattern))
        mux.m.Unlock()
}

// ServeDNS dispatches the request to the handler whose pattern most
// closely matches the request message.
//
// ServeDNS is DNSSEC aware, meaning that queries for the DS record
// are redirected to the parent zone (if that is also registered),
// otherwise the child gets the query.
//
// If no handler is found, or there is no question, a standard REFUSED
// message is returned
func (mux *ServeMux) ServeDNS(w ResponseWriter, req *Msg) {
        var h Handler
        if len(req.Question) >= 1 { // allow more than one question
                h = mux.match(req.Question[0].Name, req.Question[0].Qtype)
        }

        if h != nil {
                h.ServeDNS(w, req)
        } else {
                handleRefused(w, req)
        }
}

// Handle registers the handler with the given pattern
// in the DefaultServeMux. The documentation for
// ServeMux explains how patterns are matched.
func Handle(pattern string, handler Handler) { DefaultServeMux.Handle(pattern, handler) }

// HandleRemove deregisters the handle with the given pattern
// in the DefaultServeMux.
func HandleRemove(pattern string) { DefaultServeMux.HandleRemove(pattern) }

// HandleFunc registers the handler function with the given pattern
// in the DefaultServeMux.
func HandleFunc(pattern string, handler func(ResponseWriter, *Msg)) {
        DefaultServeMux.HandleFunc(pattern, handler)
}

// DNS server implementation.

package dns

import (
        "context"
        "crypto/tls"
        "encoding/binary"
        "errors"
        "io"
        "net"
        "strings"
        "sync"
        "time"
)

// Default maximum number of TCP queries before we close the socket.
const maxTCPQueries = 128

// aLongTimeAgo is a non-zero time, far in the past, used for
// immediate cancellation of network operations.
var aLongTimeAgo = time.Unix(1, 0)

// Handler is implemented by any value that implements ServeDNS.
type Handler interface {
        ServeDNS(w ResponseWriter, r *Msg)
}

// The HandlerFunc type is an adapter to allow the use of
// ordinary functions as DNS handlers.  If f is a function
// with the appropriate signature, HandlerFunc(f) is a
// Handler object that calls f.
type HandlerFunc func(ResponseWriter, *Msg)

// ServeDNS calls f(w, r).
func (f HandlerFunc) ServeDNS(w ResponseWriter, r *Msg) {
        f(w, r)
}

// A ResponseWriter interface is used by an DNS handler to
// construct an DNS response.
type ResponseWriter interface {
        // LocalAddr returns the net.Addr of the server
        LocalAddr() net.Addr
        // RemoteAddr returns the net.Addr of the client that sent the current request.
        RemoteAddr() net.Addr
        // WriteMsg writes a reply back to the client.
        WriteMsg(*Msg) error
        // Write writes a raw buffer back to the client.
        Write([]byte) (int, error)
        // Close closes the connection.
        Close() error
        // TsigStatus returns the status of the Tsig.
        TsigStatus() error
        // TsigTimersOnly sets the tsig timers only boolean.
        TsigTimersOnly(bool)
        // Hijack lets the caller take over the connection.
        // After a call to Hijack(), the DNS package will not do anything with the connection.
        Hijack()
}

// A ConnectionStater interface is used by a DNS Handler to access TLS connection state
// when available.
type ConnectionStater interface {
        ConnectionState() *tls.ConnectionState
}

type response struct {
        closed         bool // connection has been closed
        hijacked       bool // connection has been hijacked by handler
        tsigTimersOnly bool
        tsigStatus     error
        tsigRequestMAC string
        tsigProvider   TsigProvider
        udp            net.PacketConn // i/o connection if UDP was used
        tcp            net.Conn       // i/o connection if TCP was used
        udpSession     *SessionUDP    // oob data to get egress interface right
        pcSession      net.Addr       // address to use when writing to a generic net.PacketConn
        writer         Writer         // writer to output the raw DNS bits
}

// handleRefused returns a HandlerFunc that returns REFUSED for every request it gets.
func handleRefused(w ResponseWriter, r *Msg) {
        m := new(Msg)
        m.SetRcode(r, RcodeRefused)
        w.WriteMsg(m)
}

// HandleFailed returns a HandlerFunc that returns SERVFAIL for every request it gets.
// Deprecated: This function is going away.
func HandleFailed(w ResponseWriter, r *Msg) {
        m := new(Msg)
        m.SetRcode(r, RcodeServerFailure)
        // does not matter if this write fails
        w.WriteMsg(m)
}

// ListenAndServe Starts a server on address and network specified Invoke handler
// for incoming queries.
func ListenAndServe(addr string, network string, handler Handler) error {
        server := &Server{Addr: addr, Net: network, Handler: handler}
        return server.ListenAndServe()
}

// ListenAndServeTLS acts like http.ListenAndServeTLS, more information in
// http://golang.org/pkg/net/http/#ListenAndServeTLS
func ListenAndServeTLS(addr, certFile, keyFile string, handler Handler) error {
        cert, err := tls.LoadX509KeyPair(certFile, keyFile)
        if err != nil {
                return err
        }

        config := tls.Config{
                Certificates: []tls.Certificate{cert},
        }

        server := &Server{
                Addr:      addr,
                Net:       "tcp-tls",
                TLSConfig: &config,
                Handler:   handler,
        }

        return server.ListenAndServe()
}

// ActivateAndServe activates a server with a listener from systemd,
// l and p should not both be non-nil.
// If both l and p are not nil only p will be used.
// Invoke handler for incoming queries.
func ActivateAndServe(l net.Listener, p net.PacketConn, handler Handler) error {
        server := &Server{Listener: l, PacketConn: p, Handler: handler}
        return server.ActivateAndServe()
}

// Writer writes raw DNS messages; each call to Write should send an entire message.
type Writer interface {
        io.Writer
}

// Reader reads raw DNS messages; each call to ReadTCP or ReadUDP should return an entire message.
type Reader interface {
        // ReadTCP reads a raw message from a TCP connection. Implementations may alter
        // connection properties, for example the read-deadline.
        ReadTCP(conn net.Conn, timeout time.Duration) ([]byte, error)
        // ReadUDP reads a raw message from a UDP connection. Implementations may alter
        // connection properties, for example the read-deadline.
        ReadUDP(conn *net.UDPConn, timeout time.Duration) ([]byte, *SessionUDP, error)
}

// PacketConnReader is an optional interface that Readers can implement to support using generic net.PacketConns.
type PacketConnReader interface {
        Reader

        // ReadPacketConn reads a raw message from a generic net.PacketConn UDP connection. Implementations may
        // alter connection properties, for example the read-deadline.
        ReadPacketConn(conn net.PacketConn, timeout time.Duration) ([]byte, net.Addr, error)
}

// defaultReader is an adapter for the Server struct that implements the Reader and
// PacketConnReader interfaces using the readTCP, readUDP and readPacketConn funcs
// of the embedded Server.
type defaultReader struct {
        *Server
}

var _ PacketConnReader = defaultReader{}

func (dr defaultReader) ReadTCP(conn net.Conn, timeout time.Duration) ([]byte, error) {
        return dr.readTCP(conn, timeout)
}

func (dr defaultReader) ReadUDP(conn *net.UDPConn, timeout time.Duration) ([]byte, *SessionUDP, error) {
        return dr.readUDP(conn, timeout)
}

func (dr defaultReader) ReadPacketConn(conn net.PacketConn, timeout time.Duration) ([]byte, net.Addr, error) {
        return dr.readPacketConn(conn, timeout)
}

// DecorateReader is a decorator hook for extending or supplanting the functionality of a Reader.
// Implementations should never return a nil Reader.
// Readers should also implement the optional PacketConnReader interface.
// PacketConnReader is required to use a generic net.PacketConn.
type DecorateReader func(Reader) Reader

// DecorateWriter is a decorator hook for extending or supplanting the functionality of a Writer.
// Implementations should never return a nil Writer.
type DecorateWriter func(Writer) Writer

// MsgInvalidFunc is a listener hook for observing incoming messages that were discarded
// because they could not be parsed.
// Every message that is read by a Reader will eventually be provided to the Handler,
// rejected (or ignored) by the MsgAcceptFunc, or passed to this function.
type MsgInvalidFunc func(m []byte, err error)

func DefaultMsgInvalidFunc(m []byte, err error) {}

// A Server defines parameters for running an DNS server.
type Server struct {
        // Address to listen on, ":dns" if empty.
        Addr string
        // if "tcp" or "tcp-tls" (DNS over TLS) it will invoke a TCP listener, otherwise an UDP one
        Net string
        // TCP Listener to use, this is to aid in systemd's socket activation.
        Listener net.Listener
        // TLS connection configuration
        TLSConfig *tls.Config
        // UDP "Listener" to use, this is to aid in systemd's socket activation.
        PacketConn net.PacketConn
        // Handler to invoke, dns.DefaultServeMux if nil.
        Handler Handler
        // Default buffer size to use to read incoming UDP messages. If not set
        // it defaults to MinMsgSize (512 B).
        UDPSize int
        // The net.Conn.SetReadTimeout value for new connections, defaults to 2 * time.Second.
        ReadTimeout time.Duration
        // The net.Conn.SetWriteTimeout value for new connections, defaults to 2 * time.Second.
        WriteTimeout time.Duration
        // TCP idle timeout for multiple queries, if nil, defaults to 8 * time.Second (RFC 5966).
        IdleTimeout func() time.Duration
        // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.
        TsigProvider TsigProvider
        // Secret(s) for Tsig map[<zonename>]<base64 secret>. The zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2).
        TsigSecret map[string]string
        // If NotifyStartedFunc is set it is called once the server has started listening.
        NotifyStartedFunc func()
        // DecorateReader is optional, allows customization of the process that reads raw DNS messages.
        // The decorated reader must not mutate the data read from the conn.
        DecorateReader DecorateReader
        // DecorateWriter is optional, allows customization of the process that writes raw DNS messages.
        DecorateWriter DecorateWriter
        // Maximum number of TCP queries before we close the socket. Default is maxTCPQueries (unlimited if -1).
        MaxTCPQueries int
        // Whether to set the SO_REUSEPORT socket option, allowing multiple listeners to be bound to a single address.
        // It is only supported on certain GOOSes and when using ListenAndServe.
        ReusePort bool
        // Whether to set the SO_REUSEADDR socket option, allowing multiple listeners to be bound to a single address.
        // Crucially this allows binding when an existing server is listening on `0.0.0.0` or `::`.
        // It is only supported on certain GOOSes and when using ListenAndServe.
        ReuseAddr bool
        // AcceptMsgFunc will check the incoming message and will reject it early in the process.
        // By default DefaultMsgAcceptFunc will be used.
        MsgAcceptFunc MsgAcceptFunc
        // MsgInvalidFunc is optional, will be called if a message is received but cannot be parsed.
        MsgInvalidFunc MsgInvalidFunc

        // Shutdown handling
        lock     sync.RWMutex
        started  bool
        shutdown chan struct{}
        conns    map[net.Conn]struct{}

        // A pool for UDP message buffers.
        udpPool sync.Pool
}

func (srv *Server) tsigProvider() TsigProvider {
        if srv.TsigProvider != nil {
                return srv.TsigProvider
        }
        if srv.TsigSecret != nil {
                return tsigSecretProvider(srv.TsigSecret)
        }
        return nil
}

func (srv *Server) isStarted() bool {
        srv.lock.RLock()
        started := srv.started
        srv.lock.RUnlock()
        return started
}

func makeUDPBuffer(size int) func() interface{} {
        return func() interface{} {
                return make([]byte, size)
        }
}

func (srv *Server) init() {
        srv.shutdown = make(chan struct{})
        srv.conns = make(map[net.Conn]struct{})

        if srv.UDPSize == 0 {
                srv.UDPSize = MinMsgSize
        }
        if srv.MsgAcceptFunc == nil {
                srv.MsgAcceptFunc = DefaultMsgAcceptFunc
        }
        if srv.MsgInvalidFunc == nil {
                srv.MsgInvalidFunc = DefaultMsgInvalidFunc
        }
        if srv.Handler == nil {
                srv.Handler = DefaultServeMux
        }

        srv.udpPool.New = makeUDPBuffer(srv.UDPSize)
}

func unlockOnce(l sync.Locker) func() {
        var once sync.Once
        return func() { once.Do(l.Unlock) }
}

// ListenAndServe starts a nameserver on the configured address in *Server.
func (srv *Server) ListenAndServe() error {
        unlock := unlockOnce(&srv.lock)
        srv.lock.Lock()
        defer unlock()

        if srv.started {
                return &Error{err: "server already started"}
        }

        addr := srv.Addr
        if addr == "" {
                addr = ":domain"
        }

        srv.init()

        switch srv.Net {
        case "tcp", "tcp4", "tcp6":
                l, err := listenTCP(srv.Net, addr, srv.ReusePort, srv.ReuseAddr)
                if err != nil {
                        return err
                }
                srv.Listener = l
                srv.started = true
                unlock()
                return srv.serveTCP(l)
        case "tcp-tls", "tcp4-tls", "tcp6-tls":
                if srv.TLSConfig == nil || (len(srv.TLSConfig.Certificates) == 0 && srv.TLSConfig.GetCertificate == nil) {
                        return errors.New("dns: neither Certificates nor GetCertificate set in Config")
                }
                network := strings.TrimSuffix(srv.Net, "-tls")
                l, err := listenTCP(network, addr, srv.ReusePort, srv.ReuseAddr)
                if err != nil {
                        return err
                }
                l = tls.NewListener(l, srv.TLSConfig)
                srv.Listener = l
                srv.started = true
                unlock()
                return srv.serveTCP(l)
        case "udp", "udp4", "udp6":
                l, err := listenUDP(srv.Net, addr, srv.ReusePort, srv.ReuseAddr)
                if err != nil {
                        return err
                }
                u := l.(*net.UDPConn)
                if e := setUDPSocketOptions(u); e != nil {
                        u.Close()
                        return e
                }
                srv.PacketConn = l
                srv.started = true
                unlock()
                return srv.serveUDP(u)
        }
        return &Error{err: "bad network"}
}

// ActivateAndServe starts a nameserver with the PacketConn or Listener
// configured in *Server. Its main use is to start a server from systemd.
func (srv *Server) ActivateAndServe() error {
        unlock := unlockOnce(&srv.lock)
        srv.lock.Lock()
        defer unlock()

        if srv.started {
                return &Error{err: "server already started"}
        }

        srv.init()

        if srv.PacketConn != nil {
                // Check PacketConn interface's type is valid and value
                // is not nil
                if t, ok := srv.PacketConn.(*net.UDPConn); ok && t != nil {
                        if e := setUDPSocketOptions(t); e != nil {
                                return e
                        }
                }
                srv.started = true
                unlock()
                return srv.serveUDP(srv.PacketConn)
        }
        if srv.Listener != nil {
                srv.started = true
                unlock()
                return srv.serveTCP(srv.Listener)
        }
        return &Error{err: "bad listeners"}
}

// Shutdown shuts down a server. After a call to Shutdown, ListenAndServe and
// ActivateAndServe will return.
func (srv *Server) Shutdown() error {
        return srv.ShutdownContext(context.Background())
}

// ShutdownContext shuts down a server. After a call to ShutdownContext,
// ListenAndServe and ActivateAndServe will return.
//
// A context.Context may be passed to limit how long to wait for connections
// to terminate.
func (srv *Server) ShutdownContext(ctx context.Context) error {
        srv.lock.Lock()
        if !srv.started {
                srv.lock.Unlock()
                return &Error{err: "server not started"}
        }

        srv.started = false

        if srv.PacketConn != nil {
                srv.PacketConn.SetReadDeadline(aLongTimeAgo) // Unblock reads
        }

        if srv.Listener != nil {
                srv.Listener.Close()
        }

        for rw := range srv.conns {
                rw.SetReadDeadline(aLongTimeAgo) // Unblock reads
        }

        srv.lock.Unlock()

        if testShutdownNotify != nil {
                testShutdownNotify.Broadcast()
        }

        var ctxErr error
        select {
        case <-srv.shutdown:
        case <-ctx.Done():
                ctxErr = ctx.Err()
        }

        if srv.PacketConn != nil {
                srv.PacketConn.Close()
        }

        return ctxErr
}

var testShutdownNotify *sync.Cond

// getReadTimeout is a helper func to use system timeout if server did not intend to change it.
func (srv *Server) getReadTimeout() time.Duration {
        if srv.ReadTimeout != 0 {
                return srv.ReadTimeout
        }
        return dnsTimeout
}

// serveTCP starts a TCP listener for the server.
func (srv *Server) serveTCP(l net.Listener) error {
        defer l.Close()

        if srv.NotifyStartedFunc != nil {
                srv.NotifyStartedFunc()
        }

        var wg sync.WaitGroup
        defer func() {
                wg.Wait()
                close(srv.shutdown)
        }()

        for srv.isStarted() {
                rw, err := l.Accept()
                if err != nil {
                        if !srv.isStarted() {
                                return nil
                        }
                        if neterr, ok := err.(net.Error); ok && neterr.Temporary() {
                                continue
                        }
                        return err
                }
                srv.lock.Lock()
                // Track the connection to allow unblocking reads on shutdown.
                srv.conns[rw] = struct{}{}
                srv.lock.Unlock()
                wg.Add(1)
                go srv.serveTCPConn(&wg, rw)
        }

        return nil
}

// serveUDP starts a UDP listener for the server.
func (srv *Server) serveUDP(l net.PacketConn) error {
        defer l.Close()

        reader := Reader(defaultReader{srv})
        if srv.DecorateReader != nil {
                reader = srv.DecorateReader(reader)
        }

        lUDP, isUDP := l.(*net.UDPConn)
        readerPC, canPacketConn := reader.(PacketConnReader)
        if !isUDP && !canPacketConn {
                return &Error{err: "PacketConnReader was not implemented on Reader returned from DecorateReader but is required for net.PacketConn"}
        }

        if srv.NotifyStartedFunc != nil {
                srv.NotifyStartedFunc()
        }

        var wg sync.WaitGroup
        defer func() {
                wg.Wait()
                close(srv.shutdown)
        }()

        rtimeout := srv.getReadTimeout()
        // deadline is not used here
        for srv.isStarted() {
                var (
                        m    []byte
                        sPC  net.Addr
                        sUDP *SessionUDP
                        err  error
                )
                if isUDP {
                        m, sUDP, err = reader.ReadUDP(lUDP, rtimeout)
                } else {
                        m, sPC, err = readerPC.ReadPacketConn(l, rtimeout)
                }
                if err != nil {
                        if !srv.isStarted() {
                                return nil
                        }
                        if netErr, ok := err.(net.Error); ok && netErr.Temporary() {
                                continue
                        }
                        return err
                }
                if len(m) < headerSize {
                        if cap(m) == srv.UDPSize {
                                srv.udpPool.Put(m[:srv.UDPSize])
                        }
                        srv.MsgInvalidFunc(m, ErrShortRead)
                        continue
                }
                wg.Add(1)
                go srv.serveUDPPacket(&wg, m, l, sUDP, sPC)
        }

        return nil
}

// Serve a new TCP connection.
func (srv *Server) serveTCPConn(wg *sync.WaitGroup, rw net.Conn) {
        w := &response{tsigProvider: srv.tsigProvider(), tcp: rw}
        if srv.DecorateWriter != nil {
                w.writer = srv.DecorateWriter(w)
        } else {
                w.writer = w
        }

        reader := Reader(defaultReader{srv})
        if srv.DecorateReader != nil {
                reader = srv.DecorateReader(reader)
        }

        idleTimeout := tcpIdleTimeout
        if srv.IdleTimeout != nil {
                idleTimeout = srv.IdleTimeout()
        }

        timeout := srv.getReadTimeout()

        limit := srv.MaxTCPQueries
        if limit == 0 {
                limit = maxTCPQueries
        }

        for q := 0; (q < limit || limit == -1) && srv.isStarted(); q++ {
                m, err := reader.ReadTCP(w.tcp, timeout)
                if err != nil {
                        // TODO(tmthrgd): handle error
                        break
                }
                srv.serveDNS(m, w)
                if w.closed {
                        break // Close() was called
                }
                if w.hijacked {
                        break // client will call Close() themselves
                }
                // The first read uses the read timeout, the rest use the
                // idle timeout.
                timeout = idleTimeout
        }

        if !w.hijacked {
                w.Close()
        }

        srv.lock.Lock()
        delete(srv.conns, w.tcp)
        srv.lock.Unlock()

        wg.Done()
}

// Serve a new UDP request.
func (srv *Server) serveUDPPacket(wg *sync.WaitGroup, m []byte, u net.PacketConn, udpSession *SessionUDP, pcSession net.Addr) {
        w := &response{tsigProvider: srv.tsigProvider(), udp: u, udpSession: udpSession, pcSession: pcSession}
        if srv.DecorateWriter != nil {
                w.writer = srv.DecorateWriter(w)
        } else {
                w.writer = w
        }

        srv.serveDNS(m, w)
        wg.Done()
}

func (srv *Server) serveDNS(m []byte, w *response) {
        dh, off, err := unpackMsgHdr(m, 0)
        if err != nil {
                srv.MsgInvalidFunc(m, err)
                // Let client hang, they are sending crap; any reply can be used to amplify.
                return
        }

        req := new(Msg)
        req.setHdr(dh)

        switch action := srv.MsgAcceptFunc(dh); action {
        case MsgAccept:
                err := req.unpack(dh, m, off)
                if err == nil {
                        break
                }

                srv.MsgInvalidFunc(m, err)
                fallthrough
        case MsgReject, MsgRejectNotImplemented:
                opcode := req.Opcode
                req.SetRcodeFormatError(req)
                req.Zero = false
                if action == MsgRejectNotImplemented {
                        req.Opcode = opcode
                        req.Rcode = RcodeNotImplemented
                }

                // Are we allowed to delete any OPT records here?
                req.Ns, req.Answer, req.Extra = nil, nil, nil

                w.WriteMsg(req)
                fallthrough
        case MsgIgnore:
                if w.udp != nil && cap(m) == srv.UDPSize {
                        srv.udpPool.Put(m[:srv.UDPSize])
                }

                return
        }

        w.tsigStatus = nil
        if w.tsigProvider != nil {
                if t := req.IsTsig(); t != nil {
                        w.tsigStatus = TsigVerifyWithProvider(m, w.tsigProvider, "", false)
                        w.tsigTimersOnly = false
                        w.tsigRequestMAC = t.MAC
                }
        }

        if w.udp != nil && cap(m) == srv.UDPSize {
                srv.udpPool.Put(m[:srv.UDPSize])
        }

        srv.Handler.ServeDNS(w, req) // Writes back to the client
}

func (srv *Server) readTCP(conn net.Conn, timeout time.Duration) ([]byte, error) {
        // If we race with ShutdownContext, the read deadline may
        // have been set in the distant past to unblock the read
        // below. We must not override it, otherwise we may block
        // ShutdownContext.
        srv.lock.RLock()
        if srv.started {
                conn.SetReadDeadline(time.Now().Add(timeout))
        }
        srv.lock.RUnlock()

        var length uint16
        if err := binary.Read(conn, binary.BigEndian, &length); err != nil {
                return nil, err
        }

        m := make([]byte, length)
        if _, err := io.ReadFull(conn, m); err != nil {
                return nil, err
        }

        return m, nil
}

func (srv *Server) readUDP(conn *net.UDPConn, timeout time.Duration) ([]byte, *SessionUDP, error) {
        srv.lock.RLock()
        if srv.started {
                // See the comment in readTCP above.
                conn.SetReadDeadline(time.Now().Add(timeout))
        }
        srv.lock.RUnlock()

        m := srv.udpPool.Get().([]byte)
        n, s, err := ReadFromSessionUDP(conn, m)
        if err != nil {
                srv.udpPool.Put(m)
                return nil, nil, err
        }
        m = m[:n]
        return m, s, nil
}

func (srv *Server) readPacketConn(conn net.PacketConn, timeout time.Duration) ([]byte, net.Addr, error) {
        srv.lock.RLock()
        if srv.started {
                // See the comment in readTCP above.
                conn.SetReadDeadline(time.Now().Add(timeout))
        }
        srv.lock.RUnlock()

        m := srv.udpPool.Get().([]byte)
        n, addr, err := conn.ReadFrom(m)
        if err != nil {
                srv.udpPool.Put(m)
                return nil, nil, err
        }
        m = m[:n]
        return m, addr, nil
}

// WriteMsg implements the ResponseWriter.WriteMsg method.
func (w *response) WriteMsg(m *Msg) (err error) {
        if w.closed {
                return &Error{err: "WriteMsg called after Close"}
        }

        var data []byte
        if w.tsigProvider != nil { // if no provider, dont check for the tsig (which is a longer check)
                if t := m.IsTsig(); t != nil {
                        data, w.tsigRequestMAC, err = TsigGenerateWithProvider(m, w.tsigProvider, w.tsigRequestMAC, w.tsigTimersOnly)
                        if err != nil {
                                return err
                        }
                        _, err = w.writer.Write(data)
                        return err
                }
        }
        data, err = m.Pack()
        if err != nil {
                return err
        }
        _, err = w.writer.Write(data)
        return err
}

// Write implements the ResponseWriter.Write method.
func (w *response) Write(m []byte) (int, error) {
        if w.closed {
                return 0, &Error{err: "Write called after Close"}
        }

        switch {
        case w.udp != nil:
                if u, ok := w.udp.(*net.UDPConn); ok {
                        return WriteToSessionUDP(u, m, w.udpSession)
                }
                return w.udp.WriteTo(m, w.pcSession)
        case w.tcp != nil:
                if len(m) > MaxMsgSize {
                        return 0, &Error{err: "message too large"}
                }

                msg := make([]byte, 2+len(m))
                binary.BigEndian.PutUint16(msg, uint16(len(m)))
                copy(msg[2:], m)
                return w.tcp.Write(msg)
        default:
                panic("dns: internal error: udp and tcp both nil")
        }
}

// LocalAddr implements the ResponseWriter.LocalAddr method.
func (w *response) LocalAddr() net.Addr {
        switch {
        case w.udp != nil:
                return w.udp.LocalAddr()
        case w.tcp != nil:
                return w.tcp.LocalAddr()
        default:
                panic("dns: internal error: udp and tcp both nil")
        }
}

// RemoteAddr implements the ResponseWriter.RemoteAddr method.
func (w *response) RemoteAddr() net.Addr {
        switch {
        case w.udpSession != nil:
                return w.udpSession.RemoteAddr()
        case w.pcSession != nil:
                return w.pcSession
        case w.tcp != nil:
                return w.tcp.RemoteAddr()
        default:
                panic("dns: internal error: udpSession, pcSession and tcp are all nil")
        }
}

// TsigStatus implements the ResponseWriter.TsigStatus method.
func (w *response) TsigStatus() error { return w.tsigStatus }

// TsigTimersOnly implements the ResponseWriter.TsigTimersOnly method.
func (w *response) TsigTimersOnly(b bool) { w.tsigTimersOnly = b }

// Hijack implements the ResponseWriter.Hijack method.
func (w *response) Hijack() { w.hijacked = true }

// Close implements the ResponseWriter.Close method
func (w *response) Close() error {
        if w.closed {
                return &Error{err: "connection already closed"}
        }
        w.closed = true

        switch {
        case w.udp != nil:
                // Can't close the udp conn, as that is actually the listener.
                return nil
        case w.tcp != nil:
                return w.tcp.Close()
        default:
                panic("dns: internal error: udp and tcp both nil")
        }
}

// ConnectionState() implements the ConnectionStater.ConnectionState() interface.
func (w *response) ConnectionState() *tls.ConnectionState {
        type tlsConnectionStater interface {
                ConnectionState() tls.ConnectionState
        }
        if v, ok := w.tcp.(tlsConnectionStater); ok {
                t := v.ConnectionState()
                return &t
        }
        return nil
}

package dns

import (
        "crypto"
        "crypto/ecdsa"
        "crypto/ed25519"
        "crypto/rsa"
        "encoding/binary"
        "math/big"
        "strings"
        "time"
)

// Sign signs a dns.Msg. It fills the signature with the appropriate data.
// The SIG record should have the SignerName, KeyTag, Algorithm, Inception
// and Expiration set.
func (rr *SIG) Sign(k crypto.Signer, m *Msg) ([]byte, error) {
        if k == nil {
                return nil, ErrPrivKey
        }
        if rr.KeyTag == 0 || rr.SignerName == "" || rr.Algorithm == 0 {
                return nil, ErrKey
        }

        rr.Hdr = RR_Header{Name: ".", Rrtype: TypeSIG, Class: ClassANY, Ttl: 0}
        rr.OrigTtl, rr.TypeCovered, rr.Labels = 0, 0, 0

        buf := make([]byte, m.Len()+Len(rr))
        mbuf, err := m.PackBuffer(buf)
        if err != nil {
                return nil, err
        }
        if &buf[0] != &mbuf[0] {
                return nil, ErrBuf
        }
        off, err := PackRR(rr, buf, len(mbuf), nil, false)
        if err != nil {
                return nil, err
        }
        buf = buf[:off:cap(buf)]

        h, cryptohash, err := hashFromAlgorithm(rr.Algorithm)
        if err != nil {
                return nil, err
        }

        // Write SIG rdata
        h.Write(buf[len(mbuf)+1+2+2+4+2:])
        // Write message
        h.Write(buf[:len(mbuf)])

        signature, err := sign(k, h.Sum(nil), cryptohash, rr.Algorithm)
        if err != nil {
                return nil, err
        }

        rr.Signature = toBase64(signature)

        buf = append(buf, signature...)
        if len(buf) > int(^uint16(0)) {
                return nil, ErrBuf
        }
        // Adjust sig data length
        rdoff := len(mbuf) + 1 + 2 + 2 + 4
        rdlen := binary.BigEndian.Uint16(buf[rdoff:])
        rdlen += uint16(len(signature))
        binary.BigEndian.PutUint16(buf[rdoff:], rdlen)
        // Adjust additional count
        adc := binary.BigEndian.Uint16(buf[10:])
        adc++
        binary.BigEndian.PutUint16(buf[10:], adc)
        return buf, nil
}

// Verify validates the message buf using the key k.
// It's assumed that buf is a valid message from which rr was unpacked.
func (rr *SIG) Verify(k *KEY, buf []byte) error {
        if k == nil {
                return ErrKey
        }
        if rr.KeyTag == 0 || rr.SignerName == "" || rr.Algorithm == 0 {
                return ErrKey
        }

        h, cryptohash, err := hashFromAlgorithm(rr.Algorithm)
        if err != nil {
                return err
        }

        buflen := len(buf)
        qdc := binary.BigEndian.Uint16(buf[4:])
        anc := binary.BigEndian.Uint16(buf[6:])
        auc := binary.BigEndian.Uint16(buf[8:])
        adc := binary.BigEndian.Uint16(buf[10:])
        offset := headerSize
        for i := uint16(0); i < qdc && offset < buflen; i++ {
                _, offset, err = UnpackDomainName(buf, offset)
                if err != nil {
                        return err
                }
                // Skip past Type and Class
                offset += 2 + 2
        }
        for i := uint16(1); i < anc+auc+adc && offset < buflen; i++ {
                _, offset, err = UnpackDomainName(buf, offset)
                if err != nil {
                        return err
                }
                // Skip past Type, Class and TTL
                offset += 2 + 2 + 4
                if offset+1 >= buflen {
                        continue
                }
                rdlen := binary.BigEndian.Uint16(buf[offset:])
                offset += 2
                offset += int(rdlen)
        }
        if offset >= buflen {
                return &Error{err: "overflowing unpacking signed message"}
        }

        // offset should be just prior to SIG
        bodyend := offset
        // owner name SHOULD be root
        _, offset, err = UnpackDomainName(buf, offset)
        if err != nil {
                return err
        }
        // Skip Type, Class, TTL, RDLen
        offset += 2 + 2 + 4 + 2
        sigstart := offset
        // Skip Type Covered, Algorithm, Labels, Original TTL
        offset += 2 + 1 + 1 + 4
        if offset+4+4 >= buflen {
                return &Error{err: "overflow unpacking signed message"}
        }
        expire := binary.BigEndian.Uint32(buf[offset:])
        offset += 4
        incept := binary.BigEndian.Uint32(buf[offset:])
        offset += 4
        now := uint32(time.Now().Unix())
        if now < incept || now > expire {
                return ErrTime
        }
        // Skip key tag
        offset += 2
        var signername string
        signername, offset, err = UnpackDomainName(buf, offset)
        if err != nil {
                return err
        }
        // If key has come from the DNS name compression might
        // have mangled the case of the name
        if !strings.EqualFold(signername, k.Header().Name) {
                return &Error{err: "signer name doesn't match key name"}
        }
        sigend := offset
        h.Write(buf[sigstart:sigend])
        h.Write(buf[:10])
        h.Write([]byte{
                byte((adc - 1) << 8),
                byte(adc - 1),
        })
        h.Write(buf[12:bodyend])

        hashed := h.Sum(nil)
        sig := buf[sigend:]
        switch k.Algorithm {
        case RSASHA1, RSASHA256, RSASHA512:
                pk := k.publicKeyRSA()
                if pk != nil {
                        return rsa.VerifyPKCS1v15(pk, cryptohash, hashed, sig)
                }
        case ECDSAP256SHA256, ECDSAP384SHA384:
                pk := k.publicKeyECDSA()
                r := new(big.Int).SetBytes(sig[:len(sig)/2])
                s := new(big.Int).SetBytes(sig[len(sig)/2:])
                if pk != nil {
                        if ecdsa.Verify(pk, hashed, r, s) {
                                return nil
                        }
                        return ErrSig
                }
        case ED25519:
                pk := k.publicKeyED25519()
                if pk != nil {
                        if ed25519.Verify(pk, hashed, sig) {
                                return nil
                        }
                        return ErrSig
                }
        }
        return ErrKeyAlg
}

package dns

import (
        "crypto/sha256"
        "crypto/x509"
        "encoding/hex"
)

// Sign creates a SMIMEA record from an SSL certificate.
func (r *SMIMEA) Sign(usage, selector, matchingType int, cert *x509.Certificate) (err error) {
        r.Hdr.Rrtype = TypeSMIMEA
        r.Usage = uint8(usage)
        r.Selector = uint8(selector)
        r.MatchingType = uint8(matchingType)

        r.Certificate, err = CertificateToDANE(r.Selector, r.MatchingType, cert)
        return err
}

// Verify verifies a SMIMEA record against an SSL certificate. If it is OK
// a nil error is returned.
func (r *SMIMEA) Verify(cert *x509.Certificate) error {
        c, err := CertificateToDANE(r.Selector, r.MatchingType, cert)
        if err != nil {
                return err // Not also ErrSig?
        }
        if r.Certificate == c {
                return nil
        }
        return ErrSig // ErrSig, really?
}

// SMIMEAName returns the ownername of a SMIMEA resource record as per the
// format specified in RFC 'draft-ietf-dane-smime-12' Section 2 and 3
func SMIMEAName(email, domain string) (string, error) {
        hasher := sha256.New()
        hasher.Write([]byte(email))

        // RFC Section 3: "The local-part is hashed using the SHA2-256
        // algorithm with the hash truncated to 28 octets and
        // represented in its hexadecimal representation to become the
        // left-most label in the prepared domain name"
        return hex.EncodeToString(hasher.Sum(nil)[:28]) + "." + "_smimecert." + domain, nil
}

package dns

import (
        "bytes"
        "encoding/binary"
        "errors"
        "fmt"
        "net"
        "sort"
        "strconv"
        "strings"
)

// SVCBKey is the type of the keys used in the SVCB RR.
type SVCBKey uint16

// Keys defined in rfc9460
const (
        SVCB_MANDATORY SVCBKey = iota
        SVCB_ALPN
        SVCB_NO_DEFAULT_ALPN
        SVCB_PORT
        SVCB_IPV4HINT
        SVCB_ECHCONFIG
        SVCB_IPV6HINT
        SVCB_DOHPATH // rfc9461 Section 5
        SVCB_OHTTP   // rfc9540 Section 8

        svcb_RESERVED SVCBKey = 65535
)

var svcbKeyToStringMap = map[SVCBKey]string{
        SVCB_MANDATORY:       "mandatory",
        SVCB_ALPN:            "alpn",
        SVCB_NO_DEFAULT_ALPN: "no-default-alpn",
        SVCB_PORT:            "port",
        SVCB_IPV4HINT:        "ipv4hint",
        SVCB_ECHCONFIG:       "ech",
        SVCB_IPV6HINT:        "ipv6hint",
        SVCB_DOHPATH:         "dohpath",
        SVCB_OHTTP:           "ohttp",
}

var svcbStringToKeyMap = reverseSVCBKeyMap(svcbKeyToStringMap)

func reverseSVCBKeyMap(m map[SVCBKey]string) map[string]SVCBKey {
        n := make(map[string]SVCBKey, len(m))
        for u, s := range m {
                n[s] = u
        }
        return n
}

// String takes the numerical code of an SVCB key and returns its name.
// Returns an empty string for reserved keys.
// Accepts unassigned keys as well as experimental/private keys.
func (key SVCBKey) String() string {
        if x := svcbKeyToStringMap[key]; x != "" {
                return x
        }
        if key == svcb_RESERVED {
                return ""
        }
        return "key" + strconv.FormatUint(uint64(key), 10)
}

// svcbStringToKey returns the numerical code of an SVCB key.
// Returns svcb_RESERVED for reserved/invalid keys.
// Accepts unassigned keys as well as experimental/private keys.
func svcbStringToKey(s string) SVCBKey {
        if strings.HasPrefix(s, "key") {
                a, err := strconv.ParseUint(s[3:], 10, 16)
                // no leading zeros
                // key shouldn't be registered
                if err != nil || a == 65535 || s[3] == '0' || svcbKeyToStringMap[SVCBKey(a)] != "" {
                        return svcb_RESERVED
                }
                return SVCBKey(a)
        }
        if key, ok := svcbStringToKeyMap[s]; ok {
                return key
        }
        return svcb_RESERVED
}

func (rr *SVCB) parse(c *zlexer, o string) *ParseError {
        l, _ := c.Next()
        i, e := strconv.ParseUint(l.token, 10, 16)
        if e != nil || l.err {
                return &ParseError{file: l.token, err: "bad SVCB priority", lex: l}
        }
        rr.Priority = uint16(i)

        c.Next()        // zBlank
        l, _ = c.Next() // zString
        rr.Target = l.token

        name, nameOk := toAbsoluteName(l.token, o)
        if l.err || !nameOk {
                return &ParseError{file: l.token, err: "bad SVCB Target", lex: l}
        }
        rr.Target = name

        // Values (if any)
        l, _ = c.Next()
        var xs []SVCBKeyValue
        // Helps require whitespace between pairs.
        // Prevents key1000="a"key1001=...
        canHaveNextKey := true
        for l.value != zNewline && l.value != zEOF {
                switch l.value {
                case zString:
                        if !canHaveNextKey {
                                // The key we can now read was probably meant to be
                                // a part of the last value.
                                return &ParseError{file: l.token, err: "bad SVCB value quotation", lex: l}
                        }

                        // In key=value pairs, value does not have to be quoted unless value
                        // contains whitespace. And keys don't need to have values.
                        // Similarly, keys with an equality signs after them don't need values.
                        // l.token includes at least up to the first equality sign.
                        idx := strings.IndexByte(l.token, '=')
                        var key, value string
                        if idx < 0 {
                                // Key with no value and no equality sign
                                key = l.token
                        } else if idx == 0 {
                                return &ParseError{file: l.token, err: "bad SVCB key", lex: l}
                        } else {
                                key, value = l.token[:idx], l.token[idx+1:]

                                if value == "" {
                                        // We have a key and an equality sign. Maybe we have nothing
                                        // after "=" or we have a double quote.
                                        l, _ = c.Next()
                                        if l.value == zQuote {
                                                // Only needed when value ends with double quotes.
                                                // Any value starting with zQuote ends with it.
                                                canHaveNextKey = false

                                                l, _ = c.Next()
                                                switch l.value {
                                                case zString:
                                                        // We have a value in double quotes.
                                                        value = l.token
                                                        l, _ = c.Next()
                                                        if l.value != zQuote {
                                                                return &ParseError{file: l.token, err: "SVCB unterminated value", lex: l}
                                                        }
                                                case zQuote:
                                                        // There's nothing in double quotes.
                                                default:
                                                        return &ParseError{file: l.token, err: "bad SVCB value", lex: l}
                                                }
                                        }
                                }
                        }
                        kv := makeSVCBKeyValue(svcbStringToKey(key))
                        if kv == nil {
                                return &ParseError{file: l.token, err: "bad SVCB key", lex: l}
                        }
                        if err := kv.parse(value); err != nil {
                                return &ParseError{file: l.token, wrappedErr: err, lex: l}
                        }
                        xs = append(xs, kv)
                case zQuote:
                        return &ParseError{file: l.token, err: "SVCB key can't contain double quotes", lex: l}
                case zBlank:
                        canHaveNextKey = true
                default:
                        return &ParseError{file: l.token, err: "bad SVCB values", lex: l}
                }
                l, _ = c.Next()
        }

        // "In AliasMode, records SHOULD NOT include any SvcParams, and recipients MUST
        // ignore any SvcParams that are present."
        // However, we don't check rr.Priority == 0 && len(xs) > 0 here
        // It is the responsibility of the user of the library to check this.
        // This is to encourage the fixing of the source of this error.

        rr.Value = xs
        return nil
}

// makeSVCBKeyValue returns an SVCBKeyValue struct with the key or nil for reserved keys.
func makeSVCBKeyValue(key SVCBKey) SVCBKeyValue {
        switch key {
        case SVCB_MANDATORY:
                return new(SVCBMandatory)
        case SVCB_ALPN:
                return new(SVCBAlpn)
        case SVCB_NO_DEFAULT_ALPN:
                return new(SVCBNoDefaultAlpn)
        case SVCB_PORT:
                return new(SVCBPort)
        case SVCB_IPV4HINT:
                return new(SVCBIPv4Hint)
        case SVCB_ECHCONFIG:
                return new(SVCBECHConfig)
        case SVCB_IPV6HINT:
                return new(SVCBIPv6Hint)
        case SVCB_DOHPATH:
                return new(SVCBDoHPath)
        case SVCB_OHTTP:
                return new(SVCBOhttp)
        case svcb_RESERVED:
                return nil
        default:
                e := new(SVCBLocal)
                e.KeyCode = key
                return e
        }
}

// SVCB RR. See RFC xxxx (https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-08).
//
// NOTE: The HTTPS/SVCB RFCs are in the draft stage.
// The API, including constants and types related to SVCBKeyValues, may
// change in future versions in accordance with the latest drafts.
type SVCB struct {
        Hdr      RR_Header
        Priority uint16         // If zero, Value must be empty or discarded by the user of this library
        Target   string         `dns:"domain-name"`
        Value    []SVCBKeyValue `dns:"pairs"`
}

// HTTPS RR. Everything valid for SVCB applies to HTTPS as well.
// Except that the HTTPS record is intended for use with the HTTP and HTTPS protocols.
//
// NOTE: The HTTPS/SVCB RFCs are in the draft stage.
// The API, including constants and types related to SVCBKeyValues, may
// change in future versions in accordance with the latest drafts.
type HTTPS struct {
        SVCB
}

func (rr *HTTPS) String() string {
        return rr.SVCB.String()
}

func (rr *HTTPS) parse(c *zlexer, o string) *ParseError {
        return rr.SVCB.parse(c, o)
}

// SVCBKeyValue defines a key=value pair for the SVCB RR type.
// An SVCB RR can have multiple SVCBKeyValues appended to it.
type SVCBKeyValue interface {
        Key() SVCBKey          // Key returns the numerical key code.
        pack() ([]byte, error) // pack returns the encoded value.
        unpack([]byte) error   // unpack sets the value.
        String() string        // String returns the string representation of the value.
        parse(string) error    // parse sets the value to the given string representation of the value.
        copy() SVCBKeyValue    // copy returns a deep-copy of the pair.
        len() int              // len returns the length of value in the wire format.
}

// SVCBMandatory pair adds to required keys that must be interpreted for the RR
// to be functional. If ignored, the whole RRSet must be ignored.
// "port" and "no-default-alpn" are mandatory by default if present,
// so they shouldn't be included here.
//
// It is incumbent upon the user of this library to reject the RRSet if
// or avoid constructing such an RRSet that:
// - "mandatory" is included as one of the keys of mandatory
// - no key is listed multiple times in mandatory
// - all keys listed in mandatory are present
// - escape sequences are not used in mandatory
// - mandatory, when present, lists at least one key
//
// Basic use pattern for creating a mandatory option:
//
//        s := &dns.SVCB{Hdr: dns.RR_Header{Name: ".", Rrtype: dns.TypeSVCB, Class: dns.ClassINET}}
//        e := new(dns.SVCBMandatory)
//        e.Code = []uint16{dns.SVCB_ALPN}
//        s.Value = append(s.Value, e)
//        t := new(dns.SVCBAlpn)
//        t.Alpn = []string{"xmpp-client"}
//        s.Value = append(s.Value, t)
type SVCBMandatory struct {
        Code []SVCBKey
}

func (*SVCBMandatory) Key() SVCBKey { return SVCB_MANDATORY }

func (s *SVCBMandatory) String() string {
        str := make([]string, len(s.Code))
        for i, e := range s.Code {
                str[i] = e.String()
        }
        return strings.Join(str, ",")
}

func (s *SVCBMandatory) pack() ([]byte, error) {
        codes := cloneSlice(s.Code)
        sort.Slice(codes, func(i, j int) bool {
                return codes[i] < codes[j]
        })
        b := make([]byte, 2*len(codes))
        for i, e := range codes {
                binary.BigEndian.PutUint16(b[2*i:], uint16(e))
        }
        return b, nil
}

func (s *SVCBMandatory) unpack(b []byte) error {
        if len(b)%2 != 0 {
                return errors.New("dns: svcbmandatory: value length is not a multiple of 2")
        }
        codes := make([]SVCBKey, 0, len(b)/2)
        for i := 0; i < len(b); i += 2 {
                // We assume strictly increasing order.
                codes = append(codes, SVCBKey(binary.BigEndian.Uint16(b[i:])))
        }
        s.Code = codes
        return nil
}

func (s *SVCBMandatory) parse(b string) error {
        codes := make([]SVCBKey, 0, strings.Count(b, ",")+1)
        for len(b) > 0 {
                var key string
                key, b, _ = strings.Cut(b, ",")
                codes = append(codes, svcbStringToKey(key))
        }
        s.Code = codes
        return nil
}

func (s *SVCBMandatory) len() int {
        return 2 * len(s.Code)
}

func (s *SVCBMandatory) copy() SVCBKeyValue {
        return &SVCBMandatory{cloneSlice(s.Code)}
}

// SVCBAlpn pair is used to list supported connection protocols.
// The user of this library must ensure that at least one protocol is listed when alpn is present.
// Protocol IDs can be found at:
// https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
// Basic use pattern for creating an alpn option:
//
//        h := new(dns.HTTPS)
//        h.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeHTTPS, Class: dns.ClassINET}
//        e := new(dns.SVCBAlpn)
//        e.Alpn = []string{"h2", "http/1.1"}
//        h.Value = append(h.Value, e)
type SVCBAlpn struct {
        Alpn []string
}

func (*SVCBAlpn) Key() SVCBKey { return SVCB_ALPN }

func (s *SVCBAlpn) String() string {
        // An ALPN value is a comma-separated list of values, each of which can be
        // an arbitrary binary value. In order to allow parsing, the comma and
        // backslash characters are themselves escaped.
        //
        // However, this escaping is done in addition to the normal escaping which
        // happens in zone files, meaning that these values must be
        // double-escaped. This looks terrible, so if you see a never-ending
        // sequence of backslash in a zone file this may be why.
        //
        // https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-08#appendix-A.1
        var str strings.Builder
        for i, alpn := range s.Alpn {
                // 4*len(alpn) is the worst case where we escape every character in the alpn as \123, plus 1 byte for the ',' separating the alpn from others
                str.Grow(4*len(alpn) + 1)
                if i > 0 {
                        str.WriteByte(',')
                }
                for j := 0; j < len(alpn); j++ {
                        e := alpn[j]
                        if ' ' > e || e > '~' {
                                str.WriteString(escapeByte(e))
                                continue
                        }
                        switch e {
                        // We escape a few characters which may confuse humans or parsers.
                        case '"', ';', ' ':
                                str.WriteByte('\\')
                                str.WriteByte(e)
                        // The comma and backslash characters themselves must be
                        // doubly-escaped. We use `\\` for the first backslash and
                        // the escaped numeric value for the other value. We especially
                        // don't want a comma in the output.
                        case ',':
                                str.WriteString(`\\\044`)
                        case '\\':
                                str.WriteString(`\\\092`)
                        default:
                                str.WriteByte(e)
                        }
                }
        }
        return str.String()
}

func (s *SVCBAlpn) pack() ([]byte, error) {
        // Liberally estimate the size of an alpn as 10 octets
        b := make([]byte, 0, 10*len(s.Alpn))
        for _, e := range s.Alpn {
                if e == "" {
                        return nil, errors.New("dns: svcbalpn: empty alpn-id")
                }
                if len(e) > 255 {
                        return nil, errors.New("dns: svcbalpn: alpn-id too long")
                }
                b = append(b, byte(len(e)))
                b = append(b, e...)
        }
        return b, nil
}

func (s *SVCBAlpn) unpack(b []byte) error {
        // Estimate the size of the smallest alpn as 4 bytes
        alpn := make([]string, 0, len(b)/4)
        for i := 0; i < len(b); {
                length := int(b[i])
                i++
                if i+length > len(b) {
                        return errors.New("dns: svcbalpn: alpn array overflowing")
                }
                alpn = append(alpn, string(b[i:i+length]))
                i += length
        }
        s.Alpn = alpn
        return nil
}

func (s *SVCBAlpn) parse(b string) error {
        if len(b) == 0 {
                s.Alpn = []string{}
                return nil
        }

        alpn := []string{}
        a := []byte{}
        for p := 0; p < len(b); {
                c, q := nextByte(b, p)
                if q == 0 {
                        return errors.New("dns: svcbalpn: unterminated escape")
                }
                p += q
                // If we find a comma, we have finished reading an alpn.
                if c == ',' {
                        if len(a) == 0 {
                                return errors.New("dns: svcbalpn: empty protocol identifier")
                        }
                        alpn = append(alpn, string(a))
                        a = []byte{}
                        continue
                }
                // If it's a backslash, we need to handle a comma-separated list.
                if c == '\\' {
                        dc, dq := nextByte(b, p)
                        if dq == 0 {
                                return errors.New("dns: svcbalpn: unterminated escape decoding comma-separated list")
                        }
                        if dc != '\\' && dc != ',' {
                                return errors.New("dns: svcbalpn: bad escaped character decoding comma-separated list")
                        }
                        p += dq
                        c = dc
                }
                a = append(a, c)
        }
        // Add the final alpn.
        if len(a) == 0 {
                return errors.New("dns: svcbalpn: last protocol identifier empty")
        }
        s.Alpn = append(alpn, string(a))
        return nil
}

func (s *SVCBAlpn) len() int {
        var l int
        for _, e := range s.Alpn {
                l += 1 + len(e)
        }
        return l
}

func (s *SVCBAlpn) copy() SVCBKeyValue {
        return &SVCBAlpn{cloneSlice(s.Alpn)}
}

// SVCBNoDefaultAlpn pair signifies no support for default connection protocols.
// Should be used in conjunction with alpn.
// Basic use pattern for creating a no-default-alpn option:
//
//        s := &dns.SVCB{Hdr: dns.RR_Header{Name: ".", Rrtype: dns.TypeSVCB, Class: dns.ClassINET}}
//        t := new(dns.SVCBAlpn)
//        t.Alpn = []string{"xmpp-client"}
//        s.Value = append(s.Value, t)
//        e := new(dns.SVCBNoDefaultAlpn)
//        s.Value = append(s.Value, e)
type SVCBNoDefaultAlpn struct{}

func (*SVCBNoDefaultAlpn) Key() SVCBKey          { return SVCB_NO_DEFAULT_ALPN }
func (*SVCBNoDefaultAlpn) copy() SVCBKeyValue    { return &SVCBNoDefaultAlpn{} }
func (*SVCBNoDefaultAlpn) pack() ([]byte, error) { return []byte{}, nil }
func (*SVCBNoDefaultAlpn) String() string        { return "" }
func (*SVCBNoDefaultAlpn) len() int              { return 0 }

func (*SVCBNoDefaultAlpn) unpack(b []byte) error {
        if len(b) != 0 {
                return errors.New("dns: svcbnodefaultalpn: no-default-alpn must have no value")
        }
        return nil
}

func (*SVCBNoDefaultAlpn) parse(b string) error {
        if b != "" {
                return errors.New("dns: svcbnodefaultalpn: no-default-alpn must have no value")
        }
        return nil
}

// SVCBPort pair defines the port for connection.
// Basic use pattern for creating a port option:
//
//        s := &dns.SVCB{Hdr: dns.RR_Header{Name: ".", Rrtype: dns.TypeSVCB, Class: dns.ClassINET}}
//        e := new(dns.SVCBPort)
//        e.Port = 80
//        s.Value = append(s.Value, e)
type SVCBPort struct {
        Port uint16
}

func (*SVCBPort) Key() SVCBKey         { return SVCB_PORT }
func (*SVCBPort) len() int             { return 2 }
func (s *SVCBPort) String() string     { return strconv.FormatUint(uint64(s.Port), 10) }
func (s *SVCBPort) copy() SVCBKeyValue { return &SVCBPort{s.Port} }

func (s *SVCBPort) unpack(b []byte) error {
        if len(b) != 2 {
                return errors.New("dns: svcbport: port length is not exactly 2 octets")
        }
        s.Port = binary.BigEndian.Uint16(b)
        return nil
}

func (s *SVCBPort) pack() ([]byte, error) {
        b := make([]byte, 2)
        binary.BigEndian.PutUint16(b, s.Port)
        return b, nil
}

func (s *SVCBPort) parse(b string) error {
        port, err := strconv.ParseUint(b, 10, 16)
        if err != nil {
                return errors.New("dns: svcbport: port out of range")
        }
        s.Port = uint16(port)
        return nil
}

// SVCBIPv4Hint pair suggests an IPv4 address which may be used to open connections
// if A and AAAA record responses for SVCB's Target domain haven't been received.
// In that case, optionally, A and AAAA requests can be made, after which the connection
// to the hinted IP address may be terminated and a new connection may be opened.
// Basic use pattern for creating an ipv4hint option:
//
//                h := new(dns.HTTPS)
//                h.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeHTTPS, Class: dns.ClassINET}
//                e := new(dns.SVCBIPv4Hint)
//                e.Hint = []net.IP{net.IPv4(1,1,1,1).To4()}
//
//         Or
//
//                e.Hint = []net.IP{net.ParseIP("1.1.1.1").To4()}
//                h.Value = append(h.Value, e)
type SVCBIPv4Hint struct {
        Hint []net.IP
}

func (*SVCBIPv4Hint) Key() SVCBKey { return SVCB_IPV4HINT }
func (s *SVCBIPv4Hint) len() int   { return 4 * len(s.Hint) }

func (s *SVCBIPv4Hint) pack() ([]byte, error) {
        b := make([]byte, 0, 4*len(s.Hint))
        for _, e := range s.Hint {
                x := e.To4()
                if x == nil {
                        return nil, errors.New("dns: svcbipv4hint: expected ipv4, hint is ipv6")
                }
                b = append(b, x...)
        }
        return b, nil
}

func (s *SVCBIPv4Hint) unpack(b []byte) error {
        if len(b) == 0 || len(b)%4 != 0 {
                return errors.New("dns: svcbipv4hint: ipv4 address byte array length is not a multiple of 4")
        }
        b = cloneSlice(b)
        x := make([]net.IP, 0, len(b)/4)
        for i := 0; i < len(b); i += 4 {
                x = append(x, net.IP(b[i:i+4]))
        }
        s.Hint = x
        return nil
}

func (s *SVCBIPv4Hint) String() string {
        str := make([]string, len(s.Hint))
        for i, e := range s.Hint {
                x := e.To4()
                if x == nil {
                        return "<nil>"
                }
                str[i] = x.String()
        }
        return strings.Join(str, ",")
}

func (s *SVCBIPv4Hint) parse(b string) error {
        if b == "" {
                return errors.New("dns: svcbipv4hint: empty hint")
        }
        if strings.Contains(b, ":") {
                return errors.New("dns: svcbipv4hint: expected ipv4, got ipv6")
        }

        hint := make([]net.IP, 0, strings.Count(b, ",")+1)
        for len(b) > 0 {
                var e string
                e, b, _ = strings.Cut(b, ",")
                ip := net.ParseIP(e).To4()
                if ip == nil {
                        return errors.New("dns: svcbipv4hint: bad ip")
                }
                hint = append(hint, ip)
        }
        s.Hint = hint
        return nil
}

func (s *SVCBIPv4Hint) copy() SVCBKeyValue {
        hint := make([]net.IP, len(s.Hint))
        for i, ip := range s.Hint {
                hint[i] = cloneSlice(ip)
        }
        return &SVCBIPv4Hint{Hint: hint}
}

// SVCBECHConfig pair contains the ECHConfig structure defined in draft-ietf-tls-esni [RFC xxxx].
// Basic use pattern for creating an ech option:
//
//        h := new(dns.HTTPS)
//        h.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeHTTPS, Class: dns.ClassINET}
//        e := new(dns.SVCBECHConfig)
//        e.ECH = []byte{0xfe, 0x08, ...}
//        h.Value = append(h.Value, e)
type SVCBECHConfig struct {
        ECH []byte // Specifically ECHConfigList including the redundant length prefix
}

func (*SVCBECHConfig) Key() SVCBKey     { return SVCB_ECHCONFIG }
func (s *SVCBECHConfig) String() string { return toBase64(s.ECH) }
func (s *SVCBECHConfig) len() int       { return len(s.ECH) }

func (s *SVCBECHConfig) pack() ([]byte, error) {
        return cloneSlice(s.ECH), nil
}

func (s *SVCBECHConfig) copy() SVCBKeyValue {
        return &SVCBECHConfig{cloneSlice(s.ECH)}
}

func (s *SVCBECHConfig) unpack(b []byte) error {
        s.ECH = cloneSlice(b)
        return nil
}

func (s *SVCBECHConfig) parse(b string) error {
        x, err := fromBase64([]byte(b))
        if err != nil {
                return errors.New("dns: svcbech: bad base64 ech")
        }
        s.ECH = x
        return nil
}

// SVCBIPv6Hint pair suggests an IPv6 address which may be used to open connections
// if A and AAAA record responses for SVCB's Target domain haven't been received.
// In that case, optionally, A and AAAA requests can be made, after which the
// connection to the hinted IP address may be terminated and a new connection may be opened.
// Basic use pattern for creating an ipv6hint option:
//
//        h := new(dns.HTTPS)
//        h.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeHTTPS, Class: dns.ClassINET}
//        e := new(dns.SVCBIPv6Hint)
//        e.Hint = []net.IP{net.ParseIP("2001:db8::1")}
//        h.Value = append(h.Value, e)
type SVCBIPv6Hint struct {
        Hint []net.IP
}

func (*SVCBIPv6Hint) Key() SVCBKey { return SVCB_IPV6HINT }
func (s *SVCBIPv6Hint) len() int   { return 16 * len(s.Hint) }

func (s *SVCBIPv6Hint) pack() ([]byte, error) {
        b := make([]byte, 0, 16*len(s.Hint))
        for _, e := range s.Hint {
                if len(e) != net.IPv6len || e.To4() != nil {
                        return nil, errors.New("dns: svcbipv6hint: expected ipv6, hint is ipv4")
                }
                b = append(b, e...)
        }
        return b, nil
}

func (s *SVCBIPv6Hint) unpack(b []byte) error {
        if len(b) == 0 || len(b)%16 != 0 {
                return errors.New("dns: svcbipv6hint: ipv6 address byte array length not a multiple of 16")
        }
        b = cloneSlice(b)
        x := make([]net.IP, 0, len(b)/16)
        for i := 0; i < len(b); i += 16 {
                ip := net.IP(b[i : i+16])
                if ip.To4() != nil {
                        return errors.New("dns: svcbipv6hint: expected ipv6, got ipv4")
                }
                x = append(x, ip)
        }
        s.Hint = x
        return nil
}

func (s *SVCBIPv6Hint) String() string {
        str := make([]string, len(s.Hint))
        for i, e := range s.Hint {
                if x := e.To4(); x != nil {
                        return "<nil>"
                }
                str[i] = e.String()
        }
        return strings.Join(str, ",")
}

func (s *SVCBIPv6Hint) parse(b string) error {
        if b == "" {
                return errors.New("dns: svcbipv6hint: empty hint")
        }

        hint := make([]net.IP, 0, strings.Count(b, ",")+1)
        for len(b) > 0 {
                var e string
                e, b, _ = strings.Cut(b, ",")
                ip := net.ParseIP(e)
                if ip == nil {
                        return errors.New("dns: svcbipv6hint: bad ip")
                }
                if ip.To4() != nil {
                        return errors.New("dns: svcbipv6hint: expected ipv6, got ipv4-mapped-ipv6")
                }
                hint = append(hint, ip)
        }
        s.Hint = hint
        return nil
}

func (s *SVCBIPv6Hint) copy() SVCBKeyValue {
        hint := make([]net.IP, len(s.Hint))
        for i, ip := range s.Hint {
                hint[i] = cloneSlice(ip)
        }
        return &SVCBIPv6Hint{Hint: hint}
}

// SVCBDoHPath pair is used to indicate the URI template that the
// clients may use to construct a DNS over HTTPS URI.
//
// See RFC 9461 (https://datatracker.ietf.org/doc/html/rfc9461)
// and RFC 9462 (https://datatracker.ietf.org/doc/html/rfc9462).
//
// A basic example of using the dohpath option together with the alpn
// option to indicate support for DNS over HTTPS on a certain path:
//
//        s := new(dns.SVCB)
//        s.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeSVCB, Class: dns.ClassINET}
//        e := new(dns.SVCBAlpn)
//        e.Alpn = []string{"h2", "h3"}
//        p := new(dns.SVCBDoHPath)
//        p.Template = "/dns-query{?dns}"
//        s.Value = append(s.Value, e, p)
//
// The parsing currently doesn't validate that Template is a valid
// RFC 6570 URI template.
type SVCBDoHPath struct {
        Template string
}

func (*SVCBDoHPath) Key() SVCBKey            { return SVCB_DOHPATH }
func (s *SVCBDoHPath) String() string        { return svcbParamToStr([]byte(s.Template)) }
func (s *SVCBDoHPath) len() int              { return len(s.Template) }
func (s *SVCBDoHPath) pack() ([]byte, error) { return []byte(s.Template), nil }

func (s *SVCBDoHPath) unpack(b []byte) error {
        s.Template = string(b)
        return nil
}

func (s *SVCBDoHPath) parse(b string) error {
        template, err := svcbParseParam(b)
        if err != nil {
                return fmt.Errorf("dns: svcbdohpath: %w", err)
        }
        s.Template = string(template)
        return nil
}

func (s *SVCBDoHPath) copy() SVCBKeyValue {
        return &SVCBDoHPath{
                Template: s.Template,
        }
}

// The "ohttp" SvcParamKey is used to indicate that a service described in a SVCB RR
// can be accessed as a target using an associated gateway.
// Both the presentation and wire-format values for the "ohttp" parameter MUST be empty.
//
// See RFC 9460 (https://datatracker.ietf.org/doc/html/rfc9460/)
// and RFC 9230 (https://datatracker.ietf.org/doc/html/rfc9230/)
//
// A basic example of using the dohpath option together with the alpn
// option to indicate support for DNS over HTTPS on a certain path:
//
//        s := new(dns.SVCB)
//        s.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeSVCB, Class: dns.ClassINET}
//        e := new(dns.SVCBAlpn)
//        e.Alpn = []string{"h2", "h3"}
//        p := new(dns.SVCBOhttp)
//        s.Value = append(s.Value, e, p)
type SVCBOhttp struct{}

func (*SVCBOhttp) Key() SVCBKey          { return SVCB_OHTTP }
func (*SVCBOhttp) copy() SVCBKeyValue    { return &SVCBOhttp{} }
func (*SVCBOhttp) pack() ([]byte, error) { return []byte{}, nil }
func (*SVCBOhttp) String() string        { return "" }
func (*SVCBOhttp) len() int              { return 0 }

func (*SVCBOhttp) unpack(b []byte) error {
        if len(b) != 0 {
                return errors.New("dns: svcbotthp: svcbotthp must have no value")
        }
        return nil
}

func (*SVCBOhttp) parse(b string) error {
        if b != "" {
                return errors.New("dns: svcbotthp: svcbotthp must have no value")
        }
        return nil
}

// SVCBLocal pair is intended for experimental/private use. The key is recommended
// to be in the range [SVCB_PRIVATE_LOWER, SVCB_PRIVATE_UPPER].
// Basic use pattern for creating a keyNNNNN option:
//
//        h := new(dns.HTTPS)
//        h.Hdr = dns.RR_Header{Name: ".", Rrtype: dns.TypeHTTPS, Class: dns.ClassINET}
//        e := new(dns.SVCBLocal)
//        e.KeyCode = 65400
//        e.Data = []byte("abc")
//        h.Value = append(h.Value, e)
type SVCBLocal struct {
        KeyCode SVCBKey // Never 65535 or any assigned keys.
        Data    []byte  // All byte sequences are allowed.
}

func (s *SVCBLocal) Key() SVCBKey          { return s.KeyCode }
func (s *SVCBLocal) String() string        { return svcbParamToStr(s.Data) }
func (s *SVCBLocal) pack() ([]byte, error) { return cloneSlice(s.Data), nil }
func (s *SVCBLocal) len() int              { return len(s.Data) }

func (s *SVCBLocal) unpack(b []byte) error {
        s.Data = cloneSlice(b)
        return nil
}

func (s *SVCBLocal) parse(b string) error {
        data, err := svcbParseParam(b)
        if err != nil {
                return fmt.Errorf("dns: svcblocal: svcb private/experimental key %w", err)
        }
        s.Data = data
        return nil
}

func (s *SVCBLocal) copy() SVCBKeyValue {
        return &SVCBLocal{s.KeyCode, cloneSlice(s.Data)}
}

func (rr *SVCB) String() string {
        s := rr.Hdr.String() +
                strconv.Itoa(int(rr.Priority)) + " " +
                sprintName(rr.Target)
        for _, e := range rr.Value {
                s += " " + e.Key().String() + "=\"" + e.String() + "\""
        }
        return s
}

// areSVCBPairArraysEqual checks if SVCBKeyValue arrays are equal after sorting their
// copies. arrA and arrB have equal lengths, otherwise zduplicate.go wouldn't call this function.
func areSVCBPairArraysEqual(a []SVCBKeyValue, b []SVCBKeyValue) bool {
        a = cloneSlice(a)
        b = cloneSlice(b)
        sort.Slice(a, func(i, j int) bool { return a[i].Key() < a[j].Key() })
        sort.Slice(b, func(i, j int) bool { return b[i].Key() < b[j].Key() })
        for i, e := range a {
                if e.Key() != b[i].Key() {
                        return false
                }
                b1, err1 := e.pack()
                b2, err2 := b[i].pack()
                if err1 != nil || err2 != nil || !bytes.Equal(b1, b2) {
                        return false
                }
        }
        return true
}

// svcbParamStr converts the value of an SVCB parameter into a DNS presentation-format string.
func svcbParamToStr(s []byte) string {
        var str strings.Builder
        str.Grow(4 * len(s))
        for _, e := range s {
                if ' ' <= e && e <= '~' {
                        switch e {
                        case '"', ';', ' ', '\\':
                                str.WriteByte('\\')
                                str.WriteByte(e)
                        default:
                                str.WriteByte(e)
                        }
                } else {
                        str.WriteString(escapeByte(e))
                }
        }
        return str.String()
}

// svcbParseParam parses a DNS presentation-format string into an SVCB parameter value.
func svcbParseParam(b string) ([]byte, error) {
        data := make([]byte, 0, len(b))
        for i := 0; i < len(b); {
                if b[i] != '\\' {
                        data = append(data, b[i])
                        i++
                        continue
                }
                if i+1 == len(b) {
                        return nil, errors.New("escape unterminated")
                }
                if isDigit(b[i+1]) {
                        if i+3 < len(b) && isDigit(b[i+2]) && isDigit(b[i+3]) {
                                a, err := strconv.ParseUint(b[i+1:i+4], 10, 8)
                                if err == nil {
                                        i += 4
                                        data = append(data, byte(a))
                                        continue
                                }
                        }
                        return nil, errors.New("bad escaped octet")
                } else {
                        data = append(data, b[i+1])
                        i += 2
                }
        }
        return data, nil
}

package dns

import (
        "crypto/x509"
        "net"
        "strconv"
)

// Sign creates a TLSA record from an SSL certificate.
func (r *TLSA) Sign(usage, selector, matchingType int, cert *x509.Certificate) (err error) {
        r.Hdr.Rrtype = TypeTLSA
        r.Usage = uint8(usage)
        r.Selector = uint8(selector)
        r.MatchingType = uint8(matchingType)

        r.Certificate, err = CertificateToDANE(r.Selector, r.MatchingType, cert)
        return err
}

// Verify verifies a TLSA record against an SSL certificate. If it is OK
// a nil error is returned.
func (r *TLSA) Verify(cert *x509.Certificate) error {
        c, err := CertificateToDANE(r.Selector, r.MatchingType, cert)
        if err != nil {
                return err // Not also ErrSig?
        }
        if r.Certificate == c {
                return nil
        }
        return ErrSig // ErrSig, really?
}

// TLSAName returns the ownername of a TLSA resource record as per the
// rules specified in RFC 6698, Section 3.
func TLSAName(name, service, network string) (string, error) {
        if !IsFqdn(name) {
                return "", ErrFqdn
        }
        p, err := net.LookupPort(network, service)
        if err != nil {
                return "", err
        }
        return "_" + strconv.Itoa(p) + "._" + network + "." + name, nil
}

package dns

import (
        "crypto/hmac"
        "crypto/sha1"
        "crypto/sha256"
        "crypto/sha512"
        "encoding/binary"
        "encoding/hex"
        "hash"
        "strconv"
        "strings"
        "time"
)

// HMAC hashing codes. These are transmitted as domain names.
const (
        HmacSHA1   = "hmac-sha1."
        HmacSHA224 = "hmac-sha224."
        HmacSHA256 = "hmac-sha256."
        HmacSHA384 = "hmac-sha384."
        HmacSHA512 = "hmac-sha512."

        HmacMD5 = "hmac-md5.sig-alg.reg.int." // Deprecated: HmacMD5 is no longer supported.
)

// TsigProvider provides the API to plug-in a custom TSIG implementation.
type TsigProvider interface {
        // Generate is passed the DNS message to be signed and the partial TSIG RR. It returns the signature and nil, otherwise an error.
        Generate(msg []byte, t *TSIG) ([]byte, error)
        // Verify is passed the DNS message to be verified and the TSIG RR. If the signature is valid it will return nil, otherwise an error.
        Verify(msg []byte, t *TSIG) error
}

type tsigHMACProvider string

func (key tsigHMACProvider) Generate(msg []byte, t *TSIG) ([]byte, error) {
        // If we barf here, the caller is to blame
        rawsecret, err := fromBase64([]byte(key))
        if err != nil {
                return nil, err
        }
        var h hash.Hash
        switch CanonicalName(t.Algorithm) {
        case HmacSHA1:
                h = hmac.New(sha1.New, rawsecret)
        case HmacSHA224:
                h = hmac.New(sha256.New224, rawsecret)
        case HmacSHA256:
                h = hmac.New(sha256.New, rawsecret)
        case HmacSHA384:
                h = hmac.New(sha512.New384, rawsecret)
        case HmacSHA512:
                h = hmac.New(sha512.New, rawsecret)
        default:
                return nil, ErrKeyAlg
        }
        h.Write(msg)
        return h.Sum(nil), nil
}

func (key tsigHMACProvider) Verify(msg []byte, t *TSIG) error {
        b, err := key.Generate(msg, t)
        if err != nil {
                return err
        }
        mac, err := hex.DecodeString(t.MAC)
        if err != nil {
                return err
        }
        if !hmac.Equal(b, mac) {
                return ErrSig
        }
        return nil
}

type tsigSecretProvider map[string]string

func (ts tsigSecretProvider) Generate(msg []byte, t *TSIG) ([]byte, error) {
        key, ok := ts[t.Hdr.Name]
        if !ok {
                return nil, ErrSecret
        }
        return tsigHMACProvider(key).Generate(msg, t)
}

func (ts tsigSecretProvider) Verify(msg []byte, t *TSIG) error {
        key, ok := ts[t.Hdr.Name]
        if !ok {
                return ErrSecret
        }
        return tsigHMACProvider(key).Verify(msg, t)
}

// TSIG is the RR the holds the transaction signature of a message.
// See RFC 2845 and RFC 4635.
type TSIG struct {
        Hdr        RR_Header
        Algorithm  string `dns:"domain-name"`
        TimeSigned uint64 `dns:"uint48"`
        Fudge      uint16
        MACSize    uint16
        MAC        string `dns:"size-hex:MACSize"`
        OrigId     uint16
        Error      uint16
        OtherLen   uint16
        OtherData  string `dns:"size-hex:OtherLen"`
}

// TSIG has no official presentation format, but this will suffice.

func (rr *TSIG) String() string {
        s := "\n;; TSIG PSEUDOSECTION:\n; " // add another semi-colon to signify TSIG does not have a presentation format
        s += rr.Hdr.String() +
                " " + rr.Algorithm +
                " " + tsigTimeToString(rr.TimeSigned) +
                " " + strconv.Itoa(int(rr.Fudge)) +
                " " + strconv.Itoa(int(rr.MACSize)) +
                " " + strings.ToUpper(rr.MAC) +
                " " + strconv.Itoa(int(rr.OrigId)) +
                " " + strconv.Itoa(int(rr.Error)) + // BIND prints NOERROR
                " " + strconv.Itoa(int(rr.OtherLen)) +
                " " + rr.OtherData
        return s
}

func (*TSIG) parse(c *zlexer, origin string) *ParseError {
        return &ParseError{err: "TSIG records do not have a presentation format"}
}

// The following values must be put in wireformat, so that the MAC can be calculated.
// RFC 2845, section 3.4.2. TSIG Variables.
type tsigWireFmt struct {
        // From RR_Header
        Name  string `dns:"domain-name"`
        Class uint16
        Ttl   uint32
        // Rdata of the TSIG
        Algorithm  string `dns:"domain-name"`
        TimeSigned uint64 `dns:"uint48"`
        Fudge      uint16
        // MACSize, MAC and OrigId excluded
        Error     uint16
        OtherLen  uint16
        OtherData string `dns:"size-hex:OtherLen"`
}

// If we have the MAC use this type to convert it to wiredata. Section 3.4.3. Request MAC
type macWireFmt struct {
        MACSize uint16
        MAC     string `dns:"size-hex:MACSize"`
}

// 3.3. Time values used in TSIG calculations
type timerWireFmt struct {
        TimeSigned uint64 `dns:"uint48"`
        Fudge      uint16
}

// TsigGenerate fills out the TSIG record attached to the message.
// The message should contain a "stub" TSIG RR with the algorithm, key name
// (owner name of the RR), time fudge (defaults to 300 seconds) and the current
// time The TSIG MAC is saved in that Tsig RR. When TsigGenerate is called for
// the first time requestMAC should be set to the empty string and timersOnly to
// false.
func TsigGenerate(m *Msg, secret, requestMAC string, timersOnly bool) ([]byte, string, error) {
        return TsigGenerateWithProvider(m, tsigHMACProvider(secret), requestMAC, timersOnly)
}

// TsigGenerateWithProvider is similar to TsigGenerate, but allows for a custom TsigProvider.
func TsigGenerateWithProvider(m *Msg, provider TsigProvider, requestMAC string, timersOnly bool) ([]byte, string, error) {
        if m.IsTsig() == nil {
                panic("dns: TSIG not last RR in additional")
        }

        rr := m.Extra[len(m.Extra)-1].(*TSIG)
        m.Extra = m.Extra[0 : len(m.Extra)-1] // kill the TSIG from the msg
        mbuf, err := m.Pack()
        if err != nil {
                return nil, "", err
        }

        buf, err := tsigBuffer(mbuf, rr, requestMAC, timersOnly)
        if err != nil {
                return nil, "", err
        }

        t := new(TSIG)
        // Copy all TSIG fields except MAC, its size, and time signed which are filled when signing.
        *t = *rr
        t.TimeSigned = 0
        t.MAC = ""
        t.MACSize = 0

        // Sign unless there is a key or MAC validation error (RFC 8945 5.3.2)
        if rr.Error != RcodeBadKey && rr.Error != RcodeBadSig {
                mac, err := provider.Generate(buf, rr)
                if err != nil {
                        return nil, "", err
                }
                t.TimeSigned = rr.TimeSigned
                t.MAC = hex.EncodeToString(mac)
                t.MACSize = uint16(len(t.MAC) / 2) // Size is half!
        }

        tbuf := make([]byte, Len(t))
        off, err := PackRR(t, tbuf, 0, nil, false)
        if err != nil {
                return nil, "", err
        }
        mbuf = append(mbuf, tbuf[:off]...)
        // Update the ArCount directly in the buffer.
        binary.BigEndian.PutUint16(mbuf[10:], uint16(len(m.Extra)+1))

        return mbuf, t.MAC, nil
}

// TsigVerify verifies the TSIG on a message. If the signature does not
// validate the returned error contains the cause. If the signature is OK, the
// error is nil.
func TsigVerify(msg []byte, secret, requestMAC string, timersOnly bool) error {
        return tsigVerify(msg, tsigHMACProvider(secret), requestMAC, timersOnly, uint64(time.Now().Unix()))
}

// TsigVerifyWithProvider is similar to TsigVerify, but allows for a custom TsigProvider.
func TsigVerifyWithProvider(msg []byte, provider TsigProvider, requestMAC string, timersOnly bool) error {
        return tsigVerify(msg, provider, requestMAC, timersOnly, uint64(time.Now().Unix()))
}

// actual implementation of TsigVerify, taking the current time ('now') as a parameter for the convenience of tests.
func tsigVerify(msg []byte, provider TsigProvider, requestMAC string, timersOnly bool, now uint64) error {
        // Strip the TSIG from the incoming msg
        stripped, tsig, err := stripTsig(msg)
        if err != nil {
                return err
        }

        buf, err := tsigBuffer(stripped, tsig, requestMAC, timersOnly)
        if err != nil {
                return err
        }

        if err := provider.Verify(buf, tsig); err != nil {
                return err
        }

        // Fudge factor works both ways. A message can arrive before it was signed because
        // of clock skew.
        // We check this after verifying the signature, following draft-ietf-dnsop-rfc2845bis
        // instead of RFC2845, in order to prevent a security vulnerability as reported in CVE-2017-3142/3143.
        ti := now - tsig.TimeSigned
        if now < tsig.TimeSigned {
                ti = tsig.TimeSigned - now
        }
        if uint64(tsig.Fudge) < ti {
                return ErrTime
        }

        return nil
}

// Create a wiredata buffer for the MAC calculation.
func tsigBuffer(msgbuf []byte, rr *TSIG, requestMAC string, timersOnly bool) ([]byte, error) {
        var buf []byte
        if rr.TimeSigned == 0 {
                rr.TimeSigned = uint64(time.Now().Unix())
        }
        if rr.Fudge == 0 {
                rr.Fudge = 300 // Standard (RFC) default.
        }

        // Replace message ID in header with original ID from TSIG
        binary.BigEndian.PutUint16(msgbuf[0:2], rr.OrigId)

        if requestMAC != "" {
                m := new(macWireFmt)
                m.MACSize = uint16(len(requestMAC) / 2)
                m.MAC = requestMAC
                buf = make([]byte, len(requestMAC)) // long enough
                n, err := packMacWire(m, buf)
                if err != nil {
                        return nil, err
                }
                buf = buf[:n]
        }

        tsigvar := make([]byte, DefaultMsgSize)
        if timersOnly {
                tsig := new(timerWireFmt)
                tsig.TimeSigned = rr.TimeSigned
                tsig.Fudge = rr.Fudge
                n, err := packTimerWire(tsig, tsigvar)
                if err != nil {
                        return nil, err
                }
                tsigvar = tsigvar[:n]
        } else {
                tsig := new(tsigWireFmt)
                tsig.Name = CanonicalName(rr.Hdr.Name)
                tsig.Class = ClassANY
                tsig.Ttl = rr.Hdr.Ttl
                tsig.Algorithm = CanonicalName(rr.Algorithm)
                tsig.TimeSigned = rr.TimeSigned
                tsig.Fudge = rr.Fudge
                tsig.Error = rr.Error
                tsig.OtherLen = rr.OtherLen
                tsig.OtherData = rr.OtherData
                n, err := packTsigWire(tsig, tsigvar)
                if err != nil {
                        return nil, err
                }
                tsigvar = tsigvar[:n]
        }

        if requestMAC != "" {
                x := append(buf, msgbuf...)
                buf = append(x, tsigvar...)
        } else {
                buf = append(msgbuf, tsigvar...)
        }
        return buf, nil
}

// Strip the TSIG from the raw message.
func stripTsig(msg []byte) ([]byte, *TSIG, error) {
        // Copied from msg.go's Unpack() Header, but modified.
        var (
                dh  Header
                err error
        )
        off, tsigoff := 0, 0

        if dh, off, err = unpackMsgHdr(msg, off); err != nil {
                return nil, nil, err
        }
        if dh.Arcount == 0 {
                return nil, nil, ErrNoSig
        }

        // Rcode, see msg.go Unpack()
        if int(dh.Bits&0xF) == RcodeNotAuth {
                return nil, nil, ErrAuth
        }

        for i := 0; i < int(dh.Qdcount); i++ {
                _, off, err = unpackQuestion(msg, off)
                if err != nil {
                        return nil, nil, err
                }
        }

        _, off, err = unpackRRslice(int(dh.Ancount), msg, off)
        if err != nil {
                return nil, nil, err
        }
        _, off, err = unpackRRslice(int(dh.Nscount), msg, off)
        if err != nil {
                return nil, nil, err
        }

        rr := new(TSIG)
        var extra RR
        for i := 0; i < int(dh.Arcount); i++ {
                tsigoff = off
                extra, off, err = UnpackRR(msg, off)
                if err != nil {
                        return nil, nil, err
                }
                if extra.Header().Rrtype == TypeTSIG {
                        rr = extra.(*TSIG)
                        // Adjust Arcount.
                        arcount := binary.BigEndian.Uint16(msg[10:])
                        binary.BigEndian.PutUint16(msg[10:], arcount-1)
                        break
                }
        }
        if rr == nil {
                return nil, nil, ErrNoSig
        }
        return msg[:tsigoff], rr, nil
}

// Translate the TSIG time signed into a date. There is no
// need for RFC1982 calculations as this date is 48 bits.
func tsigTimeToString(t uint64) string {
        ti := time.Unix(int64(t), 0).UTC()
        return ti.Format("20060102150405")
}

func packTsigWire(tw *tsigWireFmt, msg []byte) (int, error) {
        // copied from zmsg.go TSIG packing
        // RR_Header
        off, err := PackDomainName(tw.Name, msg, 0, nil, false)
        if err != nil {
                return off, err
        }
        off, err = packUint16(tw.Class, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(tw.Ttl, msg, off)
        if err != nil {
                return off, err
        }

        off, err = PackDomainName(tw.Algorithm, msg, off, nil, false)
        if err != nil {
                return off, err
        }
        off, err = packUint48(tw.TimeSigned, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(tw.Fudge, msg, off)
        if err != nil {
                return off, err
        }

        off, err = packUint16(tw.Error, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(tw.OtherLen, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(tw.OtherData, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func packMacWire(mw *macWireFmt, msg []byte) (int, error) {
        off, err := packUint16(mw.MACSize, msg, 0)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(mw.MAC, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func packTimerWire(tw *timerWireFmt, msg []byte) (int, error) {
        off, err := packUint48(tw.TimeSigned, msg, 0)
        if err != nil {
                return off, err
        }
        off, err = packUint16(tw.Fudge, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

package dns

import (
        "bytes"
        "fmt"
        "net"
        "strconv"
        "strings"
        "time"
)

type (
        // Type is a DNS type.
        Type uint16
        // Class is a DNS class.
        Class uint16
        // Name is a DNS domain name.
        Name string
)

// Packet formats

// Wire constants and supported types.
const (
        // valid RR_Header.Rrtype and Question.qtype

        TypeNone       uint16 = 0
        TypeA          uint16 = 1
        TypeNS         uint16 = 2
        TypeMD         uint16 = 3
        TypeMF         uint16 = 4
        TypeCNAME      uint16 = 5
        TypeSOA        uint16 = 6
        TypeMB         uint16 = 7
        TypeMG         uint16 = 8
        TypeMR         uint16 = 9
        TypeNULL       uint16 = 10
        TypePTR        uint16 = 12
        TypeHINFO      uint16 = 13
        TypeMINFO      uint16 = 14
        TypeMX         uint16 = 15
        TypeTXT        uint16 = 16
        TypeRP         uint16 = 17
        TypeAFSDB      uint16 = 18
        TypeX25        uint16 = 19
        TypeISDN       uint16 = 20
        TypeRT         uint16 = 21
        TypeNSAPPTR    uint16 = 23
        TypeSIG        uint16 = 24
        TypeKEY        uint16 = 25
        TypePX         uint16 = 26
        TypeGPOS       uint16 = 27
        TypeAAAA       uint16 = 28
        TypeLOC        uint16 = 29
        TypeNXT        uint16 = 30
        TypeEID        uint16 = 31
        TypeNIMLOC     uint16 = 32
        TypeSRV        uint16 = 33
        TypeATMA       uint16 = 34
        TypeNAPTR      uint16 = 35
        TypeKX         uint16 = 36
        TypeCERT       uint16 = 37
        TypeDNAME      uint16 = 39
        TypeOPT        uint16 = 41 // EDNS
        TypeAPL        uint16 = 42
        TypeDS         uint16 = 43
        TypeSSHFP      uint16 = 44
        TypeIPSECKEY   uint16 = 45
        TypeRRSIG      uint16 = 46
        TypeNSEC       uint16 = 47
        TypeDNSKEY     uint16 = 48
        TypeDHCID      uint16 = 49
        TypeNSEC3      uint16 = 50
        TypeNSEC3PARAM uint16 = 51
        TypeTLSA       uint16 = 52
        TypeSMIMEA     uint16 = 53
        TypeHIP        uint16 = 55
        TypeNINFO      uint16 = 56
        TypeRKEY       uint16 = 57
        TypeTALINK     uint16 = 58
        TypeCDS        uint16 = 59
        TypeCDNSKEY    uint16 = 60
        TypeOPENPGPKEY uint16 = 61
        TypeCSYNC      uint16 = 62
        TypeZONEMD     uint16 = 63
        TypeSVCB       uint16 = 64
        TypeHTTPS      uint16 = 65
        TypeSPF        uint16 = 99
        TypeUINFO      uint16 = 100
        TypeUID        uint16 = 101
        TypeGID        uint16 = 102
        TypeUNSPEC     uint16 = 103
        TypeNID        uint16 = 104
        TypeL32        uint16 = 105
        TypeL64        uint16 = 106
        TypeLP         uint16 = 107
        TypeEUI48      uint16 = 108
        TypeEUI64      uint16 = 109
        TypeNXNAME     uint16 = 128
        TypeURI        uint16 = 256
        TypeCAA        uint16 = 257
        TypeAVC        uint16 = 258
        TypeAMTRELAY   uint16 = 260

        TypeTKEY uint16 = 249
        TypeTSIG uint16 = 250

        // valid Question.Qtype only
        TypeIXFR  uint16 = 251
        TypeAXFR  uint16 = 252
        TypeMAILB uint16 = 253
        TypeMAILA uint16 = 254
        TypeANY   uint16 = 255

        TypeTA       uint16 = 32768
        TypeDLV      uint16 = 32769
        TypeReserved uint16 = 65535

        // valid Question.Qclass
        ClassINET   = 1
        ClassCSNET  = 2
        ClassCHAOS  = 3
        ClassHESIOD = 4
        ClassNONE   = 254
        ClassANY    = 255

        // Message Response Codes, see https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
        RcodeSuccess        = 0  // NoError   - No Error                          [DNS]
        RcodeFormatError    = 1  // FormErr   - Format Error                      [DNS]
        RcodeServerFailure  = 2  // ServFail  - Server Failure                    [DNS]
        RcodeNameError      = 3  // NXDomain  - Non-Existent Domain               [DNS]
        RcodeNotImplemented = 4  // NotImp    - Not Implemented                   [DNS]
        RcodeRefused        = 5  // Refused   - Query Refused                     [DNS]
        RcodeYXDomain       = 6  // YXDomain  - Name Exists when it should not    [DNS Update]
        RcodeYXRrset        = 7  // YXRRSet   - RR Set Exists when it should not  [DNS Update]
        RcodeNXRrset        = 8  // NXRRSet   - RR Set that should exist does not [DNS Update]
        RcodeNotAuth        = 9  // NotAuth   - Server Not Authoritative for zone [DNS Update]
        RcodeNotZone        = 10 // NotZone   - Name not contained in zone        [DNS Update/TSIG]
        RcodeBadSig         = 16 // BADSIG    - TSIG Signature Failure            [TSIG]  https://www.rfc-editor.org/rfc/rfc6895.html#section-2.3
        RcodeBadVers        = 16 // BADVERS   - Bad OPT Version                   [EDNS0] https://www.rfc-editor.org/rfc/rfc6895.html#section-2.3
        RcodeBadKey         = 17 // BADKEY    - Key not recognized                [TSIG]
        RcodeBadTime        = 18 // BADTIME   - Signature out of time window      [TSIG]
        RcodeBadMode        = 19 // BADMODE   - Bad TKEY Mode                     [TKEY]
        RcodeBadName        = 20 // BADNAME   - Duplicate key name                [TKEY]
        RcodeBadAlg         = 21 // BADALG    - Algorithm not supported           [TKEY]
        RcodeBadTrunc       = 22 // BADTRUNC  - Bad Truncation                    [TSIG]
        RcodeBadCookie      = 23 // BADCOOKIE - Bad/missing Server Cookie         [DNS Cookies]

        // Message Opcodes. There is no 3.
        OpcodeQuery  = 0
        OpcodeIQuery = 1
        OpcodeStatus = 2
        OpcodeNotify = 4
        OpcodeUpdate = 5
)

// Used in ZONEMD https://tools.ietf.org/html/rfc8976
const (
        ZoneMDSchemeSimple = 1

        ZoneMDHashAlgSHA384 = 1
        ZoneMDHashAlgSHA512 = 2
)

// Used in IPSEC https://datatracker.ietf.org/doc/html/rfc4025#section-2.3
const (
        IPSECGatewayNone uint8 = iota
        IPSECGatewayIPv4
        IPSECGatewayIPv6
        IPSECGatewayHost
)

// Used in AMTRELAY https://datatracker.ietf.org/doc/html/rfc8777#section-4.2.3
const (
        AMTRELAYNone = IPSECGatewayNone
        AMTRELAYIPv4 = IPSECGatewayIPv4
        AMTRELAYIPv6 = IPSECGatewayIPv6
        AMTRELAYHost = IPSECGatewayHost
)

// Header is the wire format for the DNS packet header.
type Header struct {
        Id                                 uint16
        Bits                               uint16
        Qdcount, Ancount, Nscount, Arcount uint16
}

const (
        headerSize = 12

        // Header.Bits
        _QR = 1 << 15 // query/response (response=1)
        _AA = 1 << 10 // authoritative
        _TC = 1 << 9  // truncated
        _RD = 1 << 8  // recursion desired
        _RA = 1 << 7  // recursion available
        _Z  = 1 << 6  // Z
        _AD = 1 << 5  // authenticated data
        _CD = 1 << 4  // checking disabled
)

// Various constants used in the LOC RR. See RFC 1876.
const (
        LOC_EQUATOR       = 1 << 31 // RFC 1876, Section 2.
        LOC_PRIMEMERIDIAN = 1 << 31 // RFC 1876, Section 2.
        LOC_HOURS         = 60 * 1000
        LOC_DEGREES       = 60 * LOC_HOURS
        LOC_ALTITUDEBASE  = 100000
)

// Different Certificate Types, see RFC 4398, Section 2.1
const (
        CertPKIX = 1 + iota
        CertSPKI
        CertPGP
        CertIPIX
        CertISPKI
        CertIPGP
        CertACPKIX
        CertIACPKIX
        CertURI = 253
        CertOID = 254
)

// CertTypeToString converts the Cert Type to its string representation.
// See RFC 4398 and RFC 6944.
var CertTypeToString = map[uint16]string{
        CertPKIX:    "PKIX",
        CertSPKI:    "SPKI",
        CertPGP:     "PGP",
        CertIPIX:    "IPIX",
        CertISPKI:   "ISPKI",
        CertIPGP:    "IPGP",
        CertACPKIX:  "ACPKIX",
        CertIACPKIX: "IACPKIX",
        CertURI:     "URI",
        CertOID:     "OID",
}

// Prefix for IPv4 encoded as IPv6 address
const ipv4InIPv6Prefix = "::ffff:"

//go:generate go run types_generate.go

// Question holds a DNS question. Usually there is just one. While the
// original DNS RFCs allow multiple questions in the question section of a
// message, in practice it never works. Because most DNS servers see multiple
// questions as an error, it is recommended to only have one question per
// message.
type Question struct {
        Name   string `dns:"cdomain-name"` // "cdomain-name" specifies encoding (and may be compressed)
        Qtype  uint16
        Qclass uint16
}

func (q *Question) len(off int, compression map[string]struct{}) int {
        l := domainNameLen(q.Name, off, compression, true)
        l += 2 + 2
        return l
}

func (q *Question) String() (s string) {
        // prefix with ; (as in dig)
        s = ";" + sprintName(q.Name) + "\t"
        s += Class(q.Qclass).String() + "\t"
        s += " " + Type(q.Qtype).String()
        return s
}

// ANY is a wild card record. See RFC 1035, Section 3.2.3. ANY
// is named "*" there.
type ANY struct {
        Hdr RR_Header
        // Does not have any rdata
}

func (rr *ANY) String() string { return rr.Hdr.String() }

func (*ANY) parse(c *zlexer, origin string) *ParseError {
        return &ParseError{err: "ANY records do not have a presentation format"}
}

// NULL RR. See RFC 1035.
type NULL struct {
        Hdr  RR_Header
        Data string `dns:"any"`
}

func (rr *NULL) String() string {
        // There is no presentation format; prefix string with a comment.
        return ";" + rr.Hdr.String() + rr.Data
}

func (*NULL) parse(c *zlexer, origin string) *ParseError {
        return &ParseError{err: "NULL records do not have a presentation format"}
}

// NXNAME is a meta record. See https://www.iana.org/go/draft-ietf-dnsop-compact-denial-of-existence-04
// Reference: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
type NXNAME struct {
        Hdr RR_Header
        // Does not have any rdata
}

func (rr *NXNAME) String() string { return rr.Hdr.String() }

func (*NXNAME) parse(c *zlexer, origin string) *ParseError {
        return &ParseError{err: "NXNAME records do not have a presentation format"}
}

// CNAME RR. See RFC 1034.
type CNAME struct {
        Hdr    RR_Header
        Target string `dns:"cdomain-name"`
}

func (rr *CNAME) String() string { return rr.Hdr.String() + sprintName(rr.Target) }

// HINFO RR. See RFC 1034.
type HINFO struct {
        Hdr RR_Header
        Cpu string
        Os  string
}

func (rr *HINFO) String() string {
        return rr.Hdr.String() + sprintTxt([]string{rr.Cpu, rr.Os})
}

// MB RR. See RFC 1035.
type MB struct {
        Hdr RR_Header
        Mb  string `dns:"cdomain-name"`
}

func (rr *MB) String() string { return rr.Hdr.String() + sprintName(rr.Mb) }

// MG RR. See RFC 1035.
type MG struct {
        Hdr RR_Header
        Mg  string `dns:"cdomain-name"`
}

func (rr *MG) String() string { return rr.Hdr.String() + sprintName(rr.Mg) }

// MINFO RR. See RFC 1035.
type MINFO struct {
        Hdr   RR_Header
        Rmail string `dns:"cdomain-name"`
        Email string `dns:"cdomain-name"`
}

func (rr *MINFO) String() string {
        return rr.Hdr.String() + sprintName(rr.Rmail) + " " + sprintName(rr.Email)
}

// MR RR. See RFC 1035.
type MR struct {
        Hdr RR_Header
        Mr  string `dns:"cdomain-name"`
}

func (rr *MR) String() string {
        return rr.Hdr.String() + sprintName(rr.Mr)
}

// MF RR. See RFC 1035.
type MF struct {
        Hdr RR_Header
        Mf  string `dns:"cdomain-name"`
}

func (rr *MF) String() string {
        return rr.Hdr.String() + sprintName(rr.Mf)
}

// MD RR. See RFC 1035.
type MD struct {
        Hdr RR_Header
        Md  string `dns:"cdomain-name"`
}

func (rr *MD) String() string {
        return rr.Hdr.String() + sprintName(rr.Md)
}

// MX RR. See RFC 1035.
type MX struct {
        Hdr        RR_Header
        Preference uint16
        Mx         string `dns:"cdomain-name"`
}

func (rr *MX) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Preference)) + " " + sprintName(rr.Mx)
}

// AFSDB RR. See RFC 1183.
type AFSDB struct {
        Hdr      RR_Header
        Subtype  uint16
        Hostname string `dns:"domain-name"`
}

func (rr *AFSDB) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Subtype)) + " " + sprintName(rr.Hostname)
}

// X25 RR. See RFC 1183, Section 3.1.
type X25 struct {
        Hdr         RR_Header
        PSDNAddress string
}

func (rr *X25) String() string {
        return rr.Hdr.String() + rr.PSDNAddress
}

// ISDN RR. See RFC 1183, Section 3.2.
type ISDN struct {
        Hdr        RR_Header
        Address    string
        SubAddress string
}

func (rr *ISDN) String() string {
        return rr.Hdr.String() + sprintTxt([]string{rr.Address, rr.SubAddress})
}

// RT RR. See RFC 1183, Section 3.3.
type RT struct {
        Hdr        RR_Header
        Preference uint16
        Host       string `dns:"domain-name"` // RFC 3597 prohibits compressing records not defined in RFC 1035.
}

func (rr *RT) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Preference)) + " " + sprintName(rr.Host)
}

// NS RR. See RFC 1035.
type NS struct {
        Hdr RR_Header
        Ns  string `dns:"cdomain-name"`
}

func (rr *NS) String() string {
        return rr.Hdr.String() + sprintName(rr.Ns)
}

// PTR RR. See RFC 1035.
type PTR struct {
        Hdr RR_Header
        Ptr string `dns:"cdomain-name"`
}

func (rr *PTR) String() string {
        return rr.Hdr.String() + sprintName(rr.Ptr)
}

// RP RR. See RFC 1138, Section 2.2.
type RP struct {
        Hdr  RR_Header
        Mbox string `dns:"domain-name"`
        Txt  string `dns:"domain-name"`
}

func (rr *RP) String() string {
        return rr.Hdr.String() + sprintName(rr.Mbox) + " " + sprintName(rr.Txt)
}

// SOA RR. See RFC 1035.
type SOA struct {
        Hdr     RR_Header
        Ns      string `dns:"cdomain-name"`
        Mbox    string `dns:"cdomain-name"`
        Serial  uint32
        Refresh uint32
        Retry   uint32
        Expire  uint32
        Minttl  uint32
}

func (rr *SOA) String() string {
        return rr.Hdr.String() + sprintName(rr.Ns) + " " + sprintName(rr.Mbox) +
                " " + strconv.FormatInt(int64(rr.Serial), 10) +
                " " + strconv.FormatInt(int64(rr.Refresh), 10) +
                " " + strconv.FormatInt(int64(rr.Retry), 10) +
                " " + strconv.FormatInt(int64(rr.Expire), 10) +
                " " + strconv.FormatInt(int64(rr.Minttl), 10)
}

// TXT RR. See RFC 1035.
type TXT struct {
        Hdr RR_Header
        Txt []string `dns:"txt"`
}

func (rr *TXT) String() string { return rr.Hdr.String() + sprintTxt(rr.Txt) }

func sprintName(s string) string {
        var dst strings.Builder

        for i := 0; i < len(s); {
                if s[i] == '.' {
                        if dst.Len() != 0 {
                                dst.WriteByte('.')
                        }
                        i++
                        continue
                }

                b, n := nextByte(s, i)
                if n == 0 {
                        // Drop "dangling" incomplete escapes.
                        if dst.Len() == 0 {
                                return s[:i]
                        }
                        break
                }
                if isDomainNameLabelSpecial(b) {
                        if dst.Len() == 0 {
                                dst.Grow(len(s) * 2)
                                dst.WriteString(s[:i])
                        }
                        dst.WriteByte('\\')
                        dst.WriteByte(b)
                } else if b < ' ' || b > '~' { // unprintable, use \DDD
                        if dst.Len() == 0 {
                                dst.Grow(len(s) * 2)
                                dst.WriteString(s[:i])
                        }
                        dst.WriteString(escapeByte(b))
                } else {
                        if dst.Len() != 0 {
                                dst.WriteByte(b)
                        }
                }
                i += n
        }
        if dst.Len() == 0 {
                return s
        }
        return dst.String()
}

func sprintTxtOctet(s string) string {
        var dst strings.Builder
        dst.Grow(2 + len(s))
        dst.WriteByte('"')
        for i := 0; i < len(s); {
                if i+1 < len(s) && s[i] == '\\' && s[i+1] == '.' {
                        dst.WriteString(s[i : i+2])
                        i += 2
                        continue
                }

                b, n := nextByte(s, i)
                if n == 0 {
                        i++ // dangling back slash
                } else {
                        writeTXTStringByte(&dst, b)
                }
                i += n
        }
        dst.WriteByte('"')
        return dst.String()
}

func sprintTxt(txt []string) string {
        var out strings.Builder
        for i, s := range txt {
                out.Grow(3 + len(s))
                if i > 0 {
                        out.WriteString(` "`)
                } else {
                        out.WriteByte('"')
                }
                for j := 0; j < len(s); {
                        b, n := nextByte(s, j)
                        if n == 0 {
                                break
                        }
                        writeTXTStringByte(&out, b)
                        j += n
                }
                out.WriteByte('"')
        }
        return out.String()
}

func writeTXTStringByte(s *strings.Builder, b byte) {
        switch {
        case b == '"' || b == '\\':
                s.WriteByte('\\')
                s.WriteByte(b)
        case b < ' ' || b > '~':
                s.WriteString(escapeByte(b))
        default:
                s.WriteByte(b)
        }
}

const (
        escapedByteSmall = "" +
                `\000\001\002\003\004\005\006\007\008\009` +
                `\010\011\012\013\014\015\016\017\018\019` +
                `\020\021\022\023\024\025\026\027\028\029` +
                `\030\031`
        escapedByteLarge = `\127\128\129` +
                `\130\131\132\133\134\135\136\137\138\139` +
                `\140\141\142\143\144\145\146\147\148\149` +
                `\150\151\152\153\154\155\156\157\158\159` +
                `\160\161\162\163\164\165\166\167\168\169` +
                `\170\171\172\173\174\175\176\177\178\179` +
                `\180\181\182\183\184\185\186\187\188\189` +
                `\190\191\192\193\194\195\196\197\198\199` +
                `\200\201\202\203\204\205\206\207\208\209` +
                `\210\211\212\213\214\215\216\217\218\219` +
                `\220\221\222\223\224\225\226\227\228\229` +
                `\230\231\232\233\234\235\236\237\238\239` +
                `\240\241\242\243\244\245\246\247\248\249` +
                `\250\251\252\253\254\255`
)

// escapeByte returns the \DDD escaping of b which must
// satisfy b < ' ' || b > '~'.
func escapeByte(b byte) string {
        if b < ' ' {
                return escapedByteSmall[b*4 : b*4+4]
        }

        b -= '~' + 1
        // The cast here is needed as b*4 may overflow byte.
        return escapedByteLarge[int(b)*4 : int(b)*4+4]
}

// isDomainNameLabelSpecial returns true if
// a domain name label byte should be prefixed
// with an escaping backslash.
func isDomainNameLabelSpecial(b byte) bool {
        switch b {
        case '.', ' ', '\'', '@', ';', '(', ')', '"', '\\':
                return true
        }
        return false
}

func nextByte(s string, offset int) (byte, int) {
        if offset >= len(s) {
                return 0, 0
        }
        if s[offset] != '\\' {
                // not an escape sequence
                return s[offset], 1
        }
        switch len(s) - offset {
        case 1: // dangling escape
                return 0, 0
        case 2, 3: // too short to be \ddd
        default: // maybe \ddd
                if isDDD(s[offset+1:]) {
                        return dddToByte(s[offset+1:]), 4
                }
        }
        // not \ddd, just an RFC 1035 "quoted" character
        return s[offset+1], 2
}

// SPF RR. See RFC 4408, Section 3.1.1.
type SPF struct {
        Hdr RR_Header
        Txt []string `dns:"txt"`
}

func (rr *SPF) String() string { return rr.Hdr.String() + sprintTxt(rr.Txt) }

// AVC RR. See https://www.iana.org/assignments/dns-parameters/AVC/avc-completed-template.
type AVC struct {
        Hdr RR_Header
        Txt []string `dns:"txt"`
}

func (rr *AVC) String() string { return rr.Hdr.String() + sprintTxt(rr.Txt) }

// SRV RR. See RFC 2782.
type SRV struct {
        Hdr      RR_Header
        Priority uint16
        Weight   uint16
        Port     uint16
        Target   string `dns:"domain-name"`
}

func (rr *SRV) String() string {
        return rr.Hdr.String() +
                strconv.Itoa(int(rr.Priority)) + " " +
                strconv.Itoa(int(rr.Weight)) + " " +
                strconv.Itoa(int(rr.Port)) + " " + sprintName(rr.Target)
}

// NAPTR RR. See RFC 2915.
type NAPTR struct {
        Hdr         RR_Header
        Order       uint16
        Preference  uint16
        Flags       string
        Service     string
        Regexp      string
        Replacement string `dns:"domain-name"`
}

func (rr *NAPTR) String() string {
        return rr.Hdr.String() +
                strconv.Itoa(int(rr.Order)) + " " +
                strconv.Itoa(int(rr.Preference)) + " " +
                "\"" + rr.Flags + "\" " +
                "\"" + rr.Service + "\" " +
                "\"" + rr.Regexp + "\" " +
                rr.Replacement
}

// CERT RR. See RFC 4398.
type CERT struct {
        Hdr         RR_Header
        Type        uint16
        KeyTag      uint16
        Algorithm   uint8
        Certificate string `dns:"base64"`
}

func (rr *CERT) String() string {
        var (
                ok                  bool
                certtype, algorithm string
        )
        if certtype, ok = CertTypeToString[rr.Type]; !ok {
                certtype = strconv.Itoa(int(rr.Type))
        }
        if algorithm, ok = AlgorithmToString[rr.Algorithm]; !ok {
                algorithm = strconv.Itoa(int(rr.Algorithm))
        }
        return rr.Hdr.String() + certtype +
                " " + strconv.Itoa(int(rr.KeyTag)) +
                " " + algorithm +
                " " + rr.Certificate
}

// DNAME RR. See RFC 2672.
type DNAME struct {
        Hdr    RR_Header
        Target string `dns:"domain-name"`
}

func (rr *DNAME) String() string {
        return rr.Hdr.String() + sprintName(rr.Target)
}

// A RR. See RFC 1035.
type A struct {
        Hdr RR_Header
        A   net.IP `dns:"a"`
}

func (rr *A) String() string {
        if rr.A == nil {
                return rr.Hdr.String()
        }
        return rr.Hdr.String() + rr.A.String()
}

// AAAA RR. See RFC 3596.
type AAAA struct {
        Hdr  RR_Header
        AAAA net.IP `dns:"aaaa"`
}

func (rr *AAAA) String() string {
        if rr.AAAA == nil {
                return rr.Hdr.String()
        }

        if rr.AAAA.To4() != nil {
                return rr.Hdr.String() + ipv4InIPv6Prefix + rr.AAAA.String()
        }

        return rr.Hdr.String() + rr.AAAA.String()
}

// PX RR. See RFC 2163.
type PX struct {
        Hdr        RR_Header
        Preference uint16
        Map822     string `dns:"domain-name"`
        Mapx400    string `dns:"domain-name"`
}

func (rr *PX) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Preference)) + " " + sprintName(rr.Map822) + " " + sprintName(rr.Mapx400)
}

// GPOS RR. See RFC 1712.
type GPOS struct {
        Hdr       RR_Header
        Longitude string
        Latitude  string
        Altitude  string
}

func (rr *GPOS) String() string {
        return rr.Hdr.String() + rr.Longitude + " " + rr.Latitude + " " + rr.Altitude
}

// LOC RR. See RFC 1876.
type LOC struct {
        Hdr       RR_Header
        Version   uint8
        Size      uint8
        HorizPre  uint8
        VertPre   uint8
        Latitude  uint32
        Longitude uint32
        Altitude  uint32
}

// cmToM takes a cm value expressed in RFC 1876 SIZE mantissa/exponent
// format and returns a string in m (two decimals for the cm).
func cmToM(x uint8) string {
        m := x & 0xf0 >> 4
        e := x & 0x0f

        if e < 2 {
                if e == 1 {
                        m *= 10
                }

                return fmt.Sprintf("0.%02d", m)
        }

        s := fmt.Sprintf("%d", m)
        for e > 2 {
                s += "0"
                e--
        }
        return s
}

func (rr *LOC) String() string {
        s := rr.Hdr.String()

        lat := rr.Latitude
        ns := "N"
        if lat > LOC_EQUATOR {
                lat = lat - LOC_EQUATOR
        } else {
                ns = "S"
                lat = LOC_EQUATOR - lat
        }
        h := lat / LOC_DEGREES
        lat = lat % LOC_DEGREES
        m := lat / LOC_HOURS
        lat = lat % LOC_HOURS
        s += fmt.Sprintf("%02d %02d %0.3f %s ", h, m, float64(lat)/1000, ns)

        lon := rr.Longitude
        ew := "E"
        if lon > LOC_PRIMEMERIDIAN {
                lon = lon - LOC_PRIMEMERIDIAN
        } else {
                ew = "W"
                lon = LOC_PRIMEMERIDIAN - lon
        }
        h = lon / LOC_DEGREES
        lon = lon % LOC_DEGREES
        m = lon / LOC_HOURS
        lon = lon % LOC_HOURS
        s += fmt.Sprintf("%02d %02d %0.3f %s ", h, m, float64(lon)/1000, ew)

        var alt = float64(rr.Altitude) / 100
        alt -= LOC_ALTITUDEBASE
        if rr.Altitude%100 != 0 {
                s += fmt.Sprintf("%.2fm ", alt)
        } else {
                s += fmt.Sprintf("%.0fm ", alt)
        }

        s += cmToM(rr.Size) + "m "
        s += cmToM(rr.HorizPre) + "m "
        s += cmToM(rr.VertPre) + "m"
        return s
}

// SIG RR. See RFC 2535. The SIG RR is identical to RRSIG and nowadays only used for SIG(0), See RFC 2931.
type SIG struct {
        RRSIG
}

// RRSIG RR. See RFC 4034 and RFC 3755.
type RRSIG struct {
        Hdr         RR_Header
        TypeCovered uint16
        Algorithm   uint8
        Labels      uint8
        OrigTtl     uint32
        Expiration  uint32
        Inception   uint32
        KeyTag      uint16
        SignerName  string `dns:"domain-name"`
        Signature   string `dns:"base64"`
}

func (rr *RRSIG) String() string {
        s := rr.Hdr.String()
        s += Type(rr.TypeCovered).String()
        s += " " + strconv.Itoa(int(rr.Algorithm)) +
                " " + strconv.Itoa(int(rr.Labels)) +
                " " + strconv.FormatInt(int64(rr.OrigTtl), 10) +
                " " + TimeToString(rr.Expiration) +
                " " + TimeToString(rr.Inception) +
                " " + strconv.Itoa(int(rr.KeyTag)) +
                " " + sprintName(rr.SignerName) +
                " " + rr.Signature
        return s
}

// NXT RR. See RFC 2535.
type NXT struct {
        NSEC
}

// NSEC RR. See RFC 4034 and RFC 3755.
type NSEC struct {
        Hdr        RR_Header
        NextDomain string   `dns:"domain-name"`
        TypeBitMap []uint16 `dns:"nsec"`
}

func (rr *NSEC) String() string {
        s := rr.Hdr.String() + sprintName(rr.NextDomain)
        for _, t := range rr.TypeBitMap {
                s += " " + Type(t).String()
        }
        return s
}

func (rr *NSEC) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.NextDomain, off+l, compression, false)
        l += typeBitMapLen(rr.TypeBitMap)
        return l
}

// DLV RR. See RFC 4431.
type DLV struct{ DS }

// CDS RR. See RFC 7344.
type CDS struct{ DS }

// DS RR. See RFC 4034 and RFC 3658.
type DS struct {
        Hdr        RR_Header
        KeyTag     uint16
        Algorithm  uint8
        DigestType uint8
        Digest     string `dns:"hex"`
}

func (rr *DS) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.KeyTag)) +
                " " + strconv.Itoa(int(rr.Algorithm)) +
                " " + strconv.Itoa(int(rr.DigestType)) +
                " " + strings.ToUpper(rr.Digest)
}

// KX RR. See RFC 2230.
type KX struct {
        Hdr        RR_Header
        Preference uint16
        Exchanger  string `dns:"domain-name"`
}

func (rr *KX) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Preference)) +
                " " + sprintName(rr.Exchanger)
}

// TA RR. See http://www.watson.org/~weiler/INI1999-19.pdf.
type TA struct {
        Hdr        RR_Header
        KeyTag     uint16
        Algorithm  uint8
        DigestType uint8
        Digest     string `dns:"hex"`
}

func (rr *TA) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.KeyTag)) +
                " " + strconv.Itoa(int(rr.Algorithm)) +
                " " + strconv.Itoa(int(rr.DigestType)) +
                " " + strings.ToUpper(rr.Digest)
}

// TALINK RR. See https://www.iana.org/assignments/dns-parameters/TALINK/talink-completed-template.
type TALINK struct {
        Hdr          RR_Header
        PreviousName string `dns:"domain-name"`
        NextName     string `dns:"domain-name"`
}

func (rr *TALINK) String() string {
        return rr.Hdr.String() +
                sprintName(rr.PreviousName) + " " + sprintName(rr.NextName)
}

// SSHFP RR. See RFC 4255.
type SSHFP struct {
        Hdr         RR_Header
        Algorithm   uint8
        Type        uint8
        FingerPrint string `dns:"hex"`
}

func (rr *SSHFP) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Algorithm)) +
                " " + strconv.Itoa(int(rr.Type)) +
                " " + strings.ToUpper(rr.FingerPrint)
}

// KEY RR. See RFC 2535.
type KEY struct {
        DNSKEY
}

// CDNSKEY RR. See RFC 7344.
type CDNSKEY struct {
        DNSKEY
}

// DNSKEY RR. See RFC 4034 and RFC 3755.
type DNSKEY struct {
        Hdr       RR_Header
        Flags     uint16
        Protocol  uint8
        Algorithm uint8
        PublicKey string `dns:"base64"`
}

func (rr *DNSKEY) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Flags)) +
                " " + strconv.Itoa(int(rr.Protocol)) +
                " " + strconv.Itoa(int(rr.Algorithm)) +
                " " + rr.PublicKey
}

// IPSECKEY RR. See RFC 4025.
type IPSECKEY struct {
        Hdr         RR_Header
        Precedence  uint8
        GatewayType uint8
        Algorithm   uint8
        GatewayAddr net.IP `dns:"-"` // packing/unpacking/parsing/etc handled together with GatewayHost
        GatewayHost string `dns:"ipsechost"`
        PublicKey   string `dns:"base64"`
}

func (rr *IPSECKEY) String() string {
        var gateway string
        switch rr.GatewayType {
        case IPSECGatewayIPv4, IPSECGatewayIPv6:
                gateway = rr.GatewayAddr.String()
        case IPSECGatewayHost:
                gateway = rr.GatewayHost
        case IPSECGatewayNone:
                fallthrough
        default:
                gateway = "."
        }

        return rr.Hdr.String() + strconv.Itoa(int(rr.Precedence)) +
                " " + strconv.Itoa(int(rr.GatewayType)) +
                " " + strconv.Itoa(int(rr.Algorithm)) +
                " " + gateway +
                " " + rr.PublicKey
}

// AMTRELAY RR. See RFC 8777.
type AMTRELAY struct {
        Hdr         RR_Header
        Precedence  uint8
        GatewayType uint8  // discovery is packed in here at bit 0x80
        GatewayAddr net.IP `dns:"-"` // packing/unpacking/parsing/etc handled together with GatewayHost
        GatewayHost string `dns:"amtrelayhost"`
}

func (rr *AMTRELAY) String() string {
        var gateway string
        switch rr.GatewayType & 0x7f {
        case AMTRELAYIPv4, AMTRELAYIPv6:
                gateway = rr.GatewayAddr.String()
        case AMTRELAYHost:
                gateway = rr.GatewayHost
        case AMTRELAYNone:
                fallthrough
        default:
                gateway = "."
        }
        boolS := "0"
        if rr.GatewayType&0x80 == 0x80 {
                boolS = "1"
        }

        return rr.Hdr.String() + strconv.Itoa(int(rr.Precedence)) +
                " " + boolS +
                " " + strconv.Itoa(int(rr.GatewayType&0x7f)) +
                " " + gateway
}

// RKEY RR. See https://www.iana.org/assignments/dns-parameters/RKEY/rkey-completed-template.
type RKEY struct {
        Hdr       RR_Header
        Flags     uint16
        Protocol  uint8
        Algorithm uint8
        PublicKey string `dns:"base64"`
}

func (rr *RKEY) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Flags)) +
                " " + strconv.Itoa(int(rr.Protocol)) +
                " " + strconv.Itoa(int(rr.Algorithm)) +
                " " + rr.PublicKey
}

// NSAPPTR RR. See RFC 1348.
type NSAPPTR struct {
        Hdr RR_Header
        Ptr string `dns:"domain-name"`
}

func (rr *NSAPPTR) String() string { return rr.Hdr.String() + sprintName(rr.Ptr) }

// NSEC3 RR. See RFC 5155.
type NSEC3 struct {
        Hdr        RR_Header
        Hash       uint8
        Flags      uint8
        Iterations uint16
        SaltLength uint8
        Salt       string `dns:"size-hex:SaltLength"`
        HashLength uint8
        NextDomain string   `dns:"size-base32:HashLength"`
        TypeBitMap []uint16 `dns:"nsec"`
}

func (rr *NSEC3) String() string {
        s := rr.Hdr.String()
        s += strconv.Itoa(int(rr.Hash)) +
                " " + strconv.Itoa(int(rr.Flags)) +
                " " + strconv.Itoa(int(rr.Iterations)) +
                " " + saltToString(rr.Salt) +
                " " + rr.NextDomain
        for _, t := range rr.TypeBitMap {
                s += " " + Type(t).String()
        }
        return s
}

func (rr *NSEC3) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 6 + len(rr.Salt)/2 + 1 + len(rr.NextDomain) + 1
        l += typeBitMapLen(rr.TypeBitMap)
        return l
}

// NSEC3PARAM RR. See RFC 5155.
type NSEC3PARAM struct {
        Hdr        RR_Header
        Hash       uint8
        Flags      uint8
        Iterations uint16
        SaltLength uint8
        Salt       string `dns:"size-hex:SaltLength"`
}

func (rr *NSEC3PARAM) String() string {
        s := rr.Hdr.String()
        s += strconv.Itoa(int(rr.Hash)) +
                " " + strconv.Itoa(int(rr.Flags)) +
                " " + strconv.Itoa(int(rr.Iterations)) +
                " " + saltToString(rr.Salt)
        return s
}

// TKEY RR. See RFC 2930.
type TKEY struct {
        Hdr        RR_Header
        Algorithm  string `dns:"domain-name"`
        Inception  uint32
        Expiration uint32
        Mode       uint16
        Error      uint16
        KeySize    uint16
        Key        string `dns:"size-hex:KeySize"`
        OtherLen   uint16
        OtherData  string `dns:"size-hex:OtherLen"`
}

// TKEY has no official presentation format, but this will suffice.
func (rr *TKEY) String() string {
        s := ";" + rr.Hdr.String() +
                " " + rr.Algorithm +
                " " + TimeToString(rr.Inception) +
                " " + TimeToString(rr.Expiration) +
                " " + strconv.Itoa(int(rr.Mode)) +
                " " + strconv.Itoa(int(rr.Error)) +
                " " + strconv.Itoa(int(rr.KeySize)) +
                " " + rr.Key +
                " " + strconv.Itoa(int(rr.OtherLen)) +
                " " + rr.OtherData
        return s
}

// RFC3597 represents an unknown/generic RR. See RFC 3597.
type RFC3597 struct {
        Hdr   RR_Header
        Rdata string `dns:"hex"`
}

func (rr *RFC3597) String() string {
        // Let's call it a hack
        s := rfc3597Header(rr.Hdr)

        s += "\\# " + strconv.Itoa(len(rr.Rdata)/2) + " " + rr.Rdata
        return s
}

func rfc3597Header(h RR_Header) string {
        var s string

        s += sprintName(h.Name) + "\t"
        s += strconv.FormatInt(int64(h.Ttl), 10) + "\t"
        s += "CLASS" + strconv.Itoa(int(h.Class)) + "\t"
        s += "TYPE" + strconv.Itoa(int(h.Rrtype)) + "\t"
        return s
}

// URI RR. See RFC 7553.
type URI struct {
        Hdr      RR_Header
        Priority uint16
        Weight   uint16
        Target   string `dns:"octet"`
}

// rr.Target to be parsed as a sequence of character encoded octets according to RFC 3986
func (rr *URI) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Priority)) +
                " " + strconv.Itoa(int(rr.Weight)) + " " + sprintTxtOctet(rr.Target)
}

// DHCID RR. See RFC 4701.
type DHCID struct {
        Hdr    RR_Header
        Digest string `dns:"base64"`
}

func (rr *DHCID) String() string { return rr.Hdr.String() + rr.Digest }

// TLSA RR. See RFC 6698.
type TLSA struct {
        Hdr          RR_Header
        Usage        uint8
        Selector     uint8
        MatchingType uint8
        Certificate  string `dns:"hex"`
}

func (rr *TLSA) String() string {
        return rr.Hdr.String() +
                strconv.Itoa(int(rr.Usage)) +
                " " + strconv.Itoa(int(rr.Selector)) +
                " " + strconv.Itoa(int(rr.MatchingType)) +
                " " + rr.Certificate
}

// SMIMEA RR. See RFC 8162.
type SMIMEA struct {
        Hdr          RR_Header
        Usage        uint8
        Selector     uint8
        MatchingType uint8
        Certificate  string `dns:"hex"`
}

func (rr *SMIMEA) String() string {
        s := rr.Hdr.String() +
                strconv.Itoa(int(rr.Usage)) +
                " " + strconv.Itoa(int(rr.Selector)) +
                " " + strconv.Itoa(int(rr.MatchingType))

        // Every Nth char needs a space on this output. If we output
        // this as one giant line, we can't read it can in because in some cases
        // the cert length overflows scan.maxTok (2048).
        sx := splitN(rr.Certificate, 1024) // conservative value here
        s += " " + strings.Join(sx, " ")
        return s
}

// HIP RR. See RFC 8005.
type HIP struct {
        Hdr                RR_Header
        HitLength          uint8
        PublicKeyAlgorithm uint8
        PublicKeyLength    uint16
        Hit                string   `dns:"size-hex:HitLength"`
        PublicKey          string   `dns:"size-base64:PublicKeyLength"`
        RendezvousServers  []string `dns:"domain-name"`
}

func (rr *HIP) String() string {
        s := rr.Hdr.String() +
                strconv.Itoa(int(rr.PublicKeyAlgorithm)) +
                " " + rr.Hit +
                " " + rr.PublicKey
        for _, d := range rr.RendezvousServers {
                s += " " + sprintName(d)
        }
        return s
}

// NINFO RR. See https://www.iana.org/assignments/dns-parameters/NINFO/ninfo-completed-template.
type NINFO struct {
        Hdr    RR_Header
        ZSData []string `dns:"txt"`
}

func (rr *NINFO) String() string { return rr.Hdr.String() + sprintTxt(rr.ZSData) }

// NID RR. See RFC 6742.
type NID struct {
        Hdr        RR_Header
        Preference uint16
        NodeID     uint64
}

func (rr *NID) String() string {
        s := rr.Hdr.String() + strconv.Itoa(int(rr.Preference))
        node := fmt.Sprintf("%0.16x", rr.NodeID)
        s += " " + node[0:4] + ":" + node[4:8] + ":" + node[8:12] + ":" + node[12:16]
        return s
}

// L32 RR, See RFC 6742.
type L32 struct {
        Hdr        RR_Header
        Preference uint16
        Locator32  net.IP `dns:"a"`
}

func (rr *L32) String() string {
        if rr.Locator32 == nil {
                return rr.Hdr.String() + strconv.Itoa(int(rr.Preference))
        }
        return rr.Hdr.String() + strconv.Itoa(int(rr.Preference)) +
                " " + rr.Locator32.String()
}

// L64 RR, See RFC 6742.
type L64 struct {
        Hdr        RR_Header
        Preference uint16
        Locator64  uint64
}

func (rr *L64) String() string {
        s := rr.Hdr.String() + strconv.Itoa(int(rr.Preference))
        node := fmt.Sprintf("%0.16X", rr.Locator64)
        s += " " + node[0:4] + ":" + node[4:8] + ":" + node[8:12] + ":" + node[12:16]
        return s
}

// LP RR. See RFC 6742.
type LP struct {
        Hdr        RR_Header
        Preference uint16
        Fqdn       string `dns:"domain-name"`
}

func (rr *LP) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Preference)) + " " + sprintName(rr.Fqdn)
}

// EUI48 RR. See RFC 7043.
type EUI48 struct {
        Hdr     RR_Header
        Address uint64 `dns:"uint48"`
}

func (rr *EUI48) String() string { return rr.Hdr.String() + euiToString(rr.Address, 48) }

// EUI64 RR. See RFC 7043.
type EUI64 struct {
        Hdr     RR_Header
        Address uint64
}

func (rr *EUI64) String() string { return rr.Hdr.String() + euiToString(rr.Address, 64) }

// CAA RR. See RFC 6844.
type CAA struct {
        Hdr   RR_Header
        Flag  uint8
        Tag   string
        Value string `dns:"octet"`
}

// rr.Value Is the character-string encoding of the value field as specified in RFC 1035, Section 5.1.
func (rr *CAA) String() string {
        return rr.Hdr.String() + strconv.Itoa(int(rr.Flag)) + " " + rr.Tag + " " + sprintTxtOctet(rr.Value)
}

// UID RR. Deprecated, IANA-Reserved.
type UID struct {
        Hdr RR_Header
        Uid uint32
}

func (rr *UID) String() string { return rr.Hdr.String() + strconv.FormatInt(int64(rr.Uid), 10) }

// GID RR. Deprecated, IANA-Reserved.
type GID struct {
        Hdr RR_Header
        Gid uint32
}

func (rr *GID) String() string { return rr.Hdr.String() + strconv.FormatInt(int64(rr.Gid), 10) }

// UINFO RR. Deprecated, IANA-Reserved.
type UINFO struct {
        Hdr   RR_Header
        Uinfo string
}

func (rr *UINFO) String() string { return rr.Hdr.String() + sprintTxt([]string{rr.Uinfo}) }

// EID RR. See http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt.
type EID struct {
        Hdr      RR_Header
        Endpoint string `dns:"hex"`
}

func (rr *EID) String() string { return rr.Hdr.String() + strings.ToUpper(rr.Endpoint) }

// NIMLOC RR. See http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt.
type NIMLOC struct {
        Hdr     RR_Header
        Locator string `dns:"hex"`
}

func (rr *NIMLOC) String() string { return rr.Hdr.String() + strings.ToUpper(rr.Locator) }

// OPENPGPKEY RR. See RFC 7929.
type OPENPGPKEY struct {
        Hdr       RR_Header
        PublicKey string `dns:"base64"`
}

func (rr *OPENPGPKEY) String() string { return rr.Hdr.String() + rr.PublicKey }

// CSYNC RR. See RFC 7477.
type CSYNC struct {
        Hdr        RR_Header
        Serial     uint32
        Flags      uint16
        TypeBitMap []uint16 `dns:"nsec"`
}

func (rr *CSYNC) String() string {
        s := rr.Hdr.String() + strconv.FormatInt(int64(rr.Serial), 10) + " " + strconv.Itoa(int(rr.Flags))

        for _, t := range rr.TypeBitMap {
                s += " " + Type(t).String()
        }
        return s
}

func (rr *CSYNC) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 4 + 2
        l += typeBitMapLen(rr.TypeBitMap)
        return l
}

// ZONEMD RR, from draft-ietf-dnsop-dns-zone-digest
type ZONEMD struct {
        Hdr    RR_Header
        Serial uint32
        Scheme uint8
        Hash   uint8
        Digest string `dns:"hex"`
}

func (rr *ZONEMD) String() string {
        return rr.Hdr.String() +
                strconv.Itoa(int(rr.Serial)) +
                " " + strconv.Itoa(int(rr.Scheme)) +
                " " + strconv.Itoa(int(rr.Hash)) +
                " " + rr.Digest
}

// APL RR. See RFC 3123.
type APL struct {
        Hdr      RR_Header
        Prefixes []APLPrefix `dns:"apl"`
}

// APLPrefix is an address prefix hold by an APL record.
type APLPrefix struct {
        Negation bool
        Network  net.IPNet
}

// String returns presentation form of the APL record.
func (rr *APL) String() string {
        var sb strings.Builder
        sb.WriteString(rr.Hdr.String())
        for i, p := range rr.Prefixes {
                if i > 0 {
                        sb.WriteByte(' ')
                }
                sb.WriteString(p.str())
        }
        return sb.String()
}

// str returns presentation form of the APL prefix.
func (a *APLPrefix) str() string {
        var sb strings.Builder
        if a.Negation {
                sb.WriteByte('!')
        }

        switch len(a.Network.IP) {
        case net.IPv4len:
                sb.WriteByte('1')
        case net.IPv6len:
                sb.WriteByte('2')
        }

        sb.WriteByte(':')

        switch len(a.Network.IP) {
        case net.IPv4len:
                sb.WriteString(a.Network.IP.String())
        case net.IPv6len:
                // add prefix for IPv4-mapped IPv6
                if v4 := a.Network.IP.To4(); v4 != nil {
                        sb.WriteString(ipv4InIPv6Prefix)
                }
                sb.WriteString(a.Network.IP.String())
        }

        sb.WriteByte('/')

        prefix, _ := a.Network.Mask.Size()
        sb.WriteString(strconv.Itoa(prefix))

        return sb.String()
}

// equals reports whether two APL prefixes are identical.
func (a *APLPrefix) equals(b *APLPrefix) bool {
        return a.Negation == b.Negation &&
                a.Network.IP.Equal(b.Network.IP) &&
                bytes.Equal(a.Network.Mask, b.Network.Mask)
}

// copy returns a copy of the APL prefix.
func (a *APLPrefix) copy() APLPrefix {
        return APLPrefix{
                Negation: a.Negation,
                Network:  copyNet(a.Network),
        }
}

// len returns size of the prefix in wire format.
func (a *APLPrefix) len() int {
        // 4-byte header and the network address prefix (see Section 4 of RFC 3123)
        prefix, _ := a.Network.Mask.Size()
        return 4 + (prefix+7)/8
}

// TimeToString translates the RRSIG's incep. and expir. times to the
// string representation used when printing the record.
// It takes serial arithmetic (RFC 1982) into account.
func TimeToString(t uint32) string {
        mod := (int64(t)-time.Now().Unix())/year68 - 1
        if mod < 0 {
                mod = 0
        }
        ti := time.Unix(int64(t)-mod*year68, 0).UTC()
        return ti.Format("20060102150405")
}

// StringToTime translates the RRSIG's incep. and expir. times from
// string values like "20110403154150" to an 32 bit integer.
// It takes serial arithmetic (RFC 1982) into account.
func StringToTime(s string) (uint32, error) {
        t, err := time.Parse("20060102150405", s)
        if err != nil {
                return 0, err
        }
        mod := t.Unix()/year68 - 1
        if mod < 0 {
                mod = 0
        }
        return uint32(t.Unix() - mod*year68), nil
}

// saltToString converts a NSECX salt to uppercase and returns "-" when it is empty.
func saltToString(s string) string {
        if s == "" {
                return "-"
        }
        return strings.ToUpper(s)
}

func euiToString(eui uint64, bits int) (hex string) {
        switch bits {
        case 64:
                hex = fmt.Sprintf("%16.16x", eui)
                hex = hex[0:2] + "-" + hex[2:4] + "-" + hex[4:6] + "-" + hex[6:8] +
                        "-" + hex[8:10] + "-" + hex[10:12] + "-" + hex[12:14] + "-" + hex[14:16]
        case 48:
                hex = fmt.Sprintf("%12.12x", eui)
                hex = hex[0:2] + "-" + hex[2:4] + "-" + hex[4:6] + "-" + hex[6:8] +
                        "-" + hex[8:10] + "-" + hex[10:12]
        }
        return
}

// cloneSlice returns a shallow copy of s.
func cloneSlice[E any, S ~[]E](s S) S {
        if s == nil {
                return nil
        }
        return append(S(nil), s...)
}

// copyNet returns a copy of a subnet.
func copyNet(n net.IPNet) net.IPNet {
        return net.IPNet{
                IP:   cloneSlice(n.IP),
                Mask: cloneSlice(n.Mask),
        }
}

// SplitN splits a string into N sized string chunks.
// This might become an exported function once.
func splitN(s string, n int) []string {
        if len(s) < n {
                return []string{s}
        }
        sx := []string{}
        p, i := 0, n
        for {
                if i <= len(s) {
                        sx = append(sx, s[p:i])
                } else {
                        sx = append(sx, s[p:])
                        break

                }
                p, i = p+n, i+n
        }

        return sx
}

//go:build !windows
// +build !windows

package dns

import (
        "net"

        "golang.org/x/net/ipv4"
        "golang.org/x/net/ipv6"
)

// This is the required size of the OOB buffer to pass to ReadMsgUDP.
var udpOOBSize = func() int {
        // We can't know whether we'll get an IPv4 control message or an
        // IPv6 control message ahead of time. To get around this, we size
        // the buffer equal to the largest of the two.

        oob4 := ipv4.NewControlMessage(ipv4.FlagDst | ipv4.FlagInterface)
        oob6 := ipv6.NewControlMessage(ipv6.FlagDst | ipv6.FlagInterface)

        if len(oob4) > len(oob6) {
                return len(oob4)
        }

        return len(oob6)
}()

// SessionUDP holds the remote address and the associated
// out-of-band data.
type SessionUDP struct {
        raddr   *net.UDPAddr
        context []byte
}

// RemoteAddr returns the remote network address.
func (s *SessionUDP) RemoteAddr() net.Addr { return s.raddr }

// ReadFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
// net.UDPAddr.
func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
        oob := make([]byte, udpOOBSize)
        n, oobn, _, raddr, err := conn.ReadMsgUDP(b, oob)
        if err != nil {
                return n, nil, err
        }
        return n, &SessionUDP{raddr, oob[:oobn]}, err
}

// WriteToSessionUDP acts just like net.UDPConn.WriteTo(), but uses a *SessionUDP instead of a net.Addr.
func WriteToSessionUDP(conn *net.UDPConn, b []byte, session *SessionUDP) (int, error) {
        oob := correctSource(session.context)
        n, _, err := conn.WriteMsgUDP(b, oob, session.raddr)
        return n, err
}

func setUDPSocketOptions(conn *net.UDPConn) error {
        // Try setting the flags for both families and ignore the errors unless they
        // both error.
        err6 := ipv6.NewPacketConn(conn).SetControlMessage(ipv6.FlagDst|ipv6.FlagInterface, true)
        err4 := ipv4.NewPacketConn(conn).SetControlMessage(ipv4.FlagDst|ipv4.FlagInterface, true)
        if err6 != nil && err4 != nil {
                return err4
        }
        return nil
}

// parseDstFromOOB takes oob data and returns the destination IP.
func parseDstFromOOB(oob []byte) net.IP {
        // Start with IPv6 and then fallback to IPv4
        // TODO(fastest963): Figure out a way to prefer one or the other. Looking at
        // the lvl of the header for a 0 or 41 isn't cross-platform.
        cm6 := new(ipv6.ControlMessage)
        if cm6.Parse(oob) == nil && cm6.Dst != nil {
                return cm6.Dst
        }
        cm4 := new(ipv4.ControlMessage)
        if cm4.Parse(oob) == nil && cm4.Dst != nil {
                return cm4.Dst
        }
        return nil
}

// correctSource takes oob data and returns new oob data with the Src equal to the Dst
func correctSource(oob []byte) []byte {
        dst := parseDstFromOOB(oob)
        if dst == nil {
                return nil
        }
        // If the dst is definitely an IPv6, then use ipv6's ControlMessage to
        // respond otherwise use ipv4's because ipv6's marshal ignores ipv4
        // addresses.
        if dst.To4() == nil {
                cm := new(ipv6.ControlMessage)
                cm.Src = dst
                oob = cm.Marshal()
        } else {
                cm := new(ipv4.ControlMessage)
                cm.Src = dst
                oob = cm.Marshal()
        }
        return oob
}

package dns

// NameUsed sets the RRs in the prereq section to
// "Name is in use" RRs. RFC 2136 section 2.4.4.
func (u *Msg) NameUsed(rr []RR) {
        if u.Answer == nil {
                u.Answer = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassANY}})
        }
}

// NameNotUsed sets the RRs in the prereq section to
// "Name is in not use" RRs. RFC 2136 section 2.4.5.
func (u *Msg) NameNotUsed(rr []RR) {
        if u.Answer == nil {
                u.Answer = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassNONE}})
        }
}

// Used sets the RRs in the prereq section to
// "RRset exists (value dependent -- with rdata)" RRs. RFC 2136 section 2.4.2.
func (u *Msg) Used(rr []RR) {
        if len(u.Question) == 0 {
                panic("dns: empty question section")
        }
        if u.Answer == nil {
                u.Answer = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                hdr := r.Header()
                hdr.Class = u.Question[0].Qclass
                hdr.Ttl = 0
                u.Answer = append(u.Answer, r)
        }
}

// RRsetUsed sets the RRs in the prereq section to
// "RRset exists (value independent -- no rdata)" RRs. RFC 2136 section 2.4.1.
func (u *Msg) RRsetUsed(rr []RR) {
        if u.Answer == nil {
                u.Answer = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                h := r.Header()
                u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: h.Name, Ttl: 0, Rrtype: h.Rrtype, Class: ClassANY}})
        }
}

// RRsetNotUsed sets the RRs in the prereq section to
// "RRset does not exist" RRs. RFC 2136 section 2.4.3.
func (u *Msg) RRsetNotUsed(rr []RR) {
        if u.Answer == nil {
                u.Answer = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                h := r.Header()
                u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: h.Name, Ttl: 0, Rrtype: h.Rrtype, Class: ClassNONE}})
        }
}

// Insert creates a dynamic update packet that adds an complete RRset, see RFC 2136 section 2.5.1.
func (u *Msg) Insert(rr []RR) {
        if len(u.Question) == 0 {
                panic("dns: empty question section")
        }
        if u.Ns == nil {
                u.Ns = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                r.Header().Class = u.Question[0].Qclass
                u.Ns = append(u.Ns, r)
        }
}

// RemoveRRset creates a dynamic update packet that deletes an RRset, see RFC 2136 section 2.5.2.
func (u *Msg) RemoveRRset(rr []RR) {
        if u.Ns == nil {
                u.Ns = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                h := r.Header()
                u.Ns = append(u.Ns, &ANY{Hdr: RR_Header{Name: h.Name, Ttl: 0, Rrtype: h.Rrtype, Class: ClassANY}})
        }
}

// RemoveName creates a dynamic update packet that deletes all RRsets of a name, see RFC 2136 section 2.5.3
func (u *Msg) RemoveName(rr []RR) {
        if u.Ns == nil {
                u.Ns = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                u.Ns = append(u.Ns, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassANY}})
        }
}

// Remove creates a dynamic update packet deletes RR from a RRSset, see RFC 2136 section 2.5.4
func (u *Msg) Remove(rr []RR) {
        if u.Ns == nil {
                u.Ns = make([]RR, 0, len(rr))
        }
        for _, r := range rr {
                h := r.Header()
                h.Class = ClassNONE
                h.Ttl = 0
                u.Ns = append(u.Ns, r)
        }
}

package dns

import "fmt"

// Version is current version of this library.
var Version = v{1, 1, 62}

// v holds the version of this library.
type v struct {
        Major, Minor, Patch int
}

func (v v) String() string {
        return fmt.Sprintf("%d.%d.%d", v.Major, v.Minor, v.Patch)
}

package dns

import (
        "crypto/tls"
        "fmt"
        "time"
)

// Envelope is used when doing a zone transfer with a remote server.
type Envelope struct {
        RR    []RR  // The set of RRs in the answer section of the xfr reply message.
        Error error // If something went wrong, this contains the error.
}

// A Transfer defines parameters that are used during a zone transfer.
type Transfer struct {
        *Conn
        DialTimeout    time.Duration     // net.DialTimeout, defaults to 2 seconds
        ReadTimeout    time.Duration     // net.Conn.SetReadTimeout value for connections, defaults to 2 seconds
        WriteTimeout   time.Duration     // net.Conn.SetWriteTimeout value for connections, defaults to 2 seconds
        TsigProvider   TsigProvider      // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.
        TsigSecret     map[string]string // Secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
        tsigTimersOnly bool
        TLS            *tls.Config // TLS config. If Xfr over TLS will be attempted
}

func (t *Transfer) tsigProvider() TsigProvider {
        if t.TsigProvider != nil {
                return t.TsigProvider
        }
        if t.TsigSecret != nil {
                return tsigSecretProvider(t.TsigSecret)
        }
        return nil
}

// TODO: Think we need to away to stop the transfer

// In performs an incoming transfer with the server in a.
// If you would like to set the source IP, or some other attribute
// of a Dialer for a Transfer, you can do so by specifying the attributes
// in the Transfer.Conn:
//
//        d := net.Dialer{LocalAddr: transfer_source}
//        con, err := d.Dial("tcp", master)
//        dnscon := &dns.Conn{Conn:con}
//        transfer = &dns.Transfer{Conn: dnscon}
//        channel, err := transfer.In(message, master)
func (t *Transfer) In(q *Msg, a string) (env chan *Envelope, err error) {
        switch q.Question[0].Qtype {
        case TypeAXFR, TypeIXFR:
        default:
                return nil, &Error{"unsupported question type"}
        }

        timeout := dnsTimeout
        if t.DialTimeout != 0 {
                timeout = t.DialTimeout
        }

        if t.Conn == nil {
                if t.TLS != nil {
                        t.Conn, err = DialTimeoutWithTLS("tcp-tls", a, t.TLS, timeout)
                } else {
                        t.Conn, err = DialTimeout("tcp", a, timeout)
                }
                if err != nil {
                        return nil, err
                }
        }

        if err := t.WriteMsg(q); err != nil {
                return nil, err
        }

        env = make(chan *Envelope)
        switch q.Question[0].Qtype {
        case TypeAXFR:
                go t.inAxfr(q, env)
        case TypeIXFR:
                go t.inIxfr(q, env)
        }

        return env, nil
}

func (t *Transfer) inAxfr(q *Msg, c chan *Envelope) {
        first := true
        defer func() {
                // First close the connection, then the channel. This allows functions blocked on
                // the channel to assume that the connection is closed and no further operations are
                // pending when they resume.
                t.Close()
                close(c)
        }()
        timeout := dnsTimeout
        if t.ReadTimeout != 0 {
                timeout = t.ReadTimeout
        }
        for {
                t.Conn.SetReadDeadline(time.Now().Add(timeout))
                in, err := t.ReadMsg()
                if err != nil {
                        c <- &Envelope{nil, err}
                        return
                }
                if q.Id != in.Id {
                        c <- &Envelope{in.Answer, ErrId}
                        return
                }
                if first {
                        if in.Rcode != RcodeSuccess {
                                c <- &Envelope{in.Answer, &Error{err: fmt.Sprintf(errXFR, in.Rcode)}}
                                return
                        }
                        if !isSOAFirst(in) {
                                c <- &Envelope{in.Answer, ErrSoa}
                                return
                        }
                        first = !first
                        // only one answer that is SOA, receive more
                        if len(in.Answer) == 1 {
                                t.tsigTimersOnly = true
                                c <- &Envelope{in.Answer, nil}
                                continue
                        }
                }

                if !first {
                        t.tsigTimersOnly = true // Subsequent envelopes use this.
                        if isSOALast(in) {
                                c <- &Envelope{in.Answer, nil}
                                return
                        }
                        c <- &Envelope{in.Answer, nil}
                }
        }
}

func (t *Transfer) inIxfr(q *Msg, c chan *Envelope) {
        var serial uint32 // The first serial seen is the current server serial
        axfr := true
        n := 0
        qser := q.Ns[0].(*SOA).Serial
        defer func() {
                // First close the connection, then the channel. This allows functions blocked on
                // the channel to assume that the connection is closed and no further operations are
                // pending when they resume.
                t.Close()
                close(c)
        }()
        timeout := dnsTimeout
        if t.ReadTimeout != 0 {
                timeout = t.ReadTimeout
        }
        for {
                t.SetReadDeadline(time.Now().Add(timeout))
                in, err := t.ReadMsg()
                if err != nil {
                        c <- &Envelope{nil, err}
                        return
                }
                if q.Id != in.Id {
                        c <- &Envelope{in.Answer, ErrId}
                        return
                }
                if in.Rcode != RcodeSuccess {
                        c <- &Envelope{in.Answer, &Error{err: fmt.Sprintf(errXFR, in.Rcode)}}
                        return
                }
                if n == 0 {
                        // Check if the returned answer is ok
                        if !isSOAFirst(in) {
                                c <- &Envelope{in.Answer, ErrSoa}
                                return
                        }
                        // This serial is important
                        serial = in.Answer[0].(*SOA).Serial
                        // Check if there are no changes in zone
                        if qser >= serial {
                                c <- &Envelope{in.Answer, nil}
                                return
                        }
                }
                // Now we need to check each message for SOA records, to see what we need to do
                t.tsigTimersOnly = true
                for _, rr := range in.Answer {
                        if v, ok := rr.(*SOA); ok {
                                if v.Serial == serial {
                                        n++
                                        // quit if it's a full axfr or the servers' SOA is repeated the third time
                                        if axfr && n == 2 || n == 3 {
                                                c <- &Envelope{in.Answer, nil}
                                                return
                                        }
                                } else if axfr {
                                        // it's an ixfr
                                        axfr = false
                                }
                        }
                }
                c <- &Envelope{in.Answer, nil}
        }
}

// Out performs an outgoing transfer with the client connecting in w.
// Basic use pattern:
//
//        ch := make(chan *dns.Envelope)
//        tr := new(dns.Transfer)
//        var wg sync.WaitGroup
//        wg.Add(1)
//        go func() {
//                tr.Out(w, r, ch)
//                wg.Done()
//        }()
//        ch <- &dns.Envelope{RR: []dns.RR{soa, rr1, rr2, rr3, soa}}
//        close(ch)
//        wg.Wait() // wait until everything is written out
//        w.Close() // close connection
//
// The server is responsible for sending the correct sequence of RRs through the channel ch.
func (t *Transfer) Out(w ResponseWriter, q *Msg, ch chan *Envelope) error {
        for x := range ch {
                r := new(Msg)
                // Compress?
                r.SetReply(q)
                r.Authoritative = true
                // assume it fits TODO(miek): fix
                r.Answer = append(r.Answer, x.RR...)
                if tsig := q.IsTsig(); tsig != nil && w.TsigStatus() == nil {
                        r.SetTsig(tsig.Hdr.Name, tsig.Algorithm, tsig.Fudge, time.Now().Unix())
                }
                if err := w.WriteMsg(r); err != nil {
                        return err
                }
                w.TsigTimersOnly(true)
        }
        return nil
}

// ReadMsg reads a message from the transfer connection t.
func (t *Transfer) ReadMsg() (*Msg, error) {
        m := new(Msg)
        p := make([]byte, MaxMsgSize)
        n, err := t.Read(p)
        if err != nil && n == 0 {
                return nil, err
        }
        p = p[:n]
        if err := m.Unpack(p); err != nil {
                return nil, err
        }
        if ts, tp := m.IsTsig(), t.tsigProvider(); ts != nil && tp != nil {
                // Need to work on the original message p, as that was used to calculate the tsig.
                err = TsigVerifyWithProvider(p, tp, t.tsigRequestMAC, t.tsigTimersOnly)
                t.tsigRequestMAC = ts.MAC
        }
        return m, err
}

// WriteMsg writes a message through the transfer connection t.
func (t *Transfer) WriteMsg(m *Msg) (err error) {
        var out []byte
        if ts, tp := m.IsTsig(), t.tsigProvider(); ts != nil && tp != nil {
                out, t.tsigRequestMAC, err = TsigGenerateWithProvider(m, tp, t.tsigRequestMAC, t.tsigTimersOnly)
        } else {
                out, err = m.Pack()
        }
        if err != nil {
                return err
        }
        _, err = t.Write(out)
        return err
}

func isSOAFirst(in *Msg) bool {
        return len(in.Answer) > 0 &&
                in.Answer[0].Header().Rrtype == TypeSOA
}

func isSOALast(in *Msg) bool {
        return len(in.Answer) > 0 &&
                in.Answer[len(in.Answer)-1].Header().Rrtype == TypeSOA
}

const errXFR = "bad xfr rcode: %d"

// Code generated by "go run duplicate_generate.go"; DO NOT EDIT.

package dns

// isDuplicate() functions

func (r1 *A) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*A)
        if !ok {
                return false
        }
        _ = r2
        if !r1.A.Equal(r2.A) {
                return false
        }
        return true
}

func (r1 *AAAA) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*AAAA)
        if !ok {
                return false
        }
        _ = r2
        if !r1.AAAA.Equal(r2.AAAA) {
                return false
        }
        return true
}

func (r1 *AFSDB) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*AFSDB)
        if !ok {
                return false
        }
        _ = r2
        if r1.Subtype != r2.Subtype {
                return false
        }
        if !isDuplicateName(r1.Hostname, r2.Hostname) {
                return false
        }
        return true
}

func (r1 *AMTRELAY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*AMTRELAY)
        if !ok {
                return false
        }
        _ = r2
        if r1.Precedence != r2.Precedence {
                return false
        }
        if r1.GatewayType != r2.GatewayType {
                return false
        }
        switch r1.GatewayType {
        case IPSECGatewayIPv4, IPSECGatewayIPv6:
                if !r1.GatewayAddr.Equal(r2.GatewayAddr) {
                        return false
                }
        case IPSECGatewayHost:
                if !isDuplicateName(r1.GatewayHost, r2.GatewayHost) {
                        return false
                }
        }

        return true
}

func (r1 *ANY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*ANY)
        if !ok {
                return false
        }
        _ = r2
        return true
}

func (r1 *APL) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*APL)
        if !ok {
                return false
        }
        _ = r2
        if len(r1.Prefixes) != len(r2.Prefixes) {
                return false
        }
        for i := 0; i < len(r1.Prefixes); i++ {
                if !r1.Prefixes[i].equals(&r2.Prefixes[i]) {
                        return false
                }
        }
        return true
}

func (r1 *AVC) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*AVC)
        if !ok {
                return false
        }
        _ = r2
        if len(r1.Txt) != len(r2.Txt) {
                return false
        }
        for i := 0; i < len(r1.Txt); i++ {
                if r1.Txt[i] != r2.Txt[i] {
                        return false
                }
        }
        return true
}

func (r1 *CAA) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*CAA)
        if !ok {
                return false
        }
        _ = r2
        if r1.Flag != r2.Flag {
                return false
        }
        if r1.Tag != r2.Tag {
                return false
        }
        if r1.Value != r2.Value {
                return false
        }
        return true
}

func (r1 *CDNSKEY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*CDNSKEY)
        if !ok {
                return false
        }
        _ = r2
        if r1.Flags != r2.Flags {
                return false
        }
        if r1.Protocol != r2.Protocol {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.PublicKey != r2.PublicKey {
                return false
        }
        return true
}

func (r1 *CDS) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*CDS)
        if !ok {
                return false
        }
        _ = r2
        if r1.KeyTag != r2.KeyTag {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.DigestType != r2.DigestType {
                return false
        }
        if r1.Digest != r2.Digest {
                return false
        }
        return true
}

func (r1 *CERT) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*CERT)
        if !ok {
                return false
        }
        _ = r2
        if r1.Type != r2.Type {
                return false
        }
        if r1.KeyTag != r2.KeyTag {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.Certificate != r2.Certificate {
                return false
        }
        return true
}

func (r1 *CNAME) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*CNAME)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Target, r2.Target) {
                return false
        }
        return true
}

func (r1 *CSYNC) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*CSYNC)
        if !ok {
                return false
        }
        _ = r2
        if r1.Serial != r2.Serial {
                return false
        }
        if r1.Flags != r2.Flags {
                return false
        }
        if len(r1.TypeBitMap) != len(r2.TypeBitMap) {
                return false
        }
        for i := 0; i < len(r1.TypeBitMap); i++ {
                if r1.TypeBitMap[i] != r2.TypeBitMap[i] {
                        return false
                }
        }
        return true
}

func (r1 *DHCID) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*DHCID)
        if !ok {
                return false
        }
        _ = r2
        if r1.Digest != r2.Digest {
                return false
        }
        return true
}

func (r1 *DLV) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*DLV)
        if !ok {
                return false
        }
        _ = r2
        if r1.KeyTag != r2.KeyTag {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.DigestType != r2.DigestType {
                return false
        }
        if r1.Digest != r2.Digest {
                return false
        }
        return true
}

func (r1 *DNAME) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*DNAME)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Target, r2.Target) {
                return false
        }
        return true
}

func (r1 *DNSKEY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*DNSKEY)
        if !ok {
                return false
        }
        _ = r2
        if r1.Flags != r2.Flags {
                return false
        }
        if r1.Protocol != r2.Protocol {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.PublicKey != r2.PublicKey {
                return false
        }
        return true
}

func (r1 *DS) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*DS)
        if !ok {
                return false
        }
        _ = r2
        if r1.KeyTag != r2.KeyTag {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.DigestType != r2.DigestType {
                return false
        }
        if r1.Digest != r2.Digest {
                return false
        }
        return true
}

func (r1 *EID) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*EID)
        if !ok {
                return false
        }
        _ = r2
        if r1.Endpoint != r2.Endpoint {
                return false
        }
        return true
}

func (r1 *EUI48) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*EUI48)
        if !ok {
                return false
        }
        _ = r2
        if r1.Address != r2.Address {
                return false
        }
        return true
}

func (r1 *EUI64) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*EUI64)
        if !ok {
                return false
        }
        _ = r2
        if r1.Address != r2.Address {
                return false
        }
        return true
}

func (r1 *GID) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*GID)
        if !ok {
                return false
        }
        _ = r2
        if r1.Gid != r2.Gid {
                return false
        }
        return true
}

func (r1 *GPOS) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*GPOS)
        if !ok {
                return false
        }
        _ = r2
        if r1.Longitude != r2.Longitude {
                return false
        }
        if r1.Latitude != r2.Latitude {
                return false
        }
        if r1.Altitude != r2.Altitude {
                return false
        }
        return true
}

func (r1 *HINFO) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*HINFO)
        if !ok {
                return false
        }
        _ = r2
        if r1.Cpu != r2.Cpu {
                return false
        }
        if r1.Os != r2.Os {
                return false
        }
        return true
}

func (r1 *HIP) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*HIP)
        if !ok {
                return false
        }
        _ = r2
        if r1.HitLength != r2.HitLength {
                return false
        }
        if r1.PublicKeyAlgorithm != r2.PublicKeyAlgorithm {
                return false
        }
        if r1.PublicKeyLength != r2.PublicKeyLength {
                return false
        }
        if r1.Hit != r2.Hit {
                return false
        }
        if r1.PublicKey != r2.PublicKey {
                return false
        }
        if len(r1.RendezvousServers) != len(r2.RendezvousServers) {
                return false
        }
        for i := 0; i < len(r1.RendezvousServers); i++ {
                if !isDuplicateName(r1.RendezvousServers[i], r2.RendezvousServers[i]) {
                        return false
                }
        }
        return true
}

func (r1 *HTTPS) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*HTTPS)
        if !ok {
                return false
        }
        _ = r2
        if r1.Priority != r2.Priority {
                return false
        }
        if !isDuplicateName(r1.Target, r2.Target) {
                return false
        }
        if len(r1.Value) != len(r2.Value) {
                return false
        }
        if !areSVCBPairArraysEqual(r1.Value, r2.Value) {
                return false
        }
        return true
}

func (r1 *IPSECKEY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*IPSECKEY)
        if !ok {
                return false
        }
        _ = r2
        if r1.Precedence != r2.Precedence {
                return false
        }
        if r1.GatewayType != r2.GatewayType {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        switch r1.GatewayType {
        case IPSECGatewayIPv4, IPSECGatewayIPv6:
                if !r1.GatewayAddr.Equal(r2.GatewayAddr) {
                        return false
                }
        case IPSECGatewayHost:
                if !isDuplicateName(r1.GatewayHost, r2.GatewayHost) {
                        return false
                }
        }

        if r1.PublicKey != r2.PublicKey {
                return false
        }
        return true
}

func (r1 *ISDN) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*ISDN)
        if !ok {
                return false
        }
        _ = r2
        if r1.Address != r2.Address {
                return false
        }
        if r1.SubAddress != r2.SubAddress {
                return false
        }
        return true
}

func (r1 *KEY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*KEY)
        if !ok {
                return false
        }
        _ = r2
        if r1.Flags != r2.Flags {
                return false
        }
        if r1.Protocol != r2.Protocol {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.PublicKey != r2.PublicKey {
                return false
        }
        return true
}

func (r1 *KX) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*KX)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if !isDuplicateName(r1.Exchanger, r2.Exchanger) {
                return false
        }
        return true
}

func (r1 *L32) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*L32)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if !r1.Locator32.Equal(r2.Locator32) {
                return false
        }
        return true
}

func (r1 *L64) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*L64)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if r1.Locator64 != r2.Locator64 {
                return false
        }
        return true
}

func (r1 *LOC) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*LOC)
        if !ok {
                return false
        }
        _ = r2
        if r1.Version != r2.Version {
                return false
        }
        if r1.Size != r2.Size {
                return false
        }
        if r1.HorizPre != r2.HorizPre {
                return false
        }
        if r1.VertPre != r2.VertPre {
                return false
        }
        if r1.Latitude != r2.Latitude {
                return false
        }
        if r1.Longitude != r2.Longitude {
                return false
        }
        if r1.Altitude != r2.Altitude {
                return false
        }
        return true
}

func (r1 *LP) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*LP)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if !isDuplicateName(r1.Fqdn, r2.Fqdn) {
                return false
        }
        return true
}

func (r1 *MB) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*MB)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Mb, r2.Mb) {
                return false
        }
        return true
}

func (r1 *MD) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*MD)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Md, r2.Md) {
                return false
        }
        return true
}

func (r1 *MF) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*MF)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Mf, r2.Mf) {
                return false
        }
        return true
}

func (r1 *MG) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*MG)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Mg, r2.Mg) {
                return false
        }
        return true
}

func (r1 *MINFO) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*MINFO)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Rmail, r2.Rmail) {
                return false
        }
        if !isDuplicateName(r1.Email, r2.Email) {
                return false
        }
        return true
}

func (r1 *MR) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*MR)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Mr, r2.Mr) {
                return false
        }
        return true
}

func (r1 *MX) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*MX)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if !isDuplicateName(r1.Mx, r2.Mx) {
                return false
        }
        return true
}

func (r1 *NAPTR) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NAPTR)
        if !ok {
                return false
        }
        _ = r2
        if r1.Order != r2.Order {
                return false
        }
        if r1.Preference != r2.Preference {
                return false
        }
        if r1.Flags != r2.Flags {
                return false
        }
        if r1.Service != r2.Service {
                return false
        }
        if r1.Regexp != r2.Regexp {
                return false
        }
        if !isDuplicateName(r1.Replacement, r2.Replacement) {
                return false
        }
        return true
}

func (r1 *NID) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NID)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if r1.NodeID != r2.NodeID {
                return false
        }
        return true
}

func (r1 *NIMLOC) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NIMLOC)
        if !ok {
                return false
        }
        _ = r2
        if r1.Locator != r2.Locator {
                return false
        }
        return true
}

func (r1 *NINFO) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NINFO)
        if !ok {
                return false
        }
        _ = r2
        if len(r1.ZSData) != len(r2.ZSData) {
                return false
        }
        for i := 0; i < len(r1.ZSData); i++ {
                if r1.ZSData[i] != r2.ZSData[i] {
                        return false
                }
        }
        return true
}

func (r1 *NS) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NS)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Ns, r2.Ns) {
                return false
        }
        return true
}

func (r1 *NSAPPTR) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NSAPPTR)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Ptr, r2.Ptr) {
                return false
        }
        return true
}

func (r1 *NSEC) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NSEC)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.NextDomain, r2.NextDomain) {
                return false
        }
        if len(r1.TypeBitMap) != len(r2.TypeBitMap) {
                return false
        }
        for i := 0; i < len(r1.TypeBitMap); i++ {
                if r1.TypeBitMap[i] != r2.TypeBitMap[i] {
                        return false
                }
        }
        return true
}

func (r1 *NSEC3) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NSEC3)
        if !ok {
                return false
        }
        _ = r2
        if r1.Hash != r2.Hash {
                return false
        }
        if r1.Flags != r2.Flags {
                return false
        }
        if r1.Iterations != r2.Iterations {
                return false
        }
        if r1.SaltLength != r2.SaltLength {
                return false
        }
        if r1.Salt != r2.Salt {
                return false
        }
        if r1.HashLength != r2.HashLength {
                return false
        }
        if r1.NextDomain != r2.NextDomain {
                return false
        }
        if len(r1.TypeBitMap) != len(r2.TypeBitMap) {
                return false
        }
        for i := 0; i < len(r1.TypeBitMap); i++ {
                if r1.TypeBitMap[i] != r2.TypeBitMap[i] {
                        return false
                }
        }
        return true
}

func (r1 *NSEC3PARAM) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NSEC3PARAM)
        if !ok {
                return false
        }
        _ = r2
        if r1.Hash != r2.Hash {
                return false
        }
        if r1.Flags != r2.Flags {
                return false
        }
        if r1.Iterations != r2.Iterations {
                return false
        }
        if r1.SaltLength != r2.SaltLength {
                return false
        }
        if r1.Salt != r2.Salt {
                return false
        }
        return true
}

func (r1 *NULL) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NULL)
        if !ok {
                return false
        }
        _ = r2
        if r1.Data != r2.Data {
                return false
        }
        return true
}

func (r1 *NXNAME) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NXNAME)
        if !ok {
                return false
        }
        _ = r2
        return true
}

func (r1 *NXT) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*NXT)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.NextDomain, r2.NextDomain) {
                return false
        }
        if len(r1.TypeBitMap) != len(r2.TypeBitMap) {
                return false
        }
        for i := 0; i < len(r1.TypeBitMap); i++ {
                if r1.TypeBitMap[i] != r2.TypeBitMap[i] {
                        return false
                }
        }
        return true
}

func (r1 *OPENPGPKEY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*OPENPGPKEY)
        if !ok {
                return false
        }
        _ = r2
        if r1.PublicKey != r2.PublicKey {
                return false
        }
        return true
}

func (r1 *PTR) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*PTR)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Ptr, r2.Ptr) {
                return false
        }
        return true
}

func (r1 *PX) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*PX)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if !isDuplicateName(r1.Map822, r2.Map822) {
                return false
        }
        if !isDuplicateName(r1.Mapx400, r2.Mapx400) {
                return false
        }
        return true
}

func (r1 *RFC3597) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*RFC3597)
        if !ok {
                return false
        }
        _ = r2
        if r1.Rdata != r2.Rdata {
                return false
        }
        return true
}

func (r1 *RKEY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*RKEY)
        if !ok {
                return false
        }
        _ = r2
        if r1.Flags != r2.Flags {
                return false
        }
        if r1.Protocol != r2.Protocol {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.PublicKey != r2.PublicKey {
                return false
        }
        return true
}

func (r1 *RP) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*RP)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Mbox, r2.Mbox) {
                return false
        }
        if !isDuplicateName(r1.Txt, r2.Txt) {
                return false
        }
        return true
}

func (r1 *RRSIG) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*RRSIG)
        if !ok {
                return false
        }
        _ = r2
        if r1.TypeCovered != r2.TypeCovered {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.Labels != r2.Labels {
                return false
        }
        if r1.OrigTtl != r2.OrigTtl {
                return false
        }
        if r1.Expiration != r2.Expiration {
                return false
        }
        if r1.Inception != r2.Inception {
                return false
        }
        if r1.KeyTag != r2.KeyTag {
                return false
        }
        if !isDuplicateName(r1.SignerName, r2.SignerName) {
                return false
        }
        if r1.Signature != r2.Signature {
                return false
        }
        return true
}

func (r1 *RT) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*RT)
        if !ok {
                return false
        }
        _ = r2
        if r1.Preference != r2.Preference {
                return false
        }
        if !isDuplicateName(r1.Host, r2.Host) {
                return false
        }
        return true
}

func (r1 *SIG) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*SIG)
        if !ok {
                return false
        }
        _ = r2
        if r1.TypeCovered != r2.TypeCovered {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.Labels != r2.Labels {
                return false
        }
        if r1.OrigTtl != r2.OrigTtl {
                return false
        }
        if r1.Expiration != r2.Expiration {
                return false
        }
        if r1.Inception != r2.Inception {
                return false
        }
        if r1.KeyTag != r2.KeyTag {
                return false
        }
        if !isDuplicateName(r1.SignerName, r2.SignerName) {
                return false
        }
        if r1.Signature != r2.Signature {
                return false
        }
        return true
}

func (r1 *SMIMEA) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*SMIMEA)
        if !ok {
                return false
        }
        _ = r2
        if r1.Usage != r2.Usage {
                return false
        }
        if r1.Selector != r2.Selector {
                return false
        }
        if r1.MatchingType != r2.MatchingType {
                return false
        }
        if r1.Certificate != r2.Certificate {
                return false
        }
        return true
}

func (r1 *SOA) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*SOA)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Ns, r2.Ns) {
                return false
        }
        if !isDuplicateName(r1.Mbox, r2.Mbox) {
                return false
        }
        if r1.Serial != r2.Serial {
                return false
        }
        if r1.Refresh != r2.Refresh {
                return false
        }
        if r1.Retry != r2.Retry {
                return false
        }
        if r1.Expire != r2.Expire {
                return false
        }
        if r1.Minttl != r2.Minttl {
                return false
        }
        return true
}

func (r1 *SPF) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*SPF)
        if !ok {
                return false
        }
        _ = r2
        if len(r1.Txt) != len(r2.Txt) {
                return false
        }
        for i := 0; i < len(r1.Txt); i++ {
                if r1.Txt[i] != r2.Txt[i] {
                        return false
                }
        }
        return true
}

func (r1 *SRV) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*SRV)
        if !ok {
                return false
        }
        _ = r2
        if r1.Priority != r2.Priority {
                return false
        }
        if r1.Weight != r2.Weight {
                return false
        }
        if r1.Port != r2.Port {
                return false
        }
        if !isDuplicateName(r1.Target, r2.Target) {
                return false
        }
        return true
}

func (r1 *SSHFP) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*SSHFP)
        if !ok {
                return false
        }
        _ = r2
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.Type != r2.Type {
                return false
        }
        if r1.FingerPrint != r2.FingerPrint {
                return false
        }
        return true
}

func (r1 *SVCB) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*SVCB)
        if !ok {
                return false
        }
        _ = r2
        if r1.Priority != r2.Priority {
                return false
        }
        if !isDuplicateName(r1.Target, r2.Target) {
                return false
        }
        if len(r1.Value) != len(r2.Value) {
                return false
        }
        if !areSVCBPairArraysEqual(r1.Value, r2.Value) {
                return false
        }
        return true
}

func (r1 *TA) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*TA)
        if !ok {
                return false
        }
        _ = r2
        if r1.KeyTag != r2.KeyTag {
                return false
        }
        if r1.Algorithm != r2.Algorithm {
                return false
        }
        if r1.DigestType != r2.DigestType {
                return false
        }
        if r1.Digest != r2.Digest {
                return false
        }
        return true
}

func (r1 *TALINK) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*TALINK)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.PreviousName, r2.PreviousName) {
                return false
        }
        if !isDuplicateName(r1.NextName, r2.NextName) {
                return false
        }
        return true
}

func (r1 *TKEY) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*TKEY)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Algorithm, r2.Algorithm) {
                return false
        }
        if r1.Inception != r2.Inception {
                return false
        }
        if r1.Expiration != r2.Expiration {
                return false
        }
        if r1.Mode != r2.Mode {
                return false
        }
        if r1.Error != r2.Error {
                return false
        }
        if r1.KeySize != r2.KeySize {
                return false
        }
        if r1.Key != r2.Key {
                return false
        }
        if r1.OtherLen != r2.OtherLen {
                return false
        }
        if r1.OtherData != r2.OtherData {
                return false
        }
        return true
}

func (r1 *TLSA) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*TLSA)
        if !ok {
                return false
        }
        _ = r2
        if r1.Usage != r2.Usage {
                return false
        }
        if r1.Selector != r2.Selector {
                return false
        }
        if r1.MatchingType != r2.MatchingType {
                return false
        }
        if r1.Certificate != r2.Certificate {
                return false
        }
        return true
}

func (r1 *TSIG) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*TSIG)
        if !ok {
                return false
        }
        _ = r2
        if !isDuplicateName(r1.Algorithm, r2.Algorithm) {
                return false
        }
        if r1.TimeSigned != r2.TimeSigned {
                return false
        }
        if r1.Fudge != r2.Fudge {
                return false
        }
        if r1.MACSize != r2.MACSize {
                return false
        }
        if r1.MAC != r2.MAC {
                return false
        }
        if r1.OrigId != r2.OrigId {
                return false
        }
        if r1.Error != r2.Error {
                return false
        }
        if r1.OtherLen != r2.OtherLen {
                return false
        }
        if r1.OtherData != r2.OtherData {
                return false
        }
        return true
}

func (r1 *TXT) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*TXT)
        if !ok {
                return false
        }
        _ = r2
        if len(r1.Txt) != len(r2.Txt) {
                return false
        }
        for i := 0; i < len(r1.Txt); i++ {
                if r1.Txt[i] != r2.Txt[i] {
                        return false
                }
        }
        return true
}

func (r1 *UID) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*UID)
        if !ok {
                return false
        }
        _ = r2
        if r1.Uid != r2.Uid {
                return false
        }
        return true
}

func (r1 *UINFO) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*UINFO)
        if !ok {
                return false
        }
        _ = r2
        if r1.Uinfo != r2.Uinfo {
                return false
        }
        return true
}

func (r1 *URI) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*URI)
        if !ok {
                return false
        }
        _ = r2
        if r1.Priority != r2.Priority {
                return false
        }
        if r1.Weight != r2.Weight {
                return false
        }
        if r1.Target != r2.Target {
                return false
        }
        return true
}

func (r1 *X25) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*X25)
        if !ok {
                return false
        }
        _ = r2
        if r1.PSDNAddress != r2.PSDNAddress {
                return false
        }
        return true
}

func (r1 *ZONEMD) isDuplicate(_r2 RR) bool {
        r2, ok := _r2.(*ZONEMD)
        if !ok {
                return false
        }
        _ = r2
        if r1.Serial != r2.Serial {
                return false
        }
        if r1.Scheme != r2.Scheme {
                return false
        }
        if r1.Hash != r2.Hash {
                return false
        }
        if r1.Digest != r2.Digest {
                return false
        }
        return true
}

// Code generated by "go run msg_generate.go"; DO NOT EDIT.

package dns

// pack*() functions

func (rr *A) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDataA(rr.A, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AAAA) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDataAAAA(rr.AAAA, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AFSDB) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Subtype, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Hostname, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AMTRELAY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Precedence, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.GatewayType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packIPSECGateway(rr.GatewayAddr, rr.GatewayHost, msg, off, rr.GatewayType, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *ANY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        return off, nil
}

func (rr *APL) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDataApl(rr.Prefixes, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AVC) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringTxt(rr.Txt, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CAA) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Flag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.Tag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringOctet(rr.Value, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CDNSKEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Protocol, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CDS) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.DigestType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Digest, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CERT) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Type, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.Certificate, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CNAME) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Target, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CSYNC) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint32(rr.Serial, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDataNsec(rr.TypeBitMap, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DHCID) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringBase64(rr.Digest, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DLV) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.DigestType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Digest, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DNAME) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Target, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DNSKEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Protocol, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DS) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.DigestType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Digest, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *EID) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringHex(rr.Endpoint, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *EUI48) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint48(rr.Address, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *EUI64) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint64(rr.Address, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *GID) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint32(rr.Gid, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *GPOS) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packString(rr.Longitude, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.Latitude, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.Altitude, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *HINFO) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packString(rr.Cpu, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.Os, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *HIP) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.HitLength, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.PublicKeyAlgorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.PublicKeyLength, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Hit, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDataDomainNames(rr.RendezvousServers, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *HTTPS) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Priority, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Target, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packDataSVCB(rr.Value, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *IPSECKEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Precedence, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.GatewayType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packIPSECGateway(rr.GatewayAddr, rr.GatewayHost, msg, off, rr.GatewayType, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *ISDN) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packString(rr.Address, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.SubAddress, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *KEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Protocol, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *KX) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Exchanger, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *L32) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDataA(rr.Locator32, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *L64) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint64(rr.Locator64, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *LOC) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Version, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Size, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.HorizPre, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.VertPre, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Latitude, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Longitude, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Altitude, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *LP) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Fqdn, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MB) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Mb, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MD) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Md, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MF) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Mf, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MG) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Mg, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MINFO) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Rmail, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Email, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MR) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Mr, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MX) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Mx, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NAPTR) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Order, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.Service, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packString(rr.Regexp, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Replacement, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NID) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint64(rr.NodeID, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NIMLOC) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringHex(rr.Locator, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NINFO) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringTxt(rr.ZSData, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NS) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Ns, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSAPPTR) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Ptr, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSEC) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.NextDomain, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packDataNsec(rr.TypeBitMap, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSEC3) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Hash, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Iterations, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.SaltLength, msg, off)
        if err != nil {
                return off, err
        }
        // Only pack salt if value is not "-", i.e. empty
        if rr.Salt != "-" {
                off, err = packStringHex(rr.Salt, msg, off)
                if err != nil {
                        return off, err
                }
        }
        off, err = packUint8(rr.HashLength, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase32(rr.NextDomain, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDataNsec(rr.TypeBitMap, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSEC3PARAM) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Hash, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Iterations, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.SaltLength, msg, off)
        if err != nil {
                return off, err
        }
        // Only pack salt if value is not "-", i.e. empty
        if rr.Salt != "-" {
                off, err = packStringHex(rr.Salt, msg, off)
                if err != nil {
                        return off, err
                }
        }
        return off, nil
}

func (rr *NULL) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringAny(rr.Data, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NXNAME) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        return off, nil
}

func (rr *NXT) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.NextDomain, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packDataNsec(rr.TypeBitMap, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *OPENPGPKEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringBase64(rr.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *OPT) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDataOpt(rr.Option, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *PTR) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Ptr, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *PX) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Map822, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Mapx400, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RFC3597) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringHex(rr.Rdata, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RKEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Flags, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Protocol, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.PublicKey, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RP) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Mbox, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Txt, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RRSIG) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.TypeCovered, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Labels, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.OrigTtl, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Expiration, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Inception, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.SignerName, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.Signature, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RT) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Preference, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Host, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SIG) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.TypeCovered, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Labels, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.OrigTtl, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Expiration, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Inception, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.SignerName, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packStringBase64(rr.Signature, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SMIMEA) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Usage, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Selector, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.MatchingType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Certificate, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SOA) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Ns, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Mbox, msg, off, compression, compress)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Serial, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Refresh, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Retry, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Expire, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Minttl, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SPF) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringTxt(rr.Txt, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SRV) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Priority, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Weight, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Port, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Target, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SSHFP) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Type, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.FingerPrint, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SVCB) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Priority, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.Target, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packDataSVCB(rr.Value, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TA) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.KeyTag, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Algorithm, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.DigestType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Digest, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TALINK) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.PreviousName, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packDomainName(rr.NextName, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TKEY) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Algorithm, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Inception, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint32(rr.Expiration, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Mode, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Error, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.KeySize, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Key, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.OtherLen, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.OtherData, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TLSA) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint8(rr.Usage, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Selector, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.MatchingType, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Certificate, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TSIG) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packDomainName(rr.Algorithm, msg, off, compression, false)
        if err != nil {
                return off, err
        }
        off, err = packUint48(rr.TimeSigned, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Fudge, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.MACSize, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.MAC, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.OrigId, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Error, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.OtherLen, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.OtherData, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TXT) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packStringTxt(rr.Txt, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *UID) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint32(rr.Uid, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *UINFO) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packString(rr.Uinfo, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *URI) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint16(rr.Priority, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint16(rr.Weight, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringOctet(rr.Target, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *X25) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packString(rr.PSDNAddress, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *ZONEMD) pack(msg []byte, off int, compression compressionMap, compress bool) (off1 int, err error) {
        off, err = packUint32(rr.Serial, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Scheme, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packUint8(rr.Hash, msg, off)
        if err != nil {
                return off, err
        }
        off, err = packStringHex(rr.Digest, msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

// unpack*() functions

func (rr *A) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.A, off, err = unpackDataA(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AAAA) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.AAAA, off, err = unpackDataAAAA(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AFSDB) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Subtype, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Hostname, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AMTRELAY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Precedence, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.GatewayType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        if off == len(msg) {
                return off, nil
        }
        rr.GatewayAddr, rr.GatewayHost, off, err = unpackIPSECGateway(msg, off, rr.GatewayType)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *ANY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        return off, nil
}

func (rr *APL) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Prefixes, off, err = unpackDataApl(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *AVC) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Txt, off, err = unpackStringTxt(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CAA) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Flag, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Tag, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Value, off, err = unpackStringOctet(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CDNSKEY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Flags, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Protocol, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.PublicKey, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CDS) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.KeyTag, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.DigestType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Digest, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CERT) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Type, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.KeyTag, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Certificate, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CNAME) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Target, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *CSYNC) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Serial, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Flags, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.TypeBitMap, off, err = unpackDataNsec(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DHCID) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Digest, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DLV) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.KeyTag, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.DigestType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Digest, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DNAME) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Target, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DNSKEY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Flags, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Protocol, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.PublicKey, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *DS) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.KeyTag, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.DigestType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Digest, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *EID) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Endpoint, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *EUI48) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Address, off, err = unpackUint48(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *EUI64) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Address, off, err = unpackUint64(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *GID) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Gid, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *GPOS) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Longitude, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Latitude, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Altitude, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *HINFO) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Cpu, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Os, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *HIP) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.HitLength, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.PublicKeyAlgorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.PublicKeyLength, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Hit, off, err = unpackStringHex(msg, off, off+int(rr.HitLength))
        if err != nil {
                return off, err
        }
        rr.PublicKey, off, err = unpackStringBase64(msg, off, off+int(rr.PublicKeyLength))
        if err != nil {
                return off, err
        }
        rr.RendezvousServers, off, err = unpackDataDomainNames(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *HTTPS) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Priority, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Target, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Value, off, err = unpackDataSVCB(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *IPSECKEY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Precedence, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.GatewayType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        if off == len(msg) {
                return off, nil
        }
        rr.GatewayAddr, rr.GatewayHost, off, err = unpackIPSECGateway(msg, off, rr.GatewayType)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.PublicKey, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *ISDN) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Address, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.SubAddress, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *KEY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Flags, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Protocol, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.PublicKey, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *KX) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Exchanger, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *L32) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Locator32, off, err = unpackDataA(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *L64) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Locator64, off, err = unpackUint64(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *LOC) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Version, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Size, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.HorizPre, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.VertPre, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Latitude, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Longitude, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Altitude, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *LP) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Fqdn, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MB) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Mb, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MD) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Md, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MF) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Mf, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MG) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Mg, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MINFO) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Rmail, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Email, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MR) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Mr, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *MX) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Mx, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NAPTR) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Order, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Flags, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Service, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Regexp, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Replacement, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NID) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.NodeID, off, err = unpackUint64(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NIMLOC) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Locator, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NINFO) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.ZSData, off, err = unpackStringTxt(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NS) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Ns, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSAPPTR) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Ptr, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSEC) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.NextDomain, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.TypeBitMap, off, err = unpackDataNsec(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSEC3) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Hash, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Flags, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Iterations, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.SaltLength, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Salt, off, err = unpackStringHex(msg, off, off+int(rr.SaltLength))
        if err != nil {
                return off, err
        }
        rr.HashLength, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.NextDomain, off, err = unpackStringBase32(msg, off, off+int(rr.HashLength))
        if err != nil {
                return off, err
        }
        rr.TypeBitMap, off, err = unpackDataNsec(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NSEC3PARAM) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Hash, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Flags, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Iterations, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.SaltLength, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Salt, off, err = unpackStringHex(msg, off, off+int(rr.SaltLength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NULL) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Data, off, err = unpackStringAny(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *NXNAME) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        return off, nil
}

func (rr *NXT) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.NextDomain, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.TypeBitMap, off, err = unpackDataNsec(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *OPENPGPKEY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.PublicKey, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *OPT) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Option, off, err = unpackDataOpt(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *PTR) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Ptr, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *PX) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Map822, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Mapx400, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RFC3597) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Rdata, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RKEY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Flags, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Protocol, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.PublicKey, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RP) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Mbox, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Txt, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RRSIG) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.TypeCovered, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Labels, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.OrigTtl, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Expiration, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Inception, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.KeyTag, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.SignerName, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Signature, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *RT) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Preference, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Host, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SIG) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.TypeCovered, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Labels, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.OrigTtl, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Expiration, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Inception, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.KeyTag, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.SignerName, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Signature, off, err = unpackStringBase64(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SMIMEA) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Usage, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Selector, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.MatchingType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Certificate, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SOA) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Ns, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Mbox, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Serial, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Refresh, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Retry, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Expire, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Minttl, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SPF) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Txt, off, err = unpackStringTxt(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SRV) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Priority, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Weight, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Port, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Target, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SSHFP) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Type, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.FingerPrint, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *SVCB) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Priority, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Target, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Value, off, err = unpackDataSVCB(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TA) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.KeyTag, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Algorithm, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.DigestType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Digest, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TALINK) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.PreviousName, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.NextName, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TKEY) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Algorithm, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Inception, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Expiration, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Mode, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Error, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.KeySize, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Key, off, err = unpackStringHex(msg, off, off+int(rr.KeySize))
        if err != nil {
                return off, err
        }
        rr.OtherLen, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.OtherData, off, err = unpackStringHex(msg, off, off+int(rr.OtherLen))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TLSA) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Usage, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Selector, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.MatchingType, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Certificate, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TSIG) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Algorithm, off, err = UnpackDomainName(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.TimeSigned, off, err = unpackUint48(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Fudge, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.MACSize, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.MAC, off, err = unpackStringHex(msg, off, off+int(rr.MACSize))
        if err != nil {
                return off, err
        }
        rr.OrigId, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Error, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.OtherLen, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.OtherData, off, err = unpackStringHex(msg, off, off+int(rr.OtherLen))
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *TXT) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Txt, off, err = unpackStringTxt(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *UID) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Uid, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *UINFO) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Uinfo, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *URI) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Priority, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Weight, off, err = unpackUint16(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Target, off, err = unpackStringOctet(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *X25) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.PSDNAddress, off, err = unpackString(msg, off)
        if err != nil {
                return off, err
        }
        return off, nil
}

func (rr *ZONEMD) unpack(msg []byte, off int) (off1 int, err error) {
        rdStart := off
        _ = rdStart

        rr.Serial, off, err = unpackUint32(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Scheme, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Hash, off, err = unpackUint8(msg, off)
        if err != nil {
                return off, err
        }
        if off == len(msg) {
                return off, nil
        }
        rr.Digest, off, err = unpackStringHex(msg, off, rdStart+int(rr.Hdr.Rdlength))
        if err != nil {
                return off, err
        }
        return off, nil
}

// Code generated by "go run types_generate.go"; DO NOT EDIT.

package dns

import (
        "encoding/base64"
        "net"
)

// TypeToRR is a map of constructors for each RR type.
var TypeToRR = map[uint16]func() RR{
        TypeA:          func() RR { return new(A) },
        TypeAAAA:       func() RR { return new(AAAA) },
        TypeAFSDB:      func() RR { return new(AFSDB) },
        TypeAMTRELAY:   func() RR { return new(AMTRELAY) },
        TypeANY:        func() RR { return new(ANY) },
        TypeAPL:        func() RR { return new(APL) },
        TypeAVC:        func() RR { return new(AVC) },
        TypeCAA:        func() RR { return new(CAA) },
        TypeCDNSKEY:    func() RR { return new(CDNSKEY) },
        TypeCDS:        func() RR { return new(CDS) },
        TypeCERT:       func() RR { return new(CERT) },
        TypeCNAME:      func() RR { return new(CNAME) },
        TypeCSYNC:      func() RR { return new(CSYNC) },
        TypeDHCID:      func() RR { return new(DHCID) },
        TypeDLV:        func() RR { return new(DLV) },
        TypeDNAME:      func() RR { return new(DNAME) },
        TypeDNSKEY:     func() RR { return new(DNSKEY) },
        TypeDS:         func() RR { return new(DS) },
        TypeEID:        func() RR { return new(EID) },
        TypeEUI48:      func() RR { return new(EUI48) },
        TypeEUI64:      func() RR { return new(EUI64) },
        TypeGID:        func() RR { return new(GID) },
        TypeGPOS:       func() RR { return new(GPOS) },
        TypeHINFO:      func() RR { return new(HINFO) },
        TypeHIP:        func() RR { return new(HIP) },
        TypeHTTPS:      func() RR { return new(HTTPS) },
        TypeIPSECKEY:   func() RR { return new(IPSECKEY) },
        TypeISDN:       func() RR { return new(ISDN) },
        TypeKEY:        func() RR { return new(KEY) },
        TypeKX:         func() RR { return new(KX) },
        TypeL32:        func() RR { return new(L32) },
        TypeL64:        func() RR { return new(L64) },
        TypeLOC:        func() RR { return new(LOC) },
        TypeLP:         func() RR { return new(LP) },
        TypeMB:         func() RR { return new(MB) },
        TypeMD:         func() RR { return new(MD) },
        TypeMF:         func() RR { return new(MF) },
        TypeMG:         func() RR { return new(MG) },
        TypeMINFO:      func() RR { return new(MINFO) },
        TypeMR:         func() RR { return new(MR) },
        TypeMX:         func() RR { return new(MX) },
        TypeNAPTR:      func() RR { return new(NAPTR) },
        TypeNID:        func() RR { return new(NID) },
        TypeNIMLOC:     func() RR { return new(NIMLOC) },
        TypeNINFO:      func() RR { return new(NINFO) },
        TypeNS:         func() RR { return new(NS) },
        TypeNSAPPTR:    func() RR { return new(NSAPPTR) },
        TypeNSEC:       func() RR { return new(NSEC) },
        TypeNSEC3:      func() RR { return new(NSEC3) },
        TypeNSEC3PARAM: func() RR { return new(NSEC3PARAM) },
        TypeNULL:       func() RR { return new(NULL) },
        TypeNXNAME:     func() RR { return new(NXNAME) },
        TypeNXT:        func() RR { return new(NXT) },
        TypeOPENPGPKEY: func() RR { return new(OPENPGPKEY) },
        TypeOPT:        func() RR { return new(OPT) },
        TypePTR:        func() RR { return new(PTR) },
        TypePX:         func() RR { return new(PX) },
        TypeRKEY:       func() RR { return new(RKEY) },
        TypeRP:         func() RR { return new(RP) },
        TypeRRSIG:      func() RR { return new(RRSIG) },
        TypeRT:         func() RR { return new(RT) },
        TypeSIG:        func() RR { return new(SIG) },
        TypeSMIMEA:     func() RR { return new(SMIMEA) },
        TypeSOA:        func() RR { return new(SOA) },
        TypeSPF:        func() RR { return new(SPF) },
        TypeSRV:        func() RR { return new(SRV) },
        TypeSSHFP:      func() RR { return new(SSHFP) },
        TypeSVCB:       func() RR { return new(SVCB) },
        TypeTA:         func() RR { return new(TA) },
        TypeTALINK:     func() RR { return new(TALINK) },
        TypeTKEY:       func() RR { return new(TKEY) },
        TypeTLSA:       func() RR { return new(TLSA) },
        TypeTSIG:       func() RR { return new(TSIG) },
        TypeTXT:        func() RR { return new(TXT) },
        TypeUID:        func() RR { return new(UID) },
        TypeUINFO:      func() RR { return new(UINFO) },
        TypeURI:        func() RR { return new(URI) },
        TypeX25:        func() RR { return new(X25) },
        TypeZONEMD:     func() RR { return new(ZONEMD) },
}

// TypeToString is a map of strings for each RR type.
var TypeToString = map[uint16]string{
        TypeA:          "A",
        TypeAAAA:       "AAAA",
        TypeAFSDB:      "AFSDB",
        TypeAMTRELAY:   "AMTRELAY",
        TypeANY:        "ANY",
        TypeAPL:        "APL",
        TypeATMA:       "ATMA",
        TypeAVC:        "AVC",
        TypeAXFR:       "AXFR",
        TypeCAA:        "CAA",
        TypeCDNSKEY:    "CDNSKEY",
        TypeCDS:        "CDS",
        TypeCERT:       "CERT",
        TypeCNAME:      "CNAME",
        TypeCSYNC:      "CSYNC",
        TypeDHCID:      "DHCID",
        TypeDLV:        "DLV",
        TypeDNAME:      "DNAME",
        TypeDNSKEY:     "DNSKEY",
        TypeDS:         "DS",
        TypeEID:        "EID",
        TypeEUI48:      "EUI48",
        TypeEUI64:      "EUI64",
        TypeGID:        "GID",
        TypeGPOS:       "GPOS",
        TypeHINFO:      "HINFO",
        TypeHIP:        "HIP",
        TypeHTTPS:      "HTTPS",
        TypeIPSECKEY:   "IPSECKEY",
        TypeISDN:       "ISDN",
        TypeIXFR:       "IXFR",
        TypeKEY:        "KEY",
        TypeKX:         "KX",
        TypeL32:        "L32",
        TypeL64:        "L64",
        TypeLOC:        "LOC",
        TypeLP:         "LP",
        TypeMAILA:      "MAILA",
        TypeMAILB:      "MAILB",
        TypeMB:         "MB",
        TypeMD:         "MD",
        TypeMF:         "MF",
        TypeMG:         "MG",
        TypeMINFO:      "MINFO",
        TypeMR:         "MR",
        TypeMX:         "MX",
        TypeNAPTR:      "NAPTR",
        TypeNID:        "NID",
        TypeNIMLOC:     "NIMLOC",
        TypeNINFO:      "NINFO",
        TypeNS:         "NS",
        TypeNSEC:       "NSEC",
        TypeNSEC3:      "NSEC3",
        TypeNSEC3PARAM: "NSEC3PARAM",
        TypeNULL:       "NULL",
        TypeNXNAME:     "NXNAME",
        TypeNXT:        "NXT",
        TypeNone:       "None",
        TypeOPENPGPKEY: "OPENPGPKEY",
        TypeOPT:        "OPT",
        TypePTR:        "PTR",
        TypePX:         "PX",
        TypeRKEY:       "RKEY",
        TypeRP:         "RP",
        TypeRRSIG:      "RRSIG",
        TypeRT:         "RT",
        TypeReserved:   "Reserved",
        TypeSIG:        "SIG",
        TypeSMIMEA:     "SMIMEA",
        TypeSOA:        "SOA",
        TypeSPF:        "SPF",
        TypeSRV:        "SRV",
        TypeSSHFP:      "SSHFP",
        TypeSVCB:       "SVCB",
        TypeTA:         "TA",
        TypeTALINK:     "TALINK",
        TypeTKEY:       "TKEY",
        TypeTLSA:       "TLSA",
        TypeTSIG:       "TSIG",
        TypeTXT:        "TXT",
        TypeUID:        "UID",
        TypeUINFO:      "UINFO",
        TypeUNSPEC:     "UNSPEC",
        TypeURI:        "URI",
        TypeX25:        "X25",
        TypeZONEMD:     "ZONEMD",
        TypeNSAPPTR:    "NSAP-PTR",
}

func (rr *A) Header() *RR_Header          { return &rr.Hdr }
func (rr *AAAA) Header() *RR_Header       { return &rr.Hdr }
func (rr *AFSDB) Header() *RR_Header      { return &rr.Hdr }
func (rr *AMTRELAY) Header() *RR_Header   { return &rr.Hdr }
func (rr *ANY) Header() *RR_Header        { return &rr.Hdr }
func (rr *APL) Header() *RR_Header        { return &rr.Hdr }
func (rr *AVC) Header() *RR_Header        { return &rr.Hdr }
func (rr *CAA) Header() *RR_Header        { return &rr.Hdr }
func (rr *CDNSKEY) Header() *RR_Header    { return &rr.Hdr }
func (rr *CDS) Header() *RR_Header        { return &rr.Hdr }
func (rr *CERT) Header() *RR_Header       { return &rr.Hdr }
func (rr *CNAME) Header() *RR_Header      { return &rr.Hdr }
func (rr *CSYNC) Header() *RR_Header      { return &rr.Hdr }
func (rr *DHCID) Header() *RR_Header      { return &rr.Hdr }
func (rr *DLV) Header() *RR_Header        { return &rr.Hdr }
func (rr *DNAME) Header() *RR_Header      { return &rr.Hdr }
func (rr *DNSKEY) Header() *RR_Header     { return &rr.Hdr }
func (rr *DS) Header() *RR_Header         { return &rr.Hdr }
func (rr *EID) Header() *RR_Header        { return &rr.Hdr }
func (rr *EUI48) Header() *RR_Header      { return &rr.Hdr }
func (rr *EUI64) Header() *RR_Header      { return &rr.Hdr }
func (rr *GID) Header() *RR_Header        { return &rr.Hdr }
func (rr *GPOS) Header() *RR_Header       { return &rr.Hdr }
func (rr *HINFO) Header() *RR_Header      { return &rr.Hdr }
func (rr *HIP) Header() *RR_Header        { return &rr.Hdr }
func (rr *HTTPS) Header() *RR_Header      { return &rr.Hdr }
func (rr *IPSECKEY) Header() *RR_Header   { return &rr.Hdr }
func (rr *ISDN) Header() *RR_Header       { return &rr.Hdr }
func (rr *KEY) Header() *RR_Header        { return &rr.Hdr }
func (rr *KX) Header() *RR_Header         { return &rr.Hdr }
func (rr *L32) Header() *RR_Header        { return &rr.Hdr }
func (rr *L64) Header() *RR_Header        { return &rr.Hdr }
func (rr *LOC) Header() *RR_Header        { return &rr.Hdr }
func (rr *LP) Header() *RR_Header         { return &rr.Hdr }
func (rr *MB) Header() *RR_Header         { return &rr.Hdr }
func (rr *MD) Header() *RR_Header         { return &rr.Hdr }
func (rr *MF) Header() *RR_Header         { return &rr.Hdr }
func (rr *MG) Header() *RR_Header         { return &rr.Hdr }
func (rr *MINFO) Header() *RR_Header      { return &rr.Hdr }
func (rr *MR) Header() *RR_Header         { return &rr.Hdr }
func (rr *MX) Header() *RR_Header         { return &rr.Hdr }
func (rr *NAPTR) Header() *RR_Header      { return &rr.Hdr }
func (rr *NID) Header() *RR_Header        { return &rr.Hdr }
func (rr *NIMLOC) Header() *RR_Header     { return &rr.Hdr }
func (rr *NINFO) Header() *RR_Header      { return &rr.Hdr }
func (rr *NS) Header() *RR_Header         { return &rr.Hdr }
func (rr *NSAPPTR) Header() *RR_Header    { return &rr.Hdr }
func (rr *NSEC) Header() *RR_Header       { return &rr.Hdr }
func (rr *NSEC3) Header() *RR_Header      { return &rr.Hdr }
func (rr *NSEC3PARAM) Header() *RR_Header { return &rr.Hdr }
func (rr *NULL) Header() *RR_Header       { return &rr.Hdr }
func (rr *NXNAME) Header() *RR_Header     { return &rr.Hdr }
func (rr *NXT) Header() *RR_Header        { return &rr.Hdr }
func (rr *OPENPGPKEY) Header() *RR_Header { return &rr.Hdr }
func (rr *OPT) Header() *RR_Header        { return &rr.Hdr }
func (rr *PTR) Header() *RR_Header        { return &rr.Hdr }
func (rr *PX) Header() *RR_Header         { return &rr.Hdr }
func (rr *RFC3597) Header() *RR_Header    { return &rr.Hdr }
func (rr *RKEY) Header() *RR_Header       { return &rr.Hdr }
func (rr *RP) Header() *RR_Header         { return &rr.Hdr }
func (rr *RRSIG) Header() *RR_Header      { return &rr.Hdr }
func (rr *RT) Header() *RR_Header         { return &rr.Hdr }
func (rr *SIG) Header() *RR_Header        { return &rr.Hdr }
func (rr *SMIMEA) Header() *RR_Header     { return &rr.Hdr }
func (rr *SOA) Header() *RR_Header        { return &rr.Hdr }
func (rr *SPF) Header() *RR_Header        { return &rr.Hdr }
func (rr *SRV) Header() *RR_Header        { return &rr.Hdr }
func (rr *SSHFP) Header() *RR_Header      { return &rr.Hdr }
func (rr *SVCB) Header() *RR_Header       { return &rr.Hdr }
func (rr *TA) Header() *RR_Header         { return &rr.Hdr }
func (rr *TALINK) Header() *RR_Header     { return &rr.Hdr }
func (rr *TKEY) Header() *RR_Header       { return &rr.Hdr }
func (rr *TLSA) Header() *RR_Header       { return &rr.Hdr }
func (rr *TSIG) Header() *RR_Header       { return &rr.Hdr }
func (rr *TXT) Header() *RR_Header        { return &rr.Hdr }
func (rr *UID) Header() *RR_Header        { return &rr.Hdr }
func (rr *UINFO) Header() *RR_Header      { return &rr.Hdr }
func (rr *URI) Header() *RR_Header        { return &rr.Hdr }
func (rr *X25) Header() *RR_Header        { return &rr.Hdr }
func (rr *ZONEMD) Header() *RR_Header     { return &rr.Hdr }

// len() functions
func (rr *A) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        if len(rr.A) != 0 {
                l += net.IPv4len
        }
        return l
}

func (rr *AAAA) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        if len(rr.AAAA) != 0 {
                l += net.IPv6len
        }
        return l
}

func (rr *AFSDB) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Subtype
        l += domainNameLen(rr.Hostname, off+l, compression, false)
        return l
}

func (rr *AMTRELAY) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++ // Precedence
        l++ // GatewayType
        switch rr.GatewayType {
        case AMTRELAYIPv4:
                l += net.IPv4len
        case AMTRELAYIPv6:
                l += net.IPv6len
        case AMTRELAYHost:
                l += len(rr.GatewayHost) + 1
        }
        return l
}

func (rr *ANY) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        return l
}

func (rr *APL) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        for _, x := range rr.Prefixes {
                l += x.len()
        }
        return l
}

func (rr *AVC) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        for _, x := range rr.Txt {
                l += len(x) + 1
        }
        return l
}

func (rr *CAA) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++ // Flag
        l += len(rr.Tag) + 1
        l += len(rr.Value)
        return l
}

func (rr *CERT) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Type
        l += 2 // KeyTag
        l++    // Algorithm
        l += base64.StdEncoding.DecodedLen(len(rr.Certificate))
        return l
}

func (rr *CNAME) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Target, off+l, compression, true)
        return l
}

func (rr *DHCID) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += base64.StdEncoding.DecodedLen(len(rr.Digest))
        return l
}

func (rr *DNAME) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Target, off+l, compression, false)
        return l
}

func (rr *DNSKEY) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Flags
        l++    // Protocol
        l++    // Algorithm
        l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
        return l
}

func (rr *DS) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // KeyTag
        l++    // Algorithm
        l++    // DigestType
        l += len(rr.Digest) / 2
        return l
}

func (rr *EID) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Endpoint) / 2
        return l
}

func (rr *EUI48) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 6 // Address
        return l
}

func (rr *EUI64) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 8 // Address
        return l
}

func (rr *GID) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 4 // Gid
        return l
}

func (rr *GPOS) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Longitude) + 1
        l += len(rr.Latitude) + 1
        l += len(rr.Altitude) + 1
        return l
}

func (rr *HINFO) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Cpu) + 1
        l += len(rr.Os) + 1
        return l
}

func (rr *HIP) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++    // HitLength
        l++    // PublicKeyAlgorithm
        l += 2 // PublicKeyLength
        l += len(rr.Hit) / 2
        l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
        for _, x := range rr.RendezvousServers {
                l += domainNameLen(x, off+l, compression, false)
        }
        return l
}

func (rr *IPSECKEY) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++ // Precedence
        l++ // GatewayType
        l++ // Algorithm
        switch rr.GatewayType {
        case IPSECGatewayIPv4:
                l += net.IPv4len
        case IPSECGatewayIPv6:
                l += net.IPv6len
        case IPSECGatewayHost:
                l += len(rr.GatewayHost) + 1
        }
        l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
        return l
}

func (rr *ISDN) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Address) + 1
        l += len(rr.SubAddress) + 1
        return l
}

func (rr *KX) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        l += domainNameLen(rr.Exchanger, off+l, compression, false)
        return l
}

func (rr *L32) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        if len(rr.Locator32) != 0 {
                l += net.IPv4len
        }
        return l
}

func (rr *L64) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        l += 8 // Locator64
        return l
}

func (rr *LOC) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++    // Version
        l++    // Size
        l++    // HorizPre
        l++    // VertPre
        l += 4 // Latitude
        l += 4 // Longitude
        l += 4 // Altitude
        return l
}

func (rr *LP) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        l += domainNameLen(rr.Fqdn, off+l, compression, false)
        return l
}

func (rr *MB) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Mb, off+l, compression, true)
        return l
}

func (rr *MD) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Md, off+l, compression, true)
        return l
}

func (rr *MF) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Mf, off+l, compression, true)
        return l
}

func (rr *MG) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Mg, off+l, compression, true)
        return l
}

func (rr *MINFO) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Rmail, off+l, compression, true)
        l += domainNameLen(rr.Email, off+l, compression, true)
        return l
}

func (rr *MR) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Mr, off+l, compression, true)
        return l
}

func (rr *MX) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        l += domainNameLen(rr.Mx, off+l, compression, true)
        return l
}

func (rr *NAPTR) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Order
        l += 2 // Preference
        l += len(rr.Flags) + 1
        l += len(rr.Service) + 1
        l += len(rr.Regexp) + 1
        l += domainNameLen(rr.Replacement, off+l, compression, false)
        return l
}

func (rr *NID) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        l += 8 // NodeID
        return l
}

func (rr *NIMLOC) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Locator) / 2
        return l
}

func (rr *NINFO) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        for _, x := range rr.ZSData {
                l += len(x) + 1
        }
        return l
}

func (rr *NS) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Ns, off+l, compression, true)
        return l
}

func (rr *NSAPPTR) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Ptr, off+l, compression, false)
        return l
}

func (rr *NSEC3PARAM) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++    // Hash
        l++    // Flags
        l += 2 // Iterations
        l++    // SaltLength
        l += len(rr.Salt) / 2
        return l
}

func (rr *NULL) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Data)
        return l
}

func (rr *NXNAME) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        return l
}

func (rr *OPENPGPKEY) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
        return l
}

func (rr *PTR) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Ptr, off+l, compression, true)
        return l
}

func (rr *PX) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        l += domainNameLen(rr.Map822, off+l, compression, false)
        l += domainNameLen(rr.Mapx400, off+l, compression, false)
        return l
}

func (rr *RFC3597) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Rdata) / 2
        return l
}

func (rr *RKEY) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Flags
        l++    // Protocol
        l++    // Algorithm
        l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
        return l
}

func (rr *RP) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Mbox, off+l, compression, false)
        l += domainNameLen(rr.Txt, off+l, compression, false)
        return l
}

func (rr *RRSIG) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // TypeCovered
        l++    // Algorithm
        l++    // Labels
        l += 4 // OrigTtl
        l += 4 // Expiration
        l += 4 // Inception
        l += 2 // KeyTag
        l += domainNameLen(rr.SignerName, off+l, compression, false)
        l += base64.StdEncoding.DecodedLen(len(rr.Signature))
        return l
}

func (rr *RT) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Preference
        l += domainNameLen(rr.Host, off+l, compression, false)
        return l
}

func (rr *SMIMEA) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++ // Usage
        l++ // Selector
        l++ // MatchingType
        l += len(rr.Certificate) / 2
        return l
}

func (rr *SOA) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Ns, off+l, compression, true)
        l += domainNameLen(rr.Mbox, off+l, compression, true)
        l += 4 // Serial
        l += 4 // Refresh
        l += 4 // Retry
        l += 4 // Expire
        l += 4 // Minttl
        return l
}

func (rr *SPF) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        for _, x := range rr.Txt {
                l += len(x) + 1
        }
        return l
}

func (rr *SRV) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Priority
        l += 2 // Weight
        l += 2 // Port
        l += domainNameLen(rr.Target, off+l, compression, false)
        return l
}

func (rr *SSHFP) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++ // Algorithm
        l++ // Type
        l += len(rr.FingerPrint) / 2
        return l
}

func (rr *SVCB) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Priority
        l += domainNameLen(rr.Target, off+l, compression, false)
        for _, x := range rr.Value {
                l += 4 + int(x.len())
        }
        return l
}

func (rr *TA) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // KeyTag
        l++    // Algorithm
        l++    // DigestType
        l += len(rr.Digest) / 2
        return l
}

func (rr *TALINK) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.PreviousName, off+l, compression, false)
        l += domainNameLen(rr.NextName, off+l, compression, false)
        return l
}

func (rr *TKEY) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Algorithm, off+l, compression, false)
        l += 4 // Inception
        l += 4 // Expiration
        l += 2 // Mode
        l += 2 // Error
        l += 2 // KeySize
        l += len(rr.Key) / 2
        l += 2 // OtherLen
        l += len(rr.OtherData) / 2
        return l
}

func (rr *TLSA) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l++ // Usage
        l++ // Selector
        l++ // MatchingType
        l += len(rr.Certificate) / 2
        return l
}

func (rr *TSIG) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += domainNameLen(rr.Algorithm, off+l, compression, false)
        l += 6 // TimeSigned
        l += 2 // Fudge
        l += 2 // MACSize
        l += len(rr.MAC) / 2
        l += 2 // OrigId
        l += 2 // Error
        l += 2 // OtherLen
        l += len(rr.OtherData) / 2
        return l
}

func (rr *TXT) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        for _, x := range rr.Txt {
                l += len(x) + 1
        }
        return l
}

func (rr *UID) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 4 // Uid
        return l
}

func (rr *UINFO) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.Uinfo) + 1
        return l
}

func (rr *URI) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 2 // Priority
        l += 2 // Weight
        l += len(rr.Target)
        return l
}

func (rr *X25) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += len(rr.PSDNAddress) + 1
        return l
}

func (rr *ZONEMD) len(off int, compression map[string]struct{}) int {
        l := rr.Hdr.len(off, compression)
        l += 4 // Serial
        l++    // Scheme
        l++    // Hash
        l += len(rr.Digest) / 2
        return l
}

// copy() functions
func (rr *A) copy() RR {
        return &A{rr.Hdr, cloneSlice(rr.A)}
}

func (rr *AAAA) copy() RR {
        return &AAAA{rr.Hdr, cloneSlice(rr.AAAA)}
}

func (rr *AFSDB) copy() RR {
        return &AFSDB{rr.Hdr, rr.Subtype, rr.Hostname}
}

func (rr *AMTRELAY) copy() RR {
        return &AMTRELAY{
                rr.Hdr,
                rr.Precedence,
                rr.GatewayType,
                cloneSlice(rr.GatewayAddr),
                rr.GatewayHost,
        }
}

func (rr *ANY) copy() RR {
        return &ANY{rr.Hdr}
}

func (rr *APL) copy() RR {
        Prefixes := make([]APLPrefix, len(rr.Prefixes))
        for i, e := range rr.Prefixes {
                Prefixes[i] = e.copy()
        }
        return &APL{rr.Hdr, Prefixes}
}

func (rr *AVC) copy() RR {
        return &AVC{rr.Hdr, cloneSlice(rr.Txt)}
}

func (rr *CAA) copy() RR {
        return &CAA{
                rr.Hdr,
                rr.Flag,
                rr.Tag,
                rr.Value,
        }
}

func (rr *CDNSKEY) copy() RR {
        return &CDNSKEY{*rr.DNSKEY.copy().(*DNSKEY)}
}

func (rr *CDS) copy() RR {
        return &CDS{*rr.DS.copy().(*DS)}
}

func (rr *CERT) copy() RR {
        return &CERT{
                rr.Hdr,
                rr.Type,
                rr.KeyTag,
                rr.Algorithm,
                rr.Certificate,
        }
}

func (rr *CNAME) copy() RR {
        return &CNAME{rr.Hdr, rr.Target}
}

func (rr *CSYNC) copy() RR {
        return &CSYNC{
                rr.Hdr,
                rr.Serial,
                rr.Flags,
                cloneSlice(rr.TypeBitMap),
        }
}

func (rr *DHCID) copy() RR {
        return &DHCID{rr.Hdr, rr.Digest}
}

func (rr *DLV) copy() RR {
        return &DLV{*rr.DS.copy().(*DS)}
}

func (rr *DNAME) copy() RR {
        return &DNAME{rr.Hdr, rr.Target}
}

func (rr *DNSKEY) copy() RR {
        return &DNSKEY{
                rr.Hdr,
                rr.Flags,
                rr.Protocol,
                rr.Algorithm,
                rr.PublicKey,
        }
}

func (rr *DS) copy() RR {
        return &DS{
                rr.Hdr,
                rr.KeyTag,
                rr.Algorithm,
                rr.DigestType,
                rr.Digest,
        }
}

func (rr *EID) copy() RR {
        return &EID{rr.Hdr, rr.Endpoint}
}

func (rr *EUI48) copy() RR {
        return &EUI48{rr.Hdr, rr.Address}
}

func (rr *EUI64) copy() RR {
        return &EUI64{rr.Hdr, rr.Address}
}

func (rr *GID) copy() RR {
        return &GID{rr.Hdr, rr.Gid}
}

func (rr *GPOS) copy() RR {
        return &GPOS{
                rr.Hdr,
                rr.Longitude,
                rr.Latitude,
                rr.Altitude,
        }
}

func (rr *HINFO) copy() RR {
        return &HINFO{rr.Hdr, rr.Cpu, rr.Os}
}

func (rr *HIP) copy() RR {
        return &HIP{
                rr.Hdr,
                rr.HitLength,
                rr.PublicKeyAlgorithm,
                rr.PublicKeyLength,
                rr.Hit,
                rr.PublicKey,
                cloneSlice(rr.RendezvousServers),
        }
}

func (rr *HTTPS) copy() RR {
        return &HTTPS{*rr.SVCB.copy().(*SVCB)}
}

func (rr *IPSECKEY) copy() RR {
        return &IPSECKEY{
                rr.Hdr,
                rr.Precedence,
                rr.GatewayType,
                rr.Algorithm,
                cloneSlice(rr.GatewayAddr),
                rr.GatewayHost,
                rr.PublicKey,
        }
}

func (rr *ISDN) copy() RR {
        return &ISDN{rr.Hdr, rr.Address, rr.SubAddress}
}

func (rr *KEY) copy() RR {
        return &KEY{*rr.DNSKEY.copy().(*DNSKEY)}
}

func (rr *KX) copy() RR {
        return &KX{rr.Hdr, rr.Preference, rr.Exchanger}
}

func (rr *L32) copy() RR {
        return &L32{rr.Hdr, rr.Preference, cloneSlice(rr.Locator32)}
}

func (rr *L64) copy() RR {
        return &L64{rr.Hdr, rr.Preference, rr.Locator64}
}

func (rr *LOC) copy() RR {
        return &LOC{
                rr.Hdr,
                rr.Version,
                rr.Size,
                rr.HorizPre,
                rr.VertPre,
                rr.Latitude,
                rr.Longitude,
                rr.Altitude,
        }
}

func (rr *LP) copy() RR {
        return &LP{rr.Hdr, rr.Preference, rr.Fqdn}
}

func (rr *MB) copy() RR {
        return &MB{rr.Hdr, rr.Mb}
}

func (rr *MD) copy() RR {
        return &MD{rr.Hdr, rr.Md}
}

func (rr *MF) copy() RR {
        return &MF{rr.Hdr, rr.Mf}
}

func (rr *MG) copy() RR {
        return &MG{rr.Hdr, rr.Mg}
}

func (rr *MINFO) copy() RR {
        return &MINFO{rr.Hdr, rr.Rmail, rr.Email}
}

func (rr *MR) copy() RR {
        return &MR{rr.Hdr, rr.Mr}
}

func (rr *MX) copy() RR {
        return &MX{rr.Hdr, rr.Preference, rr.Mx}
}

func (rr *NAPTR) copy() RR {
        return &NAPTR{
                rr.Hdr,
                rr.Order,
                rr.Preference,
                rr.Flags,
                rr.Service,
                rr.Regexp,
                rr.Replacement,
        }
}

func (rr *NID) copy() RR {
        return &NID{rr.Hdr, rr.Preference, rr.NodeID}
}

func (rr *NIMLOC) copy() RR {
        return &NIMLOC{rr.Hdr, rr.Locator}
}

func (rr *NINFO) copy() RR {
        return &NINFO{rr.Hdr, cloneSlice(rr.ZSData)}
}

func (rr *NS) copy() RR {
        return &NS{rr.Hdr, rr.Ns}
}

func (rr *NSAPPTR) copy() RR {
        return &NSAPPTR{rr.Hdr, rr.Ptr}
}

func (rr *NSEC) copy() RR {
        return &NSEC{rr.Hdr, rr.NextDomain, cloneSlice(rr.TypeBitMap)}
}

func (rr *NSEC3) copy() RR {
        return &NSEC3{
                rr.Hdr,
                rr.Hash,
                rr.Flags,
                rr.Iterations,
                rr.SaltLength,
                rr.Salt,
                rr.HashLength,
                rr.NextDomain,
                cloneSlice(rr.TypeBitMap),
        }
}

func (rr *NSEC3PARAM) copy() RR {
        return &NSEC3PARAM{
                rr.Hdr,
                rr.Hash,
                rr.Flags,
                rr.Iterations,
                rr.SaltLength,
                rr.Salt,
        }
}

func (rr *NULL) copy() RR {
        return &NULL{rr.Hdr, rr.Data}
}

func (rr *NXNAME) copy() RR {
        return &NXNAME{rr.Hdr}
}

func (rr *NXT) copy() RR {
        return &NXT{*rr.NSEC.copy().(*NSEC)}
}

func (rr *OPENPGPKEY) copy() RR {
        return &OPENPGPKEY{rr.Hdr, rr.PublicKey}
}

func (rr *OPT) copy() RR {
        Option := make([]EDNS0, len(rr.Option))
        for i, e := range rr.Option {
                Option[i] = e.copy()
        }
        return &OPT{rr.Hdr, Option}
}

func (rr *PTR) copy() RR {
        return &PTR{rr.Hdr, rr.Ptr}
}

func (rr *PX) copy() RR {
        return &PX{
                rr.Hdr,
                rr.Preference,
                rr.Map822,
                rr.Mapx400,
        }
}

func (rr *RFC3597) copy() RR {
        return &RFC3597{rr.Hdr, rr.Rdata}
}

func (rr *RKEY) copy() RR {
        return &RKEY{
                rr.Hdr,
                rr.Flags,
                rr.Protocol,
                rr.Algorithm,
                rr.PublicKey,
        }
}

func (rr *RP) copy() RR {
        return &RP{rr.Hdr, rr.Mbox, rr.Txt}
}

func (rr *RRSIG) copy() RR {
        return &RRSIG{
                rr.Hdr,
                rr.TypeCovered,
                rr.Algorithm,
                rr.Labels,
                rr.OrigTtl,
                rr.Expiration,
                rr.Inception,
                rr.KeyTag,
                rr.SignerName,
                rr.Signature,
        }
}

func (rr *RT) copy() RR {
        return &RT{rr.Hdr, rr.Preference, rr.Host}
}

func (rr *SIG) copy() RR {
        return &SIG{*rr.RRSIG.copy().(*RRSIG)}
}

func (rr *SMIMEA) copy() RR {
        return &SMIMEA{
                rr.Hdr,
                rr.Usage,
                rr.Selector,
                rr.MatchingType,
                rr.Certificate,
        }
}

func (rr *SOA) copy() RR {
        return &SOA{
                rr.Hdr,
                rr.Ns,
                rr.Mbox,
                rr.Serial,
                rr.Refresh,
                rr.Retry,
                rr.Expire,
                rr.Minttl,
        }
}

func (rr *SPF) copy() RR {
        return &SPF{rr.Hdr, cloneSlice(rr.Txt)}
}

func (rr *SRV) copy() RR {
        return &SRV{
                rr.Hdr,
                rr.Priority,
                rr.Weight,
                rr.Port,
                rr.Target,
        }
}

func (rr *SSHFP) copy() RR {
        return &SSHFP{
                rr.Hdr,
                rr.Algorithm,
                rr.Type,
                rr.FingerPrint,
        }
}

func (rr *SVCB) copy() RR {
        Value := make([]SVCBKeyValue, len(rr.Value))
        for i, e := range rr.Value {
                Value[i] = e.copy()
        }
        return &SVCB{
                rr.Hdr,
                rr.Priority,
                rr.Target,
                Value,
        }
}

func (rr *TA) copy() RR {
        return &TA{
                rr.Hdr,
                rr.KeyTag,
                rr.Algorithm,
                rr.DigestType,
                rr.Digest,
        }
}

func (rr *TALINK) copy() RR {
        return &TALINK{rr.Hdr, rr.PreviousName, rr.NextName}
}

func (rr *TKEY) copy() RR {
        return &TKEY{
                rr.Hdr,
                rr.Algorithm,
                rr.Inception,
                rr.Expiration,
                rr.Mode,
                rr.Error,
                rr.KeySize,
                rr.Key,
                rr.OtherLen,
                rr.OtherData,
        }
}

func (rr *TLSA) copy() RR {
        return &TLSA{
                rr.Hdr,
                rr.Usage,
                rr.Selector,
                rr.MatchingType,
                rr.Certificate,
        }
}

func (rr *TSIG) copy() RR {
        return &TSIG{
                rr.Hdr,
                rr.Algorithm,
                rr.TimeSigned,
                rr.Fudge,
                rr.MACSize,
                rr.MAC,
                rr.OrigId,
                rr.Error,
                rr.OtherLen,
                rr.OtherData,
        }
}

func (rr *TXT) copy() RR {
        return &TXT{rr.Hdr, cloneSlice(rr.Txt)}
}

func (rr *UID) copy() RR {
        return &UID{rr.Hdr, rr.Uid}
}

func (rr *UINFO) copy() RR {
        return &UINFO{rr.Hdr, rr.Uinfo}
}

func (rr *URI) copy() RR {
        return &URI{
                rr.Hdr,
                rr.Priority,
                rr.Weight,
                rr.Target,
        }
}

func (rr *X25) copy() RR {
        return &X25{rr.Hdr, rr.PSDNAddress}
}

func (rr *ZONEMD) copy() RR {
        return &ZONEMD{
                rr.Hdr,
                rr.Serial,
                rr.Scheme,
                rr.Hash,
                rr.Digest,
        }
}