Release 2019.3.2

The last known good commit is 6da3249dfb57fbaa16efafcd8744cee8809d80cd before the first release tag.

.gitignore

@@ -8,3 +8,4 @@ guide/public
 .vscode
 \#*\#
 cscope.*
+cloudflared

Gopkg.lock

@@ -186,12 +186,12 @@
   version = "v1.1.0"
 
 [[projects]]
-  digest = "1:8f8811f9be822914c3a25c6a071e93beb4c805d7b026cbf298bc577bc1cc945b"
+  digest = "1:582b704bebaa06b48c29b0cec224a6058a09c86883aaddabde889cd1a5f73e1b"
   name = "github.com/google/uuid"
   packages = ["."]
   pruneopts = "UT"
-  revision = "064e2069ce9c359c118179501254f67d7d37ba24"
-  version = "0.2"
+  revision = "0cd6bf5da1e1c83f8b45653022c74f71af0538a4"
+  version = "v1.1.1"
 
 [[projects]]
   digest = "1:c79fb010be38a59d657c48c6ba1d003a8aa651fa56b579d959d74573b7dff8e1"
@@ -281,12 +281,14 @@
   revision = "d3b731e9255b72d4571a5aac125634cf1b6031dc"
 
 [[projects]]
-  digest = "1:463e4140189f8194f9121ca1c7fe3b8e9e9a2ab3d949b43c835c21034927dc62"
+  digest = "1:73f788f2df39614dd7d9e75c8ca5fb8b4a68937b5e6d4a15e4c3a596f6f8c07b"
   name = "github.com/miekg/dns"
-  packages = ["."]
+  packages = [
+    ".",
+    "internal/socket",
+  ]
   pruneopts = "UT"
-  revision = "5a2b9fab83ff0f8bfc99684bd5f43a37abe560f1"
-  version = "v1.0.8"
+  revision = "6da3249dfb57fbaa16efafcd8744cee8809d80cd"
 
 [[projects]]
   branch = "master"
@@ -412,20 +414,15 @@
 
 [[projects]]
   branch = "master"
-  digest = "1:011ee76ffb757c7c91a3e61cf5d6f367d1fd5dd08e16a4e6ae688e7759f8509a"
+  digest = "1:9513f8a0f1f6918181b7d744225b1931ffacafeb57067a1c26893a51058afb80"
   name = "golang.org/x/net"
   packages = [
-    "bpf",
     "context",
     "http/httpguts",
     "http2",
     "http2/hpack",
     "idna",
-    "internal/iana",
-    "internal/socket",
     "internal/timeseries",
-    "ipv4",
-    "ipv6",
     "trace",
     "websocket",
   ]

Gopkg.toml

@@ -58,6 +58,10 @@
   name = "github.com/coredns/coredns"
   branch = "master"
 
+[[constraint]]
+  name = "github.com/miekg/dns"
+  revision = "6da3249dfb57fbaa16efafcd8744cee8809d80cd"
+
 [[constraint]]
   name = "github.com/cloudflare/brotli-go"
   branch = "master"

RELEASE_NOTES

@@ -1,3 +1,30 @@
+2019.3.2
+- 2019-03-22 TUN-1637: Free tunnels shouldn't require cert.pem
+- 2019-03-18 TUN-1604: Define Connect RPC call
+
+2019.3.1
+- 2019-03-09 Add rdp as a supported protocol in URL validation (#76)
+- 2019-03-15 TUN-1613: improved cloudflared RegisterTunnel fail metrics
+- 2019-03-17 TUN-1615: revert miekg/dns to last known working revision
+
+2019.3.0
+- 2018-12-28 make http transport aware of proxy from envvar
+- 2019-02-28 TUN-1559: fix nil dereference in TunnelConfig.CloseConnOnce
+- 2019-03-04 TUN-1451: Make non-interactive, non-service execution possible on Windows
+- 2019-03-04 TUN-1562: Refactor connectedSignal to be safe to close multiple times
+- 2019-02-27 TUN-1550: Add validation timeout for non-responsive origins
+- 2019-03-06 AUTH-1531: Named flags for ssh service tokens
+- 2019-02-14 Support unix sockets.
+- 2019-03-08 TUN-1389: Non-scalar flags in a cloudflared config.yml don't get logged
+- 2019-03-07 TUN-1522: If we can't get SRV from default resolver, get them from 1.1.1.1 DoT
+
+2019.2.1
+- 2019-02-14 TUN-1381:  should tell you if you're on the latest version rather than just exiting silently
+- 2019-02-15 TUN-1467: build with Go 1.11
+- 2019-02-15 AUTH-1519: Added logging
+- 2019-02-19 TUN-1525: cloudflared metrics for registration success/fail
+- 2019-02-19 TUN-1510: Wrap the close() in sync.Once.Do
+
 2019.2.0
 - 2019-01-24 AUTH-1462: better curl arg parsing
 - 2019-02-01 TUN-1456: Only make one UUID

carrier/carrier.go

@@ -46,6 +46,7 @@ func StartServer(logger *logrus.Logger, address, originURL string, shutdownC <-c
 		logger.WithError(err).Error("failed to start forwarding server")
 		return err
 	}
+	logger.Info("Started listening on ", address)
 	defer listener.Close()
 	for {
 		select {

cfsetup.yaml

@@ -1,4 +1,4 @@
-pinned_go: &pinned_go go=1.9.3-1
+pinned_go: &pinned_go go=1.11.5-1
 build_dir: &build_dir /cfsetup_build/src/github.com/cloudflare/cloudflared/
 stretch: &stretch
   build:
@@ -88,4 +88,4 @@ stretch: &stretch
       - export GOARCH=amd64
       - make test
 
-jessie: *stretch
+jessie: *stretch

cmd/cloudflared/access/carrier.go

@@ -22,6 +22,12 @@ func ssh(c *cli.Context) error {
 		return cli.ShowCommandHelp(c, "ssh")
 	}
 	headers := buildRequestHeaders(c.StringSlice("header"))
+	if c.IsSet("service-token-id") {
+		headers.Add("CF-Access-Client-Id", c.String("service-token-id"))
+	}
+	if c.IsSet("service-token-secret") {
+		headers.Add("CF-Access-Client-Secret", c.String("service-token-secret"))
+	}
 
 	if c.NArg() > 0 || c.IsSet("url") {
 		localForwarder, err := config.ValidateUrl(c)

cmd/cloudflared/access/cmd.go

@@ -93,14 +93,27 @@ func Commands() []*cli.Command {
 					Description: `The ssh subcommand sends data over a proxy to the Cloudflare edge.`,
 					Flags: []cli.Flag{
 						&cli.StringFlag{
-							Name: "hostname",
+							Name:  "hostname",
+							Usage: "specifics the hostname of your application.",
 						},
 						&cli.StringFlag{
-							Name: "url",
+							Name:  "url",
+							Usage: "specifics the host:port to forward data to Cloudflare edge.",
 						},
 						&cli.StringSliceFlag{
 							Name:    "header",
 							Aliases: []string{"H"},
+							Usage:   "specific additional headers you wish to send.",
+						},
+						&cli.StringSliceFlag{
+							Name:    "service-token-id",
+							Aliases: []string{"id"},
+							Usage:   "specific an Access service token ID you wish to use.",
+						},
+						&cli.StringSliceFlag{
+							Name:    "service-token-secret",
+							Aliases: []string{"secret"},
+							Usage:   "specific an Access service token secret you wish to use.",
 						},
 					},
 				},

cmd/cloudflared/config/configuration.go

@@ -63,7 +63,17 @@ func FindDefaultConfigPath() string {
 	return ""
 }
 
+// ValidateUnixSocket ensures --unix-socket param is used exclusively
+// i.e. it fails if a user specifies both --url and --unix-socket
+func ValidateUnixSocket(c *cli.Context) (string, error) {
+	if c.IsSet("unix-socket") && (c.IsSet("url") || c.NArg() > 0) {
+		return "", errors.New("--unix-socket must be used exclusivly.")
+	}
+	return c.String("unix-socket"), nil
+}
+
 // ValidateUrl will validate url flag correctness. It can be either from --url or argument
+// Notice ValidateUnixSocket, it will enforce --unix-socket is not used with --url or argument
 func ValidateUrl(c *cli.Context) (string, error) {
 	var url = c.String("url")
 	if c.NArg() > 0 {

cmd/cloudflared/tunnel/cmd.go

@@ -20,6 +20,7 @@ import (
 	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/origin"
+	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunneldns"
 	"github.com/cloudflare/cloudflared/websocket"
 	"github.com/coreos/go-systemd/daemon"
@@ -180,7 +181,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	var wg sync.WaitGroup
 	listeners := gracenet.Net{}
 	errC := make(chan error)
-	connectedSignal := make(chan struct{})
+	connectedSignal := signal.New(make(chan struct{}))
 	dnsReadySignal := make(chan struct{})
 
 	if c.String("config") == "" {
@@ -280,7 +281,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 
 	// Serve DNS proxy stand-alone if no hostname or tag or app is going to run
 	if dnsProxyStandAlone(c) {
-		close(connectedSignal)
+		connectedSignal.Notify()
 		// no grace period, handle SIGINT/SIGTERM immediately
 		return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, 0)
 	}
@@ -374,13 +375,13 @@ func waitToShutdown(wg *sync.WaitGroup,
 	return err
 }
 
-func notifySystemd(waitForSignal chan struct{}) {
-	<-waitForSignal
+func notifySystemd(waitForSignal *signal.Signal) {
+	<-waitForSignal.Wait()
 	daemon.SdNotify(false, "READY=1")
 }
 
-func writePidFile(waitForSignal chan struct{}, pidFile string) {
-	<-waitForSignal
+func writePidFile(waitForSignal *signal.Signal, pidFile string) {
+	<-waitForSignal.Wait()
 	file, err := os.Create(pidFile)
 	if err != nil {
 		logger.WithError(err).Errorf("Unable to write pid to %s", pidFile)
@@ -474,6 +475,12 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_URL"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "unix-socket",
+			Usage:   "Path to unix socket to use instead of --url",
+			EnvVars: []string{"TUNNEL_UNIX_SOCKET"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "hostname",
 			Usage:   "Set a hostname on a Cloudflare zone to route traffic through this tunnel.",

cmd/cloudflared/tunnel/configuration.go

@@ -1,6 +1,7 @@
 package tunnel
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/hex"
@@ -69,8 +70,16 @@ func logClientOptions(c *cli.Context) {
 	for _, flag := range c.LocalFlagNames() {
 		flags[flag] = c.Generic(flag)
 	}
+
+	sliceFlags := []string{"header", "tag", "proxy-dns-upstream", "upstream", "edge"}
+	for _, sliceFlag := range sliceFlags {
+		if len(c.StringSlice(sliceFlag)) > 0 {
+			flags[sliceFlag] = strings.Join(c.StringSlice(sliceFlag), ", ")
+		}
+	}
+
 	if len(flags) > 0 {
-		logger.Infof("Flags %v", flags)
+		logger.WithFields(flags).Info("Flags")
 	}
 
 	envs := make(map[string]string)
@@ -136,12 +145,18 @@ If you don't have a certificate signed by Cloudflare, run the command:
 	return originCert, nil
 }
 
-func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version string, logger, transportLogger *logrus.Logger) (*origin.TunnelConfig, error) {
+func prepareTunnelConfig(
+	c *cli.Context,
+	buildInfo *origin.BuildInfo,
+	version string, logger,
+	transportLogger *logrus.Logger,
+) (*origin.TunnelConfig, error) {
 	hostname, err := validation.ValidateHostname(c.String("hostname"))
 	if err != nil {
 		logger.WithError(err).Error("Invalid hostname")
 		return nil, errors.Wrap(err, "Invalid hostname")
 	}
+	isFreeTunnel := hostname == ""
 	clientID := c.String("id")
 	if !c.IsSet("id") {
 		clientID = generateRandomClientID()
@@ -160,11 +175,13 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		logger.WithError(err).Error("Error validating origin URL")
 		return nil, errors.Wrap(err, "Error validating origin URL")
 	}
-	logger.Infof("Proxying tunnel requests to %s", originURL)
 
-	originCert, err := getOriginCert(c)
-	if err != nil {
-		return nil, errors.Wrap(err, "Error getting origin cert")
+	var originCert []byte
+	if !isFreeTunnel {
+		originCert, err = getOriginCert(c)
+		if err != nil {
+			return nil, errors.Wrap(err, "Error getting origin cert")
+		}
 	}
 
 	originCertPool, err := loadCertPool(c, logger)
@@ -175,12 +192,7 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 
 	tunnelMetrics := origin.NewTunnelMetrics()
 	httpTransport := &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
-		DialContext: (&net.Dialer{
-			Timeout:   c.Duration("proxy-connect-timeout"),
-			KeepAlive: c.Duration("proxy-tcp-keepalive"),
-			DualStack: !c.Bool("proxy-no-happy-eyeballs"),
-		}).DialContext,
+		Proxy:                 http.ProxyFromEnvironment,
 		MaxIdleConns:          c.Int("proxy-keepalive-connections"),
 		IdleConnTimeout:       c.Duration("proxy-keepalive-timeout"),
 		TLSHandshakeTimeout:   c.Duration("proxy-tls-timeout"),
@@ -188,6 +200,29 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		TLSClientConfig:       &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: c.IsSet("no-tls-verify")},
 	}
 
+	dialContext := (&net.Dialer{
+		Timeout:   c.Duration("proxy-connect-timeout"),
+		KeepAlive: c.Duration("proxy-tcp-keepalive"),
+		DualStack: !c.Bool("proxy-no-happy-eyeballs"),
+	}).DialContext
+
+	if c.IsSet("unix-socket") {
+		unixSocket, err := config.ValidateUnixSocket(c)
+		if err != nil {
+			logger.WithError(err).Error("Error validating --unix-socket")
+			return nil, errors.Wrap(err, "Error validating --unix-socket")
+		}
+
+		logger.Infof("Proxying tunnel requests to unix:%s", unixSocket)
+		httpTransport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
+			// if --unix-socket specified, enforce network type "unix"
+			return dialContext(ctx, "unix", unixSocket)
+		}
+	} else {
+		logger.Infof("Proxying tunnel requests to %s", originURL)
+		httpTransport.DialContext = dialContext
+	}
+
 	if !c.IsSet("hello-world") && c.IsSet("origin-server-name") {
 		httpTransport.TLSClientConfig.ServerName = c.String("origin-server-name")
 	}
@@ -231,6 +266,7 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		NoChunkedEncoding:  c.Bool("no-chunked-encoding"),
 		CompressionQuality: c.Uint64("compression-quality"),
 		IncidentLookup:     origin.NewIncidentLookup(),
+		IsFreeTunnel:       isFreeTunnel,
 	}, nil
 }
 

cmd/cloudflared/updater/update.go

@@ -30,45 +30,56 @@ EKx0BZogHSor9Wy5VztdFaAaVbsJiCbO
 	logger = log.CreateLogger()
 )
 
-type ReleaseInfo struct {
+type UpdateOutcome struct {
 	Updated bool
 	Version string
 	Error   error
 }
 
-func checkForUpdates() ReleaseInfo {
+func (uo *UpdateOutcome) noUpdate() bool {
+	return uo.Error != nil && uo.Updated == false
+}
+
+func checkForUpdateAndApply() UpdateOutcome {
 	var opts equinox.Options
 	if err := opts.SetPublicKeyPEM(publicKey); err != nil {
-		return ReleaseInfo{Error: err}
+		return UpdateOutcome{Error: err}
 	}
 
 	resp, err := equinox.Check(appID, opts)
 	switch {
 	case err == equinox.NotAvailableErr:
-		return ReleaseInfo{}
+		return UpdateOutcome{}
 	case err != nil:
-		return ReleaseInfo{Error: err}
+		return UpdateOutcome{Error: err}
 	}
 
 	err = resp.Apply()
 	if err != nil {
-		return ReleaseInfo{Error: err}
+		return UpdateOutcome{Error: err}
 	}
 
-	return ReleaseInfo{Updated: true, Version: resp.ReleaseVersion}
+	return UpdateOutcome{Updated: true, Version: resp.ReleaseVersion}
 }
 
 func Update(_ *cli.Context) error {
-	if updateApplied() {
-		os.Exit(64)
+	updateOutcome := loggedUpdate()
+	if updateOutcome.Error != nil {
+		os.Exit(10)
 	}
-	return nil
+
+	if updateOutcome.noUpdate() {
+		logger.Infof("cloudflared is up to date (%s)", updateOutcome.Version)
+	}
+
+	return updateOutcome.Error
 }
 
 func Autoupdate(freq time.Duration, listeners *gracenet.Net, shutdownC chan struct{}) error {
 	tickC := time.Tick(freq)
 	for {
-		if updateApplied() {
+		updateOutcome := loggedUpdate()
+		if updateOutcome.Updated {
 			os.Args = append(os.Args, "--is-autoupdated=true")
 			pid, err := listeners.StartProcess()
 			if err != nil {
@@ -88,16 +99,17 @@ func Autoupdate(freq time.Duration, listeners *gracenet.Net, shutdownC chan stru
 	}
 }
 
-func updateApplied() bool {
-	releaseInfo := checkForUpdates()
-	if releaseInfo.Updated {
-		logger.Infof("Updated to version %s", releaseInfo.Version)
-		return true
+// Checks for an update and applies it if one is available
+func loggedUpdate() UpdateOutcome {
+	updateOutcome := checkForUpdateAndApply()
+	if updateOutcome.Updated {
+		logger.Infof("cloudflared has been updated to version %s", updateOutcome.Version)
 	}
-	if releaseInfo.Error != nil {
-		logger.WithError(releaseInfo.Error).Error("Update check failed")
+	if updateOutcome.Error != nil {
+		logger.WithError(updateOutcome.Error).Error("update check failed")
 	}
-	return false
+
+	return updateOutcome
 }
 
 func IsAutoupdateEnabled(c *cli.Context) bool {

cmd/cloudflared/windows_service.go

@@ -8,6 +8,7 @@ package main
 import (
 	"fmt"
 	"os"
+	"syscall"
 	"time"
 	"unsafe"
 
@@ -30,6 +31,10 @@ const (
 	// not defined in golang.org/x/sys/windows package
 	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms681988(v=vs.85).aspx
 	serviceConfigFailureActionsFlag = 4
+
+	// ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
+	// https://docs.microsoft.com/en-us/windows/desktop/debug/system-error-codes--1000-1299-
+	serviceControllerConnectionFailure = 1063
 )
 
 func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
@@ -50,16 +55,48 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 		},
 	})
 
+	// `IsAnInteractiveSession()` isn't exactly equivalent to "should the
+	// process run as a normal EXE?" There are legitimate non-service cases,
+	// like running cloudflared in a GCP startup script, for which
+	// `IsAnInteractiveSession()` returns false. For more context, see:
+	//     https://github.com/judwhite/go-svc/issues/6
+	// It seems that the "correct way" to check "is this a normal EXE?" is:
+	//     1. attempt to connect to the Service Control Manager
+	//     2. get ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
+	// This involves actually trying to start the service.
+
 	isIntSess, err := svc.IsAnInteractiveSession()
 	if err != nil {
 		logger.Fatalf("failed to determine if we are running in an interactive session: %v", err)
 	}
-
 	if isIntSess {
 		app.Run(os.Args)
 		return
 	}
 
+	// Run executes service name by calling windowsService which is a Handler
+	// interface that implements Execute method.
+	// It will set service status to stop after Execute returns
+	err = svc.Run(windowsServiceName, &windowsService{app: app, shutdownC: shutdownC, graceShutdownC: graceShutdownC})
+	if err != nil {
+		if errno, ok := err.(syscall.Errno); ok && int(errno) == serviceControllerConnectionFailure {
+			// Hack: assume this is a false negative from the IsAnInteractiveSession() check above.
+			// Run the app in "interactive" mode anyway.
+			app.Run(os.Args)
+			return
+		}
+		logger.Fatalf("%s service failed: %v", windowsServiceName, err)
+	}
+}
+
+type windowsService struct {
+	app            *cli.App
+	shutdownC      chan struct{}
+	graceShutdownC chan struct{}
+}
+
+// called by the package code at the start of the service
+func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
 	elog, err := eventlog.Open(windowsServiceName)
 	if err != nil {
 		logger.WithError(err).Errorf("Cannot open event log for %s", windowsServiceName)
@@ -68,26 +105,10 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 	defer elog.Close()
 
 	elog.Info(1, fmt.Sprintf("%s service starting", windowsServiceName))
-	// Run executes service name by calling windowsService which is a Handler
-	// interface that implements Execute method.
-	// It will set service status to stop after Execute returns
-	err = svc.Run(windowsServiceName, &windowsService{app: app, elog: elog, shutdownC: shutdownC, graceShutdownC: graceShutdownC})
-	if err != nil {
-		elog.Error(1, fmt.Sprintf("%s service failed: %v", windowsServiceName, err))
-		return
-	}
-	elog.Info(1, fmt.Sprintf("%s service stopped", windowsServiceName))
-}
+	defer func() {
+		elog.Info(1, fmt.Sprintf("%s service stopped", windowsServiceName))
+	}()
 
-type windowsService struct {
-	app            *cli.App
-	elog           *eventlog.Log
-	shutdownC      chan struct{}
-	graceShutdownC chan struct{}
-}
-
-// called by the package code at the start of the service
-func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
 	// the arguments passed here are only meaningful if they were manually
 	// specified by the user, e.g. using the Services console or `sc start`.
 	// https://docs.microsoft.com/en-us/windows/desktop/services/service-entry-point
@@ -99,7 +120,7 @@ func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeReques
 		// fall back to the arguments from ImagePath (or, as sc calls it, binPath)
 		args = os.Args
 	}
-	s.elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
+	elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
 
 	const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
 	statusChan <- svc.Status{State: svc.StartPending}
@@ -114,26 +135,26 @@ func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeReques
 		case c := <-r:
 			switch c.Cmd {
 			case svc.Interrogate:
-				s.elog.Info(1, fmt.Sprintf("control request 1 #%d", c))
+				elog.Info(1, fmt.Sprintf("control request 1 #%d", c))
 				statusChan <- c.CurrentStatus
 			case svc.Stop:
-				s.elog.Info(1, "received stop control request")
+				elog.Info(1, "received stop control request")
 				close(s.graceShutdownC)
 				statusChan <- svc.Status{State: svc.StopPending}
 			case svc.Shutdown:
-				s.elog.Info(1, "received shutdown control request")
+				elog.Info(1, "received shutdown control request")
 				close(s.shutdownC)
 				statusChan <- svc.Status{State: svc.StopPending}
 			default:
-				s.elog.Error(1, fmt.Sprintf("unexpected control request #%d", c))
+				elog.Error(1, fmt.Sprintf("unexpected control request #%d", c))
 			}
 		case err := <-errC:
 			ssec = true
 			if err != nil {
-				s.elog.Error(1, fmt.Sprintf("cloudflared terminated with error %v", err))
+				elog.Error(1, fmt.Sprintf("cloudflared terminated with error %v", err))
 				errno = 1
 			} else {
-				s.elog.Info(1, "cloudflared terminated without error")
+				elog.Info(1, "cloudflared terminated without error")
 				errno = 0
 			}
 			return

origin/discovery.go

@@ -1,8 +1,14 @@
 package origin
 
 import (
+	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
+	"time"
+
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
 )
 
 const (
@@ -10,9 +16,25 @@ const (
 	srvService = "warp"
 	srvProto   = "tcp"
 	srvName    = "cloudflarewarp.com"
+
+	// Used to fallback to DoT when we can't use the default resolver to
+	// discover HA Warp servers (GitHub issue #75).
+	dotServerName = "cloudflare-dns.com"
+	dotServerAddr = "1.1.1.1:853"
+	dotTimeout    = time.Duration(15 * time.Second)
 )
 
-func ResolveEdgeIPs(addresses []string) ([]*net.TCPAddr, error) {
+var friendlyDNSErrorLines = []string{
+	`Please try the following things to diagnose this issue:`,
+	`  1. ensure that cloudflarewarp.com is returning "warp" service records.`,
+	`     Run your system's equivalent of: dig srv _warp._tcp.cloudflarewarp.com`,
+	`  2. ensure that your DNS resolver is not returning compressed SRV records.`,
+	`     See GitHub issue https://github.com/golang/go/issues/27546`,
+	`     For example, you could use Cloudflare's 1.1.1.1 as your resolver:`,
+	`     https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/`,
+}
+
+func ResolveEdgeIPs(logger *log.Logger, addresses []string) ([]*net.TCPAddr, error) {
 	if len(addresses) > 0 {
 		var tcpAddrs []*net.TCPAddr
 		for _, address := range addresses {
@@ -28,7 +50,30 @@ func ResolveEdgeIPs(addresses []string) ([]*net.TCPAddr, error) {
 	// HA service discovery lookup
 	_, addrs, err := net.LookupSRV(srvService, srvProto, srvName)
 	if err != nil {
-		return nil, err
+		// Try to fall back to DoT from Cloudflare directly.
+		//
+		// Note: Instead of DoT, we could also have used DoH. Either of these:
+		//     - directly via the JSON API (https://1.1.1.1/dns-query?ct=application/dns-json&name=_warp._tcp.cloudflarewarp.com&type=srv)
+		//     - indirectly via `tunneldns.NewUpstreamHTTPS()`
+		// But both of these cases miss out on a key feature from the stdlib:
+		//     "The returned records are sorted by priority and randomized by weight within a priority."
+		//     (https://golang.org/pkg/net/#Resolver.LookupSRV)
+		// Does this matter? I don't know. It may someday. Let's use DoT so we don't need to worry about it.
+		// See also: Go feature request for stdlib-supported DoH: https://github.com/golang/go/issues/27552
+		r := fallbackResolver(dotServerName, dotServerAddr)
+		ctx, cancel := context.WithTimeout(context.Background(), dotTimeout)
+		defer cancel()
+		_, fallbackAddrs, fallbackErr := r.LookupSRV(ctx, srvService, srvProto, srvName)
+		if fallbackErr != nil || len(fallbackAddrs) == 0 {
+			// use the original DNS error `err` in messages, not `fallbackErr`
+			logger.Errorln("Error looking up Cloudflare edge IPs: the DNS query failed:", err)
+			for _, s := range friendlyDNSErrorLines {
+				logger.Errorln(s)
+			}
+			return nil, errors.Wrap(err, "Could not lookup srv records on _warp._tcp.cloudflarewarp.com")
+		}
+		// Accept the fallback results and keep going
+		addrs = fallbackAddrs
 	}
 	var resolvedIPsPerCNAME [][]*net.TCPAddr
 	var lookupErr error
@@ -80,3 +125,19 @@ func FlattenServiceIPs(ipsByService [][]*net.TCPAddr) []*net.TCPAddr {
 	}
 	return result
 }
+
+// Inspiration: https://github.com/artyom/dot/blob/master/dot.go
+func fallbackResolver(serverName, serverAddress string) *net.Resolver {
+	return &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, _ string, _ string) (net.Conn, error) {
+			var dialer net.Dialer
+			conn, err := dialer.DialContext(ctx, "tcp", serverAddress)
+			if err != nil {
+				return nil, err
+			}
+			tlsConfig := &tls.Config{ServerName: serverName}
+			return tls.Client(conn, tlsConfig), nil
+		},
+	}
+}

origin/metrics.go

@@ -51,6 +51,10 @@ type TunnelMetrics struct {
 	// oldServerLocations stores the last server the tunnel was connected to
 	oldServerLocations map[string]string
 
+	regSuccess prometheus.Counter
+	regFail    *prometheus.CounterVec
+	rpcFail    *prometheus.CounterVec
+
 	muxerMetrics *muxerMetrics
 	tunnelsHA    tunnelsForHA
 }
@@ -342,6 +346,31 @@ func NewTunnelMetrics() *TunnelMetrics {
 	)
 	prometheus.MustRegister(serverLocations)
 
+	rpcFail := prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "tunnel_rpc_fail",
+			Help: "Count of RPC connection errors by type",
+		},
+		[]string{"error"},
+	)
+	prometheus.MustRegister(rpcFail)
+
+	registerFail := prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "tunnel_register_fail",
+			Help: "Count of tunnel registration errors by type",
+		},
+		[]string{"error"},
+	)
+	prometheus.MustRegister(registerFail)
+
+	registerSuccess := prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Name: "tunnel_register_success",
+			Help: "Count of successful tunnel registrations",
+		})
+	prometheus.MustRegister(registerSuccess)
+
 	return &TunnelMetrics{
 		haConnections:                  haConnections,
 		totalRequests:                  totalRequests,
@@ -357,6 +386,9 @@ func NewTunnelMetrics() *TunnelMetrics {
 		oldServerLocations:             make(map[string]string),
 		muxerMetrics:                   newMuxerMetrics(),
 		tunnelsHA:                      NewTunnelsForHA(),
+		regSuccess:                     registerSuccess,
+		regFail:                        registerFail,
+		rpcFail:                        rpcFail,
 	}
 }
 

origin/supervisor.go

@@ -6,6 +6,8 @@ import (
 	"net"
 	"time"
 
+	"github.com/cloudflare/cloudflared/signal"
+
 	"github.com/google/uuid"
 )
 
@@ -51,7 +53,7 @@ func NewSupervisor(config *TunnelConfig) *Supervisor {
 	}
 }
 
-func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) error {
+func (s *Supervisor) Run(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) error {
 	logger := s.config.Logger
 	if err := s.initialize(ctx, connectedSignal, u); err != nil {
 		return err
@@ -120,9 +122,9 @@ func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}, u u
 	}
 }
 
-func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) error {
+func (s *Supervisor) initialize(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) error {
 	logger := s.config.Logger
-	edgeIPs, err := ResolveEdgeIPs(s.config.EdgeAddrs)
+	edgeIPs, err := ResolveEdgeIPs(logger, s.config.EdgeAddrs)
 	if err != nil {
 		logger.Infof("ResolveEdgeIPs err")
 		return err
@@ -143,11 +145,12 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 		return fmt.Errorf("context was canceled")
 	case tunnelError := <-s.tunnelErrors:
 		return tunnelError.err
-	case <-connectedSignal:
+	case <-connectedSignal.Wait():
 	}
 	// At least one successful connection, so start the rest
 	for i := 1; i < s.config.HAConnections; i++ {
-		go s.startTunnel(ctx, i, make(chan struct{}), u)
+		ch := signal.New(make(chan struct{}))
+		go s.startTunnel(ctx, i, ch, u)
 		time.Sleep(registrationInterval)
 	}
 	return nil
@@ -155,7 +158,7 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 
 // startTunnel starts the first tunnel connection. The resulting error will be sent on
 // s.tunnelErrors. It will send a signal via connectedSignal if registration succeed
-func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) {
+func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) {
 	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal, u)
 	defer func() {
 		s.tunnelErrors <- tunnelError{index: 0, err: err}
@@ -183,17 +186,17 @@ func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan
 
 // startTunnel starts a new tunnel connection. The resulting error will be sent on
 // s.tunnelErrors.
-func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal chan struct{}, u uuid.UUID) {
+func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal *signal.Signal, u uuid.UUID) {
 	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(index), uint8(index), connectedSignal, u)
 	s.tunnelErrors <- tunnelError{index: index, err: err}
 }
 
-func (s *Supervisor) newConnectedTunnelSignal(index int) chan struct{} {
-	signal := make(chan struct{})
-	s.tunnelsConnecting[index] = signal
-	s.nextConnectedSignal = signal
+func (s *Supervisor) newConnectedTunnelSignal(index int) *signal.Signal {
+	sig := make(chan struct{})
+	s.tunnelsConnecting[index] = sig
+	s.nextConnectedSignal = sig
 	s.nextConnectedIndex = index
-	return signal
+	return signal.New(sig)
 }
 
 func (s *Supervisor) waitForNextTunnel(index int) bool {
@@ -220,7 +223,7 @@ func (s *Supervisor) refreshEdgeIPs() {
 	}
 	s.resolverC = make(chan resolveResult)
 	go func() {
-		edgeIPs, err := ResolveEdgeIPs(s.config.EdgeAddrs)
+		edgeIPs, err := ResolveEdgeIPs(s.config.Logger, s.config.EdgeAddrs)
 		s.resolverC <- resolveResult{edgeIPs: edgeIPs, err: err}
 	}()
 }

origin/tunnel.go

@@ -11,11 +11,11 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
-	"golang.org/x/sync/errgroup"
-
 	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/validation"
@@ -24,8 +24,10 @@ import (
 	raven "github.com/getsentry/raven-go"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
 	_ "github.com/prometheus/client_golang/prometheus"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
 	rpc "zombiezen.com/go/capnproto2/rpc"
 )
 
@@ -37,8 +39,10 @@ const (
 )
 
 type TunnelConfig struct {
+	// OriginUrl may not be used if a user specifies a unix socket.
+	OriginUrl string
+
 	EdgeAddrs          []string
-	OriginUrl          string
 	Hostname           string
 	OriginCert         []byte
 	TlsConfig          *tls.Config
@@ -64,6 +68,8 @@ type TunnelConfig struct {
 	WSGI               bool
 	CompressionQuality uint64
 	IncidentLookup     IncidentLookup
+	CloseConnOnce      *sync.Once // Used to close connectedSignal no more than once
+	IsFreeTunnel       bool
 }
 
 type dialError struct {
@@ -101,6 +107,11 @@ type clientRegisterTunnelError struct {
 	cause error
 }
 
+func newClientRegisterTunnelError(cause error, counter *prometheus.CounterVec) clientRegisterTunnelError {
+	counter.WithLabelValues(cause.Error()).Inc()
+	return clientRegisterTunnelError{cause: cause}
+}
+
 func (e clientRegisterTunnelError) Error() string {
 	return e.cause.Error()
 }
@@ -126,7 +137,7 @@ func (c *TunnelConfig) RegistrationOptions(connectionID uint8, OriginLocalIP str
 	}
 }
 
-func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connectedSignal chan struct{}) error {
+func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connectedSignal *signal.Signal) error {
 	ctx, cancel := context.WithCancel(context.Background())
 	go func() {
 		<-shutdownC
@@ -142,7 +153,7 @@ func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connecte
 	if config.HAConnections > 1 {
 		return NewSupervisor(config).Run(ctx, connectedSignal, u)
 	} else {
-		addrs, err := ResolveEdgeIPs(config.EdgeAddrs)
+		addrs, err := ResolveEdgeIPs(config.Logger, config.EdgeAddrs)
 		if err != nil {
 			return err
 		}
@@ -154,18 +165,17 @@ func ServeTunnelLoop(ctx context.Context,
 	config *TunnelConfig,
 	addr *net.TCPAddr,
 	connectionID uint8,
-	connectedSignal chan struct{},
+	connectedSignal *signal.Signal,
 	u uuid.UUID,
 ) error {
 	logger := config.Logger
 	config.Metrics.incrementHaConnections()
 	defer config.Metrics.decrementHaConnections()
 	backoff := BackoffHandler{MaxRetries: config.Retries}
-	// Used to close connectedSignal no more than once
 	connectedFuse := h2mux.NewBooleanFuse()
 	go func() {
 		if connectedFuse.Await() {
-			close(connectedSignal)
+			connectedSignal.Notify()
 		}
 	}()
 	// Ensure the above goroutine will terminate if we return without connecting
@@ -320,11 +330,11 @@ func RegisterTunnel(
 	}, nil)
 	if err != nil {
 		// RPC stream open error
-		return clientRegisterTunnelError{cause: err}
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail)
 	}
 	if !IsRPCStreamResponse(stream.Headers) {
 		// stream response error
-		return clientRegisterTunnelError{cause: err}
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail)
 	}
 	conn := rpc.NewConn(
 		tunnelrpc.NewTransportLogger(config.TransportLogger.WithField("subsystem", "rpc-register"), rpc.StreamTransport(stream)),
@@ -346,18 +356,14 @@ func RegisterTunnel(
 	LogServerInfo(serverInfoPromise.Result(), connectionID, config.Metrics, config.Logger)
 	if err != nil {
 		// RegisterTunnel RPC failure
-		return clientRegisterTunnelError{cause: err}
+		return newClientRegisterTunnelError(err, config.Metrics.regFail)
 	}
 	for _, logLine := range registration.LogLines {
 		config.Logger.Info(logLine)
 	}
-	if registration.Err == DuplicateConnectionError {
-		return dupConnRegisterTunnelError{}
-	} else if registration.Err != "" {
-		return serverRegisterTunnelError{
-			cause:     fmt.Errorf("Server error: %s", registration.Err),
-			permanent: registration.PermanentFailure,
-		}
+
+	if regErr := processRegisterTunnelError(registration.Err, registration.PermanentFailure, config.Metrics); regErr != nil {
+		return regErr
 	}
 
 	if registration.TunnelID != "" {
@@ -381,6 +387,22 @@ func RegisterTunnel(
 	return nil
 }
 
+func processRegisterTunnelError(err string, permanentFailure bool, metrics *TunnelMetrics) error {
+	if err == "" {
+		metrics.regSuccess.Inc()
+		return nil
+	}
+
+	metrics.regFail.WithLabelValues(err).Inc()
+	if err == DuplicateConnectionError {
+		return dupConnRegisterTunnelError{}
+	}
+	return serverRegisterTunnelError{
+		cause:     fmt.Errorf("Server error: %s", err),
+		permanent: permanentFailure,
+	}
+}
+
 func UnregisterTunnel(muxer *h2mux.Muxer, gracePeriod time.Duration, logger *log.Logger) error {
 	logger.Debug("initiating RPC stream to unregister")
 	stream, err := muxer.OpenStream([]h2mux.Header{

signal/safe_signal.go

@@ -0,0 +1,33 @@
+package signal
+
+import (
+	"sync"
+)
+
+// Signal lets goroutines signal that some event has occurred. Other goroutines can wait for the signal.
+type Signal struct {
+	ch   chan struct{}
+	once sync.Once
+}
+
+// New wraps a channel and turns it into a signal for a one-time event.
+func New(ch chan struct{}) *Signal {
+	return &Signal{
+		ch:   ch,
+		once: sync.Once{},
+	}
+}
+
+// Notify alerts any goroutines waiting on this signal that the event has occurred.
+// After the first call to Notify(), future calls are no-op.
+func (s *Signal) Notify() {
+	s.once.Do(func() {
+		close(s.ch)
+	})
+}
+
+// Wait returns a channel which will be written to when Notify() is called for the first time.
+// This channel will never be written to a second time.
+func (s *Signal) Wait() <-chan struct{} {
+	return s.ch
+}

signal/safe_signal_test.go

@@ -0,0 +1,25 @@
+package signal
+
+import (
+	"testing"
+)
+
+func TestMultiNotifyDoesntCrash(t *testing.T) {
+	sig := New(make(chan struct{}))
+	sig.Notify()
+	sig.Notify()
+	// If code has reached here without crashing, the test has passed.
+}
+
+func TestWait(t *testing.T) {
+	sig := New(make(chan struct{}))
+	sig.Notify()
+	select {
+	case <-sig.Wait():
+		// Test succeeds
+		return
+	default:
+		// sig.Wait() should have been read from, because sig.Notify() wrote to it.
+		t.Fail()
+	}
+}

tunneldns/https_upstream.go

@@ -39,6 +39,7 @@ func NewUpstreamHTTPS(endpoint string) (Upstream, error) {
 		TLSClientConfig:    tls,
 		DisableCompression: true,
 		MaxIdleConns:       1,
+		Proxy:              http.ProxyFromEnvironment,
 	}
 	http2.ConfigureTransport(transport)
 

tunnelrpc/pogs/tunnelrpc.go

@@ -2,8 +2,10 @@ package pogs
 
 import (
 	"context"
+	"time"
 
 	"github.com/cloudflare/cloudflared/tunnelrpc"
+	"github.com/google/uuid"
 
 	log "github.com/sirupsen/logrus"
 	"zombiezen.com/go/capnproto2"
@@ -71,6 +73,80 @@ func UnmarshalRegistrationOptions(s tunnelrpc.RegistrationOptions) (*Registratio
 	return p, err
 }
 
+type ServerHello struct {
+	ConnectResult *ConnectResult
+	CloudflaredID uuid.UUID
+}
+
+// CapnpServerHello is ServerHello respresented in Cap'n Proto build-in types
+type CapnpServerHello struct {
+	ConnectResult *ConnectResult
+	CloudflaredID []byte
+}
+
+func MarshalServerHello(s tunnelrpc.CapnpServerHello, p *ServerHello) error {
+	cloudflaredIDBytes, err := p.CloudflaredID.MarshalBinary()
+	if err != nil {
+		return err
+	}
+	capnpServerHello := &CapnpServerHello{
+		ConnectResult: p.ConnectResult,
+		CloudflaredID: cloudflaredIDBytes,
+	}
+	return pogs.Insert(tunnelrpc.CapnpServerHello_TypeID, s.Struct, capnpServerHello)
+}
+
+func UnmarshalServerHello(s tunnelrpc.CapnpServerHello) (*ServerHello, error) {
+	p := new(CapnpServerHello)
+	err := pogs.Extract(p, tunnelrpc.CapnpServerHello_TypeID, s.Struct)
+	if err != nil {
+		return nil, err
+	}
+	cloudflaredID, err := uuid.FromBytes(p.CloudflaredID)
+	if err != nil {
+		log.Errorf("fail to unmarshal %+v", p.CloudflaredID)
+		return nil, err
+	}
+	return &ServerHello{
+		ConnectResult: p.ConnectResult,
+		CloudflaredID: cloudflaredID,
+	}, nil
+}
+
+type ConnectResult struct {
+	Err        *ConnectError
+	ServerInfo ServerInfo
+}
+
+func MarshalConnectResult(s tunnelrpc.ConnectResult, p *ConnectResult) error {
+	return pogs.Insert(tunnelrpc.ConnectResult_TypeID, s.Struct, p)
+}
+
+func UnmarshalConnectResult(s tunnelrpc.ConnectResult) (*ConnectResult, error) {
+	p := new(ConnectResult)
+	err := pogs.Extract(p, tunnelrpc.ConnectResult_TypeID, s.Struct)
+	return p, err
+}
+
+type ConnectError struct {
+	Cause      string
+	RetryAfter time.Duration
+}
+
+func MarshalConnectError(s tunnelrpc.ConnectError, p *ConnectError) error {
+	return pogs.Insert(tunnelrpc.ConnectError_TypeID, s.Struct, p)
+}
+
+func UnmarshalConnectError(s tunnelrpc.ConnectError) (*ConnectError, error) {
+	p := new(ConnectError)
+	err := pogs.Extract(p, tunnelrpc.ConnectError_TypeID, s.Struct)
+	return p, err
+}
+
+func (e *ConnectError) Error() string {
+	return e.Cause
+}
+
 type Tag struct {
 	Name  string `json:"name"`
 	Value string `json:"value"`
@@ -90,10 +166,71 @@ func UnmarshalServerInfo(s tunnelrpc.ServerInfo) (*ServerInfo, error) {
 	return p, err
 }
 
+type HelloParameters struct {
+	OriginCert          []byte
+	Tags                []Tag
+	NumPreviousAttempts uint8
+}
+
+func MarshalHelloParameters(s tunnelrpc.HelloParameters, p *HelloParameters) error {
+	return pogs.Insert(tunnelrpc.HelloParameters_TypeID, s.Struct, p)
+}
+
+func UnmarshalHelloParameters(s tunnelrpc.HelloParameters) (*HelloParameters, error) {
+	p := new(HelloParameters)
+	err := pogs.Extract(p, tunnelrpc.HelloParameters_TypeID, s.Struct)
+	return p, err
+}
+
+type ConnectParameters struct {
+	OriginCert          []byte
+	CloudflaredID       uuid.UUID
+	NumPreviousAttempts uint8
+}
+
+// CapnpConnectParameters is ConnectParameters represented in Cap'n Proto build-in types
+type CapnpConnectParameters struct {
+	OriginCert          []byte
+	CloudflaredID       []byte
+	NumPreviousAttempts uint8
+}
+
+func MarshalConnectParameters(s tunnelrpc.CapnpConnectParameters, p *ConnectParameters) error {
+	cloudflaredIDBytes, err := p.CloudflaredID.MarshalBinary()
+	if err != nil {
+		return err
+	}
+	capnpConnectParameters := &CapnpConnectParameters{
+		OriginCert:          p.OriginCert,
+		CloudflaredID:       cloudflaredIDBytes,
+		NumPreviousAttempts: p.NumPreviousAttempts,
+	}
+	return pogs.Insert(tunnelrpc.CapnpConnectParameters_TypeID, s.Struct, capnpConnectParameters)
+}
+
+func UnmarshalConnectParameters(s tunnelrpc.CapnpConnectParameters) (*ConnectParameters, error) {
+	p := new(CapnpConnectParameters)
+	err := pogs.Extract(p, tunnelrpc.CapnpConnectParameters_TypeID, s.Struct)
+	if err != nil {
+		return nil, err
+	}
+	cloudflaredID, err := uuid.FromBytes(p.CloudflaredID)
+	if err != nil {
+		return nil, err
+	}
+	return &ConnectParameters{
+		OriginCert:          p.OriginCert,
+		CloudflaredID:       cloudflaredID,
+		NumPreviousAttempts: p.NumPreviousAttempts,
+	}, nil
+}
+
 type TunnelServer interface {
 	RegisterTunnel(ctx context.Context, originCert []byte, hostname string, options *RegistrationOptions) (*TunnelRegistration, error)
 	GetServerInfo(ctx context.Context) (*ServerInfo, error)
 	UnregisterTunnel(ctx context.Context, gracePeriodNanoSec int64) error
+	Hello(ctx context.Context, parameters *HelloParameters) (*ServerHello, error)
+	Connect(ctx context.Context, paramaters *ConnectParameters) (*ConnectResult, error)
 }
 
 func TunnelServer_ServerToClient(s TunnelServer) tunnelrpc.TunnelServer {
@@ -151,7 +288,48 @@ func (i TunnelServer_PogsImpl) UnregisterTunnel(p tunnelrpc.TunnelServer_unregis
 	gracePeriodNanoSec := p.Params.GracePeriodNanoSec()
 	server.Ack(p.Options)
 	return i.impl.UnregisterTunnel(p.Ctx, gracePeriodNanoSec)
+}
 
+func (i TunnelServer_PogsImpl) Hello(p tunnelrpc.TunnelServer_hello) error {
+	parameters, err := p.Params.Parameters()
+	if err != nil {
+		return err
+	}
+	pogsParameters, err := UnmarshalHelloParameters(parameters)
+	if err != nil {
+		return err
+	}
+	server.Ack(p.Options)
+	serverHello, err := i.impl.Hello(p.Ctx, pogsParameters)
+	if err != nil {
+		return err
+	}
+	result, err := p.Results.NewResult()
+	if err != nil {
+		return err
+	}
+	return MarshalServerHello(result, serverHello)
+}
+
+func (i TunnelServer_PogsImpl) Connect(p tunnelrpc.TunnelServer_connect) error {
+	paramaters, err := p.Params.Parameters()
+	if err != nil {
+		return err
+	}
+	pogsParameters, err := UnmarshalConnectParameters(paramaters)
+	if err != nil {
+		return err
+	}
+	server.Ack(p.Options)
+	connectResult, err := i.impl.Connect(p.Ctx, pogsParameters)
+	if err != nil {
+		return err
+	}
+	result, err := p.Results.NewResult()
+	if err != nil {
+		return err
+	}
+	return MarshalConnectResult(result, connectResult)
 }
 
 type TunnelServer_PogsClient struct {
@@ -212,3 +390,47 @@ func (c TunnelServer_PogsClient) UnregisterTunnel(ctx context.Context, gracePeri
 	_, err := promise.Struct()
 	return err
 }
+
+func (c TunnelServer_PogsClient) Hello(ctx context.Context,
+	parameters *HelloParameters,
+) (*ServerHello, error) {
+	client := tunnelrpc.TunnelServer{Client: c.Client}
+	promise := client.Hello(ctx, func(p tunnelrpc.TunnelServer_hello_Params) error {
+		helloParameters, err := p.NewParameters()
+		if err != nil {
+			return err
+		}
+		err = MarshalHelloParameters(helloParameters, parameters)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	retval, err := promise.Result().Struct()
+	if err != nil {
+		return nil, err
+	}
+	return UnmarshalServerHello(retval)
+}
+
+func (c TunnelServer_PogsClient) Connect(ctx context.Context,
+	parameters *ConnectParameters,
+) (*ConnectResult, error) {
+	client := tunnelrpc.TunnelServer{Client: c.Client}
+	promise := client.Connect(ctx, func(p tunnelrpc.TunnelServer_connect_Params) error {
+		connectParameters, err := p.NewParameters()
+		if err != nil {
+			return err
+		}
+		err = MarshalConnectParameters(connectParameters, parameters)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	retval, err := promise.Result().Struct()
+	if err != nil {
+		return nil, err
+	}
+	return UnmarshalConnectResult(retval)
+}

tunnelrpc/tunnelrpc.capnp

@@ -46,6 +46,43 @@ struct RegistrationOptions {
     uuid @11 :Text;
 }
 
+struct HelloParameters {
+    # certificate and token to prove ownership of a zone
+    originCert @0 :Data;
+    # user defined labels for this cloudflared
+    tags @1 :List(Tag);
+    # number of previous attempts to send Hello
+    numPreviousAttempts @2 :UInt8;
+}
+
+struct CapnpConnectParameters {
+    # certificate and token to prove ownership of a zone
+    originCert @0 :Data; 
+    # UUID assigned to this cloudflared obtained from Hello
+    cloudflaredID @1 :Data; 
+    # number of previous attempts to send Connect
+    numPreviousAttempts @2 :UInt8;
+}
+
+struct CapnpServerHello {
+    connectResult @0 :ConnectResult;
+    # UUID assigned to this cloudflared
+    cloudflaredID @1 :Data;
+}
+
+struct ConnectResult {
+    err @0 :ConnectError;
+    # Information about the server this connection is established with
+    serverInfo @1 :ServerInfo;
+}
+
+struct ConnectError {
+    cause @0 :Text;
+    # How long should this connection wait to retry in ns
+    retryAfter @1 :Int64;
+    shoudRetry @2 :Bool;
+}
+
 struct Tag {
     name @0 :Text;
     value @1 :Text;
@@ -65,4 +102,8 @@ interface TunnelServer {
     registerTunnel @0 (originCert :Data, hostname :Text, options :RegistrationOptions) -> (result :TunnelRegistration);
     getServerInfo @1 () -> (result :ServerInfo);
     unregisterTunnel @2 (gracePeriodNanoSec :Int64) -> ();
+    # originCert is used to verify ownership of a zone and hostnames it can serve
+    # tags are client-defined tags to associate with the cloudflared
+    hello @3(parameters :HelloParameters) -> (result: CapnpServerHello);
+    connect @4(parameters :CapnpConnectParameters) -> (result :ConnectResult);
 }

validation/validation.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/url"
 	"strings"
+	"time"
 
 	"net/http"
 
@@ -14,7 +15,10 @@ import (
 
 const defaultScheme = "http"
 
-var supportedProtocol = [2]string{"http", "https"}
+var (
+	supportedProtocols = []string{"http", "https", "rdp"}
+	validationTimeout = time.Duration(30 * time.Second)
+)
 
 func ValidateHostname(hostname string) (string, error) {
 	if hostname == "" {
@@ -117,7 +121,7 @@ func ValidateUrl(originUrl string) (string, error) {
 }
 
 func validateScheme(scheme string) error {
-	for _, protocol := range supportedProtocol {
+	for _, protocol := range supportedProtocols {
 		if scheme == protocol {
 			return nil
 		}
@@ -149,6 +153,7 @@ func ValidateHTTPService(originURL string, hostname string, transport http.Round
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
 			return http.ErrUseLastResponse
 		},
+		Timeout: validationTimeout,
 	}
 
 	initialRequest, err := http.NewRequest("GET", parsedURL.String(), nil)

validation/validation_test.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"testing"
+	"time"
 
 	"context"
 	"crypto/tls"
@@ -383,6 +384,36 @@ func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
 	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
 }
 
+// error path 3: origin URL is nonresponsive
+func TestValidateHTTPService_NonResponsiveOrigin(t *testing.T) {
+	originURL := "https://127.0.0.1/"
+	hostname := "example.com"
+	oldValidationTimeout := validationTimeout
+	defer func() {
+		validationTimeout = oldValidationTimeout
+	}()
+	validationTimeout = 500 * time.Millisecond
+
+	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:443", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		time.Sleep(1 * time.Second)
+		w.WriteHeader(200)
+	}))
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	defer server.Close()
+
+	err = ValidateHTTPService(originURL, hostname, client.Transport)
+	if err, ok := err.(net.Error); assert.True(t, ok) {
+		assert.True(t, err.Timeout())
+	}
+}
+
 type testRoundTripper func(req *http.Request) (*http.Response, error)
 
 func (f testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {

vendor/github.com/google/uuid/README.md

@@ -1,7 +1,3 @@
-**This package is currently in development and the API may not be stable.**
-
-The API will become stable with v1.
-
 # uuid ![build status](https://travis-ci.org/google/uuid.svg?branch=master)
 The uuid package generates and inspects UUIDs based on
 [RFC 4122](http://tools.ietf.org/html/rfc4122)

vendor/github.com/google/uuid/dce.go

@@ -42,7 +42,7 @@ func NewDCESecurity(domain Domain, id uint32) (UUID, error) {
 // NewDCEPerson returns a DCE Security (Version 2) UUID in the person
 // domain with the id returned by os.Getuid.
 //
-//  NewDCEPerson(Person, uint32(os.Getuid()))
+//  NewDCESecurity(Person, uint32(os.Getuid()))
 func NewDCEPerson() (UUID, error) {
 	return NewDCESecurity(Person, uint32(os.Getuid()))
 }
@@ -50,7 +50,7 @@ func NewDCEPerson() (UUID, error) {
 // NewDCEGroup returns a DCE Security (Version 2) UUID in the group
 // domain with the id returned by os.Getgid.
 //
-//  NewDCEGroup(Group, uint32(os.Getgid()))
+//  NewDCESecurity(Group, uint32(os.Getgid()))
 func NewDCEGroup() (UUID, error) {
 	return NewDCESecurity(Group, uint32(os.Getgid()))
 }

vendor/github.com/google/uuid/go.mod

@@ -0,0 +1 @@
+module github.com/google/uuid

vendor/github.com/google/uuid/hash.go

@@ -27,7 +27,7 @@ var (
 func NewHash(h hash.Hash, space UUID, data []byte, version int) UUID {
 	h.Reset()
 	h.Write(space[:])
-	h.Write([]byte(data))
+	h.Write(data)
 	s := h.Sum(nil)
 	var uuid UUID
 	copy(uuid[:], s)

vendor/github.com/google/uuid/marshal.go

@@ -15,8 +15,6 @@ func (uuid UUID) MarshalText() ([]byte, error) {
 
 // UnmarshalText implements encoding.TextUnmarshaler.
 func (uuid *UUID) UnmarshalText(data []byte) error {
-	// See comment in ParseBytes why we do this.
-	// id, err := ParseBytes(data)
 	id, err := ParseBytes(data)
 	if err == nil {
 		*uuid = id

vendor/github.com/google/uuid/node.go

@@ -5,16 +5,14 @@
 package uuid
 
 import (
-	"net"
 	"sync"
 )
 
 var (
-	nodeMu     sync.Mutex
-	interfaces []net.Interface // cached list of interfaces
-	ifname     string          // name of interface being used
-	nodeID     [6]byte         // hardware for version 1 UUIDs
-	zeroID     [6]byte         // nodeID with only 0's
+	nodeMu sync.Mutex
+	ifname string  // name of interface being used
+	nodeID [6]byte // hardware for version 1 UUIDs
+	zeroID [6]byte // nodeID with only 0's
 )
 
 // NodeInterface returns the name of the interface from which the NodeID was
@@ -39,26 +37,18 @@ func SetNodeInterface(name string) bool {
 }
 
 func setNodeInterface(name string) bool {
-	if interfaces == nil {
-		var err error
-		interfaces, err = net.Interfaces()
-		if err != nil && name != "" {
-			return false
-		}
-	}
-
-	for _, ifs := range interfaces {
-		if len(ifs.HardwareAddr) >= 6 && (name == "" || name == ifs.Name) {
-			copy(nodeID[:], ifs.HardwareAddr)
-			ifname = ifs.Name
-			return true
-		}
+	iname, addr := getHardwareInterface(name) // null implementation for js
+	if iname != "" && addr != nil {
+		ifname = iname
+		copy(nodeID[:], addr)
+		return true
 	}
 
 	// We found no interfaces with a valid hardware address.  If name
 	// does not specify a specific interface generate a random Node ID
 	// (section 4.1.6)
 	if name == "" {
+		ifname = "random"
 		randomBits(nodeID[:])
 		return true
 	}
@@ -94,9 +84,6 @@ func SetNodeID(id []byte) bool {
 // NodeID returns the 6 byte node id encoded in uuid.  It returns nil if uuid is
 // not valid.  The NodeID is only well defined for version 1 and 2 UUIDs.
 func (uuid UUID) NodeID() []byte {
-	if len(uuid) != 16 {
-		return nil
-	}
 	var node [6]byte
 	copy(node[:], uuid[10:])
 	return node[:]

vendor/github.com/google/uuid/node_js.go

@@ -0,0 +1,12 @@
+// Copyright 2017 Google Inc.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build js
+
+package uuid
+
+// getHardwareInterface returns nil values for the JS version of the code.
+// This remvoves the "net" dependency, because it is not used in the browser.
+// Using the "net" library inflates the size of the transpiled JS code by 673k bytes.
+func getHardwareInterface(name string) (string, []byte) { return "", nil }

vendor/github.com/google/uuid/node_net.go

@@ -0,0 +1,33 @@
+// Copyright 2017 Google Inc.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !js
+
+package uuid
+
+import "net"
+
+var interfaces []net.Interface // cached list of interfaces
+
+// getHardwareInterface returns the name and hardware address of interface name.
+// If name is "" then the name and hardware address of one of the system's
+// interfaces is returned.  If no interfaces are found (name does not exist or
+// there are no interfaces) then "", nil is returned.
+//
+// Only addresses of at least 6 bytes are returned.
+func getHardwareInterface(name string) (string, []byte) {
+	if interfaces == nil {
+		var err error
+		interfaces, err = net.Interfaces()
+		if err != nil {
+			return "", nil
+		}
+	}
+	for _, ifs := range interfaces {
+		if len(ifs.HardwareAddr) >= 6 && (name == "" || name == ifs.Name) {
+			return ifs.Name, ifs.HardwareAddr
+		}
+	}
+	return "", nil
+}

vendor/github.com/google/uuid/sql.go

@@ -13,35 +13,36 @@ import (
 // Currently, database types that map to string and []byte are supported. Please
 // consult database-specific driver documentation for matching types.
 func (uuid *UUID) Scan(src interface{}) error {
-	switch src.(type) {
+	switch src := src.(type) {
+	case nil:
+		return nil
+
 	case string:
 		// if an empty UUID comes from a table, we return a null UUID
-		if src.(string) == "" {
+		if src == "" {
 			return nil
 		}
 
 		// see Parse for required string format
-		u, err := Parse(src.(string))
-
+		u, err := Parse(src)
 		if err != nil {
 			return fmt.Errorf("Scan: %v", err)
 		}
 
 		*uuid = u
-	case []byte:
-		b := src.([]byte)
 
+	case []byte:
 		// if an empty UUID comes from a table, we return a null UUID
-		if len(b) == 0 {
+		if len(src) == 0 {
 			return nil
 		}
 
 		// assumes a simple slice of bytes if 16 bytes
 		// otherwise attempts to parse
-		if len(b) != 16 {
-			return uuid.Scan(string(b))
+		if len(src) != 16 {
+			return uuid.Scan(string(src))
 		}
-		copy((*uuid)[:], b)
+		copy((*uuid)[:], src)
 
 	default:
 		return fmt.Errorf("Scan: unable to scan type %T into UUID", src)

vendor/github.com/google/uuid/time.go

@@ -86,7 +86,7 @@ func clockSequence() int {
 	return int(clockSeq & 0x3fff)
 }
 
-// SetClockSeq sets the clock sequence to the lower 14 bits of seq.  Setting to
+// SetClockSequence sets the clock sequence to the lower 14 bits of seq.  Setting to
 // -1 causes a new sequence to be generated.
 func SetClockSequence(seq int) {
 	defer timeMu.Unlock()
@@ -100,9 +100,9 @@ func setClockSequence(seq int) {
 		randomBits(b[:]) // clock sequence
 		seq = int(b[0])<<8 | int(b[1])
 	}
-	old_seq := clockSeq
+	oldSeq := clockSeq
 	clockSeq = uint16(seq&0x3fff) | 0x8000 // Set our variant
-	if old_seq != clockSeq {
+	if oldSeq != clockSeq {
 		lasttime = 0
 	}
 }

vendor/github.com/google/uuid/uuid.go

@@ -1,4 +1,4 @@
-// Copyright 2016 Google Inc.  All rights reserved.
+// Copyright 2018 Google Inc.  All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
@@ -35,20 +35,43 @@ const (
 
 var rander = rand.Reader // random function
 
-// Parse decodes s into a UUID or returns an error.  Both the UUID form of
-// xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and
-// urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are decoded.
+// Parse decodes s into a UUID or returns an error.  Both the standard UUID
+// forms of xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and
+// urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are decoded as well as the
+// Microsoft encoding {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} and the raw hex
+// encoding: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
 func Parse(s string) (UUID, error) {
 	var uuid UUID
-	if len(s) != 36 {
-		if len(s) != 36+9 {
-			return uuid, fmt.Errorf("invalid UUID length: %d", len(s))
-		}
+	switch len(s) {
+	// xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+	case 36:
+
+	// urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+	case 36 + 9:
 		if strings.ToLower(s[:9]) != "urn:uuid:" {
 			return uuid, fmt.Errorf("invalid urn prefix: %q", s[:9])
 		}
 		s = s[9:]
+
+	// {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
+	case 36 + 2:
+		s = s[1:]
+
+	// xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+	case 32:
+		var ok bool
+		for i := range uuid {
+			uuid[i], ok = xtob(s[i*2], s[i*2+1])
+			if !ok {
+				return uuid, errors.New("invalid UUID format")
+			}
+		}
+		return uuid, nil
+	default:
+		return uuid, fmt.Errorf("invalid UUID length: %d", len(s))
 	}
+	// s is now at least 36 bytes long
+	// it must be of the form  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 	if s[8] != '-' || s[13] != '-' || s[18] != '-' || s[23] != '-' {
 		return uuid, errors.New("invalid UUID format")
 	}
@@ -58,11 +81,11 @@ func Parse(s string) (UUID, error) {
 		14, 16,
 		19, 21,
 		24, 26, 28, 30, 32, 34} {
-		if v, ok := xtob(s[x], s[x+1]); !ok {
+		v, ok := xtob(s[x], s[x+1])
+		if !ok {
 			return uuid, errors.New("invalid UUID format")
-		} else {
-			uuid[i] = v
 		}
+		uuid[i] = v
 	}
 	return uuid, nil
 }
@@ -70,15 +93,29 @@ func Parse(s string) (UUID, error) {
 // ParseBytes is like Parse, except it parses a byte slice instead of a string.
 func ParseBytes(b []byte) (UUID, error) {
 	var uuid UUID
-	if len(b) != 36 {
-		if len(b) != 36+9 {
-			return uuid, fmt.Errorf("invalid UUID length: %d", len(b))
-		}
+	switch len(b) {
+	case 36: // xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+	case 36 + 9: // urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 		if !bytes.Equal(bytes.ToLower(b[:9]), []byte("urn:uuid:")) {
 			return uuid, fmt.Errorf("invalid urn prefix: %q", b[:9])
 		}
 		b = b[9:]
+	case 36 + 2: // {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
+		b = b[1:]
+	case 32: // xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+		var ok bool
+		for i := 0; i < 32; i += 2 {
+			uuid[i/2], ok = xtob(b[i], b[i+1])
+			if !ok {
+				return uuid, errors.New("invalid UUID format")
+			}
+		}
+		return uuid, nil
+	default:
+		return uuid, fmt.Errorf("invalid UUID length: %d", len(b))
 	}
+	// s is now at least 36 bytes long
+	// it must be of the form  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 	if b[8] != '-' || b[13] != '-' || b[18] != '-' || b[23] != '-' {
 		return uuid, errors.New("invalid UUID format")
 	}
@@ -88,15 +125,32 @@ func ParseBytes(b []byte) (UUID, error) {
 		14, 16,
 		19, 21,
 		24, 26, 28, 30, 32, 34} {
-		if v, ok := xtob(b[x], b[x+1]); !ok {
+		v, ok := xtob(b[x], b[x+1])
+		if !ok {
 			return uuid, errors.New("invalid UUID format")
-		} else {
-			uuid[i] = v
 		}
+		uuid[i] = v
 	}
 	return uuid, nil
 }
 
+// MustParse is like Parse but panics if the string cannot be parsed.
+// It simplifies safe initialization of global variables holding compiled UUIDs.
+func MustParse(s string) UUID {
+	uuid, err := Parse(s)
+	if err != nil {
+		panic(`uuid: Parse(` + s + `): ` + err.Error())
+	}
+	return uuid
+}
+
+// FromBytes creates a new UUID from a byte slice. Returns an error if the slice
+// does not have a length of 16. The bytes are copied from the slice.
+func FromBytes(b []byte) (uuid UUID, err error) {
+	err = uuid.UnmarshalBinary(b)
+	return uuid, err
+}
+
 // Must returns uuid if err is nil and panics otherwise.
 func Must(uuid UUID, err error) UUID {
 	if err != nil {
@@ -123,7 +177,7 @@ func (uuid UUID) URN() string {
 }
 
 func encodeHex(dst []byte, uuid UUID) {
-	hex.Encode(dst[:], uuid[:4])
+	hex.Encode(dst, uuid[:4])
 	dst[8] = '-'
 	hex.Encode(dst[9:13], uuid[4:6])
 	dst[13] = '-'
@@ -176,7 +230,7 @@ func (v Variant) String() string {
 	return fmt.Sprintf("BadVariant%d", int(v))
 }
 
-// SetRand sets the random number generator to r, which implents io.Reader.
+// SetRand sets the random number generator to r, which implements io.Reader.
 // If r.Read returns an error when the package requests random data then
 // a panic will be issued.
 //

vendor/github.com/google/uuid/version1.go

@@ -13,7 +13,7 @@ import (
 // or SetNodeInterface then it will be set automatically.  If the NodeID cannot
 // be set NewUUID returns nil.  If clock sequence has not been set by
 // SetClockSequence then it will be set automatically.  If GetTime fails to
-// return the current NewUUID returns Nil and an error.
+// return the current NewUUID returns nil and an error.
 //
 // In most cases, New should be used.
 func NewUUID() (UUID, error) {

vendor/github.com/google/uuid/version4.go

@@ -6,7 +6,7 @@ package uuid
 
 import "io"
 
-// New is creates a new random UUID or panics.  New is equivalent to
+// New creates a new random UUID or panics.  New is equivalent to
 // the expression
 //
 //    uuid.Must(uuid.NewRandom())
@@ -14,12 +14,12 @@ func New() UUID {
 	return Must(NewRandom())
 }
 
-// NewRandom returns a Random (Version 4) UUID or panics.
+// NewRandom returns a Random (Version 4) UUID.
 //
 // The strength of the UUIDs is based on the strength of the crypto/rand
 // package.
 //
-// A note about uniqueness derived from from the UUID Wikipedia entry:
+// A note about uniqueness derived from the UUID Wikipedia entry:
 //
 //  Randomly generated UUIDs have 122 random bits.  One's annual risk of being
 //  hit by a meteorite is estimated to be one chance in 17 billion, that

vendor/github.com/miekg/dns/.codecov.yml

@@ -1,8 +0,0 @@
-coverage:
-  status:
-    project:
-      default:
-        target: 40%
-        threshold: null
-    patch: false
-    changes: false

vendor/github.com/miekg/dns/Gopkg.lock

@@ -7,15 +7,9 @@
   packages = ["ed25519","ed25519/internal/edwards25519"]
   revision = "b080dc9a8c480b08e698fb1219160d598526310f"
 
-[[projects]]
-  branch = "master"
-  name = "golang.org/x/net"
-  packages = ["bpf","internal/iana","internal/socket","ipv4","ipv6"]
-  revision = "894f8ed5849b15b810ae41e9590a0d05395bba27"
-
 [solve-meta]
   analyzer-name = "dep"
   analyzer-version = 1
-  inputs-digest = "c4abc38abaeeeeb9be92455c9c02cae32841122b8982aaa067ef25bb8e86ff9d"
+  inputs-digest = "5046e265393bd5e54f570ce29ae8bc6fa3f30ef5110e922996540400f287c64a"
   solver-name = "gps-cdcl"
   solver-version = 1

vendor/github.com/miekg/dns/Makefile.release

@@ -1,52 +0,0 @@
-# Makefile for releasing.
-#
-# The release is controlled from version.go. The version found there is
-# used to tag the git repo, we're not building any artifects so there is nothing
-# to upload to github.
-#
-# * Up the version in version.go
-# * Run: make -f Makefile.release release
-#   * will *commit* your change with 'Release $VERSION'
-#   * push to github
-#
-
-define GO
-//+build ignore
-
-package main
-
-import (
-	"fmt"
-
-	"github.com/miekg/dns"
-)
-
-func main() {
-	fmt.Println(dns.Version.String())
-}
-endef
-
-$(file > version_release.go,$(GO))
-VERSION:=$(shell go run version_release.go)
-TAG="v$(VERSION)"
-
-all:
-	@echo Use the \'release\' target to start a release $(VERSION)
-	rm -f version_release.go
-
-.PHONY: release
-release: commit push
-	@echo Released $(VERSION)
-	rm -f version_release.go
-
-.PHONY: commit
-commit:
-	@echo Committing release $(VERSION)
-	git commit -am"Release $(VERSION)"
-	git tag $(TAG)
-
-.PHONY: push
-push:
-	@echo Pushing release $(VERSION) to master
-	git push --tags
-	git push

vendor/github.com/miekg/dns/README.md

@@ -62,8 +62,6 @@ A not-so-up-to-date-list-that-may-be-actually-current:
 * https://dnssectest.net/
 * https://dns.apebits.com
 * https://github.com/oif/apex
-* https://github.com/jedisct1/dnscrypt-proxy
-* https://github.com/jedisct1/rpdns
 
 Send pull request if you want to be listed here.
 

vendor/github.com/miekg/dns/client.go

@@ -7,27 +7,22 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/binary"
-	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
-	"net/http"
 	"strings"
 	"time"
 )
 
-const (
-	dnsTimeout     time.Duration = 2 * time.Second
-	tcpIdleTimeout time.Duration = 8 * time.Second
-
-	dohMimeType = "application/dns-message"
-)
+const dnsTimeout time.Duration = 2 * time.Second
+const tcpIdleTimeout time.Duration = 8 * time.Second
 
 // A Conn represents a connection to a DNS server.
 type Conn struct {
 	net.Conn                         // a net.Conn holding the connection
 	UDPSize        uint16            // minimum receive buffer for UDP messages
 	TsigSecret     map[string]string // secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
+	rtt            time.Duration
+	t              time.Time
 	tsigRequestMAC string
 }
 
@@ -44,7 +39,6 @@ type Client struct {
 	DialTimeout    time.Duration     // net.DialTimeout, defaults to 2 seconds, or net.Dialer.Timeout if expiring earlier - overridden by Timeout when that value is non-zero
 	ReadTimeout    time.Duration     // net.Conn.SetReadTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
 	WriteTimeout   time.Duration     // net.Conn.SetWriteTimeout value for connections, defaults to 2 seconds - overridden by Timeout when that value is non-zero
-	HTTPClient     *http.Client      // The http.Client to use for DNS-over-HTTPS
 	TsigSecret     map[string]string // secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
 	SingleInflight bool              // if true suppress multiple outstanding queries for the same Qname, Qtype and Qclass
 	group          singleflight
@@ -89,10 +83,11 @@ func (c *Client) Dial(address string) (conn *Conn, err error) {
 	// create a new dialer with the appropriate timeout
 	var d net.Dialer
 	if c.Dialer == nil {
-		d = net.Dialer{Timeout:c.getTimeoutForRequest(c.dialTimeout())}
+		d = net.Dialer{}
 	} else {
 		d = net.Dialer(*c.Dialer)
 	}
+	d.Timeout = c.getTimeoutForRequest(c.writeTimeout())
 
 	network := "udp"
 	useTLS := false
@@ -141,11 +136,6 @@ func (c *Client) Dial(address string) (conn *Conn, err error) {
 // attribute appropriately
 func (c *Client) Exchange(m *Msg, address string) (r *Msg, rtt time.Duration, err error) {
 	if !c.SingleInflight {
-		if c.Net == "https" {
-			// TODO(tmthrgd): pipe timeouts into exchangeDOH
-			return c.exchangeDOH(context.TODO(), m, address)
-		}
-
 		return c.exchange(m, address)
 	}
 
@@ -158,11 +148,6 @@ func (c *Client) Exchange(m *Msg, address string) (r *Msg, rtt time.Duration, er
 		cl = cl1
 	}
 	r, rtt, err, shared := c.group.Do(m.Question[0].Name+t+cl, func() (*Msg, time.Duration, error) {
-		if c.Net == "https" {
-			// TODO(tmthrgd): pipe timeouts into exchangeDOH
-			return c.exchangeDOH(context.TODO(), m, address)
-		}
-
 		return c.exchange(m, address)
 	})
 	if r != nil && shared {
@@ -192,9 +177,8 @@ func (c *Client) exchange(m *Msg, a string) (r *Msg, rtt time.Duration, err erro
 	}
 
 	co.TsigSecret = c.TsigSecret
-	t := time.Now()
 	// write with the appropriate write timeout
-	co.SetWriteDeadline(t.Add(c.getTimeoutForRequest(c.writeTimeout())))
+	co.SetWriteDeadline(time.Now().Add(c.getTimeoutForRequest(c.writeTimeout())))
 	if err = co.WriteMsg(m); err != nil {
 		return nil, 0, err
 	}
@@ -204,76 +188,12 @@ func (c *Client) exchange(m *Msg, a string) (r *Msg, rtt time.Duration, err erro
 	if err == nil && r.Id != m.Id {
 		err = ErrId
 	}
-	rtt = time.Since(t)
-	return r, rtt, err
-}
-
-func (c *Client) exchangeDOH(ctx context.Context, m *Msg, a string) (r *Msg, rtt time.Duration, err error) {
-	p, err := m.Pack()
-	if err != nil {
-		return nil, 0, err
-	}
-
-	req, err := http.NewRequest(http.MethodPost, a, bytes.NewReader(p))
-	if err != nil {
-		return nil, 0, err
-	}
-
-	req.Header.Set("Content-Type", dohMimeType)
-	req.Header.Set("Accept", dohMimeType)
-
-	hc := http.DefaultClient
-	if c.HTTPClient != nil {
-		hc = c.HTTPClient
-	}
-
-	if ctx != context.Background() && ctx != context.TODO() {
-		req = req.WithContext(ctx)
-	}
-
-	t := time.Now()
-
-	resp, err := hc.Do(req)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer closeHTTPBody(resp.Body)
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, 0, fmt.Errorf("dns: server returned HTTP %d error: %q", resp.StatusCode, resp.Status)
-	}
-
-	if ct := resp.Header.Get("Content-Type"); ct != dohMimeType {
-		return nil, 0, fmt.Errorf("dns: unexpected Content-Type %q; expected %q", ct, dohMimeType)
-	}
-
-	p, err = ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	rtt = time.Since(t)
-
-	r = new(Msg)
-	if err := r.Unpack(p); err != nil {
-		return r, 0, err
-	}
-
-	// TODO: TSIG? Is it even supported over DoH?
-
-	return r, rtt, nil
-}
-
-func closeHTTPBody(r io.ReadCloser) error {
-	io.Copy(ioutil.Discard, io.LimitReader(r, 8<<20))
-	return r.Close()
+	return r, co.rtt, err
 }
 
 // ReadMsg reads a message from the connection co.
-// If the received message contains a TSIG record the transaction signature
-// is verified. This method always tries to return the message, however if an
-// error is returned there are no guarantees that the returned message is a
-// valid representation of the packet read.
+// If the received message contains a TSIG record the transaction
+// signature is verified.
 func (co *Conn) ReadMsg() (*Msg, error) {
 	p, err := co.ReadMsgHeader(nil)
 	if err != nil {
@@ -282,10 +202,13 @@ func (co *Conn) ReadMsg() (*Msg, error) {
 
 	m := new(Msg)
 	if err := m.Unpack(p); err != nil {
-		// If an error was returned, we still want to allow the user to use
+		// If ErrTruncated was returned, we still want to allow the user to use
 		// the message, but naively they can just check err if they don't want
-		// to use an erroneous message
-		return m, err
+		// to use a truncated message
+		if err == ErrTruncated {
+			return m, err
+		}
+		return nil, err
 	}
 	if t := m.IsTsig(); t != nil {
 		if _, ok := co.TsigSecret[t.Hdr.Name]; !ok {
@@ -318,6 +241,7 @@ func (co *Conn) ReadMsgHeader(hdr *Header) ([]byte, error) {
 		}
 		p = make([]byte, l)
 		n, err = tcpRead(r, p)
+		co.rtt = time.Since(co.t)
 	default:
 		if co.UDPSize > MinMsgSize {
 			p = make([]byte, co.UDPSize)
@@ -325,6 +249,7 @@ func (co *Conn) ReadMsgHeader(hdr *Header) ([]byte, error) {
 			p = make([]byte, MinMsgSize)
 		}
 		n, err = co.Read(p)
+		co.rtt = time.Since(co.t)
 	}
 
 	if err != nil {
@@ -437,6 +362,7 @@ func (co *Conn) WriteMsg(m *Msg) (err error) {
 	if err != nil {
 		return err
 	}
+	co.t = time.Now()
 	if _, err = co.Write(out); err != nil {
 		return err
 	}
@@ -568,10 +494,6 @@ func DialTimeoutWithTLS(network, address string, tlsConfig *tls.Config, timeout
 // context, if present. If there is both a context deadline and a configured
 // timeout on the client, the earliest of the two takes effect.
 func (c *Client) ExchangeContext(ctx context.Context, m *Msg, a string) (r *Msg, rtt time.Duration, err error) {
-	if !c.SingleInflight && c.Net == "https" {
-		return c.exchangeDOH(ctx, m, a)
-	}
-
 	var timeout time.Duration
 	if deadline, ok := ctx.Deadline(); !ok {
 		timeout = 0
@@ -580,7 +502,6 @@ func (c *Client) ExchangeContext(ctx context.Context, m *Msg, a string) (r *Msg,
 	}
 	// not passing the context to the underlying calls, as the API does not support
 	// context. For timeouts you should set up Client.Dialer and call Client.Exchange.
-	// TODO(tmthrgd): this is a race condition
 	c.Dialer = &net.Dialer{Timeout: timeout}
 	return c.Exchange(m, a)
 }

vendor/github.com/miekg/dns/clientconfig.go

@@ -91,7 +91,7 @@ func ClientConfigFromReader(resolvconf io.Reader) (*ClientConfig, error) {
 						n = 1
 					}
 					c.Timeout = n
-				case len(s) >= 9 && s[:9] == "attempts:":
+				case len(s) >= 8 && s[:9] == "attempts:":
 					n, _ := strconv.Atoi(s[9:])
 					if n < 1 {
 						n = 1

vendor/github.com/miekg/dns/compress_generate.go

@@ -18,7 +18,8 @@ import (
 )
 
 var packageHdr = `
-// Code generated by "go run compress_generate.go"; DO NOT EDIT.
+// *** DO NOT MODIFY ***
+// AUTOGENERATED BY go generate from compress_generate.go
 
 package dns
 
@@ -101,8 +102,7 @@ Names:
 
 	// compressionLenHelperType - all types that have domain-name/cdomain-name can be used for compressing names
 
-	fmt.Fprint(b, "func compressionLenHelperType(c map[string]int, r RR, initLen int) int {\n")
-	fmt.Fprint(b, "currentLen := initLen\n")
+	fmt.Fprint(b, "func compressionLenHelperType(c map[string]int, r RR) {\n")
 	fmt.Fprint(b, "switch x := r.(type) {\n")
 	for _, name := range domainTypes {
 		o := scope.Lookup(name)
@@ -110,10 +110,7 @@ Names:
 
 		fmt.Fprintf(b, "case *%s:\n", name)
 		for i := 1; i < st.NumFields(); i++ {
-			out := func(s string) {
-				fmt.Fprintf(b, "currentLen -= len(x.%s) + 1\n", st.Field(i).Name())
-				fmt.Fprintf(b, "currentLen += compressionLenHelper(c, x.%s, currentLen)\n", st.Field(i).Name())
-			}
+			out := func(s string) { fmt.Fprintf(b, "compressionLenHelper(c, x.%s)\n", st.Field(i).Name()) }
 
 			if _, ok := st.Field(i).Type().(*types.Slice); ok {
 				switch st.Tag(i) {
@@ -122,12 +119,8 @@ Names:
 				case `dns:"cdomain-name"`:
 					// For HIP we need to slice over the elements in this slice.
 					fmt.Fprintf(b, `for i := range x.%s {
-	currentLen -= len(x.%s[i]) + 1
-}
-`, st.Field(i).Name(), st.Field(i).Name())
-					fmt.Fprintf(b, `for i := range x.%s {
-	currentLen += compressionLenHelper(c, x.%s[i], currentLen)
-}
+						compressionLenHelper(c, x.%s[i])
+					}
 `, st.Field(i).Name(), st.Field(i).Name())
 				}
 				continue
@@ -141,11 +134,11 @@ Names:
 			}
 		}
 	}
-	fmt.Fprintln(b, "}\nreturn currentLen - initLen\n}\n\n")
+	fmt.Fprintln(b, "}\n}\n\n")
 
 	// compressionLenSearchType - search cdomain-tags types for compressible names.
 
-	fmt.Fprint(b, "func compressionLenSearchType(c map[string]int, r RR) (int, bool, int) {\n")
+	fmt.Fprint(b, "func compressionLenSearchType(c map[string]int, r RR) (int, bool) {\n")
 	fmt.Fprint(b, "switch x := r.(type) {\n")
 	for _, name := range cdomainTypes {
 		o := scope.Lookup(name)
@@ -155,7 +148,7 @@ Names:
 		j := 1
 		for i := 1; i < st.NumFields(); i++ {
 			out := func(s string, j int) {
-				fmt.Fprintf(b, "k%d, ok%d, sz%d := compressionLenSearch(c, x.%s)\n", j, j, j, st.Field(i).Name())
+				fmt.Fprintf(b, "k%d, ok%d := compressionLenSearch(c, x.%s)\n", j, j, st.Field(i).Name())
 			}
 
 			// There are no slice types with names that can be compressed.
@@ -168,15 +161,13 @@ Names:
 		}
 		k := "k1"
 		ok := "ok1"
-		sz := "sz1"
 		for i := 2; i < j; i++ {
 			k += fmt.Sprintf(" + k%d", i)
 			ok += fmt.Sprintf(" && ok%d", i)
-			sz += fmt.Sprintf(" + sz%d", i)
 		}
-		fmt.Fprintf(b, "return %s, %s, %s\n", k, ok, sz)
+		fmt.Fprintf(b, "return %s, %s\n", k, ok)
 	}
-	fmt.Fprintln(b, "}\nreturn 0, false, 0\n}\n\n")
+	fmt.Fprintln(b, "}\nreturn 0, false\n}\n\n")
 
 	// gofmt
 	res, err := format.Source(b.Bytes())

vendor/github.com/miekg/dns/defaults.go

@@ -273,11 +273,8 @@ func (t Type) String() string {
 
 // String returns the string representation for the class c.
 func (c Class) String() string {
-	if s, ok := ClassToString[uint16(c)]; ok {
-		// Only emit mnemonics when they are unambiguous, specically ANY is in both.
-		if _, ok := StringToType[s]; !ok {
-			return s
-		}
+	if c1, ok := ClassToString[uint16(c)]; ok {
+		return c1
 	}
 	return "CLASS" + strconv.Itoa(int(c))
 }

vendor/github.com/miekg/dns/dns.go

@@ -55,6 +55,16 @@ func (h *RR_Header) Header() *RR_Header { return h }
 // Just to implement the RR interface.
 func (h *RR_Header) copy() RR { return nil }
 
+func (h *RR_Header) copyHeader() *RR_Header {
+	r := new(RR_Header)
+	r.Name = h.Name
+	r.Rrtype = h.Rrtype
+	r.Class = h.Class
+	r.Ttl = h.Ttl
+	r.Rdlength = h.Rdlength
+	return r
+}
+
 func (h *RR_Header) String() string {
 	var s string
 

vendor/github.com/miekg/dns/dnssec.go

@@ -73,7 +73,6 @@ var StringToAlgorithm = reverseInt8(AlgorithmToString)
 // AlgorithmToHash is a map of algorithm crypto hash IDs to crypto.Hash's.
 var AlgorithmToHash = map[uint8]crypto.Hash{
 	RSAMD5:           crypto.MD5, // Deprecated in RFC 6725
-	DSA:              crypto.SHA1,
 	RSASHA1:          crypto.SHA1,
 	RSASHA1NSEC3SHA1: crypto.SHA1,
 	RSASHA256:        crypto.SHA256,
@@ -240,7 +239,7 @@ func (k *DNSKEY) ToDS(h uint8) *DS {
 // ToCDNSKEY converts a DNSKEY record to a CDNSKEY record.
 func (k *DNSKEY) ToCDNSKEY() *CDNSKEY {
 	c := &CDNSKEY{DNSKEY: *k}
-	c.Hdr = k.Hdr
+	c.Hdr = *k.Hdr.copyHeader()
 	c.Hdr.Rrtype = TypeCDNSKEY
 	return c
 }
@@ -248,7 +247,7 @@ func (k *DNSKEY) ToCDNSKEY() *CDNSKEY {
 // ToCDS converts a DS record to a CDS record.
 func (d *DS) ToCDS() *CDS {
 	c := &CDS{DS: *d}
-	c.Hdr = d.Hdr
+	c.Hdr = *d.Hdr.copyHeader()
 	c.Hdr.Rrtype = TypeCDS
 	return c
 }
@@ -542,20 +541,20 @@ func (k *DNSKEY) publicKeyRSA() *rsa.PublicKey {
 		explen = uint16(keybuf[1])<<8 | uint16(keybuf[2])
 		keyoff = 3
 	}
-	if explen > 4 {
-		// Larger exponent than supported by the crypto package.
-		return nil
-	}
 	pubkey := new(rsa.PublicKey)
 
 	pubkey.N = big.NewInt(0)
+	shift := uint64((explen - 1) * 8)
 	expo := uint64(0)
-	for i := 0; i < int(explen); i++ {
-		expo <<= 8
-		expo |= uint64(keybuf[keyoff+i])
+	for i := int(explen - 1); i > 0; i-- {
+		expo += uint64(keybuf[keyoff+i]) << shift
+		shift -= 8
 	}
-	if expo > 1<<31-1 {
-		// Larger exponent than supported by the crypto package.
+	// Remainder
+	expo += uint64(keybuf[keyoff])
+	if expo > (2<<31)+1 {
+		// Larger expo than supported.
+		// println("dns: F5 primes (or larger) are not supported")
 		return nil
 	}
 	pubkey.E = int(expo)

vendor/github.com/miekg/dns/doc.go

@@ -73,11 +73,11 @@ and port to use for the connection:
 		Port: 12345,
 		Zone: "",
 	}
-	c.Dialer := &net.Dialer{
+	d := net.Dialer{
 		Timeout: 200 * time.Millisecond,
 		LocalAddr: &laddr,
 	}
-	in, rtt, err := c.Exchange(m1, "8.8.8.8:53")
+	in, rtt, err := c.ExchangeWithDialer(&d, m1, "8.8.8.8:53")
 
 If these "advanced" features are not needed, a simple UDP query can be sent,
 with:

vendor/github.com/miekg/dns/edns.go

@@ -102,15 +102,12 @@ func (rr *OPT) SetVersion(v uint8) {
 
 // ExtendedRcode returns the EDNS extended RCODE field (the upper 8 bits of the TTL).
 func (rr *OPT) ExtendedRcode() int {
-	return int((rr.Hdr.Ttl&0xFF000000)>>24) + 15
+	return int((rr.Hdr.Ttl & 0xFF000000) >> 24)
 }
 
 // SetExtendedRcode sets the EDNS extended RCODE field.
 func (rr *OPT) SetExtendedRcode(v uint8) {
-	if v < RcodeBadVers { // Smaller than 16.. Use the 4 bits you have!
-		return
-	}
-	rr.Hdr.Ttl = rr.Hdr.Ttl&0x00FFFFFF | (uint32(v-15) << 24)
+	rr.Hdr.Ttl = rr.Hdr.Ttl&0x00FFFFFF | (uint32(v) << 24)
 }
 
 // UDPSize returns the UDP buffer size.
@@ -423,7 +420,6 @@ func (e *EDNS0_LLQ) String() string {
 	return s
 }
 
-// EDNS0_DUA implements the EDNS0 "DNSSEC Algorithm Understood" option. See RFC 6975.
 type EDNS0_DAU struct {
 	Code    uint16 // Always EDNS0DAU
 	AlgCode []uint8
@@ -446,7 +442,6 @@ func (e *EDNS0_DAU) String() string {
 	return s
 }
 
-// EDNS0_DHU implements the EDNS0 "DS Hash Understood" option. See RFC 6975.
 type EDNS0_DHU struct {
 	Code    uint16 // Always EDNS0DHU
 	AlgCode []uint8
@@ -469,7 +464,6 @@ func (e *EDNS0_DHU) String() string {
 	return s
 }
 
-// EDNS0_N3U implements the EDNS0 "NSEC3 Hash Understood" option. See RFC 6975.
 type EDNS0_N3U struct {
 	Code    uint16 // Always EDNS0N3U
 	AlgCode []uint8
@@ -493,7 +487,6 @@ func (e *EDNS0_N3U) String() string {
 	return s
 }
 
-// EDNS0_EXPIRE implementes the EDNS0 option as described in RFC 7314.
 type EDNS0_EXPIRE struct {
 	Code   uint16 // Always EDNS0EXPIRE
 	Expire uint32

vendor/github.com/miekg/dns/internal/socket/cmsghdr.go

@@ -0,0 +1,7 @@
+// +build linux
+
+package socket
+
+func (h *cmsghdr) len() int { return int(h.Len) }
+func (h *cmsghdr) lvl() int { return int(h.Level) }
+func (h *cmsghdr) typ() int { return int(h.Type) }

vendor/github.com/miekg/dns/internal/socket/cmsghdr_linux_32bit.go

@@ -1,12 +1,18 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
 // +build arm mips mipsle 386
 // +build linux
 
 package socket
 
+type cmsghdr struct {
+	Len   uint32
+	Level int32
+	Type  int32
+}
+
+const (
+	sizeofCmsghdr = 0xc
+)
+
 func (h *cmsghdr) set(l, lvl, typ int) {
 	h.Len = uint32(l)
 	h.Level = int32(lvl)

vendor/github.com/miekg/dns/internal/socket/cmsghdr_linux_64bit.go

@@ -1,12 +1,18 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
 // +build arm64 amd64 ppc64 ppc64le mips64 mips64le s390x
 // +build linux
 
 package socket
 
+type cmsghdr struct {
+	Len   uint64
+	Level int32
+	Type  int32
+}
+
+const (
+	sizeofCmsghdr = 0x10
+)
+
 func (h *cmsghdr) set(l, lvl, typ int) {
 	h.Len = uint64(l)
 	h.Level = int32(lvl)

vendor/github.com/miekg/dns/internal/socket/cmsghdr_other.go

@@ -1,8 +1,4 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris
+// +build !linux
 
 package socket
 

vendor/github.com/miekg/dns/internal/socket/controlmessage.go

@@ -0,0 +1,118 @@
+package socket
+
+import (
+	"errors"
+	"unsafe"
+)
+
+func controlHeaderLen() int {
+	return roundup(sizeofCmsghdr)
+}
+
+func controlMessageLen(dataLen int) int {
+	return roundup(sizeofCmsghdr) + dataLen
+}
+
+// returns the whole length of control message.
+func ControlMessageSpace(dataLen int) int {
+	return roundup(sizeofCmsghdr) + roundup(dataLen)
+}
+
+// A ControlMessage represents the head message in a stream of control
+// messages.
+//
+// A control message comprises of a header, data and a few padding
+// fields to conform to the interface to the kernel.
+//
+// See RFC 3542 for further information.
+type ControlMessage []byte
+
+// Data returns the data field of the control message at the head.
+func (m ControlMessage) Data(dataLen int) []byte {
+	l := controlHeaderLen()
+	if len(m) < l || len(m) < l+dataLen {
+		return nil
+	}
+	return m[l : l+dataLen]
+}
+
+// ParseHeader parses and returns the header fields of the control
+// message at the head.
+func (m ControlMessage) ParseHeader() (lvl, typ, dataLen int, err error) {
+	l := controlHeaderLen()
+	if len(m) < l {
+		return 0, 0, 0, errors.New("short message")
+	}
+	h := (*cmsghdr)(unsafe.Pointer(&m[0]))
+	return h.lvl(), h.typ(), int(uint64(h.len()) - uint64(l)), nil
+}
+
+// Next returns the control message at the next.
+func (m ControlMessage) Next(dataLen int) ControlMessage {
+	l := ControlMessageSpace(dataLen)
+	if len(m) < l {
+		return nil
+	}
+	return m[l:]
+}
+
+// MarshalHeader marshals the header fields of the control message at
+// the head.
+func (m ControlMessage) MarshalHeader(lvl, typ, dataLen int) error {
+	if len(m) < controlHeaderLen() {
+		return errors.New("short message")
+	}
+	h := (*cmsghdr)(unsafe.Pointer(&m[0]))
+	h.set(controlMessageLen(dataLen), lvl, typ)
+	return nil
+}
+
+// Marshal marshals the control message at the head, and returns the next
+// control message.
+func (m ControlMessage) Marshal(lvl, typ int, data []byte) (ControlMessage, error) {
+	l := len(data)
+	if len(m) < ControlMessageSpace(l) {
+		return nil, errors.New("short message")
+	}
+	h := (*cmsghdr)(unsafe.Pointer(&m[0]))
+	h.set(controlMessageLen(l), lvl, typ)
+	if l > 0 {
+		copy(m.Data(l), data)
+	}
+	return m.Next(l), nil
+}
+
+// Parse parses as a single or multiple control messages.
+func (m ControlMessage) Parse() ([]ControlMessage, error) {
+	var ms []ControlMessage
+	for len(m) >= controlHeaderLen() {
+		h := (*cmsghdr)(unsafe.Pointer(&m[0]))
+		l := h.len()
+		if l <= 0 {
+			return nil, errors.New("invalid header length")
+		}
+		if uint64(l) < uint64(controlHeaderLen()) {
+			return nil, errors.New("invalid message length")
+		}
+		if uint64(l) > uint64(len(m)) {
+			return nil, errors.New("short buffer")
+		}
+		ms = append(ms, ControlMessage(m[:l]))
+		ll := l - controlHeaderLen()
+		if len(m) >= ControlMessageSpace(ll) {
+			m = m[ControlMessageSpace(ll):]
+		} else {
+			m = m[controlMessageLen(ll):]
+		}
+	}
+	return ms, nil
+}
+
+// NewControlMessage returns a new stream of control messages.
+func NewControlMessage(dataLen []int) ControlMessage {
+	var l int
+	for i := range dataLen {
+		l += ControlMessageSpace(dataLen[i])
+	}
+	return make([]byte, l)
+}

vendor/github.com/miekg/dns/internal/socket/socket.go

@@ -0,0 +1,4 @@
+// Package socket contains ControlMessage parsing code from
+// golang.org/x/net/internal/socket. Instead of supporting all possible
+// architectures, we're only supporting linux 32/64 bit.
+package socket

vendor/github.com/miekg/dns/internal/socket/sys.go

@@ -0,0 +1,14 @@
+package socket
+
+import "unsafe"
+
+var (
+	kernelAlign = func() int {
+		var p uintptr
+		return int(unsafe.Sizeof(p))
+	}()
+)
+
+func roundup(l int) int {
+	return (l + kernelAlign - 1) & ^(kernelAlign - 1)
+}

vendor/github.com/miekg/dns/msg.go

@@ -595,13 +595,6 @@ func UnpackRR(msg []byte, off int) (rr RR, off1 int, err error) {
 	if err != nil {
 		return nil, len(msg), err
 	}
-
-	return UnpackRRWithHeader(h, msg, off)
-}
-
-// UnpackRRWithHeader unpacks the record type specific payload given an existing
-// RR_Header.
-func UnpackRRWithHeader(h RR_Header, msg []byte, off int) (rr RR, off1 int, err error) {
 	end := off + int(h.Rdlength)
 
 	if fn, known := typeToUnpack[h.Rrtype]; !known {
@@ -619,8 +612,8 @@ func UnpackRRWithHeader(h RR_Header, msg []byte, off int) (rr RR, off1 int, err
 // If we cannot unpack the whole array, then it will return nil
 func unpackRRslice(l int, msg []byte, off int) (dst1 []RR, off1 int, err error) {
 	var r RR
-	// Don't pre-allocate, l may be under attacker control
-	var dst []RR
+	// Optimistically make dst be the length that was sent
+	dst := make([]RR, 0, l)
 	for i := 0; i < l; i++ {
 		off1 := off
 		r, off, err = UnpackRR(msg, off)
@@ -691,20 +684,18 @@ func (dns *Msg) Pack() (msg []byte, err error) {
 	return dns.PackBuffer(nil)
 }
 
-// PackBuffer packs a Msg, using the given buffer buf. If buf is too small a new buffer is allocated.
+// PackBuffer packs a Msg, using the given buffer buf. If buf is too small
+// a new buffer is allocated.
 func (dns *Msg) PackBuffer(buf []byte) (msg []byte, err error) {
-	var compression map[string]int
-	if dns.Compress {
-		compression = make(map[string]int) // Compression pointer mappings.
-	}
-	return dns.packBufferWithCompressionMap(buf, compression)
-}
-
-// packBufferWithCompressionMap packs a Msg, using the given buffer buf.
-func (dns *Msg) packBufferWithCompressionMap(buf []byte, compression map[string]int) (msg []byte, err error) {
 	// We use a similar function in tsig.go's stripTsig.
+	var (
+		dh          Header
+		compression map[string]int
+	)
 
-	var dh Header
+	if dns.Compress {
+		compression = make(map[string]int) // Compression pointer mappings
+	}
 
 	if dns.Rcode < 0 || dns.Rcode > 0xFFF {
 		return nil, ErrRcode
@@ -716,11 +707,12 @@ func (dns *Msg) packBufferWithCompressionMap(buf []byte, compression map[string]
 			return nil, ErrExtendedRcode
 		}
 		opt.SetExtendedRcode(uint8(dns.Rcode >> 4))
+		dns.Rcode &= 0xF
 	}
 
 	// Convert convenient Msg into wire-like Header.
 	dh.Id = dns.Id
-	dh.Bits = uint16(dns.Opcode)<<11 | uint16(dns.Rcode&0xF)
+	dh.Bits = uint16(dns.Opcode)<<11 | uint16(dns.Rcode)
 	if dns.Response {
 		dh.Bits |= _QR
 	}
@@ -819,19 +811,13 @@ func (dns *Msg) Unpack(msg []byte) (err error) {
 	dns.CheckingDisabled = (dh.Bits & _CD) != 0
 	dns.Rcode = int(dh.Bits & 0xF)
 
-	// If we are at the end of the message we should return *just* the
-	// header. This can still be useful to the caller. 9.9.9.9 sends these
-	// when responding with REFUSED for instance.
 	if off == len(msg) {
-		// reset sections before returning
-		dns.Question, dns.Answer, dns.Ns, dns.Extra = nil, nil, nil, nil
-		return nil
+		return ErrTruncated
 	}
 
-	// Qdcount, Ancount, Nscount, Arcount can't be trusted, as they are
-	// attacker controlled. This means we can't use them to pre-allocate
-	// slices.
-	dns.Question = nil
+	// Optimistically use the count given to us in the header
+	dns.Question = make([]Question, 0, int(dh.Qdcount))
+
 	for i := 0; i < int(dh.Qdcount); i++ {
 		off1 := off
 		var q Question
@@ -923,138 +909,94 @@ func (dns *Msg) String() string {
 // than packing it, measuring the size and discarding the buffer.
 func (dns *Msg) Len() int { return compressedLen(dns, dns.Compress) }
 
-func compressedLenWithCompressionMap(dns *Msg, compression map[string]int) int {
-	l := 12 // Message header is always 12 bytes
-	for _, r := range dns.Question {
-		compressionLenHelper(compression, r.Name, l)
-		l += r.len()
-	}
-	l += compressionLenSlice(l, compression, dns.Answer)
-	l += compressionLenSlice(l, compression, dns.Ns)
-	l += compressionLenSlice(l, compression, dns.Extra)
-	return l
-}
-
 // compressedLen returns the message length when in compressed wire format
 // when compress is true, otherwise the uncompressed length is returned.
 func compressedLen(dns *Msg, compress bool) int {
 	// We always return one more than needed.
+	l := 12 // Message header is always 12 bytes
 	if compress {
 		compression := map[string]int{}
-		return compressedLenWithCompressionMap(dns, compression)
-	}
-	l := 12 // Message header is always 12 bytes
-
-	for _, r := range dns.Question {
-		l += r.len()
-	}
-	for _, r := range dns.Answer {
-		if r != nil {
+		for _, r := range dns.Question {
+			l += r.len()
+			compressionLenHelper(compression, r.Name)
+		}
+		l += compressionLenSlice(compression, dns.Answer)
+		l += compressionLenSlice(compression, dns.Ns)
+		l += compressionLenSlice(compression, dns.Extra)
+	} else {
+		for _, r := range dns.Question {
 			l += r.len()
 		}
-	}
-	for _, r := range dns.Ns {
-		if r != nil {
-			l += r.len()
+		for _, r := range dns.Answer {
+			if r != nil {
+				l += r.len()
+			}
+		}
+		for _, r := range dns.Ns {
+			if r != nil {
+				l += r.len()
+			}
+		}
+		for _, r := range dns.Extra {
+			if r != nil {
+				l += r.len()
+			}
 		}
 	}
-	for _, r := range dns.Extra {
-		if r != nil {
-			l += r.len()
-		}
-	}
-
 	return l
 }
 
-func compressionLenSlice(lenp int, c map[string]int, rs []RR) int {
-	initLen := lenp
+func compressionLenSlice(c map[string]int, rs []RR) int {
+	var l int
 	for _, r := range rs {
 		if r == nil {
 			continue
 		}
-		// TmpLen is to track len of record at 14bits boudaries
-		tmpLen := lenp
-
-		x := r.len()
-		// track this length, and the global length in len, while taking compression into account for both.
-		k, ok, _ := compressionLenSearch(c, r.Header().Name)
+		l += r.len()
+		k, ok := compressionLenSearch(c, r.Header().Name)
 		if ok {
-			// Size of x is reduced by k, but we add 1 since k includes the '.' and label descriptor take 2 bytes
-			// so, basically x:= x - k - 1 + 2
-			x += 1 - k
+			l += 1 - k
 		}
-
-		tmpLen += compressionLenHelper(c, r.Header().Name, tmpLen)
-		k, ok, _ = compressionLenSearchType(c, r)
+		compressionLenHelper(c, r.Header().Name)
+		k, ok = compressionLenSearchType(c, r)
 		if ok {
-			x += 1 - k
+			l += 1 - k
 		}
-		lenp += x
-		tmpLen = lenp
-		tmpLen += compressionLenHelperType(c, r, tmpLen)
-
+		compressionLenHelperType(c, r)
 	}
-	return lenp - initLen
+	return l
 }
 
-// Put the parts of the name in the compression map, return the size in bytes added in payload
-func compressionLenHelper(c map[string]int, s string, currentLen int) int {
-	if currentLen > maxCompressionOffset {
-		// We won't be able to add any label that could be re-used later anyway
-		return 0
-	}
-	if _, ok := c[s]; ok {
-		return 0
-	}
-	initLen := currentLen
+// Put the parts of the name in the compression map.
+func compressionLenHelper(c map[string]int, s string) {
 	pref := ""
-	prev := s
 	lbs := Split(s)
-	for j := 0; j < len(lbs); j++ {
+	for j := len(lbs) - 1; j >= 0; j-- {
 		pref = s[lbs[j]:]
-		currentLen += len(prev) - len(pref)
-		prev = pref
 		if _, ok := c[pref]; !ok {
-			// If first byte label is within the first 14bits, it might be re-used later
-			if currentLen < maxCompressionOffset {
-				c[pref] = currentLen
-			}
-		} else {
-			added := currentLen - initLen
-			if j > 0 {
-				// We added a new PTR
-				added += 2
-			}
-			return added
+			c[pref] = len(pref)
 		}
 	}
-	return currentLen - initLen
 }
 
 // Look for each part in the compression map and returns its length,
 // keep on searching so we get the longest match.
-// Will return the size of compression found, whether a match has been
-// found and the size of record if added in payload
-func compressionLenSearch(c map[string]int, s string) (int, bool, int) {
+func compressionLenSearch(c map[string]int, s string) (int, bool) {
 	off := 0
 	end := false
 	if s == "" { // don't bork on bogus data
-		return 0, false, 0
+		return 0, false
 	}
-	fullSize := 0
 	for {
 		if _, ok := c[s[off:]]; ok {
-			return len(s[off:]), true, fullSize + off
+			return len(s[off:]), true
 		}
 		if end {
 			break
 		}
-		// Each label descriptor takes 2 bytes, add it
-		fullSize += 2
 		off, end = NextLabel(s, off)
 	}
-	return 0, false, fullSize + len(s)
+	return 0, false
 }
 
 // Copy returns a new RR which is a deep-copy of r.

vendor/github.com/miekg/dns/msg_generate.go

@@ -18,7 +18,8 @@ import (
 )
 
 var packageHdr = `
-// Code generated by "go run msg_generate.go"; DO NOT EDIT.
+// *** DO NOT MODIFY ***
+// AUTOGENERATED BY go generate from msg_generate.go
 
 package dns
 

vendor/github.com/miekg/dns/msg_helpers.go

@@ -141,24 +141,20 @@ func truncateMsgFromRdlength(msg []byte, off int, rdlength uint16) (truncmsg []b
 	return msg[:lenrd], nil
 }
 
-var base32HexNoPadEncoding = base32.HexEncoding.WithPadding(base32.NoPadding)
-
 func fromBase32(s []byte) (buf []byte, err error) {
 	for i, b := range s {
 		if b >= 'a' && b <= 'z' {
 			s[i] = b - 32
 		}
 	}
-	buflen := base32HexNoPadEncoding.DecodedLen(len(s))
+	buflen := base32.HexEncoding.DecodedLen(len(s))
 	buf = make([]byte, buflen)
-	n, err := base32HexNoPadEncoding.Decode(buf, s)
+	n, err := base32.HexEncoding.Decode(buf, s)
 	buf = buf[:n]
 	return
 }
 
-func toBase32(b []byte) string {
-	return base32HexNoPadEncoding.EncodeToString(b)
-}
+func toBase32(b []byte) string { return base32.HexEncoding.EncodeToString(b) }
 
 func fromBase64(s []byte) (buf []byte, err error) {
 	buflen := base64.StdEncoding.DecodedLen(len(s))

vendor/github.com/miekg/dns/privaterr.go

@@ -56,7 +56,8 @@ func (r *PrivateRR) len() int { return r.Hdr.len() + r.Data.Len() }
 func (r *PrivateRR) copy() RR {
 	// make new RR like this:
 	rr := mkPrivateRR(r.Hdr.Rrtype)
-	rr.Hdr = r.Hdr
+	newh := r.Hdr.copyHeader()
+	rr.Hdr = *newh
 
 	err := r.Data.Copy(rr.Data)
 	if err != nil {

vendor/github.com/miekg/dns/sanitize.go

@@ -3,7 +3,7 @@ package dns
 // Dedup removes identical RRs from rrs. It preserves the original ordering.
 // The lowest TTL of any duplicates is used in the remaining one. Dedup modifies
 // rrs.
-// m is used to store the RRs temporary. If it is nil a new map will be allocated.
+// m is used to store the RRs temporay. If it is nil a new map will be allocated.
 func Dedup(rrs []RR, m map[string]RR) []RR {
 	if m == nil {
 		m = make(map[string]RR)

vendor/github.com/miekg/dns/scan.go

@@ -1,10 +1,8 @@
 package dns
 
 import (
-	"fmt"
 	"io"
 	"os"
-	"path/filepath"
 	"strconv"
 	"strings"
 )
@@ -299,24 +297,16 @@ func parseZone(r io.Reader, origin, f string, defttl *ttlState, t chan *Token, i
 				return
 			}
 			// Start with the new file
-			includePath := l.token
-			if !filepath.IsAbs(includePath) {
-				includePath = filepath.Join(filepath.Dir(f), includePath)
-			}
-			r1, e1 := os.Open(includePath)
+			r1, e1 := os.Open(l.token)
 			if e1 != nil {
-				msg := fmt.Sprintf("failed to open `%s'", l.token)
-				if !filepath.IsAbs(l.token) {
-					msg += fmt.Sprintf(" as `%s'", includePath)
-				}
-				t <- &Token{Error: &ParseError{f, msg, l}}
+				t <- &Token{Error: &ParseError{f, "failed to open `" + l.token + "'", l}}
 				return
 			}
 			if include+1 > 7 {
 				t <- &Token{Error: &ParseError{f, "too deeply nested $INCLUDE", l}}
 				return
 			}
-			parseZone(r1, neworigin, includePath, defttl, t, include+1)
+			parseZone(r1, neworigin, l.token, defttl, t, include+1)
 			st = zExpectOwnerDir
 		case zExpectDirTTLBl:
 			if l.value != zBlank {
@@ -577,7 +567,6 @@ func zlexer(s *scan, c chan lex) {
 								return
 							}
 							l.value = zRrtpe
-							rrtype = true
 							l.torc = t
 						}
 					}
@@ -601,7 +590,7 @@ func zlexer(s *scan, c chan lex) {
 				c <- l
 			}
 			stri = 0
-
+			// I reverse space stuff here
 			if !space && !commt {
 				l.value = zBlank
 				l.token = " "

vendor/github.com/miekg/dns/scan_rr.go

@@ -1255,10 +1255,8 @@ func setNSEC3(h RR_Header, c chan lex, o, f string) (RR, *ParseError, string) {
 	if len(l.token) == 0 || l.err {
 		return nil, &ParseError{f, "bad NSEC3 Salt", l}, ""
 	}
-	if l.token != "-" {
-		rr.SaltLength = uint8(len(l.token)) / 2
-		rr.Salt = l.token
-	}
+	rr.SaltLength = uint8(len(l.token)) / 2
+	rr.Salt = l.token
 
 	<-c
 	l = <-c
@@ -1323,10 +1321,8 @@ func setNSEC3PARAM(h RR_Header, c chan lex, o, f string) (RR, *ParseError, strin
 	rr.Iterations = uint16(i)
 	<-c
 	l = <-c
-	if l.token != "-" {
-		rr.SaltLength = uint8(len(l.token))
-		rr.Salt = l.token
-	}
+	rr.SaltLength = uint8(len(l.token))
+	rr.Salt = l.token
 	return rr, nil, ""
 }
 
@@ -2099,7 +2095,7 @@ func setTKEY(h RR_Header, c chan lex, o, f string) (RR, *ParseError, string) {
 		return nil, &ParseError{f, "bad TKEY algorithm", l}, ""
 	}
 	rr.Algorithm = l.token
-	<-c // zBlank
+	<-c     // zBlank
 
 	// Get the key length and key values
 	l = <-c
@@ -2108,13 +2104,13 @@ func setTKEY(h RR_Header, c chan lex, o, f string) (RR, *ParseError, string) {
 		return nil, &ParseError{f, "bad TKEY key length", l}, ""
 	}
 	rr.KeySize = uint16(i)
-	<-c // zBlank
+	<-c     // zBlank
 	l = <-c
 	if l.value != zString {
 		return nil, &ParseError{f, "bad TKEY key", l}, ""
 	}
 	rr.Key = l.token
-	<-c // zBlank
+	<-c     // zBlank
 
 	// Get the otherdata length and string data
 	l = <-c
@@ -2123,7 +2119,7 @@ func setTKEY(h RR_Header, c chan lex, o, f string) (RR, *ParseError, string) {
 		return nil, &ParseError{f, "bad TKEY otherdata length", l}, ""
 	}
 	rr.OtherLen = uint16(i)
-	<-c // zBlank
+	<-c     // zBlank
 	l = <-c
 	if l.value != zString {
 		return nil, &ParseError{f, "bad TKEY otherday", l}, ""

vendor/github.com/miekg/dns/server.go

@@ -9,19 +9,12 @@ import (
 	"io"
 	"net"
 	"sync"
-	"sync/atomic"
 	"time"
 )
 
-// Default maximum number of TCP queries before we close the socket.
+// Maximum number of TCP queries before we close the socket.
 const maxTCPQueries = 128
 
-// Interval for stop worker if no load
-const idleWorkerTimeout = 10 * time.Second
-
-// Maximum number of workers
-const maxWorkersCount = 10000
-
 // Handler is implemented by any value that implements ServeDNS.
 type Handler interface {
 	ServeDNS(w ResponseWriter, r *Msg)
@@ -50,7 +43,6 @@ type ResponseWriter interface {
 }
 
 type response struct {
-	msg            []byte
 	hijacked       bool // connection has been hijacked by handler
 	tsigStatus     error
 	tsigTimersOnly bool
@@ -59,6 +51,7 @@ type response struct {
 	udp            *net.UDPConn      // i/o connection if UDP was used
 	tcp            net.Conn          // i/o connection if TCP was used
 	udpSession     *SessionUDP       // oob data to get egress interface right
+	remoteAddr     net.Addr          // address of the client
 	writer         Writer            // writer to output the raw DNS bits
 }
 
@@ -303,63 +296,12 @@ type Server struct {
 	DecorateReader DecorateReader
 	// DecorateWriter is optional, allows customization of the process that writes raw DNS messages.
 	DecorateWriter DecorateWriter
-	// Maximum number of TCP queries before we close the socket. Default is maxTCPQueries (unlimited if -1).
-	MaxTCPQueries int
 
-	// UDP packet or TCP connection queue
-	queue chan *response
-	// Workers count
-	workersCount int32
 	// Shutdown handling
 	lock    sync.RWMutex
 	started bool
 }
 
-func (srv *Server) worker(w *response) {
-	srv.serve(w)
-
-	for {
-		count := atomic.LoadInt32(&srv.workersCount)
-		if count > maxWorkersCount {
-			return
-		}
-		if atomic.CompareAndSwapInt32(&srv.workersCount, count, count+1) {
-			break
-		}
-	}
-
-	defer atomic.AddInt32(&srv.workersCount, -1)
-
-	inUse := false
-	timeout := time.NewTimer(idleWorkerTimeout)
-	defer timeout.Stop()
-LOOP:
-	for {
-		select {
-		case w, ok := <-srv.queue:
-			if !ok {
-				break LOOP
-			}
-			inUse = true
-			srv.serve(w)
-		case <-timeout.C:
-			if !inUse {
-				break LOOP
-			}
-			inUse = false
-			timeout.Reset(idleWorkerTimeout)
-		}
-	}
-}
-
-func (srv *Server) spawnWorker(w *response) {
-	select {
-	case srv.queue <- w:
-	default:
-		go srv.worker(w)
-	}
-}
-
 // ListenAndServe starts a nameserver on the configured address in *Server.
 func (srv *Server) ListenAndServe() error {
 	srv.lock.Lock()
@@ -367,7 +309,6 @@ func (srv *Server) ListenAndServe() error {
 	if srv.started {
 		return &Error{err: "server already started"}
 	}
-
 	addr := srv.Addr
 	if addr == "" {
 		addr = ":domain"
@@ -375,8 +316,6 @@ func (srv *Server) ListenAndServe() error {
 	if srv.UDPSize == 0 {
 		srv.UDPSize = MinMsgSize
 	}
-	srv.queue = make(chan *response)
-	defer close(srv.queue)
 	switch srv.Net {
 	case "tcp", "tcp4", "tcp6":
 		a, err := net.ResolveTCPAddr(srv.Net, addr)
@@ -441,11 +380,8 @@ func (srv *Server) ActivateAndServe() error {
 	if srv.started {
 		return &Error{err: "server already started"}
 	}
-
 	pConn := srv.PacketConn
 	l := srv.Listener
-	srv.queue = make(chan *response)
-	defer close(srv.queue)
 	if pConn != nil {
 		if srv.UDPSize == 0 {
 			srv.UDPSize = MinMsgSize
@@ -503,6 +439,7 @@ func (srv *Server) getReadTimeout() time.Duration {
 }
 
 // serveTCP starts a TCP listener for the server.
+// Each request is handled in a separate goroutine.
 func (srv *Server) serveTCP(l net.Listener) error {
 	defer l.Close()
 
@@ -510,8 +447,26 @@ func (srv *Server) serveTCP(l net.Listener) error {
 		srv.NotifyStartedFunc()
 	}
 
+	reader := Reader(&defaultReader{srv})
+	if srv.DecorateReader != nil {
+		reader = srv.DecorateReader(reader)
+	}
+
+	handler := srv.Handler
+	if handler == nil {
+		handler = DefaultServeMux
+	}
+	rtimeout := srv.getReadTimeout()
+	// deadline is not used here
 	for {
 		rw, err := l.Accept()
+		if err != nil {
+			if neterr, ok := err.(net.Error); ok && neterr.Temporary() {
+				continue
+			}
+			return err
+		}
+		m, err := reader.ReadTCP(rw, rtimeout)
 		srv.lock.RLock()
 		if !srv.started {
 			srv.lock.RUnlock()
@@ -519,16 +474,14 @@ func (srv *Server) serveTCP(l net.Listener) error {
 		}
 		srv.lock.RUnlock()
 		if err != nil {
-			if neterr, ok := err.(net.Error); ok && neterr.Temporary() {
-				continue
-			}
-			return err
+			continue
 		}
-		srv.spawnWorker(&response{tsigSecret: srv.TsigSecret, tcp: rw})
+		go srv.serve(rw.RemoteAddr(), handler, m, nil, nil, rw)
 	}
 }
 
 // serveUDP starts a UDP listener for the server.
+// Each request is handled in a separate goroutine.
 func (srv *Server) serveUDP(l *net.UDPConn) error {
 	defer l.Close()
 
@@ -541,6 +494,10 @@ func (srv *Server) serveUDP(l *net.UDPConn) error {
 		reader = srv.DecorateReader(reader)
 	}
 
+	handler := srv.Handler
+	if handler == nil {
+		handler = DefaultServeMux
+	}
 	rtimeout := srv.getReadTimeout()
 	// deadline is not used here
 	for {
@@ -552,106 +509,82 @@ func (srv *Server) serveUDP(l *net.UDPConn) error {
 		}
 		srv.lock.RUnlock()
 		if err != nil {
-			if netErr, ok := err.(net.Error); ok && netErr.Temporary() {
-				continue
-			}
-			return err
-		}
-		if len(m) < headerSize {
 			continue
 		}
-		srv.spawnWorker(&response{msg: m, tsigSecret: srv.TsigSecret, udp: l, udpSession: s})
+		go srv.serve(s.RemoteAddr(), handler, m, l, s, nil)
 	}
 }
 
-func (srv *Server) serve(w *response) {
+// Serve a new connection.
+func (srv *Server) serve(a net.Addr, h Handler, m []byte, u *net.UDPConn, s *SessionUDP, t net.Conn) {
+	w := &response{tsigSecret: srv.TsigSecret, udp: u, tcp: t, remoteAddr: a, udpSession: s}
 	if srv.DecorateWriter != nil {
 		w.writer = srv.DecorateWriter(w)
 	} else {
 		w.writer = w
 	}
 
-	if w.udp != nil {
-		// serve UDP
-		srv.serveDNS(w)
-		return
-	}
+	q := 0 // counter for the amount of TCP queries we get
 
 	reader := Reader(&defaultReader{srv})
 	if srv.DecorateReader != nil {
 		reader = srv.DecorateReader(reader)
 	}
-
-	defer func() {
-		if !w.hijacked {
-			w.Close()
-		}
-	}()
-
-	idleTimeout := tcpIdleTimeout
-	if srv.IdleTimeout != nil {
-		idleTimeout = srv.IdleTimeout()
-	}
-
-	timeout := srv.getReadTimeout()
-
-	limit := srv.MaxTCPQueries
-	if limit == 0 {
-		limit = maxTCPQueries
-	}
-
-	for q := 0; q < limit || limit == -1; q++ {
-		var err error
-		w.msg, err = reader.ReadTCP(w.tcp, timeout)
-		if err != nil {
-			// TODO(tmthrgd): handle error
-			break
-		}
-		srv.serveDNS(w)
-		if w.tcp == nil {
-			break // Close() was called
-		}
-		if w.hijacked {
-			break // client will call Close() themselves
-		}
-		// The first read uses the read timeout, the rest use the
-		// idle timeout.
-		timeout = idleTimeout
-	}
-}
-
-func (srv *Server) serveDNS(w *response) {
+Redo:
 	req := new(Msg)
-	err := req.Unpack(w.msg)
+	err := req.Unpack(m)
 	if err != nil { // Send a FormatError back
 		x := new(Msg)
 		x.SetRcodeFormatError(req)
 		w.WriteMsg(x)
-		return
+		goto Exit
 	}
 	if !srv.Unsafe && req.Response {
-		return
+		goto Exit
 	}
 
 	w.tsigStatus = nil
 	if w.tsigSecret != nil {
 		if t := req.IsTsig(); t != nil {
-			if secret, ok := w.tsigSecret[t.Hdr.Name]; ok {
-				w.tsigStatus = TsigVerify(w.msg, secret, "", false)
-			} else {
-				w.tsigStatus = ErrSecret
+			secret := t.Hdr.Name
+			if _, ok := w.tsigSecret[secret]; !ok {
+				w.tsigStatus = ErrKeyAlg
 			}
+			w.tsigStatus = TsigVerify(m, w.tsigSecret[secret], "", false)
 			w.tsigTimersOnly = false
 			w.tsigRequestMAC = req.Extra[len(req.Extra)-1].(*TSIG).MAC
 		}
 	}
+	h.ServeDNS(w, req) // Writes back to the client
 
-	handler := srv.Handler
-	if handler == nil {
-		handler = DefaultServeMux
+Exit:
+	if w.tcp == nil {
+		return
+	}
+	// TODO(miek): make this number configurable?
+	if q > maxTCPQueries { // close socket after this many queries
+		w.Close()
+		return
 	}
 
-	handler.ServeDNS(w, req) // Writes back to the client
+	if w.hijacked {
+		return // client calls Close()
+	}
+	if u != nil { // UDP, "close" and return
+		w.Close()
+		return
+	}
+	idleTimeout := tcpIdleTimeout
+	if srv.IdleTimeout != nil {
+		idleTimeout = srv.IdleTimeout()
+	}
+	m, err = reader.ReadTCP(w.tcp, idleTimeout)
+	if err == nil {
+		q++
+		goto Redo
+	}
+	w.Close()
+	return
 }
 
 func (srv *Server) readTCP(conn net.Conn, timeout time.Duration) ([]byte, error) {
@@ -693,8 +626,11 @@ func (srv *Server) readUDP(conn *net.UDPConn, timeout time.Duration) ([]byte, *S
 	conn.SetReadDeadline(time.Now().Add(timeout))
 	m := make([]byte, srv.UDPSize)
 	n, s, err := ReadFromSessionUDP(conn, m)
-	if err != nil {
-		return nil, nil, err
+	if err != nil || n == 0 {
+		if err != nil {
+			return nil, nil, err
+		}
+		return nil, nil, ErrShortRead
 	}
 	m = m[:n]
 	return m, s, nil
@@ -754,12 +690,7 @@ func (w *response) LocalAddr() net.Addr {
 }
 
 // RemoteAddr implements the ResponseWriter.RemoteAddr method.
-func (w *response) RemoteAddr() net.Addr {
-	if w.tcp != nil {
-		return w.tcp.RemoteAddr()
-	}
-	return w.udpSession.RemoteAddr()
-}
+func (w *response) RemoteAddr() net.Addr { return w.remoteAddr }
 
 // TsigStatus implements the ResponseWriter.TsigStatus method.
 func (w *response) TsigStatus() error { return w.tsigStatus }

vendor/github.com/miekg/dns/types_generate.go

@@ -27,7 +27,8 @@ var skipLen = map[string]struct{}{
 }
 
 var packageHdr = `
-// Code generated by "go run types_generate.go"; DO NOT EDIT.
+// *** DO NOT MODIFY ***
+// AUTOGENERATED BY go generate from types_generate.go
 
 package dns
 
@@ -181,8 +182,6 @@ func main() {
 				fallthrough
 			case st.Tag(i) == `dns:"base64"`:
 				o("l += base64.StdEncoding.DecodedLen(len(rr.%s))\n")
-			case strings.HasPrefix(st.Tag(i), `dns:"size-hex:`): // this has an extra field where the length is stored
-				o("l += len(rr.%s)/2\n")
 			case strings.HasPrefix(st.Tag(i), `dns:"size-hex`):
 				fallthrough
 			case st.Tag(i) == `dns:"hex"`:
@@ -226,7 +225,7 @@ func main() {
 			continue
 		}
 		fmt.Fprintf(b, "func (rr *%s) copy() RR {\n", name)
-		fields := []string{"rr.Hdr"}
+		fields := []string{"*rr.Hdr.copyHeader()"}
 		for i := 1; i < st.NumFields(); i++ {
 			f := st.Field(i).Name()
 			if sl, ok := st.Field(i).Type().(*types.Slice); ok {

vendor/github.com/miekg/dns/udp.go

@@ -4,27 +4,8 @@ package dns
 
 import (
 	"net"
-
-	"golang.org/x/net/ipv4"
-	"golang.org/x/net/ipv6"
 )
 
-// This is the required size of the OOB buffer to pass to ReadMsgUDP.
-var udpOOBSize = func() int {
-	// We can't know whether we'll get an IPv4 control message or an
-	// IPv6 control message ahead of time. To get around this, we size
-	// the buffer equal to the largest of the two.
-
-	oob4 := ipv4.NewControlMessage(ipv4.FlagDst | ipv4.FlagInterface)
-	oob6 := ipv6.NewControlMessage(ipv6.FlagDst | ipv6.FlagInterface)
-
-	if len(oob4) > len(oob6) {
-		return len(oob4)
-	}
-
-	return len(oob6)
-}()
-
 // SessionUDP holds the remote address and the associated
 // out-of-band data.
 type SessionUDP struct {
@@ -38,7 +19,7 @@ func (s *SessionUDP) RemoteAddr() net.Addr { return s.raddr }
 // ReadFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
 // net.UDPAddr.
 func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
-	oob := make([]byte, udpOOBSize)
+	oob := make([]byte, 40)
 	n, oobn, _, raddr, err := conn.ReadMsgUDP(b, oob)
 	if err != nil {
 		return n, nil, err
@@ -53,50 +34,12 @@ func WriteToSessionUDP(conn *net.UDPConn, b []byte, session *SessionUDP) (int, e
 	return n, err
 }
 
-func setUDPSocketOptions(conn *net.UDPConn) error {
-	// Try setting the flags for both families and ignore the errors unless they
-	// both error.
-	err6 := ipv6.NewPacketConn(conn).SetControlMessage(ipv6.FlagDst|ipv6.FlagInterface, true)
-	err4 := ipv4.NewPacketConn(conn).SetControlMessage(ipv4.FlagDst|ipv4.FlagInterface, true)
-	if err6 != nil && err4 != nil {
-		return err4
-	}
-	return nil
-}
-
-// parseDstFromOOB takes oob data and returns the destination IP.
-func parseDstFromOOB(oob []byte) net.IP {
-	// Start with IPv6 and then fallback to IPv4
-	// TODO(fastest963): Figure out a way to prefer one or the other. Looking at
-	// the lvl of the header for a 0 or 41 isn't cross-platform.
-	cm6 := new(ipv6.ControlMessage)
-	if cm6.Parse(oob) == nil && cm6.Dst != nil {
-		return cm6.Dst
-	}
-	cm4 := new(ipv4.ControlMessage)
-	if cm4.Parse(oob) == nil && cm4.Dst != nil {
-		return cm4.Dst
-	}
-	return nil
-}
-
 // correctSource takes oob data and returns new oob data with the Src equal to the Dst
 func correctSource(oob []byte) []byte {
-	dst := parseDstFromOOB(oob)
-	if dst == nil {
+	dst, err := parseUDPSocketDst(oob)
+	// If the destination could not be determined, ignore.
+	if err != nil || dst == nil {
 		return nil
 	}
-	// If the dst is definitely an IPv6, then use ipv6's ControlMessage to
-	// respond otherwise use ipv4's because ipv6's marshal ignores ipv4
-	// addresses.
-	if dst.To4() == nil {
-		cm := new(ipv6.ControlMessage)
-		cm.Src = dst
-		oob = cm.Marshal()
-	} else {
-		cm := new(ipv4.ControlMessage)
-		cm.Src = dst
-		oob = cm.Marshal()
-	}
-	return oob
+	return marshalUDPSocketSrc(dst)
 }

vendor/github.com/miekg/dns/udp_linux.go

@@ -0,0 +1,220 @@
+// +build linux,!appengine
+
+package dns
+
+// See:
+// * http://stackoverflow.com/questions/3062205/setting-the-source-ip-for-a-udp-socket and
+// * http://blog.powerdns.com/2012/10/08/on-binding-datagram-udp-sockets-to-the-any-addresses/
+//
+// Why do we need this: When listening on 0.0.0.0 with UDP so kernel decides what is the outgoing
+// interface, this might not always be the correct one. This code will make sure the egress
+// packet's interface matched the ingress' one.
+
+import (
+	"net"
+	"syscall"
+	"unsafe"
+
+	"github.com/miekg/dns/internal/socket"
+)
+
+const (
+	sizeofInet6Pktinfo = 0x14
+	sizeofInetPktinfo  = 0xc
+	protocolIP         = 0
+	protocolIPv6       = 41
+)
+
+type inetPktinfo struct {
+	Ifindex  int32
+	Spec_dst [4]byte /* in_addr */
+	Addr     [4]byte /* in_addr */
+}
+
+type inet6Pktinfo struct {
+	Addr    [16]byte /* in6_addr */
+	Ifindex int32
+}
+
+type inetControlMessage struct {
+	Src net.IP // source address, specifying only
+	Dst net.IP // destination address, receiving only
+}
+
+// setUDPSocketOptions sets the UDP socket options.
+// This function is implemented on a per platform basis. See udp_*.go for more details
+func setUDPSocketOptions(conn *net.UDPConn) error {
+	sa, err := getUDPSocketName(conn)
+	if err != nil {
+		return err
+	}
+	switch sa.(type) {
+	case *syscall.SockaddrInet6:
+		v6only, err := getUDPSocketOptions6Only(conn)
+		if err != nil {
+			return err
+		}
+		setUDPSocketOptions6(conn)
+		if !v6only {
+			setUDPSocketOptions4(conn)
+		}
+	case *syscall.SockaddrInet4:
+		setUDPSocketOptions4(conn)
+	}
+	return nil
+}
+
+// setUDPSocketOptions4 prepares the v4 socket for sessions.
+func setUDPSocketOptions4(conn *net.UDPConn) error {
+	file, err := conn.File()
+	if err != nil {
+		return err
+	}
+	if err := syscall.SetsockoptInt(int(file.Fd()), syscall.IPPROTO_IP, syscall.IP_PKTINFO, 1); err != nil {
+		file.Close()
+		return err
+	}
+	// Calling File() above results in the connection becoming blocking, we must fix that.
+	// See https://github.com/miekg/dns/issues/279
+	err = syscall.SetNonblock(int(file.Fd()), true)
+	if err != nil {
+		file.Close()
+		return err
+	}
+	file.Close()
+	return nil
+}
+
+// setUDPSocketOptions6 prepares the v6 socket for sessions.
+func setUDPSocketOptions6(conn *net.UDPConn) error {
+	file, err := conn.File()
+	if err != nil {
+		return err
+	}
+	if err := syscall.SetsockoptInt(int(file.Fd()), syscall.IPPROTO_IPV6, syscall.IPV6_RECVPKTINFO, 1); err != nil {
+		file.Close()
+		return err
+	}
+	err = syscall.SetNonblock(int(file.Fd()), true)
+	if err != nil {
+		file.Close()
+		return err
+	}
+	file.Close()
+	return nil
+}
+
+// getUDPSocketOption6Only return true if the socket is v6 only and false when it is v4/v6 combined
+// (dualstack).
+func getUDPSocketOptions6Only(conn *net.UDPConn) (bool, error) {
+	file, err := conn.File()
+	if err != nil {
+		return false, err
+	}
+	// dual stack. See http://stackoverflow.com/questions/1618240/how-to-support-both-ipv4-and-ipv6-connections
+	v6only, err := syscall.GetsockoptInt(int(file.Fd()), syscall.IPPROTO_IPV6, syscall.IPV6_V6ONLY)
+	if err != nil {
+		file.Close()
+		return false, err
+	}
+	file.Close()
+	return v6only == 1, nil
+}
+
+func getUDPSocketName(conn *net.UDPConn) (syscall.Sockaddr, error) {
+	file, err := conn.File()
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	return syscall.Getsockname(int(file.Fd()))
+}
+
+// marshalInetPacketInfo marshals a ipv4 control message, returning
+// the byte slice for the next marshal, if any
+func marshalInetPacketInfo(b []byte, cm *inetControlMessage) []byte {
+	m := socket.ControlMessage(b)
+	m.MarshalHeader(protocolIP, syscall.IP_PKTINFO, sizeofInetPktinfo)
+	if cm != nil {
+		pi := (*inetPktinfo)(unsafe.Pointer(&m.Data(sizeofInetPktinfo)[0]))
+		if ip := cm.Src.To4(); ip != nil {
+			copy(pi.Spec_dst[:], ip)
+		}
+	}
+	return m.Next(sizeofInetPktinfo)
+}
+
+// marshalInet6PacketInfo marshals a ipv6 control message, returning
+// the byte slice for the next marshal, if any
+func marshalInet6PacketInfo(b []byte, cm *inetControlMessage) []byte {
+	m := socket.ControlMessage(b)
+	m.MarshalHeader(protocolIPv6, syscall.IPV6_PKTINFO, sizeofInet6Pktinfo)
+	if cm != nil {
+		pi := (*inet6Pktinfo)(unsafe.Pointer(&m.Data(sizeofInet6Pktinfo)[0]))
+		if ip := cm.Src.To16(); ip != nil && ip.To4() == nil {
+			copy(pi.Addr[:], ip)
+		}
+	}
+	return m.Next(sizeofInet6Pktinfo)
+}
+
+func parseInetPacketInfo(cm *inetControlMessage, b []byte) {
+	pi := (*inetPktinfo)(unsafe.Pointer(&b[0]))
+	if len(cm.Dst) < net.IPv4len {
+		cm.Dst = make(net.IP, net.IPv4len)
+	}
+	copy(cm.Dst, pi.Addr[:])
+}
+
+func parseInet6PacketInfo(cm *inetControlMessage, b []byte) {
+	pi := (*inet6Pktinfo)(unsafe.Pointer(&b[0]))
+	if len(cm.Dst) < net.IPv6len {
+		cm.Dst = make(net.IP, net.IPv6len)
+	}
+	copy(cm.Dst, pi.Addr[:])
+}
+
+// parseUDPSocketDst takes out-of-band data from ReadMsgUDP and parses it for
+// the Dst address
+func parseUDPSocketDst(oob []byte) (net.IP, error) {
+	cm := new(inetControlMessage)
+	ms, err := socket.ControlMessage(oob).Parse()
+	if err != nil {
+		return nil, err
+	}
+	for _, m := range ms {
+		lvl, typ, l, err := m.ParseHeader()
+		if err != nil {
+			return nil, err
+		}
+		if lvl == protocolIPv6 { // IPv6
+			if typ == syscall.IPV6_PKTINFO && l >= sizeofInet6Pktinfo {
+				parseInet6PacketInfo(cm, m.Data(l))
+			}
+		} else if lvl == protocolIP { // IPv4
+			if typ == syscall.IP_PKTINFO && l >= sizeofInetPktinfo {
+				parseInetPacketInfo(cm, m.Data(l))
+			}
+		}
+	}
+	return cm.Dst, nil
+}
+
+// marshalUDPSocketSrc takes the given src address and returns out-of-band data
+// to give to WriteMsgUDP
+func marshalUDPSocketSrc(src net.IP) []byte {
+	var oob []byte
+	// If the dst is definitely an ipv6, then use ipv6 control to respond
+	// otherwise use ipv4 because the ipv6 marshal ignores ipv4 messages.
+	// See marshalInet6PacketInfo
+	cm := new(inetControlMessage)
+	cm.Src = src
+	if src.To4() == nil {
+		oob = make([]byte, socket.ControlMessageSpace(sizeofInet6Pktinfo))
+		marshalInet6PacketInfo(oob, cm)
+	} else {
+		oob = make([]byte, socket.ControlMessageSpace(sizeofInetPktinfo))
+		marshalInetPacketInfo(oob, cm)
+	}
+	return oob
+}

vendor/github.com/miekg/dns/udp_other.go

@@ -0,0 +1,17 @@
+// +build !linux appengine
+
+package dns
+
+import (
+	"net"
+)
+
+// These do nothing. See udp_linux.go for an example of how to implement this.
+
+// We tried to adhire to some kind of naming scheme.
+func setUDPSocketOptions(conn *net.UDPConn) error              { return nil }
+func setUDPSocketOptions4(conn *net.UDPConn) error             { return nil }
+func setUDPSocketOptions6(conn *net.UDPConn) error             { return nil }
+func getUDPSocketOptions6Only(conn *net.UDPConn) (bool, error) { return false, nil }
+func parseUDPSocketDst(oob []byte) (net.IP, error)             { return nil, nil }
+func marshalUDPSocketSrc(src net.IP) []byte                    { return nil }

vendor/github.com/miekg/dns/udp_windows.go

@@ -14,7 +14,6 @@ func (s *SessionUDP) RemoteAddr() net.Addr { return s.raddr }
 
 // ReadFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
 // net.UDPAddr.
-// TODO(fastest963): Once go1.10 is released, use ReadMsgUDP.
 func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
 	n, raddr, err := conn.ReadFrom(b)
 	if err != nil {
@@ -25,13 +24,7 @@ func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
 }
 
 // WriteToSessionUDP acts just like net.UDPConn.WriteTo(), but uses a *SessionUDP instead of a net.Addr.
-// TODO(fastest963): Once go1.10 is released, use WriteMsgUDP.
 func WriteToSessionUDP(conn *net.UDPConn, b []byte, session *SessionUDP) (int, error) {
 	n, err := conn.WriteTo(b, session.raddr)
 	return n, err
 }
-
-// TODO(fastest963): Once go1.10 is released and we can use *MsgUDP methods
-// use the standard method in udp.go for these.
-func setUDPSocketOptions(*net.UDPConn) error { return nil }
-func parseDstFromOOB([]byte, net.IP) net.IP  { return nil }

vendor/github.com/miekg/dns/version.go

@@ -1,15 +0,0 @@
-package dns
-
-import "fmt"
-
-// Version is current version of this library.
-var Version = V{1, 0, 8}
-
-// V holds the version of this library.
-type V struct {
-	Major, Minor, Patch int
-}
-
-func (v V) String() string {
-	return fmt.Sprintf("%d.%d.%d", v.Major, v.Minor, v.Patch)
-}

vendor/github.com/miekg/dns/zcompress.go

@@ -1,155 +1,119 @@
-// Code generated by "go run compress_generate.go"; DO NOT EDIT.
+// *** DO NOT MODIFY ***
+// AUTOGENERATED BY go generate from compress_generate.go
 
 package dns
 
-func compressionLenHelperType(c map[string]int, r RR, initLen int) int {
-	currentLen := initLen
+func compressionLenHelperType(c map[string]int, r RR) {
 	switch x := r.(type) {
 	case *AFSDB:
-		currentLen -= len(x.Hostname) + 1
-		currentLen += compressionLenHelper(c, x.Hostname, currentLen)
+		compressionLenHelper(c, x.Hostname)
 	case *CNAME:
-		currentLen -= len(x.Target) + 1
-		currentLen += compressionLenHelper(c, x.Target, currentLen)
+		compressionLenHelper(c, x.Target)
 	case *DNAME:
-		currentLen -= len(x.Target) + 1
-		currentLen += compressionLenHelper(c, x.Target, currentLen)
+		compressionLenHelper(c, x.Target)
 	case *HIP:
 		for i := range x.RendezvousServers {
-			currentLen -= len(x.RendezvousServers[i]) + 1
-		}
-		for i := range x.RendezvousServers {
-			currentLen += compressionLenHelper(c, x.RendezvousServers[i], currentLen)
+			compressionLenHelper(c, x.RendezvousServers[i])
 		}
 	case *KX:
-		currentLen -= len(x.Exchanger) + 1
-		currentLen += compressionLenHelper(c, x.Exchanger, currentLen)
+		compressionLenHelper(c, x.Exchanger)
 	case *LP:
-		currentLen -= len(x.Fqdn) + 1
-		currentLen += compressionLenHelper(c, x.Fqdn, currentLen)
+		compressionLenHelper(c, x.Fqdn)
 	case *MB:
-		currentLen -= len(x.Mb) + 1
-		currentLen += compressionLenHelper(c, x.Mb, currentLen)
+		compressionLenHelper(c, x.Mb)
 	case *MD:
-		currentLen -= len(x.Md) + 1
-		currentLen += compressionLenHelper(c, x.Md, currentLen)
+		compressionLenHelper(c, x.Md)
 	case *MF:
-		currentLen -= len(x.Mf) + 1
-		currentLen += compressionLenHelper(c, x.Mf, currentLen)
+		compressionLenHelper(c, x.Mf)
 	case *MG:
-		currentLen -= len(x.Mg) + 1
-		currentLen += compressionLenHelper(c, x.Mg, currentLen)
+		compressionLenHelper(c, x.Mg)
 	case *MINFO:
-		currentLen -= len(x.Rmail) + 1
-		currentLen += compressionLenHelper(c, x.Rmail, currentLen)
-		currentLen -= len(x.Email) + 1
-		currentLen += compressionLenHelper(c, x.Email, currentLen)
+		compressionLenHelper(c, x.Rmail)
+		compressionLenHelper(c, x.Email)
 	case *MR:
-		currentLen -= len(x.Mr) + 1
-		currentLen += compressionLenHelper(c, x.Mr, currentLen)
+		compressionLenHelper(c, x.Mr)
 	case *MX:
-		currentLen -= len(x.Mx) + 1
-		currentLen += compressionLenHelper(c, x.Mx, currentLen)
+		compressionLenHelper(c, x.Mx)
 	case *NAPTR:
-		currentLen -= len(x.Replacement) + 1
-		currentLen += compressionLenHelper(c, x.Replacement, currentLen)
+		compressionLenHelper(c, x.Replacement)
 	case *NS:
-		currentLen -= len(x.Ns) + 1
-		currentLen += compressionLenHelper(c, x.Ns, currentLen)
+		compressionLenHelper(c, x.Ns)
 	case *NSAPPTR:
-		currentLen -= len(x.Ptr) + 1
-		currentLen += compressionLenHelper(c, x.Ptr, currentLen)
+		compressionLenHelper(c, x.Ptr)
 	case *NSEC:
-		currentLen -= len(x.NextDomain) + 1
-		currentLen += compressionLenHelper(c, x.NextDomain, currentLen)
+		compressionLenHelper(c, x.NextDomain)
 	case *PTR:
-		currentLen -= len(x.Ptr) + 1
-		currentLen += compressionLenHelper(c, x.Ptr, currentLen)
+		compressionLenHelper(c, x.Ptr)
 	case *PX:
-		currentLen -= len(x.Map822) + 1
-		currentLen += compressionLenHelper(c, x.Map822, currentLen)
-		currentLen -= len(x.Mapx400) + 1
-		currentLen += compressionLenHelper(c, x.Mapx400, currentLen)
+		compressionLenHelper(c, x.Map822)
+		compressionLenHelper(c, x.Mapx400)
 	case *RP:
-		currentLen -= len(x.Mbox) + 1
-		currentLen += compressionLenHelper(c, x.Mbox, currentLen)
-		currentLen -= len(x.Txt) + 1
-		currentLen += compressionLenHelper(c, x.Txt, currentLen)
+		compressionLenHelper(c, x.Mbox)
+		compressionLenHelper(c, x.Txt)
 	case *RRSIG:
-		currentLen -= len(x.SignerName) + 1
-		currentLen += compressionLenHelper(c, x.SignerName, currentLen)
+		compressionLenHelper(c, x.SignerName)
 	case *RT:
-		currentLen -= len(x.Host) + 1
-		currentLen += compressionLenHelper(c, x.Host, currentLen)
+		compressionLenHelper(c, x.Host)
 	case *SIG:
-		currentLen -= len(x.SignerName) + 1
-		currentLen += compressionLenHelper(c, x.SignerName, currentLen)
+		compressionLenHelper(c, x.SignerName)
 	case *SOA:
-		currentLen -= len(x.Ns) + 1
-		currentLen += compressionLenHelper(c, x.Ns, currentLen)
-		currentLen -= len(x.Mbox) + 1
-		currentLen += compressionLenHelper(c, x.Mbox, currentLen)
+		compressionLenHelper(c, x.Ns)
+		compressionLenHelper(c, x.Mbox)
 	case *SRV:
-		currentLen -= len(x.Target) + 1
-		currentLen += compressionLenHelper(c, x.Target, currentLen)
+		compressionLenHelper(c, x.Target)
 	case *TALINK:
-		currentLen -= len(x.PreviousName) + 1
-		currentLen += compressionLenHelper(c, x.PreviousName, currentLen)
-		currentLen -= len(x.NextName) + 1
-		currentLen += compressionLenHelper(c, x.NextName, currentLen)
+		compressionLenHelper(c, x.PreviousName)
+		compressionLenHelper(c, x.NextName)
 	case *TKEY:
-		currentLen -= len(x.Algorithm) + 1
-		currentLen += compressionLenHelper(c, x.Algorithm, currentLen)
+		compressionLenHelper(c, x.Algorithm)
 	case *TSIG:
-		currentLen -= len(x.Algorithm) + 1
-		currentLen += compressionLenHelper(c, x.Algorithm, currentLen)
+		compressionLenHelper(c, x.Algorithm)
 	}
-	return currentLen - initLen
 }
 
-func compressionLenSearchType(c map[string]int, r RR) (int, bool, int) {
+func compressionLenSearchType(c map[string]int, r RR) (int, bool) {
 	switch x := r.(type) {
 	case *AFSDB:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Hostname)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Hostname)
+		return k1, ok1
 	case *CNAME:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Target)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Target)
+		return k1, ok1
 	case *MB:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Mb)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Mb)
+		return k1, ok1
 	case *MD:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Md)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Md)
+		return k1, ok1
 	case *MF:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Mf)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Mf)
+		return k1, ok1
 	case *MG:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Mg)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Mg)
+		return k1, ok1
 	case *MINFO:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Rmail)
-		k2, ok2, sz2 := compressionLenSearch(c, x.Email)
-		return k1 + k2, ok1 && ok2, sz1 + sz2
+		k1, ok1 := compressionLenSearch(c, x.Rmail)
+		k2, ok2 := compressionLenSearch(c, x.Email)
+		return k1 + k2, ok1 && ok2
 	case *MR:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Mr)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Mr)
+		return k1, ok1
 	case *MX:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Mx)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Mx)
+		return k1, ok1
 	case *NS:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Ns)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Ns)
+		return k1, ok1
 	case *PTR:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Ptr)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Ptr)
+		return k1, ok1
 	case *RT:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Host)
-		return k1, ok1, sz1
+		k1, ok1 := compressionLenSearch(c, x.Host)
+		return k1, ok1
 	case *SOA:
-		k1, ok1, sz1 := compressionLenSearch(c, x.Ns)
-		k2, ok2, sz2 := compressionLenSearch(c, x.Mbox)
-		return k1 + k2, ok1 && ok2, sz1 + sz2
+		k1, ok1 := compressionLenSearch(c, x.Ns)
+		k2, ok2 := compressionLenSearch(c, x.Mbox)
+		return k1 + k2, ok1 && ok2
 	}
-	return 0, false, 0
+	return 0, false
 }

vendor/github.com/miekg/dns/zmsg.go

@@ -1,4 +1,5 @@
-// Code generated by "go run msg_generate.go"; DO NOT EDIT.
+// *** DO NOT MODIFY ***
+// AUTOGENERATED BY go generate from msg_generate.go
 
 package dns
 

vendor/github.com/miekg/dns/ztypes.go

@@ -1,4 +1,5 @@
-// Code generated by "go run types_generate.go"; DO NOT EDIT.
+// *** DO NOT MODIFY ***
+// AUTOGENERATED BY go generate from types_generate.go
 
 package dns
 
@@ -347,7 +348,7 @@ func (rr *HIP) len() int {
 	l++    // HitLength
 	l++    // PublicKeyAlgorithm
 	l += 2 // PublicKeyLength
-	l += len(rr.Hit) / 2
+	l += len(rr.Hit)/2 + 1
 	l += base64.StdEncoding.DecodedLen(len(rr.PublicKey))
 	for _, x := range rr.RendezvousServers {
 		l += len(x) + 1
@@ -470,7 +471,7 @@ func (rr *NSEC3PARAM) len() int {
 	l++    // Flags
 	l += 2 // Iterations
 	l++    // SaltLength
-	l += len(rr.Salt) / 2
+	l += len(rr.Salt)/2 + 1
 	return l
 }
 func (rr *OPENPGPKEY) len() int {
@@ -591,9 +592,9 @@ func (rr *TKEY) len() int {
 	l += 2 // Mode
 	l += 2 // Error
 	l += 2 // KeySize
-	l += len(rr.Key) / 2
+	l += len(rr.Key) + 1
 	l += 2 // OtherLen
-	l += len(rr.OtherData) / 2
+	l += len(rr.OtherData) + 1
 	return l
 }
 func (rr *TLSA) len() int {
@@ -610,11 +611,11 @@ func (rr *TSIG) len() int {
 	l += 6 // TimeSigned
 	l += 2 // Fudge
 	l += 2 // MACSize
-	l += len(rr.MAC) / 2
+	l += len(rr.MAC)/2 + 1
 	l += 2 // OrigId
 	l += 2 // Error
 	l += 2 // OtherLen
-	l += len(rr.OtherData) / 2
+	l += len(rr.OtherData)/2 + 1
 	return l
 }
 func (rr *TXT) len() int {
@@ -649,215 +650,215 @@ func (rr *X25) len() int {
 
 // copy() functions
 func (rr *A) copy() RR {
-	return &A{rr.Hdr, copyIP(rr.A)}
+	return &A{*rr.Hdr.copyHeader(), copyIP(rr.A)}
 }
 func (rr *AAAA) copy() RR {
-	return &AAAA{rr.Hdr, copyIP(rr.AAAA)}
+	return &AAAA{*rr.Hdr.copyHeader(), copyIP(rr.AAAA)}
 }
 func (rr *AFSDB) copy() RR {
-	return &AFSDB{rr.Hdr, rr.Subtype, rr.Hostname}
+	return &AFSDB{*rr.Hdr.copyHeader(), rr.Subtype, rr.Hostname}
 }
 func (rr *ANY) copy() RR {
-	return &ANY{rr.Hdr}
+	return &ANY{*rr.Hdr.copyHeader()}
 }
 func (rr *AVC) copy() RR {
 	Txt := make([]string, len(rr.Txt))
 	copy(Txt, rr.Txt)
-	return &AVC{rr.Hdr, Txt}
+	return &AVC{*rr.Hdr.copyHeader(), Txt}
 }
 func (rr *CAA) copy() RR {
-	return &CAA{rr.Hdr, rr.Flag, rr.Tag, rr.Value}
+	return &CAA{*rr.Hdr.copyHeader(), rr.Flag, rr.Tag, rr.Value}
 }
 func (rr *CERT) copy() RR {
-	return &CERT{rr.Hdr, rr.Type, rr.KeyTag, rr.Algorithm, rr.Certificate}
+	return &CERT{*rr.Hdr.copyHeader(), rr.Type, rr.KeyTag, rr.Algorithm, rr.Certificate}
 }
 func (rr *CNAME) copy() RR {
-	return &CNAME{rr.Hdr, rr.Target}
+	return &CNAME{*rr.Hdr.copyHeader(), rr.Target}
 }
 func (rr *CSYNC) copy() RR {
 	TypeBitMap := make([]uint16, len(rr.TypeBitMap))
 	copy(TypeBitMap, rr.TypeBitMap)
-	return &CSYNC{rr.Hdr, rr.Serial, rr.Flags, TypeBitMap}
+	return &CSYNC{*rr.Hdr.copyHeader(), rr.Serial, rr.Flags, TypeBitMap}
 }
 func (rr *DHCID) copy() RR {
-	return &DHCID{rr.Hdr, rr.Digest}
+	return &DHCID{*rr.Hdr.copyHeader(), rr.Digest}
 }
 func (rr *DNAME) copy() RR {
-	return &DNAME{rr.Hdr, rr.Target}
+	return &DNAME{*rr.Hdr.copyHeader(), rr.Target}
 }
 func (rr *DNSKEY) copy() RR {
-	return &DNSKEY{rr.Hdr, rr.Flags, rr.Protocol, rr.Algorithm, rr.PublicKey}
+	return &DNSKEY{*rr.Hdr.copyHeader(), rr.Flags, rr.Protocol, rr.Algorithm, rr.PublicKey}
 }
 func (rr *DS) copy() RR {
-	return &DS{rr.Hdr, rr.KeyTag, rr.Algorithm, rr.DigestType, rr.Digest}
+	return &DS{*rr.Hdr.copyHeader(), rr.KeyTag, rr.Algorithm, rr.DigestType, rr.Digest}
 }
 func (rr *EID) copy() RR {
-	return &EID{rr.Hdr, rr.Endpoint}
+	return &EID{*rr.Hdr.copyHeader(), rr.Endpoint}
 }
 func (rr *EUI48) copy() RR {
-	return &EUI48{rr.Hdr, rr.Address}
+	return &EUI48{*rr.Hdr.copyHeader(), rr.Address}
 }
 func (rr *EUI64) copy() RR {
-	return &EUI64{rr.Hdr, rr.Address}
+	return &EUI64{*rr.Hdr.copyHeader(), rr.Address}
 }
 func (rr *GID) copy() RR {
-	return &GID{rr.Hdr, rr.Gid}
+	return &GID{*rr.Hdr.copyHeader(), rr.Gid}
 }
 func (rr *GPOS) copy() RR {
-	return &GPOS{rr.Hdr, rr.Longitude, rr.Latitude, rr.Altitude}
+	return &GPOS{*rr.Hdr.copyHeader(), rr.Longitude, rr.Latitude, rr.Altitude}
 }
 func (rr *HINFO) copy() RR {
-	return &HINFO{rr.Hdr, rr.Cpu, rr.Os}
+	return &HINFO{*rr.Hdr.copyHeader(), rr.Cpu, rr.Os}
 }
 func (rr *HIP) copy() RR {
 	RendezvousServers := make([]string, len(rr.RendezvousServers))
 	copy(RendezvousServers, rr.RendezvousServers)
-	return &HIP{rr.Hdr, rr.HitLength, rr.PublicKeyAlgorithm, rr.PublicKeyLength, rr.Hit, rr.PublicKey, RendezvousServers}
+	return &HIP{*rr.Hdr.copyHeader(), rr.HitLength, rr.PublicKeyAlgorithm, rr.PublicKeyLength, rr.Hit, rr.PublicKey, RendezvousServers}
 }
 func (rr *KX) copy() RR {
-	return &KX{rr.Hdr, rr.Preference, rr.Exchanger}
+	return &KX{*rr.Hdr.copyHeader(), rr.Preference, rr.Exchanger}
 }
 func (rr *L32) copy() RR {
-	return &L32{rr.Hdr, rr.Preference, copyIP(rr.Locator32)}
+	return &L32{*rr.Hdr.copyHeader(), rr.Preference, copyIP(rr.Locator32)}
 }
 func (rr *L64) copy() RR {
-	return &L64{rr.Hdr, rr.Preference, rr.Locator64}
+	return &L64{*rr.Hdr.copyHeader(), rr.Preference, rr.Locator64}
 }
 func (rr *LOC) copy() RR {
-	return &LOC{rr.Hdr, rr.Version, rr.Size, rr.HorizPre, rr.VertPre, rr.Latitude, rr.Longitude, rr.Altitude}
+	return &LOC{*rr.Hdr.copyHeader(), rr.Version, rr.Size, rr.HorizPre, rr.VertPre, rr.Latitude, rr.Longitude, rr.Altitude}
 }
 func (rr *LP) copy() RR {
-	return &LP{rr.Hdr, rr.Preference, rr.Fqdn}
+	return &LP{*rr.Hdr.copyHeader(), rr.Preference, rr.Fqdn}
 }
 func (rr *MB) copy() RR {
-	return &MB{rr.Hdr, rr.Mb}
+	return &MB{*rr.Hdr.copyHeader(), rr.Mb}
 }
 func (rr *MD) copy() RR {
-	return &MD{rr.Hdr, rr.Md}
+	return &MD{*rr.Hdr.copyHeader(), rr.Md}
 }
 func (rr *MF) copy() RR {
-	return &MF{rr.Hdr, rr.Mf}
+	return &MF{*rr.Hdr.copyHeader(), rr.Mf}
 }
 func (rr *MG) copy() RR {
-	return &MG{rr.Hdr, rr.Mg}
+	return &MG{*rr.Hdr.copyHeader(), rr.Mg}
 }
 func (rr *MINFO) copy() RR {
-	return &MINFO{rr.Hdr, rr.Rmail, rr.Email}
+	return &MINFO{*rr.Hdr.copyHeader(), rr.Rmail, rr.Email}
 }
 func (rr *MR) copy() RR {
-	return &MR{rr.Hdr, rr.Mr}
+	return &MR{*rr.Hdr.copyHeader(), rr.Mr}
 }
 func (rr *MX) copy() RR {
-	return &MX{rr.Hdr, rr.Preference, rr.Mx}
+	return &MX{*rr.Hdr.copyHeader(), rr.Preference, rr.Mx}
 }
 func (rr *NAPTR) copy() RR {
-	return &NAPTR{rr.Hdr, rr.Order, rr.Preference, rr.Flags, rr.Service, rr.Regexp, rr.Replacement}
+	return &NAPTR{*rr.Hdr.copyHeader(), rr.Order, rr.Preference, rr.Flags, rr.Service, rr.Regexp, rr.Replacement}
 }
 func (rr *NID) copy() RR {
-	return &NID{rr.Hdr, rr.Preference, rr.NodeID}
+	return &NID{*rr.Hdr.copyHeader(), rr.Preference, rr.NodeID}
 }
 func (rr *NIMLOC) copy() RR {
-	return &NIMLOC{rr.Hdr, rr.Locator}
+	return &NIMLOC{*rr.Hdr.copyHeader(), rr.Locator}
 }
 func (rr *NINFO) copy() RR {
 	ZSData := make([]string, len(rr.ZSData))
 	copy(ZSData, rr.ZSData)
-	return &NINFO{rr.Hdr, ZSData}
+	return &NINFO{*rr.Hdr.copyHeader(), ZSData}
 }
 func (rr *NS) copy() RR {
-	return &NS{rr.Hdr, rr.Ns}
+	return &NS{*rr.Hdr.copyHeader(), rr.Ns}
 }
 func (rr *NSAPPTR) copy() RR {
-	return &NSAPPTR{rr.Hdr, rr.Ptr}
+	return &NSAPPTR{*rr.Hdr.copyHeader(), rr.Ptr}
 }
 func (rr *NSEC) copy() RR {
 	TypeBitMap := make([]uint16, len(rr.TypeBitMap))
 	copy(TypeBitMap, rr.TypeBitMap)
-	return &NSEC{rr.Hdr, rr.NextDomain, TypeBitMap}
+	return &NSEC{*rr.Hdr.copyHeader(), rr.NextDomain, TypeBitMap}
 }
 func (rr *NSEC3) copy() RR {
 	TypeBitMap := make([]uint16, len(rr.TypeBitMap))
 	copy(TypeBitMap, rr.TypeBitMap)
-	return &NSEC3{rr.Hdr, rr.Hash, rr.Flags, rr.Iterations, rr.SaltLength, rr.Salt, rr.HashLength, rr.NextDomain, TypeBitMap}
+	return &NSEC3{*rr.Hdr.copyHeader(), rr.Hash, rr.Flags, rr.Iterations, rr.SaltLength, rr.Salt, rr.HashLength, rr.NextDomain, TypeBitMap}
 }
 func (rr *NSEC3PARAM) copy() RR {
-	return &NSEC3PARAM{rr.Hdr, rr.Hash, rr.Flags, rr.Iterations, rr.SaltLength, rr.Salt}
+	return &NSEC3PARAM{*rr.Hdr.copyHeader(), rr.Hash, rr.Flags, rr.Iterations, rr.SaltLength, rr.Salt}
 }
 func (rr *OPENPGPKEY) copy() RR {
-	return &OPENPGPKEY{rr.Hdr, rr.PublicKey}
+	return &OPENPGPKEY{*rr.Hdr.copyHeader(), rr.PublicKey}
 }
 func (rr *OPT) copy() RR {
 	Option := make([]EDNS0, len(rr.Option))
 	copy(Option, rr.Option)
-	return &OPT{rr.Hdr, Option}
+	return &OPT{*rr.Hdr.copyHeader(), Option}
 }
 func (rr *PTR) copy() RR {
-	return &PTR{rr.Hdr, rr.Ptr}
+	return &PTR{*rr.Hdr.copyHeader(), rr.Ptr}
 }
 func (rr *PX) copy() RR {
-	return &PX{rr.Hdr, rr.Preference, rr.Map822, rr.Mapx400}
+	return &PX{*rr.Hdr.copyHeader(), rr.Preference, rr.Map822, rr.Mapx400}
 }
 func (rr *RFC3597) copy() RR {
-	return &RFC3597{rr.Hdr, rr.Rdata}
+	return &RFC3597{*rr.Hdr.copyHeader(), rr.Rdata}
 }
 func (rr *RKEY) copy() RR {
-	return &RKEY{rr.Hdr, rr.Flags, rr.Protocol, rr.Algorithm, rr.PublicKey}
+	return &RKEY{*rr.Hdr.copyHeader(), rr.Flags, rr.Protocol, rr.Algorithm, rr.PublicKey}
 }
 func (rr *RP) copy() RR {
-	return &RP{rr.Hdr, rr.Mbox, rr.Txt}
+	return &RP{*rr.Hdr.copyHeader(), rr.Mbox, rr.Txt}
 }
 func (rr *RRSIG) copy() RR {
-	return &RRSIG{rr.Hdr, rr.TypeCovered, rr.Algorithm, rr.Labels, rr.OrigTtl, rr.Expiration, rr.Inception, rr.KeyTag, rr.SignerName, rr.Signature}
+	return &RRSIG{*rr.Hdr.copyHeader(), rr.TypeCovered, rr.Algorithm, rr.Labels, rr.OrigTtl, rr.Expiration, rr.Inception, rr.KeyTag, rr.SignerName, rr.Signature}
 }
 func (rr *RT) copy() RR {
-	return &RT{rr.Hdr, rr.Preference, rr.Host}
+	return &RT{*rr.Hdr.copyHeader(), rr.Preference, rr.Host}
 }
 func (rr *SMIMEA) copy() RR {
-	return &SMIMEA{rr.Hdr, rr.Usage, rr.Selector, rr.MatchingType, rr.Certificate}
+	return &SMIMEA{*rr.Hdr.copyHeader(), rr.Usage, rr.Selector, rr.MatchingType, rr.Certificate}
 }
 func (rr *SOA) copy() RR {
-	return &SOA{rr.Hdr, rr.Ns, rr.Mbox, rr.Serial, rr.Refresh, rr.Retry, rr.Expire, rr.Minttl}
+	return &SOA{*rr.Hdr.copyHeader(), rr.Ns, rr.Mbox, rr.Serial, rr.Refresh, rr.Retry, rr.Expire, rr.Minttl}
 }
 func (rr *SPF) copy() RR {
 	Txt := make([]string, len(rr.Txt))
 	copy(Txt, rr.Txt)
-	return &SPF{rr.Hdr, Txt}
+	return &SPF{*rr.Hdr.copyHeader(), Txt}
 }
 func (rr *SRV) copy() RR {
-	return &SRV{rr.Hdr, rr.Priority, rr.Weight, rr.Port, rr.Target}
+	return &SRV{*rr.Hdr.copyHeader(), rr.Priority, rr.Weight, rr.Port, rr.Target}
 }
 func (rr *SSHFP) copy() RR {
-	return &SSHFP{rr.Hdr, rr.Algorithm, rr.Type, rr.FingerPrint}
+	return &SSHFP{*rr.Hdr.copyHeader(), rr.Algorithm, rr.Type, rr.FingerPrint}
 }
 func (rr *TA) copy() RR {
-	return &TA{rr.Hdr, rr.KeyTag, rr.Algorithm, rr.DigestType, rr.Digest}
+	return &TA{*rr.Hdr.copyHeader(), rr.KeyTag, rr.Algorithm, rr.DigestType, rr.Digest}
 }
 func (rr *TALINK) copy() RR {
-	return &TALINK{rr.Hdr, rr.PreviousName, rr.NextName}
+	return &TALINK{*rr.Hdr.copyHeader(), rr.PreviousName, rr.NextName}
 }
 func (rr *TKEY) copy() RR {
-	return &TKEY{rr.Hdr, rr.Algorithm, rr.Inception, rr.Expiration, rr.Mode, rr.Error, rr.KeySize, rr.Key, rr.OtherLen, rr.OtherData}
+	return &TKEY{*rr.Hdr.copyHeader(), rr.Algorithm, rr.Inception, rr.Expiration, rr.Mode, rr.Error, rr.KeySize, rr.Key, rr.OtherLen, rr.OtherData}
 }
 func (rr *TLSA) copy() RR {
-	return &TLSA{rr.Hdr, rr.Usage, rr.Selector, rr.MatchingType, rr.Certificate}
+	return &TLSA{*rr.Hdr.copyHeader(), rr.Usage, rr.Selector, rr.MatchingType, rr.Certificate}
 }
 func (rr *TSIG) copy() RR {
-	return &TSIG{rr.Hdr, rr.Algorithm, rr.TimeSigned, rr.Fudge, rr.MACSize, rr.MAC, rr.OrigId, rr.Error, rr.OtherLen, rr.OtherData}
+	return &TSIG{*rr.Hdr.copyHeader(), rr.Algorithm, rr.TimeSigned, rr.Fudge, rr.MACSize, rr.MAC, rr.OrigId, rr.Error, rr.OtherLen, rr.OtherData}
 }
 func (rr *TXT) copy() RR {
 	Txt := make([]string, len(rr.Txt))
 	copy(Txt, rr.Txt)
-	return &TXT{rr.Hdr, Txt}
+	return &TXT{*rr.Hdr.copyHeader(), Txt}
 }
 func (rr *UID) copy() RR {
-	return &UID{rr.Hdr, rr.Uid}
+	return &UID{*rr.Hdr.copyHeader(), rr.Uid}
 }
 func (rr *UINFO) copy() RR {
-	return &UINFO{rr.Hdr, rr.Uinfo}
+	return &UINFO{*rr.Hdr.copyHeader(), rr.Uinfo}
 }
 func (rr *URI) copy() RR {
-	return &URI{rr.Hdr, rr.Priority, rr.Weight, rr.Target}
+	return &URI{*rr.Hdr.copyHeader(), rr.Priority, rr.Weight, rr.Target}
 }
 func (rr *X25) copy() RR {
-	return &X25{rr.Hdr, rr.PSDNAddress}
+	return &X25{*rr.Hdr.copyHeader(), rr.PSDNAddress}
 }

vendor/golang.org/x/net/bpf/asm.go

@@ -1,41 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package bpf
-
-import "fmt"
-
-// Assemble converts insts into raw instructions suitable for loading
-// into a BPF virtual machine.
-//
-// Currently, no optimization is attempted, the assembled program flow
-// is exactly as provided.
-func Assemble(insts []Instruction) ([]RawInstruction, error) {
-	ret := make([]RawInstruction, len(insts))
-	var err error
-	for i, inst := range insts {
-		ret[i], err = inst.Assemble()
-		if err != nil {
-			return nil, fmt.Errorf("assembling instruction %d: %s", i+1, err)
-		}
-	}
-	return ret, nil
-}
-
-// Disassemble attempts to parse raw back into
-// Instructions. Unrecognized RawInstructions are assumed to be an
-// extension not implemented by this package, and are passed through
-// unchanged to the output. The allDecoded value reports whether insts
-// contains no RawInstructions.
-func Disassemble(raw []RawInstruction) (insts []Instruction, allDecoded bool) {
-	insts = make([]Instruction, len(raw))
-	allDecoded = true
-	for i, r := range raw {
-		insts[i] = r.Disassemble()
-		if _, ok := insts[i].(RawInstruction); ok {
-			allDecoded = false
-		}
-	}
-	return insts, allDecoded
-}

vendor/golang.org/x/net/bpf/constants.go

@@ -1,218 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package bpf
-
-// A Register is a register of the BPF virtual machine.
-type Register uint16
-
-const (
-	// RegA is the accumulator register. RegA is always the
-	// destination register of ALU operations.
-	RegA Register = iota
-	// RegX is the indirection register, used by LoadIndirect
-	// operations.
-	RegX
-)
-
-// An ALUOp is an arithmetic or logic operation.
-type ALUOp uint16
-
-// ALU binary operation types.
-const (
-	ALUOpAdd ALUOp = iota << 4
-	ALUOpSub
-	ALUOpMul
-	ALUOpDiv
-	ALUOpOr
-	ALUOpAnd
-	ALUOpShiftLeft
-	ALUOpShiftRight
-	aluOpNeg // Not exported because it's the only unary ALU operation, and gets its own instruction type.
-	ALUOpMod
-	ALUOpXor
-)
-
-// A JumpTest is a comparison operator used in conditional jumps.
-type JumpTest uint16
-
-// Supported operators for conditional jumps.
-const (
-	// K == A
-	JumpEqual JumpTest = iota
-	// K != A
-	JumpNotEqual
-	// K > A
-	JumpGreaterThan
-	// K < A
-	JumpLessThan
-	// K >= A
-	JumpGreaterOrEqual
-	// K <= A
-	JumpLessOrEqual
-	// K & A != 0
-	JumpBitsSet
-	// K & A == 0
-	JumpBitsNotSet
-)
-
-// An Extension is a function call provided by the kernel that
-// performs advanced operations that are expensive or impossible
-// within the BPF virtual machine.
-//
-// Extensions are only implemented by the Linux kernel.
-//
-// TODO: should we prune this list? Some of these extensions seem
-// either broken or near-impossible to use correctly, whereas other
-// (len, random, ifindex) are quite useful.
-type Extension int
-
-// Extension functions available in the Linux kernel.
-const (
-	// extOffset is the negative maximum number of instructions used
-	// to load instructions by overloading the K argument.
-	extOffset = -0x1000
-	// ExtLen returns the length of the packet.
-	ExtLen Extension = 1
-	// ExtProto returns the packet's L3 protocol type.
-	ExtProto Extension = 0
-	// ExtType returns the packet's type (skb->pkt_type in the kernel)
-	//
-	// TODO: better documentation. How nice an API do we want to
-	// provide for these esoteric extensions?
-	ExtType Extension = 4
-	// ExtPayloadOffset returns the offset of the packet payload, or
-	// the first protocol header that the kernel does not know how to
-	// parse.
-	ExtPayloadOffset Extension = 52
-	// ExtInterfaceIndex returns the index of the interface on which
-	// the packet was received.
-	ExtInterfaceIndex Extension = 8
-	// ExtNetlinkAttr returns the netlink attribute of type X at
-	// offset A.
-	ExtNetlinkAttr Extension = 12
-	// ExtNetlinkAttrNested returns the nested netlink attribute of
-	// type X at offset A.
-	ExtNetlinkAttrNested Extension = 16
-	// ExtMark returns the packet's mark value.
-	ExtMark Extension = 20
-	// ExtQueue returns the packet's assigned hardware queue.
-	ExtQueue Extension = 24
-	// ExtLinkLayerType returns the packet's hardware address type
-	// (e.g. Ethernet, Infiniband).
-	ExtLinkLayerType Extension = 28
-	// ExtRXHash returns the packets receive hash.
-	//
-	// TODO: figure out what this rxhash actually is.
-	ExtRXHash Extension = 32
-	// ExtCPUID returns the ID of the CPU processing the current
-	// packet.
-	ExtCPUID Extension = 36
-	// ExtVLANTag returns the packet's VLAN tag.
-	ExtVLANTag Extension = 44
-	// ExtVLANTagPresent returns non-zero if the packet has a VLAN
-	// tag.
-	//
-	// TODO: I think this might be a lie: it reads bit 0x1000 of the
-	// VLAN header, which changed meaning in recent revisions of the
-	// spec - this extension may now return meaningless information.
-	ExtVLANTagPresent Extension = 48
-	// ExtVLANProto returns 0x8100 if the frame has a VLAN header,
-	// 0x88a8 if the frame has a "Q-in-Q" double VLAN header, or some
-	// other value if no VLAN information is present.
-	ExtVLANProto Extension = 60
-	// ExtRand returns a uniformly random uint32.
-	ExtRand Extension = 56
-)
-
-// The following gives names to various bit patterns used in opcode construction.
-
-const (
-	opMaskCls uint16 = 0x7
-	// opClsLoad masks
-	opMaskLoadDest  = 0x01
-	opMaskLoadWidth = 0x18
-	opMaskLoadMode  = 0xe0
-	// opClsALU
-	opMaskOperandSrc = 0x08
-	opMaskOperator   = 0xf0
-	// opClsJump
-	opMaskJumpConst = 0x0f
-	opMaskJumpCond  = 0xf0
-)
-
-const (
-	// +---------------+-----------------+---+---+---+
-	// | AddrMode (3b) | LoadWidth (2b)  | 0 | 0 | 0 |
-	// +---------------+-----------------+---+---+---+
-	opClsLoadA uint16 = iota
-	// +---------------+-----------------+---+---+---+
-	// | AddrMode (3b) | LoadWidth (2b)  | 0 | 0 | 1 |
-	// +---------------+-----------------+---+---+---+
-	opClsLoadX
-	// +---+---+---+---+---+---+---+---+
-	// | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
-	// +---+---+---+---+---+---+---+---+
-	opClsStoreA
-	// +---+---+---+---+---+---+---+---+
-	// | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
-	// +---+---+---+---+---+---+---+---+
-	opClsStoreX
-	// +---------------+-----------------+---+---+---+
-	// | Operator (4b) | OperandSrc (1b) | 1 | 0 | 0 |
-	// +---------------+-----------------+---+---+---+
-	opClsALU
-	// +-----------------------------+---+---+---+---+
-	// |      TestOperator (4b)      | 0 | 1 | 0 | 1 |
-	// +-----------------------------+---+---+---+---+
-	opClsJump
-	// +---+-------------------------+---+---+---+---+
-	// | 0 | 0 | 0 |   RetSrc (1b)   | 0 | 1 | 1 | 0 |
-	// +---+-------------------------+---+---+---+---+
-	opClsReturn
-	// +---+-------------------------+---+---+---+---+
-	// | 0 | 0 | 0 |  TXAorTAX (1b)  | 0 | 1 | 1 | 1 |
-	// +---+-------------------------+---+---+---+---+
-	opClsMisc
-)
-
-const (
-	opAddrModeImmediate uint16 = iota << 5
-	opAddrModeAbsolute
-	opAddrModeIndirect
-	opAddrModeScratch
-	opAddrModePacketLen // actually an extension, not an addressing mode.
-	opAddrModeMemShift
-)
-
-const (
-	opLoadWidth4 uint16 = iota << 3
-	opLoadWidth2
-	opLoadWidth1
-)
-
-// Operator defined by ALUOp*
-
-const (
-	opALUSrcConstant uint16 = iota << 3
-	opALUSrcX
-)
-
-const (
-	opJumpAlways = iota << 4
-	opJumpEqual
-	opJumpGT
-	opJumpGE
-	opJumpSet
-)
-
-const (
-	opRetSrcConstant uint16 = iota << 4
-	opRetSrcA
-)
-
-const (
-	opMiscTAX = 0x00
-	opMiscTXA = 0x80
-)

vendor/golang.org/x/net/bpf/doc.go

@@ -1,82 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-/*
-
-Package bpf implements marshaling and unmarshaling of programs for the
-Berkeley Packet Filter virtual machine, and provides a Go implementation
-of the virtual machine.
-
-BPF's main use is to specify a packet filter for network taps, so that
-the kernel doesn't have to expensively copy every packet it sees to
-userspace. However, it's been repurposed to other areas where running
-user code in-kernel is needed. For example, Linux's seccomp uses BPF
-to apply security policies to system calls. For simplicity, this
-documentation refers only to packets, but other uses of BPF have their
-own data payloads.
-
-BPF programs run in a restricted virtual machine. It has almost no
-access to kernel functions, and while conditional branches are
-allowed, they can only jump forwards, to guarantee that there are no
-infinite loops.
-
-The virtual machine
-
-The BPF VM is an accumulator machine. Its main register, called
-register A, is an implicit source and destination in all arithmetic
-and logic operations. The machine also has 16 scratch registers for
-temporary storage, and an indirection register (register X) for
-indirect memory access. All registers are 32 bits wide.
-
-Each run of a BPF program is given one packet, which is placed in the
-VM's read-only "main memory". LoadAbsolute and LoadIndirect
-instructions can fetch up to 32 bits at a time into register A for
-examination.
-
-The goal of a BPF program is to produce and return a verdict (uint32),
-which tells the kernel what to do with the packet. In the context of
-packet filtering, the returned value is the number of bytes of the
-packet to forward to userspace, or 0 to ignore the packet. Other
-contexts like seccomp define their own return values.
-
-In order to simplify programs, attempts to read past the end of the
-packet terminate the program execution with a verdict of 0 (ignore
-packet). This means that the vast majority of BPF programs don't need
-to do any explicit bounds checking.
-
-In addition to the bytes of the packet, some BPF programs have access
-to extensions, which are essentially calls to kernel utility
-functions. Currently, the only extensions supported by this package
-are the Linux packet filter extensions.
-
-Examples
-
-This packet filter selects all ARP packets.
-
-	bpf.Assemble([]bpf.Instruction{
-		// Load "EtherType" field from the ethernet header.
-		bpf.LoadAbsolute{Off: 12, Size: 2},
-		// Skip over the next instruction if EtherType is not ARP.
-		bpf.JumpIf{Cond: bpf.JumpNotEqual, Val: 0x0806, SkipTrue: 1},
-		// Verdict is "send up to 4k of the packet to userspace."
-		bpf.RetConstant{Val: 4096},
-		// Verdict is "ignore packet."
-		bpf.RetConstant{Val: 0},
-	})
-
-This packet filter captures a random 1% sample of traffic.
-
-	bpf.Assemble([]bpf.Instruction{
-		// Get a 32-bit random number from the Linux kernel.
-		bpf.LoadExtension{Num: bpf.ExtRand},
-		// 1% dice roll?
-		bpf.JumpIf{Cond: bpf.JumpLessThan, Val: 2^32/100, SkipFalse: 1},
-		// Capture.
-		bpf.RetConstant{Val: 4096},
-		// Ignore.
-		bpf.RetConstant{Val: 0},
-	})
-
-*/
-package bpf // import "golang.org/x/net/bpf"

vendor/golang.org/x/net/bpf/instructions.go

@@ -1,704 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package bpf
-
-import "fmt"
-
-// An Instruction is one instruction executed by the BPF virtual
-// machine.
-type Instruction interface {
-	// Assemble assembles the Instruction into a RawInstruction.
-	Assemble() (RawInstruction, error)
-}
-
-// A RawInstruction is a raw BPF virtual machine instruction.
-type RawInstruction struct {
-	// Operation to execute.
-	Op uint16
-	// For conditional jump instructions, the number of instructions
-	// to skip if the condition is true/false.
-	Jt uint8
-	Jf uint8
-	// Constant parameter. The meaning depends on the Op.
-	K uint32
-}
-
-// Assemble implements the Instruction Assemble method.
-func (ri RawInstruction) Assemble() (RawInstruction, error) { return ri, nil }
-
-// Disassemble parses ri into an Instruction and returns it. If ri is
-// not recognized by this package, ri itself is returned.
-func (ri RawInstruction) Disassemble() Instruction {
-	switch ri.Op & opMaskCls {
-	case opClsLoadA, opClsLoadX:
-		reg := Register(ri.Op & opMaskLoadDest)
-		sz := 0
-		switch ri.Op & opMaskLoadWidth {
-		case opLoadWidth4:
-			sz = 4
-		case opLoadWidth2:
-			sz = 2
-		case opLoadWidth1:
-			sz = 1
-		default:
-			return ri
-		}
-		switch ri.Op & opMaskLoadMode {
-		case opAddrModeImmediate:
-			if sz != 4 {
-				return ri
-			}
-			return LoadConstant{Dst: reg, Val: ri.K}
-		case opAddrModeScratch:
-			if sz != 4 || ri.K > 15 {
-				return ri
-			}
-			return LoadScratch{Dst: reg, N: int(ri.K)}
-		case opAddrModeAbsolute:
-			if ri.K > extOffset+0xffffffff {
-				return LoadExtension{Num: Extension(-extOffset + ri.K)}
-			}
-			return LoadAbsolute{Size: sz, Off: ri.K}
-		case opAddrModeIndirect:
-			return LoadIndirect{Size: sz, Off: ri.K}
-		case opAddrModePacketLen:
-			if sz != 4 {
-				return ri
-			}
-			return LoadExtension{Num: ExtLen}
-		case opAddrModeMemShift:
-			return LoadMemShift{Off: ri.K}
-		default:
-			return ri
-		}
-
-	case opClsStoreA:
-		if ri.Op != opClsStoreA || ri.K > 15 {
-			return ri
-		}
-		return StoreScratch{Src: RegA, N: int(ri.K)}
-
-	case opClsStoreX:
-		if ri.Op != opClsStoreX || ri.K > 15 {
-			return ri
-		}
-		return StoreScratch{Src: RegX, N: int(ri.K)}
-
-	case opClsALU:
-		switch op := ALUOp(ri.Op & opMaskOperator); op {
-		case ALUOpAdd, ALUOpSub, ALUOpMul, ALUOpDiv, ALUOpOr, ALUOpAnd, ALUOpShiftLeft, ALUOpShiftRight, ALUOpMod, ALUOpXor:
-			if ri.Op&opMaskOperandSrc != 0 {
-				return ALUOpX{Op: op}
-			}
-			return ALUOpConstant{Op: op, Val: ri.K}
-		case aluOpNeg:
-			return NegateA{}
-		default:
-			return ri
-		}
-
-	case opClsJump:
-		if ri.Op&opMaskJumpConst != opClsJump {
-			return ri
-		}
-		switch ri.Op & opMaskJumpCond {
-		case opJumpAlways:
-			return Jump{Skip: ri.K}
-		case opJumpEqual:
-			if ri.Jt == 0 {
-				return JumpIf{
-					Cond:      JumpNotEqual,
-					Val:       ri.K,
-					SkipTrue:  ri.Jf,
-					SkipFalse: 0,
-				}
-			}
-			return JumpIf{
-				Cond:      JumpEqual,
-				Val:       ri.K,
-				SkipTrue:  ri.Jt,
-				SkipFalse: ri.Jf,
-			}
-		case opJumpGT:
-			if ri.Jt == 0 {
-				return JumpIf{
-					Cond:      JumpLessOrEqual,
-					Val:       ri.K,
-					SkipTrue:  ri.Jf,
-					SkipFalse: 0,
-				}
-			}
-			return JumpIf{
-				Cond:      JumpGreaterThan,
-				Val:       ri.K,
-				SkipTrue:  ri.Jt,
-				SkipFalse: ri.Jf,
-			}
-		case opJumpGE:
-			if ri.Jt == 0 {
-				return JumpIf{
-					Cond:      JumpLessThan,
-					Val:       ri.K,
-					SkipTrue:  ri.Jf,
-					SkipFalse: 0,
-				}
-			}
-			return JumpIf{
-				Cond:      JumpGreaterOrEqual,
-				Val:       ri.K,
-				SkipTrue:  ri.Jt,
-				SkipFalse: ri.Jf,
-			}
-		case opJumpSet:
-			return JumpIf{
-				Cond:      JumpBitsSet,
-				Val:       ri.K,
-				SkipTrue:  ri.Jt,
-				SkipFalse: ri.Jf,
-			}
-		default:
-			return ri
-		}
-
-	case opClsReturn:
-		switch ri.Op {
-		case opClsReturn | opRetSrcA:
-			return RetA{}
-		case opClsReturn | opRetSrcConstant:
-			return RetConstant{Val: ri.K}
-		default:
-			return ri
-		}
-
-	case opClsMisc:
-		switch ri.Op {
-		case opClsMisc | opMiscTAX:
-			return TAX{}
-		case opClsMisc | opMiscTXA:
-			return TXA{}
-		default:
-			return ri
-		}
-
-	default:
-		panic("unreachable") // switch is exhaustive on the bit pattern
-	}
-}
-
-// LoadConstant loads Val into register Dst.
-type LoadConstant struct {
-	Dst Register
-	Val uint32
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a LoadConstant) Assemble() (RawInstruction, error) {
-	return assembleLoad(a.Dst, 4, opAddrModeImmediate, a.Val)
-}
-
-// String returns the instruction in assembler notation.
-func (a LoadConstant) String() string {
-	switch a.Dst {
-	case RegA:
-		return fmt.Sprintf("ld #%d", a.Val)
-	case RegX:
-		return fmt.Sprintf("ldx #%d", a.Val)
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// LoadScratch loads scratch[N] into register Dst.
-type LoadScratch struct {
-	Dst Register
-	N   int // 0-15
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a LoadScratch) Assemble() (RawInstruction, error) {
-	if a.N < 0 || a.N > 15 {
-		return RawInstruction{}, fmt.Errorf("invalid scratch slot %d", a.N)
-	}
-	return assembleLoad(a.Dst, 4, opAddrModeScratch, uint32(a.N))
-}
-
-// String returns the instruction in assembler notation.
-func (a LoadScratch) String() string {
-	switch a.Dst {
-	case RegA:
-		return fmt.Sprintf("ld M[%d]", a.N)
-	case RegX:
-		return fmt.Sprintf("ldx M[%d]", a.N)
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// LoadAbsolute loads packet[Off:Off+Size] as an integer value into
-// register A.
-type LoadAbsolute struct {
-	Off  uint32
-	Size int // 1, 2 or 4
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a LoadAbsolute) Assemble() (RawInstruction, error) {
-	return assembleLoad(RegA, a.Size, opAddrModeAbsolute, a.Off)
-}
-
-// String returns the instruction in assembler notation.
-func (a LoadAbsolute) String() string {
-	switch a.Size {
-	case 1: // byte
-		return fmt.Sprintf("ldb [%d]", a.Off)
-	case 2: // half word
-		return fmt.Sprintf("ldh [%d]", a.Off)
-	case 4: // word
-		if a.Off > extOffset+0xffffffff {
-			return LoadExtension{Num: Extension(a.Off + 0x1000)}.String()
-		}
-		return fmt.Sprintf("ld [%d]", a.Off)
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// LoadIndirect loads packet[X+Off:X+Off+Size] as an integer value
-// into register A.
-type LoadIndirect struct {
-	Off  uint32
-	Size int // 1, 2 or 4
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a LoadIndirect) Assemble() (RawInstruction, error) {
-	return assembleLoad(RegA, a.Size, opAddrModeIndirect, a.Off)
-}
-
-// String returns the instruction in assembler notation.
-func (a LoadIndirect) String() string {
-	switch a.Size {
-	case 1: // byte
-		return fmt.Sprintf("ldb [x + %d]", a.Off)
-	case 2: // half word
-		return fmt.Sprintf("ldh [x + %d]", a.Off)
-	case 4: // word
-		return fmt.Sprintf("ld [x + %d]", a.Off)
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// LoadMemShift multiplies the first 4 bits of the byte at packet[Off]
-// by 4 and stores the result in register X.
-//
-// This instruction is mainly useful to load into X the length of an
-// IPv4 packet header in a single instruction, rather than have to do
-// the arithmetic on the header's first byte by hand.
-type LoadMemShift struct {
-	Off uint32
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a LoadMemShift) Assemble() (RawInstruction, error) {
-	return assembleLoad(RegX, 1, opAddrModeMemShift, a.Off)
-}
-
-// String returns the instruction in assembler notation.
-func (a LoadMemShift) String() string {
-	return fmt.Sprintf("ldx 4*([%d]&0xf)", a.Off)
-}
-
-// LoadExtension invokes a linux-specific extension and stores the
-// result in register A.
-type LoadExtension struct {
-	Num Extension
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a LoadExtension) Assemble() (RawInstruction, error) {
-	if a.Num == ExtLen {
-		return assembleLoad(RegA, 4, opAddrModePacketLen, 0)
-	}
-	return assembleLoad(RegA, 4, opAddrModeAbsolute, uint32(extOffset+a.Num))
-}
-
-// String returns the instruction in assembler notation.
-func (a LoadExtension) String() string {
-	switch a.Num {
-	case ExtLen:
-		return "ld #len"
-	case ExtProto:
-		return "ld #proto"
-	case ExtType:
-		return "ld #type"
-	case ExtPayloadOffset:
-		return "ld #poff"
-	case ExtInterfaceIndex:
-		return "ld #ifidx"
-	case ExtNetlinkAttr:
-		return "ld #nla"
-	case ExtNetlinkAttrNested:
-		return "ld #nlan"
-	case ExtMark:
-		return "ld #mark"
-	case ExtQueue:
-		return "ld #queue"
-	case ExtLinkLayerType:
-		return "ld #hatype"
-	case ExtRXHash:
-		return "ld #rxhash"
-	case ExtCPUID:
-		return "ld #cpu"
-	case ExtVLANTag:
-		return "ld #vlan_tci"
-	case ExtVLANTagPresent:
-		return "ld #vlan_avail"
-	case ExtVLANProto:
-		return "ld #vlan_tpid"
-	case ExtRand:
-		return "ld #rand"
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// StoreScratch stores register Src into scratch[N].
-type StoreScratch struct {
-	Src Register
-	N   int // 0-15
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a StoreScratch) Assemble() (RawInstruction, error) {
-	if a.N < 0 || a.N > 15 {
-		return RawInstruction{}, fmt.Errorf("invalid scratch slot %d", a.N)
-	}
-	var op uint16
-	switch a.Src {
-	case RegA:
-		op = opClsStoreA
-	case RegX:
-		op = opClsStoreX
-	default:
-		return RawInstruction{}, fmt.Errorf("invalid source register %v", a.Src)
-	}
-
-	return RawInstruction{
-		Op: op,
-		K:  uint32(a.N),
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a StoreScratch) String() string {
-	switch a.Src {
-	case RegA:
-		return fmt.Sprintf("st M[%d]", a.N)
-	case RegX:
-		return fmt.Sprintf("stx M[%d]", a.N)
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// ALUOpConstant executes A = A <Op> Val.
-type ALUOpConstant struct {
-	Op  ALUOp
-	Val uint32
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a ALUOpConstant) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsALU | opALUSrcConstant | uint16(a.Op),
-		K:  a.Val,
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a ALUOpConstant) String() string {
-	switch a.Op {
-	case ALUOpAdd:
-		return fmt.Sprintf("add #%d", a.Val)
-	case ALUOpSub:
-		return fmt.Sprintf("sub #%d", a.Val)
-	case ALUOpMul:
-		return fmt.Sprintf("mul #%d", a.Val)
-	case ALUOpDiv:
-		return fmt.Sprintf("div #%d", a.Val)
-	case ALUOpMod:
-		return fmt.Sprintf("mod #%d", a.Val)
-	case ALUOpAnd:
-		return fmt.Sprintf("and #%d", a.Val)
-	case ALUOpOr:
-		return fmt.Sprintf("or #%d", a.Val)
-	case ALUOpXor:
-		return fmt.Sprintf("xor #%d", a.Val)
-	case ALUOpShiftLeft:
-		return fmt.Sprintf("lsh #%d", a.Val)
-	case ALUOpShiftRight:
-		return fmt.Sprintf("rsh #%d", a.Val)
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// ALUOpX executes A = A <Op> X
-type ALUOpX struct {
-	Op ALUOp
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a ALUOpX) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsALU | opALUSrcX | uint16(a.Op),
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a ALUOpX) String() string {
-	switch a.Op {
-	case ALUOpAdd:
-		return "add x"
-	case ALUOpSub:
-		return "sub x"
-	case ALUOpMul:
-		return "mul x"
-	case ALUOpDiv:
-		return "div x"
-	case ALUOpMod:
-		return "mod x"
-	case ALUOpAnd:
-		return "and x"
-	case ALUOpOr:
-		return "or x"
-	case ALUOpXor:
-		return "xor x"
-	case ALUOpShiftLeft:
-		return "lsh x"
-	case ALUOpShiftRight:
-		return "rsh x"
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-// NegateA executes A = -A.
-type NegateA struct{}
-
-// Assemble implements the Instruction Assemble method.
-func (a NegateA) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsALU | uint16(aluOpNeg),
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a NegateA) String() string {
-	return fmt.Sprintf("neg")
-}
-
-// Jump skips the following Skip instructions in the program.
-type Jump struct {
-	Skip uint32
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a Jump) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsJump | opJumpAlways,
-		K:  a.Skip,
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a Jump) String() string {
-	return fmt.Sprintf("ja %d", a.Skip)
-}
-
-// JumpIf skips the following Skip instructions in the program if A
-// <Cond> Val is true.
-type JumpIf struct {
-	Cond      JumpTest
-	Val       uint32
-	SkipTrue  uint8
-	SkipFalse uint8
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a JumpIf) Assemble() (RawInstruction, error) {
-	var (
-		cond uint16
-		flip bool
-	)
-	switch a.Cond {
-	case JumpEqual:
-		cond = opJumpEqual
-	case JumpNotEqual:
-		cond, flip = opJumpEqual, true
-	case JumpGreaterThan:
-		cond = opJumpGT
-	case JumpLessThan:
-		cond, flip = opJumpGE, true
-	case JumpGreaterOrEqual:
-		cond = opJumpGE
-	case JumpLessOrEqual:
-		cond, flip = opJumpGT, true
-	case JumpBitsSet:
-		cond = opJumpSet
-	case JumpBitsNotSet:
-		cond, flip = opJumpSet, true
-	default:
-		return RawInstruction{}, fmt.Errorf("unknown JumpTest %v", a.Cond)
-	}
-	jt, jf := a.SkipTrue, a.SkipFalse
-	if flip {
-		jt, jf = jf, jt
-	}
-	return RawInstruction{
-		Op: opClsJump | cond,
-		Jt: jt,
-		Jf: jf,
-		K:  a.Val,
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a JumpIf) String() string {
-	switch a.Cond {
-	// K == A
-	case JumpEqual:
-		return conditionalJump(a, "jeq", "jneq")
-	// K != A
-	case JumpNotEqual:
-		return fmt.Sprintf("jneq #%d,%d", a.Val, a.SkipTrue)
-	// K > A
-	case JumpGreaterThan:
-		return conditionalJump(a, "jgt", "jle")
-	// K < A
-	case JumpLessThan:
-		return fmt.Sprintf("jlt #%d,%d", a.Val, a.SkipTrue)
-	// K >= A
-	case JumpGreaterOrEqual:
-		return conditionalJump(a, "jge", "jlt")
-	// K <= A
-	case JumpLessOrEqual:
-		return fmt.Sprintf("jle #%d,%d", a.Val, a.SkipTrue)
-	// K & A != 0
-	case JumpBitsSet:
-		if a.SkipFalse > 0 {
-			return fmt.Sprintf("jset #%d,%d,%d", a.Val, a.SkipTrue, a.SkipFalse)
-		}
-		return fmt.Sprintf("jset #%d,%d", a.Val, a.SkipTrue)
-	// K & A == 0, there is no assembler instruction for JumpBitNotSet, use JumpBitSet and invert skips
-	case JumpBitsNotSet:
-		return JumpIf{Cond: JumpBitsSet, SkipTrue: a.SkipFalse, SkipFalse: a.SkipTrue, Val: a.Val}.String()
-	default:
-		return fmt.Sprintf("unknown instruction: %#v", a)
-	}
-}
-
-func conditionalJump(inst JumpIf, positiveJump, negativeJump string) string {
-	if inst.SkipTrue > 0 {
-		if inst.SkipFalse > 0 {
-			return fmt.Sprintf("%s #%d,%d,%d", positiveJump, inst.Val, inst.SkipTrue, inst.SkipFalse)
-		}
-		return fmt.Sprintf("%s #%d,%d", positiveJump, inst.Val, inst.SkipTrue)
-	}
-	return fmt.Sprintf("%s #%d,%d", negativeJump, inst.Val, inst.SkipFalse)
-}
-
-// RetA exits the BPF program, returning the value of register A.
-type RetA struct{}
-
-// Assemble implements the Instruction Assemble method.
-func (a RetA) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsReturn | opRetSrcA,
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a RetA) String() string {
-	return fmt.Sprintf("ret a")
-}
-
-// RetConstant exits the BPF program, returning a constant value.
-type RetConstant struct {
-	Val uint32
-}
-
-// Assemble implements the Instruction Assemble method.
-func (a RetConstant) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsReturn | opRetSrcConstant,
-		K:  a.Val,
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a RetConstant) String() string {
-	return fmt.Sprintf("ret #%d", a.Val)
-}
-
-// TXA copies the value of register X to register A.
-type TXA struct{}
-
-// Assemble implements the Instruction Assemble method.
-func (a TXA) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsMisc | opMiscTXA,
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a TXA) String() string {
-	return fmt.Sprintf("txa")
-}
-
-// TAX copies the value of register A to register X.
-type TAX struct{}
-
-// Assemble implements the Instruction Assemble method.
-func (a TAX) Assemble() (RawInstruction, error) {
-	return RawInstruction{
-		Op: opClsMisc | opMiscTAX,
-	}, nil
-}
-
-// String returns the instruction in assembler notation.
-func (a TAX) String() string {
-	return fmt.Sprintf("tax")
-}
-
-func assembleLoad(dst Register, loadSize int, mode uint16, k uint32) (RawInstruction, error) {
-	var (
-		cls uint16
-		sz  uint16
-	)
-	switch dst {
-	case RegA:
-		cls = opClsLoadA
-	case RegX:
-		cls = opClsLoadX
-	default:
-		return RawInstruction{}, fmt.Errorf("invalid target register %v", dst)
-	}
-	switch loadSize {
-	case 1:
-		sz = opLoadWidth1
-	case 2:
-		sz = opLoadWidth2
-	case 4:
-		sz = opLoadWidth4
-	default:
-		return RawInstruction{}, fmt.Errorf("invalid load byte length %d", sz)
-	}
-	return RawInstruction{
-		Op: cls | sz | mode,
-		K:  k,
-	}, nil
-}

vendor/golang.org/x/net/bpf/setter.go

@@ -1,10 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package bpf
-
-// A Setter is a type which can attach a compiled BPF filter to itself.
-type Setter interface {
-	SetBPF(filter []RawInstruction) error
-}

vendor/golang.org/x/net/bpf/vm.go

@@ -1,140 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package bpf
-
-import (
-	"errors"
-	"fmt"
-)
-
-// A VM is an emulated BPF virtual machine.
-type VM struct {
-	filter []Instruction
-}
-
-// NewVM returns a new VM using the input BPF program.
-func NewVM(filter []Instruction) (*VM, error) {
-	if len(filter) == 0 {
-		return nil, errors.New("one or more Instructions must be specified")
-	}
-
-	for i, ins := range filter {
-		check := len(filter) - (i + 1)
-		switch ins := ins.(type) {
-		// Check for out-of-bounds jumps in instructions
-		case Jump:
-			if check <= int(ins.Skip) {
-				return nil, fmt.Errorf("cannot jump %d instructions; jumping past program bounds", ins.Skip)
-			}
-		case JumpIf:
-			if check <= int(ins.SkipTrue) {
-				return nil, fmt.Errorf("cannot jump %d instructions in true case; jumping past program bounds", ins.SkipTrue)
-			}
-			if check <= int(ins.SkipFalse) {
-				return nil, fmt.Errorf("cannot jump %d instructions in false case; jumping past program bounds", ins.SkipFalse)
-			}
-		// Check for division or modulus by zero
-		case ALUOpConstant:
-			if ins.Val != 0 {
-				break
-			}
-
-			switch ins.Op {
-			case ALUOpDiv, ALUOpMod:
-				return nil, errors.New("cannot divide by zero using ALUOpConstant")
-			}
-		// Check for unknown extensions
-		case LoadExtension:
-			switch ins.Num {
-			case ExtLen:
-			default:
-				return nil, fmt.Errorf("extension %d not implemented", ins.Num)
-			}
-		}
-	}
-
-	// Make sure last instruction is a return instruction
-	switch filter[len(filter)-1].(type) {
-	case RetA, RetConstant:
-	default:
-		return nil, errors.New("BPF program must end with RetA or RetConstant")
-	}
-
-	// Though our VM works using disassembled instructions, we
-	// attempt to assemble the input filter anyway to ensure it is compatible
-	// with an operating system VM.
-	_, err := Assemble(filter)
-
-	return &VM{
-		filter: filter,
-	}, err
-}
-
-// Run runs the VM's BPF program against the input bytes.
-// Run returns the number of bytes accepted by the BPF program, and any errors
-// which occurred while processing the program.
-func (v *VM) Run(in []byte) (int, error) {
-	var (
-		// Registers of the virtual machine
-		regA       uint32
-		regX       uint32
-		regScratch [16]uint32
-
-		// OK is true if the program should continue processing the next
-		// instruction, or false if not, causing the loop to break
-		ok = true
-	)
-
-	// TODO(mdlayher): implement:
-	// - NegateA:
-	//   - would require a change from uint32 registers to int32
-	//     registers
-
-	// TODO(mdlayher): add interop tests that check signedness of ALU
-	// operations against kernel implementation, and make sure Go
-	// implementation matches behavior
-
-	for i := 0; i < len(v.filter) && ok; i++ {
-		ins := v.filter[i]
-
-		switch ins := ins.(type) {
-		case ALUOpConstant:
-			regA = aluOpConstant(ins, regA)
-		case ALUOpX:
-			regA, ok = aluOpX(ins, regA, regX)
-		case Jump:
-			i += int(ins.Skip)
-		case JumpIf:
-			jump := jumpIf(ins, regA)
-			i += jump
-		case LoadAbsolute:
-			regA, ok = loadAbsolute(ins, in)
-		case LoadConstant:
-			regA, regX = loadConstant(ins, regA, regX)
-		case LoadExtension:
-			regA = loadExtension(ins, in)
-		case LoadIndirect:
-			regA, ok = loadIndirect(ins, in, regX)
-		case LoadMemShift:
-			regX, ok = loadMemShift(ins, in)
-		case LoadScratch:
-			regA, regX = loadScratch(ins, regScratch, regA, regX)
-		case RetA:
-			return int(regA), nil
-		case RetConstant:
-			return int(ins.Val), nil
-		case StoreScratch:
-			regScratch = storeScratch(ins, regScratch, regA, regX)
-		case TAX:
-			regX = regA
-		case TXA:
-			regA = regX
-		default:
-			return 0, fmt.Errorf("unknown Instruction at index %d: %T", i, ins)
-		}
-	}
-
-	return 0, nil
-}

vendor/golang.org/x/net/bpf/vm_instructions.go

@@ -1,174 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package bpf
-
-import (
-	"encoding/binary"
-	"fmt"
-)
-
-func aluOpConstant(ins ALUOpConstant, regA uint32) uint32 {
-	return aluOpCommon(ins.Op, regA, ins.Val)
-}
-
-func aluOpX(ins ALUOpX, regA uint32, regX uint32) (uint32, bool) {
-	// Guard against division or modulus by zero by terminating
-	// the program, as the OS BPF VM does
-	if regX == 0 {
-		switch ins.Op {
-		case ALUOpDiv, ALUOpMod:
-			return 0, false
-		}
-	}
-
-	return aluOpCommon(ins.Op, regA, regX), true
-}
-
-func aluOpCommon(op ALUOp, regA uint32, value uint32) uint32 {
-	switch op {
-	case ALUOpAdd:
-		return regA + value
-	case ALUOpSub:
-		return regA - value
-	case ALUOpMul:
-		return regA * value
-	case ALUOpDiv:
-		// Division by zero not permitted by NewVM and aluOpX checks
-		return regA / value
-	case ALUOpOr:
-		return regA | value
-	case ALUOpAnd:
-		return regA & value
-	case ALUOpShiftLeft:
-		return regA << value
-	case ALUOpShiftRight:
-		return regA >> value
-	case ALUOpMod:
-		// Modulus by zero not permitted by NewVM and aluOpX checks
-		return regA % value
-	case ALUOpXor:
-		return regA ^ value
-	default:
-		return regA
-	}
-}
-
-func jumpIf(ins JumpIf, value uint32) int {
-	var ok bool
-	inV := uint32(ins.Val)
-
-	switch ins.Cond {
-	case JumpEqual:
-		ok = value == inV
-	case JumpNotEqual:
-		ok = value != inV
-	case JumpGreaterThan:
-		ok = value > inV
-	case JumpLessThan:
-		ok = value < inV
-	case JumpGreaterOrEqual:
-		ok = value >= inV
-	case JumpLessOrEqual:
-		ok = value <= inV
-	case JumpBitsSet:
-		ok = (value & inV) != 0
-	case JumpBitsNotSet:
-		ok = (value & inV) == 0
-	}
-
-	if ok {
-		return int(ins.SkipTrue)
-	}
-
-	return int(ins.SkipFalse)
-}
-
-func loadAbsolute(ins LoadAbsolute, in []byte) (uint32, bool) {
-	offset := int(ins.Off)
-	size := int(ins.Size)
-
-	return loadCommon(in, offset, size)
-}
-
-func loadConstant(ins LoadConstant, regA uint32, regX uint32) (uint32, uint32) {
-	switch ins.Dst {
-	case RegA:
-		regA = ins.Val
-	case RegX:
-		regX = ins.Val
-	}
-
-	return regA, regX
-}
-
-func loadExtension(ins LoadExtension, in []byte) uint32 {
-	switch ins.Num {
-	case ExtLen:
-		return uint32(len(in))
-	default:
-		panic(fmt.Sprintf("unimplemented extension: %d", ins.Num))
-	}
-}
-
-func loadIndirect(ins LoadIndirect, in []byte, regX uint32) (uint32, bool) {
-	offset := int(ins.Off) + int(regX)
-	size := int(ins.Size)
-
-	return loadCommon(in, offset, size)
-}
-
-func loadMemShift(ins LoadMemShift, in []byte) (uint32, bool) {
-	offset := int(ins.Off)
-
-	if !inBounds(len(in), offset, 0) {
-		return 0, false
-	}
-
-	// Mask off high 4 bits and multiply low 4 bits by 4
-	return uint32(in[offset]&0x0f) * 4, true
-}
-
-func inBounds(inLen int, offset int, size int) bool {
-	return offset+size <= inLen
-}
-
-func loadCommon(in []byte, offset int, size int) (uint32, bool) {
-	if !inBounds(len(in), offset, size) {
-		return 0, false
-	}
-
-	switch size {
-	case 1:
-		return uint32(in[offset]), true
-	case 2:
-		return uint32(binary.BigEndian.Uint16(in[offset : offset+size])), true
-	case 4:
-		return uint32(binary.BigEndian.Uint32(in[offset : offset+size])), true
-	default:
-		panic(fmt.Sprintf("invalid load size: %d", size))
-	}
-}
-
-func loadScratch(ins LoadScratch, regScratch [16]uint32, regA uint32, regX uint32) (uint32, uint32) {
-	switch ins.Dst {
-	case RegA:
-		regA = regScratch[ins.N]
-	case RegX:
-		regX = regScratch[ins.N]
-	}
-
-	return regA, regX
-}
-
-func storeScratch(ins StoreScratch, regScratch [16]uint32, regA uint32, regX uint32) [16]uint32 {
-	switch ins.Src {
-	case RegA:
-		regScratch[ins.N] = regA
-	case RegX:
-		regScratch[ins.N] = regX
-	}
-
-	return regScratch
-}

vendor/golang.org/x/net/internal/iana/const.go

@@ -1,223 +0,0 @@
-// go generate gen.go
-// Code generated by the command above; DO NOT EDIT.
-
-// Package iana provides protocol number resources managed by the Internet Assigned Numbers Authority (IANA).
-package iana // import "golang.org/x/net/internal/iana"
-
-// Differentiated Services Field Codepoints (DSCP), Updated: 2018-05-04
-const (
-	DiffServCS0           = 0x00 // CS0
-	DiffServCS1           = 0x20 // CS1
-	DiffServCS2           = 0x40 // CS2
-	DiffServCS3           = 0x60 // CS3
-	DiffServCS4           = 0x80 // CS4
-	DiffServCS5           = 0xa0 // CS5
-	DiffServCS6           = 0xc0 // CS6
-	DiffServCS7           = 0xe0 // CS7
-	DiffServAF11          = 0x28 // AF11
-	DiffServAF12          = 0x30 // AF12
-	DiffServAF13          = 0x38 // AF13
-	DiffServAF21          = 0x48 // AF21
-	DiffServAF22          = 0x50 // AF22
-	DiffServAF23          = 0x58 // AF23
-	DiffServAF31          = 0x68 // AF31
-	DiffServAF32          = 0x70 // AF32
-	DiffServAF33          = 0x78 // AF33
-	DiffServAF41          = 0x88 // AF41
-	DiffServAF42          = 0x90 // AF42
-	DiffServAF43          = 0x98 // AF43
-	DiffServEF            = 0xb8 // EF
-	DiffServVOICEADMIT    = 0xb0 // VOICE-ADMIT
-	NotECNTransport       = 0x00 // Not-ECT (Not ECN-Capable Transport)
-	ECNTransport1         = 0x01 // ECT(1) (ECN-Capable Transport(1))
-	ECNTransport0         = 0x02 // ECT(0) (ECN-Capable Transport(0))
-	CongestionExperienced = 0x03 // CE (Congestion Experienced)
-)
-
-// Protocol Numbers, Updated: 2017-10-13
-const (
-	ProtocolIP             = 0   // IPv4 encapsulation, pseudo protocol number
-	ProtocolHOPOPT         = 0   // IPv6 Hop-by-Hop Option
-	ProtocolICMP           = 1   // Internet Control Message
-	ProtocolIGMP           = 2   // Internet Group Management
-	ProtocolGGP            = 3   // Gateway-to-Gateway
-	ProtocolIPv4           = 4   // IPv4 encapsulation
-	ProtocolST             = 5   // Stream
-	ProtocolTCP            = 6   // Transmission Control
-	ProtocolCBT            = 7   // CBT
-	ProtocolEGP            = 8   // Exterior Gateway Protocol
-	ProtocolIGP            = 9   // any private interior gateway (used by Cisco for their IGRP)
-	ProtocolBBNRCCMON      = 10  // BBN RCC Monitoring
-	ProtocolNVPII          = 11  // Network Voice Protocol
-	ProtocolPUP            = 12  // PUP
-	ProtocolEMCON          = 14  // EMCON
-	ProtocolXNET           = 15  // Cross Net Debugger
-	ProtocolCHAOS          = 16  // Chaos
-	ProtocolUDP            = 17  // User Datagram
-	ProtocolMUX            = 18  // Multiplexing
-	ProtocolDCNMEAS        = 19  // DCN Measurement Subsystems
-	ProtocolHMP            = 20  // Host Monitoring
-	ProtocolPRM            = 21  // Packet Radio Measurement
-	ProtocolXNSIDP         = 22  // XEROX NS IDP
-	ProtocolTRUNK1         = 23  // Trunk-1
-	ProtocolTRUNK2         = 24  // Trunk-2
-	ProtocolLEAF1          = 25  // Leaf-1
-	ProtocolLEAF2          = 26  // Leaf-2
-	ProtocolRDP            = 27  // Reliable Data Protocol
-	ProtocolIRTP           = 28  // Internet Reliable Transaction
-	ProtocolISOTP4         = 29  // ISO Transport Protocol Class 4
-	ProtocolNETBLT         = 30  // Bulk Data Transfer Protocol
-	ProtocolMFENSP         = 31  // MFE Network Services Protocol
-	ProtocolMERITINP       = 32  // MERIT Internodal Protocol
-	ProtocolDCCP           = 33  // Datagram Congestion Control Protocol
-	Protocol3PC            = 34  // Third Party Connect Protocol
-	ProtocolIDPR           = 35  // Inter-Domain Policy Routing Protocol
-	ProtocolXTP            = 36  // XTP
-	ProtocolDDP            = 37  // Datagram Delivery Protocol
-	ProtocolIDPRCMTP       = 38  // IDPR Control Message Transport Proto
-	ProtocolTPPP           = 39  // TP++ Transport Protocol
-	ProtocolIL             = 40  // IL Transport Protocol
-	ProtocolIPv6           = 41  // IPv6 encapsulation
-	ProtocolSDRP           = 42  // Source Demand Routing Protocol
-	ProtocolIPv6Route      = 43  // Routing Header for IPv6
-	ProtocolIPv6Frag       = 44  // Fragment Header for IPv6
-	ProtocolIDRP           = 45  // Inter-Domain Routing Protocol
-	ProtocolRSVP           = 46  // Reservation Protocol
-	ProtocolGRE            = 47  // Generic Routing Encapsulation
-	ProtocolDSR            = 48  // Dynamic Source Routing Protocol
-	ProtocolBNA            = 49  // BNA
-	ProtocolESP            = 50  // Encap Security Payload
-	ProtocolAH             = 51  // Authentication Header
-	ProtocolINLSP          = 52  // Integrated Net Layer Security  TUBA
-	ProtocolNARP           = 54  // NBMA Address Resolution Protocol
-	ProtocolMOBILE         = 55  // IP Mobility
-	ProtocolTLSP           = 56  // Transport Layer Security Protocol using Kryptonet key management
-	ProtocolSKIP           = 57  // SKIP
-	ProtocolIPv6ICMP       = 58  // ICMP for IPv6
-	ProtocolIPv6NoNxt      = 59  // No Next Header for IPv6
-	ProtocolIPv6Opts       = 60  // Destination Options for IPv6
-	ProtocolCFTP           = 62  // CFTP
-	ProtocolSATEXPAK       = 64  // SATNET and Backroom EXPAK
-	ProtocolKRYPTOLAN      = 65  // Kryptolan
-	ProtocolRVD            = 66  // MIT Remote Virtual Disk Protocol
-	ProtocolIPPC           = 67  // Internet Pluribus Packet Core
-	ProtocolSATMON         = 69  // SATNET Monitoring
-	ProtocolVISA           = 70  // VISA Protocol
-	ProtocolIPCV           = 71  // Internet Packet Core Utility
-	ProtocolCPNX           = 72  // Computer Protocol Network Executive
-	ProtocolCPHB           = 73  // Computer Protocol Heart Beat
-	ProtocolWSN            = 74  // Wang Span Network
-	ProtocolPVP            = 75  // Packet Video Protocol
-	ProtocolBRSATMON       = 76  // Backroom SATNET Monitoring
-	ProtocolSUNND          = 77  // SUN ND PROTOCOL-Temporary
-	ProtocolWBMON          = 78  // WIDEBAND Monitoring
-	ProtocolWBEXPAK        = 79  // WIDEBAND EXPAK
-	ProtocolISOIP          = 80  // ISO Internet Protocol
-	ProtocolVMTP           = 81  // VMTP
-	ProtocolSECUREVMTP     = 82  // SECURE-VMTP
-	ProtocolVINES          = 83  // VINES
-	ProtocolTTP            = 84  // Transaction Transport Protocol
-	ProtocolIPTM           = 84  // Internet Protocol Traffic Manager
-	ProtocolNSFNETIGP      = 85  // NSFNET-IGP
-	ProtocolDGP            = 86  // Dissimilar Gateway Protocol
-	ProtocolTCF            = 87  // TCF
-	ProtocolEIGRP          = 88  // EIGRP
-	ProtocolOSPFIGP        = 89  // OSPFIGP
-	ProtocolSpriteRPC      = 90  // Sprite RPC Protocol
-	ProtocolLARP           = 91  // Locus Address Resolution Protocol
-	ProtocolMTP            = 92  // Multicast Transport Protocol
-	ProtocolAX25           = 93  // AX.25 Frames
-	ProtocolIPIP           = 94  // IP-within-IP Encapsulation Protocol
-	ProtocolSCCSP          = 96  // Semaphore Communications Sec. Pro.
-	ProtocolETHERIP        = 97  // Ethernet-within-IP Encapsulation
-	ProtocolENCAP          = 98  // Encapsulation Header
-	ProtocolGMTP           = 100 // GMTP
-	ProtocolIFMP           = 101 // Ipsilon Flow Management Protocol
-	ProtocolPNNI           = 102 // PNNI over IP
-	ProtocolPIM            = 103 // Protocol Independent Multicast
-	ProtocolARIS           = 104 // ARIS
-	ProtocolSCPS           = 105 // SCPS
-	ProtocolQNX            = 106 // QNX
-	ProtocolAN             = 107 // Active Networks
-	ProtocolIPComp         = 108 // IP Payload Compression Protocol
-	ProtocolSNP            = 109 // Sitara Networks Protocol
-	ProtocolCompaqPeer     = 110 // Compaq Peer Protocol
-	ProtocolIPXinIP        = 111 // IPX in IP
-	ProtocolVRRP           = 112 // Virtual Router Redundancy Protocol
-	ProtocolPGM            = 113 // PGM Reliable Transport Protocol
-	ProtocolL2TP           = 115 // Layer Two Tunneling Protocol
-	ProtocolDDX            = 116 // D-II Data Exchange (DDX)
-	ProtocolIATP           = 117 // Interactive Agent Transfer Protocol
-	ProtocolSTP            = 118 // Schedule Transfer Protocol
-	ProtocolSRP            = 119 // SpectraLink Radio Protocol
-	ProtocolUTI            = 120 // UTI
-	ProtocolSMP            = 121 // Simple Message Protocol
-	ProtocolPTP            = 123 // Performance Transparency Protocol
-	ProtocolISIS           = 124 // ISIS over IPv4
-	ProtocolFIRE           = 125 // FIRE
-	ProtocolCRTP           = 126 // Combat Radio Transport Protocol
-	ProtocolCRUDP          = 127 // Combat Radio User Datagram
-	ProtocolSSCOPMCE       = 128 // SSCOPMCE
-	ProtocolIPLT           = 129 // IPLT
-	ProtocolSPS            = 130 // Secure Packet Shield
-	ProtocolPIPE           = 131 // Private IP Encapsulation within IP
-	ProtocolSCTP           = 132 // Stream Control Transmission Protocol
-	ProtocolFC             = 133 // Fibre Channel
-	ProtocolRSVPE2EIGNORE  = 134 // RSVP-E2E-IGNORE
-	ProtocolMobilityHeader = 135 // Mobility Header
-	ProtocolUDPLite        = 136 // UDPLite
-	ProtocolMPLSinIP       = 137 // MPLS-in-IP
-	ProtocolMANET          = 138 // MANET Protocols
-	ProtocolHIP            = 139 // Host Identity Protocol
-	ProtocolShim6          = 140 // Shim6 Protocol
-	ProtocolWESP           = 141 // Wrapped Encapsulating Security Payload
-	ProtocolROHC           = 142 // Robust Header Compression
-	ProtocolReserved       = 255 // Reserved
-)
-
-// Address Family Numbers, Updated: 2018-04-02
-const (
-	AddrFamilyIPv4                          = 1     // IP (IP version 4)
-	AddrFamilyIPv6                          = 2     // IP6 (IP version 6)
-	AddrFamilyNSAP                          = 3     // NSAP
-	AddrFamilyHDLC                          = 4     // HDLC (8-bit multidrop)
-	AddrFamilyBBN1822                       = 5     // BBN 1822
-	AddrFamily802                           = 6     // 802 (includes all 802 media plus Ethernet "canonical format")
-	AddrFamilyE163                          = 7     // E.163
-	AddrFamilyE164                          = 8     // E.164 (SMDS, Frame Relay, ATM)
-	AddrFamilyF69                           = 9     // F.69 (Telex)
-	AddrFamilyX121                          = 10    // X.121 (X.25, Frame Relay)
-	AddrFamilyIPX                           = 11    // IPX
-	AddrFamilyAppletalk                     = 12    // Appletalk
-	AddrFamilyDecnetIV                      = 13    // Decnet IV
-	AddrFamilyBanyanVines                   = 14    // Banyan Vines
-	AddrFamilyE164withSubaddress            = 15    // E.164 with NSAP format subaddress
-	AddrFamilyDNS                           = 16    // DNS (Domain Name System)
-	AddrFamilyDistinguishedName             = 17    // Distinguished Name
-	AddrFamilyASNumber                      = 18    // AS Number
-	AddrFamilyXTPoverIPv4                   = 19    // XTP over IP version 4
-	AddrFamilyXTPoverIPv6                   = 20    // XTP over IP version 6
-	AddrFamilyXTPnativemodeXTP              = 21    // XTP native mode XTP
-	AddrFamilyFibreChannelWorldWidePortName = 22    // Fibre Channel World-Wide Port Name
-	AddrFamilyFibreChannelWorldWideNodeName = 23    // Fibre Channel World-Wide Node Name
-	AddrFamilyGWID                          = 24    // GWID
-	AddrFamilyL2VPN                         = 25    // AFI for L2VPN information
-	AddrFamilyMPLSTPSectionEndpointID       = 26    // MPLS-TP Section Endpoint Identifier
-	AddrFamilyMPLSTPLSPEndpointID           = 27    // MPLS-TP LSP Endpoint Identifier
-	AddrFamilyMPLSTPPseudowireEndpointID    = 28    // MPLS-TP Pseudowire Endpoint Identifier
-	AddrFamilyMTIPv4                        = 29    // MT IP: Multi-Topology IP version 4
-	AddrFamilyMTIPv6                        = 30    // MT IPv6: Multi-Topology IP version 6
-	AddrFamilyEIGRPCommonServiceFamily      = 16384 // EIGRP Common Service Family
-	AddrFamilyEIGRPIPv4ServiceFamily        = 16385 // EIGRP IPv4 Service Family
-	AddrFamilyEIGRPIPv6ServiceFamily        = 16386 // EIGRP IPv6 Service Family
-	AddrFamilyLISPCanonicalAddressFormat    = 16387 // LISP Canonical Address Format (LCAF)
-	AddrFamilyBGPLS                         = 16388 // BGP-LS
-	AddrFamily48bitMAC                      = 16389 // 48-bit MAC
-	AddrFamily64bitMAC                      = 16390 // 64-bit MAC
-	AddrFamilyOUI                           = 16391 // OUI
-	AddrFamilyMACFinal24bits                = 16392 // MAC/24
-	AddrFamilyMACFinal40bits                = 16393 // MAC/40
-	AddrFamilyIPv6Initial64bits             = 16394 // IPv6/64
-	AddrFamilyRBridgePortID                 = 16395 // RBridge Port ID
-	AddrFamilyTRILLNickname                 = 16396 // TRILL Nickname
-)

vendor/golang.org/x/net/internal/iana/gen.go

@@ -1,383 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-//go:generate go run gen.go
-
-// This program generates internet protocol constants and tables by
-// reading IANA protocol registries.
-package main
-
-import (
-	"bytes"
-	"encoding/xml"
-	"fmt"
-	"go/format"
-	"io"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"strconv"
-	"strings"
-)
-
-var registries = []struct {
-	url   string
-	parse func(io.Writer, io.Reader) error
-}{
-	{
-		"https://www.iana.org/assignments/dscp-registry/dscp-registry.xml",
-		parseDSCPRegistry,
-	},
-	{
-		"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xml",
-		parseProtocolNumbers,
-	},
-	{
-		"https://www.iana.org/assignments/address-family-numbers/address-family-numbers.xml",
-		parseAddrFamilyNumbers,
-	},
-}
-
-func main() {
-	var bb bytes.Buffer
-	fmt.Fprintf(&bb, "// go generate gen.go\n")
-	fmt.Fprintf(&bb, "// Code generated by the command above; DO NOT EDIT.\n\n")
-	fmt.Fprintf(&bb, "// Package iana provides protocol number resources managed by the Internet Assigned Numbers Authority (IANA).\n")
-	fmt.Fprintf(&bb, `package iana // import "golang.org/x/net/internal/iana"`+"\n\n")
-	for _, r := range registries {
-		resp, err := http.Get(r.url)
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-		defer resp.Body.Close()
-		if resp.StatusCode != http.StatusOK {
-			fmt.Fprintf(os.Stderr, "got HTTP status code %v for %v\n", resp.StatusCode, r.url)
-			os.Exit(1)
-		}
-		if err := r.parse(&bb, resp.Body); err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-		fmt.Fprintf(&bb, "\n")
-	}
-	b, err := format.Source(bb.Bytes())
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	if err := ioutil.WriteFile("const.go", b, 0644); err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-}
-
-func parseDSCPRegistry(w io.Writer, r io.Reader) error {
-	dec := xml.NewDecoder(r)
-	var dr dscpRegistry
-	if err := dec.Decode(&dr); err != nil {
-		return err
-	}
-	fmt.Fprintf(w, "// %s, Updated: %s\n", dr.Title, dr.Updated)
-	fmt.Fprintf(w, "const (\n")
-	for _, dr := range dr.escapeDSCP() {
-		fmt.Fprintf(w, "DiffServ%s = %#02x", dr.Name, dr.Value)
-		fmt.Fprintf(w, "// %s\n", dr.OrigName)
-	}
-	for _, er := range dr.escapeECN() {
-		fmt.Fprintf(w, "%s = %#02x", er.Descr, er.Value)
-		fmt.Fprintf(w, "// %s\n", er.OrigDescr)
-	}
-	fmt.Fprintf(w, ")\n")
-	return nil
-}
-
-type dscpRegistry struct {
-	XMLName    xml.Name `xml:"registry"`
-	Title      string   `xml:"title"`
-	Updated    string   `xml:"updated"`
-	Note       string   `xml:"note"`
-	Registries []struct {
-		Title      string `xml:"title"`
-		Registries []struct {
-			Title   string `xml:"title"`
-			Records []struct {
-				Name  string `xml:"name"`
-				Space string `xml:"space"`
-			} `xml:"record"`
-		} `xml:"registry"`
-		Records []struct {
-			Value string `xml:"value"`
-			Descr string `xml:"description"`
-		} `xml:"record"`
-	} `xml:"registry"`
-}
-
-type canonDSCPRecord struct {
-	OrigName string
-	Name     string
-	Value    int
-}
-
-func (drr *dscpRegistry) escapeDSCP() []canonDSCPRecord {
-	var drs []canonDSCPRecord
-	for _, preg := range drr.Registries {
-		if !strings.Contains(preg.Title, "Differentiated Services Field Codepoints") {
-			continue
-		}
-		for _, reg := range preg.Registries {
-			if !strings.Contains(reg.Title, "Pool 1 Codepoints") {
-				continue
-			}
-			drs = make([]canonDSCPRecord, len(reg.Records))
-			sr := strings.NewReplacer(
-				"+", "",
-				"-", "",
-				"/", "",
-				".", "",
-				" ", "",
-			)
-			for i, dr := range reg.Records {
-				s := strings.TrimSpace(dr.Name)
-				drs[i].OrigName = s
-				drs[i].Name = sr.Replace(s)
-				n, err := strconv.ParseUint(dr.Space, 2, 8)
-				if err != nil {
-					continue
-				}
-				drs[i].Value = int(n) << 2
-			}
-		}
-	}
-	return drs
-}
-
-type canonECNRecord struct {
-	OrigDescr string
-	Descr     string
-	Value     int
-}
-
-func (drr *dscpRegistry) escapeECN() []canonECNRecord {
-	var ers []canonECNRecord
-	for _, reg := range drr.Registries {
-		if !strings.Contains(reg.Title, "ECN Field") {
-			continue
-		}
-		ers = make([]canonECNRecord, len(reg.Records))
-		sr := strings.NewReplacer(
-			"Capable", "",
-			"Not-ECT", "",
-			"ECT(1)", "",
-			"ECT(0)", "",
-			"CE", "",
-			"(", "",
-			")", "",
-			"+", "",
-			"-", "",
-			"/", "",
-			".", "",
-			" ", "",
-		)
-		for i, er := range reg.Records {
-			s := strings.TrimSpace(er.Descr)
-			ers[i].OrigDescr = s
-			ss := strings.Split(s, " ")
-			if len(ss) > 1 {
-				ers[i].Descr = strings.Join(ss[1:], " ")
-			} else {
-				ers[i].Descr = ss[0]
-			}
-			ers[i].Descr = sr.Replace(er.Descr)
-			n, err := strconv.ParseUint(er.Value, 2, 8)
-			if err != nil {
-				continue
-			}
-			ers[i].Value = int(n)
-		}
-	}
-	return ers
-}
-
-func parseProtocolNumbers(w io.Writer, r io.Reader) error {
-	dec := xml.NewDecoder(r)
-	var pn protocolNumbers
-	if err := dec.Decode(&pn); err != nil {
-		return err
-	}
-	prs := pn.escape()
-	prs = append([]canonProtocolRecord{{
-		Name:  "IP",
-		Descr: "IPv4 encapsulation, pseudo protocol number",
-		Value: 0,
-	}}, prs...)
-	fmt.Fprintf(w, "// %s, Updated: %s\n", pn.Title, pn.Updated)
-	fmt.Fprintf(w, "const (\n")
-	for _, pr := range prs {
-		if pr.Name == "" {
-			continue
-		}
-		fmt.Fprintf(w, "Protocol%s = %d", pr.Name, pr.Value)
-		s := pr.Descr
-		if s == "" {
-			s = pr.OrigName
-		}
-		fmt.Fprintf(w, "// %s\n", s)
-	}
-	fmt.Fprintf(w, ")\n")
-	return nil
-}
-
-type protocolNumbers struct {
-	XMLName  xml.Name `xml:"registry"`
-	Title    string   `xml:"title"`
-	Updated  string   `xml:"updated"`
-	RegTitle string   `xml:"registry>title"`
-	Note     string   `xml:"registry>note"`
-	Records  []struct {
-		Value string `xml:"value"`
-		Name  string `xml:"name"`
-		Descr string `xml:"description"`
-	} `xml:"registry>record"`
-}
-
-type canonProtocolRecord struct {
-	OrigName string
-	Name     string
-	Descr    string
-	Value    int
-}
-
-func (pn *protocolNumbers) escape() []canonProtocolRecord {
-	prs := make([]canonProtocolRecord, len(pn.Records))
-	sr := strings.NewReplacer(
-		"-in-", "in",
-		"-within-", "within",
-		"-over-", "over",
-		"+", "P",
-		"-", "",
-		"/", "",
-		".", "",
-		" ", "",
-	)
-	for i, pr := range pn.Records {
-		if strings.Contains(pr.Name, "Deprecated") ||
-			strings.Contains(pr.Name, "deprecated") {
-			continue
-		}
-		prs[i].OrigName = pr.Name
-		s := strings.TrimSpace(pr.Name)
-		switch pr.Name {
-		case "ISIS over IPv4":
-			prs[i].Name = "ISIS"
-		case "manet":
-			prs[i].Name = "MANET"
-		default:
-			prs[i].Name = sr.Replace(s)
-		}
-		ss := strings.Split(pr.Descr, "\n")
-		for i := range ss {
-			ss[i] = strings.TrimSpace(ss[i])
-		}
-		if len(ss) > 1 {
-			prs[i].Descr = strings.Join(ss, " ")
-		} else {
-			prs[i].Descr = ss[0]
-		}
-		prs[i].Value, _ = strconv.Atoi(pr.Value)
-	}
-	return prs
-}
-
-func parseAddrFamilyNumbers(w io.Writer, r io.Reader) error {
-	dec := xml.NewDecoder(r)
-	var afn addrFamilylNumbers
-	if err := dec.Decode(&afn); err != nil {
-		return err
-	}
-	afrs := afn.escape()
-	fmt.Fprintf(w, "// %s, Updated: %s\n", afn.Title, afn.Updated)
-	fmt.Fprintf(w, "const (\n")
-	for _, afr := range afrs {
-		if afr.Name == "" {
-			continue
-		}
-		fmt.Fprintf(w, "AddrFamily%s = %d", afr.Name, afr.Value)
-		fmt.Fprintf(w, "// %s\n", afr.Descr)
-	}
-	fmt.Fprintf(w, ")\n")
-	return nil
-}
-
-type addrFamilylNumbers struct {
-	XMLName  xml.Name `xml:"registry"`
-	Title    string   `xml:"title"`
-	Updated  string   `xml:"updated"`
-	RegTitle string   `xml:"registry>title"`
-	Note     string   `xml:"registry>note"`
-	Records  []struct {
-		Value string `xml:"value"`
-		Descr string `xml:"description"`
-	} `xml:"registry>record"`
-}
-
-type canonAddrFamilyRecord struct {
-	Name  string
-	Descr string
-	Value int
-}
-
-func (afn *addrFamilylNumbers) escape() []canonAddrFamilyRecord {
-	afrs := make([]canonAddrFamilyRecord, len(afn.Records))
-	sr := strings.NewReplacer(
-		"IP version 4", "IPv4",
-		"IP version 6", "IPv6",
-		"Identifier", "ID",
-		"-", "",
-		"-", "",
-		"/", "",
-		".", "",
-		" ", "",
-	)
-	for i, afr := range afn.Records {
-		if strings.Contains(afr.Descr, "Unassigned") ||
-			strings.Contains(afr.Descr, "Reserved") {
-			continue
-		}
-		afrs[i].Descr = afr.Descr
-		s := strings.TrimSpace(afr.Descr)
-		switch s {
-		case "IP (IP version 4)":
-			afrs[i].Name = "IPv4"
-		case "IP6 (IP version 6)":
-			afrs[i].Name = "IPv6"
-		case "AFI for L2VPN information":
-			afrs[i].Name = "L2VPN"
-		case "E.164 with NSAP format subaddress":
-			afrs[i].Name = "E164withSubaddress"
-		case "MT IP: Multi-Topology IP version 4":
-			afrs[i].Name = "MTIPv4"
-		case "MAC/24":
-			afrs[i].Name = "MACFinal24bits"
-		case "MAC/40":
-			afrs[i].Name = "MACFinal40bits"
-		case "IPv6/64":
-			afrs[i].Name = "IPv6Initial64bits"
-		default:
-			n := strings.Index(s, "(")
-			if n > 0 {
-				s = s[:n]
-			}
-			n = strings.Index(s, ":")
-			if n > 0 {
-				s = s[:n]
-			}
-			afrs[i].Name = sr.Replace(s)
-		}
-		afrs[i].Value, _ = strconv.Atoi(afr.Value)
-	}
-	return afrs
-}

vendor/golang.org/x/net/internal/socket/cmsghdr.go

@@ -1,11 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build darwin dragonfly freebsd linux netbsd openbsd solaris
-
-package socket
-
-func (h *cmsghdr) len() int { return int(h.Len) }
-func (h *cmsghdr) lvl() int { return int(h.Level) }
-func (h *cmsghdr) typ() int { return int(h.Type) }

vendor/golang.org/x/net/internal/socket/cmsghdr_bsd.go

@@ -1,13 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build darwin dragonfly freebsd netbsd openbsd
-
-package socket
-
-func (h *cmsghdr) set(l, lvl, typ int) {
-	h.Len = uint32(l)
-	h.Level = int32(lvl)
-	h.Type = int32(typ)
-}

vendor/golang.org/x/net/internal/socket/cmsghdr_solaris_64bit.go

@@ -1,14 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build amd64
-// +build solaris
-
-package socket
-
-func (h *cmsghdr) set(l, lvl, typ int) {
-	h.Len = uint32(l)
-	h.Level = int32(lvl)
-	h.Type = int32(typ)
-}

vendor/golang.org/x/net/internal/socket/defs_darwin.go

@@ -1,44 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-// +godefs map struct_in_addr [4]byte /* in_addr */
-// +godefs map struct_in6_addr [16]byte /* in6_addr */
-
-package socket
-
-/*
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-*/
-import "C"
-
-const (
-	sysAF_UNSPEC = C.AF_UNSPEC
-	sysAF_INET   = C.AF_INET
-	sysAF_INET6  = C.AF_INET6
-
-	sysSOCK_RAW = C.SOCK_RAW
-)
-
-type iovec C.struct_iovec
-
-type msghdr C.struct_msghdr
-
-type cmsghdr C.struct_cmsghdr
-
-type sockaddrInet C.struct_sockaddr_in
-
-type sockaddrInet6 C.struct_sockaddr_in6
-
-const (
-	sizeofIovec   = C.sizeof_struct_iovec
-	sizeofMsghdr  = C.sizeof_struct_msghdr
-	sizeofCmsghdr = C.sizeof_struct_cmsghdr
-
-	sizeofSockaddrInet  = C.sizeof_struct_sockaddr_in
-	sizeofSockaddrInet6 = C.sizeof_struct_sockaddr_in6
-)

vendor/golang.org/x/net/internal/socket/defs_dragonfly.go

@@ -1,44 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-// +godefs map struct_in_addr [4]byte /* in_addr */
-// +godefs map struct_in6_addr [16]byte /* in6_addr */
-
-package socket
-
-/*
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-*/
-import "C"
-
-const (
-	sysAF_UNSPEC = C.AF_UNSPEC
-	sysAF_INET   = C.AF_INET
-	sysAF_INET6  = C.AF_INET6
-
-	sysSOCK_RAW = C.SOCK_RAW
-)
-
-type iovec C.struct_iovec
-
-type msghdr C.struct_msghdr
-
-type cmsghdr C.struct_cmsghdr
-
-type sockaddrInet C.struct_sockaddr_in
-
-type sockaddrInet6 C.struct_sockaddr_in6
-
-const (
-	sizeofIovec   = C.sizeof_struct_iovec
-	sizeofMsghdr  = C.sizeof_struct_msghdr
-	sizeofCmsghdr = C.sizeof_struct_cmsghdr
-
-	sizeofSockaddrInet  = C.sizeof_struct_sockaddr_in
-	sizeofSockaddrInet6 = C.sizeof_struct_sockaddr_in6
-)

vendor/golang.org/x/net/internal/socket/defs_freebsd.go

@@ -1,44 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-// +godefs map struct_in_addr [4]byte /* in_addr */
-// +godefs map struct_in6_addr [16]byte /* in6_addr */
-
-package socket
-
-/*
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-*/
-import "C"
-
-const (
-	sysAF_UNSPEC = C.AF_UNSPEC
-	sysAF_INET   = C.AF_INET
-	sysAF_INET6  = C.AF_INET6
-
-	sysSOCK_RAW = C.SOCK_RAW
-)
-
-type iovec C.struct_iovec
-
-type msghdr C.struct_msghdr
-
-type cmsghdr C.struct_cmsghdr
-
-type sockaddrInet C.struct_sockaddr_in
-
-type sockaddrInet6 C.struct_sockaddr_in6
-
-const (
-	sizeofIovec   = C.sizeof_struct_iovec
-	sizeofMsghdr  = C.sizeof_struct_msghdr
-	sizeofCmsghdr = C.sizeof_struct_cmsghdr
-
-	sizeofSockaddrInet  = C.sizeof_struct_sockaddr_in
-	sizeofSockaddrInet6 = C.sizeof_struct_sockaddr_in6
-)

vendor/golang.org/x/net/internal/socket/defs_linux.go

@@ -1,49 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-// +godefs map struct_in_addr [4]byte /* in_addr */
-// +godefs map struct_in6_addr [16]byte /* in6_addr */
-
-package socket
-
-/*
-#include <linux/in.h>
-#include <linux/in6.h>
-
-#define _GNU_SOURCE
-#include <sys/socket.h>
-*/
-import "C"
-
-const (
-	sysAF_UNSPEC = C.AF_UNSPEC
-	sysAF_INET   = C.AF_INET
-	sysAF_INET6  = C.AF_INET6
-
-	sysSOCK_RAW = C.SOCK_RAW
-)
-
-type iovec C.struct_iovec
-
-type msghdr C.struct_msghdr
-
-type mmsghdr C.struct_mmsghdr
-
-type cmsghdr C.struct_cmsghdr
-
-type sockaddrInet C.struct_sockaddr_in
-
-type sockaddrInet6 C.struct_sockaddr_in6
-
-const (
-	sizeofIovec   = C.sizeof_struct_iovec
-	sizeofMsghdr  = C.sizeof_struct_msghdr
-	sizeofMmsghdr = C.sizeof_struct_mmsghdr
-	sizeofCmsghdr = C.sizeof_struct_cmsghdr
-
-	sizeofSockaddrInet  = C.sizeof_struct_sockaddr_in
-	sizeofSockaddrInet6 = C.sizeof_struct_sockaddr_in6
-)

vendor/golang.org/x/net/internal/socket/defs_netbsd.go

@@ -1,47 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-// +godefs map struct_in_addr [4]byte /* in_addr */
-// +godefs map struct_in6_addr [16]byte /* in6_addr */
-
-package socket
-
-/*
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-*/
-import "C"
-
-const (
-	sysAF_UNSPEC = C.AF_UNSPEC
-	sysAF_INET   = C.AF_INET
-	sysAF_INET6  = C.AF_INET6
-
-	sysSOCK_RAW = C.SOCK_RAW
-)
-
-type iovec C.struct_iovec
-
-type msghdr C.struct_msghdr
-
-type mmsghdr C.struct_mmsghdr
-
-type cmsghdr C.struct_cmsghdr
-
-type sockaddrInet C.struct_sockaddr_in
-
-type sockaddrInet6 C.struct_sockaddr_in6
-
-const (
-	sizeofIovec   = C.sizeof_struct_iovec
-	sizeofMsghdr  = C.sizeof_struct_msghdr
-	sizeofMmsghdr = C.sizeof_struct_mmsghdr
-	sizeofCmsghdr = C.sizeof_struct_cmsghdr
-
-	sizeofSockaddrInet  = C.sizeof_struct_sockaddr_in
-	sizeofSockaddrInet6 = C.sizeof_struct_sockaddr_in6
-)

vendor/golang.org/x/net/internal/socket/defs_openbsd.go

@@ -1,44 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-// +godefs map struct_in_addr [4]byte /* in_addr */
-// +godefs map struct_in6_addr [16]byte /* in6_addr */
-
-package socket
-
-/*
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-*/
-import "C"
-
-const (
-	sysAF_UNSPEC = C.AF_UNSPEC
-	sysAF_INET   = C.AF_INET
-	sysAF_INET6  = C.AF_INET6
-
-	sysSOCK_RAW = C.SOCK_RAW
-)
-
-type iovec C.struct_iovec
-
-type msghdr C.struct_msghdr
-
-type cmsghdr C.struct_cmsghdr
-
-type sockaddrInet C.struct_sockaddr_in
-
-type sockaddrInet6 C.struct_sockaddr_in6
-
-const (
-	sizeofIovec   = C.sizeof_struct_iovec
-	sizeofMsghdr  = C.sizeof_struct_msghdr
-	sizeofCmsghdr = C.sizeof_struct_cmsghdr
-
-	sizeofSockaddrInet  = C.sizeof_struct_sockaddr_in
-	sizeofSockaddrInet6 = C.sizeof_struct_sockaddr_in6
-)

vendor/golang.org/x/net/internal/socket/defs_solaris.go

@@ -1,44 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build ignore
-
-// +godefs map struct_in_addr [4]byte /* in_addr */
-// +godefs map struct_in6_addr [16]byte /* in6_addr */
-
-package socket
-
-/*
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-*/
-import "C"
-
-const (
-	sysAF_UNSPEC = C.AF_UNSPEC
-	sysAF_INET   = C.AF_INET
-	sysAF_INET6  = C.AF_INET6
-
-	sysSOCK_RAW = C.SOCK_RAW
-)
-
-type iovec C.struct_iovec
-
-type msghdr C.struct_msghdr
-
-type cmsghdr C.struct_cmsghdr
-
-type sockaddrInet C.struct_sockaddr_in
-
-type sockaddrInet6 C.struct_sockaddr_in6
-
-const (
-	sizeofIovec   = C.sizeof_struct_iovec
-	sizeofMsghdr  = C.sizeof_struct_msghdr
-	sizeofCmsghdr = C.sizeof_struct_cmsghdr
-
-	sizeofSockaddrInet  = C.sizeof_struct_sockaddr_in
-	sizeofSockaddrInet6 = C.sizeof_struct_sockaddr_in6
-)

vendor/golang.org/x/net/internal/socket/error_unix.go

@@ -1,31 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build darwin dragonfly freebsd linux netbsd openbsd solaris
-
-package socket
-
-import "syscall"
-
-var (
-	errEAGAIN error = syscall.EAGAIN
-	errEINVAL error = syscall.EINVAL
-	errENOENT error = syscall.ENOENT
-)
-
-// errnoErr returns common boxed Errno values, to prevent allocations
-// at runtime.
-func errnoErr(errno syscall.Errno) error {
-	switch errno {
-	case 0:
-		return nil
-	case syscall.EAGAIN:
-		return errEAGAIN
-	case syscall.EINVAL:
-		return errEINVAL
-	case syscall.ENOENT:
-		return errENOENT
-	}
-	return errno
-}

vendor/golang.org/x/net/internal/socket/error_windows.go

@@ -1,26 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package socket
-
-import "syscall"
-
-var (
-	errERROR_IO_PENDING error = syscall.ERROR_IO_PENDING
-	errEINVAL           error = syscall.EINVAL
-)
-
-// errnoErr returns common boxed Errno values, to prevent allocations
-// at runtime.
-func errnoErr(errno syscall.Errno) error {
-	switch errno {
-	case 0:
-		return nil
-	case syscall.ERROR_IO_PENDING:
-		return errERROR_IO_PENDING
-	case syscall.EINVAL:
-		return errEINVAL
-	}
-	return errno
-}

vendor/golang.org/x/net/internal/socket/iovec_32bit.go

@@ -1,19 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build arm mips mipsle 386
-// +build darwin dragonfly freebsd linux netbsd openbsd
-
-package socket
-
-import "unsafe"
-
-func (v *iovec) set(b []byte) {
-	l := len(b)
-	if l == 0 {
-		return
-	}
-	v.Base = (*byte)(unsafe.Pointer(&b[0]))
-	v.Len = uint32(l)
-}

vendor/golang.org/x/net/internal/socket/iovec_64bit.go

@@ -1,19 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build arm64 amd64 ppc64 ppc64le mips64 mips64le s390x
-// +build darwin dragonfly freebsd linux netbsd openbsd
-
-package socket
-
-import "unsafe"
-
-func (v *iovec) set(b []byte) {
-	l := len(b)
-	if l == 0 {
-		return
-	}
-	v.Base = (*byte)(unsafe.Pointer(&b[0]))
-	v.Len = uint64(l)
-}

vendor/golang.org/x/net/internal/socket/iovec_solaris_64bit.go

@@ -1,19 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build amd64
-// +build solaris
-
-package socket
-
-import "unsafe"
-
-func (v *iovec) set(b []byte) {
-	l := len(b)
-	if l == 0 {
-		return
-	}
-	v.Base = (*int8)(unsafe.Pointer(&b[0]))
-	v.Len = uint64(l)
-}

vendor/golang.org/x/net/internal/socket/iovec_stub.go

@@ -1,11 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris
-
-package socket
-
-type iovec struct{}
-
-func (v *iovec) set(b []byte) {}

vendor/golang.org/x/net/internal/socket/mmsghdr_stub.go

@@ -1,21 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// +build !linux,!netbsd
-
-package socket
-
-import "net"
-
-type mmsghdr struct{}
-
-type mmsghdrs []mmsghdr
-
-func (hs mmsghdrs) pack(ms []Message, parseFn func([]byte, string) (net.Addr, error), marshalFn func(net.Addr) []byte) error {
-	return nil
-}
-
-func (hs mmsghdrs) unpack(ms []Message, parseFn func([]byte, string) (net.Addr, error), hint string) error {
-	return nil
-}