Merge pull request #23930 from ArtfulCoder/vendor-skydns

Godeps/.license_file_state

@@ -71,6 +71,10 @@ raw.githubusercontent.com/dgrijalva/jwt-go/master/NOTICE
 raw.githubusercontent.com/dgrijalva/jwt-go/master/NOTICE.txt
 raw.githubusercontent.com/dgrijalva/jwt-go/master/README
 raw.githubusercontent.com/dgrijalva/jwt-go/master/README.md
+raw.githubusercontent.com/docker/distribution/master/NOTICE
+raw.githubusercontent.com/docker/distribution/master/NOTICE.txt
+raw.githubusercontent.com/docker/distribution/master/README
+raw.githubusercontent.com/docker/distribution/master/README.md
 raw.githubusercontent.com/docker/engine-api/master/NOTICE
 raw.githubusercontent.com/docker/engine-api/master/NOTICE.txt
 raw.githubusercontent.com/docker/engine-api/master/README
@@ -129,6 +133,10 @@ raw.githubusercontent.com/golang/groupcache/master/NOTICE
 raw.githubusercontent.com/golang/groupcache/master/NOTICE.txt
 raw.githubusercontent.com/golang/groupcache/master/README
 raw.githubusercontent.com/golang/groupcache/master/README.md
+raw.githubusercontent.com/golang/mock/master/NOTICE
+raw.githubusercontent.com/golang/mock/master/NOTICE.txt
+raw.githubusercontent.com/golang/mock/master/README
+raw.githubusercontent.com/golang/mock/master/README.md
 raw.githubusercontent.com/golang/protobuf/master/NOTICE
 raw.githubusercontent.com/golang/protobuf/master/NOTICE.txt
 raw.githubusercontent.com/golang/protobuf/master/README
@@ -247,7 +255,6 @@ raw.githubusercontent.com/pmezard/go-difflib/master/NOTICE
 raw.githubusercontent.com/pmezard/go-difflib/master/NOTICE.txt
 raw.githubusercontent.com/pmezard/go-difflib/master/README
 raw.githubusercontent.com/pmezard/go-difflib/master/README.md
-raw.githubusercontent.com/prometheus/common/master/LICENSE
 raw.githubusercontent.com/prometheus/common/master/LICENSE.code
 raw.githubusercontent.com/prometheus/common/master/LICENSE.txt
 raw.githubusercontent.com/prometheus/common/master/LICENSE.md
@@ -315,6 +322,10 @@ raw.githubusercontent.com/vishvananda/netlink/master/NOTICE
 raw.githubusercontent.com/vishvananda/netlink/master/NOTICE.txt
 raw.githubusercontent.com/vishvananda/netlink/master/README
 raw.githubusercontent.com/vishvananda/netlink/master/README.md
+raw.githubusercontent.com/vmware/govmomi/master/NOTICE
+raw.githubusercontent.com/vmware/govmomi/master/NOTICE.txt
+raw.githubusercontent.com/vmware/govmomi/master/README
+raw.githubusercontent.com/vmware/govmomi/master/README.md
 raw.githubusercontent.com/xiang90/probing/master/NOTICE
 raw.githubusercontent.com/xiang90/probing/master/NOTICE.txt
 raw.githubusercontent.com/xiang90/probing/master/README
@@ -367,6 +378,10 @@ gopkg.in/gcfg.v1/master/NOTICE
 gopkg.in/gcfg.v1/master/NOTICE.txt
 gopkg.in/gcfg.v1/master/README
 gopkg.in/gcfg.v1/master/README.md
+gopkg.in/inf.v0/master/NOTICE
+gopkg.in/inf.v0/master/NOTICE.txt
+gopkg.in/inf.v0/master/README
+gopkg.in/inf.v0/master/README.md
 gopkg.in/natefinch/master/NOTICE
 gopkg.in/natefinch/master/NOTICE.txt
 gopkg.in/natefinch/master/README
@@ -379,39 +394,3 @@ k8s.io/heapster/master/NOTICE
 k8s.io/heapster/master/NOTICE.txt
 k8s.io/heapster/master/README
 k8s.io/heapster/master/README.md
-speter.net/go/master/NOTICE
-speter.net/go/master/NOTICE.txt
-speter.net/go/master/README
-speter.net/go/master/README.md
-gopkg.in/gcfg.v1/master/NOTICE
-gopkg.in/gcfg.v1/master/NOTICE.txt
-gopkg.in/gcfg.v1/master/README
-gopkg.in/gcfg.v1/master/README.md
-raw.githubusercontent.com/docker/engine-api/master/NOTICE
-raw.githubusercontent.com/docker/engine-api/master/NOTICE.txt
-raw.githubusercontent.com/docker/engine-api/master/README
-raw.githubusercontent.com/docker/engine-api/master/README.md
-raw.githubusercontent.com/docker/go-connections/master/NOTICE
-raw.githubusercontent.com/docker/go-connections/master/NOTICE.txt
-raw.githubusercontent.com/docker/go-connections/master/README
-raw.githubusercontent.com/docker/go-connections/master/README.md
-raw.githubusercontent.com/Microsoft/go-winio/master/NOTICE
-raw.githubusercontent.com/Microsoft/go-winio/master/NOTICE.txt
-raw.githubusercontent.com/Microsoft/go-winio/master/README
-raw.githubusercontent.com/Microsoft/go-winio/master/README.md
-raw.githubusercontent.com/docker/distribution/master/NOTICE
-raw.githubusercontent.com/docker/distribution/master/NOTICE.txt
-raw.githubusercontent.com/docker/distribution/master/README
-raw.githubusercontent.com/docker/distribution/master/README.md
-raw.githubusercontent.com/golang/mock/master/NOTICE
-raw.githubusercontent.com/golang/mock/master/NOTICE.txt
-raw.githubusercontent.com/golang/mock/master/README
-raw.githubusercontent.com/golang/mock/master/README.md
-raw.githubusercontent.com/vmware/govmomi/master/NOTICE
-raw.githubusercontent.com/vmware/govmomi/master/NOTICE.txt
-raw.githubusercontent.com/vmware/govmomi/master/README
-raw.githubusercontent.com/vmware/govmomi/master/README.md
-gopkg.in/inf.v0/master/NOTICE
-gopkg.in/inf.v0/master/NOTICE.txt
-gopkg.in/inf.v0/master/README
-gopkg.in/inf.v0/master/README.md

Godeps/Godeps.json

@@ -508,6 +508,11 @@
 			"Rev": "d043ae190b3202550d026daf009359bb5d761672"
 		},
 		{
+			"ImportPath": "github.com/coreos/go-systemd/activation",
+			"Comment": "v4",
+			"Rev": "b4a58d95188dd092ae20072bac14cece0e67c388"
+		},
+		{
 			"ImportPath": "github.com/coreos/go-systemd/daemon",
 			"Comment": "v4",
 			"Rev": "b4a58d95188dd092ae20072bac14cece0e67c388"
@@ -1335,7 +1340,7 @@
 		},
 		{
 			"ImportPath": "github.com/miekg/dns",
-			"Rev": "3f504e8dabd5d562e997d19ce0200aa41973e1b2"
+			"Rev": "c2b278e70f35902fd68b54b69238cd10bb1b7451"
 		},
 		{
 			"ImportPath": "github.com/mistifyio/go-zfs",
@@ -1782,9 +1787,29 @@
 			"Rev": "9a8b7d4e8f347bfa230879db9d7d4e4d9e19f962"
 		},
 		{
+			"ImportPath": "github.com/skynetservices/skydns/cache",
+			"Comment": "2.5.3a-32-gf7b6fb7",
+			"Rev": "f7b6fb74bcfab300b4e7e0e27b1fe6c0ed555f78"
+		},
+		{
+			"ImportPath": "github.com/skynetservices/skydns/metrics",
+			"Comment": "2.5.3a-32-gf7b6fb7",
+			"Rev": "f7b6fb74bcfab300b4e7e0e27b1fe6c0ed555f78"
+		},
+		{
 			"ImportPath": "github.com/skynetservices/skydns/msg",
-			"Comment": "2.5.1a",
-			"Rev": "1be70b5b8aa07acccd972146d84011b670af88b4"
+			"Comment": "2.5.3a-32-gf7b6fb7",
+			"Rev": "f7b6fb74bcfab300b4e7e0e27b1fe6c0ed555f78"
+		},
+		{
+			"ImportPath": "github.com/skynetservices/skydns/server",
+			"Comment": "2.5.3a-32-gf7b6fb7",
+			"Rev": "f7b6fb74bcfab300b4e7e0e27b1fe6c0ed555f78"
+		},
+		{
+			"ImportPath": "github.com/skynetservices/skydns/singleflight",
+			"Comment": "2.5.3a-32-gf7b6fb7",
+			"Rev": "f7b6fb74bcfab300b4e7e0e27b1fe6c0ed555f78"
 		},
 		{
 			"ImportPath": "github.com/spf13/cobra",

build/kube-dns/Dockerfile

+# Copyright 2016 The Kubernetes Authors All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM BASEIMAGE
+MAINTAINER Tim Hockin <thockin@google.com>
+ADD kube-dns /
+ENTRYPOINT ["/kube-dns"]

build/kube-dns/Makefile

+# Copyright 2016 The Kubernetes Authors All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Makefile for the Docker image gcr.io/google_containers/kube2sky
+# MAINTAINER: Tim Hockin <thockin@google.com>
+# If you update this image please bump the tag value before pushing.
+#
+# Usage:
+#   [ARCH=amd64] [TAG=1.0] [REGISTRY=gcr.io/google_containers] [BASEIMAGE=busybox] make container
+
+# Default registry, arch and tag. This can be overwritten by arguments to make
+PLATFORM?=linux
+ARCH?=amd64
+TAG?=1.0
+REGISTRY?=gcr.io/google_containers
+
+GOLANG_VERSION=1.6
+GOARM=6
+KUBE_ROOT=$(shell pwd)/../..
+TEMP_DIR:=$(shell mktemp -d)
+
+ifeq ($(ARCH),amd64)
+	BASEIMAGE?=busybox
+endif
+ifeq ($(ARCH),arm)
+	BASEIMAGE?=armel/busybox
+endif
+ifeq ($(ARCH),arm64)
+	BASEIMAGE?=aarch64/busybox
+endif
+ifeq ($(ARCH),ppc64le)
+	BASEIMAGE?=ppc64le/busybox
+endif
+
+
+all: container
+
+container:
+	# Copy the content in this dir to the temp dir
+	cp $(KUBE_ROOT)/_output/local/bin/$(PLATFORM)/$(ARCH)/kube-dns $(TEMP_DIR)
+	cp $(KUBE_ROOT)/build/kube-dns/Dockerfile $(TEMP_DIR)
+
+	# Replace BASEIMAGE with the real base image
+	cd $(TEMP_DIR) && sed -i "s|BASEIMAGE|$(BASEIMAGE)|g" Dockerfile
+
+	# And build the image
+	docker build -t $(REGISTRY)/kubedns-$(ARCH):$(TAG) $(TEMP_DIR)
+
+	# delete temp dir
+	rm -rf $(TEMP_DIR)
+
+push: container
+	gcloud docker push $(REGISTRY)/kubedns-$(ARCH):$(TAG)
+
+.PHONY: all container push

cluster/saltbase/salt/kube-addons/init.sls

@@ -73,17 +73,17 @@ addon-dir-create:
 {% endif %}
 
 {% if pillar.get('enable_cluster_dns', '').lower() == 'true' %}
-/etc/kubernetes/addons/dns/skydns-svc.yaml:
+/etc/kubernetes/addons/dns/kubedns-svc.yaml:
   file.managed:
-    - source: salt://kube-addons/dns/skydns-svc.yaml.in
+    - source: salt://kube-dns/kubedns-svc.yaml.in
     - template: jinja
     - group: root
     - dir_mode: 755
     - makedirs: True
 
-/etc/kubernetes/addons/dns/skydns-rc.yaml:
+/etc/kubernetes/addons/dns/kubedns-rc.yaml:
   file.managed:
-    - source: salt://kube-addons/dns/skydns-rc.yaml.in
+    - source: salt://kube-dns/kubedns-rc.yaml.in
     - template: jinja
     - group: root
     - dir_mode: 755

cluster/saltbase/salt/kube-dns/kubedns-rc.yaml.in

+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: kube-dns-v12
+  namespace: kube-system
+  labels:
+    k8s-app: kube-dns
+    version: v12
+    kubernetes.io/cluster-service: "true"
+spec:
+  replicas: {{ pillar['dns_replicas'] }}
+  selector:
+    k8s-app: kube-dns
+    version: v12
+  template:
+    metadata:
+      labels:
+        k8s-app: kube-dns
+        version: v12
+        kubernetes.io/cluster-service: "true"
+    spec:
+      containers:
+      - name: kubedns
+        image: gcr.io/google_containers/kubedns-amd64:1.0
+        resources:
+          # TODO: Set memory limits when we've profiled the container for large
+          # clusters, then set request = limit to keep this container in
+          # guaranteed class. Currently, this container falls into the
+          # "burstable" category so the kubelet doesn't backoff from restarting it.
+          limits:
+            cpu: 100m
+            memory: 200Mi
+          requests:
+            cpu: 100m
+            memory: 50Mi
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /readiness
+            port: 8081
+            scheme: HTTP
+          # we poll on pod startup for the Kubernetes master service and
+          # only setup the /readiness HTTP server once that's available.
+          initialDelaySeconds: 30
+          timeoutSeconds: 5
+        args:
+        # command = "/kube-dns"
+        - --domain={{ pillar['dns_domain'] }}.
+        ports:
+        - containerPort: 53
+          name: dns
+          protocol: UDP
+        - containerPort: 53
+          name: dns-tcp
+          protocol: TCP
+      - name: healthz
+        image: gcr.io/google_containers/exechealthz:1.0
+        resources:
+          # keep request = limit to keep this container in guaranteed class
+          limits:
+            cpu: 10m
+            memory: 20Mi
+          requests:
+            cpu: 10m
+            memory: 20Mi
+        args:
+        - -cmd=nslookup kubernetes.default.svc.{{ pillar['dns_domain'] }} 127.0.0.1 >/dev/null
+        - -port=8080
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+      dnsPolicy: Default  # Don't use cluster DNS.

cluster/saltbase/salt/kube-dns/kubedns-svc.yaml.in

+apiVersion: v1
+kind: Service
+metadata:
+  name: kube-dns
+  namespace: kube-system
+  labels:
+    k8s-app: kube-dns
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "KubeDNS"
+spec:
+  selector:
+    k8s-app: kube-dns
+  clusterIP:  {{ pillar['dns_server'] }}
+  ports:
+  - name: dns
+    port: 53
+    protocol: UDP
+  - name: dns-tcp
+    port: 53
+    protocol: TCP

cmd/kube-dns/app/options/options.go

+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package options contains flags for initializing a proxy.
+package options
+
+import (
+	"net/url"
+	"os"
+
+	"fmt"
+	"github.com/spf13/pflag"
+	"k8s.io/kubernetes/pkg/util/validation"
+	_ "net/http/pprof"
+	"strings"
+)
+
+type KubeDNSConfig struct {
+	ClusterDomain  string
+	KubeConfigFile string
+	KubeMasterURL  string
+	HealthzPort    int
+}
+
+func NewKubeDNSConfig() *KubeDNSConfig {
+	return &KubeDNSConfig{
+		ClusterDomain:  "cluster.local.",
+		KubeConfigFile: "",
+		KubeMasterURL:  "",
+		HealthzPort:    8081,
+	}
+}
+
+type clusterDomainVar struct {
+	val *string
+}
+
+func (m clusterDomainVar) Set(v string) error {
+	v = strings.TrimSuffix(v, ".")
+	segments := strings.Split(v, ".")
+	for _, segment := range segments {
+		if errs := validation.IsDNS1123Label(segment); len(errs) > 0 {
+			return fmt.Errorf("Not a valid DNS label. %v", errs)
+		}
+	}
+	if !strings.HasSuffix(v, ".") {
+		v = fmt.Sprintf("%s.", v)
+	}
+	*m.val = v
+	return nil
+}
+
+func (m clusterDomainVar) String() string {
+	return *m.val
+}
+
+func (m clusterDomainVar) Type() string {
+	return "string"
+}
+
+type kubeMasterURLVar struct {
+	val *string
+}
+
+func (m kubeMasterURLVar) Set(v string) error {
+	parsedURL, err := url.Parse(os.ExpandEnv(v))
+	if err != nil {
+		return fmt.Errorf("failed to parse kube-master-url")
+	}
+	if parsedURL.Scheme == "" || parsedURL.Host == "" || parsedURL.Host == ":" {
+		return fmt.Errorf("invalid kube-master-url specified")
+	}
+	*m.val = v
+	return nil
+}
+
+func (m kubeMasterURLVar) String() string {
+	return *m.val
+}
+
+func (m kubeMasterURLVar) Type() string {
+	return "string"
+}
+
+func (s *KubeDNSConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.Var(clusterDomainVar{&s.ClusterDomain}, "domain", "domain under which to create names")
+	fs.StringVar(&s.KubeConfigFile, "kubecfg-file", s.KubeConfigFile, "Location of kubecfg file for access to kubernetes master service; --kube-master-url overrides the URL part of this; if neither this nor --kube-master-url are provided, defaults to service account tokens")
+	fs.Var(kubeMasterURLVar{&s.KubeMasterURL}, "kube-master-url", "URL to reach kubernetes master. Env variables in this flag will be expanded.")
+	fs.IntVar(&s.HealthzPort, "healthz-port", s.HealthzPort, "port on which to serve a kube-dns HTTP readiness probe.")
+}

cmd/kube-dns/app/server.go

+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/golang/glog"
+	"github.com/skynetservices/skydns/metrics"
+	"github.com/skynetservices/skydns/server"
+	"k8s.io/kubernetes/cmd/kube-dns/app/options"
+	"k8s.io/kubernetes/pkg/api/unversioned"
+	"k8s.io/kubernetes/pkg/client/restclient"
+	kclient "k8s.io/kubernetes/pkg/client/unversioned"
+	kclientcmd "k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
+	kdns "k8s.io/kubernetes/pkg/dns"
+)
+
+type KubeDNSServer struct {
+	// DNS domain name.
+	domain      string
+	healthzPort int
+	kd          *kdns.KubeDNS
+}
+
+func NewKubeDNSServerDefault(config *options.KubeDNSConfig) *KubeDNSServer {
+	ks := KubeDNSServer{
+		domain: config.ClusterDomain,
+	}
+
+	kubeClient, err := newKubeClient(config)
+	if err != nil {
+		glog.Fatalf("Failed to create a kubernetes client: %v", err)
+	}
+	ks.healthzPort = config.HealthzPort
+	ks.kd = kdns.NewKubeDNS(kubeClient, config.ClusterDomain)
+	return &ks
+}
+
+// TODO: evaluate using pkg/client/clientcmd
+func newKubeClient(dnsConfig *options.KubeDNSConfig) (*kclient.Client, error) {
+	var (
+		config *restclient.Config
+		err    error
+	)
+
+	if dnsConfig.KubeMasterURL != "" && dnsConfig.KubeConfigFile == "" {
+		// Only --kube-master-url was provided.
+		config = &restclient.Config{
+			Host:          dnsConfig.KubeMasterURL,
+			ContentConfig: restclient.ContentConfig{GroupVersion: &unversioned.GroupVersion{Version: "v1"}},
+		}
+	} else {
+		// We either have:
+		//  1) --kube-master-url and --kubecfg-file
+		//  2) just --kubecfg-file
+		//  3) neither flag
+		// In any case, the logic is the same.  If (3), this will automatically
+		// fall back on the service account token.
+		overrides := &kclientcmd.ConfigOverrides{}
+		overrides.ClusterInfo.Server = dnsConfig.KubeMasterURL                                // might be "", but that is OK
+		rules := &kclientcmd.ClientConfigLoadingRules{ExplicitPath: dnsConfig.KubeConfigFile} // might be "", but that is OK
+		if config, err = kclientcmd.NewNonInteractiveDeferredLoadingClientConfig(rules, overrides).ClientConfig(); err != nil {
+			return nil, err
+		}
+	}
+
+	glog.Infof("Using %s for kubernetes master", config.Host)
+	glog.Infof("Using kubernetes API %v", config.GroupVersion)
+	return kclient.New(config)
+}
+
+func (server *KubeDNSServer) Run() {
+	setupSignalHandlers()
+	server.startSkyDNSServer()
+	server.kd.Start()
+	server.setupHealthzHandlers()
+	glog.Infof("Setting up Healthz Handler(/readiness, /cache) on port :%d", server.healthzPort)
+	glog.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", server.healthzPort), nil))
+}
+
+// setupHealthzHandlers sets up a readiness and liveness endpoint for kube2sky.
+func (server *KubeDNSServer) setupHealthzHandlers() {
+	http.HandleFunc("/readiness", func(w http.ResponseWriter, req *http.Request) {
+		fmt.Fprintf(w, "ok\n")
+	})
+	http.HandleFunc("/cache", func(w http.ResponseWriter, req *http.Request) {
+		serializedJSON, err := server.kd.GetCacheAsJSON()
+		if err == nil {
+			fmt.Fprint(w, serializedJSON)
+		} else {
+			w.WriteHeader(http.StatusInternalServerError)
+			fmt.Fprint(w, err)
+		}
+	})
+}
+
+// setupSignalHandlers runs a goroutine that waits on SIGINT or SIGTERM and logs it
+// before exiting.
+func setupSignalHandlers() {
+	sigChan := make(chan os.Signal)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		glog.Fatalf("Received signal: %s", <-sigChan)
+	}()
+}
+
+func (d *KubeDNSServer) startSkyDNSServer() {
+	skydnsConfig := &server.Config{Domain: d.domain, DnsAddr: "0.0.0.0:53"}
+	server.SetDefaults(skydnsConfig)
+	s := server.New(d.kd, skydnsConfig)
+	if err := metrics.Metrics(); err != nil {
+		glog.Fatalf("skydns: %s", err)
+	} else {
+		glog.Infof("skydns: metrics enabled on :%s%s", metrics.Port, metrics.Path)
+	}
+	go s.Run()
+}

cmd/kube-dns/dns.go

+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"github.com/spf13/pflag"
+	"k8s.io/kubernetes/cmd/kube-dns/app"
+	"k8s.io/kubernetes/cmd/kube-dns/app/options"
+	"k8s.io/kubernetes/pkg/util"
+	"k8s.io/kubernetes/pkg/util/flag"
+	"k8s.io/kubernetes/pkg/version/verflag"
+)
+
+func main() {
+	config := options.NewKubeDNSConfig()
+	config.AddFlags(pflag.CommandLine)
+
+	flag.InitFlags()
+	util.InitLogs()
+	defer util.FlushLogs()
+
+	verflag.PrintAndExitIfRequested()
+	server := app.NewKubeDNSServerDefault(config)
+	server.Run()
+}

hack/lib/golang.sh

@@ -30,6 +30,7 @@ fi
 # kube::build::source_targets in build/common.sh as well.
 kube::golang::server_targets() {
   local targets=(
+    cmd/kube-dns
     cmd/kube-proxy
     cmd/kube-apiserver
     cmd/kube-controller-manager
@@ -159,6 +160,7 @@ readonly KUBE_ALL_BINARIES=("${KUBE_ALL_TARGETS[@]##*/}")
 readonly KUBE_STATIC_LIBRARIES=(
   kube-apiserver
   kube-controller-manager
+  kube-dns
   kube-scheduler
   kube-proxy
   kubectl

pkg/dns/treecache.go

+/*
+Copyright 2016 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package dns
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+)
+
+type TreeCache struct {
+	ChildNodes map[string]*TreeCache
+	Entries    map[string]interface{}
+}
+
+func NewTreeCache() *TreeCache {
+	return &TreeCache{
+		ChildNodes: make(map[string]*TreeCache),
+		Entries:    make(map[string]interface{}),
+	}
+}
+
+func (cache *TreeCache) Serialize() (string, error) {
+	b, err := json.Marshal(cache)
+	if err != nil {
+		return "", err
+	}
+
+	var prettyJSON bytes.Buffer
+	err = json.Indent(&prettyJSON, b, "", "\t")
+
+	if err != nil {
+		return "", err
+	}
+	return string(prettyJSON.Bytes()), nil
+}
+
+func (cache *TreeCache) setEntry(key string, val interface{}, path ...string) {
+	node := cache.ensureChildNode(path...)
+	node.Entries[key] = val
+}
+
+func (cache *TreeCache) getSubCache(path ...string) *TreeCache {
+	childCache := cache
+	for _, subpath := range path {
+		childCache = childCache.ChildNodes[subpath]
+		if childCache == nil {
+			return nil
+		}
+	}
+	return childCache
+}
+
+func (cache *TreeCache) setSubCache(key string, subCache *TreeCache, path ...string) {
+	node := cache.ensureChildNode(path...)
+	node.ChildNodes[key] = subCache
+}
+
+func (cache *TreeCache) getEntry(key string, path ...string) (interface{}, bool) {
+	childNode := cache.getSubCache(path...)
+	val, ok := childNode.Entries[key]
+	return val, ok
+}
+
+func (cache *TreeCache) getValuesForPathWithWildcards(path ...string) []interface{} {
+	retval := []interface{}{}
+	nodesToExplore := []*TreeCache{cache}
+	for idx, subpath := range path {
+		nextNodesToExplore := []*TreeCache{}
+		if idx == len(path)-1 {
+			// if path ends on an entry, instead of a child node, add the entry
+			for _, node := range nodesToExplore {
+				if subpath == "*" {
+					nextNodesToExplore = append(nextNodesToExplore, node)
+				} else {
+					if val, ok := node.Entries[subpath]; ok {
+						retval = append(retval, val)
+					} else {
+						childNode := node.ChildNodes[subpath]
+						if childNode != nil {
+							nextNodesToExplore = append(nextNodesToExplore, childNode)
+						}
+					}
+				}
+			}
+			nodesToExplore = nextNodesToExplore
+			break
+		}
+
+		if subpath == "*" {
+			for _, node := range nodesToExplore {
+				for subkey, subnode := range node.ChildNodes {
+					if !strings.HasPrefix(subkey, "_") {
+						nextNodesToExplore = append(nextNodesToExplore, subnode)
+					}
+				}
+			}
+		} else {
+			for _, node := range nodesToExplore {
+				childNode := node.ChildNodes[subpath]
+				if childNode != nil {
+					nextNodesToExplore = append(nextNodesToExplore, childNode)
+				}
+			}
+		}
+		nodesToExplore = nextNodesToExplore
+	}
+
+	for _, node := range nodesToExplore {
+		for _, val := range node.Entries {
+			retval = append(retval, val)
+		}
+	}
+
+	return retval
+}
+
+func (cache *TreeCache) deletePath(path ...string) bool {
+	if len(path) == 0 {
+		return false
+	}
+	if parentNode := cache.getSubCache(path[:len(path)-1]...); parentNode != nil {
+		if _, ok := parentNode.ChildNodes[path[len(path)-1]]; ok {
+			delete(parentNode.ChildNodes, path[len(path)-1])
+			return true
+		}
+	}
+	return false
+}
+
+func (cache *TreeCache) deleteEntry(key string, path ...string) bool {
+	childNode := cache.getSubCache(path...)
+	if childNode == nil {
+		return false
+	}
+	if _, ok := childNode.Entries[key]; ok {
+		delete(childNode.Entries, key)
+		return true
+	}
+	return false
+}
+
+func (cache *TreeCache) appendValues(recursive bool, ref [][]interface{}) {
+	for _, value := range cache.Entries {
+		ref[0] = append(ref[0], value)
+	}
+	if recursive {
+		for _, node := range cache.ChildNodes {
+			node.appendValues(recursive, ref)
+		}
+	}
+}
+
+func (cache *TreeCache) ensureChildNode(path ...string) *TreeCache {
+	childNode := cache
+	for _, subpath := range path {
+		newNode, ok := childNode.ChildNodes[subpath]
+		if !ok {
+			newNode = NewTreeCache()
+			childNode.ChildNodes[subpath] = newNode
+		}
+		childNode = newNode
+	}
+	return childNode
+}
+
+// unused function. keeping it around in commented-fashion
+// in the future, we might need some form of this function so that
+// we can serialize to a file in a mounted empty dir..
+//const (
+//	dataFile = "data.dat"
+//	crcFile  = "data.crc"
+//)
+//func (cache *TreeCache) Serialize(dir string) (string, error) {
+//	cache.m.RLock()
+//	defer cache.m.RUnlock()
+//	b, err := json.Marshal(cache)
+//	if err != nil {
+//		return "", err
+//	}
+//
+//	if err := ensureDir(dir, os.FileMode(0755)); err != nil {
+//		return "", err
+//	}
+//	if err := ioutil.WriteFile(path.Join(dir, dataFile), b, 0644); err != nil {
+//		return "", err
+//	}
+//	if err := ioutil.WriteFile(path.Join(dir, crcFile), getMD5(b), 0644); err != nil {
+//		return "", err
+//	}
+//	return string(b), nil
+//}
+
+//func ensureDir(path string, perm os.FileMode) error {
+//	s, err := os.Stat(path)
+//	if err != nil || !s.IsDir() {
+//		return os.Mkdir(path, perm)
+//	}
+//	return nil
+//}
+
+//func getMD5(b []byte) []byte {
+//	h := md5.New()
+//	h.Write(b)
+//	return []byte(fmt.Sprintf("%x", h.Sum(nil)))
+//}
+
+// unused function. keeping it around in commented-fashion
+// in the future, we might need some form of this function so that
+// we can restart kube-dns, deserialize the tree and have a cache
+// without having to wait for kube-dns to reach out to API server.
+//func Deserialize(dir string) (*TreeCache, error) {
+//	b, err := ioutil.ReadFile(path.Join(dir, dataFile))
+//	if err != nil {
+//		return nil, err
+//	}
+//
+//	hash, err := ioutil.ReadFile(path.Join(dir, crcFile))
+//	if err != nil {
+//		return nil, err
+//	}
+//	if !reflect.DeepEqual(hash, getMD5(b)) {
+//		return nil, fmt.Errorf("Checksum failed")
+//	}
+//
+//	var cache TreeCache
+//	err = json.Unmarshal(b, &cache)
+//	if err != nil {
+//		return nil, err
+//	}
+//	cache.m = &sync.RWMutex{}
+//	return &cache, nil
+//}

vendor/github.com/coreos/go-systemd/activation/files.go

+// Copyright 2015 CoreOS, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package activation implements primitives for systemd socket activation.
+package activation
+
+import (
+	"os"
+	"strconv"
+	"syscall"
+)
+
+// based on: https://gist.github.com/alberts/4640792
+const (
+	listenFdsStart = 3
+)
+
+func Files(unsetEnv bool) []*os.File {
+	if unsetEnv {
+		defer os.Unsetenv("LISTEN_PID")
+		defer os.Unsetenv("LISTEN_FDS")
+	}
+
+	pid, err := strconv.Atoi(os.Getenv("LISTEN_PID"))
+	if err != nil || pid != os.Getpid() {
+		return nil
+	}
+
+	nfds, err := strconv.Atoi(os.Getenv("LISTEN_FDS"))
+	if err != nil || nfds == 0 {
+		return nil
+	}
+
+	files := make([]*os.File, 0, nfds)
+	for fd := listenFdsStart; fd < listenFdsStart+nfds; fd++ {
+		syscall.CloseOnExec(fd)
+		files = append(files, os.NewFile(uintptr(fd), "LISTEN_FD_"+strconv.Itoa(fd)))
+	}
+
+	return files
+}

vendor/github.com/coreos/go-systemd/activation/listeners.go

+// Copyright 2015 CoreOS, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package activation
+
+import (
+	"crypto/tls"
+	"net"
+)
+
+// Listeners returns a slice containing a net.Listener for each matching socket type
+// passed to this process.
+//
+// The order of the file descriptors is preserved in the returned slice.
+// Nil values are used to fill any gaps. For example if systemd were to return file descriptors
+// corresponding with "udp, tcp, tcp", then the slice would contain {nil, net.Listener, net.Listener}
+func Listeners(unsetEnv bool) ([]net.Listener, error) {
+	files := Files(unsetEnv)
+	listeners := make([]net.Listener, len(files))
+
+	for i, f := range files {
+		if pc, err := net.FileListener(f); err == nil {
+			listeners[i] = pc
+		}
+	}
+	return listeners, nil
+}
+
+// TLSListeners returns a slice containing a net.listener for each matching TCP socket type
+// passed to this process.
+// It uses default Listeners func and forces TCP sockets handlers to use TLS based on tlsConfig.
+func TLSListeners(unsetEnv bool, tlsConfig *tls.Config) ([]net.Listener, error) {
+	listeners, err := Listeners(unsetEnv)
+
+	if listeners == nil || err != nil {
+		return nil, err
+	}
+
+	if tlsConfig != nil && err == nil {
+		tlsConfig.NextProtos = []string{"http/1.1"}
+
+		for i, l := range listeners {
+			// Activate TLS only for TCP sockets
+			if l.Addr().Network() == "tcp" {
+				listeners[i] = tls.NewListener(l, tlsConfig)
+			}
+		}
+	}
+
+	return listeners, err
+}

vendor/github.com/coreos/go-systemd/activation/packetconns.go

+// Copyright 2015 CoreOS, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package activation
+
+import (
+	"net"
+)
+
+// PacketConns returns a slice containing a net.PacketConn for each matching socket type
+// passed to this process.
+//
+// The order of the file descriptors is preserved in the returned slice.
+// Nil values are used to fill any gaps. For example if systemd were to return file descriptors
+// corresponding with "udp, tcp, udp", then the slice would contain {net.PacketConn, nil, net.PacketConn}
+func PacketConns(unsetEnv bool) ([]net.PacketConn, error) {
+	files := Files(unsetEnv)
+	conns := make([]net.PacketConn, len(files))
+
+	for i, f := range files {
+		if pc, err := net.FilePacketConn(f); err == nil {
+			conns[i] = pc
+		}
+	}
+	return conns, nil
+}

vendor/github.com/miekg/dns/.travis.yml

 language: go
+sudo: false
 go:
-  - 1.2
-  - 1.3
-env:
-  # "gvm update" resets GOOS and GOARCH environment variable, workaround it by setting
-  # BUILD_GOOS and BUILD_GOARCH and overriding GOARCH and GOOS in the build script
-  global:
-    - BUILD_GOARCH=amd64
-  matrix:
-    - BUILD_GOOS=linux
-    - BUILD_GOOS=darwin
-    - BUILD_GOOS=windows
+  - 1.5
+  - 1.6
 script:
-  - gvm cross $BUILD_GOOS $BUILD_GOARCH
-  - GOARCH=$BUILD_GOARCH GOOS=$BUILD_GOOS go build
-
-  # only test on linux
-  # also specify -short; the crypto tests fail in weird ways *sometimes*
-  # See issue #151
-  - if [ $BUILD_GOOS == "linux" ]; then GOARCH=$BUILD_GOARCH GOOS=$BUILD_GOOS go test -short -bench=.; fi
+  - go test -race -v -bench=.

vendor/github.com/miekg/dns/README.md

@@ -10,9 +10,9 @@ If there is stuff you should know as a DNS programmer there isn't a convenience
 function for it. Server side and client side programming is supported, i.e. you
 can build servers and resolvers with it.
 
-If you like this, you may also be interested in:
-
-* https://github.com/miekg/unbound -- Go wrapper for the Unbound resolver.
+We try to keep the "master" branch as sane as possible and at the bleeding edge
+of standards, avoiding breaking changes wherever reasonable. We support the last
+two versions of Go, currently: 1.4 and 1.5.
 
 # Goals
 
@@ -24,6 +24,7 @@ If you like this, you may also be interested in:
 
 A not-so-up-to-date-list-that-may-be-actually-current:
 
+* https://cloudflare.com
 * https://github.com/abh/geodns
 * http://www.statdns.com/
 * http://www.dnsinspect.com/
@@ -32,8 +33,21 @@ A not-so-up-to-date-list-that-may-be-actually-current:
 * https://github.com/fcambus/rrda
 * https://github.com/kenshinx/godns
 * https://github.com/skynetservices/skydns
+* https://github.com/hashicorp/consul
 * https://github.com/DevelopersPL/godnsagent
 * https://github.com/duedil-ltd/discodns
+* https://github.com/StalkR/dns-reverse-proxy
+* https://github.com/tianon/rawdns
+* https://mesosphere.github.io/mesos-dns/
+* https://pulse.turbobytes.com/
+* https://play.google.com/store/apps/details?id=com.turbobytes.dig
+* https://github.com/fcambus/statzone
+* https://github.com/benschw/dns-clb-go
+* https://github.com/corny/dnscheck for http://public-dns.info/
+* https://namesmith.io
+* https://github.com/miekg/unbound
+* https://github.com/miekg/exdns
+* https://dnslookup.org
 
 Send pull request if you want to be listed here.
 
@@ -50,6 +64,7 @@ Send pull request if you want to be listed here.
 * EDNS0, NSID;
 * AXFR/IXFR;
 * TSIG, SIG(0);
+* DNS over TLS: optional encrypted connection between client and server;
 * DNS name compression;
 * Depends only on the standard library.
 
@@ -67,7 +82,7 @@ correctly, the following should work:
 
 ## Examples
 
-A short "how to use the API" is at the beginning of dns.go (this also will show
+A short "how to use the API" is at the beginning of doc.go (this also will show
 when you call `godoc github.com/miekg/dns`).
 
 Example programs can be found in the `github.com/miekg/exdns` repository.
@@ -77,7 +92,7 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
 *all of them*
 
 * 103{4,5} - DNS standard
-* 1348 - NSAP record
+* 1348 - NSAP record (removed the record)
 * 1982 - Serial Arithmetic
 * 1876 - LOC record
 * 1995 - IXFR
@@ -95,7 +110,8 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
 * 3225 - DO bit (DNSSEC OK)
 * 340{1,2,3} - NAPTR record
 * 3445 - Limiting the scope of (DNS)KEY
-* 3597 - Unkown RRs
+* 3597 - Unknown RRs
+* 4025 - IPSECKEY
 * 403{3,4,5} - DNSSEC + validation functions
 * 4255 - SSHFP record
 * 4343 - Case insensitivity
@@ -114,13 +130,16 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
 * 6605 - ECDSA
 * 6725 - IANA Registry Update
 * 6742 - ILNP DNS
+* 6840 - Clarifications and Implementation Notes for DNS Security
+* 6844 - CAA record
 * 6891 - EDNS0 update
 * 6895 - DNS IANA considerations
 * 6975 - Algorithm Understanding in DNSSEC
 * 7043 - EUI48/EUI64 records
 * 7314 - DNS (EDNS) EXPIRE Option
-* xxxx - URI record (draft)
+* 7553 - URI record
 * xxxx - EDNS0 DNS Update Lease (draft)
+* yyyy - DNS over TLS: Initiation and Performance Considerations (draft)
 
 ## Loosely based upon
 
@@ -132,9 +151,7 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
 ## TODO
 
 * privatekey.Precompute() when signing?
-* Last remaining RRs: APL, ATMA, A6 and NXT;
-* Missing in parsing: ISDN, UNSPEC, ATMA;
-* CAA parsing is broken;
-* NSEC(3) cover/match/closest enclose;
-* Replies with TC bit are not parsed to the end;
-* Create IsMsg to validate a message before fully parsing it.
+* Last remaining RRs: APL, ATMA, A6, NSAP and NXT.
+* Missing in parsing: ISDN, UNSPEC, NSAP and ATMA.
+* NSEC(3) cover/match/closest enclose.
+* Replies with TC bit are not parsed to the end.

vendor/github.com/miekg/dns/clientconfig.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 )
 
-// Wraps the contents of the /etc/resolv.conf.
+// ClientConfig wraps the contents of the /etc/resolv.conf file.
 type ClientConfig struct {
 	Servers  []string // servers to use
 	Search   []string // suffixes to append to local name
@@ -26,14 +26,19 @@ func ClientConfigFromFile(resolvconf string) (*ClientConfig, error) {
 	}
 	defer file.Close()
 	c := new(ClientConfig)
-	b := bufio.NewReader(file)
+	scanner := bufio.NewScanner(file)
 	c.Servers = make([]string, 0)
 	c.Search = make([]string, 0)
 	c.Port = "53"
 	c.Ndots = 1
 	c.Timeout = 5
 	c.Attempts = 2
-	for line, ok := b.ReadString('\n'); ok == nil; line, ok = b.ReadString('\n') {
+
+	for scanner.Scan() {
+		if err := scanner.Err(); err != nil {
+			return nil, err
+		}
+		line := scanner.Text()
 		f := strings.Fields(line)
 		if len(f) < 1 {
 			continue

vendor/github.com/miekg/dns/defaults.go

@@ -24,7 +24,9 @@ func (dns *Msg) SetReply(request *Msg) *Msg {
 	return dns
 }
 
-// SetQuestion creates a question message.
+// SetQuestion creates a question message, it sets the Question
+// section, generates an Id and sets the RecursionDesired (RD)
+// bit to true.
 func (dns *Msg) SetQuestion(z string, t uint16) *Msg {
 	dns.Id = Id()
 	dns.RecursionDesired = true
@@ -33,7 +35,9 @@ func (dns *Msg) SetQuestion(z string, t uint16) *Msg {
 	return dns
 }
 
-// SetNotify creates a notify message.
+// SetNotify creates a notify message, it sets the Question
+// section, generates an Id and sets the Authoritative (AA)
+// bit to true.
 func (dns *Msg) SetNotify(z string) *Msg {
 	dns.Opcode = OpcodeNotify
 	dns.Authoritative = true
@@ -73,13 +77,15 @@ func (dns *Msg) SetUpdate(z string) *Msg {
 }
 
 // SetIxfr creates message for requesting an IXFR.
-func (dns *Msg) SetIxfr(z string, serial uint32) *Msg {
+func (dns *Msg) SetIxfr(z string, serial uint32, ns, mbox string) *Msg {
 	dns.Id = Id()
 	dns.Question = make([]Question, 1)
 	dns.Ns = make([]RR, 1)
 	s := new(SOA)
 	s.Hdr = RR_Header{z, TypeSOA, ClassINET, defaultTtl, 0}
 	s.Serial = serial
+	s.Ns = ns
+	s.Mbox = mbox
 	dns.Question[0] = Question{z, TypeIXFR, ClassINET}
 	dns.Ns[0] = s
 	return dns
@@ -144,11 +150,14 @@ func (dns *Msg) IsEdns0() *OPT {
 	return nil
 }
 
-// IsDomainName checks if s is a valid domainname, it returns
-// the number of labels and true, when a domain name is valid.
-// Note that non fully qualified domain name is considered valid, in this case the
-// last label is counted in the number of labels.
-// When false is returned the number of labels is not defined.
+// IsDomainName checks if s is a valid domain name, it returns the number of
+// labels and true, when a domain name is valid.  Note that non fully qualified
+// domain name is considered valid, in this case the last label is counted in
+// the number of labels.  When false is returned the number of labels is not
+// defined.  Also note that this function is extremely liberal; almost any
+// string is a valid domain name as the DNS is 8 bit protocol. It checks if each
+// label fits in 63 characters, but there is no length check for the entire
+// string s. I.e.  a domain name longer than 255 characters is considered valid.
 func IsDomainName(s string) (labels int, ok bool) {
 	_, labels, err := packDomainName(s, nil, 0, nil, false)
 	return labels, err == nil
@@ -182,7 +191,34 @@ func IsFqdn(s string) bool {
 	return s[l-1] == '.'
 }
 
-// Fqdns return the fully qualified domain name from s.
+// IsRRset checks if a set of RRs is a valid RRset as defined by RFC 2181.
+// This means the RRs need to have the same type, name, and class. Returns true
+// if the RR set is valid, otherwise false.
+func IsRRset(rrset []RR) bool {
+	if len(rrset) == 0 {
+		return false
+	}
+	if len(rrset) == 1 {
+		return true
+	}
+	rrHeader := rrset[0].Header()
+	rrType := rrHeader.Rrtype
+	rrClass := rrHeader.Class
+	rrName := rrHeader.Name
+
+	for _, rr := range rrset[1:] {
+		curRRHeader := rr.Header()
+		if curRRHeader.Rrtype != rrType || curRRHeader.Class != rrClass || curRRHeader.Name != rrName {
+			// Mismatch between the records, so this is not a valid rrset for
+			//signing/verifying
+			return false
+		}
+	}
+
+	return true
+}
+
+// Fqdn return the fully qualified domain name from s.
 // If s is already fully qualified, it behaves as the identity function.
 func Fqdn(s string) string {
 	if IsFqdn(s) {

vendor/github.com/miekg/dns/dns.go

-// Package dns implements a full featured interface to the Domain Name System.
-// Server- and client-side programming is supported.
-// The package allows complete control over what is send out to the DNS. The package
-// API follows the less-is-more principle, by presenting a small, clean interface.
-//
-// The package dns supports (asynchronous) querying/replying, incoming/outgoing zone transfers,
-// TSIG, EDNS0, dynamic updates, notifies and DNSSEC validation/signing.
-// Note that domain names MUST be fully qualified, before sending them, unqualified
-// names in a message will result in a packing failure.
-//
-// Resource records are native types. They are not stored in wire format.
-// Basic usage pattern for creating a new resource record:
-//
-//      r := new(dns.MX)
-//      r.Hdr = dns.RR_Header{Name: "miek.nl.", Rrtype: dns.TypeMX, Class: dns.ClassINET, Ttl: 3600}
-//      r.Preference = 10
-//      r.Mx = "mx.miek.nl."
-//
-// Or directly from a string:
-//
-//      mx, err := dns.NewRR("miek.nl. 3600 IN MX 10 mx.miek.nl.")
-//
-// Or when the default TTL (3600) and class (IN) suit you:
-//
-//      mx, err := dns.NewRR("miek.nl. MX 10 mx.miek.nl.")
-//
-// Or even:
-//
-//      mx, err := dns.NewRR("$ORIGIN nl.\nmiek 1H IN MX 10 mx.miek")
-//
-// In the DNS messages are exchanged, these messages contain resource
-// records (sets).  Use pattern for creating a message:
-//
-//      m := new(dns.Msg)
-//      m.SetQuestion("miek.nl.", dns.TypeMX)
-//
-// Or when not certain if the domain name is fully qualified:
-//
-//	m.SetQuestion(dns.Fqdn("miek.nl"), dns.TypeMX)
-//
-// The message m is now a message with the question section set to ask
-// the MX records for the miek.nl. zone.
-//
-// The following is slightly more verbose, but more flexible:
-//
-//      m1 := new(dns.Msg)
-//      m1.Id = dns.Id()
-//      m1.RecursionDesired = true
-//      m1.Question = make([]dns.Question, 1)
-//      m1.Question[0] = dns.Question{"miek.nl.", dns.TypeMX, dns.ClassINET}
-//
-// After creating a message it can be send.
-// Basic use pattern for synchronous querying the DNS at a
-// server configured on 127.0.0.1 and port 53:
-//
-//      c := new(dns.Client)
-//      in, rtt, err := c.Exchange(m1, "127.0.0.1:53")
-//
-// Suppressing
-// multiple outstanding queries (with the same question, type and class) is as easy as setting:
-//
-//	c.SingleInflight = true
-//
-// If these "advanced" features are not needed, a simple UDP query can be send,
-// with:
-//
-//	in, err := dns.Exchange(m1, "127.0.0.1:53")
-//
-// When this functions returns you will get dns message. A dns message consists
-// out of four sections.
-// The question section: in.Question, the answer section: in.Answer,
-// the authority section: in.Ns and the additional section: in.Extra.
-//
-// Each of these sections (except the Question section) contain a []RR. Basic
-// use pattern for accessing the rdata of a TXT RR as the first RR in
-// the Answer section:
-//
-//	if t, ok := in.Answer[0].(*dns.TXT); ok {
-//		// do something with t.Txt
-//	}
-//
-// Domain Name and TXT Character String Representations
-//
-// Both domain names and TXT character strings are converted to presentation
-// form both when unpacked and when converted to strings.
-//
-// For TXT character strings, tabs, carriage returns and line feeds will be
-// converted to \t, \r and \n respectively. Back slashes and quotations marks
-// will be escaped. Bytes below 32 and above 127 will be converted to \DDD
-// form.
-//
-// For domain names, in addition to the above rules brackets, periods,
-// spaces, semicolons and the at symbol are escaped.
 package dns
 
-import (
-	"strconv"
-)
+import "strconv"
 
 const (
 	year68 = 1 << 31 // For RFC1982 (Serial Arithmetic) calculations in 32 bits.
-	DefaultMsgSize = 4096    // Standard default for larger than 512 bytes.
-	MinMsgSize     = 512     // Minimal size of a DNS packet.
-	MaxMsgSize     = 65536   // Largest possible DNS packet.
-	defaultTtl     = 3600    // Default TTL.
+	// DefaultMsgSize is the standard default for messages larger than 512 bytes.
+	DefaultMsgSize = 4096
+	// MinMsgSize is the minimal size of a DNS packet.
+	MinMsgSize = 512
+	// MaxMsgSize is the largest possible DNS packet.
+	MaxMsgSize = 65535
+	defaultTtl = 3600 // Default internal TTL.
 )
 
 // Error represents a DNS error
@@ -124,13 +32,11 @@ type RR interface {
 	String() string
 	// copy returns a copy of the RR
 	copy() RR
-	// len returns the length (in octects) of the uncompressed RR in wire format.
+	// len returns the length (in octets) of the uncompressed RR in wire format.
 	len() int
 }
 
-// DNS resource records.
-// There are many types of RRs,
-// but they all share the same header.
+// RR_Header is the header all DNS resource records share.
 type RR_Header struct {
 	Name     string `dns:"cdomain-name"`
 	Rrtype   uint16
@@ -139,9 +45,10 @@ type RR_Header struct {
 	Rdlength uint16 // length of data after header
 }
 
+// Header returns itself. This is here to make RR_Header implement the RR interface.
 func (h *RR_Header) Header() *RR_Header { return h }
 
-// Just to imlement the RR interface
+// Just to imlement the RR interface.
 func (h *RR_Header) copy() RR { return nil }
 
 func (h *RR_Header) copyHeader() *RR_Header {

vendor/github.com/miekg/dns/keygen.go → vendor/github.com/miekg/dns/dnssec_keygen.go

 package dns
 
 import (
+	"crypto"
 	"crypto/dsa"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/rsa"
 	"math/big"
-	"strconv"
 )
 
-const _FORMAT = "Private-key-format: v1.3\n"
-
-// Empty interface that is used as a wrapper around all possible
-// private key implementations from the crypto package.
-type PrivateKey interface{}
-
 // Generate generates a DNSKEY of the given bit size.
 // The public part is put inside the DNSKEY record.
 // The Algorithm in the key must be set as this will define
 // what kind of DNSKEY will be generated.
 // The ECDSA algorithms imply a fixed keysize, in that case
 // bits should be set to the size of the algorithm.
-func (r *DNSKEY) Generate(bits int) (PrivateKey, error) {
-	switch r.Algorithm {
+func (k *DNSKEY) Generate(bits int) (crypto.PrivateKey, error) {
+	switch k.Algorithm {
 	case DSA, DSANSEC3SHA1:
 		if bits != 1024 {
 			return nil, ErrKeySize
@@ -46,7 +40,7 @@ func (r *DNSKEY) Generate(bits int) (PrivateKey, error) {
 		}
 	}
 
-	switch r.Algorithm {
+	switch k.Algorithm {
 	case DSA, DSANSEC3SHA1:
 		params := new(dsa.Parameters)
 		if err := dsa.GenerateParameters(params, rand.Reader, dsa.L1024N160); err != nil {
@@ -58,18 +52,18 @@ func (r *DNSKEY) Generate(bits int) (PrivateKey, error) {
 		if err != nil {
 			return nil, err
 		}
-		r.setPublicKeyDSA(params.Q, params.P, params.G, priv.PublicKey.Y)
+		k.setPublicKeyDSA(params.Q, params.P, params.G, priv.PublicKey.Y)
 		return priv, nil
 	case RSAMD5, RSASHA1, RSASHA256, RSASHA512, RSASHA1NSEC3SHA1:
 		priv, err := rsa.GenerateKey(rand.Reader, bits)
 		if err != nil {
 			return nil, err
 		}
-		r.setPublicKeyRSA(priv.PublicKey.E, priv.PublicKey.N)
+		k.setPublicKeyRSA(priv.PublicKey.E, priv.PublicKey.N)
 		return priv, nil
 	case ECDSAP256SHA256, ECDSAP384SHA384:
 		var c elliptic.Curve
-		switch r.Algorithm {
+		switch k.Algorithm {
 		case ECDSAP256SHA256:
 			c = elliptic.P256()
 		case ECDSAP384SHA384:
@@ -79,79 +73,84 @@ func (r *DNSKEY) Generate(bits int) (PrivateKey, error) {
 		if err != nil {
 			return nil, err
 		}
-		r.setPublicKeyCurve(priv.PublicKey.X, priv.PublicKey.Y)
+		k.setPublicKeyECDSA(priv.PublicKey.X, priv.PublicKey.Y)
 		return priv, nil
 	default:
 		return nil, ErrAlg
 	}
-	return nil, nil // Dummy return
 }
 
-// PrivateKeyString converts a PrivateKey to a string. This
-// string has the same format as the private-key-file of BIND9 (Private-key-format: v1.3).
-// It needs some info from the key (hashing, keytag), so its a method of the DNSKEY.
-func (r *DNSKEY) PrivateKeyString(p PrivateKey) (s string) {
-	switch t := p.(type) {
-	case *rsa.PrivateKey:
-		algorithm := strconv.Itoa(int(r.Algorithm)) + " (" + AlgorithmToString[r.Algorithm] + ")"
-		modulus := toBase64(t.PublicKey.N.Bytes())
-		e := big.NewInt(int64(t.PublicKey.E))
-		publicExponent := toBase64(e.Bytes())
-		privateExponent := toBase64(t.D.Bytes())
-		prime1 := toBase64(t.Primes[0].Bytes())
-		prime2 := toBase64(t.Primes[1].Bytes())
-		// Calculate Exponent1/2 and Coefficient as per: http://en.wikipedia.org/wiki/RSA#Using_the_Chinese_remainder_algorithm
-		// and from: http://code.google.com/p/go/issues/detail?id=987
-		one := big.NewInt(1)
-		minusone := big.NewInt(-1)
-		p_1 := big.NewInt(0).Sub(t.Primes[0], one)
-		q_1 := big.NewInt(0).Sub(t.Primes[1], one)
-		exp1 := big.NewInt(0).Mod(t.D, p_1)
-		exp2 := big.NewInt(0).Mod(t.D, q_1)
-		coeff := big.NewInt(0).Exp(t.Primes[1], minusone, t.Primes[0])
-
-		exponent1 := toBase64(exp1.Bytes())
-		exponent2 := toBase64(exp2.Bytes())
-		coefficient := toBase64(coeff.Bytes())
+// Set the public key (the value E and N)
+func (k *DNSKEY) setPublicKeyRSA(_E int, _N *big.Int) bool {
+	if _E == 0 || _N == nil {
+		return false
+	}
+	buf := exponentToBuf(_E)
+	buf = append(buf, _N.Bytes()...)
+	k.PublicKey = toBase64(buf)
+	return true
+}
 
-		s = _FORMAT +
-			"Algorithm: " + algorithm + "\n" +
-			"Modules: " + modulus + "\n" +
-			"PublicExponent: " + publicExponent + "\n" +
-			"PrivateExponent: " + privateExponent + "\n" +
-			"Prime1: " + prime1 + "\n" +
-			"Prime2: " + prime2 + "\n" +
-			"Exponent1: " + exponent1 + "\n" +
-			"Exponent2: " + exponent2 + "\n" +
-			"Coefficient: " + coefficient + "\n"
-	case *ecdsa.PrivateKey:
-		algorithm := strconv.Itoa(int(r.Algorithm)) + " (" + AlgorithmToString[r.Algorithm] + ")"
+// Set the public key for Elliptic Curves
+func (k *DNSKEY) setPublicKeyECDSA(_X, _Y *big.Int) bool {
+	if _X == nil || _Y == nil {
+		return false
+	}
 	var intlen int
-		switch r.Algorithm {
+	switch k.Algorithm {
 	case ECDSAP256SHA256:
 		intlen = 32
 	case ECDSAP384SHA384:
 		intlen = 48
 	}
-		private := toBase64(intToBytes(t.D, intlen))
-		s = _FORMAT +
-			"Algorithm: " + algorithm + "\n" +
-			"PrivateKey: " + private + "\n"
-	case *dsa.PrivateKey:
-		algorithm := strconv.Itoa(int(r.Algorithm)) + " (" + AlgorithmToString[r.Algorithm] + ")"
-		T := divRoundUp(divRoundUp(t.PublicKey.Parameters.G.BitLen(), 8)-64, 8)
-		prime := toBase64(intToBytes(t.PublicKey.Parameters.P, 64+T*8))
-		subprime := toBase64(intToBytes(t.PublicKey.Parameters.Q, 20))
-		base := toBase64(intToBytes(t.PublicKey.Parameters.G, 64+T*8))
-		priv := toBase64(intToBytes(t.X, 20))
-		pub := toBase64(intToBytes(t.PublicKey.Y, 64+T*8))
-		s = _FORMAT +
-			"Algorithm: " + algorithm + "\n" +
-			"Prime(p): " + prime + "\n" +
-			"Subprime(q): " + subprime + "\n" +
-			"Base(g): " + base + "\n" +
-			"Private_value(x): " + priv + "\n" +
-			"Public_value(y): " + pub + "\n"
-	}
-	return
+	k.PublicKey = toBase64(curveToBuf(_X, _Y, intlen))
+	return true
+}
+
+// Set the public key for DSA
+func (k *DNSKEY) setPublicKeyDSA(_Q, _P, _G, _Y *big.Int) bool {
+	if _Q == nil || _P == nil || _G == nil || _Y == nil {
+		return false
+	}
+	buf := dsaToBuf(_Q, _P, _G, _Y)
+	k.PublicKey = toBase64(buf)
+	return true
+}
+
+// Set the public key (the values E and N) for RSA
+// RFC 3110: Section 2. RSA Public KEY Resource Records
+func exponentToBuf(_E int) []byte {
+	var buf []byte
+	i := big.NewInt(int64(_E))
+	if len(i.Bytes()) < 256 {
+		buf = make([]byte, 1)
+		buf[0] = uint8(len(i.Bytes()))
+	} else {
+		buf = make([]byte, 3)
+		buf[0] = 0
+		buf[1] = uint8(len(i.Bytes()) >> 8)
+		buf[2] = uint8(len(i.Bytes()))
+	}
+	buf = append(buf, i.Bytes()...)
+	return buf
+}
+
+// Set the public key for X and Y for Curve. The two
+// values are just concatenated.
+func curveToBuf(_X, _Y *big.Int, intlen int) []byte {
+	buf := intToBytes(_X, intlen)
+	buf = append(buf, intToBytes(_Y, intlen)...)
+	return buf
+}
+
+// Set the public key for X and Y for Curve. The two
+// values are just concatenated.
+func dsaToBuf(_Q, _P, _G, _Y *big.Int) []byte {
+	t := divRoundUp(divRoundUp(_G.BitLen(), 8)-64, 8)
+	buf := []byte{byte(t)}
+	buf = append(buf, intToBytes(_Q, 20)...)
+	buf = append(buf, intToBytes(_P, 64+t*8)...)
+	buf = append(buf, intToBytes(_G, 64+t*8)...)
+	buf = append(buf, intToBytes(_Y, 64+t*8)...)
+	return buf
 }

vendor/github.com/miekg/dns/kscan.go → vendor/github.com/miekg/dns/dnssec_keyscan.go

 package dns
 
 import (
+	"crypto"
 	"crypto/dsa"
 	"crypto/ecdsa"
 	"crypto/rsa"
 	"io"
 	"math/big"
+	"strconv"
 	"strings"
 )
 
-func (k *DNSKEY) NewPrivateKey(s string) (PrivateKey, error) {
+// NewPrivateKey returns a PrivateKey by parsing the string s.
+// s should be in the same form of the BIND private key files.
+func (k *DNSKEY) NewPrivateKey(s string) (crypto.PrivateKey, error) {
 	if s[len(s)-1] != '\n' { // We need a closing newline
 		return k.ReadPrivateKey(strings.NewReader(s+"\n"), "")
 	}
@@ -18,9 +22,9 @@ func (k *DNSKEY) NewPrivateKey(s string) (PrivateKey, error) {
 
 // ReadPrivateKey reads a private key from the io.Reader q. The string file is
 // only used in error reporting.
-// The public key must be
-// known, because some cryptographic algorithms embed the public inside the privatekey.
-func (k *DNSKEY) ReadPrivateKey(q io.Reader, file string) (PrivateKey, error) {
+// The public key must be known, because some cryptographic algorithms embed
+// the public inside the privatekey.
+func (k *DNSKEY) ReadPrivateKey(q io.Reader, file string) (crypto.PrivateKey, error) {
 	m, e := parseKey(q, file)
 	if m == nil {
 		return nil, e
@@ -32,57 +36,63 @@ func (k *DNSKEY) ReadPrivateKey(q io.Reader, file string) (PrivateKey, error) {
 		return nil, ErrPrivKey
 	}
 	// TODO(mg): check if the pubkey matches the private key
-	switch m["algorithm"] {
-	case "3 (DSA)":
-		p, e := readPrivateKeyDSA(m)
+	algo, err := strconv.Atoi(strings.SplitN(m["algorithm"], " ", 2)[0])
+	if err != nil {
+		return nil, ErrPrivKey
+	}
+	switch uint8(algo) {
+	case DSA:
+		priv, e := readPrivateKeyDSA(m)
 		if e != nil {
 			return nil, e
 		}
-		if !k.setPublicKeyInPrivate(p) {
+		pub := k.publicKeyDSA()
+		if pub == nil {
 			return nil, ErrKey
 		}
-		return p, e
-	case "1 (RSAMD5)":
+		priv.PublicKey = *pub
+		return priv, e
+	case RSAMD5:
 		fallthrough
-	case "5 (RSASHA1)":
+	case RSASHA1:
 		fallthrough
-	case "7 (RSASHA1NSEC3SHA1)":
+	case RSASHA1NSEC3SHA1:
 		fallthrough
-	case "8 (RSASHA256)":
+	case RSASHA256:
 		fallthrough
-	case "10 (RSASHA512)":
-		p, e := readPrivateKeyRSA(m)
+	case RSASHA512:
+		priv, e := readPrivateKeyRSA(m)
 		if e != nil {
 			return nil, e
 		}
-		if !k.setPublicKeyInPrivate(p) {
+		pub := k.publicKeyRSA()
+		if pub == nil {
 			return nil, ErrKey
 		}
-		return p, e
-	case "12 (ECC-GOST)":
-		p, e := readPrivateKeyGOST(m)
-		if e != nil {
-			return nil, e
-		}
-		// setPublicKeyInPrivate(p)
-		return p, e
-	case "13 (ECDSAP256SHA256)":
+		priv.PublicKey = *pub
+		return priv, e
+	case ECCGOST:
+		return nil, ErrPrivKey
+	case ECDSAP256SHA256:
 		fallthrough
-	case "14 (ECDSAP384SHA384)":
-		p, e := readPrivateKeyECDSA(m)
+	case ECDSAP384SHA384:
+		priv, e := readPrivateKeyECDSA(m)
 		if e != nil {
 			return nil, e
 		}
-		if !k.setPublicKeyInPrivate(p) {
+		pub := k.publicKeyECDSA()
+		if pub == nil {
 			return nil, ErrKey
 		}
-		return p, e
-	}
+		priv.PublicKey = *pub
+		return priv, e
+	default:
 		return nil, ErrPrivKey
+	}
 }
 
 // Read a private key (file) string and create a public key. Return the private key.
-func readPrivateKeyRSA(m map[string]string) (PrivateKey, error) {
+func readPrivateKeyRSA(m map[string]string) (*rsa.PrivateKey, error) {
 	p := new(rsa.PrivateKey)
 	p.Primes = []*big.Int{nil, nil}
 	for k, v := range m {
@@ -119,7 +129,7 @@ func readPrivateKeyRSA(m map[string]string) (PrivateKey, error) {
 	return p, nil
 }
 
-func readPrivateKeyDSA(m map[string]string) (PrivateKey, error) {
+func readPrivateKeyDSA(m map[string]string) (*dsa.PrivateKey, error) {
 	p := new(dsa.PrivateKey)
 	p.X = big.NewInt(0)
 	for k, v := range m {
@@ -137,7 +147,7 @@ func readPrivateKeyDSA(m map[string]string) (PrivateKey, error) {
 	return p, nil
 }
 
-func readPrivateKeyECDSA(m map[string]string) (PrivateKey, error) {
+func readPrivateKeyECDSA(m map[string]string) (*ecdsa.PrivateKey, error) {
 	p := new(ecdsa.PrivateKey)
 	p.D = big.NewInt(0)
 	// TODO: validate that the required flags are present
@@ -156,11 +166,6 @@ func readPrivateKeyECDSA(m map[string]string) (PrivateKey, error) {
 	return p, nil
 }
 
-func readPrivateKeyGOST(m map[string]string) (PrivateKey, error) {
-	// TODO(miek)
-	return nil, nil
-}
-
 // parseKey reads a private key from r. It returns a map[string]string,
 // with the key-value pairs, or an error when the file is not correct.
 func parseKey(r io.Reader, file string) (map[string]string, error) {
@@ -173,9 +178,9 @@ func parseKey(r io.Reader, file string) (map[string]string, error) {
 	for l := range c {
 		// It should alternate
 		switch l.value {
-		case _KEY:
+		case zKey:
 			k = l.token
-		case _VALUE:
+		case zValue:
 			if k == "" {
 				return nil, &ParseError{file, "no private key seen", l}
 			}
@@ -205,14 +210,14 @@ func klexer(s *scan, c chan lex) {
 			}
 			l.token = str
 			if key {
-				l.value = _KEY
+				l.value = zKey
 				c <- l
 				// Next token is a space, eat it
 				s.tokenText()
 				key = false
 				str = ""
 			} else {
-				l.value = _VALUE
+				l.value = zValue
 			}
 		case ';':
 			commt = true
@@ -221,7 +226,7 @@ func klexer(s *scan, c chan lex) {
 				// Reset a comment
 				commt = false
 			}
-			l.value = _VALUE
+			l.value = zValue
 			l.token = str
 			c <- l
 			str = ""
@@ -238,7 +243,7 @@ func klexer(s *scan, c chan lex) {
 	if len(str) > 0 {
 		// Send remainder
 		l.token = str
-		l.value = _VALUE
+		l.value = zValue
 		c <- l
 	}
 }

vendor/github.com/miekg/dns/dnssec_privkey.go

+package dns
+
+import (
+	"crypto"
+	"crypto/dsa"
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"math/big"
+	"strconv"
+)
+
+const format = "Private-key-format: v1.3\n"
+
+// PrivateKeyString converts a PrivateKey to a string. This string has the same
+// format as the private-key-file of BIND9 (Private-key-format: v1.3).
+// It needs some info from the key (the algorithm), so its a method of the DNSKEY
+// It supports rsa.PrivateKey, ecdsa.PrivateKey and dsa.PrivateKey
+func (r *DNSKEY) PrivateKeyString(p crypto.PrivateKey) string {
+	algorithm := strconv.Itoa(int(r.Algorithm))
+	algorithm += " (" + AlgorithmToString[r.Algorithm] + ")"
+
+	switch p := p.(type) {
+	case *rsa.PrivateKey:
+		modulus := toBase64(p.PublicKey.N.Bytes())
+		e := big.NewInt(int64(p.PublicKey.E))
+		publicExponent := toBase64(e.Bytes())
+		privateExponent := toBase64(p.D.Bytes())
+		prime1 := toBase64(p.Primes[0].Bytes())
+		prime2 := toBase64(p.Primes[1].Bytes())
+		// Calculate Exponent1/2 and Coefficient as per: http://en.wikipedia.org/wiki/RSA#Using_the_Chinese_remainder_algorithm
+		// and from: http://code.google.com/p/go/issues/detail?id=987
+		one := big.NewInt(1)
+		p1 := big.NewInt(0).Sub(p.Primes[0], one)
+		q1 := big.NewInt(0).Sub(p.Primes[1], one)
+		exp1 := big.NewInt(0).Mod(p.D, p1)
+		exp2 := big.NewInt(0).Mod(p.D, q1)
+		coeff := big.NewInt(0).ModInverse(p.Primes[1], p.Primes[0])
+
+		exponent1 := toBase64(exp1.Bytes())
+		exponent2 := toBase64(exp2.Bytes())
+		coefficient := toBase64(coeff.Bytes())
+
+		return format +
+			"Algorithm: " + algorithm + "\n" +
+			"Modulus: " + modulus + "\n" +
+			"PublicExponent: " + publicExponent + "\n" +
+			"PrivateExponent: " + privateExponent + "\n" +
+			"Prime1: " + prime1 + "\n" +
+			"Prime2: " + prime2 + "\n" +
+			"Exponent1: " + exponent1 + "\n" +
+			"Exponent2: " + exponent2 + "\n" +
+			"Coefficient: " + coefficient + "\n"
+
+	case *ecdsa.PrivateKey:
+		var intlen int
+		switch r.Algorithm {
+		case ECDSAP256SHA256:
+			intlen = 32
+		case ECDSAP384SHA384:
+			intlen = 48
+		}
+		private := toBase64(intToBytes(p.D, intlen))
+		return format +
+			"Algorithm: " + algorithm + "\n" +
+			"PrivateKey: " + private + "\n"
+
+	case *dsa.PrivateKey:
+		T := divRoundUp(divRoundUp(p.PublicKey.Parameters.G.BitLen(), 8)-64, 8)
+		prime := toBase64(intToBytes(p.PublicKey.Parameters.P, 64+T*8))
+		subprime := toBase64(intToBytes(p.PublicKey.Parameters.Q, 20))
+		base := toBase64(intToBytes(p.PublicKey.Parameters.G, 64+T*8))
+		priv := toBase64(intToBytes(p.X, 20))
+		pub := toBase64(intToBytes(p.PublicKey.Y, 64+T*8))
+		return format +
+			"Algorithm: " + algorithm + "\n" +
+			"Prime(p): " + prime + "\n" +
+			"Subprime(q): " + subprime + "\n" +
+			"Base(g): " + base + "\n" +
+			"Private_value(x): " + priv + "\n" +
+			"Public_value(y): " + pub + "\n"
+
+	default:
+		return ""
+	}
+}

vendor/github.com/miekg/dns/doc.go

+/*
+Package dns implements a full featured interface to the Domain Name System.
+Server- and client-side programming is supported.
+The package allows complete control over what is send out to the DNS. The package
+API follows the less-is-more principle, by presenting a small, clean interface.
+
+The package dns supports (asynchronous) querying/replying, incoming/outgoing zone transfers,
+TSIG, EDNS0, dynamic updates, notifies and DNSSEC validation/signing.
+Note that domain names MUST be fully qualified, before sending them, unqualified
+names in a message will result in a packing failure.
+
+Resource records are native types. They are not stored in wire format.
+Basic usage pattern for creating a new resource record:
+
+     r := new(dns.MX)
+     r.Hdr = dns.RR_Header{Name: "miek.nl.", Rrtype: dns.TypeMX,
+	Class: dns.ClassINET, Ttl: 3600}
+     r.Preference = 10
+     r.Mx = "mx.miek.nl."
+
+Or directly from a string:
+
+     mx, err := dns.NewRR("miek.nl. 3600 IN MX 10 mx.miek.nl.")
+
+Or when the default TTL (3600) and class (IN) suit you:
+
+     mx, err := dns.NewRR("miek.nl. MX 10 mx.miek.nl.")
+
+Or even:
+
+     mx, err := dns.NewRR("$ORIGIN nl.\nmiek 1H IN MX 10 mx.miek")
+
+In the DNS messages are exchanged, these messages contain resource
+records (sets).  Use pattern for creating a message:
+
+     m := new(dns.Msg)
+     m.SetQuestion("miek.nl.", dns.TypeMX)
+
+Or when not certain if the domain name is fully qualified:
+
+	m.SetQuestion(dns.Fqdn("miek.nl"), dns.TypeMX)
+
+The message m is now a message with the question section set to ask
+the MX records for the miek.nl. zone.
+
+The following is slightly more verbose, but more flexible:
+
+     m1 := new(dns.Msg)
+     m1.Id = dns.Id()
+     m1.RecursionDesired = true
+     m1.Question = make([]dns.Question, 1)
+     m1.Question[0] = dns.Question{"miek.nl.", dns.TypeMX, dns.ClassINET}
+
+After creating a message it can be send.
+Basic use pattern for synchronous querying the DNS at a
+server configured on 127.0.0.1 and port 53:
+
+     c := new(dns.Client)
+     in, rtt, err := c.Exchange(m1, "127.0.0.1:53")
+
+Suppressing multiple outstanding queries (with the same question, type and
+class) is as easy as setting:
+
+	c.SingleInflight = true
+
+If these "advanced" features are not needed, a simple UDP query can be send,
+with:
+
+	in, err := dns.Exchange(m1, "127.0.0.1:53")
+
+When this functions returns you will get dns message. A dns message consists
+out of four sections.
+The question section: in.Question, the answer section: in.Answer,
+the authority section: in.Ns and the additional section: in.Extra.
+
+Each of these sections (except the Question section) contain a []RR. Basic
+use pattern for accessing the rdata of a TXT RR as the first RR in
+the Answer section:
+
+	if t, ok := in.Answer[0].(*dns.TXT); ok {
+		// do something with t.Txt
+	}
+
+Domain Name and TXT Character String Representations
+
+Both domain names and TXT character strings are converted to presentation
+form both when unpacked and when converted to strings.
+
+For TXT character strings, tabs, carriage returns and line feeds will be
+converted to \t, \r and \n respectively. Back slashes and quotations marks
+will be escaped. Bytes below 32 and above 127 will be converted to \DDD
+form.
+
+For domain names, in addition to the above rules brackets, periods,
+spaces, semicolons and the at symbol are escaped.
+
+DNSSEC
+
+DNSSEC (DNS Security Extension) adds a layer of security to the DNS. It
+uses public key cryptography to sign resource records. The
+public keys are stored in DNSKEY records and the signatures in RRSIG records.
+
+Requesting DNSSEC information for a zone is done by adding the DO (DNSSEC OK) bit
+to a request.
+
+     m := new(dns.Msg)
+     m.SetEdns0(4096, true)
+
+Signature generation, signature verification and key generation are all supported.
+
+DYNAMIC UPDATES
+
+Dynamic updates reuses the DNS message format, but renames three of
+the sections. Question is Zone, Answer is Prerequisite, Authority is
+Update, only the Additional is not renamed. See RFC 2136 for the gory details.
+
+You can set a rather complex set of rules for the existence of absence of
+certain resource records or names in a zone to specify if resource records
+should be added or removed. The table from RFC 2136 supplemented with the Go
+DNS function shows which functions exist to specify the prerequisites.
+
+ 3.2.4 - Table Of Metavalues Used In Prerequisite Section
+
+  CLASS    TYPE     RDATA    Meaning                    Function
+  --------------------------------------------------------------
+  ANY      ANY      empty    Name is in use             dns.NameUsed
+  ANY      rrset    empty    RRset exists (value indep) dns.RRsetUsed
+  NONE     ANY      empty    Name is not in use         dns.NameNotUsed
+  NONE     rrset    empty    RRset does not exist       dns.RRsetNotUsed
+  zone     rrset    rr       RRset exists (value dep)   dns.Used
+
+The prerequisite section can also be left empty.
+If you have decided on the prerequisites you can tell what RRs should
+be added or deleted. The next table shows the options you have and
+what functions to call.
+
+ 3.4.2.6 - Table Of Metavalues Used In Update Section
+
+  CLASS    TYPE     RDATA    Meaning                     Function
+  ---------------------------------------------------------------
+  ANY      ANY      empty    Delete all RRsets from name dns.RemoveName
+  ANY      rrset    empty    Delete an RRset             dns.RemoveRRset
+  NONE     rrset    rr       Delete an RR from RRset     dns.Remove
+  zone     rrset    rr       Add to an RRset             dns.Insert
+
+TRANSACTION SIGNATURE
+
+An TSIG or transaction signature adds a HMAC TSIG record to each message sent.
+The supported algorithms include: HmacMD5, HmacSHA1, HmacSHA256 and HmacSHA512.
+
+Basic use pattern when querying with a TSIG name "axfr." (note that these key names
+must be fully qualified - as they are domain names) and the base64 secret
+"so6ZGir4GPAqINNh9U5c3A==":
+
+	c := new(dns.Client)
+	c.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
+	m := new(dns.Msg)
+	m.SetQuestion("miek.nl.", dns.TypeMX)
+	m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
+	...
+	// When sending the TSIG RR is calculated and filled in before sending
+
+When requesting an zone transfer (almost all TSIG usage is when requesting zone transfers), with
+TSIG, this is the basic use pattern. In this example we request an AXFR for
+miek.nl. with TSIG key named "axfr." and secret "so6ZGir4GPAqINNh9U5c3A=="
+and using the server 176.58.119.54:
+
+	t := new(dns.Transfer)
+	m := new(dns.Msg)
+	t.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
+	m.SetAxfr("miek.nl.")
+	m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
+	c, err := t.In(m, "176.58.119.54:53")
+	for r := range c { ... }
+
+You can now read the records from the transfer as they come in. Each envelope is checked with TSIG.
+If something is not correct an error is returned.
+
+Basic use pattern validating and replying to a message that has TSIG set.
+
+	server := &dns.Server{Addr: ":53", Net: "udp"}
+	server.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
+	go server.ListenAndServe()
+	dns.HandleFunc(".", handleRequest)
+
+	func handleRequest(w dns.ResponseWriter, r *dns.Msg) {
+		m := new(dns.Msg)
+		m.SetReply(r)
+		if r.IsTsig() != nil {
+			if w.TsigStatus() == nil {
+				// *Msg r has an TSIG record and it was validated
+				m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
+			} else {
+				// *Msg r has an TSIG records and it was not valided
+			}
+		}
+		w.WriteMsg(m)
+	}
+
+PRIVATE RRS
+
+RFC 6895 sets aside a range of type codes for private use. This range
+is 65,280 - 65,534 (0xFF00 - 0xFFFE). When experimenting with new Resource Records these
+can be used, before requesting an official type code from IANA.
+
+see http://miek.nl/posts/2014/Sep/21/Private%20RRs%20and%20IDN%20in%20Go%20DNS/ for more
+information.
+
+EDNS0
+
+EDNS0 is an extension mechanism for the DNS defined in RFC 2671 and updated
+by RFC 6891. It defines an new RR type, the OPT RR, which is then completely
+abused.
+Basic use pattern for creating an (empty) OPT RR:
+
+	o := new(dns.OPT)
+	o.Hdr.Name = "." // MUST be the root zone, per definition.
+	o.Hdr.Rrtype = dns.TypeOPT
+
+The rdata of an OPT RR consists out of a slice of EDNS0 (RFC 6891)
+interfaces. Currently only a few have been standardized: EDNS0_NSID
+(RFC 5001) and EDNS0_SUBNET (draft-vandergaast-edns-client-subnet-02). Note
+that these options may be combined in an OPT RR.
+Basic use pattern for a server to check if (and which) options are set:
+
+	// o is a dns.OPT
+	for _, s := range o.Option {
+		switch e := s.(type) {
+		case *dns.EDNS0_NSID:
+			// do stuff with e.Nsid
+		case *dns.EDNS0_SUBNET:
+			// access e.Family, e.Address, etc.
+		}
+	}
+
+SIG(0)
+
+From RFC 2931:
+
+    SIG(0) provides protection for DNS transactions and requests ....
+    ... protection for glue records, DNS requests, protection for message headers
+    on requests and responses, and protection of the overall integrity of a response.
+
+It works like TSIG, except that SIG(0) uses public key cryptography, instead of the shared
+secret approach in TSIG.
+Supported algorithms: DSA, ECDSAP256SHA256, ECDSAP384SHA384, RSASHA1, RSASHA256 and
+RSASHA512.
+
+Signing subsequent messages in multi-message sessions is not implemented.
+*/
+package dns

vendor/github.com/miekg/dns/edns.go

-// EDNS0
-//
-// EDNS0 is an extension mechanism for the DNS defined in RFC 2671 and updated
-// by RFC 6891. It defines an new RR type, the OPT RR, which is then completely
-// abused.
-// Basic use pattern for creating an (empty) OPT RR:
-//
-//	o := new(dns.OPT)
-//	o.Hdr.Name = "." // MUST be the root zone, per definition.
-//	o.Hdr.Rrtype = dns.TypeOPT
-//
-// The rdata of an OPT RR consists out of a slice of EDNS0 (RFC 6891)
-// interfaces. Currently only a few have been standardized: EDNS0_NSID
-// (RFC 5001) and EDNS0_SUBNET (draft-vandergaast-edns-client-subnet-02). Note
-// that these options may be combined in an OPT RR.
-// Basic use pattern for a server to check if (and which) options are set:
-//
-//	// o is a dns.OPT
-//	for _, s := range o.Option {
-//		switch e := s.(type) {
-//		case *dns.EDNS0_NSID:
-//			// do stuff with e.Nsid
-//		case *dns.EDNS0_SUBNET:
-//			// access e.Family, e.Address, etc.
-//		}
-//	}
 package dns
 
 import (
@@ -44,18 +18,18 @@ const (
 	EDNS0SUBNET      = 0x8     // client-subnet (RFC6891)
 	EDNS0EXPIRE      = 0x9     // EDNS0 expire
 	EDNS0SUBNETDRAFT = 0x50fa  // Don't use! Use EDNS0SUBNET
+	EDNS0LOCALSTART  = 0xFDE9  // Beginning of range reserved for local/experimental use (RFC6891)
+	EDNS0LOCALEND    = 0xFFFE  // End of range reserved for local/experimental use (RFC6891)
 	_DO              = 1 << 15 // dnssec ok
 )
 
+// OPT is the EDNS0 RR appended to messages to convey extra (meta) information.
+// See RFC 6891.
 type OPT struct {
 	Hdr    RR_Header
 	Option []EDNS0 `dns:"opt"`
 }
 
-func (rr *OPT) Header() *RR_Header {
-	return &rr.Hdr
-}
-
 func (rr *OPT) String() string {
 	s := "\n;; OPT PSEUDOSECTION:\n; EDNS: version " + strconv.Itoa(int(rr.Version())) + "; "
 	if rr.Do() {
@@ -92,6 +66,8 @@ func (rr *OPT) String() string {
 			s += "\n; DS HASH UNDERSTOOD: " + o.String()
 		case *EDNS0_N3U:
 			s += "\n; NSEC3 HASH UNDERSTOOD: " + o.String()
+		case *EDNS0_LOCAL:
+			s += "\n; LOCAL OPT: " + o.String()
 		}
 	}
 	return s
@@ -100,16 +76,13 @@ func (rr *OPT) String() string {
 func (rr *OPT) len() int {
 	l := rr.Hdr.len()
 	for i := 0; i < len(rr.Option); i++ {
+		l += 4 // Account for 2-byte option code and 2-byte option length.
 		lo, _ := rr.Option[i].pack()
-		l += 2 + len(lo)
+		l += len(lo)
 	}
 	return l
 }
 
-func (rr *OPT) copy() RR {
-	return &OPT{*rr.Hdr.copyHeader(), rr.Option}
-}
-
 // return the old value -> delete SetVersion?
 
 // Version returns the EDNS version used. Only zero is defined.
@@ -195,7 +168,7 @@ func (e *EDNS0_NSID) Option() uint16        { return EDNS0NSID }
 func (e *EDNS0_NSID) unpack(b []byte) error { e.Nsid = hex.EncodeToString(b); return nil }
 func (e *EDNS0_NSID) String() string        { return string(e.Nsid) }
 
-// The subnet EDNS0 option is used to give the remote nameserver
+// EDNS0_SUBNET is the subnet option that is used to give the remote nameserver
 // an idea of where the client lives. It can then give back a different
 // answer depending on the location or network topology.
 // Basic use pattern for creating an subnet option:
@@ -211,6 +184,11 @@ func (e *EDNS0_NSID) String() string        { return string(e.Nsid) }
 //	e.Address = net.ParseIP("127.0.0.1").To4()	// for IPv4
 //	// e.Address = net.ParseIP("2001:7b8:32a::2")	// for IPV6
 //	o.Option = append(o.Option, e)
+//
+// Note: the spec (draft-ietf-dnsop-edns-client-subnet-00) has some insane logic
+// for which netmask applies to the address. This code will parse all the
+// available bits when unpacking (up to optlen). When packing it will apply
+// SourceNetmask. If you need more advanced logic, patches welcome and good luck.
 type EDNS0_SUBNET struct {
 	Code          uint16 // Always EDNS0SUBNET
 	Family        uint16 // 1 for IP, 2 for IP6
@@ -237,38 +215,22 @@ func (e *EDNS0_SUBNET) pack() ([]byte, error) {
 		if e.SourceNetmask > net.IPv4len*8 {
 			return nil, errors.New("dns: bad netmask")
 		}
-		ip := make([]byte, net.IPv4len)
-		a := e.Address.To4().Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv4len*8))
-		for i := 0; i < net.IPv4len; i++ {
-			if i+1 > len(e.Address) {
-				break
-			}
-			ip[i] = a[i]
-		}
-		needLength := e.SourceNetmask / 8
-		if e.SourceNetmask%8 > 0 {
-			needLength++
+		if len(e.Address.To4()) != net.IPv4len {
+			return nil, errors.New("dns: bad address")
 		}
-		ip = ip[:needLength]
-		b = append(b, ip...)
+		ip := e.Address.To4().Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv4len*8))
+		needLength := (e.SourceNetmask + 8 - 1) / 8 // division rounding up
+		b = append(b, ip[:needLength]...)
 	case 2:
 		if e.SourceNetmask > net.IPv6len*8 {
 			return nil, errors.New("dns: bad netmask")
 		}
-		ip := make([]byte, net.IPv6len)
-		a := e.Address.Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv6len*8))
-		for i := 0; i < net.IPv6len; i++ {
-			if i+1 > len(e.Address) {
-				break
-			}
-			ip[i] = a[i]
-		}
-		needLength := e.SourceNetmask / 8
-		if e.SourceNetmask%8 > 0 {
-			needLength++
+		if len(e.Address) != net.IPv6len {
+			return nil, errors.New("dns: bad address")
 		}
-		ip = ip[:needLength]
-		b = append(b, ip...)
+		ip := e.Address.Mask(net.CIDRMask(int(e.SourceNetmask), net.IPv6len*8))
+		needLength := (e.SourceNetmask + 8 - 1) / 8 // division rounding up
+		b = append(b, ip[:needLength]...)
 	default:
 		return nil, errors.New("dns: bad address family")
 	}
@@ -276,8 +238,7 @@ func (e *EDNS0_SUBNET) pack() ([]byte, error) {
 }
 
 func (e *EDNS0_SUBNET) unpack(b []byte) error {
-	lb := len(b)
-	if lb < 4 {
+	if len(b) < 4 {
 		return ErrBuf
 	}
 	e.Family, _ = unpackUint16(b, 0)
@@ -285,25 +246,27 @@ func (e *EDNS0_SUBNET) unpack(b []byte) error {
 	e.SourceScope = b[3]
 	switch e.Family {
 	case 1:
-		addr := make([]byte, 4)
-		for i := 0; i < int(e.SourceNetmask/8); i++ {
-			if i >= len(addr) || 4+i >= len(b) {
-				return ErrBuf
+		if e.SourceNetmask > net.IPv4len*8 || e.SourceScope > net.IPv4len*8 {
+			return errors.New("dns: bad netmask")
 		}
+		addr := make([]byte, net.IPv4len)
+		for i := 0; i < net.IPv4len && 4+i < len(b); i++ {
 			addr[i] = b[4+i]
 		}
 		e.Address = net.IPv4(addr[0], addr[1], addr[2], addr[3])
 	case 2:
-		addr := make([]byte, 16)
-		for i := 0; i < int(e.SourceNetmask/8); i++ {
-			if i >= len(addr) || 4+i >= len(b) {
-				return ErrBuf
+		if e.SourceNetmask > net.IPv6len*8 || e.SourceScope > net.IPv6len*8 {
+			return errors.New("dns: bad netmask")
 		}
+		addr := make([]byte, net.IPv6len)
+		for i := 0; i < net.IPv6len && 4+i < len(b); i++ {
 			addr[i] = b[4+i]
 		}
 		e.Address = net.IP{addr[0], addr[1], addr[2], addr[3], addr[4],
 			addr[5], addr[6], addr[7], addr[8], addr[9], addr[10],
 			addr[11], addr[12], addr[13], addr[14], addr[15]}
+	default:
+		return errors.New("dns: bad address family")
 	}
 	return nil
 }
@@ -320,7 +283,7 @@ func (e *EDNS0_SUBNET) String() (s string) {
 	return
 }
 
-// The UL (Update Lease) EDNS0 (draft RFC) option is used to tell the server to set
+// The EDNS0_UL (Update Lease) (draft RFC) option is used to tell the server to set
 // an expiration on an update RR. This is helpful for clients that cannot clean
 // up after themselves. This is a draft RFC and more information can be found at
 // http://files.dns-sd.org/draft-sekar-dns-ul.txt
@@ -358,7 +321,7 @@ func (e *EDNS0_UL) unpack(b []byte) error {
 	return nil
 }
 
-// Long Lived Queries: http://tools.ietf.org/html/draft-sekar-dns-llq-01
+// EDNS0_LLQ stands for Long Lived Queries: http://tools.ietf.org/html/draft-sekar-dns-llq-01
 // Implemented for completeness, as the EDNS0 type code is assigned.
 type EDNS0_LLQ struct {
 	Code      uint16 // Always EDNS0LLQ
@@ -499,3 +462,44 @@ func (e *EDNS0_EXPIRE) unpack(b []byte) error {
 	e.Expire = uint32(b[0])<<24 | uint32(b[1])<<16 | uint32(b[2])<<8 | uint32(b[3])
 	return nil
 }
+
+// The EDNS0_LOCAL option is used for local/experimental purposes. The option
+// code is recommended to be within the range [EDNS0LOCALSTART, EDNS0LOCALEND]
+// (RFC6891), although any unassigned code can actually be used.  The content of
+// the option is made available in Data, unaltered.
+// Basic use pattern for creating a local option:
+//
+//	o := new(dns.OPT)
+//	o.Hdr.Name = "."
+//	o.Hdr.Rrtype = dns.TypeOPT
+//	e := new(dns.EDNS0_LOCAL)
+//	e.Code = dns.EDNS0LOCALSTART
+//	e.Data = []byte{72, 82, 74}
+//	o.Option = append(o.Option, e)
+type EDNS0_LOCAL struct {
+	Code uint16
+	Data []byte
+}
+
+func (e *EDNS0_LOCAL) Option() uint16 { return e.Code }
+func (e *EDNS0_LOCAL) String() string {
+	return strconv.FormatInt(int64(e.Code), 10) + ":0x" + hex.EncodeToString(e.Data)
+}
+
+func (e *EDNS0_LOCAL) pack() ([]byte, error) {
+	b := make([]byte, len(e.Data))
+	copied := copy(b, e.Data)
+	if copied != len(e.Data) {
+		return nil, ErrBuf
+	}
+	return b, nil
+}
+
+func (e *EDNS0_LOCAL) unpack(b []byte) error {
+	e.Data = make([]byte, len(b))
+	copied := copy(e.Data, b)
+	if copied != len(b) {
+		return ErrBuf
+	}
+	return nil
+}

vendor/github.com/miekg/dns/format.go

+package dns
+
+import (
+	"net"
+	"reflect"
+	"strconv"
+)
+
+// NumField returns the number of rdata fields r has.
+func NumField(r RR) int {
+	return reflect.ValueOf(r).Elem().NumField() - 1 // Remove RR_Header
+}
+
+// Field returns the rdata field i as a string. Fields are indexed starting from 1.
+// RR types that holds slice data, for instance the NSEC type bitmap will return a single
+// string where the types are concatenated using a space.
+// Accessing non existing fields will cause a panic.
+func Field(r RR, i int) string {
+	if i == 0 {
+		return ""
+	}
+	d := reflect.ValueOf(r).Elem().Field(i)
+	switch k := d.Kind(); k {
+	case reflect.String:
+		return d.String()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return strconv.FormatInt(d.Int(), 10)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return strconv.FormatUint(d.Uint(), 10)
+	case reflect.Slice:
+		switch reflect.ValueOf(r).Elem().Type().Field(i).Tag {
+		case `dns:"a"`:
+			// TODO(miek): Hmm store this as 16 bytes
+			if d.Len() < net.IPv6len {
+				return net.IPv4(byte(d.Index(0).Uint()),
+					byte(d.Index(1).Uint()),
+					byte(d.Index(2).Uint()),
+					byte(d.Index(3).Uint())).String()
+			}
+			return net.IPv4(byte(d.Index(12).Uint()),
+				byte(d.Index(13).Uint()),
+				byte(d.Index(14).Uint()),
+				byte(d.Index(15).Uint())).String()
+		case `dns:"aaaa"`:
+			return net.IP{
+				byte(d.Index(0).Uint()),
+				byte(d.Index(1).Uint()),
+				byte(d.Index(2).Uint()),
+				byte(d.Index(3).Uint()),
+				byte(d.Index(4).Uint()),
+				byte(d.Index(5).Uint()),
+				byte(d.Index(6).Uint()),
+				byte(d.Index(7).Uint()),
+				byte(d.Index(8).Uint()),
+				byte(d.Index(9).Uint()),
+				byte(d.Index(10).Uint()),
+				byte(d.Index(11).Uint()),
+				byte(d.Index(12).Uint()),
+				byte(d.Index(13).Uint()),
+				byte(d.Index(14).Uint()),
+				byte(d.Index(15).Uint()),
+			}.String()
+		case `dns:"nsec"`:
+			if d.Len() == 0 {
+				return ""
+			}
+			s := Type(d.Index(0).Uint()).String()
+			for i := 1; i < d.Len(); i++ {
+				s += " " + Type(d.Index(i).Uint()).String()
+			}
+			return s
+		case `dns:"wks"`:
+			if d.Len() == 0 {
+				return ""
+			}
+			s := strconv.Itoa(int(d.Index(0).Uint()))
+			for i := 0; i < d.Len(); i++ {
+				s += " " + strconv.Itoa(int(d.Index(i).Uint()))
+			}
+			return s
+		default:
+			// if it does not have a tag its a string slice
+			fallthrough
+		case `dns:"txt"`:
+			if d.Len() == 0 {
+				return ""
+			}
+			s := d.Index(0).String()
+			for i := 1; i < d.Len(); i++ {
+				s += " " + d.Index(i).String()
+			}
+			return s
+		}
+	}
+	return ""
+}

vendor/github.com/miekg/dns/labels.go

@@ -4,9 +4,11 @@ package dns
 
 // SplitDomainName splits a name string into it's labels.
 // www.miek.nl. returns []string{"www", "miek", "nl"}
+// .www.miek.nl. returns []string{"", "www", "miek", "nl"},
 // The root label (.) returns nil. Note that using
 // strings.Split(s) will work in most cases, but does not handle
 // escaped dots (\.) for instance.
+// s must be a syntactically valid domain name, see IsDomainName.
 func SplitDomainName(s string) (labels []string) {
 	if len(s) == 0 {
 		return nil
@@ -45,6 +47,8 @@ func SplitDomainName(s string) (labels []string) {
 //
 // www.miek.nl. and miek.nl. have two labels in common: miek and nl
 // www.miek.nl. and www.bla.nl. have one label in common: nl
+//
+// s1 and s2 must be syntactically valid domain names.
 func CompareDomainName(s1, s2 string) (n int) {
 	s1 = Fqdn(s1)
 	s2 = Fqdn(s2)
@@ -85,6 +89,7 @@ func CompareDomainName(s1, s2 string) (n int) {
 }
 
 // CountLabel counts the the number of labels in the string s.
+// s must be a syntactically valid domain name.
 func CountLabel(s string) (labels int) {
 	if s == "." {
 		return
@@ -98,12 +103,12 @@ func CountLabel(s string) (labels int) {
 			return
 		}
 	}
-	panic("dns: not reached")
 }
 
 // Split splits a name s into its label indexes.
 // www.miek.nl. returns []int{0, 4, 9}, www.miek.nl also returns []int{0, 4, 9}.
-// The root name (.) returns nil. Also see dns.SplitDomainName.
+// The root name (.) returns nil. Also see SplitDomainName. 
+// s must be a syntactically valid domain name.
 func Split(s string) []int {
 	if s == "." {
 		return nil
@@ -119,12 +124,12 @@ func Split(s string) []int {
 		}
 		idx = append(idx, off)
 	}
-	panic("dns: not reached")
 }
 
 // NextLabel returns the index of the start of the next label in the
 // string s starting at offset.
 // The bool end is true when the end of the string has been reached.
+// Also see PrevLabel.
 func NextLabel(s string, offset int) (i int, end bool) {
 	quote := false
 	for i = offset; i < len(s)-1; i++ {
@@ -147,6 +152,7 @@ func NextLabel(s string, offset int) (i int, end bool) {
 // PrevLabel returns the index of the label when starting from the right and
 // jumping n labels to the left.
 // The bool start is true when the start of the string has been overshot.
+// Also see NextLabel.
 func PrevLabel(s string, n int) (i int, start bool) {
 	if n == 0 {
 		return len(s), false

vendor/github.com/miekg/dns/nsecx.go

@@ -50,6 +50,8 @@ func HashName(label string, ha uint8, iter uint16, salt string) string {
 	return toBase32(nsec3)
 }
 
+// Denialer is an interface that should be implemented by types that are used to denial
+// answers in DNSSEC.
 type Denialer interface {
 	// Cover will check if the (unhashed) name is being covered by this NSEC or NSEC3.
 	Cover(name string) bool

vendor/github.com/miekg/dns/privaterr.go

-/*
-PRIVATE RR
-
-RFC 6895 sets aside a range of type codes for private use. This range
-is 65,280 - 65,534 (0xFF00 - 0xFFFE). When experimenting with new Resource Records these
-can be used, before requesting an official type code from IANA.
-*/
 package dns
 
 import (
@@ -40,7 +33,7 @@ type PrivateRR struct {
 
 func mkPrivateRR(rrtype uint16) *PrivateRR {
 	// Panics if RR is not an instance of PrivateRR.
-	rrfunc, ok := typeToRR[rrtype]
+	rrfunc, ok := TypeToRR[rrtype]
 	if !ok {
 		panic(fmt.Sprintf("dns: invalid operation with Private RR type %d", rrtype))
 	}
@@ -50,10 +43,12 @@ func mkPrivateRR(rrtype uint16) *PrivateRR {
 	case *PrivateRR:
 		return rr
 	}
-	panic(fmt.Sprintf("dns: RR is not a PrivateRR, typeToRR[%d] generator returned %T", rrtype, anyrr))
+	panic(fmt.Sprintf("dns: RR is not a PrivateRR, TypeToRR[%d] generator returned %T", rrtype, anyrr))
 }
 
+// Header return the RR header of r.
 func (r *PrivateRR) Header() *RR_Header { return &r.Hdr }
+
 func (r *PrivateRR) String() string { return r.Hdr.String() + r.Data.String() }
 
 // Private len and copy parts to satisfy RR interface.
@@ -76,7 +71,7 @@ func (r *PrivateRR) copy() RR {
 func PrivateHandle(rtypestr string, rtype uint16, generator func() PrivateRdata) {
 	rtypestr = strings.ToUpper(rtypestr)
 
-	typeToRR[rtype] = func() RR { return &PrivateRR{RR_Header{}, generator()} }
+	TypeToRR[rtype] = func() RR { return &PrivateRR{RR_Header{}, generator()} }
 	TypeToString[rtype] = rtypestr
 	StringToType[rtypestr] = rtype
 
@@ -91,9 +86,9 @@ func PrivateHandle(rtypestr string, rtype uint16, generator func() PrivateRdata)
 			// TODO(miek): we could also be returning _QUOTE, this might or might not
 			// be an issue (basically parsing TXT becomes hard)
 			switch l = <-c; l.value {
-			case _NEWLINE, _EOF:
+			case zNewline, zEOF:
 				break FETCH
-			case _STRING:
+			case zString:
 				text = append(text, l.token)
 			}
 		}
@@ -113,7 +108,7 @@ func PrivateHandle(rtypestr string, rtype uint16, generator func() PrivateRdata)
 func PrivateHandleRemove(rtype uint16) {
 	rtypestr, ok := TypeToString[rtype]
 	if ok {
-		delete(typeToRR, rtype)
+		delete(TypeToRR, rtype)
 		delete(TypeToString, rtype)
 		delete(typeToparserFunc, rtype)
 		delete(StringToType, rtypestr)

vendor/github.com/miekg/dns/rawmsg.go

@@ -21,7 +21,7 @@ func rawSetQuestionLen(msg []byte, i uint16) bool {
 	return true
 }
 
-// rawSetAnswerLen sets the lenght of the answer section.
+// rawSetAnswerLen sets the length of the answer section.
 func rawSetAnswerLen(msg []byte, i uint16) bool {
 	if len(msg) < 8 {
 		return false
@@ -30,7 +30,7 @@ func rawSetAnswerLen(msg []byte, i uint16) bool {
 	return true
 }
 
-// rawSetsNsLen sets the lenght of the authority section.
+// rawSetsNsLen sets the length of the authority section.
 func rawSetNsLen(msg []byte, i uint16) bool {
 	if len(msg) < 10 {
 		return false
@@ -39,7 +39,7 @@ func rawSetNsLen(msg []byte, i uint16) bool {
 	return true
 }
 
-// rawSetExtraLen sets the lenght of the additional section.
+// rawSetExtraLen sets the length of the additional section.
 func rawSetExtraLen(msg []byte, i uint16) bool {
 	if len(msg) < 12 {
 		return false

vendor/github.com/miekg/dns/sanitize.go

+package dns
+
+// Dedup removes identical RRs from rrs. It preserves the original ordering.
+// The lowest TTL of any duplicates is used in the remaining one. Dedup modifies
+// rrs.
+// m is used to store the RRs temporay. If it is nil a new map will be allocated.
+func Dedup(rrs []RR, m map[string]RR) []RR {
+	if m == nil {
+		m = make(map[string]RR)
+	}
+	// Save the keys, so we don't have to call normalizedString twice.
+	keys := make([]*string, 0, len(rrs))
+
+	for _, r := range rrs {
+		key := normalizedString(r)
+		keys = append(keys, &key)
+		if _, ok := m[key]; ok {
+			// Shortest TTL wins.
+			if m[key].Header().Ttl > r.Header().Ttl {
+				m[key].Header().Ttl = r.Header().Ttl
+			}
+			continue
+		}
+
+		m[key] = r
+	}
+	// If the length of the result map equals the amount of RRs we got,
+	// it means they were all different. We can then just return the original rrset.
+	if len(m) == len(rrs) {
+		return rrs
+	}
+
+	j := 0
+	for i, r := range rrs {
+		// If keys[i] lives in the map, we should copy and remove it.
+		if _, ok := m[*keys[i]]; ok {
+			delete(m, *keys[i])
+			rrs[j] = r
+			j++
+		}
+
+		if len(m) == 0 {
+			break
+		}
+	}
+
+	return rrs[:j]
+}
+
+// normalizedString returns a normalized string from r. The TTL
+// is removed and the domain name is lowercased. We go from this:
+// DomainName<TAB>TTL<TAB>CLASS<TAB>TYPE<TAB>RDATA to:
+// lowercasename<TAB>CLASS<TAB>TYPE...
+func normalizedString(r RR) string {
+	// A string Go DNS makes has: domainname<TAB>TTL<TAB>...
+	b := []byte(r.String())
+
+	// find the first non-escaped tab, then another, so we capture where the TTL lives.
+	esc := false
+	ttlStart, ttlEnd := 0, 0
+	for i := 0; i < len(b) && ttlEnd == 0; i++ {
+		switch {
+		case b[i] == '\\':
+			esc = !esc
+		case b[i] == '\t' && !esc:
+			if ttlStart == 0 {
+				ttlStart = i
+				continue
+			}
+			if ttlEnd == 0 {
+				ttlEnd = i
+			}
+		case b[i] >= 'A' && b[i] <= 'Z' && !esc:
+			b[i] += 32
+		default:
+			esc = false
+		}
+	}
+
+	// remove TTL.
+	copy(b[ttlStart:], b[ttlEnd:])
+	cut := ttlEnd - ttlStart
+	return string(b[:len(b)-cut])
+}

vendor/github.com/miekg/dns/sig0.go

-// SIG(0)
-//
-// From RFC 2931:
-//
-//     SIG(0) provides protection for DNS transactions and requests ....
-//     ... protection for glue records, DNS requests, protection for message headers
-//     on requests and responses, and protection of the overall integrity of a response.
-//
-// It works like TSIG, except that SIG(0) uses public key cryptography, instead of the shared
-// secret approach in TSIG.
-// Supported algorithms: DSA, ECDSAP256SHA256, ECDSAP384SHA384, RSASHA1, RSASHA256 and
-// RSASHA512.
-//
-// Signing subsequent messages in multi-message sessions is not implemented.
-//
 package dns
 
 import (
 	"crypto"
 	"crypto/dsa"
 	"crypto/ecdsa"
-	"crypto/rand"
 	"crypto/rsa"
 	"math/big"
 	"strings"
@@ -29,7 +13,7 @@ import (
 // Sign signs a dns.Msg. It fills the signature with the appropriate data.
 // The SIG record should have the SignerName, KeyTag, Algorithm, Inception
 // and Expiration set.
-func (rr *SIG) Sign(k PrivateKey, m *Msg) ([]byte, error) {
+func (rr *SIG) Sign(k crypto.Signer, m *Msg) ([]byte, error) {
 	if k == nil {
 		return nil, ErrPrivKey
 	}
@@ -57,56 +41,26 @@ func (rr *SIG) Sign(k PrivateKey, m *Msg) ([]byte, error) {
 		return nil, err
 	}
 	buf = buf[:off:cap(buf)]
-	var hash crypto.Hash
-	var intlen int
-	switch rr.Algorithm {
-	case DSA, RSASHA1:
-		hash = crypto.SHA1
-	case RSASHA256, ECDSAP256SHA256:
-		hash = crypto.SHA256
-		intlen = 32
-	case ECDSAP384SHA384:
-		hash = crypto.SHA384
-		intlen = 48
-	case RSASHA512:
-		hash = crypto.SHA512
-	default:
+
+	hash, ok := AlgorithmToHash[rr.Algorithm]
+	if !ok {
 		return nil, ErrAlg
 	}
+
 	hasher := hash.New()
 	// Write SIG rdata
 	hasher.Write(buf[len(mbuf)+1+2+2+4+2:])
 	// Write message
 	hasher.Write(buf[:len(mbuf)])
-	hashed := hasher.Sum(nil)
 
-	var sig []byte
-	switch p := k.(type) {
-	case *dsa.PrivateKey:
-		t := divRoundUp(divRoundUp(p.PublicKey.Y.BitLen(), 8)-64, 8)
-		r1, s1, err := dsa.Sign(rand.Reader, p, hashed)
-		if err != nil {
-			return nil, err
-		}
-		sig = append(sig, byte(t))
-		sig = append(sig, intToBytes(r1, 20)...)
-		sig = append(sig, intToBytes(s1, 20)...)
-	case *rsa.PrivateKey:
-		sig, err = rsa.SignPKCS1v15(rand.Reader, p, hash, hashed)
-		if err != nil {
-			return nil, err
-		}
-	case *ecdsa.PrivateKey:
-		r1, s1, err := ecdsa.Sign(rand.Reader, p, hashed)
+	signature, err := sign(k, hasher.Sum(nil), hash, rr.Algorithm)
 	if err != nil {
 		return nil, err
 	}
-		sig = intToBytes(r1, intlen)
-		sig = append(sig, intToBytes(s1, intlen)...)
-	default:
-		return nil, ErrAlg
-	}
-	rr.Signature = toBase64(sig)
+
+	rr.Signature = toBase64(signature)
+	sig := string(signature)
+
 	buf = append(buf, sig...)
 	if len(buf) > int(^uint16(0)) {
 		return nil, ErrBuf
@@ -118,7 +72,7 @@ func (rr *SIG) Sign(k PrivateKey, m *Msg) ([]byte, error) {
 	buf[rdoff], buf[rdoff+1] = packUint16(rdlen)
 	// Adjust additional count
 	adc, _ := unpackUint16(buf, 10)
-	adc += 1
+	adc++
 	buf[10], buf[11] = packUint16(adc)
 	return buf, nil
 }
@@ -246,7 +200,7 @@ func (rr *SIG) Verify(k *KEY, buf []byte) error {
 			return rsa.VerifyPKCS1v15(pk, hash, hashed, sig)
 		}
 	case ECDSAP256SHA256, ECDSAP384SHA384:
-		pk := k.publicKeyCurve()
+		pk := k.publicKeyECDSA()
 		r := big.NewInt(0)
 		r.SetBytes(sig[:len(sig)/2])
 		s := big.NewInt(0)

vendor/github.com/miekg/dns/tlsa.go

@@ -25,7 +25,8 @@ func CertificateToDANE(selector, matchingType uint8, cert *x509.Certificate) (st
 		h := sha256.New()
 		switch selector {
 		case 0:
-			return hex.EncodeToString(cert.Raw), nil
+			io.WriteString(h, string(cert.Raw))
+			return hex.EncodeToString(h.Sum(nil)), nil
 		case 1:
 			io.WriteString(h, string(cert.RawSubjectPublicKeyInfo))
 			return hex.EncodeToString(h.Sum(nil)), nil
@@ -34,7 +35,8 @@ func CertificateToDANE(selector, matchingType uint8, cert *x509.Certificate) (st
 		h := sha512.New()
 		switch selector {
 		case 0:
-			return hex.EncodeToString(cert.Raw), nil
+			io.WriteString(h, string(cert.Raw))
+			return hex.EncodeToString(h.Sum(nil)), nil
 		case 1:
 			io.WriteString(h, string(cert.RawSubjectPublicKeyInfo))
 			return hex.EncodeToString(h.Sum(nil)), nil
@@ -80,5 +82,5 @@ func TLSAName(name, service, network string) (string, error) {
 	if e != nil {
 		return "", e
 	}
-	return "_" + strconv.Itoa(p) + "_" + network + "." + name, nil
+	return "_" + strconv.Itoa(p) + "._" + network + "." + name, nil
 }

vendor/github.com/miekg/dns/tsig.go

-// TRANSACTION SIGNATURE
-//
-// An TSIG or transaction signature adds a HMAC TSIG record to each message sent.
-// The supported algorithms include: HmacMD5, HmacSHA1 and HmacSHA256.
-//
-// Basic use pattern when querying with a TSIG name "axfr." (note that these key names
-// must be fully qualified - as they are domain names) and the base64 secret
-// "so6ZGir4GPAqINNh9U5c3A==":
-//
-//	c := new(dns.Client)
-//	c.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
-//	m := new(dns.Msg)
-//	m.SetQuestion("miek.nl.", dns.TypeMX)
-//	m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
-//	...
-//	// When sending the TSIG RR is calculated and filled in before sending
-//
-// When requesting an zone transfer (almost all TSIG usage is when requesting zone transfers), with
-// TSIG, this is the basic use pattern. In this example we request an AXFR for
-// miek.nl. with TSIG key named "axfr." and secret "so6ZGir4GPAqINNh9U5c3A=="
-// and using the server 176.58.119.54:
-//
-//	t := new(dns.Transfer)
-//	m := new(dns.Msg)
-//	t.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
-//	m.SetAxfr("miek.nl.")
-//	m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
-//	c, err := t.In(m, "176.58.119.54:53")
-//	for r := range c { /* r.RR */ }
-//
-// You can now read the records from the transfer as they come in. Each envelope is checked with TSIG.
-// If something is not correct an error is returned.
-//
-// Basic use pattern validating and replying to a message that has TSIG set.
-//
-//	server := &dns.Server{Addr: ":53", Net: "udp"}
-//	server.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
-//	go server.ListenAndServe()
-//	dns.HandleFunc(".", handleRequest)
-//
-// 	func handleRequest(w dns.ResponseWriter, r *dns.Msg) {
-//		m := new(Msg)
-//		m.SetReply(r)
-//		if r.IsTsig() {
-//			if w.TsigStatus() == nil {
-//				// *Msg r has an TSIG record and it was validated
-//				m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
-//			} else {
-//				// *Msg r has an TSIG records and it was not valided
-//			}
-//		}
-//		w.WriteMsg(m)
-//	}
 package dns
 
 import (
@@ -58,6 +5,7 @@ import (
 	"crypto/md5"
 	"crypto/sha1"
 	"crypto/sha256"
+	"crypto/sha512"
 	"encoding/hex"
 	"hash"
 	"io"
@@ -71,8 +19,11 @@ const (
 	HmacMD5    = "hmac-md5.sig-alg.reg.int."
 	HmacSHA1   = "hmac-sha1."
 	HmacSHA256 = "hmac-sha256."
+	HmacSHA512 = "hmac-sha512."
 )
 
+// TSIG is the RR the holds the transaction signature of a message.
+// See RFC 2845 and RFC 4635.
 type TSIG struct {
 	Hdr        RR_Header
 	Algorithm  string `dns:"domain-name"`
@@ -86,10 +37,6 @@ type TSIG struct {
 	OtherData  string `dns:"size-hex"`
 }
 
-func (rr *TSIG) Header() *RR_Header {
-	return &rr.Hdr
-}
-
 // TSIG has no official presentation format, but this will suffice.
 
 func (rr *TSIG) String() string {
@@ -107,15 +54,6 @@ func (rr *TSIG) String() string {
 	return s
 }
 
-func (rr *TSIG) len() int {
-	return rr.Hdr.len() + len(rr.Algorithm) + 1 + 6 +
-		4 + len(rr.MAC)/2 + 1 + 6 + len(rr.OtherData)/2 + 1
-}
-
-func (rr *TSIG) copy() RR {
-	return &TSIG{*rr.Hdr.copyHeader(), rr.Algorithm, rr.TimeSigned, rr.Fudge, rr.MACSize, rr.MAC, rr.OrigId, rr.Error, rr.OtherLen, rr.OtherData}
-}
-
 // The following values must be put in wireformat, so that the MAC can be calculated.
 // RFC 2845, section 3.4.2. TSIG Variables.
 type tsigWireFmt struct {
@@ -174,13 +112,15 @@ func TsigGenerate(m *Msg, secret, requestMAC string, timersOnly bool) ([]byte, s
 
 	t := new(TSIG)
 	var h hash.Hash
-	switch rr.Algorithm {
+	switch strings.ToLower(rr.Algorithm) {
 	case HmacMD5:
 		h = hmac.New(md5.New, []byte(rawsecret))
 	case HmacSHA1:
 		h = hmac.New(sha1.New, []byte(rawsecret))
 	case HmacSHA256:
 		h = hmac.New(sha256.New, []byte(rawsecret))
+	case HmacSHA512:
+		h = hmac.New(sha512.New, []byte(rawsecret))
 	default:
 		return nil, "", ErrKeyAlg
 	}
@@ -238,13 +178,15 @@ func TsigVerify(msg []byte, secret, requestMAC string, timersOnly bool) error {
 	}
 
 	var h hash.Hash
-	switch tsig.Algorithm {
+	switch strings.ToLower(tsig.Algorithm) {
 	case HmacMD5:
 		h = hmac.New(md5.New, rawsecret)
 	case HmacSHA1:
 		h = hmac.New(sha1.New, rawsecret)
 	case HmacSHA256:
 		h = hmac.New(sha256.New, rawsecret)
+	case HmacSHA512:
+		h = hmac.New(sha512.New, rawsecret)
 	default:
 		return ErrKeyAlg
 	}

vendor/github.com/miekg/dns/types_generate.go

+//+build ignore
+
+// types_generate.go is meant to run with go generate. It will use
+// go/{importer,types} to track down all the RR struct types. Then for each type
+// it will generate conversion tables (TypeToRR and TypeToString) and banal
+// methods (len, Header, copy) based on the struct tags. The generated source is
+// written to ztypes.go, and is meant to be checked into git.
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"go/format"
+	"go/importer"
+	"go/types"
+	"log"
+	"os"
+	"strings"
+	"text/template"
+)
+
+var skipLen = map[string]struct{}{
+	"NSEC":     {},
+	"NSEC3":    {},
+	"OPT":      {},
+	"WKS":      {},
+	"IPSECKEY": {},
+}
+
+var packageHdr = `
+// *** DO NOT MODIFY ***
+// AUTOGENERATED BY go generate
+
+package dns
+
+import (
+	"encoding/base64"
+	"net"
+)
+
+`
+
+var TypeToRR = template.Must(template.New("TypeToRR").Parse(`
+// TypeToRR is a map of constructors for each RR type.
+var TypeToRR = map[uint16]func() RR{
+{{range .}}{{if ne . "RFC3597"}}  Type{{.}}:  func() RR { return new({{.}}) },
+{{end}}{{end}}                    }
+
+`))
+
+var typeToString = template.Must(template.New("typeToString").Parse(`
+// TypeToString is a map of strings for each RR type.
+var TypeToString = map[uint16]string{
+{{range .}}{{if ne . "NSAPPTR"}}  Type{{.}}: "{{.}}",
+{{end}}{{end}}                    TypeNSAPPTR:    "NSAP-PTR",
+}
+
+`))
+
+var headerFunc = template.Must(template.New("headerFunc").Parse(`
+// Header() functions
+{{range .}}  func (rr *{{.}}) Header() *RR_Header { return &rr.Hdr }
+{{end}}
+
+`))
+
+// getTypeStruct will take a type and the package scope, and return the
+// (innermost) struct if the type is considered a RR type (currently defined as
+// those structs beginning with a RR_Header, could be redefined as implementing
+// the RR interface). The bool return value indicates if embedded structs were
+// resolved.
+func getTypeStruct(t types.Type, scope *types.Scope) (*types.Struct, bool) {
+	st, ok := t.Underlying().(*types.Struct)
+	if !ok {
+		return nil, false
+	}
+	if st.Field(0).Type() == scope.Lookup("RR_Header").Type() {
+		return st, false
+	}
+	if st.Field(0).Anonymous() {
+		st, _ := getTypeStruct(st.Field(0).Type(), scope)
+		return st, true
+	}
+	return nil, false
+}
+
+func main() {
+	// Import and type-check the package
+	pkg, err := importer.Default().Import("github.com/miekg/dns")
+	fatalIfErr(err)
+	scope := pkg.Scope()
+
+	// Collect constants like TypeX
+	var numberedTypes []string
+	for _, name := range scope.Names() {
+		o := scope.Lookup(name)
+		if o == nil || !o.Exported() {
+			continue
+		}
+		b, ok := o.Type().(*types.Basic)
+		if !ok || b.Kind() != types.Uint16 {
+			continue
+		}
+		if !strings.HasPrefix(o.Name(), "Type") {
+			continue
+		}
+		name := strings.TrimPrefix(o.Name(), "Type")
+		if name == "PrivateRR" {
+			continue
+		}
+		numberedTypes = append(numberedTypes, name)
+	}
+
+	// Collect actual types (*X)
+	var namedTypes []string
+	for _, name := range scope.Names() {
+		o := scope.Lookup(name)
+		if o == nil || !o.Exported() {
+			continue
+		}
+		if st, _ := getTypeStruct(o.Type(), scope); st == nil {
+			continue
+		}
+		if name == "PrivateRR" {
+			continue
+		}
+
+		// Check if corresponding TypeX exists
+		if scope.Lookup("Type"+o.Name()) == nil && o.Name() != "RFC3597" {
+			log.Fatalf("Constant Type%s does not exist.", o.Name())
+		}
+
+		namedTypes = append(namedTypes, o.Name())
+	}
+
+	b := &bytes.Buffer{}
+	b.WriteString(packageHdr)
+
+	// Generate TypeToRR
+	fatalIfErr(TypeToRR.Execute(b, namedTypes))
+
+	// Generate typeToString
+	fatalIfErr(typeToString.Execute(b, numberedTypes))
+
+	// Generate headerFunc
+	fatalIfErr(headerFunc.Execute(b, namedTypes))
+
+	// Generate len()
+	fmt.Fprint(b, "// len() functions\n")
+	for _, name := range namedTypes {
+		if _, ok := skipLen[name]; ok {
+			continue
+		}
+		o := scope.Lookup(name)
+		st, isEmbedded := getTypeStruct(o.Type(), scope)
+		if isEmbedded {
+			continue
+		}
+		fmt.Fprintf(b, "func (rr *%s) len() int {\n", name)
+		fmt.Fprintf(b, "l := rr.Hdr.len()\n")
+		for i := 1; i < st.NumFields(); i++ {
+			o := func(s string) { fmt.Fprintf(b, s, st.Field(i).Name()) }
+
+			if _, ok := st.Field(i).Type().(*types.Slice); ok {
+				switch st.Tag(i) {
+				case `dns:"-"`:
+					// ignored
+				case `dns:"cdomain-name"`, `dns:"domain-name"`, `dns:"txt"`:
+					o("for _, x := range rr.%s { l += len(x) + 1 }\n")
+				default:
+					log.Fatalln(name, st.Field(i).Name(), st.Tag(i))
+				}
+				continue
+			}
+
+			switch st.Tag(i) {
+			case `dns:"-"`:
+				// ignored
+			case `dns:"cdomain-name"`, `dns:"domain-name"`:
+				o("l += len(rr.%s) + 1\n")
+			case `dns:"octet"`:
+				o("l += len(rr.%s)\n")
+			case `dns:"base64"`:
+				o("l += base64.StdEncoding.DecodedLen(len(rr.%s))\n")
+			case `dns:"size-hex"`, `dns:"hex"`:
+				o("l += len(rr.%s)/2 + 1\n")
+			case `dns:"a"`:
+				o("l += net.IPv4len // %s\n")
+			case `dns:"aaaa"`:
+				o("l += net.IPv6len // %s\n")
+			case `dns:"txt"`:
+				o("for _, t := range rr.%s { l += len(t) + 1 }\n")
+			case `dns:"uint48"`:
+				o("l += 6 // %s\n")
+			case "":
+				switch st.Field(i).Type().(*types.Basic).Kind() {
+				case types.Uint8:
+					o("l += 1 // %s\n")
+				case types.Uint16:
+					o("l += 2 // %s\n")
+				case types.Uint32:
+					o("l += 4 // %s\n")
+				case types.Uint64:
+					o("l += 8 // %s\n")
+				case types.String:
+					o("l += len(rr.%s) + 1\n")
+				default:
+					log.Fatalln(name, st.Field(i).Name())
+				}
+			default:
+				log.Fatalln(name, st.Field(i).Name(), st.Tag(i))
+			}
+		}
+		fmt.Fprintf(b, "return l }\n")
+	}
+
+	// Generate copy()
+	fmt.Fprint(b, "// copy() functions\n")
+	for _, name := range namedTypes {
+		o := scope.Lookup(name)
+		st, isEmbedded := getTypeStruct(o.Type(), scope)
+		if isEmbedded {
+			continue
+		}
+		fmt.Fprintf(b, "func (rr *%s) copy() RR {\n", name)
+		fields := []string{"*rr.Hdr.copyHeader()"}
+		for i := 1; i < st.NumFields(); i++ {
+			f := st.Field(i).Name()
+			if sl, ok := st.Field(i).Type().(*types.Slice); ok {
+				t := sl.Underlying().String()
+				t = strings.TrimPrefix(t, "[]")
+				t = strings.TrimPrefix(t, "github.com/miekg/dns.")
+				fmt.Fprintf(b, "%s := make([]%s, len(rr.%s)); copy(%s, rr.%s)\n",
+					f, t, f, f, f)
+				fields = append(fields, f)
+				continue
+			}
+			if st.Field(i).Type().String() == "net.IP" {
+				fields = append(fields, "copyIP(rr."+f+")")
+				continue
+			}
+			fields = append(fields, "rr."+f)
+		}
+		fmt.Fprintf(b, "return &%s{%s}\n", name, strings.Join(fields, ","))
+		fmt.Fprintf(b, "}\n")
+	}
+
+	// gofmt
+	res, err := format.Source(b.Bytes())
+	if err != nil {
+		b.WriteTo(os.Stderr)
+		log.Fatal(err)
+	}
+
+	// write result
+	f, err := os.Create("ztypes.go")
+	fatalIfErr(err)
+	defer f.Close()
+	f.Write(res)
+}
+
+func fatalIfErr(err error) {
+	if err != nil {
+		log.Fatal(err)
+	}
+}

vendor/github.com/miekg/dns/udp.go

-// +build !windows
+// +build !windows,!plan9
 
 package dns
 
@@ -7,12 +7,15 @@ import (
 	"syscall"
 )
 
-type sessionUDP struct {
+// SessionUDP holds the remote address and the associated
+// out-of-band data.
+type SessionUDP struct {
 	raddr   *net.UDPAddr
 	context []byte
 }
 
-func (s *sessionUDP) RemoteAddr() net.Addr { return s.raddr }
+// RemoteAddr returns the remote network address.
+func (s *SessionUDP) RemoteAddr() net.Addr { return s.raddr }
 
 // setUDPSocketOptions sets the UDP socket options.
 // This function is implemented on a per platform basis. See udp_*.go for more details
@@ -37,19 +40,19 @@ func setUDPSocketOptions(conn *net.UDPConn) error {
 	return nil
 }
 
-// readFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
+// ReadFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
 // net.UDPAddr.
-func readFromSessionUDP(conn *net.UDPConn, b []byte) (int, *sessionUDP, error) {
+func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
 	oob := make([]byte, 40)
 	n, oobn, _, raddr, err := conn.ReadMsgUDP(b, oob)
 	if err != nil {
 		return n, nil, err
 	}
-	return n, &sessionUDP{raddr, oob[:oobn]}, err
+	return n, &SessionUDP{raddr, oob[:oobn]}, err
 }
 
-// writeToSessionUDP acts just like net.UDPConn.WritetTo(), but uses a *sessionUDP instead of a net.Addr.
-func writeToSessionUDP(conn *net.UDPConn, b []byte, session *sessionUDP) (int, error) {
+// WriteToSessionUDP acts just like net.UDPConn.WritetTo(), but uses a *SessionUDP instead of a net.Addr.
+func WriteToSessionUDP(conn *net.UDPConn, b []byte, session *SessionUDP) (int, error) {
 	n, _, err := conn.WriteMsgUDP(b, session.context, session.raddr)
 	return n, err
 }

vendor/github.com/miekg/dns/udp_linux.go

@@ -24,6 +24,12 @@ func setUDPSocketOptions4(conn *net.UDPConn) error {
 	if err := syscall.SetsockoptInt(int(file.Fd()), syscall.IPPROTO_IP, syscall.IP_PKTINFO, 1); err != nil {
 		return err
 	}
+	// Calling File() above results in the connection becoming blocking, we must fix that.
+	// See https://github.com/miekg/dns/issues/279
+	err = syscall.SetNonblock(int(file.Fd()), true)
+	if err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -36,6 +42,10 @@ func setUDPSocketOptions6(conn *net.UDPConn) error {
 	if err := syscall.SetsockoptInt(int(file.Fd()), syscall.IPPROTO_IPV6, syscall.IPV6_RECVPKTINFO, 1); err != nil {
 		return err
 	}
+	err = syscall.SetNonblock(int(file.Fd()), true)
+	if err != nil {
+		return err
+	}
 	return nil
 }
 

vendor/github.com/miekg/dns/udp_other.go

-// +build !linux
+// +build !linux,!plan9
 
 package dns
 

vendor/github.com/miekg/dns/udp_plan9.go

+package dns
+
+import (
+	"net"
+)
+
+func setUDPSocketOptions(conn *net.UDPConn) error { return nil }
+
+// SessionUDP holds the remote address and the associated
+// out-of-band data.
+type SessionUDP struct {
+	raddr   *net.UDPAddr
+	context []byte
+}
+
+// RemoteAddr returns the remote network address.
+func (s *SessionUDP) RemoteAddr() net.Addr { return s.raddr }
+
+// ReadFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
+// net.UDPAddr.
+func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
+	oob := make([]byte, 40)
+	n, oobn, _, raddr, err := conn.ReadMsgUDP(b, oob)
+	if err != nil {
+		return n, nil, err
+	}
+	return n, &SessionUDP{raddr, oob[:oobn]}, err
+}
+
+// WriteToSessionUDP acts just like net.UDPConn.WritetTo(), but uses a *SessionUDP instead of a net.Addr.
+func WriteToSessionUDP(conn *net.UDPConn, b []byte, session *SessionUDP) (int, error) {
+	n, _, err := conn.WriteMsgUDP(b, session.context, session.raddr)
+	return n, err
+}

vendor/github.com/miekg/dns/udp_windows.go

@@ -4,28 +4,28 @@ package dns
 
 import "net"
 
-type sessionUDP struct {
+type SessionUDP struct {
 	raddr *net.UDPAddr
 }
 
-// readFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
+// ReadFromSessionUDP acts just like net.UDPConn.ReadFrom(), but returns a session object instead of a
 // net.UDPAddr.
-func readFromSessionUDP(conn *net.UDPConn, b []byte) (int, *sessionUDP, error) {
+func ReadFromSessionUDP(conn *net.UDPConn, b []byte) (int, *SessionUDP, error) {
 	n, raddr, err := conn.ReadFrom(b)
 	if err != nil {
 		return n, nil, err
 	}
-	session := &sessionUDP{raddr.(*net.UDPAddr)}
+	session := &SessionUDP{raddr.(*net.UDPAddr)}
 	return n, session, err
 }
 
-// writeToSessionUDP acts just like net.UDPConn.WritetTo(), but uses a *sessionUDP instead of a net.Addr.
-func writeToSessionUDP(conn *net.UDPConn, b []byte, session *sessionUDP) (int, error) {
+// WriteToSessionUDP acts just like net.UDPConn.WritetTo(), but uses a *SessionUDP instead of a net.Addr.
+func WriteToSessionUDP(conn *net.UDPConn, b []byte, session *SessionUDP) (int, error) {
 	n, err := conn.WriteTo(b, session.raddr)
 	return n, err
 }
 
-func (s *sessionUDP) RemoteAddr() net.Addr { return s.raddr }
+func (s *SessionUDP) RemoteAddr() net.Addr { return s.raddr }
 
 // setUDPSocketOptions sets the UDP socket options.
 // This function is implemented on a per platform basis. See udp_*.go for more details

vendor/github.com/miekg/dns/update.go

-// DYNAMIC UPDATES
-//
-// Dynamic updates reuses the DNS message format, but renames three of
-// the sections. Question is Zone, Answer is Prerequisite, Authority is
-// Update, only the Additional is not renamed. See RFC 2136 for the gory details.
-//
-// You can set a rather complex set of rules for the existence of absence of
-// certain resource records or names in a zone to specify if resource records
-// should be added or removed. The table from RFC 2136 supplemented with the Go
-// DNS function shows which functions exist to specify the prerequisites.
-//
-// 3.2.4 - Table Of Metavalues Used In Prerequisite Section
-//
-//   CLASS    TYPE     RDATA    Meaning                    Function
-//   --------------------------------------------------------------
-//   ANY      ANY      empty    Name is in use             dns.NameUsed
-//   ANY      rrset    empty    RRset exists (value indep) dns.RRsetUsed
-//   NONE     ANY      empty    Name is not in use         dns.NameNotUsed
-//   NONE     rrset    empty    RRset does not exist       dns.RRsetNotUsed
-//   zone     rrset    rr       RRset exists (value dep)   dns.Used
-//
-// The prerequisite section can also be left empty.
-// If you have decided on the prerequisites you can tell what RRs should
-// be added or deleted. The next table shows the options you have and
-// what functions to call.
-//
-// 3.4.2.6 - Table Of Metavalues Used In Update Section
-//
-//   CLASS    TYPE     RDATA    Meaning                     Function
-//   ---------------------------------------------------------------
-//   ANY      ANY      empty    Delete all RRsets from name dns.RemoveName
-//   ANY      rrset    empty    Delete an RRset             dns.RemoveRRset
-//   NONE     rrset    rr       Delete an RR from RRset     dns.Remove
-//   zone     rrset    rr       Add to an RRset             dns.Insert
-//
 package dns
 
 // NameUsed sets the RRs in the prereq section to
 // "Name is in use" RRs. RFC 2136 section 2.4.4.
 func (u *Msg) NameUsed(rr []RR) {
-	u.Answer = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Answer[i] = &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassANY}}
+	if u.Answer == nil {
+		u.Answer = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassANY}})
 	}
 }
 
 // NameNotUsed sets the RRs in the prereq section to
 // "Name is in not use" RRs. RFC 2136 section 2.4.5.
 func (u *Msg) NameNotUsed(rr []RR) {
-	u.Answer = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Answer[i] = &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassNONE}}
+	if u.Answer == nil {
+		u.Answer = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassNONE}})
 	}
 }
 
@@ -59,34 +28,34 @@ func (u *Msg) Used(rr []RR) {
 	if len(u.Question) == 0 {
 		panic("dns: empty question section")
 	}
-	u.Answer = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Answer[i] = r
-		u.Answer[i].Header().Class = u.Question[0].Qclass
+	if u.Answer == nil {
+		u.Answer = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		r.Header().Class = u.Question[0].Qclass
+		u.Answer = append(u.Answer, r)
 	}
 }
 
 // RRsetUsed sets the RRs in the prereq section to
 // "RRset exists (value independent -- no rdata)" RRs. RFC 2136 section 2.4.1.
 func (u *Msg) RRsetUsed(rr []RR) {
-	u.Answer = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Answer[i] = r
-		u.Answer[i].Header().Class = ClassANY
-		u.Answer[i].Header().Ttl = 0
-		u.Answer[i].Header().Rdlength = 0
+	if u.Answer == nil {
+		u.Answer = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: r.Header().Rrtype, Class: ClassANY}})
 	}
 }
 
 // RRsetNotUsed sets the RRs in the prereq section to
 // "RRset does not exist" RRs. RFC 2136 section 2.4.3.
 func (u *Msg) RRsetNotUsed(rr []RR) {
-	u.Answer = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Answer[i] = r
-		u.Answer[i].Header().Class = ClassNONE
-		u.Answer[i].Header().Rdlength = 0
-		u.Answer[i].Header().Ttl = 0
+	if u.Answer == nil {
+		u.Answer = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		u.Answer = append(u.Answer, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: r.Header().Rrtype, Class: ClassNONE}})
 	}
 }
 
@@ -95,44 +64,43 @@ func (u *Msg) Insert(rr []RR) {
 	if len(u.Question) == 0 {
 		panic("dns: empty question section")
 	}
-	u.Ns = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Ns[i] = r
-		u.Ns[i].Header().Class = u.Question[0].Qclass
+	if u.Ns == nil {
+		u.Ns = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		r.Header().Class = u.Question[0].Qclass
+		u.Ns = append(u.Ns, r)
 	}
 }
 
 // RemoveRRset creates a dynamic update packet that deletes an RRset, see RFC 2136 section 2.5.2.
 func (u *Msg) RemoveRRset(rr []RR) {
-	m := make(map[RR_Header]struct{})
+	if u.Ns == nil {
 		u.Ns = make([]RR, 0, len(rr))
-	for _, r := range rr {
-		h := *r.Header().copyHeader()
-		h.Class = ClassANY
-		h.Ttl = 0
-		h.Rdlength = 0
-		if _, ok := m[h]; ok {
-			continue
 	}
-		m[h] = struct{}{}
-		u.Ns = append(u.Ns, &ANY{h})
+	for _, r := range rr {
+		u.Ns = append(u.Ns, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: r.Header().Rrtype, Class: ClassANY}})
 	}
 }
 
 // RemoveName creates a dynamic update packet that deletes all RRsets of a name, see RFC 2136 section 2.5.3
 func (u *Msg) RemoveName(rr []RR) {
-	u.Ns = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Ns[i] = &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassANY}}
+	if u.Ns == nil {
+		u.Ns = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		u.Ns = append(u.Ns, &ANY{Hdr: RR_Header{Name: r.Header().Name, Ttl: 0, Rrtype: TypeANY, Class: ClassANY}})
 	}
 }
 
-// Remove creates a dynamic update packet deletes RR from the RRSset, see RFC 2136 section 2.5.4
+// Remove creates a dynamic update packet deletes RR from a RRSset, see RFC 2136 section 2.5.4
 func (u *Msg) Remove(rr []RR) {
-	u.Ns = make([]RR, len(rr))
-	for i, r := range rr {
-		u.Ns[i] = r
-		u.Ns[i].Header().Class = ClassNONE
-		u.Ns[i].Header().Ttl = 0
+	if u.Ns == nil {
+		u.Ns = make([]RR, 0, len(rr))
+	}
+	for _, r := range rr {
+		r.Header().Class = ClassNONE
+		r.Header().Ttl = 0
+		u.Ns = append(u.Ns, r)
 	}
 }

vendor/github.com/miekg/dns/xfr.go

@@ -13,9 +13,9 @@ type Envelope struct {
 // A Transfer defines parameters that are used during a zone transfer.
 type Transfer struct {
 	*Conn
-	DialTimeout    time.Duration     // net.DialTimeout (ns), defaults to 2 * 1e9
-	ReadTimeout    time.Duration     // net.Conn.SetReadTimeout value for connections (ns), defaults to 2 * 1e9
-	WriteTimeout   time.Duration     // net.Conn.SetWriteTimeout value for connections (ns), defaults to 2 * 1e9
+	DialTimeout    time.Duration     // net.DialTimeout, defaults to 2 seconds
+	ReadTimeout    time.Duration     // net.Conn.SetReadTimeout value for connections, defaults to 2 seconds
+	WriteTimeout   time.Duration     // net.Conn.SetWriteTimeout value for connections, defaults to 2 seconds
 	TsigSecret     map[string]string // Secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be fully qualified
 	tsigTimersOnly bool
 }
@@ -23,15 +23,27 @@ type Transfer struct {
 // Think we need to away to stop the transfer
 
 // In performs an incoming transfer with the server in a.
+// If you would like to set the source IP, or some other attribute
+// of a Dialer for a Transfer, you can do so by specifying the attributes
+// in the Transfer.Conn:
+//
+//	d := net.Dialer{LocalAddr: transfer_source}
+//	con, err := d.Dial("tcp", master)
+//	dnscon := &dns.Conn{Conn:con}
+//	transfer = &dns.Transfer{Conn: dnscon}
+//	channel, err := transfer.In(message, master)
+//
 func (t *Transfer) In(q *Msg, a string) (env chan *Envelope, err error) {
 	timeout := dnsTimeout
 	if t.DialTimeout != 0 {
 		timeout = t.DialTimeout
 	}
+	if t.Conn == nil {
 		t.Conn, err = DialTimeout("tcp", a, timeout)
 		if err != nil {
 			return nil, err
 		}
+	}
 	if err := t.WriteMsg(q); err != nil {
 		return nil, err
 	}
@@ -91,7 +103,6 @@ func (t *Transfer) inAxfr(id uint16, c chan *Envelope) {
 			c <- &Envelope{in.Answer, nil}
 		}
 	}
-	panic("dns: not reached")
 }
 
 func (t *Transfer) inIxfr(id uint16, c chan *Envelope) {
@@ -107,7 +118,7 @@ func (t *Transfer) inIxfr(id uint16, c chan *Envelope) {
 		t.SetReadDeadline(time.Now().Add(timeout))
 		in, err := t.ReadMsg()
 		if err != nil {
-			c <- &Envelope{in.Answer, err}
+			c <- &Envelope{nil, err}
 			return
 		}
 		if id != in.Id {
@@ -160,22 +171,18 @@ func (t *Transfer) inIxfr(id uint16, c chan *Envelope) {
 // The server is responsible for sending the correct sequence of RRs through the
 // channel ch.
 func (t *Transfer) Out(w ResponseWriter, q *Msg, ch chan *Envelope) error {
+	for x := range ch {
 		r := new(Msg)
 		// Compress?
 		r.SetReply(q)
 		r.Authoritative = true
-
-	go func() {
-		for x := range ch {
 		// assume it fits TODO(miek): fix
 		r.Answer = append(r.Answer, x.RR...)
 		if err := w.WriteMsg(r); err != nil {
-				return
+			return err
 		}
 	}
 	w.TsigTimersOnly(true)
-		r.Answer = nil
-	}()
 	return nil
 }
 
@@ -197,6 +204,7 @@ func (t *Transfer) ReadMsg() (*Msg, error) {
 		}
 		// Need to work on the original message p, as that was used to calculate the tsig.
 		err = TsigVerify(p, t.TsigSecret[ts.Hdr.Name], t.tsigRequestMAC, t.tsigTimersOnly)
+		t.tsigRequestMAC = ts.MAC
 	}
 	return m, err
 }

vendor/github.com/miekg/dns/zgenerate.go

 package dns
 
 import (
+	"bytes"
 	"fmt"
 	"strconv"
 	"strings"
@@ -14,7 +15,7 @@ import (
 // * [[ttl][class]]
 // * type
 // * rhs (rdata)
-// But we are lazy here, only the range is parsed *all* occurences
+// But we are lazy here, only the range is parsed *all* occurrences
 // of $ after that are interpreted.
 // Any error are returned as a string value, the empty string signals
 // "no error".
@@ -24,13 +25,13 @@ func generate(l lex, c chan lex, t chan *Token, o string) string {
 		if i+1 == len(l.token) {
 			return "bad step in $GENERATE range"
 		}
-		if s, e := strconv.Atoi(l.token[i+1:]); e != nil {
-			return "bad step in $GENERATE range"
-		} else {
+		if s, e := strconv.Atoi(l.token[i+1:]); e == nil {
 			if s < 0 {
 				return "bad step in $GENERATE range"
 			}
 			step = s
+		} else {
+			return "bad step in $GENERATE range"
 		}
 		l.token = l.token[:i]
 	}
@@ -46,7 +47,7 @@ func generate(l lex, c chan lex, t chan *Token, o string) string {
 	if err != nil {
 		return "bad stop in $GENERATE range"
 	}
-	if end < 0 || start < 0 || end <= start {
+	if end < 0 || start < 0 || end < start {
 		return "bad range in $GENERATE range"
 	}
 
@@ -55,14 +56,14 @@ func generate(l lex, c chan lex, t chan *Token, o string) string {
 	s := ""
 BuildRR:
 	l = <-c
-	if l.value != _NEWLINE && l.value != _EOF {
+	if l.value != zNewline && l.value != zEOF {
 		s += l.token
 		goto BuildRR
 	}
 	for i := start; i <= end; i += step {
 		var (
 			escape bool
-			dom    string
+			dom    bytes.Buffer
 			mod    string
 			err    string
 			offset int
@@ -72,7 +73,7 @@ BuildRR:
 			switch s[j] {
 			case '\\':
 				if escape {
-					dom += "\\"
+					dom.WriteByte('\\')
 					escape = false
 					continue
 				}
@@ -81,17 +82,17 @@ BuildRR:
 				mod = "%d"
 				offset = 0
 				if escape {
-					dom += "$"
+					dom.WriteByte('$')
 					escape = false
 					continue
 				}
 				escape = false
 				if j+1 >= len(s) { // End of the string
-					dom += fmt.Sprintf(mod, i+offset)
+					dom.WriteString(fmt.Sprintf(mod, i+offset))
 					continue
 				} else {
 					if s[j+1] == '$' {
-						dom += "$"
+						dom.WriteByte('$')
 						j++
 						continue
 					}
@@ -108,17 +109,17 @@ BuildRR:
 					}
 					j += 2 + sep // Jump to it
 				}
-				dom += fmt.Sprintf(mod, i+offset)
+				dom.WriteString(fmt.Sprintf(mod, i+offset))
 			default:
 				if escape { // Pretty useless here
 					escape = false
 					continue
 				}
-				dom += string(s[j])
+				dom.WriteByte(s[j])
 			}
 		}
 		// Re-parse the RR and send it on the current channel t
-		rx, e := NewRR("$ORIGIN " + o + "\n" + dom)
+		rx, e := NewRR("$ORIGIN " + o + "\n" + dom.String())
 		if e != nil {
 			return e.(*ParseError).err
 		}
@@ -140,11 +141,11 @@ func modToPrintf(s string) (string, int, string) {
 		return "", 0, "bad base in $GENERATE"
 	}
 	offset, err := strconv.Atoi(xs[0])
-	if err != nil {
+	if err != nil || offset > 255 {
 		return "", 0, "bad offset in $GENERATE"
 	}
 	width, err := strconv.Atoi(xs[1])
-	if err != nil {
+	if err != nil || width > 255 {
 		return "", offset, "bad width in $GENERATE"
 	}
 	switch {

vendor/github.com/skynetservices/skydns/cache/cache.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package cache
+
+// Cache that holds RRs and for DNSSEC an RRSIG.
+
+// TODO(miek): there is a lot of copying going on to copy myself out of data
+// races. This should be optimized.
+
+import (
+	"crypto/sha1"
+	"sync"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+// Elem hold an answer and additional section that returned from the cache.
+// The signature is put in answer, extra is empty there. This wastes some memory.
+type elem struct {
+	expiration time.Time // time added + TTL, after this the elem is invalid
+	msg        *dns.Msg
+}
+
+// Cache is a cache that holds on the a number of RRs or DNS messages. The cache
+// eviction is randomized.
+type Cache struct {
+	sync.RWMutex
+
+	capacity int
+	m        map[string]*elem
+	ttl      time.Duration
+}
+
+// New returns a new cache with the capacity and the ttl specified.
+func New(capacity, ttl int) *Cache {
+	c := new(Cache)
+	c.m = make(map[string]*elem)
+	c.capacity = capacity
+	c.ttl = time.Duration(ttl) * time.Second
+	return c
+}
+
+func (c *Cache) Capacity() int { return c.capacity }
+
+func (c *Cache) Remove(s string) {
+	c.Lock()
+	delete(c.m, s)
+	c.Unlock()
+}
+
+// EvictRandom removes a random member a the cache.
+// Must be called under a write lock.
+func (c *Cache) EvictRandom() {
+	clen := len(c.m)
+	if clen < c.capacity {
+		return
+	}
+	i := c.capacity - clen
+	for k, _ := range c.m {
+		delete(c.m, k)
+		i--
+		if i == 0 {
+			break
+		}
+	}
+}
+
+// InsertMessage inserts a message in the Cache. We will cache it for ttl seconds, which
+// should be a small (60...300) integer.
+func (c *Cache) InsertMessage(s string, msg *dns.Msg) {
+	if c.capacity <= 0 {
+		return
+	}
+
+	c.Lock()
+	if _, ok := c.m[s]; !ok {
+		c.m[s] = &elem{time.Now().UTC().Add(c.ttl), msg.Copy()}
+
+	}
+	c.EvictRandom()
+	c.Unlock()
+}
+
+// InsertSignature inserts a signature, the expiration time is used as the cache ttl.
+func (c *Cache) InsertSignature(s string, sig *dns.RRSIG) {
+	if c.capacity <= 0 {
+		return
+	}
+	c.Lock()
+
+	if _, ok := c.m[s]; !ok {
+		m := ((int64(sig.Expiration) - time.Now().Unix()) / (1 << 31)) - 1
+		if m < 0 {
+			m = 0
+		}
+		t := time.Unix(int64(sig.Expiration)-(m*(1<<31)), 0).UTC()
+		c.m[s] = &elem{t, &dns.Msg{Answer: []dns.RR{dns.Copy(sig)}}}
+	}
+	c.EvictRandom()
+	c.Unlock()
+}
+
+// Search returns a dns.Msg, the expiration time and a boolean indicating if we found something
+// in the cache.
+func (c *Cache) Search(s string) (*dns.Msg, time.Time, bool) {
+	if c.capacity <= 0 {
+		return nil, time.Time{}, false
+	}
+	c.RLock()
+	if e, ok := c.m[s]; ok {
+		e1 := e.msg.Copy()
+		c.RUnlock()
+		return e1, e.expiration, true
+	}
+	c.RUnlock()
+	return nil, time.Time{}, false
+}
+
+// Key creates a hash key from a question section. It creates a different key
+// for requests with DNSSEC.
+func Key(q dns.Question, dnssec, tcp bool) string {
+	h := sha1.New()
+	i := append([]byte(q.Name), packUint16(q.Qtype)...)
+	if dnssec {
+		i = append(i, byte(255))
+	}
+	if tcp {
+		i = append(i, byte(254))
+	}
+	return string(h.Sum(i))
+}
+
+// Key uses the name, type and rdata, which is serialized and then hashed as the key for the lookup.
+func KeyRRset(rrs []dns.RR) string {
+	h := sha1.New()
+	i := []byte(rrs[0].Header().Name)
+	i = append(i, packUint16(rrs[0].Header().Rrtype)...)
+	for _, r := range rrs {
+		switch t := r.(type) { // we only do a few type, serialize these manually
+		case *dns.SOA:
+			// We only fiddle with the serial so store that.
+			i = append(i, packUint32(t.Serial)...)
+		case *dns.SRV:
+			i = append(i, packUint16(t.Priority)...)
+			i = append(i, packUint16(t.Weight)...)
+			i = append(i, packUint16(t.Weight)...)
+			i = append(i, []byte(t.Target)...)
+		case *dns.A:
+			i = append(i, []byte(t.A)...)
+		case *dns.AAAA:
+			i = append(i, []byte(t.AAAA)...)
+		case *dns.NSEC3:
+			i = append(i, []byte(t.NextDomain)...)
+			// Bitmap does not differentiate in SkyDNS.
+		case *dns.DNSKEY:
+		case *dns.NS:
+		case *dns.TXT:
+		}
+	}
+	return string(h.Sum(i))
+}
+
+func packUint16(i uint16) []byte { return []byte{byte(i >> 8), byte(i)} }
+func packUint32(i uint32) []byte { return []byte{byte(i >> 24), byte(i >> 16), byte(i >> 8), byte(i)} }

vendor/github.com/skynetservices/skydns/cache/hit.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package cache
+
+import (
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+// Hit returns a dns message from the cache. If the message's TTL is expired nil
+// is returned and the message is removed from the cache.
+func (c *Cache) Hit(question dns.Question, dnssec, tcp bool, msgid uint16) *dns.Msg {
+	key := Key(question, dnssec, tcp)
+	m1, exp, hit := c.Search(key)
+	if hit {
+		// Cache hit! \o/
+		if time.Since(exp) < 0 {
+			m1.Id = msgid
+			m1.Compress = true
+			// Even if something ended up with the TC bit *in* the cache, set it to off
+			m1.Truncated = false
+			return m1
+		}
+		// Expired! /o\
+		c.Remove(key)
+	}
+	return nil
+}

vendor/github.com/skynetservices/skydns/metrics/metrics.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package metrics
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/miekg/dns"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+var (
+	Port      = os.Getenv("PROMETHEUS_PORT")
+	Path      = envOrDefault("PROMETHEUS_PATH", "/metrics")
+	Namespace = envOrDefault("PROMETHEUS_NAMESPACE", "skydns")
+	Subsystem = envOrDefault("PROMETHEUS_SUBSYSTEM", "skydns")
+
+	requestCount    *prometheus.CounterVec
+	requestDuration *prometheus.HistogramVec
+	responseSize    *prometheus.HistogramVec
+	errorCount      *prometheus.CounterVec
+	cacheMiss       *prometheus.CounterVec
+)
+
+type (
+	System    string
+	Cause     string
+	CacheType string
+)
+
+var (
+	Auth    System = "auth"
+	Cache   System = "cache"
+	Rec     System = "recursive"
+	Reverse System = "reverse"
+	Stub    System = "stub"
+
+	Nxdomain  Cause = "nxdomain"
+	Nodata    Cause = "nodata"
+	Truncated Cause = "truncated"
+	Refused   Cause = "refused"
+	Overflow  Cause = "overflow"
+	Fail      Cause = "servfail"
+
+	Response  CacheType = "response"
+	Signature CacheType = "signature"
+)
+
+func defineMetrics() {
+	requestCount = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "dns_request_count_total",
+		Help:      "Counter of DNS requests made.",
+	}, []string{"system"})
+
+	requestDuration = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "dns_request_duration_seconds",
+		Help:      "Histogram of the time (in seconds) each request took to resolve.",
+		Buckets:   append([]float64{0.001, 0.003}, prometheus.DefBuckets...),
+	}, []string{"system"})
+
+	responseSize = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "dns_response_size_bytes",
+		Help:      "Size of the returns response in bytes.",
+		Buckets: []float64{0, 512, 1024, 1500, 2048, 4096,
+			8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864,
+			40960, 45056, 49152, 53248, 57344, 61440, 65536,
+		},
+	}, []string{"system"})
+
+	errorCount = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "dns_error_count_total",
+		Help:      "Counter of DNS requests resulting in an error.",
+	}, []string{"system", "cause"})
+
+	cacheMiss = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: Namespace,
+		Subsystem: Subsystem,
+		Name:      "dns_cachemiss_count_total",
+		Help:      "Counter of DNS requests that result in a cache miss.",
+	}, []string{"cache"})
+}
+
+// Metrics registers the DNS metrics to Prometheus, and starts the internal metrics
+// server if the environment variable PROMETHEUS_PORT is set.
+func Metrics() error {
+	// We do this in a function instead of using var + init(), because we want to
+	// able to set Namespace and/or Subsystem.
+	if Port == "" {
+		return nil
+	}
+
+	_, err := strconv.Atoi(Port)
+	if err != nil {
+		fmt.Errorf("bad port for prometheus: %s", Port)
+	}
+
+	defineMetrics()
+
+	prometheus.MustRegister(requestCount)
+	prometheus.MustRegister(requestDuration)
+	prometheus.MustRegister(responseSize)
+	prometheus.MustRegister(errorCount)
+	prometheus.MustRegister(cacheMiss)
+
+	http.Handle(Path, prometheus.Handler())
+	go func() {
+		fmt.Errorf("%s", http.ListenAndServe(":"+Port, nil))
+	}()
+	return nil
+}
+
+func ReportDuration(resp *dns.Msg, start time.Time, sys System) {
+	if requestDuration == nil || responseSize == nil {
+		return
+	}
+
+	rlen := float64(0)
+	if resp != nil {
+		rlen = float64(resp.Len())
+	}
+	requestDuration.WithLabelValues(string(sys)).Observe(float64(time.Since(start)) / float64(time.Second))
+	responseSize.WithLabelValues(string(sys)).Observe(rlen)
+}
+
+func ReportRequestCount(req *dns.Msg, sys System) {
+	if requestCount == nil {
+		return
+	}
+
+	requestCount.WithLabelValues(string(sys)).Inc()
+}
+
+func ReportErrorCount(resp *dns.Msg, sys System) {
+	if resp == nil || errorCount == nil {
+		return
+	}
+
+	if resp.Truncated {
+		errorCount.WithLabelValues(string(sys), string(Truncated)).Inc()
+		return
+	}
+	if resp.Len() > dns.MaxMsgSize {
+		errorCount.WithLabelValues(string(sys), string(Overflow)).Inc()
+		return
+	}
+
+	switch resp.Rcode {
+	case dns.RcodeServerFailure:
+		errorCount.WithLabelValues(string(sys), string(Fail)).Inc()
+	case dns.RcodeRefused:
+		errorCount.WithLabelValues(string(sys), string(Refused)).Inc()
+	case dns.RcodeNameError:
+		errorCount.WithLabelValues(string(sys), string(Nxdomain)).Inc()
+		// nodata ??
+	}
+
+}
+
+func ReportCacheMiss(ca CacheType) {
+	if cacheMiss == nil {
+		return
+	}
+	cacheMiss.WithLabelValues(string(ca)).Inc()
+}
+
+func envOrDefault(env, def string) string {
+	e := os.Getenv(env)
+	if e != "" {
+		return e
+	}
+	return def
+}

vendor/github.com/skynetservices/skydns/msg/service.go

@@ -12,6 +12,14 @@ import (
 	"github.com/miekg/dns"
 )
 
+// PathPrefix is the prefix used to store SkyDNS data in the backend.
+// It defaults to `skydns`.
+// You can change it by set `path-prefix` configuration or SKYDNS_PATH_PREFIX env. variable.
+// Then:
+// 	The SkyDNS's configuration object should be stored under the key "/mydns/config";
+// 	The etcd path of domain `service.staging.skydns.local.` will be "/mydns/local/skydns/staging/service".
+var PathPrefix string = "skydns"
+
 // This *is* the rdata from a SRV record, but with a twist.
 // Host (Target in SRV) must be a domain name, but if it looks like an IP
 // address (4/6), we will treat it like an IP address.
@@ -29,7 +37,7 @@ type Service struct {
 	// the record lives to a DNS name and use this as the srv.Target.  When
 	// TargetStrip > 0 we strip the left most TargetStrip labels from the
 	// DNS name.
-	TargetStrip int `json:"targetstrip",omitempty"`
+	TargetStrip int `json:"targetstrip,omitempty"`
 
 	// Group is used to group (or *not* to group) different services
 	// together. Services with an identical Group are returned in the same
@@ -42,17 +50,7 @@ type Service struct {
 
 // NewSRV returns a new SRV record based on the Service.
 func (s *Service) NewSRV(name string, weight uint16) *dns.SRV {
-	host := dns.Fqdn(s.Host)
-
-	offset, end := 0, false
-	for i := 0; i < s.TargetStrip; i++ {
-		offset, end = dns.NextLabel(host, offset)
-	}
-	if end {
-		// We overshot the name, use the orignal one.
-		offset = 0
-	}
-	host = host[offset:]
+	host := targetStrip(dns.Fqdn(s.Host), s.TargetStrip)
 
 	return &dns.SRV{Hdr: dns.RR_Header{Name: name, Rrtype: dns.TypeSRV, Class: dns.ClassINET, Ttl: s.Ttl},
 		Priority: uint16(s.Priority), Weight: weight, Port: uint16(s.Port), Target: host}
@@ -60,17 +58,7 @@ func (s *Service) NewSRV(name string, weight uint16) *dns.SRV {
 
 // NewMX returns a new MX record based on the Service.
 func (s *Service) NewMX(name string) *dns.MX {
-	host := dns.Fqdn(s.Host)
-
-	offset, end := 0, false
-	for i := 0; i < s.TargetStrip; i++ {
-		offset, end = dns.NextLabel(host, offset)
-	}
-	if end {
-		// We overshot the name, use the orignal one.
-		offset = 0
-	}
-	host = host[offset:]
+	host := targetStrip(dns.Fqdn(s.Host), s.TargetStrip)
 
 	return &dns.MX{Hdr: dns.RR_Header{Name: name, Rrtype: dns.TypeMX, Class: dns.ClassINET, Ttl: s.Ttl},
 		Preference: uint16(s.Priority), Mx: host}
@@ -118,10 +106,10 @@ func PathWithWildcard(s string) (string, bool) {
 	}
 	for i, k := range l {
 		if k == "*" || k == "any" {
-			return path.Join(append([]string{"/skydns/"}, l[:i]...)...), true
+			return path.Join(append([]string{"/" + PathPrefix + "/"}, l[:i]...)...), true
 		}
 	}
-	return path.Join(append([]string{"/skydns/"}, l...)...), false
+	return path.Join(append([]string{"/" + PathPrefix + "/"}, l...)...), false
 }
 
 // Path converts a domainname to an etcd path. If s looks like service.staging.skydns.local.,
@@ -131,7 +119,7 @@ func Path(s string) string {
 	for i, j := 0, len(l)-1; i < j; i, j = i+1, j-1 {
 		l[i], l[j] = l[j], l[i]
 	}
-	return path.Join(append([]string{"/skydns/"}, l...)...)
+	return path.Join(append([]string{"/" + PathPrefix + "/"}, l...)...)
 }
 
 // Domain is the opposite of Path.
@@ -213,3 +201,21 @@ func split255(s string) []string {
 
 	return sx
 }
+
+// targetStrip strips "targetstrip" labels from the left side of the fully qualified name.
+func targetStrip(name string, targetStrip int) string {
+	if targetStrip == 0 {
+		return name
+	}
+
+	offset, end := 0, false
+	for i := 0; i < targetStrip; i++ {
+		offset, end = dns.NextLabel(name, offset)
+	}
+	if end {
+		// We overshot the name, use the orignal one.
+		offset = 0
+	}
+	name = name[offset:]
+	return name
+}

vendor/github.com/skynetservices/skydns/server/backend.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package server
+
+import "github.com/skynetservices/skydns/msg"
+
+type Backend interface {
+	Records(name string, exact bool) ([]msg.Service, error)
+	ReverseRecord(name string) (*msg.Service, error)
+}
+
+// FirstBackend exposes the Backend interface over multiple Backends, returning
+// the first Backend that answers the provided record request. If no Backend answers
+// a record request, the last error seen will be returned.
+type FirstBackend []Backend
+
+// FirstBackend implements Backend
+var _ Backend = FirstBackend{}
+
+func (g FirstBackend) Records(name string, exact bool) (records []msg.Service, err error) {
+	var lastError error
+	for _, backend := range g {
+		if records, err = backend.Records(name, exact); err == nil && len(records) > 0 {
+			return records, nil
+		}
+		if err != nil {
+			lastError = err
+		}
+	}
+	return nil, lastError
+}
+
+func (g FirstBackend) ReverseRecord(name string) (record *msg.Service, err error) {
+	var lastError error
+	for _, backend := range g {
+		if record, err = backend.ReverseRecord(name); err == nil && record != nil {
+			return record, nil
+		}
+		if err != nil {
+			lastError = err
+		}
+	}
+	return nil, lastError
+}

vendor/github.com/skynetservices/skydns/server/config.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package server
+
+import (
+	"crypto"
+	"fmt"
+	"net"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+const (
+	SCacheCapacity = 10000
+	RCacheCapacity = 100000
+	RCacheTtl      = 60
+)
+
+// Config provides options to the SkyDNS resolver.
+type Config struct {
+	// The ip:port SkyDNS should be listening on for incoming DNS requests.
+	DnsAddr string `json:"dns_addr,omitempty"`
+	// bind to port(s) activated by systemd. If set to true, this overrides DnsAddr.
+	Systemd bool `json:"systemd,omitempty"`
+	// The domain SkyDNS is authoritative for, defaults to skydns.local.
+	Domain string `json:"domain,omitempty"`
+	// Domain pointing to a key where service info is stored when being queried
+	// for local.dns.skydns.local.
+	Local string `json:"local,omitempty"`
+	// The hostmaster responsible for this domain, defaults to hostmaster.<Domain>.
+	Hostmaster string `json:"hostmaster,omitempty"`
+	DNSSEC     string `json:"dnssec,omitempty"`
+	// Round robin A/AAAA replies. Default is true.
+	RoundRobin bool `json:"round_robin,omitempty"`
+	// Round robin selection of nameservers from among those listed, rather than have all forwarded requests try the first listed server first every time.
+	NSRotate bool `json:"ns_rotate,omitempty"`
+	// List of ip:port, seperated by commas of recursive nameservers to forward queries to.
+	Nameservers []string `json:"nameservers,omitempty"`
+	// Never provide a recursive service.
+	NoRec       bool          `json:"no_rec,omitempty"`
+	ReadTimeout time.Duration `json:"read_timeout,omitempty"`
+	// Default priority on SRV records when none is given. Defaults to 10.
+	Priority uint16 `json:"priority"`
+	// Default TTL, in seconds, when none is given in etcd. Defaults to 3600.
+	Ttl uint32 `json:"ttl,omitempty"`
+	// Minimum TTL, in seconds, for NXDOMAIN responses. Defaults to 300.
+	MinTtl uint32 `json:"min_ttl,omitempty"`
+	// SCache, capacity of the signature cache in signatures stored.
+	SCache int `json:"scache,omitempty"`
+	// RCache, capacity of response cache in resource records stored.
+	RCache int `json:"rcache,omitempty"`
+	// RCacheTtl, how long to cache in seconds.
+	RCacheTtl int `json:"rcache_ttl,omitempty"`
+	// How many labels a name should have before we allow forwarding. Default to 2.
+	Ndots int `json:"ndot,omitempty"`
+
+	// DNSSEC key material
+	PubKey  *dns.DNSKEY   `json:"-"`
+	KeyTag  uint16        `json:"-"`
+	PrivKey crypto.Signer `json:"-"`
+
+	Verbose bool `json:"-"`
+
+	Version bool
+
+	// some predefined string "constants"
+	localDomain string // "local.dns." + config.Domain
+	dnsDomain   string // "ns.dns". + config.Domain
+
+	// Stub zones support. Pointer to a map that we refresh when we see
+	// an update. Map contains domainname -> nameserver:port
+	stub *map[string][]string
+}
+
+func SetDefaults(config *Config) error {
+	if config.ReadTimeout == 0 {
+		config.ReadTimeout = 2 * time.Second
+	}
+	if config.DnsAddr == "" {
+		config.DnsAddr = "127.0.0.1:53"
+	}
+	if config.Domain == "" {
+		config.Domain = "skydns.local."
+	}
+	if config.Hostmaster == "" {
+		config.Hostmaster = appendDomain("hostmaster", config.Domain)
+	}
+	// People probably don't know that SOA's email addresses cannot
+	// contain @-signs, replace them with dots
+	config.Hostmaster = dns.Fqdn(strings.Replace(config.Hostmaster, "@", ".", -1))
+	if config.MinTtl == 0 {
+		config.MinTtl = 60
+	}
+	if config.Ttl == 0 {
+		config.Ttl = 3600
+	}
+	if config.Priority == 0 {
+		config.Priority = 10
+	}
+	if config.RCache < 0 {
+		config.RCache = 0
+	}
+	if config.SCache < 0 {
+		config.SCache = 0
+	}
+	if config.RCacheTtl == 0 {
+		config.RCacheTtl = RCacheTtl
+	}
+	if config.Ndots <= 0 {
+		config.Ndots = 2
+	}
+
+	if len(config.Nameservers) == 0 {
+		c, err := dns.ClientConfigFromFile("/etc/resolv.conf")
+		if !os.IsNotExist(err) {
+			if err != nil {
+				return err
+			}
+			for _, s := range c.Servers {
+				config.Nameservers = append(config.Nameservers, net.JoinHostPort(s, c.Port))
+			}
+		}
+	}
+	config.Domain = dns.Fqdn(strings.ToLower(config.Domain))
+	if config.DNSSEC != "" {
+		// For some reason the + are replaces by spaces in etcd. Re-replace them
+		keyfile := strings.Replace(config.DNSSEC, " ", "+", -1)
+		k, p, err := ParseKeyFile(keyfile)
+		if err != nil {
+			return err
+		}
+		if k.Header().Name != dns.Fqdn(config.Domain) {
+			return fmt.Errorf("ownername of DNSKEY must match SkyDNS domain")
+		}
+		k.Header().Ttl = config.Ttl
+		config.PubKey = k
+		config.KeyTag = k.KeyTag()
+		config.PrivKey = p
+	}
+	config.localDomain = appendDomain("local.dns", config.Domain)
+	config.dnsDomain = appendDomain("ns.dns", config.Domain)
+	stubmap := make(map[string][]string)
+	config.stub = &stubmap
+	return nil
+}
+
+func appendDomain(s1, s2 string) string {
+	if len(s2) > 0 && s2[0] == '.' {
+		return s1 + s2
+	}
+	return s1 + "." + s2
+}

vendor/github.com/skynetservices/skydns/server/dnssec.go

+// Copyright (c) 2013 Erik St. Martin, Brian Ketelsen. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package server
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"os"
+	"time"
+
+	"github.com/skynetservices/skydns/cache"
+	"github.com/skynetservices/skydns/metrics"
+	"github.com/skynetservices/skydns/singleflight"
+
+	"github.com/miekg/dns"
+)
+var (
+	inflight = &singleflight.Group{}
+)
+
+
+// ParseKeyFile read a DNSSEC keyfile as generated by dnssec-keygen or other
+// utilities. It add ".key" for the public key and ".private" for the private key.
+func ParseKeyFile(file string) (*dns.DNSKEY, crypto.Signer, error) {
+	f, e := os.Open(file + ".key")
+	if e != nil {
+		return nil, nil, e
+	}
+	k, e := dns.ReadRR(f, file+".key")
+	if e != nil {
+		return nil, nil, e
+	}
+	f, e = os.Open(file + ".private")
+	if e != nil {
+		return nil, nil, e
+	}
+	p, e := k.(*dns.DNSKEY).ReadPrivateKey(f, file+".private")
+	if e != nil {
+		return nil, nil, e
+	}
+
+	if v, ok := p.(*rsa.PrivateKey); ok {
+		return k.(*dns.DNSKEY), v, nil
+	}
+	if v, ok := p.(*ecdsa.PrivateKey); ok {
+		return k.(*dns.DNSKEY), v, nil
+	}
+	return k.(*dns.DNSKEY), nil, nil
+}
+
+// Sign signs a message m, it takes care of negative or nodata responses as
+// well by synthesising NSEC3 records. It will also cache the signatures, using
+// a hash of the signed data as a key.
+// We also fake the origin TTL in the signature, because we don't want to
+// throw away signatures when services decide to have longer TTL. So we just
+// set the origTTL to 60.
+// TODO(miek): revisit origTTL
+func (s *server) Sign(m *dns.Msg, bufsize uint16) {
+	now := time.Now().UTC()
+	incep := uint32(now.Add(-3 * time.Hour).Unix())     // 2+1 hours, be sure to catch daylight saving time and such
+	expir := uint32(now.Add(7 * 24 * time.Hour).Unix()) // sign for a week
+
+	for _, r := range rrSets(m.Answer) {
+		if r[0].Header().Rrtype == dns.TypeRRSIG {
+			continue
+		}
+		if !dns.IsSubDomain(s.config.Domain, r[0].Header().Name) {
+			continue
+		}
+		if sig, err := s.signSet(r, now, incep, expir); err == nil {
+			m.Answer = append(m.Answer, sig)
+		}
+	}
+	for _, r := range rrSets(m.Ns) {
+		if r[0].Header().Rrtype == dns.TypeRRSIG {
+			continue
+		}
+		if !dns.IsSubDomain(s.config.Domain, r[0].Header().Name) {
+			continue
+		}
+		if sig, err := s.signSet(r, now, incep, expir); err == nil {
+			m.Ns = append(m.Ns, sig)
+		}
+	}
+	for _, r := range rrSets(m.Extra) {
+		if r[0].Header().Rrtype == dns.TypeRRSIG || r[0].Header().Rrtype == dns.TypeOPT {
+			continue
+		}
+		if !dns.IsSubDomain(s.config.Domain, r[0].Header().Name) {
+			continue
+		}
+		if sig, err := s.signSet(r, now, incep, expir); err == nil {
+			m.Extra = append(m.Extra, sig)
+		}
+	}
+
+	o := new(dns.OPT)
+	o.Hdr.Name = "."
+	o.Hdr.Rrtype = dns.TypeOPT
+	o.SetDo()
+	o.SetUDPSize(4096) // TODO(miek): echo client
+	m.Extra = append(m.Extra, o)
+	return
+}
+
+func (s *server) signSet(r []dns.RR, now time.Time, incep, expir uint32) (*dns.RRSIG, error) {
+	key := cache.KeyRRset(r)
+	if m, exp, hit := s.scache.Search(key); hit { // There can only be one sig in this cache.
+		// Is it still valid 24 hours from now?
+		if now.Add(+24*time.Hour).Sub(exp) < -24*time.Hour {
+			return m.Answer[0].(*dns.RRSIG), nil
+		}
+		s.scache.Remove(key)
+	}
+	if s.config.Verbose {
+		logf("scache miss for %s type %d", r[0].Header().Name, r[0].Header().Rrtype)
+	}
+
+	metrics.ReportCacheMiss("signature")
+
+	sig, err := inflight.Do(key, func() (interface{}, error) {
+		sig1 := s.NewRRSIG(incep, expir)
+		sig1.Header().Ttl = r[0].Header().Ttl
+		if r[0].Header().Rrtype == dns.TypeTXT {
+			sig1.OrigTtl = 0
+		}
+		e := sig1.Sign(s.config.PrivKey, r)
+		if e != nil {
+			logf("failed to sign: %s", e.Error())
+		}
+		return sig1, e
+	})
+	if err != nil {
+		return nil, err
+	}
+	s.scache.InsertSignature(key, sig.(*dns.RRSIG))
+	return dns.Copy(sig.(*dns.RRSIG)).(*dns.RRSIG), nil
+}
+
+func (s *server) NewRRSIG(incep, expir uint32) *dns.RRSIG {
+	sig := new(dns.RRSIG)
+	sig.Hdr.Rrtype = dns.TypeRRSIG
+	sig.Hdr.Ttl = s.config.Ttl
+	sig.OrigTtl = s.config.Ttl
+	sig.Algorithm = s.config.PubKey.Algorithm
+	sig.KeyTag = s.config.KeyTag
+	sig.Inception = incep
+	sig.Expiration = expir
+	sig.SignerName = s.config.PubKey.Hdr.Name
+	return sig
+}
+
+type rrset struct {
+	qname string
+	qtype uint16
+}
+
+func rrSets(rrs []dns.RR) map[rrset][]dns.RR {
+	m := make(map[rrset][]dns.RR)
+	for _, r := range rrs {
+		if s, ok := m[rrset{r.Header().Name, r.Header().Rrtype}]; ok {
+			s = append(s, r)
+			m[rrset{r.Header().Name, r.Header().Rrtype}] = s
+		} else {
+			s := make([]dns.RR, 1, 3)
+			s[0] = r
+			m[rrset{r.Header().Name, r.Header().Rrtype}] = s
+		}
+	}
+	if len(m) > 0 {
+		return m
+	}
+	return nil
+}

vendor/github.com/skynetservices/skydns/server/doc.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+// Package server provides a DNS server implementation that handles DNS
+// queries. To answer a query, the server asks the provided Backend for
+// DNS records, which are then converted to the proper answers.
+package server

vendor/github.com/skynetservices/skydns/server/exchange.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package server
+
+import "github.com/miekg/dns"
+
+// exchangeMsg returns a new dns message based on name, type, bufsize and dnssec.
+func newExchangeMsg(name string, typ, bufsize uint16, dnssec bool) *dns.Msg {
+	m := new(dns.Msg)
+	m.SetQuestion(name, typ)
+	m.SetEdns0(bufsize, dnssec)
+	return m
+}
+
+// exchangeWithRetry sends message m to server, but retries on ServerFailure.
+func exchangeWithRetry(c *dns.Client, m *dns.Msg, server string) (*dns.Msg, error) {
+	r, _, err := c.Exchange(m, server)
+	if err == nil && r.Rcode == dns.RcodeServerFailure {
+		// redo the query
+		r, _, err = c.Exchange(m, server)
+	}
+	return r, err
+}
+
+func (s *server) randomNameserverID(id uint16) int {
+	nsid := 0
+	if s.config.NSRotate {
+		// Use request Id for "random" nameserver selection.
+		nsid = int(id) % len(s.config.Nameservers)
+	}
+	return nsid
+}

vendor/github.com/skynetservices/skydns/server/forwarding.go

+// Copyright (c) 2014 The SkyDNS Authors. All rights reserved.
+// Use of this source code is governed by The MIT License (MIT) that can be
+// found in the LICENSE file.
+
+package server
+
+import (
+	"fmt"
+
+	"github.com/miekg/dns"
+)
+
+// ServeDNSForward forwards a request to a nameservers and returns the response.
+func (s *server) ServeDNSForward(w dns.ResponseWriter, req *dns.Msg) *dns.Msg {
+	if s.config.NoRec {
+		m := s.ServerFailure(req)
+		w.WriteMsg(m)
+		return m
+	}
+
+	if len(s.config.Nameservers) == 0 || dns.CountLabel(req.Question[0].Name) < s.config.Ndots {
+		if s.config.Verbose {
+			if len(s.config.Nameservers) == 0 {
+				logf("can not forward, no nameservers defined")
+			} else {
+				logf("can not forward, name too short (less than %d labels): `%s'", s.config.Ndots, req.Question[0].Name)
+			}
+		}
+		m := s.ServerFailure(req)
+		m.RecursionAvailable = true // this is still true
+		w.WriteMsg(m)
+		return m
+	}
+
+	var (
+		r   *dns.Msg
+		err error
+	)
+
+	nsid := s.randomNameserverID(req.Id)
+	try := 0
+Redo:
+	if isTCP(w) {
+		r, err = exchangeWithRetry(s.dnsTCPclient, req, s.config.Nameservers[nsid])
+	} else {
+		r, err = exchangeWithRetry(s.dnsUDPclient, req, s.config.Nameservers[nsid])
+	}
+	if err == nil {
+		r.Compress = true
+		r.Id = req.Id
+		w.WriteMsg(r)
+		return r
+	}
+	// Seen an error, this can only mean, "server not reached", try again
+	// but only if we have not exausted our nameservers.
+	if try < len(s.config.Nameservers) {
+		try++
+		nsid = (nsid + 1) % len(s.config.Nameservers)
+		goto Redo
+	}
+
+	logf("failure to forward request %q", err)
+	m := s.ServerFailure(req)
+	return m
+}
+
+// ServeDNSReverse is the handler for DNS requests for the reverse zone. If nothing is found
+// locally the request is forwarded to the forwarder for resolution.
+func (s *server) ServeDNSReverse(w dns.ResponseWriter, req *dns.Msg) *dns.Msg {
+	m := new(dns.Msg)
+	m.SetReply(req)
+	m.Compress = true
+	m.Authoritative = false // Set to false, because I don't know what to do wrt DNSSEC.
+	m.RecursionAvailable = true
+	var err error
+	if m.Answer, err = s.PTRRecords(req.Question[0]); err == nil {
+		// TODO(miek): Reverse DNSSEC. We should sign this, but requires a key....and more
+		// Probably not worth the hassle?
+		if err := w.WriteMsg(m); err != nil {
+			logf("failure to return reply %q", err)
+		}
+		return m
+	}
+	// Always forward if not found locally.
+	return s.ServeDNSForward(w, req)
+}
+
+// Lookup looks up name,type using the recursive nameserver defines
+// in the server's config. If none defined it returns an error.
+func (s *server) Lookup(n string, t, bufsize uint16, dnssec bool) (*dns.Msg, error) {
+	if len(s.config.Nameservers) == 0 {
+		return nil, fmt.Errorf("no nameservers configured can not lookup name")
+	}
+	if dns.CountLabel(n) < s.config.Ndots {
+		return nil, fmt.Errorf("name has fewer than %d labels", s.config.Ndots)
+	}
+	m := newExchangeMsg(n, t, bufsize, dnssec)
+
+	nsid := s.randomNameserverID(m.Id)
+	try := 0
+Redo:
+	r, err := exchangeWithRetry(s.dnsUDPclient, m, s.config.Nameservers[nsid])
+	if err == nil {
+		if r.Rcode != dns.RcodeSuccess {
+			return nil, fmt.Errorf("rcode is not equal to success")
+		}
+		// Reset TTLs to rcache TTL to make some of the other code
+		// and the tests not care about TTLs
+		for _, rr := range r.Answer {
+			rr.Header().Ttl = uint32(s.config.RCacheTtl)
+		}
+		for _, rr := range r.Extra {
+			rr.Header().Ttl = uint32(s.config.RCacheTtl)
+		}
+		return r, nil
+	}
+	// Seen an error, this can only mean, "server not reached", try again
+	// but only if we have not exausted our nameservers.
+	if try < len(s.config.Nameservers) {
+		try++
+		nsid = (nsid + 1) % len(s.config.Nameservers)
+		goto Redo
+	}
+	return nil, fmt.Errorf("failure to lookup name")
+}