ServiceRegistration/dnssd-proxy.c - mDNSResponder - Git at Google

 /* dnssd-proxy.c
  *
  * Copyright (c) 2018-2024 Apple Inc. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *     https://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
  * This is a Discovery Proxy module for the SRP gateway.
  *
  * The motivation here is that it makes sense to co-locate the SRP relay and the Discovery Proxy because
  * these functions are likely to co-exist on the same node, listening on the same port.  For homenet-style
  * name resolution, we need a DNS proxy that implements DNSSD Discovery Proxy for local queries, but
  * forwards other queries to an ISP resolver.  The SRP gateway is already expecting to do this.
  * This module implements the functions required to allow the SRP gateway to also do Discovery Relay.
  *
  * The Discovery Proxy relies on Apple's DNS-SD library and the mDNSResponder DNSSD server, which is included
  * in Apple's open source mDNSResponder package, available here:
  *
  *            https://opensource.apple.com/tarballs/mDNSResponder/
  */

 #ifndef __APPLE_USE_RFC_3542
     #define __APPLE_USE_RFC_3542
 #endif // #ifndef __APPLE_USE_RFC_3542

 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
 #include <unistd.h>
 #include <errno.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <fcntl.h>
 #include <sys/time.h>
 #include <ctype.h>
 #include <sys/types.h>
 #include <ifaddrs.h>
 #include <net/if.h>
 #include <stdarg.h>
 #include <notify.h>
 #ifdef IOLOOP_MACOS
 #include <AssertMacros.h>
 #include <SystemConfiguration/SystemConfiguration.h>
 #endif // #ifdef IOLOOP_MACOS

 #include "dns_sd.h"
 #include "srp.h"
 #include "dns-msg.h"
 #include "srp-crypto.h"
 #include "ioloop.h"
 #include "dso-utils.h"
 #include "dso.h"
 #include "srp-tls.h"
 #include "config-parse.h"
 #include "srp-mdns-proxy.h"
 #include "dnssd-proxy.h"
 #include "srp-tls.h"
 #include "srp-gw.h"
 #include "srp-proxy.h"
 #include "cti-services.h"
 #include "route.h"
 #include "srp-replication.h"
 #if THREAD_DEVICE
 #  include "state-machine.h"
 #  include "service-publisher.h"
 #endif
 #if SRP_FEATURE_NAT64
 #include "dns_sd_private.h"
 #include "nat64-macos.h"
 #endif
 #include "advertising_proxy_services.h"
 #include "srp-dnssd.h"

 #define RESPONSE_WINDOW_MSECS 800
 #define RESPONSE_WINDOW_USECS (RESPONSE_WINDOW_MSECS * 1000) // 800ms in microseconds.

 extern srp_server_t *srp_servers;
 #define SERIAL(x) ((x) == NULL ? 0 : (x)->serial)

 // When do we build dnssd-proxy?
 // 1. When we are integrating dnssd-proxy into srp-mdns-proxy: SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY == 1
 // 2. When we are building standalone dnssd-proxy: !defined(BUILD_SRP_MDNS_PROXY) || (BUILD_SRP_MDNS_PROXY == 0)
 // When do we not build dnssd-proxy?
 // 3. When we are building srp-mdns-proxy without dnssd-proxy: other than the two cases above.
 #if (SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY) || (!defined(BUILD_SRP_MDNS_PROXY) || (BUILD_SRP_MDNS_PROXY == 0))

 // Enumerate the list of interfaces, map them to interface indexes, give each one a name
 // Have a tree of subdomains for matching

 // Structures

 typedef struct interface_addr interface_addr_t;
 struct interface_addr {
     interface_addr_t *next;
     addr_t addr, mask;
 };

 typedef struct dp_interface dp_interface_t;
 struct dp_interface {
     int ifindex;                            // The interface index (for use with sendmsg() and recvmsg().
     bool no_push;                           // If true, don't set up DNS Push for this domain
     char *NONNULL name;                     // The name of the interface
     interface_addr_t *NULLABLE addresses;   // Addresses on this interface.
 };

 typedef struct hardwired hardwired_t;
 struct hardwired {
     hardwired_t *NULLABLE next;
     uint16_t type;
     char *NONNULL name;
     char *NONNULL fullname;
     uint8_t *NULLABLE rdata;
     uint16_t rdlen;
 };

 typedef struct question question_t;
 typedef struct answer answer_t;
 typedef struct served_domain served_domain_t;
 struct served_domain {
     served_domain_t *NULLABLE next;             // Active configurations, used for identifying a domain that matches
     char *NONNULL domain;                       // The domain name of the interface, represented as a text string.
     char *NONNULL domain_ld;                    // The same name, with a leading dot (if_domain_lp == if_domain + 1)
     dns_name_t *NONNULL domain_name;            // The domain name, parsed into labels.
     hardwired_t *NULLABLE hardwired_responses;  // Hardwired responses for this interface.
     dp_interface_t *NULLABLE interface;         // Interface to which this domain applies (may be NULL).
     question_t *NULLABLE questions;             // Questions that have been asked in the served domain.
 };

 // There are two ways that a dnssd_query_t can be created. One is that a DNS datagram comes in that's a DNS
 // query.  In this case, we create the query, ask the question, generate a single DNS response, send it, and
 // the dnssd query is finished. We could optimize retransmissions, but currently do not. UDP queries can
 // happen either over a TCP connection or a UDP connection--the behavior is the same in either case.  The
 // other way is that it can be a DNS Push subscribe. A DNS Push subscribe query is finished either when the
 // connection dies, or when we get a corresponding unsubscribe.

 // For DNS Push queries, there is an "activity" object which tracks a particular subscription. Each activity
 // can hold a reference to the comm_t. A disconnect from the comm_t should cancel all activities. Otherwise,
 // the lifecycle of activities should not affect the comm_t.

 // For DNS queries, a disconnect should cancel every query associated with the connection. This is complicated
 // by the fact that we are not tracking outstanding queries--the query survives because the dnssd_txn_t object
 // holds a reference to it; when the txn_t goes away, the connection will have no remaining references.

 // In order to make this work, dnssd_query_t objects are tracked per connection. Dnssd_query_t objects do not
 // hold a reference to their comm_t, but rather to their tracker.

 // When a connection drops, the tracker object gets a disconnect callback, which triggers it to cancel out any
 // remaining DNS transactions, and to cancel the associated DSO object. Cancelling the DSO object cancels all
 // of the activities on that object; each activity is a dnssd_query_t object. Consequently, the tracker does
 // not directly track DSO activities.

 // In order to follow RFC 7766, the tracker keeps an idle timer going. If no DNS messages have been received
 // on a connection for that amount of time, the tracker closes the connection; when the disconnect event arrives,
 // the tracker is collected. If there is a DSO object on the tracker, the tracker is not responsible for tracking
 // idle state.

 typedef enum {
     dp_tracker_session_none,
     dp_tracker_session_push,
     dp_tracker_session_srpl
 } dp_tracker_session_type_t;

 int cur_tracker_serial;
 typedef struct dnssd_query dnssd_query_t;
 typedef struct dp_tracker {
     int ref_count;
     int serial;
     comm_t *connection;
     dnssd_query_t *dns_queries;
     dso_state_t *dso;
     wakeup_t *idle_timeout;
     dp_tracker_session_type_t session_type;
 } dp_tracker_t;

 struct answer {
     answer_t *next;                 // List of answers to a question.
     char *fullname;                 // Name returned in callback.
     uint8_t *rdata;                 // Rdata returned in callback (wire format).
     uint32_t interface_index;       // Interface index returned in callback.
     uint32_t ttl;                   // Time-to-live returned in callback (probably not useful for LLQ).
     uint16_t rrtype;                // Resource record type returned in callback.
     uint16_t rrclass;               // Resource record class returned in callback.
     uint16_t rdlen;                 // Length of resource record data returned in callback.
 };

 static int cur_question_serial;
 struct question {
     question_t *next;               // List of questions that are being asked.
     served_domain_t *served_domain;
     dnssd_query_t *queries;         // dnssd queries that are asking this question.
     dnssd_txn_t *txn;               // Subordinate DNSServiceRef for this question
     char *name;                     // The name we are looking up.
     answer_t *answers;              // Answers this question has received.
     int64_t start_time;             // When this question was started.
     int serviceFlags;               // Service flags to use with this question.
     int ref_count;                  // Reference count.
     int serial;
     uint32_t interface_index;       // Which interface the query should use.
     uint16_t type;                  // The type.
     uint16_t qclass;                // The class.
     bool no_data;                   // True if "no such record" is received or all data gets removed
 };

 static int cur_query_serial;
 struct dnssd_query {
     int ref_count;
     int serial;
     dp_tracker_t *tracker;          // Tracks the connection that delivered this query.
     dnssd_query_t *next;            // For DNS queries, tracks other queries on the same connection, if any.
     wakeup_t *wakeup;
     dns_name_pointer_t enclosing_domain_pointer;

     message_t *message;
     dso_state_t *dso;               // If this is a DNS Push query, the DSO state associated with it.
     dso_activity_t *activity;
     int num_questions;              // In case of a multi-question query, how many questions were asked
     bool is_edns0;
     dns_towire_state_t towire;
     uint8_t *p_dso_length;          // Where to store the DSO length just before we write out a push notification.
     dns_wire_t *response;
     dns_message_t *response_msg;    // In case we need to decompose the message to construct a multi-answer message.
     size_t data_size;               // Size of the data payload of the response.
     dnssd_query_t *question_next;   // Linked list of queries on the question this query is subscribed to.
     question_t *question;           // Question asked by this query pointing to a cache entry.
     bool satisfied;                 // If true, this query has gotten an answer. Only relevant for straight DNS.
     bool canceled;                  // If true, dnssd_query_cancel has been called on this query, so don't cancel it again.
 };

 // Structure that is used to setup the mDNS discovery for dnssd-proxy.
 struct dnssd_proxy_advertisements {
     wakeup_t *wakeup_timer;         // Used to setup a timer to advertise records repeatedly until it succeeds.
     dnssd_txn_t *txn;               // Contains event loop.
     DNSServiceRef service_ref;      // Shared DNSServiceRef for all registering operation.
     DNSRecordRef ns_record_ref;     // Used to update the advertised NS record.
     DNSRecordRef ptr_record_ref;    // Used to update the advertised PTR record.
     char *domain_to_advertise;      // The domain to be advertised in NS and PTR records.
     srp_server_t *server_state;
     SCDynamicStoreContext sc_context;
 };

 #if SRP_FEATURE_DISCOVERY_PROXY_SERVER
 // Structure that is used to advertise the push discovery service in .local domain.
 struct dnssd_dp_proxy_advertisements {
     wakeup_t *wakeup_timer;     // Used to setup a timer to advertise push service repeatedly until it succeeds.
     dnssd_txn_t *txn;           // The event loop.
     DNSServiceRef service_ref;  // DNSServiceRef to register the service.
     srp_server_t *server_state;
 };
 #endif

 // Configuration file settings

 uint16_t dnssd_proxy_udp_port;
 uint16_t dnssd_proxy_tcp_port;
 uint16_t dnssd_proxy_tls_port;
 const char *my_name = "discoveryproxy.home.arpa.";
 char *listen_addrs[MAX_ADDRS];
 int num_listen_addrs;
 char *publish_addrs[MAX_ADDRS];
 int num_publish_addrs;
 char *tls_cacert_filename;
 char *tls_cert_filename = "/etc/dnssd-proxy/server.crt";
 char *tls_key_filename = "/etc/dnssd-proxy/server.key";

 comm_t *dnssd_proxy_listeners[4 + MAX_ADDRS];
 int dnssd_proxy_num_listeners;
 question_t *questions_without_domain; // Questions that aren't in a served domain
 served_domain_t *served_domains;
 int num_push_sessions; // Number of connections from DNS Push clients
 int dp_num_outstanding_queries;
 int num_push_sessions_dropped_for_load;
 int num_queries_dropped_for_load;

 #if SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
 dnssd_txn_t *shared_discovery_txn;
 #endif // SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
 wakeup_t *discovery_restart_wakeup;

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
 static char uuid_name[DNS_MAX_NAME_SIZE + 1];
 static char my_name_buf[DNS_MAX_NAME_SIZE + 1];
 static CFStringRef sc_dynamic_store_key_host_name;
 static char local_host_name[DNS_MAX_NAME_SIZE + 1];
 static char local_host_name_dot_local[DNS_MAX_NAME_SIZE + 1];
 #endif // #if (SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY)

 #if THREAD_BORDER_ROUTER && SRP_FEATURE_SRP_COMBINED_DNSSD_PROXY
 extern char *thread_interface_name;
 #endif // THREAD_BORDER_ROUTER && SRP_FEATURE_COMBINED_DNSSD_PROXY

 // Globals

 const char push_subscription_activity_type[] = "push subscription";

 static const char local_suffix[] = ".local.";

 bool tls_fail = false; // Command line argument, for testing.

 // Macros

 #define THREAD_DOMAIN "thread.home.arpa."
 // "openthread." will change in the future once we have a way to get thread network ID
 #define THREAD_DOMAIN_WITH_ID "openthread." THREAD_DOMAIN
 #define DEFAULT_SERVICE_ARPA_DOMAIN "default.service.arpa."
 #define HOME_NET_DOMAIN "home.arpa."
 #define DOT_HOME_NET_DOMAIN ".home.arpa."
 #define DOT_LOCAL_DOMAIN "local."
 #define LOCAL "local."
 #define DOT_LOCAL ".local."
 #define IPV4_REVERSE_LOOKUP_DOMAIN "in-addr.arpa."
 #define IPV6_REVERSE_LOOKUP_DOMAIN "ip6.arpa."
 #define SRV_TYPE_FOR_AUTOMATIC_BROWSING_DOMAIN "lb._dns-sd._udp"
 #define TOWIRE_CHECK(note, towire, func) { func; if ((towire)->error != 0 && failnote == NULL) failnote = (note); }
 #define BUSY_RETRY_DELAY_MS (5 * 60 * 1000) // Five minutes.
 #define MAX_DSO_CONNECTIONS 15 // Should be enough for a typical home network, assuming more hosts -> more BRs

 // RFC8766 says for us to clamp the TTL on proxied mDNS records to 10s. In practice this appears to be much
 // too short, because if the DNSSD server (e.g. mDNSResponder) is doing an LLQ, this results in a refresh
 // interval of <10s, which is kind of painful.
 #define RFC8766_TTL_CLAMP 300

 #define VALIDATE_TRACKER_CONNECTION_NON_NULL()                                                            \
     do {                                                                                                  \
         if (query->tracker == NULL) {                                                                     \
             ERROR("[Q%d] query->tracker NULL for query!", SERIAL(query));                                 \
             return;                                                                                       \
         }                                                                                                 \
         if (query->tracker->connection == NULL) {                                                         \
             ERROR("[Q%d][TRK%d] query->tracker->connection NULL", SERIAL(query), SERIAL(query->tracker)); \
             return;                                                                                       \
         }                                                                                                 \
     } while (false)

 #ifdef SRP_TEST_SERVER
 extern void (*srp_test_dso_message_finished)(void *context, message_t *message, dso_state_t *dso);
 extern ready_callback_t srp_test_dnssd_tls_listener_ready;
 extern void *srp_test_tls_listener_context;
 #endif

 // Forward references

 static void dns_push_start(dnssd_query_t *query);

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
 static void served_domain_free(served_domain_t *const served_domain);
 #endif

 static served_domain_t *NULLABLE
 new_served_domain(dp_interface_t *const NULLABLE interface, const char * NONNULL domain);

 #if STUB_ROUTER
 static served_domain_t *NULLABLE
 find_served_domain(const char *const NONNULL domain);

 static bool
 string_ends_with(const char *const NONNULL str, const char *const NONNULL suffix);
 #endif // STUB_ROUTER

 static void dp_query_towire_reset(dnssd_query_t *query);

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
 static served_domain_t *NONNULL
 add_new_served_domain_with_interface(const char *const NONNULL name,
     const addr_t *const NULLABLE address, const addr_t *const NULLABLE mask);;

 #if STUB_ROUTER
 static bool
 dnssd_hardwired_add_or_remove_address_in_domain(const char *const NONNULL name,
     const char *const NONNULL domain_to_change, const addr_t *const NONNULL address, const bool add);
 #endif // STUB_ROUTER

 static bool
 dnssd_hardwired_setup_dns_push_for_domain(served_domain_t *const NONNULL served_domain);
 #endif // SRP_FEATURE_DYNAMIC_CONFIGURATION

 #if STUB_ROUTER
 static bool
 start_timer_to_advertise(dnssd_proxy_advertisements_t *NONNULL context,
     const char *const NULLABLE domain_to_advertise, const uint32_t interval);
 #endif

 static bool
 interface_process_addr_change(dp_interface_t *const NONNULL interface, const addr_t *const NONNULL address,
                               const addr_t *const NONNULL mask, const enum interface_address_change event_type);

 static void dns_question_callback(DNSServiceRef UNUSED sdRef, DNSServiceFlags flags, uint32_t UNUSED interfaceIndex,
                                   DNSServiceErrorType errorCode, const char *fullname, uint16_t rrtype,
                                   uint16_t rrclass, uint16_t rdlen, const void *rdata, uint32_t ttl, void *context);
 static void dns_push_callback(void *context, void *event_context, dso_state_t *dso, dso_event_type_t eventType);
 #if SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
 static void dp_setup_shared_discovery_txn(void);
 #endif
 static void dp_query_reply_from_cache(question_t *question, dnssd_query_t *query, bool remove);
 static void dp_handle_server_disconnect(void *UNUSED context, int status);
 static void dp_question_answers_free(question_t *question);
 static void question_finalize(question_t *question);

 // For debugging
 static wakeup_t *connection_dropper;
 extern dso_state_t *dso_connections;
 static void dp_drop_connections(void *UNUSED context);
 #ifdef SRP_TEST_SERVER
 served_domain_t *NULLABLE last_freed_domain;
 #endif

 static void
 dp_question_context_release(void *context)
 {
     question_t *question = context;
     RELEASE_HERE(question, question);
 }

 static DNSServiceErrorType
 dp_start_question(question_t *question, bool dns64)
 {
     DNSServiceErrorType err;
     DNSServiceRef sdref;
     size_t len;
     char name[DNS_MAX_NAME_SIZE + 1];
     char *np;

     // If a query has a served domain, query->question->name is the subdomain of the served domain that is
     // being queried; otherwise query->question->name is the whole name.
     if (question->served_domain != NULL) {
         len = strlen(question->name);
         if (question->served_domain->interface != NULL) {
             if (len + sizeof local_suffix > sizeof name) {
                 ERROR("[QU%d] question name %s is too long for .local.", SERIAL(question), name);
                 return kDNSServiceErr_BadParam;
             }
             memcpy(name, question->name, len);
             memcpy(&name[len], local_suffix, sizeof local_suffix);
         } else {
             size_t dlen = strlen(question->served_domain->domain_ld) + 1;
             if (len + dlen > sizeof name) {
                 ERROR("[QU%d] question name %s is too long for %s.", SERIAL(question), name, question->served_domain->domain);
                 return kDNSServiceErr_BadParam;
             }
             memcpy(name, question->name, len);
             memcpy(&name[len], question->served_domain->domain_ld, dlen);
         }
         np = name;
     } else {
         np = question->name;
     }

     int shared_connection_flag = 0;
 #if SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
     dp_setup_shared_discovery_txn();
     if (shared_discovery_txn != NULL) {
         sdref = shared_discovery_txn->sdref;
         shared_connection_flag = kDNSServiceFlagsShareConnection;
     }
 #endif // SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS

     uint32_t question_interface = question->interface_index;
 #if SRP_FEATURE_LOCAL_DISCOVERY
     if (question_interface == kDNSServiceInterfaceIndexInfra) {
         int ret = -1;
 #if STUB_ROUTER
         ret = route_get_current_infra_interface_index();
 #else
         static unsigned en0_ifindex = 0;
         if (en0_ifindex == 0) {
             en0_ifindex = if_nametoindex("en0");
             if (en0_ifindex == 0) {
                 ERROR("getting en0 ifindex failed!");
             }
         }
         if (en0_ifindex != 0) {
             ret = en0_ifindex;
         }
 #endif // STUB_ROUTER
         // If we don't have an infrastructure interface, refuse the query.
         if (ret < 0) {
             return kDNSServiceErr_Refused;
         }
         question_interface = ret;
     }
 #endif // SRP_FEATURE_LOCAL_DISCOVERY

 #if SRP_FEATURE_NAT64
     const DNSServiceAttribute *attr = NULL;
     if (dns64 && (question->type == dns_rrtype_aaaa) && (question->qclass == dns_qclass_in)) {
         attr = &kDNSServiceAttributeAAAAFallback;
     }
     err = dns_service_query_record_wa(srp_servers, &sdref, question->serviceFlags | shared_connection_flag,
                                       question_interface, np, question->type,
                                       question->qclass, attr, dns_question_callback, question);
 #else
     (void)dns64;
     err = dns_service_query_record(srp_servers, &sdref, question->serviceFlags | shared_connection_flag, question_interface, np,
                                    question->type, question->qclass, dns_question_callback, question);
 #endif
     if (err != kDNSServiceErr_NoError) {
         ERROR("[QU%d] DNSServiceQueryRecord failed for '%s': %d", SERIAL(question), np, err);
     } else {
         INFO("[QU%d] txn %p new sdref %p", SERIAL(question), question->txn, sdref);
 #if SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTION
         question->txn = ioloop_dnssd_txn_add_subordinate(sdref, dp_question_context_release, NULL);
 #else
         question->txn = dns_service_ioloop_txn_add(srp_servers, sdref, question, dp_question_context_release, dp_handle_server_disconnect);
 #endif // SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
         RETAIN_HERE(question, question); // For the callback
 #if SRP_FEATURE_NAT64
         INFO("[QU%d] DNSServiceQueryRecordWithAttribute started for '" PRI_S_SRP "': %d", SERIAL(question), np, err);
 #else
         INFO("[QU%d] DNSServiceQueryRecord started for '" PRI_S_SRP "': %d", SERIAL(question), np, err);
 #endif // SRP_FEATURE_NAT64
     }
     return err;
 }

 static bool
 dp_iterate_questions_on_list(question_t *list, bool (*callback)(question_t *question, void *context), void *context)
 {
     for (question_t *question = list; question; question = question->next) {
         if (callback(question, context)) {
             return true;
         }
     }
     return false;
 }

 static bool
 dp_iterate_questions(bool (*callback)(question_t *question, void *context), void *context)
 {
     if (dp_iterate_questions_on_list(questions_without_domain, callback, context)) {
         return true;
     }

     for (served_domain_t *domain = served_domains; domain != NULL; domain = domain->next) {
         if (dp_iterate_questions_on_list(domain->questions, callback, context)) {
             return true;
         }
     }
     return false;
 }

 static bool
 dp_restart_question(question_t *question, void *context)
 {
     bool dns64 = *((bool *)context);
     if (question->txn == NULL) {
         dp_start_question(question, dns64);
     }
     return false;
 }

 static void
 dp_restart_all_questions(void *UNUSED context)
 {
     bool dns64 = false;
 #if SRP_FEATURE_NAT64
     if (srp_servers->srp_nat64_enabled) {
         dns64 = nat64_is_active();
     }
 #endif
     dp_iterate_questions(dp_restart_question, &dns64);
 }

 static bool
 dp_void_question(question_t *question, void *UNUSED context)
 {
     if (question->txn != NULL) {
         INFO("[QU%d] question->txn = %p", SERIAL(question), question->txn);
 #if SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
         question->txn->sdref = NULL;
 #else
         ioloop_dnssd_txn_cancel(question->txn);
 #endif
         ioloop_dnssd_txn_release(question->txn);
         question->txn = NULL;
     }
     if (question->answers != NULL) {
         dnssd_query_t *next, *query = question->queries;
         while(query != NULL) {
             next = query->question_next;
             if (query->dso != NULL) {
                 dp_query_reply_from_cache(question, query, true);
             }
             query = next;
         }
         dp_question_answers_free(question);
     }

     return false;
 }

 // NULLs out all outstanding questions (after an mDNSResponder crash). These pointers are rendered invalid when the
 // parent transaction is deallocated, so this should not result in any leaks.
 static void
 dp_void_all_questions(void)
 {
     dp_iterate_questions(dp_void_question, NULL);
 }

 static void
 dp_handle_server_disconnect(void *UNUSED context, int status)
 {
     INFO("status %d", status);
     dp_void_all_questions();
     if (discovery_restart_wakeup == NULL) {
         discovery_restart_wakeup = ioloop_wakeup_create();
     }
     if (discovery_restart_wakeup != NULL) {
         // Try to reconnect to mDNSResponder after a second.
         ioloop_add_wake_event(discovery_restart_wakeup, NULL, dp_restart_all_questions, NULL, 1000);
     }
 }

 #if SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
 static void
 dp_setup_shared_discovery_txn(void)
 {
     if (shared_discovery_txn == NULL) {
         DNSServiceRef sdref;
         int err = DNSServiceCreateConnection(&sdref);
         if (err != kDNSServiceErr_NoError) {
             return false;
         }
         shared_discovery_txn = ioloop_dnssd_txn_add(sdref, NULL, NULL, dp_handle_server_disconnect);
         if (shared_discovery_txn == NULL) {
             ERROR("unable to create shared connection for registration.");
             DNSServiceRefDeallocate(sdref);
             return false;
         }
         INFO("shared_discovery_txn = %p  sdref = %p", shared_discovery_txn, sdref);
     }
 }
 #endif // SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS

 void
 dp_start_dropping(void)
 {
     if (connection_dropper == NULL) {
         connection_dropper = ioloop_wakeup_create();
         if (connection_dropper == NULL) {
             ERROR("can't create connection dropper.");
             return;
         }
     }
     ioloop_add_wake_event(connection_dropper, NULL, dp_drop_connections, NULL, 90 * 1000);
 }

 static void
 dp_drop_connections(void *UNUSED context)
 {
     for (dso_state_t *dso = dso_connections; dso != NULL; dso = dso->next) {
         if (dso->cb == dns_push_callback) {
             dp_tracker_t *tracker = dso->context;
             INFO("dropping connection for " PRI_S_SRP ".", dso->remote_name);
             if (tracker->connection != NULL) {
                 ioloop_comm_cancel(tracker->connection);
             }
         }
     }
     dp_start_dropping();
 }

 static void
 dp_tracker_finalize(dp_tracker_t *tracker)
 {
     // At this point tracker should have nothing attached to it that we need to get rid of, except maybe the
     // wakeup timer.
     if (tracker->idle_timeout != NULL) {
         ioloop_wakeup_release(tracker->idle_timeout);
     }
     // The only case where tracker->connection should still exist at this point is when the connection turned
     // out to be an srp replication connection.
     if (tracker->connection) {
         ioloop_comm_release(tracker->connection);
     }
     free(tracker);
 }

 static void
 dp_answer_free(answer_t *answer)
 {
     if (answer != NULL) {
         free(answer->fullname);
         free(answer);
     }
 }

 static void
 dp_question_answers_free(question_t *question)
 {
     // De-allocate answers
     answer_t *answer = question->answers;
     answer_t *next;
     while (answer != NULL) {
         next = answer->next;
         dp_answer_free(answer);
         answer = next;
     }
     question->answers = NULL;
 }

 // The finalize function will deallocate answers associated with the question,
 // remove question from the question list and deallocate the question.
 static void
 question_finalize(question_t *question)
 {
     INFO("[QU%d] type %d class %d " PRI_S_SRP, SERIAL(question), question->type, question->qclass, question->name);
     dp_question_answers_free(question);
     free(question->name);
     free(question);
 }

 static void
 dp_question_cancel(question_t *question)
 {
     if (question->txn != NULL) {
         INFO("[QU%d] question->txn = %p sdref=%p", SERIAL(question), question->txn, question->txn->sdref);
         ioloop_dnssd_txn_cancel(question->txn);
         ioloop_dnssd_txn_release(question->txn);
         question->txn = NULL;
     }

     // Remove the question from its list.
     question_t **questions, *q_cur;
     if (question->served_domain != NULL) {
         questions = &question->served_domain->questions;
     } else {
         questions = &questions_without_domain;
     }
     while (*questions != NULL ) {
         q_cur = *questions;
         if (q_cur == question) {
             *questions = q_cur->next;
             break;
         } else {
             questions = &q_cur->next;
         }
     }
     // If this was the last question, see if the served domain is still on the served domain list; if not,
     // this is the last reference, so free it.
     if (question->served_domain != NULL && question->served_domain->questions == NULL) {
         served_domain_t *served_domain;
         for (served_domain = served_domains; served_domain; served_domain = served_domain->next) {
             if (served_domain == question->served_domain) {
                 break;
             }
         }
         if (served_domain == NULL) {
             served_domain_free(question->served_domain);
         }
     }
     RELEASE_HERE(question, question); // Release from the list.
 }

 // Called when the last reference on the query has been released.
 static void
 dnssd_query_finalize(void *context)
 {
     dnssd_query_t *query = context;
     if (query->tracker != NULL) {
         RELEASE_HERE(query->tracker, dp_tracker);
         query->tracker = NULL;
     }
     if (query->message != NULL) {
         ioloop_message_release(query->message);
         query->message = NULL;
     }
     if (query->wakeup != NULL) {
         ioloop_wakeup_release(query->wakeup);
         query->wakeup = NULL;
     }
     if (query->response != NULL) {
         free(query->response);
         query->response = NULL;
     }
     if (query->response_msg != NULL) {
         dns_message_free(query->response_msg);
         query->response_msg = NULL;
     }
     if (query->question != NULL) {
         RELEASE_HERE(query->question, question);
         query->question = NULL;
     }
     free(query);
     dp_num_outstanding_queries--;
 }

 // Remove any finished queries from the question cache query list.
 static void
 dp_question_cache_remove_queries(question_t *question)
 {
     // Convenience
     if (question == NULL) {
         return;
     }

     dnssd_query_t **pptr = &(question->queries);
     RETAIN_HERE(question, question);
     if (question->queries != NULL) {
         while (*pptr != NULL) {
             dnssd_query_t *cquery = *pptr;
             if (cquery->satisfied) {
                 *pptr = cquery->question_next;
                 RELEASE_HERE(cquery, dnssd_query);
             } else {
                 pptr = &cquery->question_next;
             }
         }
         if (question->queries == NULL) {
             dp_question_cancel(question);
         }
     }
     RELEASE_HERE(question, question);
 }

 static void
 dp_tracker_context_release(void *context)
 {
     dp_tracker_t *tracker = context;
     RELEASE_HERE(tracker, dp_tracker);
 }

 static void
 dp_tracker_went_away(dp_tracker_t *tracker)
 {
     // Reduce the number of outstanding connections (should never go below zero).
     if (tracker->session_type == dp_tracker_session_push) {
         if (--num_push_sessions < 0) {
             FAULT("DNS Push connection count went negative");
             num_push_sessions = 0;
         } else {
             INFO("[TRK%d][DSO%d][C%d] dso connection count dropped: %d", SERIAL(tracker), SERIAL(tracker->dso), SERIAL(tracker->connection), num_push_sessions);
         }
     }
 }

 static void
 dp_tracker_idle(void *context)
 {
     dp_tracker_t *tracker = context;
     // Shouldn't be NULL.
     if (tracker->connection != NULL) {
         comm_t *connection = tracker->connection;
         INFO("[TRK%d][DSO%d][C%d] tracker for connection " PRI_S_SRP " has gone idle.",
              SERIAL(tracker), SERIAL(tracker->dso), SERIAL(connection), connection->name);

         // If the connection is already disconnected, it's already released its reference to the tracker. If not,
         // the release below will release tracker as a side effect. So in case tracker survives, clear the
         // connection pointer.
         tracker->connection = NULL;
         // The POSIX ioloop just hands us the "listener", which we do not want to cancel.
         if (!connection->is_listener) {
             ioloop_comm_cancel(connection);
         }
         ioloop_comm_release(connection);
     }
 }

 static void
 dp_tracker_idle_after(dp_tracker_t *tracker, int seconds, dnssd_query_t *query)
 {
     if (tracker->connection != NULL && !tracker->connection->is_listener &&
         tracker->dso == NULL && (query == NULL ||
                                  (tracker->dns_queries == NULL ||
                                   (tracker->dns_queries == query && query->next == NULL))))
     {
         if (tracker->idle_timeout == NULL) {
             tracker->idle_timeout = ioloop_wakeup_create();
         }
         if (tracker->idle_timeout == NULL) {
             ERROR("[TRK%d] no memory for idle timeout", SERIAL(tracker));
         } else {
             ioloop_add_wake_event(tracker->idle_timeout, tracker, dp_tracker_idle, dp_tracker_context_release, seconds * MSEC_PER_SEC);
             RETAIN_HERE(tracker, dp_tracker);
         }
     }
 }

 static bool
 dp_same_message(message_t *a, message_t *b)
 {
     // Code commented out below catches retransmissions, but right now this won't work and we'll leak queries,
     // so saving it for rdar://111808637 (dnssd-proxy is way too complicated)
     if (a == b /*  || (a != NULL && b != NULL && a->wire.id == b->wire.id) */ ) {
         return true;
     }
     return false;
 }

 // Called at any time (prior to release!) to cancel a query.
 static void
 dnssd_query_cancel(dnssd_query_t *query)
 {
     INFO("[Q%d][QU%d] " PRI_S_SRP PUB_S_SRP PUB_S_SRP, SERIAL(query), SERIAL(query->question),
          query->question == NULL ? "<null>" : query->question->name,
          query->question == NULL ? "" : ((query->question->served_domain
                                           ? (query->question->served_domain->interface
                                              ? DOT_LOCAL
                                              : query->question->served_domain->domain_ld)
                                           : "")),
          query->canceled ? " canceled" : "");
     // Avoid double-cancellation
     if (query->canceled) {
         return;
     }
     // Retain the query for the duration of dnssd_query_cancel so that it doesn't get finalized while we are working on it.
     RETAIN_HERE(query, dnssd_query);
     query->canceled = true; // prevent double-cancellation
     if (query->tracker != NULL) {
         dp_tracker_t *tracker = query->tracker;

         // Retain the tracker so it doesn't get released while we are working on it.
         RETAIN_HERE(tracker, dp_tracker);

         if (query->dso == NULL) {
             bool unsatisfied = false;
             for (dnssd_query_t *list_query = tracker->dns_queries; list_query != NULL; list_query = list_query->next) {
                 if (dp_same_message(query->message, list_query->message)) {
                     if (!query->satisfied) {
                         unsatisfied = true;
                     }
                 }
             }

             if (!unsatisfied) {
                 // Scan the list freeing all queries relating to the message attached to the query that's been canceled.
                 // A UDP message will never have any other queries, but TCP connections can have multiple messages.
                 for (dnssd_query_t **qp = &tracker->dns_queries; *qp != NULL; ) {
                     dnssd_query_t *list_query = *qp;

                     // Release the current query either if it's the query that's being canceled, or this is a UDP message.
                     if (dp_same_message(query->message, list_query->message)) {
                         *qp = list_query->next;

                         // This might release the query, but we know that the tracker holds a reference to it, so
                         // we don't need another reference to it.
                         if (list_query->wakeup != NULL) {
                             ioloop_wakeup_release(list_query->wakeup);
                             list_query->wakeup = NULL;
                         }

                         // Release this query's reference to the tracker
                         RELEASE_HERE(tracker, dp_tracker);
                         list_query->tracker = NULL;

                         // The tracker was holding a reference to the query.
                         RELEASE_HERE(list_query, dnssd_query);
                     } else {
                         qp = &list_query->next;
                     }
                 }
             }
         } else {
             // For DNS Push queries, drop the activity, which will release the query.
             if (query->activity != NULL && query->dso != NULL) {
                 dso_activity_t *activity = query->activity;
                 dso_state_t *dso = query->dso;
                 dso_drop_activity(dso, activity);
                 query->activity = NULL;
             }
             // Now release the reference the query had on the tracker.
             query->tracker = NULL;
             RELEASE_HERE(tracker, dp_tracker);
         }

         // For TCP connections, wait for it to become idle before closing.
         if (tracker->connection != NULL && tracker->dns_queries == NULL) {
             if (tracker->connection->tcp_stream) {
                 dp_tracker_idle_after(tracker, 15, query);
             } else {
 #if UDP_LISTENER_USES_CONNECTION_GROUPS
                 ioloop_comm_cancel(tracker->connection);
 #else
                 ioloop_comm_release(tracker->connection);
                 tracker->connection = NULL;
 #endif
             }
         }

         // Release the reference we retained on entry.
         RELEASE_HERE(tracker, dp_tracker);
     } else {
         if (query->wakeup != NULL) {
             ioloop_wakeup_release(query->wakeup);
             query->wakeup = NULL;
         }
     }
     query->satisfied = true;
     RELEASE_HERE(query, dnssd_query);
 }

 static void
 dp_query_track(dp_tracker_t *tracker, dnssd_query_t *query)
 {
     dnssd_query_t **qp = &tracker->dns_queries;

     while (*qp != NULL) {
         if (*qp == query) {
             ERROR("[Q%d][TRK%d] query is already being tracked.", SERIAL(query), SERIAL(query->tracker));
             return;
         }
         qp = &(*qp)->next;
     }
     *qp = query;
     RETAIN_HERE(query, dnssd_query);
 }

 static void
 dp_tracker_disconnected(comm_t *UNUSED connection, void *context, int UNUSED error)
 {
     dp_tracker_t *tracker = context;
     dnssd_query_t *dns_queries = tracker->dns_queries, **qp, *query;
     comm_t *tracker_connection = tracker->connection;
     tracker->connection = NULL;
     tracker->dns_queries = NULL;

     INFO("[TRK%d][DSO%d][C%d] queries %p", SERIAL(tracker), SERIAL(tracker->dso), SERIAL(tracker_connection), dns_queries);

     // If there is a DSO state outstanding on the tracker, cancel any activities connected to it.
     if (tracker->dso != NULL) {
         dso_activity_t *activity = tracker->dso->activities;
         while (activity != NULL) {
             dso_drop_activity(tracker->dso, tracker->dso->activities);
             // Failsafe in case dso_drop_activity for some reason doesn't drop the activity.
             if (tracker->dso->activities == activity) {
                 break;
             }
             activity = tracker->dso->activities;
         }
         dso_state_cancel(tracker->dso);
         dp_tracker_went_away(tracker);
         tracker->session_type = dp_tracker_session_none;
         tracker->dso = NULL;
     }

     // We probably still have the connection object at this point, so we should release it, which could
     // in turn finalize the tracker.
     if (tracker_connection != NULL) {
         ioloop_comm_release(tracker_connection);
         tracker->connection = NULL;
     }

     // If dns_queries is non-null, tracker still exists, but it might go away when we cancel the last
     // query.
     qp = &dns_queries;
     while (*qp != NULL) {
         query = *qp;
         *qp = query->next;
         RELEASE_HERE(query, dnssd_query);
     }
 }

 static void
 dns_push_cancel(dso_activity_t *activity)
 {
     dnssd_query_t *query = (dnssd_query_t *)activity->context;
     INFO("[Q%d][QU%d] " PUB_S_SRP, SERIAL(query), SERIAL(query->question), activity->name);
     // We can either get here because the dso object is being finalized, or because the activity is being dropped.
     // In the former case, we need to cancel the query. In the latter case, we've been called as a result of
     // dnssd_query_cancel calling dso_drop_activity. dnssd_query_cancel sets query->activity to NULL before dropping
     // it, so we mustn't call back in to dnssd_query_cancel.
     if (query->activity != NULL) {
         query->activity = NULL;
         query->satisfied = true;
         dp_question_cache_remove_queries(query->question);
         dnssd_query_cancel(query);
     }
     // The activity held a reference to the query.
     RELEASE_HERE(query, dnssd_query);
 }

 static void
 dp_tracker_not_idle(dp_tracker_t *tracker)
 {
     if (tracker->idle_timeout) {
         ioloop_cancel_wake_event(tracker->idle_timeout);
     }
 }

 static served_domain_t *
 dp_served(dns_name_t *name, char *buf, size_t bufsize)
 {
     served_domain_t *sdt;
     dns_label_t *lim;

     for (sdt = served_domains; sdt; sdt = sdt->next) {
         if ((lim = dns_name_subdomain_of(name, sdt->domain_name))) {
             dns_name_print_to_limit(name, lim, buf, bufsize);
             return sdt;
         }
     }
     return NULL;
 }

 static bool
 is_in_local_domain(const dns_name_t *const NONNULL name)
 {
     const dns_label_t *prev_root_label;
     const dns_label_t *root_label;

     for (prev_root_label = NULL, root_label = name;
          root_label->next != NULL;
          prev_root_label = root_label, root_label = root_label->next)
         ;

     if (prev_root_label == NULL) {
         return false;
     }

 #define LOCAL_DOMAIN_LABEL "local"
     if (prev_root_label->len != strlen(LOCAL_DOMAIN_LABEL)) {
         return false;
     }

     if (!dns_labels_equal(prev_root_label->data, LOCAL_DOMAIN_LABEL, strlen(LOCAL_DOMAIN_LABEL))) {
         return false;
     }
 #undef LOCAL_DOMAIN_LABEL

     return true;
 }

 // Utility function to find "local" on the end of a string of labels.
 static bool
 truncate_local(dns_name_t *name)
 {
     dns_label_t *lp, *prev, *prevprev;

     prevprev = prev = NULL;
     // Find the root label.
     for (lp = name; lp && lp->len; lp = lp->next) {
         prevprev = prev;
         prev = lp;
     }
     if (lp && prev && prevprev) {
         if (prev->len == 5 && dns_labels_equal(prev->data, "local", 5)) {
             dns_name_free(prev);
             prevprev->next = NULL;
             return true;
         }
     }
     return false;
 }

 static bool
 dp_query_add_data_to_response(dnssd_query_t *query, const char *fullname, uint16_t rrtype, uint16_t rrclass,
                               uint16_t rdlen, const void *rdata, int32_t ttl, const bool hardwired_response,
                               bool dont_elide, uint16_t *counter)
 {
     bool record_added;
     dns_towire_state_t *towire = &query->towire;
     const char *failnote = NULL;
     const uint8_t *rd = rdata;
     char pbuf[DNS_MAX_NAME_SIZE + 1];
     char rbuf[DNS_MAX_NAME_SIZE + 1];
     uint8_t *revert = query->towire.p; // Remember where we were in case there's no room.
     question_t *question = query->question;

     // Only do the translation if:
     // 1. We serve the domain.
     // 2. The response we will add does not come from our hardwired response set.
     const bool translate = (question->served_domain != NULL) && (!hardwired_response);

     if (rdlen == 0) {
         INFO("[Q%d][QU%d] eliding zero-length response for " PRI_S_SRP " " PUB_S_SRP " %d",
              SERIAL(query), SERIAL(question), fullname, dns_rrtype_to_string(rrtype), rrclass);
         record_added = false;
         goto exit;
     }
     // Don't send A records for 127.* nor AAAA records for ::1
     if (dont_elide) {
     } else if (rrtype == dns_rrtype_a && rdlen == 4) {
         // Should use IN_LINKLOCAL and IN_LOOPBACK macros here, but for some reason they are not present on
         // OpenWRT.
         if (rd[0] == 127) {
             IPv4_ADDR_GEN_SRP(rd, rd_buf);
             INFO("[Q%d][QU%d] eliding localhost response for " PRI_S_SRP ": " PRI_IPv4_ADDR_SRP,
                  SERIAL(query), SERIAL(question), fullname, IPv4_ADDR_PARAM_SRP(rd, rd_buf));
             record_added = false;
             goto exit;
         }
         if (rd[0] == 169 && rd[1] == 254) {
             IPv4_ADDR_GEN_SRP(rd, rd_buf);
             INFO("[Q%d][QU%d] eliding link-local response for " PRI_S_SRP ": " PRI_IPv4_ADDR_SRP,
                  SERIAL(query), SERIAL(question), fullname, IPv4_ADDR_PARAM_SRP(rd, rd_buf));
             record_added = false;
             goto exit;
         }
     } else if (rrtype == dns_rrtype_aaaa && rdlen == 16) {
         struct in6_addr addr = *(struct in6_addr *)rdata;
         if (IN6_IS_ADDR_LOOPBACK(&addr)) {
             SEGMENTED_IPv6_ADDR_GEN_SRP(rdata, rdata_buf);
             INFO("[Q%d][QU%d] eliding localhost response for " PRI_S_SRP ": " PRI_SEGMENTED_IPv6_ADDR_SRP,
                  SERIAL(query), SERIAL(question), fullname, SEGMENTED_IPv6_ADDR_PARAM_SRP(rdata, rdata_buf));
             record_added = false;
             goto exit;
         }
         if (IN6_IS_ADDR_LINKLOCAL(&addr)) {
             SEGMENTED_IPv6_ADDR_GEN_SRP(rdata, rdata_buf);
             INFO("[Q%d][QU%d] eliding link-local response for " PRI_S_SRP ": " PRI_SEGMENTED_IPv6_ADDR_SRP,
                  SERIAL(query), SERIAL(question), fullname, SEGMENTED_IPv6_ADDR_PARAM_SRP(rdata, rdata_buf));
             record_added = false;
             goto exit;
         }
     }
     INFO("survived for rrtype " PUB_S_SRP " rdlen %d", dns_rrtype_to_string(rrtype), rdlen);

     if (query->dso != NULL) {
         dns_push_start(query);
     }
     // Rewrite the domain if it's .local.
     if (question->served_domain != NULL) {
         TOWIRE_CHECK("concatenate_name_to_wire", towire,
                      dns_concatenate_name_to_wire(towire, NULL, question->name, question->served_domain->domain));
         INFO("[Q%d][QU%d] " PUB_S_SRP " answer:  type " PUB_S_SRP " class %02d " PRI_S_SRP "." PRI_S_SRP, SERIAL(query), SERIAL(question),
              query->dso != NULL ? "PUSH" : "DNS ", dns_rrtype_to_string(rrtype), rrclass, question->name, question->served_domain->domain);
     } else {
         TOWIRE_CHECK("compress_name_to_wire", towire, dns_concatenate_name_to_wire(towire, NULL, NULL, question->name));
         INFO("[Q%d][QU%d] " PUB_S_SRP " answer:  type " PUB_S_SRP " class %02d " PRI_S_SRP " (p)",
              SERIAL(query), SERIAL(question), query->dso != NULL ? "push" : " dns", dns_rrtype_to_string(rrtype), rrclass, question->name);
     }
     TOWIRE_CHECK("rrtype", towire, dns_u16_to_wire(towire, rrtype));
     TOWIRE_CHECK("rrclass", towire, dns_u16_to_wire(towire, rrclass));
     TOWIRE_CHECK("ttl", towire, dns_ttl_to_wire(towire, ttl));

     // If necessary, correct domain names inside of rrdata.
     dns_rr_t answer;
     dns_name_t *name;
     unsigned offp = 0;

     answer.type = rrtype;
     answer.qclass = rrclass;
     if (dns_rdata_parse_data(&answer, rdata, &offp, rdlen, rdlen, 0)) {
         switch(rrtype) {
             case dns_rrtype_cname:
             case dns_rrtype_ptr:
             case dns_rrtype_ns:
             case dns_rrtype_md:
             case dns_rrtype_mf:
             case dns_rrtype_mb:
             case dns_rrtype_mg:
             case dns_rrtype_mr:
             case dns_rrtype_nsap_ptr:
             case dns_rrtype_dname:
                 name = answer.data.ptr.name;
                 TOWIRE_CHECK("rdlength begin", towire, dns_rdlength_begin(towire));
                 break;
             case dns_rrtype_srv:
                 name = answer.data.srv.name;
                 TOWIRE_CHECK("rdlength begin", towire, dns_rdlength_begin(towire));
                 TOWIRE_CHECK("answer.data.srv.priority", towire, dns_u16_to_wire(towire, answer.data.srv.priority));
                 TOWIRE_CHECK("answer.data.srv.weight", towire, dns_u16_to_wire(towire, answer.data.srv.weight));
                 TOWIRE_CHECK("answer.data.srv.port", towire, dns_u16_to_wire(towire, answer.data.srv.port));
                 break;
             default:
                 INFO("[Q%d][QU%d] record type " PUB_S_SRP " not translated", SERIAL(query), SERIAL(question), dns_rrtype_to_string(rrtype));
                 dns_rrdata_free(&answer);
                 goto raw;
         }

         dns_name_print(name, rbuf, sizeof rbuf);

         if (translate && is_in_local_domain(name)) {
             // If the response requires the translation from <served domain> to ".local." and the response ends in
             // ".local.", truncate it.
             truncate_local(name);
             dns_name_print(name, pbuf, sizeof pbuf);
             TOWIRE_CHECK("concatenate_name_to_wire 2", towire,
                          dns_concatenate_name_to_wire(towire, name, NULL, question->served_domain->domain));
             INFO("[Q%d][QU%d] translating " PRI_S_SRP " to " PRI_S_SRP " . " PRI_S_SRP,
                  SERIAL(query), SERIAL(question), rbuf, pbuf, question->served_domain->domain);
         } else {
             TOWIRE_CHECK("concatenate_name_to_wire 2", towire,
                          dns_concatenate_name_to_wire(towire, name, NULL, NULL));
             INFO("[Q%d][QU%d] compressing " PRI_S_SRP, SERIAL(query), SERIAL(question), rbuf);
         }

         dns_name_free(name);
         dns_rdlength_end(towire);
     } else {
         ERROR("[Q%d][QU%d] rdata from mDNSResponder didn't parse!!", SERIAL(query), SERIAL(question));
     raw:
         TOWIRE_CHECK("rdlen", towire, dns_u16_to_wire(towire, rdlen));
         TOWIRE_CHECK("rdata", towire, dns_rdata_raw_data_to_wire(towire, rdata, rdlen));
     }

     if (towire->truncated || failnote) {
         ERROR("[Q%d][QU%d] RR ADD FAIL: " PUB_S_SRP, SERIAL(query), SERIAL(question), failnote);
         query->towire.p = revert;
         record_added = false;
         goto exit;
     }

     record_added = true;
     if (counter != NULL && query->dso == NULL) {
         *counter = htons(ntohs(*counter) + 1);
     }
 exit:
     return record_added;
 }

 static void
 dnssd_hardwired_add(served_domain_t *sdt,
                     const char *name, const char *domain, size_t rdlen, const uint8_t *rdata, uint16_t type)
 {
     hardwired_t *hp, **hrp;
     size_t namelen = strlen(name);
     size_t domainlen = strlen(domain);
     size_t total = sizeof *hp;
     uint8_t *trailer;
     total += rdlen; // Space for RDATA
     total += namelen; // Space for name
     total += 1; // NUL
     total += namelen;// space for FQDN
     total += domainlen;
     total += 1; // NUL

     hp = calloc(1, total + 4);
     if (hp == NULL) {
         ERROR("no memory for %s %s", name, domain);
         return;
     }
     trailer = ((uint8_t *)hp) + total;
     memcpy(trailer, "abcd", 4);
     hp->rdata = (uint8_t *)(hp + 1);
     hp->rdlen = rdlen;
     memcpy(hp->rdata, rdata, rdlen);
     hp->name = (char *)hp->rdata + rdlen;
     memcpy(hp->name, name, namelen);
     hp->name[namelen] = '\0';
     hp->fullname = hp->name + namelen + 1;
     if (namelen != 0) {
         snprintf(hp->fullname, namelen + domainlen + 1, "%s%s", name, domain);
     } else {
         memcpy(hp->fullname, domain, domainlen);
         hp->fullname[domainlen] = '\0';
     }
     if (hp->fullname + strlen(hp->fullname) + 1 != (char *)hp + total) {
         ERROR("%p != %p", hp->fullname + strlen(hp->fullname) + 1, ((char *)hp) + total);
         return;
     }
     if (memcmp(trailer, "abcd", 4)) {
         ERROR("ran off the end.");
         return;
     }
     hp->type = type;
     hp->next = NULL;

     // Store this new hardwired_t at the end of the list unless a hardwired_t with the same name
     // is already on the list.   If it is, splice it in.
     for (hrp = &sdt->hardwired_responses; *hrp != NULL; hrp = &(*hrp)->next) {
         hardwired_t *old = *hrp;
         if (old->type != hp->type) {
             continue;
         }
         if (strcasecmp(old->fullname, hp->fullname) != 0) {
             continue;
         }
         // The same name and type
         bool superseded;
         switch (type) {
             case dns_rrtype_a:
             case dns_rrtype_aaaa:
             case dns_rrtype_ns:
             case dns_rrtype_ptr:
                 superseded = false;
                 break;
             default:
                 // dns_rrtype_soa
                 // dns_rrtype_srv
                 superseded = true;
                 break;
         }

         if (superseded) {
             INFO("superseding " PRI_S_SRP " name " PRI_S_SRP " type %d rdlen %d", old->fullname,
                  old->name, old->type, old->rdlen);
             hp->next = old->next;
             free(old);
         } else {
             INFO("inserting before " PRI_S_SRP " name " PRI_S_SRP " type %d rdlen %d", old->fullname,
                  old->name, old->type, old->rdlen);
             hp->next = old;
         }
         break;
     }
     *hrp = hp;

     INFO("fullname " PRI_S_SRP " name " PRI_S_SRP " type %d rdlen %d",
          hp->fullname, hp->name, hp->type, hp->rdlen);
 }

 #if STUB_ROUTER
 static bool
 dnssd_hardwired_remove_record(served_domain_t *const NONNULL sdt, const char *const NONNULL name, const char *const NONNULL domain, size_t rdlen,
     const void *const NULLABLE rdata, uint16_t type)
 {
     bool removed;
     hardwired_t *prev = NULL;
     hardwired_t *current;
     char full_name[DNS_MAX_NAME_SIZE + 1];

     int bytes_written = snprintf(full_name, sizeof(full_name), "%s%s", name, domain);
     require_action_quiet(bytes_written > 0 && (size_t)bytes_written < sizeof(full_name), exit, removed = false;
         ERROR("snprintf truncates the string - name length: %zu, domain length: %zu, buffer length: %zu",
             strlen(name), strlen(domain), sizeof(full_name))
     );

     for (current = sdt->hardwired_responses; current != NULL; prev = current, current = current->next) {
         if (current->type != type) {
             continue;
         }
         if (rdata != NULL && current->rdlen != rdlen) {
             continue;
         }
         if (strcasecmp(current->fullname, full_name) != 0) {
             continue;
         }
         if (rdata != NULL && memcmp(current->rdata, rdata, rdlen) != 0) {
             continue;
         }
         // record found
         break;
     }
     require_action_quiet(current != NULL, exit, removed = false;
         ERROR("no matching hardwired_t found - record name: " PUB_S_SRP ", record type: %d", full_name, type));

     if (prev != NULL) {
         prev->next = current->next;
     } else {
         sdt->hardwired_responses = current->next;
     }
     free(current);

     removed = true;
 exit:
     return removed;
 }

 static bool
 dnssd_hardwired_add_or_remove_addr_record(served_domain_t *const NONNULL sdt, const addr_t *const NONNULL addr,
     const char *const NONNULL name, bool add)
 {
     dns_wire_t wire;
     dns_towire_state_t towire;
     bool succeeded;

     memset(&towire, 0, sizeof towire);
     towire.message = &wire;
     towire.p = wire.data;
     towire.lim = towire.p + sizeof wire.data;

     const void *rdata_ptr;
     size_t addr_len;
     uint16_t addr_type;
     if (addr->sa.sa_family == AF_INET) {
         rdata_ptr = &addr->sin.sin_addr;
         addr_len = sizeof(addr->sin.sin_addr);
         addr_type = dns_rrtype_a;
     } else { // addr.sa.sa_family == AF_INET6
         rdata_ptr = &addr->sin6.sin6_addr;
         addr_len = sizeof(addr->sin6.sin6_addr);
         addr_type = dns_rrtype_aaaa;
     }
     dns_rdata_raw_data_to_wire(&towire, rdata_ptr, addr_len);

     if (add) {
         dnssd_hardwired_add(sdt, name, name[0] == '\0' ? sdt->domain : sdt->domain_ld, towire.p - wire.data, wire.data,
             addr_type);
         succeeded = true;
     } else {
         succeeded = dnssd_hardwired_remove_record(sdt, name,  name[0] == '\0' ? sdt->domain : sdt->domain_ld,
             towire.p - wire.data, wire.data, addr_type);
     }

     return succeeded;
 }

 static bool
 dnssd_hardwired_add_or_remove_address_in_domain(const char *const NONNULL name,
     const char *const NONNULL domain_to_change, const addr_t *const NONNULL address, const bool add)
 {
     bool succeeded;

     served_domain_t *served_domain = find_served_domain(domain_to_change);
     require_action_quiet(served_domain != NULL, exit, succeeded = false;
         ERROR("could not find served domain with the specified domain name - domain name: " PRI_S_SRP, domain_to_change)
     );

     succeeded = dnssd_hardwired_add_or_remove_addr_record(served_domain, address, name, add);
     require_action_quiet(succeeded, exit, succeeded = false;
         ERROR("failed to " PUB_S_SRP " address record - domain name: " PRI_S_SRP,
             domain_to_change, add ? "add" : "remove")
     );

 exit:
     return succeeded;
 }

 static bool
 dnssd_hardwired_generate_ptr_name(const addr_t *const NONNULL addr, const addr_t *const NONNULL mask,
                                   char *name_buf, size_t buf_size)
 {
     char *name_ptr = name_buf;
     const char *const name_limit = name_ptr + buf_size;
     int bytes_written;
     bool succeeded;

 #define RESET \
     memset(&towire, 0, sizeof towire); \
     towire.message = &wire; \
     towire.p = wire.data; \
     towire.lim = towire.p + sizeof wire.data

     bytes_written = snprintf(name_ptr, name_limit - name_ptr, SRV_TYPE_FOR_AUTOMATIC_BROWSING_DOMAIN);
     require_action_quiet(bytes_written > 0 && bytes_written < name_limit - name_ptr, exit, succeeded = false;
         ERROR("snprintf truncates the string - bytes_written: %d, limit: %zd", bytes_written, name_limit - name_ptr));
     name_ptr += bytes_written;


     if (addr->sa.sa_family == AF_INET) {
         const uint32_t subnet = (ntohl(addr->sin.sin_addr.s_addr) & ntohl(mask->sin.sin_addr.s_addr));
         bytes_written = snprintf(name_ptr, name_limit - name_ptr, ".%u.%u.%u.%u",
             subnet & 0xFFU, (subnet >> 8) & 0xFFU, (subnet >> 16) & 0xFFU, (subnet >> 24) & 0xFFU);
         require_action(bytes_written > 0 && bytes_written < name_limit - name_ptr, exit, succeeded = false);
         // Remember to increase the name_ptr by bytes_written bytes if name_ptr is used later.

     } else if (addr->sa.sa_family == AF_INET6) {
         const uint8_t *const addr_bytes = addr->sin6.sin6_addr.s6_addr;
         const uint8_t *const mask_bytes = mask->sin6.sin6_addr.s6_addr;
         for (int i = 15; i >= 0; i--) {
             for (int shift = 0; shift < 8; shift += 4) {
                 bytes_written = snprintf(name_ptr, name_limit - name_ptr, ".%x",
                     (addr_bytes[i] >> shift) & (mask_bytes[i] >> shift) & 15);
                 require_action_quiet(bytes_written > 0 && bytes_written < name_limit - name_ptr, exit, succeeded = false;
                     ERROR("snprintf truncates the string - bytes_written: %d, limit: %zd",
                         bytes_written, name_limit - name_ptr)
                 );
                 name_ptr += bytes_written;
             }
         }

     } else {
         FAULT("skipping address type other than IPv4/IPv6 - type: %u", addr->sa.sa_family);
         succeeded = false;
         goto exit;
     }

     succeeded = true;
 exit:
     return succeeded;
 }

 static bool
 dnssd_hardwired_add_or_remove_ptr_record(served_domain_t *const NONNULL sdt, const addr_t *const NONNULL addr,
     const addr_t *const NONNULL mask, bool add)
 {
     char name[DNS_MAX_NAME_SIZE + 1];
     dns_wire_t wire;
     dns_towire_state_t towire;
     bool succeeded;

 #define RESET \
     memset(&towire, 0, sizeof towire); \
     towire.message = &wire; \
     towire.p = wire.data; \
     towire.lim = towire.p + sizeof wire.data

     succeeded = dnssd_hardwired_generate_ptr_name(addr, mask, name, sizeof(name));
     if (!succeeded) {
         INFO("address is not eligible to construct PTR record");
         goto exit;
     }

     for (served_domain_t *if_domain = served_domains; if_domain != NULL; if_domain = if_domain->next) {
         if (if_domain->interface == NULL || if_domain->interface->ifindex == 0) {
             continue;
         }
         RESET;
         INFO(PUB_S_SRP " PTR from " PRI_S_SRP " to " PRI_S_SRP, add ? "Adding" : "Removing", name, if_domain->domain);
         dns_full_name_to_wire(NULL, &towire, if_domain->domain);

         if (add) {
             dnssd_hardwired_add(sdt, name, sdt->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_ptr);
             succeeded = true;
         } else {
             succeeded = dnssd_hardwired_remove_record(sdt, name, sdt->domain_ld, towire.p - wire.data, wire.data,
                 dns_rrtype_ptr);
         }
     }

 exit:
     return succeeded;
 }

 static bool
 dnssd_hardwired_add_or_remove_ptr_in_domain(const char *const NONNULL domain_to_change,
     const addr_t *const NONNULL address, const addr_t *const NONNULL mask, const bool add)
 {
     bool succeeded;

     served_domain_t *served_domain = find_served_domain(domain_to_change);
     require_action_quiet(served_domain != NULL, exit, succeeded = false;
         ERROR("could not find served domain with the specified domain name - domain name: " PRI_S_SRP, domain_to_change)
     );

     succeeded = dnssd_hardwired_add_or_remove_ptr_record(served_domain, address, mask, add);
     require_action_quiet(succeeded, exit, succeeded = false;
         ERROR("failed to " PUB_S_SRP " address record - domain name: " PRI_S_SRP,
             add ? "adding" : "removing", domain_to_change)
     );

 exit:
     return succeeded;
 }

 static bool
 is_valid_address_to_publish(const addr_t *const NONNULL address)
 {
     bool is_valid = true;

     if (address->sa.sa_family == AF_INET) {
         const struct in_addr *const ipv4_address = &(address->sin.sin_addr);
         const bool is_linklocal = is_in_addr_link_local(ipv4_address);
         const bool is_loopback = is_in_addr_loopback(ipv4_address);

         if (is_linklocal || is_loopback) {
             IPv4_ADDR_GEN_SRP(&ipv4_address, ipv4_address_buf);
             INFO("ignoring the address for interface - address: " PRI_IPv4_ADDR_SRP ", address type: " PUB_S_SRP ".",
                 IPv4_ADDR_PARAM_SRP(&ipv4_address, ipv4_address_buf), is_linklocal ? "link local" : "loopback");
             is_valid = false;
         }

     } else if (address->sa.sa_family == AF_INET6) {
         const struct in6_addr *const ipv6_address = &(address->sin6.sin6_addr);
         const bool is_linklocal = IN6_IS_ADDR_LINKLOCAL(ipv6_address);
         const bool is_loopback = IN6_IS_ADDR_LOOPBACK(ipv6_address);

         if (is_linklocal || is_loopback) {
             IPv6_ADDR_GEN_SRP(ipv6_address->s6_addr, ipv6_address_buf);
             INFO("ignoring the address for interface - address: " PRI_IPv6_ADDR_SRP ", address type: " PUB_S_SRP ".",
                 IPv6_ADDR_PARAM_SRP(ipv6_address->s6_addr, ipv6_address_buf), is_linklocal ? "link local" : "loopback");
             is_valid = false;
         }

     } else {
         // It is possible that MAC address is added for the interface, so ignore it.
         INFO("Non IPv4/IPv6 address added for the interface - sa_family: %u", address->sa.sa_family);
         is_valid = false;
     }

     return is_valid;
 }

 static bool
 dnssd_hardwired_process_addr_change(const addr_t *const NONNULL addr, const addr_t *const NONNULL mask, const bool add)
 {
     bool succeeded;

     if (!is_valid_address_to_publish(addr)) {
         succeeded = true;
         goto exit;
     }

     // Update the <local host name>.home.arpa. address mapping.
     succeeded = dnssd_hardwired_add_or_remove_address_in_domain("", my_name, addr, add);
     if (!succeeded) {
         ERROR("failed to update address record for domain - domain: " PRI_S_SRP, my_name);
         goto exit;
     }

     // Update the <local host name>.<Thread ID>.thread.home.arpa. address mapping.
     succeeded = dnssd_hardwired_add_or_remove_address_in_domain(local_host_name, THREAD_DOMAIN_WITH_ID, addr, add);
     if (!succeeded) {
         ERROR("failed to update address record for domain - domain: " PUB_S_SRP, THREAD_DOMAIN_WITH_ID);
         goto exit;
     }

     // Update the default.service.arpa. address mapping.
     succeeded = dnssd_hardwired_add_or_remove_address_in_domain(local_host_name, DEFAULT_SERVICE_ARPA_DOMAIN, addr, add);
     if (!succeeded) {
         ERROR("failed to update address record for domain - domain: " PUB_S_SRP, DEFAULT_SERVICE_ARPA_DOMAIN);
         goto exit;
     }

 #if SRP_FEATURE_LOCAL_DISCOVERY
     // Update the default.service.arpa. address mapping.
     succeeded = dnssd_hardwired_add_or_remove_address_in_domain(local_host_name, DOT_LOCAL_DOMAIN, addr, add);
     if (!succeeded) {
         ERROR("failed to update address record for domain - domain: " PUB_S_SRP, LOCAL);
         goto exit;
     }
 #endif

     // Setup the "_lb.dns-sd"
     // Update the "reverse mapping from address to browsing domain" for each eligible served domain under IPv6 or IPv4
     // reverse lookup domain.
     if (addr->sa.sa_family == AF_INET6) {
         succeeded = dnssd_hardwired_add_or_remove_ptr_in_domain(IPV6_REVERSE_LOOKUP_DOMAIN, addr, mask, add);
     } else if (addr->sa.sa_family == AF_INET) {
         succeeded = dnssd_hardwired_add_or_remove_ptr_in_domain(IPV4_REVERSE_LOOKUP_DOMAIN, addr, mask, add);
     } else {
         char buf[INET6_ADDRSTRLEN];
         IOLOOP_NTOP(addr, buf);
         INFO("Skipping non IPv6/IPv4 address - addr:" PRI_S_SRP, buf);
         succeeded = true;
     }

 exit:
     return succeeded;
 }

 static void
 dnssd_hardwired_lbdomains_setup(void)
 {
     served_domain_t *ipv6, *ipv4;
 #if (SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY)
     // When dnssd-proxy is combined with srp-mdns-proxy, IPv4 and IPv6 reverse look up domain is set from the begining.
     ipv4 = find_served_domain(IPV4_REVERSE_LOOKUP_DOMAIN);
     ipv6 = find_served_domain(IPV6_REVERSE_LOOKUP_DOMAIN);
 #else // #if (SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY)
     ipv4 = new_served_domain(NULL, IPV4_REVERSE_LOOKUP_DOMAIN);
     ipv6 = new_served_domain(NULL, IPV6_REVERSE_LOOKUP_DOMAIN);
 #endif // #if (SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY)
     require_action_quiet(ipv4 != NULL && ipv6 != NULL, exit, ERROR("cannot find/create new served domain"));

     for (served_domain_t *addr_domain = served_domains; addr_domain; addr_domain = addr_domain->next) {
         dp_interface_t *interface = addr_domain->interface;
         interface_addr_t *ifaddr;
         if (interface == NULL) {
             INFO("Domain " PRI_S_SRP " has no interface", addr_domain->domain);
             continue;
         }
         INFO("Interface " PUB_S_SRP, interface->name);
         // Add lb domain support for link domain
         for (ifaddr = interface->addresses; ifaddr != NULL; ifaddr = ifaddr->next) {
             // Do not publish link-local or loopback address
             if (!is_valid_address_to_publish(&ifaddr->addr)) {
                 continue;
             }

             if (ifaddr->addr.sa.sa_family == AF_INET) {
                 dnssd_hardwired_add_or_remove_ptr_record(ipv4, &ifaddr->addr, &ifaddr->mask, true);
             } else if (ifaddr->addr.sa.sa_family == AF_INET6) {
                 dnssd_hardwired_add_or_remove_ptr_record(ipv6, &ifaddr->addr, &ifaddr->mask, true);
             } else {
                 char buf[INET6_ADDRSTRLEN];
                 IOLOOP_NTOP(&ifaddr->addr, buf);
                 INFO("Skipping " PRI_S_SRP, buf);
             }
         }
     }
 exit:
     return;
 }
 #endif

 static void
 dnssd_hardwired_setup(void)
 {
     dns_wire_t wire;
     dns_towire_state_t towire;
     served_domain_t *sdt;
 #if STUB_ROUTER
     dns_name_t *my_name_parsed = my_name == NULL ? NULL : dns_pres_name_parse(my_name);
 #endif

 #define RESET \
     memset(&towire, 0, sizeof towire); \
     towire.message = &wire; \
     towire.p = wire.data; \
     towire.lim = towire.p + sizeof wire.data

     // For each interface, set up the hardwired names.
     for (sdt = served_domains; sdt; sdt = sdt->next) {
         if (sdt->interface == NULL) {
             continue;
         }

         // SRV
         // _dns-llq._udp
         // _dns-llq-tls._tcp
         // _dns-update._udp
         // _dns-update-tls._udp
         // We deny the presence of support for LLQ, because we only support DNS Push
         RESET;
         dnssd_hardwired_add(sdt, "_dns-llq._udp", sdt->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);
         dnssd_hardwired_add(sdt, "_dns-llq-tls._tcp", sdt->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);

         // We deny the presence of support for DNS Update, because a Discovery Proxy zone is stateless.
         dnssd_hardwired_add(sdt, "_dns-update._udp", sdt->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);
         dnssd_hardwired_add(sdt, "_dns-update-tls._tcp", sdt->domain_ld, towire.p - wire.data, wire.data,
                             dns_rrtype_srv);

         // Until we set up the DNS Push listener, we deny its existence.   If TLS is ready to go, this will be
         // overwritten immediately; otherwise it will be overwritten when the TLS key has been generated and signed.
         dnssd_hardwired_add(sdt, "_dns-push-tls._tcp", sdt->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);

 #if STUB_ROUTER
         char namebuf[DNS_MAX_NAME_SIZE + 1];
         const char *local_name;
         addr_t addr;

         // If my_name wasn't set, or if my_name is in this interface's domain, we need to answer
         // for it when queried.
         if (my_name == NULL || my_name_parsed != NULL) {
             const char *local_domain = NULL;
             if (my_name == NULL) {
                 local_name = "ns";
                 local_domain = sdt->domain_ld;
             } else {
                 dns_name_t *lim;
                 local_name = NULL;

                 // See if my_name is a subdomain of this interface's domain
                 if ((lim = dns_name_subdomain_of(my_name_parsed, sdt->domain_name)) != NULL) {
                     dns_name_print_to_limit(my_name_parsed, lim, namebuf, sizeof namebuf);
                     local_name = namebuf;
                     dns_name_free(my_name_parsed);
                     my_name_parsed = NULL;
                     if (local_name[0] == '\0') {
                         local_domain = sdt->domain;
                     } else {
                         local_domain = sdt->domain_ld;
                     }
                 }
             }
             if (local_name != NULL) {
                 for (int i = 0; i < num_publish_addrs; i++) {
                     RESET;
                     memset(&addr, 0, sizeof addr);
                     getipaddr(&addr, publish_addrs[i]);
                     if (addr.sa.sa_family == AF_INET) {
                         // A
                         // ns
                         dns_rdata_raw_data_to_wire(&towire, &addr.sin.sin_addr, sizeof addr.sin.sin_addr);
                         dnssd_hardwired_add(sdt, local_name, local_domain, towire.p - wire.data, wire.data,
                                             dns_rrtype_a);
                     } else {
                         // AAAA
                         RESET;
                         dns_rdata_raw_data_to_wire(&towire, &addr.sin6.sin6_addr, sizeof addr.sin6.sin6_addr);
                         dnssd_hardwired_add(sdt, local_name, local_domain, towire.p - wire.data, wire.data,
                                             dns_rrtype_aaaa);
                     }
                 }
             }
         }
 #endif // STUB_ROUTER

         // NS
         RESET;
 #if STUB_ROUTER
         if (string_ends_with(sdt->domain, THREAD_DOMAIN)) {
             // For served domain in the THREAD_DOMAIN, set the NS record to the local host name:
             // For example, openthread.thread.home.arpa. NS Office.local.
             // XXX is this right?
             require_quiet(local_host_name_dot_local[0] != 0, exit);
             dns_full_name_to_wire(NULL, &towire, local_host_name_dot_local);
         } else
 #endif
         if (uuid_name[0] != 0) {
             dns_name_to_wire(NULL, &towire, uuid_name);
             dns_full_name_to_wire(NULL, &towire, sdt->domain);
         } else {
             dns_name_to_wire(NULL, &towire, "ns");
             dns_full_name_to_wire(NULL, &towire, sdt->domain);
         }
         dnssd_hardwired_add(sdt, "", sdt->domain, towire.p - wire.data, wire.data, dns_rrtype_ns);

         // SOA (piggybacking on what we already did for NS, which starts the same.
         dns_name_to_wire(NULL, &towire, "postmaster");
         dns_full_name_to_wire(NULL, &towire, sdt->domain);
         dns_u32_to_wire(&towire, 0);     // serial
         dns_ttl_to_wire(&towire, 7200);  // refresh
         dns_ttl_to_wire(&towire, 3600);  // retry
         dns_ttl_to_wire(&towire, 86400); // expire
         dns_ttl_to_wire(&towire, 120);    // minimum
         dnssd_hardwired_add(sdt, "", sdt->domain, towire.p - wire.data, wire.data, dns_rrtype_soa);
     }

     // Setup hardwired response A/AAAA record for <local host name>.home.arpa.
 #if SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY
 #if STUB_ROUTER
     // When dnssd-proxy is combined with srp-mdns-proxy, we get the address from the interface address list not from the
     // config file, so we search through the served domains for all available address.
     if (my_name_parsed != NULL) {
         dns_name_free(my_name_parsed);
         my_name_parsed = NULL;
     }

     require_action_quiet(my_name != NULL, exit, ERROR("Failed to get my_name and unable to set hardwired response"));
     served_domain_t *const my_name_served_domain = find_served_domain(my_name);
     require_action_quiet(my_name_served_domain != NULL, exit,
         ERROR("Failed to find my_name domain - my_name: " PRI_S_SRP, my_name));

     served_domain_t *const thread_served_domain = find_served_domain(THREAD_DOMAIN_WITH_ID);
     require_action(thread_served_domain != NULL, exit,
         ERROR("Failed to find thread domain - domain: " PUB_S_SRP, THREAD_DOMAIN_WITH_ID));

     served_domain_t *const default_service_arpa_domain = find_served_domain(DEFAULT_SERVICE_ARPA_DOMAIN);
     require_action(default_service_arpa_domain != NULL, exit,
         ERROR("Failed to find thread domain - domain: " PUB_S_SRP, DEFAULT_SERVICE_ARPA_DOMAIN));

 #if SRP_FEATURE_LOCAL_DISCOVERY
     served_domain_t *const dot_local_domain = find_served_domain(DOT_LOCAL_DOMAIN);
     require_action(dot_local_domain != NULL, exit,
         ERROR("Failed to find thread domain - domain: " PUB_S_SRP, DOT_LOCAL_DOMAIN));
 #endif
     for (const served_domain_t *domain = served_domains; domain != NULL; domain = domain->next) {
         if (domain->interface == NULL) {
             continue;
         }
         for (const interface_addr_t *if_addrs = domain->interface->addresses; if_addrs != NULL;
              if_addrs = if_addrs->next) {
             const addr_t *const if_addr = &if_addrs->addr;
             // Only publish routable IP address.
             if (!is_valid_address_to_publish(if_addr)) {
                 continue;
             }

             RESET;
             uint16_t rr_type;
             if (if_addr->sa.sa_family == AF_INET) {
                 dns_rdata_raw_data_to_wire(&towire, &if_addr->sin.sin_addr, sizeof(if_addr->sin.sin_addr));
                 rr_type = dns_rrtype_a;
             } else if (if_addr->sa.sa_family == AF_INET6) {
                 dns_rdata_raw_data_to_wire(&towire, &if_addr->sin6.sin6_addr, sizeof(if_addr->sin6.sin6_addr));
                 rr_type = dns_rrtype_aaaa;
             } else {
                 ERROR("Non IPv4/IPv6 address in interface addresses - sa_family: %u", if_addr->sa.sa_family);
                 continue;
             }

             // <local host name>.home.arpa. A/AAAA <IP address>
             dnssd_hardwired_add(my_name_served_domain, "", my_name_served_domain->domain, towire.p - wire.data,
                 wire.data, rr_type);

             // <local host name>.openthread.thread.home.arpa. A/AAAA <IP address>
             dnssd_hardwired_add(thread_served_domain, local_host_name, thread_served_domain->domain_ld,
                 towire.p - wire.data, wire.data, rr_type);

             // <local host name>.default.service.arpa. A/AAAA <IP address>
             dnssd_hardwired_add(default_service_arpa_domain, local_host_name, default_service_arpa_domain->domain_ld,
                 towire.p - wire.data, wire.data, rr_type);

 #if SRP_FEATURE_LOCAL_DISCOVERY
             // <local host name>.local. A/AAAA <IP address>
             dnssd_hardwired_add(dot_local_domain, local_host_name, dot_local_domain->domain_ld,
                 towire.p - wire.data, wire.data, rr_type);
 #endif
         }
     }
 #endif
 #else // SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY
     if (my_name_parsed != NULL) {
         dns_name_free(my_name_parsed);
         my_name_parsed = NULL;

         sdt = new_served_domain(NULL, my_name);
         if (sdt == NULL) {
             ERROR("Unable to allocate domain for %s", my_name);
         } else {
             for (int i = 0; i < num_publish_addrs; i++) {
                 // AAAA
                 // A
                 RESET;
                 memset(&addr, 0, sizeof addr);
                 getipaddr(&addr, publish_addrs[i]);
                 if (addr.sa.sa_family == AF_INET) {
                     dns_rdata_raw_data_to_wire(&towire, &addr.sin.sin_addr, sizeof addr.sin.sin_addr);
                     dnssd_hardwired_add(sdt, "", sdt->domain, towire.p - wire.data, wire.data, dns_rrtype_a);
                 } else {
                     dns_rdata_raw_data_to_wire(&towire, &addr.sin6.sin6_addr, sizeof addr.sin6.sin6_addr);
                     dnssd_hardwired_add(sdt, "", sdt->domain, towire.p - wire.data, wire.data, dns_rrtype_aaaa);
                 }
             }
         }
     }
 #endif // SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY

 #if STUB_ROUTER
     // Setup _lb._udp.<reversed IP address> PTR record for the domain we are advertising, for example:
     // _lb._udp.0.0.168.192.in-addr.arpa. PTR my-discovery-proxy-en0.home.arpa.
     dnssd_hardwired_lbdomains_setup();

 exit:
 #endif
     return;
 }

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
 static void
 dnssd_hardwired_clear(void)
 {
     INFO("Clearing all hardwired response");
     for (served_domain_t *domain = served_domains; domain != NULL; domain = domain->next) {
         hardwired_t *hardwired_responses = domain->hardwired_responses;
         if (hardwired_responses == NULL) {
             continue;
         }

         domain->hardwired_responses = NULL;
         hardwired_t *next_response;
         for (hardwired_t *response = hardwired_responses; response != NULL; response = next_response) {
             next_response = response->next;
             free(response);
         }
     }
 }

 static void
 dnssd_hardwired_push_setup(void)
 {
     // For each interface, set up the hardwired names.
     for (served_domain_t *sdt = served_domains; sdt; sdt = sdt->next) {
         if (sdt->interface == NULL) {
             continue;
         }

         if (!sdt->interface->no_push) {
             // SRV
             // _dns-push-tls._tcp
             // _dns-query-tls._udp
             dnssd_hardwired_setup_dns_push_for_domain(sdt);
         }
     }
 }

 static void
 dnssd_hardwired_deny_service_existence_for_served_domain(served_domain_t *const NONNULL served_domain)
 {
     dns_wire_t wire;
     dns_towire_state_t towire;

 #define RESET \
     memset(&towire, 0, sizeof towire); \
     towire.message = &wire; \
     towire.p = wire.data; \
     towire.lim = towire.p + sizeof wire.data

     RESET;
     // We deny the presence of support for LLQ, because we only support DNS Push.
     dnssd_hardwired_add(served_domain, "_dns-llq._udp", served_domain->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);
     dnssd_hardwired_add(served_domain, "_dns-llq-tls._tcp", served_domain->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);

     // We deny the presence of support for DNS Update, because a Discovery Proxy zone is stateless.
     dnssd_hardwired_add(served_domain, "_dns-update._udp", served_domain->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);
     dnssd_hardwired_add(served_domain, "_dns-update-tls._tcp", served_domain->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);

     // We deny the presence of support for UDP with TLS, because we have not implemented DTLS (datagram TLS).
     dnssd_hardwired_add(served_domain, "_dns-query-tls._udp", served_domain->domain_ld, towire.p - wire.data, wire.data, dns_rrtype_srv);

     // We deny the presence of "lb._dns-sd._udp" for the served domain, to avoid the response like:
     // lb._dns-sd._udp.openthread.thread.home.arpa. PTR openthread.thread.home.arpa.
     dnssd_hardwired_add(served_domain, SRV_TYPE_FOR_AUTOMATIC_BROWSING_DOMAIN, served_domain->domain_ld,
         towire.p - wire.data, wire.data, dns_rrtype_ptr);
     dnssd_hardwired_add(served_domain, "b._dns-sd._udp", served_domain->domain_ld,
         towire.p - wire.data, wire.data, dns_rrtype_ptr);
     dnssd_hardwired_add(served_domain, "db._dns-sd._udp", served_domain->domain_ld,
         towire.p - wire.data, wire.data, dns_rrtype_ptr);
 }

 static bool
 dnssd_hardwired_setup_for_served_domain(served_domain_t *const NONNULL served_domain)
 {
     bool succeeded = false;
     dns_wire_t wire;
     dns_towire_state_t towire;

 #define RESET \
     memset(&towire, 0, sizeof towire); \
     towire.message = &wire; \
     towire.p = wire.data; \
     towire.lim = towire.p + sizeof wire.data

     require_action_quiet(served_domain->interface != NULL, exit, succeeded = false;
         ERROR("only domain with usable interface can setup hardwired response - domain name: " PRI_S_SRP,
             served_domain->domain)
     );

     // deny the existence of the following services:
     // _dns-llq._udp
     // _dns-llq-tls._tcp
     // _dns-update._udp
     dnssd_hardwired_deny_service_existence_for_served_domain(served_domain);

     // Setup NS record for this served domain.
     RESET;
 #if STUB_ROUTER
     if (string_ends_with(served_domain->domain, THREAD_DOMAIN)) {
         // If the response requires the translation from <served domain> to ".local." and the response ends in
         // ".local.", truncate it.
         require_action_quiet(local_host_name_dot_local[0] != 0, exit, succeeded = false);
         dns_full_name_to_wire(NULL, &towire, local_host_name_dot_local);
     } else
 #endif
     if (uuid_name[0] != 0) {
         dns_name_to_wire(NULL, &towire, uuid_name);
         dns_full_name_to_wire(NULL, &towire, served_domain->domain);
     } else {
         dns_name_to_wire(NULL, &towire, "ns");
         dns_full_name_to_wire(NULL, &towire, served_domain->domain);
     }
     dnssd_hardwired_add(served_domain, "", served_domain->domain, towire.p - wire.data, wire.data, dns_rrtype_ns);

     // Setup SOA record for this served domain. (piggybacking on what we already did for NS, which starts the same.)
     dns_name_to_wire(NULL, &towire, "postmaster");
     dns_full_name_to_wire(NULL, &towire, served_domain->domain);
     dns_u32_to_wire(&towire, 0);     // serial
     dns_ttl_to_wire(&towire, 7200);  // refresh
     dns_ttl_to_wire(&towire, 3600);  // retry
     dns_ttl_to_wire(&towire, 86400); // expire
     dns_ttl_to_wire(&towire, 120);    // minimum
     dnssd_hardwired_add(served_domain, "", served_domain->domain, towire.p - wire.data, wire.data, dns_rrtype_soa);

     // Setup DNS push
     if (served_domain->interface == NULL || !served_domain->interface->no_push) {
         succeeded = dnssd_hardwired_setup_dns_push_for_domain(served_domain);
         if (!succeeded) {
             ERROR("failed to setup DNS push service for hardwired response - domain: " PRI_S_SRP,
                   served_domain->domain);
             goto exit;
         }
     }
     succeeded = true;

 exit:
     return succeeded;
 }

 static bool
 dnssd_hardwired_setup_dns_push_for_domain(served_domain_t *const NONNULL served_domain)
 {
     bool succeeded;

     require_action_quiet(served_domain->interface != NULL && !served_domain->interface->no_push, exit, succeeded = false;
         ERROR("the associated interface does not enable DNS push - domain: " PRI_S_SRP, served_domain->domain));

     require_action_quiet(my_name != NULL, exit, succeeded = false; ERROR("my_name is not set"));

     dns_wire_t wire;
     dns_towire_state_t towire;
 #define RESET \
     memset(&towire, 0, sizeof towire); \
     towire.message = &wire; \
     towire.p = wire.data; \
     towire.lim = towire.p + sizeof wire.data

     RESET;
     dns_u16_to_wire(&towire, 0); // priority
     dns_u16_to_wire(&towire, 0); // weight
     dns_u16_to_wire(&towire, 853); // port

 #if STUB_ROUTER
     if (string_ends_with(served_domain->domain, THREAD_DOMAIN)) {
         // If the served domain is subdomain of "thread.home.arpa.", use name <local host name>.local for the DNS push
         // service. Currently we only support DNS push in "thread.home.arpa." domain in local subnet, so DNS push
         // service for "thread.home.arpa." will be registered with a name in ".local.".
         require_action_quiet(local_host_name_dot_local[0] != 0, exit, succeeded = false);
         dns_full_name_to_wire(NULL, &towire, local_host_name_dot_local);
     } else
 #endif
     if (uuid_name[0] != 0) {
         // Use <local host name>.<domain>
         dns_name_to_wire(NULL, &towire, uuid_name);
         dns_full_name_to_wire(NULL, &towire, served_domain->domain);
     } else {
         // Use name ns.<served domain>.
         dns_name_to_wire(NULL, &towire, "ns");
         dns_full_name_to_wire(NULL, &towire, served_domain->domain);
     }

     dnssd_hardwired_add(served_domain, "_dns-push-tls._tcp", served_domain->domain_ld, towire.p - wire.data, wire.data,
         dns_rrtype_srv);

     succeeded = true;
 exit:
     return succeeded;
 }
 #endif // SRP_FEATURE_DYNAMIC_CONFIGURATION

 static bool
 embiggen(dnssd_query_t *query)
 {
     dns_wire_t *nr = malloc(query->data_size + DNS_DATA_SIZE + DNS_HEADER_SIZE); // increments wire size by DNS_DATA_SIZE
     if (nr == NULL) {
         return false;
     }
     memcpy(nr, query->response, query->data_size + DNS_HEADER_SIZE);
     query->data_size += DNS_DATA_SIZE;
     size_t len = query->towire.p - &query->response->data[0];
     query->towire.p = &nr->data[0] + len;
     query->towire.lim = &nr->data[0] + query->data_size;
     query->towire.p_rdlength = NULL;
     query->towire.p_opt = NULL;
     query->towire.message = nr;
     free(query->response);
     query->response = nr;
     return true;
 }

 static void
 dp_move_rrs(dns_rr_t *first_section, unsigned *p_first_count, dns_rr_t *source_section, unsigned source_count, unsigned count, bool rdata_present)
 {
     unsigned first_count = *p_first_count;

     // Copy the rrs into the combined section.
     for (unsigned i = 0; i < source_count; i++) {
         // Skip this RR if there's already another one just like it in the section (most likely to happen
         // with authority records.
         bool duplicate = false;
         for (unsigned j = 0; j < first_count; j++) {
             if (dns_rrs_equal(&first_section[j], &source_section[i], rdata_present)) {
                 duplicate = true;
                 break;
             }
         }
         if (duplicate) {
             continue;
         }

         // Only if there is space...
         if (first_count < count) {
             first_section[first_count] = source_section[i];
             first_count++;
             source_section[i].type = dns_invalid_rr;
         } else {
             ERROR("first_count %d unexpectedly equal to count %d with i = %d", first_count, count, i);
         }
     }
     *p_first_count = first_count;
 }

 static dnssd_query_t *
 dp_dns_queries_finished(dnssd_query_t *answered_query)
 {
     dns_message_t *first_message = NULL;
     unsigned qdcount = 0, ancount = 0, nscount = 0, arcount = 0;
     unsigned first_qdcount, first_ancount, first_nscount, first_arcount;
     dnssd_query_t *first_query = NULL;
     dp_tracker_t *tracker = answered_query->tracker;

     // response_query will be set to NULL if we don't want anything sent yet, to query if query is the
     // only query or if there's an error in this function, or to the query that holds the aggregate response
     // otherwise.
     dnssd_query_t *response_query = answered_query;
     const char *name = answered_query->question != NULL ? answered_query->question->name : "(null)";

     require_action_quiet(tracker != NULL, exit,
                          dns_rcode_set(answered_query->response, dns_rcode_servfail);
                          ERROR("NULL tracker on " PRI_S_SRP, name));
     require_action_quiet(tracker->dns_queries != NULL, exit,
                          dns_rcode_set(answered_query->response, dns_rcode_servfail);
                          ERROR("NULL tracker->dns_queries on " PRI_S_SRP, name));

     // The usual case, there's only one question in the DNS message, so we can just
     // return the answer now.
     if (answered_query->num_questions == 1) {
         goto exit;
     }

     // Otherwise, we have more than one query, so see if any remain unsatisfied.
     int satisfied = 0;
     for (dnssd_query_t *match = tracker->dns_queries; match != NULL; match = match->next) {
         // It's possible we could creep in here without actually generating one of the responses,
         // in which case we should definitely fail at this point.
         require_action_quiet(match->response != NULL,
                              exit,
                              ERROR("null response on match query");
                              dns_rcode_set(response_query->response, dns_rcode_servfail));
         if (match->message == answered_query->message) {
             if (!match->satisfied) {
                 response_query = NULL; // More answers coming.
                 goto exit;
             }
             satisfied++;
         }
     }
     if (satisfied != answered_query->num_questions) {
         response_query = NULL;
         goto exit;
     }
     // All queries have been satisfied.

     // Parse all of the messages (this is gross--later on we should just never convert to wire format until
     // we get here.
     for (dnssd_query_t *source = tracker->dns_queries; source != NULL; source = source->next) {
         if (source->message == answered_query->message) {
             // This should never fail, but...
             require_action_quiet(dns_wire_parse(&source->response_msg, source->response,
                                                 (unsigned)(source->towire.p - source->response->data) + DNS_HEADER_SIZE, false),
                                  exit,
                                  dns_rcode_set(response_query->response, dns_rcode_servfail));

             if (first_query == NULL) {
                 first_query = source;
                 first_message = first_query->response_msg;
                 first_qdcount = first_message->qdcount;
                 first_ancount = first_message->ancount;
                 first_nscount = first_message->nscount;
                 first_arcount = first_message->arcount;
             }
             qdcount += source->response_msg->qdcount;
             ancount += source->response_msg->ancount;
             nscount += source->response_msg->nscount;
             arcount += source->response_msg->arcount;
         }
     }

     // Copy records from the response.
     for (int i = 0; i < 4; i++) {
         dns_rr_t *section, **first_section = NULL, **source_section = NULL;
         unsigned section_count = 0, source_count = 0, *first_count = NULL;

         // Start with the second message, since the first is already populated.
         for (dnssd_query_t *source = tracker->dns_queries;
              source != NULL && answered_query->message == source->message ; source = source->next)
         {
 #define SECTION_CASE(index, counter_name, section_name)                   \
             case index:                                                   \
                 first_section = &first_message->section_name;             \
                 source_section = &source->response_msg->section_name;     \
                 section_count = counter_name;                             \
                 source_count = source->response_msg->counter_name;        \
                 first_count = &first_message->counter_name;               \
                 break

             switch (i) {
                     SECTION_CASE(0, qdcount, questions);
                     SECTION_CASE(1, ancount, answers);
                     SECTION_CASE(2, nscount, authority);
                     SECTION_CASE(3, arcount, additional);
             }

             // If this is the first matching query, expand the current section to be able to fit all of the data we're
             // copying in, and then copy the data from the first section.
             if (first_section == source_section) {
                 section = calloc(section_count, sizeof(*section));
                 require_action_quiet(section != NULL, exit,
                                      dns_rcode_set(answered_query->response, dns_rcode_servfail);
                                      ERROR("Unable to allocate memory for query response section on " PRI_S_SRP, name));
                 memcpy(section, *first_section, source_count * sizeof(*section));
                 memset(*first_section, 0, source_count * sizeof(*section)); // NULL out any pointers
                 free(*first_section);
                 *first_section = section;
             } else {
                 dp_move_rrs(*first_section, first_count, *source_section, source_count, section_count, i != 0);
             }
         }
     }

     // Use the response in the first query to turn the answer to wire format.
 redo_message:
     dp_query_towire_reset(first_query);
     dns_message_rrs_to_wire(&first_query->towire, first_query->response_msg);
     if (first_query->towire.truncated) {
         if (first_query->tracker->connection->tcp_stream) {
             if (embiggen(first_query)) {
                 first_query->towire.error = false;
                 first_query->towire.truncated = false;
                 goto redo_message;
             }
         }
     }
     first_query->response->qdcount = htons(first_message->qdcount);
     first_query->response->ancount = htons(first_message->ancount);
     first_query->response->nscount = htons(first_message->nscount);
     first_query->response->arcount = htons(first_message->arcount);
     response_query = first_query;

 exit:
     return response_query;
 }

 static void
 dp_query_send_dns_response(dnssd_query_t *query, const char *context_description)
 {
     struct iovec iov;
     dns_towire_state_t *towire = &query->towire;
     const char *failnote = NULL;
     uint8_t *revert = towire->p;
     uint16_t tc = towire->truncated ? dns_flags_tc : 0;
     uint16_t bitfield = ntohs(query->response->bitfield);
     uint16_t mask = 0;
     int rcode = dns_rcode_get(query->response);
     question_t *question = query->question;

     // Mark this query as complete.
     query->satisfied = true;

     VALIDATE_TRACKER_CONNECTION_NON_NULL();

     // Send an SOA record if it's a .local query.
     if (question->served_domain != NULL && question->served_domain->interface != NULL &&
         !towire->truncated && (question->type != dns_rrtype_soa || question->name[0] != '\0'))
     {
     redo:
         // DNSSD Hybrid, Section 6.1.
         TOWIRE_CHECK("&query->enclosing_domain_pointer 1", towire,
                      dns_pointer_to_wire(NULL, towire, &query->enclosing_domain_pointer));
         TOWIRE_CHECK("dns_rrtype_soa", towire,
                      dns_u16_to_wire(towire, dns_rrtype_soa));
         TOWIRE_CHECK("dns_qclass_in", towire,
                      dns_u16_to_wire(towire, dns_qclass_in));
         TOWIRE_CHECK("ttl", towire, dns_ttl_to_wire(towire, 3600));
         TOWIRE_CHECK("rdlength_begin ", towire, dns_rdlength_begin(towire));
         if (0) {
 #if STUB_ROUTER
         } else if (srp_servers->stub_router_enabled && my_name != NULL) {
             TOWIRE_CHECK(my_name, towire, dns_full_name_to_wire(NULL, towire, my_name));
 #endif
         } else if (uuid_name[0] != 0) {
             TOWIRE_CHECK("uuid_name", towire, dns_name_to_wire(NULL, towire, uuid_name));
             TOWIRE_CHECK("&query->enclosing_domain_pointer 2", towire,
                          dns_pointer_to_wire(NULL, towire, &query->enclosing_domain_pointer));
         } else {
             TOWIRE_CHECK("\"ns\"", towire, dns_name_to_wire(NULL, towire, "ns"));
             TOWIRE_CHECK("&query->enclosing_domain_pointer 2", towire,
                          dns_pointer_to_wire(NULL, towire, &query->enclosing_domain_pointer));
         }
         TOWIRE_CHECK("\"postmaster\"", towire,
                      dns_name_to_wire(NULL, towire, "postmaster"));
         TOWIRE_CHECK("&query->enclosing_domain_pointer 3", towire,
                      dns_pointer_to_wire(NULL, towire, &query->enclosing_domain_pointer));
         TOWIRE_CHECK("serial", towire,dns_u32_to_wire(towire, 0));     // serial
         TOWIRE_CHECK("refresh", towire, dns_ttl_to_wire(towire, 7200));  // refresh
         TOWIRE_CHECK("retry", towire, dns_ttl_to_wire(towire, 3600));  // retry
         TOWIRE_CHECK("expire", towire, dns_ttl_to_wire(towire, 86400)); // expire
         TOWIRE_CHECK("minimum", towire, dns_ttl_to_wire(towire, 120));    // minimum
         dns_rdlength_end(towire);
         if (towire->truncated) {
             query->towire.p = revert;
             if (query->tracker->connection->tcp_stream) {
                 if (embiggen(query)) {
                     query->towire.error = 0;
                     towire->truncated = false;
                     goto redo;
                 }
             } else {
                 tc = dns_flags_tc;
             }
         } else {
             query->response->nscount = htons(1);
         }

         // Response is authoritative and not recursive.
     authoritative:
         mask = ~dns_flags_ra;
         bitfield = bitfield | dns_flags_aa | tc;
         bitfield = bitfield & mask;
     } else {
         // Response is recursive and not authoritative.
         if (question->type != dns_rrtype_soa) {
             mask = ~dns_flags_aa;
             bitfield = bitfield | dns_flags_ra | tc;
             bitfield = bitfield & mask;
         } else {
             goto authoritative;
         }
     }

     INFO("[Q%d][QU%d][QID %x] ->p %p ->lim %p len %zd rcode %d " PUB_S_SRP, SERIAL(query), SERIAL(question),
          ntohs(query->message->wire.id), query->towire.p, &query->towire.message->data[0],
          query->towire.p - &query->towire.message->data[0], dns_rcode_get(query->response), context_description);

     // In the case that we get an error looking something up, we return that error immediately on the query that failed,
     // rather than trying to assemble a complete answer. In returning the error, we cancel any outstanding queries.
     dnssd_query_t *send_query;

     if (!towire->error && rcode == dns_rcode_noerror) {
         // It's possible that we got a query with qdcount > 1. In this case, we are going to marshal all of the
         // answers from the responses we've constructed into a new response and send it after all of the queries
         // have responses.  So at this point, if we don't have all the responses yet, there's no point in adding
         // the edns0 option.  If we do, dp_dns_update_queries_finished will marshal all the answers into one
         // message and after that we can add the edns0 option. If there's only one query, this is a no-op.
         send_query = dp_dns_queries_finished(query);
         if (send_query == NULL) {
 #ifdef DNSSD_PROXY_DUMP_TRACKER_QUERIES
             if (query->tracker == NULL) {
                 ERROR("[Q%d] query->tracker is NULL", SERIAL(query));
             } else {
                 char logbuf[200];
                 char *lbp = logbuf;
                 char *lbend = logbuf + sizeof(logbuf);
                 char *lbrestart;
                 bool print_last = true;
                 if (query->tracker->connection != NULL && query->tracker->connection->tcp_stream) {
                     int len = snprintf(logbuf, sizeof(logbuf), "[Q%d] TCP %d: ", SERIAL(query), query->num_questions);
                     lbrestart = logbuf + len;
                 } else {
                     int len = snprintf(logbuf, sizeof(logbuf), "[Q%d] UDP %p %d: ", SERIAL(query), query->num_questions);
                     lbrestart = logbuf + len;
                 }
                 lbp = logbuf + strlen(logbuf);
                 for (dnssd_query_t *list_query = query->tracker->dns_queries;
                      list_query != NULL; list_query = list_query->next)
                 {
                     if (list_query->message != query->message) {
                         continue;
                     }
                     int len = snprintf(lbp, lbend - lbp, "%p%s ", list_query, list_query->satisfied ? "+" : "=");
                     if (lbp + len < lbend) {
                         lbp += len;
                         print_last = true;
                     } else {
                         *lbp = 0;
                         INFO("[Q%d] " PUB_S_SRP, SERIAL(query), logbuf);
                         lbp = lbrestart;
                         *lbp = 0;
                         print_last = false;
                     }
                 }
                 if (print_last) {
                     INFO("[Q%d] " PUB_S_SRP, SERIAL(query), logbuf);
                 }
             }
 #endif // DNSSD_PROXY_DUMP_TRACKER_QUERIES
             return;
         }
         if (dns_rcode_get(send_query->response) != dns_rcode_noerror) {
             rcode = dns_rcode_get(send_query->response);
         }

         towire = &send_query->towire;
         revert = towire->p;
     } else {
         send_query = query;
     }

     // Not authentic, checking not disabled.
     mask = ~(dns_flags_rd | dns_flags_ad | dns_flags_cd);
     bitfield = bitfield & mask;
     send_query->response->bitfield = htons(bitfield);

     // This is a response
     dns_qr_set(send_query->response, dns_qr_response);

     // If we got a failure from dp_dns_queries_finished(), skip adding the opt RR and checking for a towire error.
     if (rcode == dns_rcode_noerror) {
     // Send an OPT RR if we got one
     // XXX reserve space so we can always send an OPT RR?
         if (send_query->is_edns0) {
         redo_edns0:
             TOWIRE_CHECK("Root label", towire, dns_u8_to_wire(towire, 0));     // Root label
             TOWIRE_CHECK("dns_rrtype_opt", towire, dns_u16_to_wire(towire, dns_rrtype_opt));
             TOWIRE_CHECK("UDP Payload size", towire, dns_u16_to_wire(towire, 4096)); // UDP Payload size
             TOWIRE_CHECK("extended-rcode", towire, dns_u8_to_wire(towire, 0));     // extended-rcode
             TOWIRE_CHECK("EDNS version 0", towire, dns_u8_to_wire(towire, 0));     // EDNS version 0
             TOWIRE_CHECK("No extended flags", towire, dns_u16_to_wire(towire, 0));    // No extended flags
             TOWIRE_CHECK("No payload", towire, dns_u16_to_wire(towire, 0));    // No payload
             if (towire->truncated) {
                 send_query->towire.p = revert;
                 if (send_query->tracker->connection->tcp_stream) {
                     if (embiggen(send_query)) {
                         send_query->towire.error = false;
                         send_query->towire.truncated = false;
                         goto redo_edns0;
                     }
                 }
             } else {
 #if SRP_FEATURE_NAT64
                 send_query->response->arcount = htons(ntohs(send_query->response->arcount) + 1);
 #else
                 send_query->response->arcount = htons(1);
 #endif
             }
         }

         if (towire->error) {
             ERROR("[Q%d][QU%d][QID%x] failed on %s", SERIAL(query), SERIAL(question), ntohs(send_query->message->wire.id), failnote);
             if (tc == dns_flags_tc) {
                 dns_rcode_set(send_query->response, dns_rcode_noerror);
             } else {
                 dns_rcode_set(send_query->response, dns_rcode_servfail);
             }
         } else {
             // No error.
             dns_rcode_set(send_query->response, dns_rcode_noerror);
         }
     } else {
         dns_rcode_set(send_query->response, rcode);
     }

     iov.iov_len = (send_query->towire.p - (uint8_t *)send_query->response);
     iov.iov_base = send_query->response;
     INFO("[Q%d][QU%d] (len %zd)", SERIAL(query), SERIAL(question), iov.iov_len);

     ioloop_send_message(send_query->tracker->connection, send_query->message, &iov, 1);

     // Cancel the send_query.
     dnssd_query_cancel(send_query);
 }

 static void
 dp_query_towire_reset(dnssd_query_t *query)
 {
     query->towire.p = &query->response->data[0];  // We start storing RR data here.
     query->towire.lim = &query->response->data[0] + query->data_size; // This is the limit to how much we can store.
     query->towire.message = query->response;
     query->towire.p_rdlength = NULL;
     query->towire.p_opt = NULL;
     query->p_dso_length = NULL;
 }

 static void
 dns_push_start(dnssd_query_t *query)
 {
     const char *failnote = NULL;

     // If we don't have a dso header yet, start one.
     if (query->p_dso_length == NULL) {
         memset(query->response, 0, (sizeof *query->response) - DNS_DATA_SIZE);
         dns_opcode_set(query->response, dns_opcode_dso);
         // This is a unidirectional DSO message, which is marked as a query
         dns_qr_set(query->response, dns_qr_query);
         // No error cuz not a response.
         dns_rcode_set(query->response, dns_rcode_noerror);

         TOWIRE_CHECK("kDSOType_DNSPushUpdate", &query->towire,
                      dns_u16_to_wire(&query->towire, kDSOType_DNSPushUpdate));
         if (query->towire.p + 2 > query->towire.lim) {
             ERROR("[Q%d] No room for dso length in DNS Push notification message.", SERIAL(query));
             dp_query_towire_reset(query);
             return;
         }
         query->p_dso_length = query->towire.p;
         query->towire.p += 2;
     }
     if (failnote != NULL) {
         ERROR("[Q%d] couldn't start update: %s", SERIAL(query), failnote);
     }
 }

 static void
 dp_push_response(dnssd_query_t *query, dns_rr_t *original_question)
 {
     struct iovec iov;
     question_t *question = query->question;
     char nbuf[DNS_MAX_NAME_SIZE_ESCAPED + 1];
     char *name = "<null question name>";
     if (question != NULL) {
         name = question->name;
     } else if (original_question != NULL) {
         dns_name_print(original_question->name, nbuf, sizeof(nbuf));
         name = nbuf;
     }

     VALIDATE_TRACKER_CONNECTION_NON_NULL();

     if (query->p_dso_length != NULL) {
         int16_t dso_length = query->towire.p - query->p_dso_length - 2;
         iov.iov_len = (query->towire.p - (uint8_t *)query->response);
         iov.iov_base = query->response;
         INFO("[Q%d][QU%d] " PRI_S_SRP " (len %zd)", SERIAL(query), SERIAL(question), name, iov.iov_len);

         query->towire.p = query->p_dso_length;
         dns_u16_to_wire(&query->towire, dso_length);
         ioloop_send_message(query->tracker->connection, query->message, &iov, 1);
         dp_query_towire_reset(query);
     }
 }

 static bool
 dnssd_hardwired_response(dnssd_query_t *query, DNSServiceQueryRecordReply UNUSED callback)
 {
     hardwired_t *hp;
     question_t *question = query->question;
     const char *response_type = NULL;
     uint8_t v4mapped[12] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff };

     // If the question is for our uuid name in a domain we're authoritative for, respond with the IP address that
     // the question was received on.
     if (!strcasecmp(question->name, uuid_name) && (question->type == dns_rrtype_a || question->type == dns_rrtype_aaaa)) {
         addr_t *local = NULL;
         if (query->message != NULL) {
             local = &query->message->local;
         } else {
             local = &query->dso->transport->local;
         }

         // If it's an IPv4 address we can respond with an A record.
         if (question->type == dns_rrtype_a && local->sa.sa_family == AF_INET) {
             dp_query_add_data_to_response(query, question->name, question->type, dns_qclass_in, 4,
                                           &local->sin.sin_addr, 300, true, true, &query->response->ancount);
             response_type = "local host IPv4 address";
         }
         // If it's an IPv4-mapped IPv6 address, we can respond with an A record
         else if (local->sa.sa_family == AF_INET6 && question->type == dns_rrtype_a &&
                  !memcmp(&local->sin6.sin6_addr, v4mapped, sizeof(v4mapped)))
         {
             dp_query_add_data_to_response(query, question->name, question->type, dns_qclass_in, 4,
                                           ((uint8_t *)&local->sin6.sin6_addr) + 12, 3600, true, true,
                                           &query->response->ancount);
             response_type = "local host v4-mapped address";
         }
         // If it's an IPv6 address and NOT a v4-mapped address, we can respond with an AAAA record.
         else if (local->sa.sa_family == AF_INET6 && question->type == dns_rrtype_aaaa &&
                  memcmp(&local->sin6.sin6_addr, v4mapped, sizeof(v4mapped)))
         {
             struct in6_addr response = local->sin6.sin6_addr;
             bool address_is_usable = false;
             // If it's not a synthesized anycast or rloc address, we can just use it.
             if (!is_thread_mesh_synthetic_address(&response)) {
                 address_is_usable = true;
                 response_type = "local host IPv6 address";
             } else {
                 // Otherwise, we need to find the mesh-local address and respond with that.
                 srp_server_t *server_state = srp_servers;
 #if SRP_TEST_SERVER
                 for (; !address_is_usable && server_state != NULL; server_state = server_state->next)
 #endif
                 {
                     if (0) {
 #if STUB_ROUTER
                     } else if (server_state->stub_router_enabled) {
                         route_state_t *route_state = server_state->route_state;
                         if (route_state->thread_interface_name != NULL) {
                             for (interface_address_state_t *address = route_state->interface_addresses;
                                  !address_is_usable && address != NULL; address = address->next)
                             {
                                 // Wrong interface or wrong type of address
                                 if (strcmp(address->name, route_state->thread_interface_name) ||
                                     address->addr.sa.sa_family != AF_INET6)
                                 {
                                     continue;
                                 }
                                 if (!is_thread_mesh_synthetic_or_link_local(&address->addr.sin6.sin6_addr))
                                 {
                                     memcpy(&response, &address->addr.sin6.sin6_addr, sizeof(response));
                                     response_type = "thread interface address";
                                     address_is_usable = true;
                                 }
                             }
                             if (address_is_usable == false) {
                                 response_type = "no usable address on thread interface";
                             }
                         } else {
                             address_is_usable = false;
                             response_type = "thread interface name unknown";
                         }
 #endif
                     } else {
                         // For thread device, the only thing that can work is the ML-EID.
                         if (service_publisher_get_ml_eid(server_state->service_publisher, &response)) {
                             address_is_usable = true;
                             response_type = "thread device ML-EID";
                         } else {
                             response_type = "thread ML-EID not known";
                         }
                     }
                 }
             }
             if (address_is_usable) {
                 SEGMENTED_IPv6_ADDR_GEN_SRP(&response, response_buf);
                 INFO(PUB_S_SRP " IN AAAA " PRI_SEGMENTED_IPv6_ADDR_SRP " " PUB_S_SRP, question->name,
                      SEGMENTED_IPv6_ADDR_PARAM_SRP(&response, response_buf), response_type);
                 dp_query_add_data_to_response(query, question->name, question->type, dns_qclass_in, 16,
                                               &response, 300, true, true, &query->response->ancount);
             }
         }
     } else {
         for (hp = query->question->served_domain->hardwired_responses; hp; hp = hp->next) {
             if ((query->question->type == hp->type || query->question->type == dns_rrtype_any) &&
                 query->question->qclass == dns_qclass_in && !strcasecmp(hp->name, query->question->name))
             {
                 if (query->dso != NULL) {
                     // Since hardwired response is set by the dnssd-proxy itself, do not do ".local" translation.
                     dp_query_add_data_to_response(query, hp->fullname, hp->type, dns_qclass_in, hp->rdlen, hp->rdata,
                                                   3600, true, false, NULL);
                 } else {
                     // Store the response
                     if (!query->towire.truncated) {
                         // Since hardwired response is set by the dnssd-proxy itself, do not do ".local" translation.
                         dp_query_add_data_to_response(query, hp->fullname, hp->type, dns_qclass_in,
                                                       hp->rdlen, hp->rdata, 3600, true, false,
                                                       &query->response->ancount);
                     }
                 }
                 response_type = "hardwired";
             }
         }
     }
     if (response_type != NULL) {
         return true;
     }
     return false;
 }

 #if SRP_FEATURE_NAT64
 static void
 dp_query_append_nat64_prefix_records(dnssd_query_t *query)
 {
     // 192.0.0.170 and 192.0.0.171 are reserved IPv4 addresses for ipv4only.arpa.
     // See <https://tools.ietf.org/html/rfc7050#section-8.2>.
     const uint8_t ipv4_addrs[2][4] = {
         {192, 0, 0, 170},
         {192, 0, 0, 171}
     };
     uint8_t rdata[16] = {0};

     VALIDATE_TRACKER_CONNECTION_NON_NULL();

     const struct in6_addr *prefix = nat64_get_ipv6_prefix();
     memcpy(rdata, prefix->s6_addr, sizeof(rdata));
     for (size_t i = 0; i < countof(ipv4_addrs);) {
         memcpy(&rdata[12], ipv4_addrs[i], 4);
         uint8_t *revert = query->towire.p;
         dp_query_add_data_to_response(query, "ipv4only.arpa.", dns_rrtype_aaaa, query->question->qclass,
                                       (uint16_t)sizeof(rdata), rdata, RFC8766_TTL_CLAMP, true, false,
                                       &query->response->arcount);
         if (query->towire.truncated) {
             query->towire.p = revert;
             if (query->tracker->connection->tcp_stream) {
                 if (embiggen(query)) {
                     query->towire.truncated = false;
                     query->towire.error = false;
                     continue;
                 } else {
                     dns_rcode_set(query->response, dns_rcode_servfail);
                 }
             }
             return;
         }
         i++;
     }
 }
 #endif // SRP_FEATURE_NAT64

 static void
 dns_query_answer_process(DNSServiceFlags flags, DNSServiceErrorType errorCode,
                          const char *fullname, uint16_t rrtype, uint16_t rrclass,
                          uint16_t rdlen, const void *rdata, uint32_t ttl, dnssd_query_t *query, bool send)
 {
     question_t *question = query->question;

     INFO("[Q%d][QU%d] " PRI_S_SRP PUB_S_SRP PUB_S_SRP " %d %x %d %p", SERIAL(query), SERIAL(question),
          fullname, (flags & kDNSServiceFlagsMoreComing) ? " m " : " ", dns_rrtype_to_string(rrtype), rrclass, rdlen,
          errorCode, query);

     VALIDATE_TRACKER_CONNECTION_NON_NULL();

     if (errorCode == kDNSServiceErr_NoError) {
 #if SRP_FEATURE_NAT64
         const bool aaaa_query_got_a_record = (question->type == dns_rrtype_aaaa) && (rrtype == dns_rrtype_a);
         if (srp_servers->srp_nat64_enabled && (ntohs(query->response->arcount) != 0) && !aaaa_query_got_a_record) {
             return;
         }
 #endif
     re_add:
         if (send) {
             uint16_t *counter = &query->response->ancount;
 #if SRP_FEATURE_NAT64
             if (srp_servers->srp_nat64_enabled && aaaa_query_got_a_record) {
                 counter = &query->response->arcount;
             }
 #endif
             uint8_t *revert = query->towire.p;
             dp_query_add_data_to_response(query, fullname, rrtype, rrclass, rdlen, rdata,
                                           ttl > RFC8766_TTL_CLAMP ? RFC8766_TTL_CLAMP : ttl, false, false, counter);
             if (query->towire.truncated) {
                 query->towire.p = revert;
                 if (query->tracker->connection->tcp_stream) {
                     if (embiggen(query)) {
                         query->towire.truncated = false;
                         query->towire.error = false;
                         goto re_add;
                     } else {
                         dns_rcode_set(query->response, dns_rcode_servfail);
                         dp_query_send_dns_response(query, "failed embiggen");
                         return;
                     }
                 }
             }
         }
         // If there isn't more coming, send the response now
         if (!(flags & kDNSServiceFlagsMoreComing) || query->towire.truncated) {
             // When we get a CNAME response, we may not get the record it points to with the MoreComing
             // flag set, so don't respond yet.
             if (question->type != dns_rrtype_cname && rrtype == dns_rrtype_cname) {
                 INFO("[Q%d][QU%d] not responding yet because CNAME.", SERIAL(query), SERIAL(question));
             } else {
 #if SRP_FEATURE_NAT64
                 if (srp_servers->srp_nat64_enabled && (ntohs(query->response->arcount) != 0)) {
                     dp_query_append_nat64_prefix_records(query);
                 }
 #endif
                 dp_query_send_dns_response(query, "normal success");
             }
         }
     } else if (errorCode == kDNSServiceErr_NoSuchRecord) {
         // If we get "no such record," we can't really do much except return the answer.
         dp_query_send_dns_response(query, "no such record");
     } else {
         dns_rcode_set(query->response, dns_rcode_servfail);
         dp_query_send_dns_response(query, "unhandled error");
     }
 }

 // answer_match is to decide if an answer matches the one requested to be removed.
 // Based on rfc8765
 // Remove all RRsets from a name in all classes:
 //      TTL = 0xFFFFFFFE, RDLEN = 0, CLASS = 255 (ANY).
 // Remove all RRsets from a name in given class:
 //      TTL = 0xFFFFFFFE, RDLEN = 0, CLASS gives class, TYPE = 255 (ANY).
 // Remove specified RRset from a name in given class:
 //      TTL = 0xFFFFFFFE, RDLEN = 0,
 //      CLASS and TYPE specify the RRset being removed.
 // Remove an individual RR from a name:
 //      TTL = 0xFFFFFFFF,
 //      CLASS, TYPE, RDLEN, and RDATA specify the RR being removed.
 static bool
 answer_match(const answer_t *answer, uint32_t rdlen, const char *fullname, uint16_t rrtype, uint16_t rrclass, const void *rdata)
 {
     return (((rrclass == dns_qclass_any) || (rrclass == answer->rrclass)) &&
             ((rrtype == dns_rrtype_any) || (rrtype == answer->rrtype)) &&
             ((rdlen == 0) || ((rdlen == answer->rdlen) && (memcmp(answer->rdata, rdata, rdlen) == 0))) &&
             (!strcmp(answer->fullname, fullname))
             );
 }

 static void
 dns_push_query_answer_process(DNSServiceFlags flags, DNSServiceErrorType errorCode,
                               const char *fullname, uint16_t rrtype, uint16_t rrclass,
                               uint16_t rdlen, const void *rdata, uint32_t ttl, dnssd_query_t *query, bool send);

 // This is the callback for both dns query and dns push query results.
 static void
 dns_question_callback(DNSServiceRef UNUSED sdRef, DNSServiceFlags flags, uint32_t interfaceIndex,
                       DNSServiceErrorType errorCode, const char *fullname, uint16_t rrtype, uint16_t rrclass,
                       uint16_t rdlen, const void *rdata, uint32_t ttl, void *context)
 {
     question_t *question = context;
     dnssd_query_t *query, *next;
     bool send = true;

     // For dns push query,  insert or remove answer from the question cache depending on the flags
     // For dns query (dso==NULL), add answer when receiving callback to the question
     if (errorCode == kDNSServiceErr_NoError) {
         if (flags & kDNSServiceFlagsAdd) {
             // Eliminate duplicates (appears on more than one interface)
             for (answer_t *answer = question->answers; answer != NULL; answer = answer->next) {
                 if (answer_match(answer, rdlen, fullname, rrtype, rrclass, rdata)) {
                     INFO("[QU%d] duplicate answer in cache - name: " PRI_S_SRP ", rrtype: " PUB_S_SRP
                          ", rrclass: " PUB_S_SRP ", rdlen: %u." PUB_S_SRP, SERIAL(question),
                          fullname, dns_rrtype_to_string(rrtype), dns_qclass_to_string(rrclass), rdlen,
                          (flags & kDNSServiceFlagsMoreComing) ? " more coming" : " done");
                     send = false;
                     break;
                 }
             }
             if (send) {
                 // Add the extra space rdlen stores rdata at the end
                 answer_t *answer = calloc(1, sizeof(*answer) + rdlen);
                 if (answer == NULL) {
                     ERROR("[QU%d] unable to allocate memory for answer - name: " PRI_S_SRP ", rrtype: " PUB_S_SRP
                           ", rrclass: " PUB_S_SRP ", rdlen: %u.", SERIAL(question),
                           fullname, dns_rrtype_to_string(rrtype), dns_qclass_to_string(rrclass), rdlen);
                     return;
                 }
                 answer->fullname = strdup(fullname);
                 if (answer->fullname == NULL) {
                     ERROR("[QU%d] strdup failed to copy the answer name: " PRI_S_SRP, SERIAL(question), fullname);
                     free(answer);
                     return;
                 }
                 answer->interface_index = interfaceIndex;
                 answer->ttl = ttl;
                 answer->rrtype = rrtype;
                 answer->rrclass = rrclass;
                 answer->rdlen = rdlen;
                 answer->rdata = (uint8_t *)(answer + 1);
                 memcpy(answer->rdata, rdata, rdlen);
                 answer->next = NULL;
                 // Insert answer at the tail
                 answer_t **tail = &(question->answers);
                 while (*tail != NULL) {
                     tail = &((*tail)->next);
                 }
                 *tail = answer;
                 // Received data; reset no_data flag.
                 question->no_data = false;
                 INFO("[QU%d] add answer to cache - name: " PRI_S_SRP ", rrtype: " PUB_S_SRP
                      ", rrclass: " PUB_S_SRP ", rdlen: %u." PUB_S_SRP, SERIAL(question),
                      fullname, dns_rrtype_to_string(rrtype), dns_qclass_to_string(rrclass), rdlen,
                  (flags & kDNSServiceFlagsMoreComing) ? " more coming" : " done");
             }
         } else {
             // Remove
             answer_t **answer = &(question->answers);
             answer_t *cur = NULL;
             bool matched = false;
             while (*answer != NULL) {
                 cur = *answer;
                 if (answer_match(cur, rdlen, fullname, rrtype, rrclass, rdata)) {
                     INFO("[QU%d] remove answer from cache - "
                          "name: " PRI_S_SRP ", rrtype: " PUB_S_SRP ", rrclass: " PUB_S_SRP ", rdlen: %u." PUB_S_SRP,
                          SERIAL(question), fullname, dns_rrtype_to_string(rrtype), dns_qclass_to_string(rrclass), rdlen,
                          (flags & kDNSServiceFlagsMoreComing) ? " more coming" : " done");
                     *answer = cur->next;
                     dp_answer_free(cur);
                     matched = true;
                     // If individual RR to be removed, get out of the loop once the RR has been removed
                     if (rdlen != 0) {
                         break;
                     }
                 } else {
                     answer = &cur->next;
                 }
             }
             if (!matched) {
                 INFO("[Q%d] remove not found in cache - name: " PRI_S_SRP
                      ", rrtype: " PUB_S_SRP ", rrclass: " PUB_S_SRP ", rdlen: %u." PUB_S_SRP, SERIAL(question),
                      fullname, dns_rrtype_to_string(rrtype), dns_qclass_to_string(rrclass), rdlen,
                      (flags & kDNSServiceFlagsMoreComing) ? " more coming" : " done");
             }
             if (*answer == NULL) {
                 // All the answers get removed; set no_data flag.
                 question->no_data = true;
             }
         }
     } else if (errorCode == kDNSServiceErr_NoSuchRecord) {
         INFO("[QU%d] no data - name: " PRI_S_SRP ", rrtype: " PUB_S_SRP
              ", rrclass: " PUB_S_SRP ", rdlen: %u." PUB_S_SRP, SERIAL(question), fullname, dns_rrtype_to_string(rrtype),
              dns_qclass_to_string(rrclass), rdlen, (flags & kDNSServiceFlagsMoreComing) ? " more coming" : " done");
         question->no_data = true;
     } else if (errorCode == kDNSServiceErr_ServiceNotRunning || errorCode == kDNSServiceErr_DefunctConnection) {
 #if SRP_FEATURE_DNSSD_PROXY_SHARED_CONNECTIONS
         if (shared_discovery_txn != NULL) {
             ioloop_dnssd_txn_cancel(shared_discovery_txn);
             ioloop_dnssd_txn_release(shared_discovery_txn);
             shared_discovery_txn = NULL;
             dp_handle_server_disconnect(NULL, errorCode);
         }
 #else
         ioloop_dnssd_txn_cancel(question->txn);
         ioloop_dnssd_txn_release(question->txn);
         question->txn = NULL;
         dp_handle_server_disconnect(NULL, errorCode);
 #endif
         return; // This doesn't count as a result.
     }
     query = question->queries;
     while(query != NULL) {
         next = query->question_next;
         if (query->dso != NULL) {
             dns_push_query_answer_process(flags, errorCode, fullname, rrtype, rrclass,
                                           rdlen, rdata, ttl, query, send);
         } else {
             dns_query_answer_process(flags, errorCode, fullname, rrtype, rrclass,
                                      rdlen, rdata, ttl, query, send);
         }
         query = next;
     }
     dp_question_cache_remove_queries(question);
 }

 static void
 dp_query_wakeup(void *context)
 {
     dnssd_query_t *query = context;
     char name[DNS_MAX_NAME_SIZE + 1];
     size_t namelen = strlen(query->question->name);
     question_t *question = query->question;

     if (question->answers != NULL) {
         FAULT("[Q%d][QU%d] answers present, but dp_query_wakeup reached for name " PRI_S_SRP,
               SERIAL(query), SERIAL(question), question->name);
     } else {
         question->no_data = true;
     }

     // Should never happen.
     if (namelen + (question->served_domain
                    ? (question->served_domain->interface != NULL
                       ? sizeof local_suffix
                       // XXX why are we checking this but not copying in the served domain name below?
                       : strlen(question->served_domain->domain_ld) + 1)
                    : 0) > sizeof name) {
         ERROR("[Q%d][QU%d] no space to construct name.", SERIAL(query), SERIAL(question));
         dnssd_query_cancel(query);
         return;
     }

     memcpy(name, question->name, namelen + 1);
     if (question->served_domain != NULL) {
         memcpy(name + namelen, local_suffix, sizeof(local_suffix));
     }
     RETAIN_HERE(query, dnssd_query);
     dp_query_send_dns_response(query, "query wakeup");
     dp_question_cache_remove_queries(question);
     RELEASE_HERE(query, dnssd_query);
 }

 // Search asked question in the cache; if not existing, create one.
 static question_t *
 dp_query_question_cache_copy(dns_rr_t *search_term, bool *new)
 {
     char name[DNS_MAX_NAME_SIZE + 1];
     served_domain_t *sdt = dp_served(search_term->name, name, sizeof(name));

     if (sdt == NULL) {
         dns_name_print(search_term->name, name, sizeof name);
     }
     question_t **questions, *ret = NULL;
     question_t *new_question = NULL;
     // if the query is in served domain, lookup in served_domain->questions
     // otherwise lookup in the out-of-domain question cache
     if (sdt != NULL) {
         questions = &sdt->questions;
     } else {
         questions = &questions_without_domain;
     }
     *new = false;
     while (*questions != NULL) {
         question_t *question = *questions;
         if (search_term->type == question->type &&
             search_term->qclass == question->qclass &&
             !strcmp(name, question->name))
         {
             ret = question;
             break;
         }
         questions = &question->next;
     }

     // If no cache entry was found, create one
     if (*questions == NULL) {
         new_question = calloc(1, sizeof(*new_question));
         require_action_quiet(new_question != NULL, exit,
                              ERROR("Unable to allocate memory for question entry on " PRI_S_SRP, name));
         new_question->name = strdup(name);
         require_action_quiet(new_question->name != NULL, exit,
                              ERROR("unable to allocate memory for question name on " PRI_S_SRP, name));
         new_question->type = search_term->type;
         new_question->qclass = search_term->qclass;
         new_question->start_time = srp_utime();
         new_question->answers = NULL;
         new_question->served_domain = sdt;
         new_question->queries = NULL;
         new_question->no_data = false;
         new_question->serial = ++cur_question_serial;

         if (sdt != NULL && sdt->interface != NULL) {
             new_question->interface_index = sdt->interface->ifindex;
             new_question->serviceFlags = kDNSServiceFlagsForceMulticast;
         } else {
             new_question->interface_index = kDNSServiceInterfaceIndexAny;
             new_question->serviceFlags = kDNSServiceFlagsReturnIntermediates;
         }

         // Link the new_question to the question list.
         new_question->next = *questions;
         *questions = new_question;
         RETAIN_HERE(*questions, question); // retain

         // Successfully created a new question, which will be the returned question.
         ret = new_question;
         new_question = NULL;
         *new = true;
     }
 exit:
     if (new_question != NULL) {
         RELEASE_HERE(new_question, question);
     }
     if (ret != NULL) {
         RETAIN_HERE(ret, question);
     }
     return ret;
 }

 // Look for answers in the cache for the current query. Remove flag is used when mDNSResponder connection is broken, to signal to
 // DNS Push clients only that the records previously sent should be discarded.
 static void
 dp_query_reply_from_cache(question_t *question, dnssd_query_t *query, bool remove)
 {
     // For dns query, if no_data is flagged or it's been six seconds since the question
     // was started and there is still no answer yet, we should also respond immediately.
     // [DNS Discovery Proxy RFC, RFC 8766, Section 5.6]
     // Note that six seconds as stated in RFC8766 is probably too long, currently we're using 800ms.
     if (query->dso == NULL &&
         (question->no_data == true ||
          (question->answers == NULL &&
           srp_utime() - question->start_time > RESPONSE_WINDOW_USECS)))
     {
         INFO("[Q%d][QU%d] no data for question - type %d class %d " PRI_S_SRP,
              SERIAL(query), SERIAL(question), question->type, question->qclass, question->name);
         dns_query_answer_process(0, kDNSServiceErr_NoSuchRecord, question->name,
                                  question->type, question->qclass, 0,
                                  NULL, 0, query, true);
         dp_question_cache_remove_queries(question);
         return;
     }
     // answers are available for the question being asked
     if (question->answers != NULL) {
         INFO("[Q%d][QU%d] reply from cache for question - type %d class %d " PRI_S_SRP,
              SERIAL(query), SERIAL(question), question->type, question->qclass, question->name);
         DNSServiceFlags flags;
         answer_t *answer = question->answers;
         while (answer != NULL) {
             if (remove) {
                 flags = 0;
             } else {
                 flags = kDNSServiceFlagsAdd;
             }

             answer_t *next = answer->next;
             if (next != NULL) {
                 flags |= kDNSServiceFlagsMoreComing;
             }
             if (query->dso == NULL) {
                 if (!remove) {
                     dns_query_answer_process(flags, kDNSServiceErr_NoError, answer->fullname,
                                              answer->rrtype, answer->rrclass, answer->rdlen,
                                              answer->rdata, answer->ttl, query, true);
                 }
             } else {
                 dns_push_query_answer_process(flags, kDNSServiceErr_NoError, answer->fullname,
                                               answer->rrtype, answer->rrclass, answer->rdlen,
                                               answer->rdata, answer->ttl, query, true);
             }
             answer = next;
         }
         dp_question_cache_remove_queries(question);
     }
 }

 static void
 dp_query_context_release(void *context)
 {
     dnssd_query_t *query = context;
     RELEASE_HERE(query, dnssd_query);
 }

 static bool
 dp_query_start(dnssd_query_t *query, int *rcode, bool *hardwired, bool dns64)
 {
     bool local = false;
     question_t *question = query->question;

     if (question->served_domain != NULL) {
         if (dnssd_hardwired_response(query, dns_question_callback)) {
             *rcode = dns_rcode_noerror; // indicate that we already sent the response
             *hardwired = true;
             INFO("[Q%d] hardwired response", SERIAL(query));
             return true;
         }
         local = true;
     }

     // If we get an SOA query for record that's under a zone cut we're authoritative for, which
     // is the case of query->served_domain->interface != NULL, then answer with a negative response that includes
     // our authority records, rather than waiting for the query to time out.
     if (question->served_domain != NULL && question->served_domain->interface != NULL && !question->name[0]) {
         // If this isn't a DNS Push query, we can signal that there is no data. Otherwise we just never send an answer since
         // we will never have one.
         if (query->dso == NULL) {
             *hardwired = true;
         }
         return true;
     }

     // Check if DNSServiceQueryRecord call needs to be made
     if (question->txn == NULL) {
         int ret = dp_start_question(question, dns64);
         if (ret == kDNSServiceErr_Refused) {
             *rcode = dns_rcode_servfail;
             INFO("question was refused");
         } else if (ret != kDNSServiceErr_NoError) {
             *rcode = dns_rcode_servfail;
             INFO("[Q%d] couldn't start question", SERIAL(query));
             return false;
         }
     } else {
         if (question->answers != NULL || question->no_data) {
             INFO("[Q%d] answering immediately from cache", SERIAL(query));
             *rcode = dns_rcode_noerror;
             return true;
         }
     }

     // If this isn't a DNS Push subscription, we need to respond quickly with as much data as we have.  It
     // turns out that dig gives us a second, but also that responses seem to come back in on the order of a
     // millisecond, so we'll wait 100ms.
     if (query->dso == NULL && local) {
         // [DNS Discovery Proxy RFC, RFC 8766, Section 5.6, Answer Aggregation]

         // RFC8766 asks us to wait six seconds, but this is probably too long. Most likely we will have all
         // our answers much sooner than that, and waiting this long means that we have to keep state for
         // this long; when there are a lot of queries coming in, that can amount to too much state, causing
         // us to drop requests we could easily have answered.
         if (query->wakeup == NULL) {
             query->wakeup = ioloop_wakeup_create();
             if (query->wakeup == NULL) {
                 *rcode = dns_rcode_servfail;
                 return false;
             }
         }
         ioloop_add_wake_event(query->wakeup, query, dp_query_wakeup, dp_query_context_release, RESPONSE_WINDOW_MSECS /* ms */);
         RETAIN_HERE(query, dnssd_query);
     }

     INFO("[Q%d] waiting for wakeup or response", SERIAL(query));
     return true;
 }

 static dnssd_query_t *
 dp_query_create(dp_tracker_t *tracker, dns_rr_t *question, message_t *message, dso_state_t *dso, int *rcode)
 {
     char name[DNS_MAX_NAME_SIZE + 1];
     served_domain_t *sdt = dp_served(question->name, name, sizeof name);
     int xid = message == NULL ? 0 : ntohs(message->wire.id);

     dnssd_query_t *query = calloc(1,sizeof *query);
     require_action_quiet(query != NULL, exit, *rcode = dns_rcode_servfail;
                          ERROR("Unable to allocate memory for query on " PRI_S_SRP, name));
     RETAIN_HERE(query, dnssd_query); // for the caller
     query->serial = ++cur_query_serial;

     // If it's a query for a name served by the local discovery proxy, do an mDNS lookup.
     if (sdt != NULL) {
         INFO("[Q%d][QID%x] msg %p " PUB_S_SRP " question: type %d class %d " PRI_S_SRP "." PRI_S_SRP " -> "
              PRI_S_SRP DOT_LOCAL, SERIAL(query), xid, message, dso != NULL ? "push" : " dns",
              question->type, question->qclass, name, sdt->domain, name);
     } else {
         dns_name_print(question->name, name, sizeof name);
         INFO("[Q%d][QID%x] msg %p " PUB_S_SRP " question: type %d class %d " PRI_S_SRP, SERIAL(query), xid,
              message, dso != NULL ? "push" : " dns", question->type, question->qclass, name);
     }

     query->response = malloc(sizeof *query->response);
     require_action_quiet(query->response != NULL, exit, *rcode = dns_rcode_servfail;
                          ERROR("[Q%d] Unable to allocate memory for query response on " PRI_S_SRP,
                                SERIAL(query), name));

     query->data_size = DNS_DATA_SIZE;

     // Zero out the DNS header, but not the data.
     memset(query->response, 0, DNS_HEADER_SIZE);

     // Name now contains the name we want mDNSResponder to look up.

     // The only thing holding a reference to query is its tracker.
     query->tracker = tracker;
     RETAIN_HERE(query->tracker, dp_tracker);

     // Remember whether this is a long-lived query.
     query->dso = dso;

     // Retain the question, as we will need it to send a response.
     if (message != NULL) {
         query->message = message;
         ioloop_message_retain(query->message);
     }

     // Start writing the response
     dp_query_towire_reset(query);

     bool new_entry;
     query->question = dp_query_question_cache_copy(question, &new_entry);
     require_action_quiet(query->question != NULL, exit, *rcode = dns_rcode_servfail);

     // add the query to the list of queries that are asking this question.
     dnssd_query_t **qr = &(query->question->queries);
     while (*qr != NULL) {
         qr = &(*qr)->question_next;
     }
     *qr = query;
     // Question query list holds a reference to the query.
     RETAIN_HERE(*qr, dnssd_query);
     INFO("[Q%d][QID%x] msg %p " PUB_S_SRP " cache entry for question: type %d class %d " PRI_S_SRP, SERIAL(query),
          xid, query->message, new_entry ? "new" : " existing", question->type, question->qclass, name);
     *rcode = dns_rcode_noerror;
     dp_num_outstanding_queries++;

 exit:
     if (*rcode != dns_rcode_noerror && query != NULL) {
         RELEASE_HERE(query, dnssd_query);
         query = NULL;
     }
     return query;
 }


 static void
 dns_push_query_answer_process(DNSServiceFlags flags, DNSServiceErrorType errorCode,
                               const char *fullname, uint16_t rrtype, uint16_t rrclass,
                               uint16_t rdlen, const void *rdata, uint32_t ttl, dnssd_query_t *query, bool send)
 {
     uint8_t *revert = query->towire.p;

     VALIDATE_TRACKER_CONNECTION_NON_NULL();

     // From DNSSD-Hybrid, for mDNS queries:
     // If we have cached answers, respond immediately, because we probably have all the answers.
     // If we don't have cached answers, respond as soon as we get an answer (presumably more-coming will be false).

     // The spec says to not query if we have cached answers.   We trust the DNSServiceQueryRecord call to handle this.

     // If we switch to using a single connection to mDNSResponder, we could have !more-coming trigger a flush of
     // all outstanding queries that aren't waiting on a time trigger.   This is because more-coming isn't
     // query-specific

     INFO("[Q%d] PUSH " PRI_S_SRP " %d %d %x %d %p", SERIAL(query), fullname, rrtype, rrclass, rdlen, errorCode, query);

     // query_state_waiting means that we're answering a regular DNS question
     if (errorCode == kDNSServiceErr_NoError) {
         if (send) {
             const void *rdata_to_send;
             uint32_t ttl_to_send;
             // If kDNSServiceFlagsAdd is set, it's an add, otherwise a delete.
         re_add:
             if (flags & kDNSServiceFlagsAdd) {
                 rdata_to_send = rdata;
                 ttl_to_send = ttl;
                 INFO("[Q%d] DNS Push adding record - "
                      "name: " PRI_S_SRP ", rrtype: " PUB_S_SRP ", rrclass: " PUB_S_SRP ", rdlen: %u, ttl: %u.",
                      SERIAL(query), fullname, dns_rrtype_to_string(rrtype), dns_qclass_to_string(rrclass), rdlen, ttl_to_send);
             } else {
                 // See <https://tools.ietf.org/html/rfc8765#section-6.3.1>.
 #define TTL_TO_REMOVE_INDIVIDUAL_RECORDS    0xFFFFFFFF
 #define TTL_TO_REMOVE_MULTIPLE_RECORDS      0xFFFFFFFE
                 if (rdlen == 0) {
                     // Remove specified RRset from a name in given class:
                     // TTL = 0xFFFFFFFE, RDLEN = 0,
                     // CLASS and TYPE specify the RRset being removed.
                     rdata_to_send = NULL;
                     ttl_to_send = TTL_TO_REMOVE_MULTIPLE_RECORDS;
                 } else {
                     // Remove an individual RR from a name:
                     // TTL = 0xFFFFFFFF,
                     // CLASS, TYPE, RDLEN, and RDATA specify the RR being removed.
                     rdata_to_send = rdata;
                     ttl_to_send = TTL_TO_REMOVE_INDIVIDUAL_RECORDS;
                 }
                 INFO("[Q%d] DNS Push removing record - "
                      "name: " PRI_S_SRP ", rrtype: " PUB_S_SRP ", rrclass: " PUB_S_SRP ", rdlen: %u, ttl: 0x%X.",
                      SERIAL(query), fullname, dns_rrtype_to_string(rrtype), dns_qclass_to_string(rrclass), rdlen, ttl_to_send);
             }

             // Do the update.
             dp_query_add_data_to_response(query, fullname, rrtype, rrclass, rdlen, rdata_to_send,
                                           ttl_to_send, false, false, NULL);

             if (query->towire.truncated) {
                 query->towire.truncated = false;
                 query->towire.p = revert;
                 query->towire.error = 0;
                 dp_push_response(query, NULL);
                 dns_push_start(query);
                 goto re_add;
             }
         }
         // If there isn't more coming, send a DNS Push notification now.
         // XXX If enough comes to fill the response, send the message.
         if (!(flags & kDNSServiceFlagsMoreComing)) {
             dp_push_response(query, NULL);
         }
     } else if (errorCode != kDNSServiceErr_NoSuchRecord) { // Do nothing if kDNSServiceErr_NoSuchRecord is received.
         ERROR("[Q%d] unexpected error code %d", SERIAL(query), errorCode);
         dnssd_query_cancel(query);
     }
 }

 static void
 dns_push_subscribe(dp_tracker_t *tracker, const dns_wire_t *header, dso_state_t *dso, dns_rr_t *question,
                    const char *activity_name, const char * UNUSED opcode_name)
 {
     int rcode;
     dnssd_query_t *query = dp_query_create(tracker, question, NULL, dso, &rcode);

     if (!query) {
         dso_simple_response(tracker->connection, NULL, header, rcode);
         return;
     }

     dso_activity_t *activity = dso_add_activity(dso, activity_name, push_subscription_activity_type, query,
                                                 dns_push_cancel);
     RETAIN_HERE(query, dnssd_query); // The activity holds a reference to the query.
     query->activity = activity;
     bool dns64 = false;
 #if SRP_FEATURE_NAT64
     if (srp_servers->srp_nat64_enabled) {
         dns64 = nat64_is_active();
     }
 #endif
     bool hardwired = false;
     if (!dp_query_start(query, &rcode, &hardwired, dns64)) {
         dso_simple_response(tracker->connection, NULL, header, rcode);
         dp_question_cache_remove_queries(query->question);
         dnssd_query_cancel(query);
     } else {
         char nbuf[DNS_MAX_NAME_SIZE + 1];
         dns_name_print(question->name, nbuf, sizeof(nbuf));
         // The push subscribe can be considered a success at this point.
         dso_simple_response(tracker->connection, NULL, header, dns_rcode_noerror);
         if (hardwired) {
             INFO("[DSO%d][Q%d] hardwired response for " PRI_S_SRP " %d %d",
                  SERIAL(dso), SERIAL(query), nbuf, question->type, question->qclass);
             dp_push_response(query, question);
         } else if (query->question != NULL) {
             INFO("[DSO%d][Q%d][QU%d] replying from cache for " PRI_S_SRP " %d %d",
                  SERIAL(dso), SERIAL(query), SERIAL(query->question), nbuf, question->type, question->qclass);
             dp_query_reply_from_cache(query->question, query, false);
         }
     }

     // dp_query_create() returned the query retained; when we added the query to the activity, we retained it again;
     // if something went wrong, the second retain was released, but whether or not something went wrong, we can now
     // safely release the initial retain.
     RELEASE_HERE(query, dnssd_query);
 }

 static void
 dns_push_reconfirm(comm_t *comm, const dns_wire_t *header, dso_state_t *dso)
 {
     dns_rr_t question;
     char name[DNS_MAX_NAME_SIZE + 1];
     uint16_t rdlen;
     memset(&question, 0, sizeof(question));

     // The TLV offset should always be pointing into the message.
     unsigned offp = (unsigned)(dso->primary.payload - &header->data[0]);
     unsigned len = offp + dso->primary.length;
     dp_tracker_t *tracker = comm->context;

     // Parse the name, rrtype and class.   We say there's no rdata even though there is
     // because there's no ttl and also we want the raw rdata, not parsed rdata.
     if (!dns_rr_parse(&question, header->data, len, &offp, false, false) ||
         !dns_u16_parse(header->data, len, &offp, &rdlen))
     {
         dso_simple_response(comm, NULL, header, dns_rcode_formerr);
         ERROR("[DSO%d][C%d][TRK%d] RR parse from %s failed",
               SERIAL(dso), SERIAL(comm), SERIAL(tracker), dso->remote_name);
         goto out;
     }
     if (rdlen + offp != len) {
         dso_simple_response(comm, NULL, header, dns_rcode_formerr);
         ERROR("[DSO%d][C%d][TRK%d] RRdata parse from %s failed: length mismatch (%d != %d)",
               SERIAL(dso), SERIAL(comm), SERIAL(tracker), dso->remote_name, rdlen + offp, len);
         goto out;
     }

     if ((dp_served(question.name, name, sizeof name))) {
         size_t name_len = strlen(name);
         if (name_len + sizeof local_suffix > sizeof name) {
             dso_simple_response(comm, NULL, header, dns_rcode_formerr);
             ERROR("[DSO%d][C%d][TRK%d] name is too long for .local suffix: %s", SERIAL(dso), SERIAL(comm), SERIAL(tracker), name);
             goto out;
         }
         memcpy(&name[name_len], local_suffix, sizeof local_suffix);
     } else {
         dns_name_print(question.name, &name[8], sizeof name - 8);
     }
     // transmogrify name.
     DNSServiceReconfirmRecord(0, kDNSServiceInterfaceIndexAny, name,
                               question.type, question.qclass, rdlen, &header->data[offp]);
     dso_simple_response(comm, NULL, header, dns_rcode_noerror);
 out:
     dns_rrdata_free(&question);
     dns_name_free(question.name);
 }

 static void
 dns_push_unsubscribe(dso_activity_t *activity)
 {
     dnssd_query_t *query = activity->context;
     dnssd_query_cancel(query);
     // No response, unsubscribe is unidirectional.
 }

 static void
 dns_push_subscription_change(const char *opcode_name, dp_tracker_t *tracker, const dns_wire_t *header, dso_state_t *dso)
 {
     // type-in-hex/class-in-hex/name-to-subscribe
     char activity_name[5];
     dso_activity_t *activity;

     // The TLV offset should always be pointing into the message.
     unsigned offp = (unsigned)(dso->primary.payload - &header->data[0]);
     unsigned len = offp + dso->primary.length;
     // Get the question
     dns_rr_t question;
     uint16_t subscribe_xid = ntohs(header->id);
     char nbuf[DNS_MAX_NAME_SIZE + 1];

     memset(&question, 0, sizeof(question));
     if (dso->primary.opcode == kDSOType_DNSPushSubscribe) {
         if (!dns_rr_parse(&question, header->data, offp + dso->primary.length, &offp, false, false)) {
             dso_simple_response(tracker->connection, NULL, header, dns_rcode_formerr);
             ERROR("[DSO%d][TRK%d] RR parse for %s from %s failed", SERIAL(dso), SERIAL(tracker), dso->remote_name, opcode_name);
             goto out;
         }
         dns_name_print(question.name, nbuf, sizeof(nbuf));
     } else {
         // Unsubscribes are unidirectional, so no response can be sent
         if (!dns_u16_parse(header->data, offp + dso->primary.length, &offp, &subscribe_xid)) {
             ERROR("unable to get subscribe xid from primary");
             goto out;
         }
         const char none[] = "none";
         memcpy(nbuf, none, sizeof(none));
     }
     if (offp != len) {
         if (dso->primary.opcode == kDSOType_DNSPushSubscribe) {
             dso_simple_response(tracker->connection, NULL, header, dns_rcode_formerr);
         }
         ERROR("DNS push " PUB_S_SRP " parse from %s failed: length mismatch (%d != %d)",
               dso->primary.opcode == kDSOType_DNSPushSubscribe ? "subscribe" : "unsubscribe",
               dso->remote_name, offp, len);
         goto out;
     }

     // Concoct an activity name. The subscribe transaction ID is required to be unique and is used by the
     // protocol to identify the subscription, so we can just use that.
     snprintf(activity_name, sizeof(activity_name), "%04x", subscribe_xid);

     activity = dso_find_activity(dso, activity_name, push_subscription_activity_type, NULL);
     if (activity == NULL) {
         // Unsubscribe with no activity means no work to do; just return noerror.
         if (dso->primary.opcode != kDSOType_DNSPushSubscribe) {
             ERROR("[DSO%d][TRK%d] " PUB_S_SRP " for " PRI_S_SRP " (" PUB_S_SRP ") when no subscription exists.",
                   SERIAL(dso), SERIAL(tracker), opcode_name, nbuf, activity_name);
         } else {
             INFO("[DSO%d][TRK%d] " PUB_S_SRP " for " PRI_S_SRP " (" PUB_S_SRP ") type %d.",
                  SERIAL(dso), SERIAL(tracker), opcode_name, nbuf, activity_name, question.type);
             // In this case we have a push subscribe for which no subscription exists, which means we can do it.
             dns_push_subscribe(tracker, header, dso, &question, activity_name, opcode_name);
         }
     } else {
         // We should never get two subscribes with the same transaction id.
         if (dso->primary.opcode == kDSOType_DNSPushSubscribe) {
             ERROR("[DSO%d][TRK%d] " PUB_S_SRP " for " PRI_S_SRP " (" PUB_S_SRP ") "
                   "xid %d when subscription already exists.", SERIAL(dso), SERIAL(tracker),
                   opcode_name, nbuf, activity_name, subscribe_xid);
             dso_simple_response(tracker->connection, NULL, header, dns_rcode_refused);
         }
         // Otherwise cancel the subscription.
         else {
             dnssd_query_t *query = activity->context;
             char *question_name = query->question != NULL ? query->question->name : nbuf;
             INFO("[DSO%d][TRK%d] " PUB_S_SRP " for " PRI_S_SRP " (" PUB_S_SRP ") type %d.",
                  SERIAL(dso), SERIAL(tracker), opcode_name, question_name, activity_name, question.type);
             dns_push_unsubscribe(activity);
         }
     }
 out:
     dns_rrdata_free(&question);
     dns_name_free(question.name);
 }

 static bool
 dso_limit(dp_tracker_t *tracker, message_t *message, dp_tracker_session_type_t session_type)
 {
     if (num_push_sessions == MAX_DSO_CONNECTIONS) {
         // We are too busy. Return a retry-delay response.
         INFO("[TRK%d] no more DNS Push connections allowed--sending retry-delay: %d", SERIAL(tracker), num_push_sessions);
         dso_retry_delay_response(tracker->connection, message, &message->wire, dns_rcode_servfail, BUSY_RETRY_DELAY_MS);

         num_push_sessions_dropped_for_load++;
         // Cancel the connection after five seconds
         dp_tracker_idle_after(tracker, 5, NULL);
         return true;
     }

     // Count this as a DSO connection.
     (num_push_sessions)++;
     INFO("[TRK%d] new DNS Push connection, count is now %d", SERIAL(tracker), num_push_sessions);

     tracker->session_type = session_type;
     return false;
 }

 static void dso_message(dp_tracker_t *tracker, message_t *message, dso_state_t *dso)
 {
     // For the first DSO message we get on a connection, see if we already have too many connections of
     // the same type. We track SRP replication and DNS Push separately, because we don't want a surfeit of
     // DNS Push messages to prevent replication from working. A surfeit of SRP Replication connections is
     // less likely, and less problematic.
     if (tracker->session_type == dp_tracker_session_none) {
         if (dso->primary.opcode != kDSOType_SRPLSession) {
             if (dso_limit(tracker, message, dp_tracker_session_push)) {
                 return;
             }
         }
     }

     switch(dso->primary.opcode) {
     case kDSOType_DNSPushSubscribe:
         dns_push_subscription_change("DNS Push Subscribe", tracker, &message->wire, dso);
         break;
     case kDSOType_DNSPushUnsubscribe:
         dns_push_subscription_change("DNS Push Unsubscribe", tracker, &message->wire, dso);
         break;

     case kDSOType_DNSPushReconfirm:
         dns_push_reconfirm(tracker->connection, &message->wire, dso);
         break;

     case kDSOType_DNSPushUpdate:
         INFO("[DSO%d][TRK%d] bogus push update message %d", SERIAL(dso), SERIAL(tracker), dso->primary.opcode);
         dso_state_cancel(dso);
         break;

 #if SRP_FEATURE_REPLICATION
     case kDSOType_SRPLSession:
         if (dso->activities != NULL) {
             dso_state_cancel(dso);
             ERROR("[DSO%d][TRK%d][C%d] " PRI_S_SRP ": SRP Replication session start received on a connection that is already doing DNS Push.",
                   SERIAL(dso), SERIAL(tracker), SERIAL(tracker->connection), tracker->connection->name);
             return;
         }
 #ifdef SRP_TEST_SERVER
         srpl_dso_server_message(tracker->connection, message, dso, (srp_server_t*)tracker->connection->srp_server);
 #else
         srpl_dso_server_message(tracker->connection, message, dso, srp_servers);
 #endif
         break;
 #endif

     default:
         INFO("[DSO%d][TRK%d] unexpected primary TLV %d", SERIAL(dso), SERIAL(tracker), dso->primary.opcode);
         dso_simple_response(tracker->connection, NULL, &message->wire, dns_rcode_dsotypeni);
         break;
     }
     // XXX free the message if we didn't consume it.
 #ifdef SRP_TEST_SERVER
     if (srp_test_dso_message_finished != NULL) {
         srp_test_dso_message_finished(srp_test_tls_listener_context, message, dso);
     }
 #endif
 }

 static void
 dp_keepalive_response_send(dso_keepalive_context_t *keepalive_event, dso_state_t *dso)
 {
     uint8_t dsobuf[SRPL_KEEPALIVE_MESSAGE_LENGTH];
     dns_towire_state_t towire;
     struct iovec iov;
     uint16_t *p_dso_length;
     dso_message_t state;

     if (dso->transport == NULL) {
         ERROR("dso state " PRI_S_SRP " has no transport", dso->remote_name);
         return;
     }

     memset(&towire, 0, sizeof(towire));
     towire.p = &dsobuf[DNS_HEADER_SIZE];
     towire.lim = towire.p + (sizeof(dsobuf) - DNS_HEADER_SIZE);
     towire.message = (dns_wire_t *)dsobuf;
     towire.p_rdlength = NULL;
     towire.p_opt = NULL;
     p_dso_length = NULL;

     dso_make_message(&state, dsobuf, sizeof(dsobuf), dso, false /* unidirectional */, true /* response */,
                      keepalive_event->xid, dns_rcode_noerror, dso->transport);
     dns_u16_to_wire(&towire, kDSOType_Keepalive);
     dns_rdlength_begin(&towire);
     dns_u32_to_wire(&towire, keepalive_event->inactivity_timeout); // Idle timeout (we are never idle)
     dns_u32_to_wire(&towire, keepalive_event->keepalive_interval); // Keepalive timeout
     dns_rdlength_end(&towire);
     if (towire.error) {
         ERROR("ran out of message space at " PUB_S_SRP ", :%d", __FILE__, towire.line);
         return;
     }
     memset(&iov, 0, sizeof(iov));
     iov.iov_len = towire.p - dsobuf;
     iov.iov_base = dsobuf;
     if (!ioloop_send_message(dso->transport, NULL, &iov, 1)) {
         INFO("send failed");
         return;
     }

     INFO("sent %zd byte response Keepalive, xid %02x%02x (was %04x), to " PRI_S_SRP,
          iov.iov_len, dsobuf[0], dsobuf[1], keepalive_event->xid, dso->transport->name);
 }

 static void
 dns_push_callback(void *context, void *event_context, dso_state_t *dso, dso_event_type_t eventType)
 {
     dso_keepalive_context_t *keepalive_context;
     message_t *message;
     switch(eventType)
     {
     case kDSOEventType_DNSMessage:
         // We shouldn't get here because we already handled any DNS messages
         message = event_context;
         INFO("[DSO%d] DNS Message (opcode=%d) received from " PRI_S_SRP, SERIAL(dso), dns_opcode_get(&message->wire),
              dso->remote_name);
         break;
     case kDSOEventType_DNSResponse:
         // We shouldn't get here because we already handled any DNS messages
         message = event_context;
         INFO("[DSO%d] DNS Response (opcode=%d) received from " PRI_S_SRP, SERIAL(dso), dns_opcode_get(&message->wire),
              dso->remote_name);
         break;
     case kDSOEventType_DSOMessage:
         INFO("[DSO%d] DSO Message (Primary TLV=%d) received from " PRI_S_SRP,
              SERIAL(dso), dso->primary.opcode, dso->remote_name);
         message = event_context;
         dso_message((dp_tracker_t *)context, message, dso);
         break;
     case kDSOEventType_DSOResponse:
         INFO("[DSO%d] DSO Response (Primary TLV=%d) received from " PRI_S_SRP,
              SERIAL(dso), dso->primary.opcode, dso->remote_name);
         break;

     case kDSOEventType_Finalize:
         INFO("[DSO%d] Finalize", SERIAL(dso));
         break;

     case kDSOEventType_Connected:
         INFO("[DSO%d] Connected to " PRI_S_SRP, SERIAL(dso), dso->remote_name);
         break;

     case kDSOEventType_ConnectFailed:
         INFO("[DSO%d] Connection to " PRI_S_SRP " failed", SERIAL(dso), dso->remote_name);
         break;

     case kDSOEventType_Disconnected:
         INFO("[DSO%d] Connection to " PRI_S_SRP " disconnected", SERIAL(dso), dso->remote_name);
         break;
     case kDSOEventType_ShouldReconnect:
         INFO("[DSO%d] Connection to " PRI_S_SRP " should reconnect (not for a server)", SERIAL(dso), dso->remote_name);
         break;
     case kDSOEventType_Inactive:
         INFO("[DSO%d] Inactivity timer went off, closing connection.", SERIAL(dso));
         break;
     case kDSOEventType_Keepalive:
         INFO("[DSO%d] should send a keepalive now.", SERIAL(dso));
         break;
     case kDSOEventType_KeepaliveRcvd:
         keepalive_context = event_context;
         keepalive_context->send_response = false;
         INFO("[DSO%d] " PRI_S_SRP ": keepalive received, xid %04x.", SERIAL(dso), dso->transport->name, keepalive_context->xid);

         // If we are the server, we have to send a response to the keepalive.
         if (dso->is_server) {
             dp_keepalive_response_send(keepalive_context, dso);
         }
         break;
     case kDSOEventType_RetryDelay:
         INFO("[DSO%d] keepalive received.", SERIAL(dso));
         break;
     }
 }

 static bool
 dp_dns_query(dp_tracker_t *tracker, message_t *message, dns_rr_t *question, int num_questions)
 {
     int rcode;

     // Limit outstanding queries if we don't have shared connection support
     if (dp_num_outstanding_queries >= 256) {
         num_queries_dropped_for_load++;
         dso_simple_response(tracker->connection, message, &message->wire, dns_rcode_servfail);
         ERROR("[TRK%d][QID %x] dropping query because there are too many", SERIAL(tracker), ntohs(message->wire.id));
         return false;
     }


     dnssd_query_t *query = dp_query_create(tracker, question, message, NULL, &rcode);
     const char *failnote = NULL;
     if (!query) {
         ERROR("[TRK%d][QID %x] query create failed", SERIAL(tracker), ntohs(message->wire.id));
         dso_simple_response(tracker->connection, message, &message->wire, rcode);
         return false;
     }
     query->num_questions = num_questions;

     dns_rcode_set(query->response, dns_rcode_noerror);

     // For DNS queries, we need to return the question.
     query->response->qdcount = htons(1);
     if (query->question->served_domain != NULL) {
         TOWIRE_CHECK("name", &query->towire, dns_name_to_wire(NULL, &query->towire, query->question->name));
         TOWIRE_CHECK("enclosing_domain", &query->towire,
                      dns_full_name_to_wire(&query->enclosing_domain_pointer,
                                            &query->towire, query->question->served_domain->domain));
     } else {
         TOWIRE_CHECK("full name", &query->towire, dns_full_name_to_wire(NULL, &query->towire, query->question->name));
     }
     TOWIRE_CHECK("TYPE", &query->towire, dns_u16_to_wire(&query->towire, question->type));    // TYPE
     TOWIRE_CHECK("CLASS", &query->towire, dns_u16_to_wire(&query->towire, question->qclass));  // CLASS
     if (failnote != NULL) {
         ERROR("[TRK%d][QID %x] failure encoding question: " PUB_S_SRP, SERIAL(tracker), ntohs(message->wire.id), failnote);
         goto fail;
     }

     // Set message ID.
     query->towire.message->id = message->wire.id;

     // We should check for OPT RR, but for now assume it's there.
     query->is_edns0 = true;

     bool dns64 = false;
 #if SRP_FEATURE_NAT64
     if (srp_servers->srp_nat64_enabled) {
         dns64 = nat64_is_active();
     }
 #endif
     dp_query_track(tracker, query);
     bool hardwired = false;
     if (dp_query_start(query, &rcode, &hardwired, dns64)) {
         // If query->question isn't NULL, we need to reply from cache
         if (hardwired) {
             INFO("[Q%d][TRK%d] hardwired reply", SERIAL(query), SERIAL(tracker));
             dp_query_send_dns_response(query, "hardwired");
             dp_question_cache_remove_queries(query->question);
             RELEASE_HERE(query->question, question);
             query->question = NULL;
         } else if (query->question != NULL) {
             INFO("[Q%d][TRK%d] replying from cache", SERIAL(query), SERIAL(tracker));
             dp_query_reply_from_cache(query->question, query, false);
             dp_question_cache_remove_queries(query->question);
         } else {
             INFO("[Q%d][TRK%d] not replying from cache", SERIAL(query), SERIAL(tracker));
         }
     } else {
         INFO("[Q%d][TRK%d][QID %x] query start failed", SERIAL(query), SERIAL(tracker), ntohs(message->wire.id));
     fail:
         dso_simple_response(tracker->connection, message, &message->wire, rcode);
         query->satisfied = true;
         dp_question_cache_remove_queries(query->question);
         dnssd_query_cancel(query);
         RELEASE_HERE(query, dnssd_query);
         return false;
     }
     // Query is returned retained, and dp_query_track retains it, so we always need to release the reference here.
     RELEASE_HERE(query, dnssd_query);
     return true;
 }

 static void
 dp_tracker_dso_cleanup(void *UNUSED context)
 {
     dso_cleanup(false);
 }

 static bool
 dp_tracker_dso_state_change(const dso_life_cycle_t cycle, void *const context, dso_state_t *const dso)
 {
     if (cycle == dso_life_cycle_cancel) {
         dp_tracker_t *tracker = context;
         if (tracker->dso != NULL) {
             tracker->dso = NULL;
             if (tracker->connection != NULL) {
                 tracker->connection->dso = NULL;
                 ioloop_comm_cancel(tracker->connection);
             }
             for (dnssd_query_t *query = tracker->dns_queries; query != NULL; query = query->next) {
                 if (query->dso == dso) {
                     query->dso = NULL;
                 }
                 if (query->activity != NULL) {
                     query->activity = NULL;
                     // Release the activity's reference to the query.
                     RELEASE_HERE(query, dnssd_query);
                 }
             }
         }
         ioloop_run_async(dp_tracker_dso_cleanup, NULL);
         return true;
     }
     return false;
 }

 static void
 dnssd_proxy_dns_evaluate(comm_t *comm, message_t *message, dp_tracker_t *tracker)
 {
     dns_rr_t question;
     unsigned offset = 0;

     if (tracker == NULL) {
         tracker = calloc(1, sizeof(*tracker));
         if (tracker == NULL) {
             ERROR("[C%d] " PRI_S_SRP ": no memory for a connection tracker object!", SERIAL(comm), comm->name);
             goto fail;
         }
         tracker->connection = comm;
         tracker->serial = ++cur_tracker_serial;
         ioloop_comm_retain(tracker->connection);
         if (comm->tcp_stream) {
             ioloop_comm_context_set(comm, tracker, dp_tracker_context_release);
             RETAIN_HERE(tracker, dp_tracker); // connection has a reference.
         }
         if (!comm->is_listener) {
             ioloop_comm_disconnect_callback_set(comm, dp_tracker_disconnected);
         }
     }
     RETAIN_HERE(tracker, dp_tracker); // For the function.

     // Drop incoming responses--we're a server, so we only accept queries.
     if (dns_qr_get(&message->wire) == dns_qr_response) {
         INFO("[TRK%d][C%d] " PRI_S_SRP ": dropping unexpected response", SERIAL(tracker), SERIAL(comm), comm->name);
         goto fail;
     }

     // If this is a DSO message, see if we have a session yet.
     switch(dns_opcode_get(&message->wire)) {
     case dns_opcode_dso:
         if (!comm->tcp_stream) {
             ERROR("[TRK%d][C%d] " PRI_S_SRP ": DSO message received on non-tcp socket.", SERIAL(tracker), SERIAL(comm), comm->name);
             dso_simple_response(comm, message, &message->wire, dns_rcode_notimp);
             goto fail;
         }

         if (!tracker->dso) {
             tracker->dso = dso_state_create(true, 2, comm->name, dns_push_callback, tracker,
                                             dp_tracker_dso_state_change, comm);
             if (!tracker->dso) {
                 ERROR("[TRK%d][C%d] " PRI_S_SRP ": Unable to create a dso context.", SERIAL(tracker), SERIAL(comm), comm->name);
                 dso_simple_response(comm, message, &message->wire, dns_rcode_servfail);
                 goto fail;
             }
             comm->dso = tracker->dso;
         }
         dp_tracker_not_idle(tracker);
         dso_message_received(comm->dso, (uint8_t *)&message->wire, message->length, message);
         break;

     case dns_opcode_query: {
         int num_questions = ntohs(message->wire.qdcount);

         // Some Matter accessories will send queries with more than one question, and if we don't answer these
         // queries, automations fail. So even though this is a bit weird, we need to answer the queries.
         for (int i = 0; i < num_questions; i++) {
             memset(&question, 0, sizeof(question));
             if (!dns_rr_parse(&question, message->wire.data, message->length - DNS_HEADER_SIZE, &offset, false, false)) {
                 ERROR("[TRK%d][C%d] " PRI_S_SRP ": rr parse failed.", SERIAL(tracker), SERIAL(comm), comm->name);
                 dso_simple_response(comm, message, &message->wire, dns_rcode_formerr);
                 goto fail;
             }
             bool success = dp_dns_query(tracker, message, &question, num_questions);
             dns_rrdata_free(&question);
             dns_name_free(question.name);
             if (!success) {
                 dnssd_query_t *next = NULL, *match = NULL;
                 for (dnssd_query_t *query = tracker->dns_queries; query != NULL; query = next) {
                     next = query->next;
                     if (dp_same_message(query->message, message)) {
                         query->satisfied = true;
                         dp_question_cache_remove_queries(query->question);
                         if (match == NULL) {
                             match = query;
                             RETAIN_HERE(match, dnssd_query);
                         }
                     }
                 }
                 if (match != NULL) {
                     dnssd_query_cancel(match);
                     RELEASE_HERE(match, dnssd_query);
                 }
                 goto out;
             }
         }
         dp_tracker_not_idle(tracker);
         break;
     }
         // No support for other opcodes yet.
     default:
         dso_simple_response(comm, message, &message->wire, dns_rcode_notimp);
         break;
     }
     goto out;
 fail:
     // For connected connections, if we exit unexpectedly, we need to cancel the connection.
     if (comm->tcp_stream) {
         ioloop_comm_cancel(tracker->connection);
     }
 out:
     if (tracker != NULL) {
         RELEASE_HERE(tracker, dp_tracker); // For the function.
     }
 }

 void
 dns_proxy_input_for_server(comm_t *comm, srp_server_t *server_state, message_t *message, void *context)
 {
     char buf[INET6_ADDRSTRLEN];
     const char *remote_name = buf;
     if (comm->tcp_stream) {
         remote_name = comm->name;
     } else {
         IOLOOP_NTOP(&message->src, buf);
     }
     dp_tracker_t *tracker = comm->context;
     INFO("[C%d][TRK%d][QID %x] Received a new DNS message - src: " PRI_S_SRP ", message length: %u bytes.",
          SERIAL(comm), SERIAL(tracker), ntohs(message->wire.id), remote_name, message->length);


     dnssd_proxy_dns_evaluate(comm, message, context);
 }

 static void
 dns_proxy_input(comm_t *comm, message_t *message, void *context)
 {
     dns_proxy_input_for_server(comm, srp_servers, message, context);
 }

 // usage is only called when we are building standalone dnssd-proxy, not the combined one.
 #if (!SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY)
 static int
 usage(const char *progname)
 {
     ERROR("usage: %s", progname);
     ERROR("ex: dnssd-proxy");
     return 1;
 }
 #endif // #if (!SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY)

 // Called whenever we get a connection.
 static void UNUSED
 connected(comm_t *comm)
 {
     INFO("[C%d] connection from " PRI_S_SRP, SERIAL(comm), comm->name);
     return;
 }

 static served_domain_t *NULLABLE
 new_served_domain(dp_interface_t *const NULLABLE interface, const char *const NONNULL domain)
 {
     served_domain_t *sdt = calloc(1, sizeof *sdt);
     if (sdt == NULL) {
         ERROR("Unable to allocate served domain %s", domain);
         return NULL;
     }
     size_t domain_len = strlen(domain);
     sdt->domain_ld = malloc(domain_len + 2);
     if (sdt->domain_ld == NULL) {
         ERROR("Unable to allocate served domain name %s", domain);
         free(sdt);
         return NULL;
     }
     sdt->domain_ld[0] = '.';
     sdt->domain = sdt->domain_ld + 1;
     memcpy(sdt->domain, domain, domain_len + 1);
     sdt->domain_name = dns_pres_name_parse(sdt->domain);
     sdt->interface = interface;
     if (sdt->domain_name == NULL) {
         if (interface != NULL) {
             ERROR("invalid domain name for interface %s: %s", interface->name, sdt->domain);
         } else {
             ERROR("invalid domain name: %s", sdt->domain);
         }
         free(sdt);
         return NULL;
     }
     sdt->next = served_domains;
     served_domains = sdt;

     INFO("new served domain created - domain name: " PRI_S_SRP, sdt->domain);
     return sdt;
 }

 #if STUB_ROUTER
 static served_domain_t *NULLABLE
 find_served_domain(const char *const NONNULL domain)
 {
     served_domain_t *current;
     for (current = served_domains; current != NULL; current = current->next) {
         if (strcasecmp(domain, current->domain) == 0) {
             break;
         }
     }

     return current;
 }
 #endif

 // served domain can only go away when combined with srp-mdns-proxy and interface going up and down.
 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
 static void
 served_domain_free(served_domain_t *const served_domain)
 {
     INFO("served domain removed - domain name: " PRI_S_SRP, served_domain->domain);

    // free struct interface *NULLABLE interface
     if (served_domain->interface != NULL) {
         interface_addr_t *current = served_domain->interface->addresses;
         interface_addr_t *next;
         for (;current != NULL; current = next) {
             next = current->next;
             free(current);
         }
         if (served_domain->interface->name != NULL) {
             free(served_domain->interface->name);
         }
         free(served_domain->interface);
     }

     // free hardwired_t *NULLABLE hardwired_responses
     if (served_domain->hardwired_responses != NULL) {
         hardwired_t *current = served_domain->hardwired_responses;
         hardwired_t *next;
         for (; current != NULL; current = next) {
             next = current->next;
             free(current);
         }
     }

     // free dns_name_t *NONNULL domain_name;
     if (served_domain->domain_name != NULL) {
         dns_name_free(served_domain->domain_name);
     }

     // free char *NONNULL domain_ld;
     free(served_domain->domain_ld);

 #ifdef SRP_TEST_SERVER
     last_freed_domain = served_domain;
 #endif

     // free served_domain_t *
     free(served_domain);
 }

 static void
 delete_served_domain(served_domain_t *const served_domain)
 {
     if (served_domain->questions == NULL) {
         served_domain_free(served_domain);
     }
 }

 #if STUB_ROUTER
 served_domain_t *
 delete_served_domain_by_interface_name(const char *const NONNULL interface_name)
 {
     served_domain_t *current;
     served_domain_t *prev = NULL;
     for(current= served_domains; current != NULL; prev = current, current = current->next) {
         if (current->interface == NULL) {
             continue;
         }
         if (strcmp(interface_name, current->interface->name) != 0) {
             continue;
         }

         INFO("served domain deleted with interface - "
             "domain: " PRI_S_SRP ", interface name: " PUB_S_SRP, current->domain, interface_name);

         // Since we are removing the entire served domain and the interface, the addresses that are associated with
         // this interface will also be removed. Therefore, any hardwired response that contains these addresses should
         // also be removed.
         for (interface_addr_t *address = current->interface->addresses; address != NULL; address = address->next) {
             dnssd_hardwired_process_addr_change(&address->addr, &address->mask, false);
         }

         if (prev == NULL) {
             served_domains = current->next;
         } else {
             prev->next = current->next;
         }

         delete_served_domain(current);
         break;
     }

     return current;
 }
 #endif // STUB_ROUTER
 #endif // SRP_FEATURE_DYNAMIC_CONFIGURATION

 // Dynamic interface detection...
 // This is called whenever a new interface address is encountered.

 void
 dnssd_proxy_ifaddr_callback(srp_server_t *UNUSED server_state, void *UNUSED context, const char *name,
                             const addr_t *address, const addr_t *mask, uint32_t UNUSED flags,
                             enum interface_address_change event_type)
 {
 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
     bool is_new_interface = true;
 #endif
     bool succeeded;
     const char *const action = (event_type == interface_address_added ? "Adding" : "Removing");

     if (event_type == interface_address_unchanged) {
         goto exit;
     }

     int interface_index = if_nametoindex(name);
     if (address->sa.sa_family == AF_INET) {
         IPv4_ADDR_GEN_SRP((const uint8_t *)&address->sin.sin_addr, addr_buf);
         IPv4_ADDR_GEN_SRP((const uint8_t *)&mask->sin.sin_addr, mask_buf);
         INFO("Interface " PUB_S_SRP " address " PRI_IPv4_ADDR_SRP " mask " PRI_IPv4_ADDR_SRP " index %d " PUB_S_SRP,
              name, IPv4_ADDR_PARAM_SRP((const uint8_t *)&address->sin.sin_addr, addr_buf),
              IPv4_ADDR_PARAM_SRP((const uint8_t *)&mask->sin.sin_addr, mask_buf), interface_index,
              event_type == interface_address_added ? "added" : "removed");
     } else if (address->sa.sa_family == AF_INET6) {
         IPv6_ADDR_GEN_SRP((const uint8_t *)&address->sin6.sin6_addr, addr_buf);
         IPv6_ADDR_GEN_SRP((const uint8_t *)&mask->sin6.sin6_addr, mask_buf);
         INFO("Interface " PUB_S_SRP " address " PRI_IPv6_ADDR_SRP " mask " PRI_IPv6_ADDR_SRP " index %d " PUB_S_SRP,
              name, IPv6_ADDR_PARAM_SRP((const uint8_t *)&address->sin6.sin6_addr, addr_buf),
              IPv6_ADDR_PARAM_SRP((const uint8_t *)&mask->sin6.sin6_addr, mask_buf), interface_index,
              event_type == interface_address_added ? "added" : "removed");
     } else {
         INFO("Interface " PUB_S_SRP " address type %d index %d " PUB_S_SRP, name, address->sa.sa_family, interface_index,
              event_type == interface_address_added ? "added" : "removed");
         INFO("ignoring non IP address");
         goto exit;
     }

 #if THREAD_BORDER_ROUTER && SRP_FEATURE_COMBINED_DNSSD_PROXY
     // Ignore Thread interface
     bool is_valid_address = thread_interface_name == NULL || strcmp(thread_interface_name, name) != 0;
     if (!is_valid_address) {
         INFO("skipping thread interface address");
         goto exit;
     }
 #endif

     // Add/remove the address from the corresponding served domain.
     served_domain_t **sp = &served_domains;
     while (*sp != NULL) {
         served_domain_t *current = *sp;
         // Only change the served domain that owns the current interface and address.
         if (current->interface == NULL || current->interface->ifindex == 0 ||
             strcmp(current->interface->name, name) != 0) {
             goto again;
         }

         INFO(PUB_S_SRP " address from the served domain - domain: " PRI_S_SRP, action, current->domain);
         succeeded = interface_process_addr_change(current->interface, address, mask, event_type);
         require_action_quiet(succeeded, exit, ERROR("failed to " PUB_S_SRP " new interface address", action));

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
         is_new_interface = false;

         // if interface loses all usable IP addresses, the interface has gone, remove this interface and the
         // corresponding served domain.
         if (event_type == interface_address_deleted) {
             if (current->interface->addresses == NULL) {
                 INFO("Removing served domain with 0 address - domain: " PRI_S_SRP ", interface name: " PUB_S_SRP,
                     current->domain, current->interface->name);
                 *sp = current->next;
                 delete_served_domain(current);
                 continue;
             }
         }
 #else // SRP_FEATURE_DYNAMIC_CONFIGURATION
         if (current->interface->addresses == NULL) {
             current->interface->ifindex = 0;
         }
 #endif // SRP_FEATURE_DYNAMIC_CONFIGURATION
     again:
         sp = &(*sp)->next;
     }

     // We will only create new served domain from dnssd_proxy_ifaddr_callback if the callback gets called from
     // srp-mdns-proxy.
 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
     if (event_type == interface_address_added && is_new_interface) {
         served_domain_t *const new_served_domain = add_new_served_domain_with_interface(name, address, mask);
         require_action_quiet(new_served_domain != NULL, exit,
             ERROR("failed to add new served domain ""- interface name: " PUB_S_SRP, name));

         bool hardwired_set = dnssd_hardwired_setup_for_served_domain(new_served_domain);
         if (!hardwired_set) {
             ERROR("failed to setup hardwired response for newly created served domain - domain: " PRI_S_SRP, name);
             delete_served_domain(new_served_domain);
         }
         INFO("New served domain created and hardwired response created - domain: " PRI_S_SRP,
             new_served_domain->domain);
     }
 #endif // SRP_FEATURE_DYNAMIC_CONFIGURATION

 #if STUB_ROUTER
     // Added or removed address will possibly need hardwired response to be updated.
     dnssd_hardwired_process_addr_change(address, mask, event_type == interface_address_added);
 #endif

 exit:
     return;
 }

 #if !SRP_FEATURE_DYNAMIC_CONFIGURATION
 // Config file parsing...
 static bool
 interface_handler(void * UNUSED context, const char * UNUSED filename, char **hunks, int UNUSED num_hunks,
                   int UNUSED lineno)
 {
     dp_interface_t *interface = calloc(1, sizeof *interface);
     if (interface == NULL) {
         ERROR("Unable to allocate interface %s", hunks[1]);
         return false;
     }

     interface->name = strdup(hunks[1]);
     if (interface->name == NULL) {
         ERROR("Unable to allocate interface name %s", hunks[1]);
         free(interface);
         return false;
     }

     if (!strcmp(hunks[0], "nopush")) {
         interface->no_push = true;
     }

     if (new_served_domain(interface, hunks[2]) == NULL) {
         free(interface->name);
         free(interface);
         return false;
     }
     return true;
 }

 static bool
 port_handler(void * UNUSED context, const char * UNUSED filename, char **hunks, int UNUSED num_hunks, int UNUSED lineno)
 {
     char *ep = NULL;
     long port = strtol(hunks[1], &ep, 10);
     if (port < 0 || port > 65535 || *ep != 0) {
         ERROR("Invalid port number: %s", hunks[1]);
         return false;
     }
     if (!strcmp(hunks[0], "udp-port")) {
         dnssd_proxy_udp_port = port;
     } else if (!strcmp(hunks[0], "tcp-port")) {
         dnssd_proxy_tcp_port = port;
     } else if (!strcmp(hunks[0], "tls-port")) {
         dnssd_proxy_tls_port = port;
     }
     return true;
 }

 static bool
 config_string_handler(char **ret, const char * UNUSED filename, const char *string, int UNUSED lineno, bool tdot,
                                   bool ldot)
 {
     char *s;
     int add_trailing_dot = 0;
     int add_leading_dot = ldot ? 1 : 0;
     size_t len = strlen(string);

     // Space for NUL and leading dot.
     if (tdot && len > 0 && string[len - 1] != '.') {
         add_trailing_dot = 1;
     }
     s = malloc(strlen(string) + add_leading_dot + add_trailing_dot + 1);
     if (s == NULL) {
         ERROR("Unable to allocate domain name %s", string);
         return false;
     }
     *ret = s;
     if (ldot) {
         *s++ = '.';
     }
     memcpy(s, string, len + add_leading_dot + add_trailing_dot + 1);
     if (add_trailing_dot) {
         s[len] = '.';
         s[len + 1] = 0;
     }
     return true;
 }

 static bool
 my_name_handler(void * UNUSED context, const char *filename, char **hunks, int UNUSED num_hunks, int lineno)
 {
     static char *new_name = NULL;
     if (new_name != NULL) {
         free(new_name);
         my_name = NULL;
         new_name = NULL;
     }
     if (!config_string_handler(&new_name, filename, hunks[1], lineno, false, false)) {
         return false;
     }
     my_name = new_name;
     size_t len = strlen(my_name);
     size_t bigger = sizeof(DOT_HOME_NET_DOMAIN) > sizeof(DOT_LOCAL) ? sizeof(DOT_HOME_NET_DOMAIN) : sizeof(DOT_LOCAL);
     if (len >= sizeof(local_host_name) - bigger) {
         ERROR("truncating local hostname %s", my_name);
         return false;
     }

     // Set up existing local host name with .local. suffix
     snprintf(local_host_name_dot_local, sizeof(local_host_name_dot_local), "%s" DOT_LOCAL, my_name);

     // Set up existing local host name with .home.net. suffix
     snprintf(local_host_name, sizeof(local_host_name), "%s" DOT_HOME_NET_DOMAIN, my_name);
     return true;
 }

 static bool
 listen_addr_handler(void * UNUSED context, const char *filename, char **hunks, int UNUSED num_hunks, int lineno)
 {
     if (num_listen_addrs == MAX_ADDRS) {
         ERROR("Only %d IPv4 listen addresses can be configured.", MAX_ADDRS);
         return false;
     }
     return config_string_handler(&listen_addrs[num_listen_addrs++], filename, hunks[1], lineno, false, false);
 }

 static bool
 publish_addr_handler(void * UNUSED context, const char *filename, char **hunks, int UNUSED num_hunks, int lineno)
 {
     if (num_publish_addrs == MAX_ADDRS) {
         ERROR("Only %d addresses can be published.", MAX_ADDRS);
         return false;
     }
     return config_string_handler(&publish_addrs[num_publish_addrs++], filename, hunks[1], lineno, false, false);
 }

 static bool
 tls_key_handler(void * UNUSED context, const char *filename, char **hunks, int UNUSED num_hunks, int lineno)
 {
     return config_string_handler(&tls_key_filename, filename, hunks[1], lineno, false, false);
 }

 static bool
 tls_cert_handler(void * UNUSED context, const char *filename, char **hunks, int UNUSED num_hunks, int lineno)
 {
     return config_string_handler(&tls_cert_filename, filename, hunks[1], lineno, false, false);
 }

 static bool
 tls_cacert_handler(void * UNUSED context, const char *filename, char **hunks, int UNUSED num_hunks, int lineno)
 {
     return config_string_handler(&tls_cacert_filename, filename, hunks[1], lineno, false, false);
 }

 config_file_verb_t dp_verbs[] = {
     { "interface",    3, 3, interface_handler },    // interface <name> <domain>
     { "nopush",       3, 3, interface_handler },    // nopush <name> <domain>
     { "udp-port",     2, 2, port_handler },         // udp-port <number>
     { "tcp-port",     2, 2, port_handler },         // tcp-port <number>
     { "tls-port",     2, 2, port_handler },         // tls-port <number>
     { "my-name",      2, 2, my_name_handler },      // my-name <domain name>
     { "tls-key",      2, 2, tls_key_handler },      // tls-key <filename>
     { "tls-cert",     2, 2, tls_cert_handler },     // tls-cert <filename>
     { "tls-cacert",   2, 2, tls_cacert_handler },   // tls-cacert <filename>
     { "listen-addr",  2, 2, listen_addr_handler },  // listen-addr <IP address>
     { "publish-addr", 2, 2, publish_addr_handler }  // publish-addr <IP address>
 };
 #define NUMCFVERBS ((sizeof dp_verbs) / sizeof (config_file_verb_t))
 #endif // !SRP_FEATURE_DYNAMIC_CONFIGURATION

 static wakeup_t *tls_listener_wakeup;
 static int tls_listener_index;
 static void dnssd_tls_listener_restart(comm_t *NONNULL listener, void *NULLABLE context);

 static void dnssd_tls_key_change_notification_send(void)
 {
     static int dnssd_tls_change_notification_token = NOTIFY_TOKEN_INVALID;

     if (dnssd_tls_change_notification_token == NOTIFY_TOKEN_INVALID) {
         uint32_t notifyStatus = notify_register_check(kDNSSDAdvertisingProxyTLSKeyUpdateNotification,
                                                       &dnssd_tls_change_notification_token);
         if (notifyStatus != NOTIFY_STATUS_OK) {
             dnssd_tls_change_notification_token = NOTIFY_TOKEN_INVALID;
             ERROR("notify_register_check(%s) failed with %u", kDNSSDAdvertisingProxyTLSKeyUpdateNotification, notifyStatus);
             return;
         }
     }

     if (dnssd_tls_change_notification_token != NOTIFY_TOKEN_INVALID) {
         uint32_t notifyStatus = notify_post(kDNSSDAdvertisingProxyTLSKeyUpdateNotification);
         if (notifyStatus != NOTIFY_STATUS_OK) {
             ERROR("notify_post(%s) %u", kDNSSDAdvertisingProxyTLSKeyUpdateNotification, notifyStatus);
             notify_cancel(dnssd_tls_change_notification_token);
             dnssd_tls_change_notification_token = NOTIFY_TOKEN_INVALID;
         }
     }
 }

 static void
 dnssd_tls_listener_ready(void *UNUSED context, uint16_t port)
 {
 #ifdef SRP_TEST_SERVER
     if (srp_test_dnssd_tls_listener_ready != NULL) {
         srp_test_dnssd_tls_listener_ready(srp_test_tls_listener_context, port);
     }
 #else
     (void)context;
     (void)port;
 #endif
 }

 static void dnssd_tls_listener_listen(void *context, bool init_daemon)
 {
     addr_t addr;
     INFO("starting DoT listener");
     memset(&addr, 0, sizeof(addr));
     addr.sa.sa_family = AF_UNSPEC;
 #ifndef NOT_HAVE_SA_LEN
     addr.sa.sa_len = sizeof(addr.sin6);
 #endif
     addr.sin6.sin6_port = htons(dnssd_proxy_tls_port);
 #ifndef EXCLUDE_TLS
     dnssd_proxy_listeners[tls_listener_index] =
             ioloop_listener_create(true, true, init_daemon, NULL, 0, &addr, NULL, "DNS over TLS",
                                    dns_proxy_input, NULL, dnssd_tls_listener_restart, dnssd_tls_listener_ready,
                                    NULL, srp_tls_configure, 0, context);
 #else
     dnssd_proxy_listeners[tls_listener_index] =
         ioloop_listener_create(true, true, init_daemon, NULL, 0, &addr, NULL, "DNS over TLS",
                                dns_proxy_input, NULL, dnssd_tls_listener_restart, dnssd_tls_listener_ready,
                                NULL, NULL, 0, context);
 #endif
     if (dnssd_proxy_listeners[tls_listener_index] == NULL) {
         ERROR("DNS Push listener: fail.");
         goto exit;
     }

     // Notify about intial key update
     dnssd_tls_key_change_notification_send();

     // Schedule a wake up timer to rotate the expired TLS certificate.
     schedule_tls_certificate_rotation(&tls_listener_wakeup, dnssd_proxy_listeners[tls_listener_index]);
 exit:
     return;
 }

 static void dnssd_tls_listener_relisten(void *context)
 {
     dnssd_tls_listener_listen(context, false);
 }

 static void
 dnssd_tls_listener_restart(comm_t *UNUSED in_listener, void *context)
 {
     const bool doing_rotation = dnssd_proxy_listeners[tls_listener_index]->tls_rotation_ready;
     ioloop_listener_release(dnssd_proxy_listeners[tls_listener_index]);
     dnssd_proxy_listeners[tls_listener_index] = NULL;

     if (doing_rotation) {
         const bool succeeded = srp_tls_init();
         if (!succeeded) {
             FAULT("srp_tls_init failed.");
             return;
         }

         // Send TLS key update notification
         dnssd_tls_key_change_notification_send();
         dnssd_tls_listener_listen(NULL, false);
     } else {
         INFO("Creation of TLS listener failed; reattempting in 10s.");

         if (tls_listener_wakeup == NULL) {
             tls_listener_wakeup = ioloop_wakeup_create();
             if (tls_listener_wakeup == NULL) {
                 ERROR("Unable to allocate wakeup in order to re-attempt TLS listener creation.");
                 return;
             }
         }
         ioloop_add_wake_event(tls_listener_wakeup, context, dnssd_tls_listener_relisten, NULL, 10 * MSEC_PER_SEC);
     }
 }

 static void
 dnssd_push_setup(void)
 {
     tls_listener_index = dnssd_proxy_num_listeners++;
     dnssd_tls_listener_listen(NULL, true);

     // Only set hardwired response when dynamic configuration is enabled.  Dynamic configuration
     // sets up hardwired response when new address of the interface is added.
 #if SRP_FEATURE_DYNAMIC_CONFIGURATION // not set hardwired response for now
     dnssd_hardwired_push_setup();
 #endif // !SRP_FEATURE_DYNAMIC_CONFIGURATION
 }

 #if (!SRP_FEATURE_CAN_GENERATE_TLS_CERT)

 // Start a key generation or cert signing program.   Arguments are key=value pairs.
 // Arguments that can be constant should be <"key=value", NULL>.   Arguments that
 // have a variable component should be <"key", value">.  References to arguments
 // will be held, except that if the rhs of the pair is variable, memory is allocated
 // to store the key=value pair, so the neither the key nor the value is retained.
 // The callback is called when the program exits.

 static void
 keyprogram_start(const char *program, subproc_callback_t callback, ...)
 {
 #define MAX_SUBPROC_VARS 3
     size_t lens[MAX_SUBPROC_VARS];
     char *vars[MAX_SUBPROC_VARS];
     int num_vars = 0;
     char *argv[MAX_SUBPROC_ARGS + 1];
     int argc = 0;
     va_list vl;
     int i;
     subproc_t *subproc = NULL;

     va_start(vl, callback);
     while (true) {
         char *vname, *value;
         char *arg;

         vname = va_arg(vl, char *);
         if (vname == NULL) {
             break;
         }
         value = va_arg(vl, char *);

         if (argc >= MAX_SUBPROC_ARGS) {
             ERROR("keyprogram_start: too many arguments.");
         }

         if (value == NULL) {
             arg = vname;
         } else {
             if (num_vars >= MAX_SUBPROC_VARS) {
                 ERROR("Too many variable args: %s %s", vname, value);
                 goto out;
             }
             lens[num_vars] = strlen(vname) + strlen(value) + 2;
             vars[num_vars] = malloc(lens[num_vars]);
             if (vars[num_vars] == NULL) {
                 ERROR("No memory for variable key=value %s %s", vname, value);
                 goto out;
             }
             snprintf(vars[num_vars], lens[num_vars], "%s=%s", vname, value);
             arg = vars[num_vars];
             num_vars++;
         }
         argv[argc++] = arg;
     }
     argv[argc] = NULL;
     subproc = ioloop_subproc(program, argv, argc, callback, NULL, NULL);
     if (subproc != NULL) {
         ioloop_subproc_run_sync(subproc);
         ioloop_subproc_release(subproc);
     }
 out:
     for (i = 0; i < num_vars; i++) {
         free(vars[i]);
     }
 }

 static bool
 finished_okay(const char *context, int status, const char *error)
 {
     // If we get an error, something failed before the program had been successfully started.
     if (error != NULL) {
         ERROR("%s failed on startup: %s", context, error);
     }

     // The key file generation process completed
     else if (WIFEXITED(status)) {
         if (WEXITSTATUS(status) != 0) {
             ERROR("%s program exited with status %d", context, status);
             // And that means we don't have DNS Push--sorry!
         } else {
             return true;
         }
     } else if (WIFSIGNALED(status)) {
         ERROR("%s program exited on signal %d", context, WTERMSIG(status));
         // And that means we don't have DNS Push--sorry!
     } else if (WIFSTOPPED(status)) {
         ERROR("%s program stopped on signal %d", context, WSTOPSIG(status));
         // And that means we don't have DNS Push--sorry!
     } else {
         ERROR("%s program exit status unknown: %d", context, status);
         // And that means we don't have DNS Push--sorry!
     }
     return false;
 }

 // Called after the cert has been generated.
 static void
 certfile_finished_callback(void *NULLABLE context, int status, const char *error)
 {
     (void)context;

     // If we were able to generate a cert, we can start DNS Push service and start advertising it.
     if (finished_okay("Certificate signing", status, error)) {
         int i = dnssd_proxy_num_listeners;

         dnssd_push_setup();

         for (; i < dnssd_proxy_num_listeners; i++) {
             INFO("Started " PUB_S_SRP, dnssd_proxy_listeners[i]->name);
         }
     }
 }

 // Called after the key has been generated.
 static void
 keyfile_finished_callback(void *context, int status, const char *error)
 {
     (void)context;
     if (finished_okay("Keyfile generation", status, error)) {
         INFO("Keyfile generation completed.");

     // XXX dates need to not be constant!!!
     keyprogram_start(CERTWRITE_PROGRAM, certfile_finished_callback,
                      "selfsign=1", NULL, "issuer_key", tls_key_filename, "issuer_name=CN", my_name,
                      "not_before=20210825000000", NULL, "not_after=20230824235959", NULL, "is_ca=1", NULL,
                      "max_pathlen=0", NULL, "output_file", tls_cert_filename, NULL);
     }

 }
 #endif // #if (SRP_FEATURE_CAN_GENERATE_TLS_CERT)

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
 static served_domain_t *NONNULL
 add_new_served_domain_with_interface(const char *const NONNULL name,
                                      const addr_t *const NULLABLE address, const addr_t *const NULLABLE mask)
 {
     dp_interface_t *new_interface = NULL;
     served_domain_t *served_domain = NULL;
     bool local_only_interface = !strcmp(LOCAL_ONLY_PSEUDO_INTERFACE, name);
     bool locally_served_interface = !local_only_interface && !strcmp(ALL_LOCALS_PSEUDO_INTERFACE, name);
 #if SRP_FEATURE_LOCAL_DISCOVERY
     bool infrastructure_interface = !locally_served_interface && !strcmp(INFRASTRUCTURE_PSEUDO_INTERFACE, name);
 #endif
     bool succeeded;

     new_interface = calloc(1, sizeof(*new_interface));
     require_action_quiet(new_interface != NULL, exit, succeeded = false;
         ERROR("calloc failed - name: " PRI_S_SRP ", allocate size: %lu", name, sizeof(*new_interface)));

     new_interface->name = strdup(name);
     require_action_quiet(new_interface->name != NULL, exit, succeeded = false;
         ERROR("strdup failed to copy interface name - interface name: " PRI_S_SRP, name));

     if (local_only_interface) {
         new_interface->ifindex = kDNSServiceInterfaceIndexLocalOnly;
     } else if (locally_served_interface) {
         new_interface->ifindex = kDNSServiceInterfaceIndexAny;
 #if SRP_FEATURE_LOCAL_DISCOVERY
     } else if (infrastructure_interface) {
         new_interface->ifindex = kDNSServiceInterfaceIndexInfra;
 #endif
     } else {
         new_interface->ifindex = if_nametoindex(name);
     }

     // Enable DNS push by default.
     new_interface->no_push = false;

     if (address != NULL) {
         require_action_quiet(mask != NULL, exit, succeeded = false);

         new_interface->addresses = calloc(1, sizeof(*new_interface->addresses));
         require_action_quiet(new_interface->addresses != NULL, exit, succeeded = false;
             ERROR("calloc failed - allocated size: %lu", sizeof(*new_interface->addresses)));
         new_interface->addresses->addr = *address;
         new_interface->addresses->mask = *mask;
     }

     char *per_interface_served_domain;
 #if STUB_ROUTER
     char served_domain_buffer[DNS_MAX_NAME_SIZE];
 #endif
     if (local_only_interface) {
         // All queries sent to <Thread ID>.thread.home.arpa. will only be proxied to local only interface.
         per_interface_served_domain = THREAD_DOMAIN_WITH_ID;
     } else if (locally_served_interface) {
         per_interface_served_domain = DEFAULT_SERVICE_ARPA_DOMAIN;
 #if SRP_FEATURE_LOCAL_DISCOVERY
     } else if (infrastructure_interface) {
         per_interface_served_domain = DOT_LOCAL_DOMAIN;
 #endif
     } else {
 #if STUB_ROUTER
         int bytes_written = snprintf(served_domain_buffer, sizeof(served_domain_buffer),
             "%s-%s." HOME_NET_DOMAIN, local_host_name, name);
         require_action_quiet(bytes_written > 0 && (size_t)bytes_written < sizeof(served_domain_buffer), exit,
             succeeded = false;
             ERROR("snprintf failed - local host name: " PRI_S_SRP ", interface name: " PUB_S_SRP
                 ", name buffer size: %lu", my_name, name, sizeof(served_domain_buffer))
         );
         per_interface_served_domain = served_domain_buffer;
 #else
         ERROR("unexpected served domain " PRI_S_SRP, name);
         succeeded = false;
         goto exit;
 #endif
     }

     served_domain = new_served_domain(new_interface, per_interface_served_domain);
     require_action_quiet(served_domain != NULL, exit, succeeded = false;
         ERROR("new_served_domain failed - interface name: " PUB_S_SRP ", served domain: " PRI_S_SRP,
             name, per_interface_served_domain)
     );

     succeeded = true;
     INFO("new served domain added with interface - served domain: " PUB_S_SRP ", interface name: " PUB_S_SRP,
         per_interface_served_domain, name);
 exit:
     if (!succeeded) {
         if (new_interface != NULL) {
             if (new_interface->addresses != NULL) {
                 verify_action(new_interface->addresses->next == NULL,
                     ERROR("multiple addresses added for this new interface"));
                 free(new_interface->addresses);
             }
             if (new_interface->name != NULL) {
                 free(new_interface->name);
             }
             free(new_interface);
         }
     }

     return served_domain;
 }
 #endif // !SRP_FEATURE_DYNAMIC_CONFIGURATION

 static bool
 interface_addr_t_equal(const interface_addr_t *const NONNULL a, const interface_addr_t *const NONNULL b)
 {
     bool equal;
     const addr_t *const a_addr = &a->addr;
     const addr_t *const a_mask = &a->mask;
     const addr_t *const b_addr = &b->addr;
     const addr_t *const b_mask = &b->mask;

     if (a_addr->sa.sa_family != b_addr->sa.sa_family) {
         equal = false;
         goto exit;
     }

     require_action_quiet(a_addr->sa.sa_family == a_mask->sa.sa_family, exit, equal = false;
         ERROR("A address and mask are not in the same sa_family - address family: %d, mask family: %d",
             a_addr->sa.sa_family, a_mask->sa.sa_family)
     );

     require_action_quiet(b_addr->sa.sa_family == b_mask->sa.sa_family, exit, equal = false;
         ERROR("B address and mask are no in the same sa_family - address family: %d, mask family: %d",
             b_addr->sa.sa_family, b_mask->sa.sa_family)
     );

     if (a_addr->sa.sa_family == AF_INET) {
         if (a_addr->sin.sin_addr.s_addr != b_addr->sin.sin_addr.s_addr) {
             equal = false;
             goto exit;
         }

         if (a_mask->sin.sin_addr.s_addr != b_mask->sin.sin_addr.s_addr) {
             equal = false;
             goto exit;
         }
     } else { // a_addr->sa.sa_family == AF_INET6
         if (memcmp(&a_addr->sin6.sin6_addr, &b_addr->sin6.sin6_addr, sizeof(a_addr->sin6.sin6_addr)) != 0) {
             equal = false;
             goto exit;
         }

         if (memcmp(&a_mask->sin6.sin6_addr, &b_mask->sin6.sin6_addr, sizeof(a_mask->sin6.sin6_addr)) != 0) {
             equal = false;
             goto exit;
         }
     }

     equal = true;
 exit:
     return equal;
 }

 static bool
 interface_add_new_address(dp_interface_t *const NONNULL interface, const addr_t *const NONNULL address,
                           const addr_t *const NONNULL mask)
 {
     bool succeeded;

     interface_addr_t *new_if_addr = calloc(1, sizeof(*new_if_addr));
     require_action_quiet(new_if_addr != NULL, exit, succeeded = false;
         ERROR("calloc failed - allocated size: %zu", sizeof(*new_if_addr)));
     new_if_addr->addr = *address;
     new_if_addr->mask = *mask;
     new_if_addr->next = NULL;

     interface_addr_t **ap;

     for (ap = &interface->addresses; *ap != NULL; ap = &(*ap)->next)
         ;

     *ap = new_if_addr;
     succeeded = true;;
 exit:
     return succeeded;
 }

 static bool
 interface_remove_old_address(dp_interface_t *const NONNULL interface, const addr_t *const NONNULL address,
                              const addr_t *const NONNULL mask)
 {
     bool succeeded;
     interface_addr_t addr_to_remove = {NULL, *address, *mask};
     interface_addr_t **ap;
     interface_addr_t *current;

     for (ap = &interface->addresses; *ap != NULL; ap = &(*ap)->next) {
         if (interface_addr_t_equal(*ap, &addr_to_remove)) {
             break;
         }
     }
     if (*ap == NULL) {
         INFO("address not found in the interface address list - interface name: " PUB_S_SRP, interface->name);
         succeeded = false;
         goto exit;
     }
     current = *ap;
     *ap = current->next;
     free(current);

     succeeded = true;
 exit:
     return succeeded;
 }

 static bool
 interface_process_addr_change(dp_interface_t *const NONNULL interface, const addr_t *const NONNULL address,
                               const addr_t *const NONNULL mask, const enum interface_address_change event_type)
 {
     bool succeeded;

     require_action_quiet(event_type != interface_address_unchanged, exit, succeeded = false;
         INFO("no address change event happens"));

     if (event_type == interface_address_added) {
         succeeded = interface_add_new_address(interface, address, mask);
     } else { // event_type == interface_address_removed
         succeeded = interface_remove_old_address(interface, address, mask);
     }

     INFO("address added/removed successfully - event: " PUB_S_SRP,
         event_type == interface_address_added ? "added" : "removed");

 exit:
     return succeeded;
 }

 static void
 towire_init(dns_wire_t * const NONNULL wire_ptr, dns_towire_state_t * const NONNULL towire_ptr)
 {
     memset(wire_ptr, 0, sizeof(*wire_ptr));
     memset(towire_ptr, 0, sizeof(*towire_ptr));
     towire_ptr->message = wire_ptr;
     towire_ptr->lim = &wire_ptr->data[DNS_DATA_SIZE];
     towire_ptr->p = wire_ptr->data;
 }

 #if STUB_ROUTER
 static bool
 string_ends_with(const char *const NONNULL str, const char *const NONNULL suffix)
 {
     size_t str_len = strlen(str);
     size_t suffix_len = strlen(suffix);
     bool ret;

     if (str_len < suffix_len) {
         ret = false;
         goto exit;
     }

     if (strcmp(str + (str_len-suffix_len), suffix) != 0) {
         ret = false;
         goto exit;
     }

     ret = true;
 exit:
     return ret;
 }
 #endif

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
 #if STUB_ROUTER
 static bool
 served_domain_change_domain_name(void)
 {
     bool succeeded = true;

     served_domain_t *next;
     for (served_domain_t *current = served_domains; current != NULL; current = next) {
         next = current->next;
         if (!string_ends_with(current->domain, HOME_NET_DOMAIN)) {
             continue;
         }
         // Skip local only interface because only served domain <Thread ID>.thread.home.arpa. does not contain domain
         // string.
         if (current->interface != NULL && strcmp(LOCAL_ONLY_PSEUDO_INTERFACE, current->interface->name) == 0) {
             continue;
         }

         // Constructs new served domain name.
         char *new_served_domain_name;
         char new_served_domain_buff[DNS_MAX_NAME_SIZE];

         if (0) {
         } else if (current->interface != NULL) { // <local host name>-<interface name>.home.arpa.
             const dp_interface_t *const interface = current->interface;
             int bytes_written = snprintf(new_served_domain_buff, sizeof(new_served_domain_buff),
                 "%s-%s." HOME_NET_DOMAIN, local_host_name, interface->name);
             require_action_quiet(bytes_written > 0 && (size_t)bytes_written < sizeof(new_served_domain_buff), exit,
                 succeeded = false; ERROR("snprintf failed"));
             new_served_domain_name = new_served_domain_buff;
         } else { // <local host name>.home.arpa.
             int bytes_written = snprintf(new_served_domain_buff, sizeof(new_served_domain_buff),
                 "%s." HOME_NET_DOMAIN, local_host_name);
             require_action_quiet(bytes_written > 0 && (size_t)bytes_written < sizeof(new_served_domain_buff), exit,
                 succeeded = false; ERROR("snprintf failed"));
             new_served_domain_name = new_served_domain_buff;
         }

         INFO("Updating served domain from " PRI_S_SRP " to " PRI_S_SRP, current->domain, new_served_domain_name);

         // Free the old served domain name.
         free(current->domain_ld);
         dns_name_free(current->domain_name);

         // Set the new served domain name.
         size_t domain_len = strlen(new_served_domain_name);
         current->domain_ld = malloc(domain_len + 2);
         require_action_quiet(current->domain_ld != NULL, for_loop_exit, succeeded = false;
             ERROR("malloc failed - allocated length: %zu", domain_len + 2));
         current->domain_ld[0] = '.';
         current->domain = current->domain_ld + 1;
         memcpy(current->domain, new_served_domain_name, domain_len);
         current->domain[domain_len] = '\0';

         current->domain_name = dns_pres_name_parse(current->domain);
         require_action_quiet(current->domain_name != NULL, for_loop_exit, succeeded = false;
             ERROR("failed to create parsed DNS name - domain name to be parsed: " PRI_S_SRP, current->domain)
         );

     for_loop_exit:
         if (!succeeded) {
             delete_served_domain(current);
         }
     }

 exit:
     return succeeded;
 }
 #endif // STUB_ROUTER

 static bool
 served_domain_process_name_change(void)
 {
     bool succeeded;

     // Deletes all hardwired response set in the served domain.
     dnssd_hardwired_clear();

 #if STUB_ROUTER
     // Since local host name changes, we need to reflect the change in the served domain name.
     succeeded = served_domain_change_domain_name();
     require_action_quiet(succeeded, exit, ERROR("served_domain_change_domain_name failed"));
 #endif

     // Re-set the hardwired response
     dnssd_hardwired_setup();

     // Re-set the DNS push hardwired response
     dnssd_hardwired_push_setup();

     succeeded = true;
 #if STUB_ROUTER
 exit:
 #endif
     return succeeded;
 }

 static bool
 initialize_uuid_name(srp_server_t *UNUSED server_state)
 {
     char *s;
     uint64_t uuid = srp_random64();
     static const char letters[] = "0123456789abcdefghijklmnopqrstuvwxyz";
     static int letlen = sizeof(letters) - 1;
     s = uuid_name;
     *s++ = 'u'; // So that it always starts with a letter.
     while (s < uuid_name + sizeof(uuid_name) - 1 && uuid != 0) {
         *s++ = letters[uuid % letlen];
         uuid /= letlen;
     }
     *s++ = 0;
     return true;
 }

 static bool
 update_my_name(CFStringRef local_host_name_cfstr)
 {
     bool succeeded;
     size_t name_length;

     if (local_host_name_cfstr == NULL) {
         // If we are a thread device and not a stub router, make up a hostname for the remote server in case we need it.
         char localhost[] = "localhost.";
         name_length = sizeof(localhost);
         memcpy(local_host_name, localhost, name_length);
         memcpy(local_host_name_dot_local, localhost, name_length);
         memcpy(my_name_buf, localhost, name_length);
     } else {
         // local host name to c string.
         succeeded = CFStringGetCString(local_host_name_cfstr, local_host_name, sizeof(local_host_name),
                                        kCFStringEncodingUTF8);
         require_action_quiet(succeeded, exit, succeeded = false;
                              ERROR("CFStringGetCString failed - local host name: " PRI_S_SRP,
                                    CFStringGetCStringPtr(local_host_name_cfstr, kCFStringEncodingUTF8))
             );
         name_length = strlen(local_host_name);

         // Validate the local host name.
         for (size_t i = 0; i < name_length; i++) {
             char ch = local_host_name[i];
             bool is_valid_char = isalnum(ch) || (ch == '-');
             require_action_quiet(is_valid_char, exit, succeeded = false;
                                  ERROR("invalid DNS name - name: " PUB_S_SRP, local_host_name));
         }

         require_action_quiet(name_length + sizeof(DOT_HOME_NET_DOMAIN) <= sizeof(my_name_buf),
                              exit,
                              succeeded = false;
                              ERROR("generated name too long: " PUB_S_SRP DOT_HOME_NET_DOMAIN, local_host_name));

         // Update existing local host name in my_name.
         memcpy(my_name_buf, local_host_name, name_length);
         memcpy(my_name_buf + name_length, DOT_HOME_NET_DOMAIN, sizeof(DOT_HOME_NET_DOMAIN));

         // Update existing local host name with .local suffix.
         int bytes_written = snprintf(local_host_name_dot_local, sizeof(local_host_name_dot_local), "%s" DOT_LOCAL, local_host_name);
         if (bytes_written < 0 || (size_t) bytes_written > sizeof(local_host_name_dot_local)) {
            ERROR("snprintf failed - name length: %lu, max: %lu", strlen(local_host_name) + sizeof(DOT_LOCAL),
                  sizeof(local_host_name_dot_local));
            succeeded = false;
            goto exit;
         }
     }
     my_name = my_name_buf;

     succeeded = true;
     INFO(PUB_S_SRP " my_name: " PRI_S_SRP ", local host name: " PRI_S_SRP, my_name == NULL ? "initialized" : "updated",
          my_name, local_host_name_dot_local);

 exit:
     return succeeded;
 }

 // Gets called when name change event happens
 static void
 monitor_name_changes_callback(SCDynamicStoreRef store, CFArrayRef changed_keys, void *context)
 {
     bool succeeded;
     CFStringRef local_host_name_cfstring = NULL;
     dnssd_proxy_advertisements_t *advertisements = context;

     // Check if name changes.
     CFRange range = {0, CFArrayGetCount(changed_keys)};
     const bool host_name_changed = CFArrayContainsValue(changed_keys, range, sc_dynamic_store_key_host_name);
     if (!host_name_changed) {
         goto exit;
     }

     // Get the new local host name.
     local_host_name_cfstring = SCDynamicStoreCopyLocalHostName(store);
     require_action_quiet(local_host_name_cfstring != NULL, exit, ERROR("failed to get updated local host name"));

     // Update the old my_name
     succeeded = update_my_name(local_host_name_cfstring);
     require_action_quiet(succeeded, exit, ERROR("failed to update my name"));

     // With the new local host name, update the served domains and hardwired response.
     succeeded = served_domain_process_name_change();
     require_action_quiet(succeeded, exit, ERROR("failed to process name change for served domains"));

     if (advertisements->txn != NULL) {
         dns_wire_t wire;
         dns_towire_state_t towire;
         towire_init(&wire, &towire);
         dns_full_name_to_wire(NULL, &towire, local_host_name_dot_local);

         DNSServiceErrorType err = DNSServiceUpdateRecord(advertisements->service_ref, advertisements->ns_record_ref, 0,
             towire.p - wire.data, wire.data, 0);
         if (err != kDNSServiceErr_NoError) {
             ERROR("DNSServiceUpdateRecord failed to update NS record to new name - name: " PRI_S_SRP,
                 local_host_name_dot_local);
         }

         INFO("Updating record - new NS record rdata: " PRI_S_SRP, local_host_name_dot_local);
     }

 exit:
     if (local_host_name_cfstring != NULL) {
         CFRelease(local_host_name_cfstring);
     }
     return;
 }

 static bool
 monitor_name_changes(dnssd_proxy_advertisements_t *advertisements)
 {
     bool succeeded;
     SCDynamicStoreRef store = NULL;
     const void *monitored_keys[1];
     CFArrayRef monitored_keys_array = NULL;

     // Set the callback function for name change event.
     store = SCDynamicStoreCreate(kCFAllocatorDefault, CFSTR("dnssd-proxy:watch for name change events"),
                                  monitor_name_changes_callback, &advertisements->sc_context);
     require_action_quiet(store != NULL, exit, succeeded = false; ERROR("failed to create SCDynamicStoreRef"));

     // Set the key to be monitored, which is host name
     sc_dynamic_store_key_host_name = SCDynamicStoreKeyCreateHostNames(kCFAllocatorDefault);
     require_action_quiet(sc_dynamic_store_key_host_name != NULL, exit, succeeded = false;
         ERROR("failed to create SCDynamicStoreKey for host name"));

     monitored_keys[0] = sc_dynamic_store_key_host_name;
     monitored_keys_array = CFArrayCreate(kCFAllocatorDefault, monitored_keys, countof(monitored_keys),
         &kCFTypeArrayCallBacks);
     require_action_quiet(monitored_keys_array != NULL, exit, succeeded = false;
         ERROR("failed to create CFArrayRef for monitored keys"));

     succeeded = SCDynamicStoreSetNotificationKeys(store, monitored_keys_array, NULL);
     require_action_quiet(succeeded, exit, ERROR("SCDynamicStoreSetNotificationKeys failed"));

     succeeded = SCDynamicStoreSetDispatchQueue(store, dispatch_get_main_queue());
     require_action_quiet(succeeded, exit, ERROR("SCDynamicStoreSetDispatchQueue failed"));

     succeeded = true;
     INFO("Start to monitor local host name changes");
 exit:
     if (!succeeded) {
         if (store != NULL) {
             CFRelease(store);
         }
     }
     if (monitored_keys_array != NULL) {
         CFRelease(monitored_keys_array);
     }
     return succeeded;
 }

 static bool
 initialize_my_name_and_monitoring(srp_server_t *server_state)
 {
     bool succeeded;
     CFStringRef local_host_name_cfstring = NULL;

     // Set notification from configd.
     succeeded = monitor_name_changes(server_state->dnssd_proxy_advertisements);
     require_action_quiet(succeeded, exit, ERROR("failed to monitor name changes"));

     // Get the initial local host name
     local_host_name_cfstring = SCDynamicStoreCopyLocalHostName(NULL);
     require_action_quiet(local_host_name != NULL, exit, succeeded = false; ERROR("failed to get local host name"));

     succeeded = update_my_name(local_host_name_cfstring);
     require_action_quiet(succeeded, exit, ERROR("failed to update myname"));

 exit:
     if (local_host_name_cfstring != NULL) {
         CFRelease(local_host_name_cfstring);
     }
     return succeeded;
 }

 #ifndef SRP_TEST_SERVER
 static bool
 configure_dnssd_proxy(void)
 {
     dnssd_proxy_udp_port= 53;
     dnssd_proxy_tcp_port = 53;
     dnssd_proxy_tls_port = 853;
     return true;
 }
 #endif // SRP_TEST_SERVER
 #endif // SRP_FEATURE_DYNAMIC_CONFIGURATION

 static bool
 start_dnssd_proxy_listener(void)
 {
     bool succeeded;

 #if STUB_ROUTER
 #ifndef NOT_HAVE_SA_LEN
 #  define SA_LEN_INIT addr.sa.sa_len = sizeof(addr.sin6)
 #else
 #  define SA_LEN_INIT
 #endif // NOT_HAVE_SA_LEN
 #define INIT_ADDR_T(PORT)                       \
         do {                                    \
             memset(&addr, 0, sizeof(addr));     \
             addr.sa.sa_family = AF_UNSPEC;      \
             addr.sin6.sin6_port = htons(PORT);  \
             SA_LEN_INIT;                        \
         } while (false)

     addr_t addr;

     INIT_ADDR_T(dnssd_proxy_udp_port);
     dnssd_proxy_listeners[dnssd_proxy_num_listeners] =
         ioloop_listener_create(false, false, true, NULL, 0, &addr, NULL, "DNS over UDP", dns_proxy_input,
                                NULL, NULL, NULL, NULL, NULL, 0, NULL);
     require_action_quiet(dnssd_proxy_listeners[dnssd_proxy_num_listeners] != NULL, exit, succeeded = false;
         ERROR("failed to start UDP listener - listener index: %d", dnssd_proxy_num_listeners));
     dnssd_proxy_num_listeners++;

     INIT_ADDR_T(dnssd_proxy_tcp_port);
     dnssd_proxy_listeners[dnssd_proxy_num_listeners] =
         ioloop_listener_create(true, false, true, NULL, 0, &addr, NULL, "DNS over TCP", dns_proxy_input,
                                NULL, NULL, NULL, NULL, NULL, 0, NULL);
     require_action_quiet(dnssd_proxy_listeners[dnssd_proxy_num_listeners] != NULL, exit, succeeded = false;
         ERROR("failed to start TCP listener - listener index: %d", dnssd_proxy_num_listeners));
     dnssd_proxy_num_listeners++;
 #endif // STUB_ROUTER

     dnssd_push_setup();

     for (int i = 0; i < dnssd_proxy_num_listeners; i++) {
         INFO("listener started - name: " PUB_S_SRP, dnssd_proxy_listeners[i]->name);
     }

     succeeded = true;
     goto exit;

 exit:
     return succeeded;
 }

 #define ADVERTISEMENT_RETRY_TIMER 10 * MSEC_PER_SEC

 #if STUB_ROUTER
 static void
 advertisements_finalize(void *context)
 {
     dnssd_proxy_advertisements_t *advertisements_context = context;
     advertisements_context->txn = NULL;
 }

 static void
 advertisements_failed(void *UNUSED context, int status)
 {
     ERROR("%d", status);
 }

 static void
 advertisements_callback(DNSServiceRef sd_ref, DNSRecordRef record_ref, DNSServiceFlags UNUSED flags,
                         DNSServiceErrorType error, void *context)
 {
     dnssd_proxy_advertisements_t *advertisements_context = context;

     if (error == kDNSServiceErr_NoError) {
         const char * const description = record_ref == advertisements_context->ns_record_ref ? "NS" : "PTR";
         INFO("record registered successfully - registered: " PUB_S_SRP, description);
     } else if (error == kDNSServiceErr_ServiceNotRunning) {
         // The record is not being advertised because mDNSResponder stopped running for some reason (like crashes),
         // in which case, we will stop the previous DNSService operation and start a new one 10s later.

         // Release the previous DNSServiceRef.
         if (advertisements_context->service_ref != sd_ref) {
             ERROR("Invalid DNSServiceRef - context->service_ref: %p, sd_ref: %p", advertisements_context->service_ref,
                 sd_ref);
         }
         if (advertisements_context->txn != NULL) {
             ioloop_dnssd_txn_cancel(advertisements_context->txn);
             ioloop_dnssd_txn_release(advertisements_context->txn);
             advertisements_context->txn = NULL;
         }
         advertisements_context->service_ref = NULL;

         // Restart the advertisement.
         bool succeeded = start_timer_to_advertise(advertisements_context, NULL, ADVERTISEMENT_RETRY_TIMER);
         if (!succeeded) {
             ERROR("start_timer_to_advertise failed");
         } else {
             INFO("mDNSResponder stopped running, preparing to re-advertise the PTR and NS records");
         }
     } else {
         ERROR("record not registered - error: %d", error);
     }
 }

 static void
 advertise_dnssd_proxy_callback(void *NONNULL context)
 {
     DNSServiceErrorType err;
     bool succeeded;
     bool dns_service_initialized = false;
     dns_wire_t wire;
     dns_towire_state_t towire;
     dnssd_proxy_advertisements_t *advertisement_context = context;
     srp_server_t *server_state = advertisement_context->server_state;
     const char *const domain_to_advertise = advertisement_context->domain_to_advertise;

     INFO("Start advertising lb._dns-sd._udp.local. PTR and openthread.thread.home.arpa.local NS records");

     // Create DNSServiceRef
     err = DNSServiceCreateConnection(&advertisement_context->service_ref);
     if (err != kDNSServiceErr_NoError) {
         ERROR("DNSServiceCreateConnection failed");
         succeeded = false;
         goto exit;
     }
     dns_service_initialized = true;

     // Setup lb._dns-sd._udp.local. PTR openthread.thread.home.arpa.
     towire_init(&wire, &towire);
     dns_full_name_to_wire(NULL, &towire, domain_to_advertise);

     err = DNSServiceRegisterRecord(advertisement_context->service_ref, &advertisement_context->ptr_record_ref,
                                    kDNSServiceFlagsShared, server_state->advertise_interface, AUTOMATIC_BROWSING_DOMAIN,
                                    kDNSServiceType_PTR, kDNSServiceClass_IN, towire.p - wire.data, wire.data, 0,
                                    advertisements_callback, advertisement_context);
     if (err != kDNSServiceErr_NoError) {
         ERROR("DNSServiceRegisterRecord failed - record: " PUB_S_SRP " PTR " PRI_S_SRP, AUTOMATIC_BROWSING_DOMAIN,
               domain_to_advertise);
         succeeded = false;
         goto exit;
     }

     // Setup openthread.thread.home.arpa. NS <local host name>.local.
     towire_init(&wire, &towire);
     dns_full_name_to_wire(NULL, &towire, local_host_name_dot_local);

     err = DNSServiceRegisterRecord(advertisement_context->service_ref, &advertisement_context->ns_record_ref,
                                    kDNSServiceFlagsShared | kDNSServiceFlagsForceMulticast,
                                    server_state->advertise_interface, domain_to_advertise, kDNSServiceType_NS,
                                    kDNSServiceClass_IN, towire.p - wire.data, wire.data, 0,
                                    advertisements_callback, advertisement_context);
     if (err != kDNSServiceErr_NoError) {
         ERROR("DNSServiceRegisterRecord failed - record: " PUB_S_SRP " NS " PRI_S_SRP, domain_to_advertise,
             local_host_name_dot_local);
         succeeded = false;
         goto exit;
     }

     // Start the running loop
     advertisement_context->txn = ioloop_dnssd_txn_add(advertisement_context->service_ref, advertisement_context,
                                                       advertisements_finalize, advertisements_failed);
     if (advertisement_context->txn == NULL) {
         ERROR("ioloop_dnssd_txn_add failed");
         succeeded = false;
         goto exit;
     }

     INFO("Advertising records - " PUB_S_SRP " PTR " PRI_S_SRP ", " PRI_S_SRP " NS " PRI_S_SRP,
          AUTOMATIC_BROWSING_DOMAIN, domain_to_advertise, domain_to_advertise, local_host_name_dot_local);
     succeeded = true;
 exit:
     if (!succeeded) {
         if (dns_service_initialized) {
             DNSServiceRefDeallocate(advertisement_context->service_ref);
             advertisement_context->service_ref = NULL;
         }
         if (err == kDNSServiceErr_ServiceNotRunning) {
             ERROR("mDNSResponder is not running yet when trying to advertise PTR and NS records, try again 10s later");
             // advertise_dnssd_proxy_callback will be called again 10s later, since we did not cancel the timer.
         } else {
             // Other kDNSServiceErr, should be impossible. If it happens, give up advertising the records.
             ioloop_cancel_wake_event(advertisement_context->wakeup_timer);
         }
     } else {
         // Since we registered successfully, there is no need to trigger another timer to set the records.
         // Stop the timer.
         ioloop_cancel_wake_event(advertisement_context->wakeup_timer);
     }
 }

 static bool
 start_timer_to_advertise(dnssd_proxy_advertisements_t *NONNULL context,
     const char *const NULLABLE domain_to_advertise, const uint32_t interval)
 {
     bool succeeded;

     // Only create timer once.
     if (context->wakeup_timer == NULL) {
         context->wakeup_timer = ioloop_wakeup_create();
         if (context->wakeup_timer == NULL) {
             succeeded = false;
             goto exit;
         }
     }

     // Only copy advertised domain once.
     if (context->domain_to_advertise == NULL) {
         if (domain_to_advertise == NULL) {
             succeeded = false;
             goto exit;
         }

         context->domain_to_advertise = strdup(domain_to_advertise);
         if (context->domain_to_advertise == NULL) {
             succeeded = false;
             goto exit;
         }
     }

     // Start the timer, finalize callback is not necessary here because the context should always be available.
     succeeded = ioloop_add_wake_event(context->wakeup_timer, context, advertise_dnssd_proxy_callback, NULL, interval);
     if (!succeeded) {
         goto exit;
     }

     succeeded = true;
 exit:
     if (!succeeded) {
         if (context->domain_to_advertise != NULL) {
             free(context->domain_to_advertise);
             context->domain_to_advertise = NULL;
         }
         if (context->wakeup_timer != NULL) {
             ioloop_wakeup_release(context->wakeup_timer);
             context->wakeup_timer = NULL;
         }
     }
     return succeeded;
 }

 #if SRP_FEATURE_DISCOVERY_PROXY_SERVER

 static bool
 start_timer_to_advertise_dnssd_dp_proxy(dnssd_dp_proxy_advertisements_t *context, uint32_t interval);

 static void
 dp_advertisements_finalize(void *const context)
 {
     dnssd_dp_proxy_advertisements_t *advertisements_context = context;
     advertisements_context->txn = NULL;
 }

 static void
 dp_advertisements_failed(void *const UNUSED context, const int status)
 {
     ERROR("push service advertisement failed  -- error: %d", status);
 }

 static void
 dp_advertisements_callback(const DNSServiceRef UNUSED sd_ref, const DNSServiceFlags UNUSED flags,
                            const DNSServiceErrorType error, const char *const name, const char *const reg_type,
                            const char *const domain, void *const context)
 {
     dnssd_dp_proxy_advertisements_t *const ads_ctx = context;
     if (error == kDNSServiceErr_NoError) {
         INFO("Push service registered successfully -- %s.%s%s", name, reg_type, domain);
     } else if (error == kDNSServiceErr_ServiceNotRunning) {
         if (ads_ctx->txn != NULL) {
             ioloop_dnssd_txn_cancel(ads_ctx->txn);
             ioloop_dnssd_txn_forget(&ads_ctx->txn);
         }
         ads_ctx->service_ref = NULL;

         const bool succeeded = start_timer_to_advertise_dnssd_dp_proxy(ads_ctx, ADVERTISEMENT_RETRY_TIMER);
         if (!succeeded) {
             ERROR("start_timer_to_advertise_dnssd_dp_proxy failed");
         } else {
             INFO("mDNSResponder stopped running, preparing to re-advertise DNS push service");
         }
     } else {
         ERROR("Push service not registered -- error: %d", error);
     }
 }

 static void
 advertise_dnssd_dp_proxy_callback(void *const context)
 {
     DNSServiceRef service_ref = NULL;
     dnssd_txn_t *txn = NULL;
     dnssd_dp_proxy_advertisements_t *const advertisement_context = context;
     srp_server_t *const server_state = advertisement_context->server_state;
     int bytes_written = 0;

     // Construct ,_local,_openthread#thread#home#arpa
     const char *domains_support_push[] = {
         DOT_LOCAL_DOMAIN,
         THREAD_BROWSING_DOMAIN,
     };
     char subtype_domains[256];
     size_t current_len = 0;
     for (size_t i = 0; i < countof(domains_support_push); i++) {
         const char *const domain_supports_push = domains_support_push[i];
         const size_t len = strlen(domain_supports_push);
         char subtype_domain[128];
         // Convert domain name like `_openthread.thread.home.arpa` to `_openthread#thread#home#arpa`.
         require_quiet(len < sizeof(subtype_domain), exit);
         for (size_t j = 0; j < len + 1; j++) {
             if (domain_supports_push[j] == '.') {
                 subtype_domain[j] = '#';
             } else {
                 subtype_domain[j] = domain_supports_push[j];
             }
         }
         // Remove the trailing '#'.
         if (subtype_domain[len - 1] == '#') {
             subtype_domain[len - 1] = '\0';
         }

         bytes_written = snprintf(subtype_domains + current_len, sizeof(subtype_domains) - current_len, ",_%s",
                                  subtype_domain);
         require_quiet((bytes_written > 0) && ((size_t)bytes_written < (sizeof(subtype_domains) - current_len)), exit);
         current_len += bytes_written;
     }

     // Construct _dnssd-dp._tcp,_local,_openthread#thread#home#arpa with subtype.
     char reg_type[128];
     bytes_written = snprintf(reg_type, sizeof(reg_type), "_dnssd-dp._tcp%s", subtype_domains);
     require_quiet((bytes_written > 0) && ((size_t)bytes_written < sizeof(reg_type)), exit);

     // Construct service instance name like: p128-undulw2d1vktd1
     const uint8_t priority = 128;
     const char * const random_identifier = uuid_name;
     char name[128];
     bytes_written = snprintf(name, sizeof(name), "p%03d-%s", priority, random_identifier);
     require_quiet((bytes_written > 0) && ((size_t)bytes_written < sizeof(name)), exit);

     const uint16_t dp_port = dnssd_proxy_tls_port;

     // The registered PTRs will be like:
     // _openthread#thread#home#arpa._sub._dnssd-dp._tcp.local   PTR p128-undulw2d1vktd1._dnssd-dp._tcp.local
     // _local._sub._dnssd-dp._tcp.local                         PTR p128-undulw2d1vktd1._dnssd-dp._tcp.local
     const DNSServiceErrorType dnsssd_err = DNSServiceRegister(&service_ref, 0, server_state->advertise_interface, name,
         reg_type, DOT_LOCAL_DOMAIN, NULL, htons(dp_port), 0, NULL, dp_advertisements_callback, context);
     require_action_quiet(dnsssd_err == kDNSServiceErr_NoError, exit,
         ERROR("DNSServiceRegisterRecord failed -- error: %d", dnsssd_err));

     txn = ioloop_dnssd_txn_add(service_ref, advertisement_context, dp_advertisements_finalize,
                                dp_advertisements_failed);
     require_quiet(txn != NULL, exit);

     advertisement_context->service_ref = service_ref;
     service_ref = NULL;
     advertisement_context->txn = txn;
     txn = NULL;
     INFO("Advertising push discovery service -- reg_type: %s.%s, service instance name: %s._dnssd-dp._tcp.%s",
          reg_type, DOT_LOCAL_DOMAIN, name, DOT_LOCAL_DOMAIN);

 exit:
     DNSServiceRefSourceForget(&service_ref);
     if (txn != NULL) {
         ioloop_dnssd_txn_cancel(txn);
         ioloop_dnssd_txn_forget(&txn);
     }
 }

 static bool
 start_timer_to_advertise_dnssd_dp_proxy(dnssd_dp_proxy_advertisements_t *const context, const uint32_t interval)
 {
     bool succeeded;
     wakeup_t *wakeup_timer = context->wakeup_timer;

     if (wakeup_timer == NULL) {
         wakeup_timer = ioloop_wakeup_create();
     } else {
         ioloop_wakeup_retain(wakeup_timer);
     }
     require_action_quiet(wakeup_timer != NULL, exit, succeeded = false);

     succeeded = ioloop_add_wake_event(wakeup_timer, context, advertise_dnssd_dp_proxy_callback, NULL, interval);
     require_quiet(succeeded, exit);

     if (context->wakeup_timer == NULL) {
         context->wakeup_timer = wakeup_timer;
         wakeup_timer = NULL;
     }

 exit:
     ioloop_wakeup_forget(&wakeup_timer);
     return succeeded;
 }

 static bool
 advertise_dnssd_dp_proxy(srp_server_t *const server_state)
 {
     return start_timer_to_advertise_dnssd_dp_proxy(server_state->dnssd_dp_proxy_advertisements,
         ADVERTISEMENT_RETRY_TIMER);
 }

 static bool
 is_eligible_to_provide_push_discovery_service(void)
 {
     return true;
 }

 #endif // SRP_FEATURE_DISCOVERY_PROXY_SERVER

 #endif // STUB_ROUTER

 #if SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY
 #  if SRP_FEATURE_DYNAMIC_CONFIGURATION
 static bool
 served_domain_init(srp_server_t *server_state)
 {
     bool succeeded;
     served_domain_t *my_name_served_domain = NULL;
     served_domain_t *ipv6 = NULL;
     served_domain_t *ipv4 = NULL;
     served_domain_t *thread_served_domain = NULL;
     served_domain_t *default_service_arpa_domain = NULL;
 #if SRP_FEATURE_LOCAL_DISCOVERY
     served_domain_t *dot_local_domain = NULL;
 #endif

     // <local host name>.home.arpa.
     my_name_served_domain = new_served_domain(NULL, my_name);
     require_action_quiet(my_name_served_domain != NULL, exit, succeeded = false;
         ERROR("failed to create new served domain - domain name: " PUB_S_SRP, my_name));

 #if STUB_ROUTER
     if (server_state->stub_router_enabled) {
         // ip6.arpa.
         // in-addr.arpa.
         ipv6 = new_served_domain(NULL, IPV6_REVERSE_LOOKUP_DOMAIN);
         ipv4 = new_served_domain(NULL, IPV4_REVERSE_LOOKUP_DOMAIN);
         require_action_quiet(ipv6 != NULL && ipv4 != NULL, exit, succeeded = false;
                              ERROR("failed to create new served domain for reverse look up -  domain name: " PUB_S_SRP ", " PUB_S_SRP,
                                    IPV6_REVERSE_LOOKUP_DOMAIN, IPV4_REVERSE_LOOKUP_DOMAIN)
             );
     }
 #else
     (void)server_state;
 #endif

     // THREAD_BROWSING_DOMAIN
     // It will be served by kDNSServiceInterfaceIndexLocalOnly, which is a pseudo interface.
     thread_served_domain = add_new_served_domain_with_interface(LOCAL_ONLY_PSEUDO_INTERFACE, NULL, NULL);
     require_action_quiet(thread_served_domain != NULL, exit, succeeded = false);
     bool hardwired_set = dnssd_hardwired_setup_for_served_domain(thread_served_domain);
     require_action_quiet(hardwired_set, exit, succeeded = false);

     // default.service.arpa
     // For Thread 1.3.0, default.service.arpa has to return all locally-discoverable services
     default_service_arpa_domain = add_new_served_domain_with_interface(ALL_LOCALS_PSEUDO_INTERFACE, NULL, NULL);
     require_action_quiet(default_service_arpa_domain != NULL, exit, succeeded = false);
     hardwired_set = dnssd_hardwired_setup_for_served_domain(default_service_arpa_domain);
     require_action_quiet(hardwired_set, exit, succeeded = false);

 #if SRP_FEATURE_LOCAL_DISCOVERY
     // local
     // discovery proxy for the infrastructure interface
     dot_local_domain = add_new_served_domain_with_interface(INFRASTRUCTURE_PSEUDO_INTERFACE, NULL, NULL);
     require_action_quiet(dot_local_domain != NULL, exit, succeeded = false);
     hardwired_set = dnssd_hardwired_setup_for_served_domain(dot_local_domain);
     require_action_quiet(hardwired_set, exit, succeeded = false);
 #endif

     succeeded = true;
 exit:
     if (!succeeded) {
         if (thread_served_domain != NULL) {
             delete_served_domain(thread_served_domain);
         }
         if (default_service_arpa_domain != NULL) {
             delete_served_domain(default_service_arpa_domain);
         }
 #if SRP_FEATURE_LOCAL_DISCOVERY
         if (dot_local_domain != NULL) {
             delete_served_domain(dot_local_domain);
         }
 #endif
         if (ipv4 != NULL) {
             delete_served_domain(ipv4);
         }
         if (ipv6 != NULL) {
             delete_served_domain(ipv6);
         }
         if (my_name_served_domain != NULL) {
             delete_served_domain(my_name_served_domain);
         }
     }
     return succeeded;
 }
 #  endif // SRP_FEATURE_DYNAMIC_CONFIGURATION
 #endif // SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY

 bool
 init_dnssd_proxy(srp_server_t *server_state)
 {
     bool succeeded;
     dnssd_proxy_advertisements_t *advertisements = server_state->dnssd_proxy_advertisements;
     if (advertisements == NULL) {
         advertisements = calloc(1, sizeof(*advertisements));
         require_action_quiet(advertisements != NULL, exit,
                              succeeded = false;
                              ERROR("no memory for advertisements"));
         server_state->dnssd_proxy_advertisements = advertisements;
         advertisements->server_state = server_state;
         advertisements->sc_context.info = advertisements;
     }

 #if STUB_ROUTER
 #if SRP_FEATURE_DISCOVERY_PROXY_SERVER
     if (is_eligible_to_provide_push_discovery_service()) {
         dnssd_dp_proxy_advertisements_t *dp_ads = server_state->dnssd_dp_proxy_advertisements;
         if (dp_ads == NULL) {
             dp_ads = calloc(1, sizeof(*dp_ads));
             require_action_quiet(dp_ads != NULL, exit,
                                  succeeded = false; ERROR("no memory for push discovery service advertisements"));
             server_state->dnssd_dp_proxy_advertisements = dp_ads;
             dp_ads->server_state = server_state;
         }
     }
 #endif // SRP_FEATURE_DISCOVERY_PROXY_SERVER
 #endif // STUB_ROUTER

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
     succeeded = configure_dnssd_proxy();
     require_action_quiet(succeeded, exit, ERROR("configure_dnssd_proxy failed"));


     succeeded = initialize_my_name_and_monitoring(server_state);

     require_action_quiet(succeeded, exit, ERROR("initialize_my_name_and_monitoring failed"));
     succeeded = initialize_uuid_name(server_state);
     require_action_quiet(succeeded, exit, ERROR("initialize_uuid_name failed"));
 #if STUB_ROUTER
     if (!server_state->stub_router_enabled) {
         served_domain_process_name_change();
     }
 #endif

 #else // SRP_FEATURE_DYNAMIC_CONFIGURATION
     // Read the config file
     succeeded = config_parse(NULL, "/etc/dnssd-proxy.cf", dp_verbs, NUMCFVERBS);
     require_action_quiet(succeeded,
                          exit,);

     // Insist that we have at least one address we're listening on.
     succeeded = !(num_listen_addrs == 0 && num_publish_addrs == 0);
     require_action_quiet(succeeded,
                          exit,
                          ERROR("Please configure at least one my-ipv4-addr and/or one my-ipv6-addr."));

     ioloop_map_interface_addresses(server_state, NULL, &served_domains, dnssd_proxy_ifaddr_callback);

     // Set up hardwired answers
     dnssd_hardwired_setup();
 #endif // SRP_FEATURE_DYNAMIC_CONFIGURATION

     succeeded = srp_tls_init();
     require_action_quiet(succeeded, exit, ERROR("srp_tls_init failed."));

 #if !SRP_FEATURE_CAN_GENERATE_TLS_CERT
     // The tls_fail flag allows us to run the proxy in such a way that TLS connections will fail.
     // This is never what you want in production, but is useful for testing.
     if (!tls_fail) {
         if (access(tls_key_filename, R_OK) < 0) {
             keyprogram_start(GENKEY_PROGRAM, keyfile_finished_callback,
                              "type=rsa", NULL, "rsa_keysize=4096", NULL, "filename", tls_key_filename, NULL);
         } else if (access(tls_cert_filename, R_OK) < 0) {
             keyfile_finished_callback(NULL, 0, NULL);
         }
         require_action_quiet(access(tls_key_filename, R_OK) >= 0, exit, ERROR("failed to create tls listener key."));
         require_action_quiet(access(tls_cert_filename, R_OK) >= 0, exit, ERROR("failed to create tls listener cert."));

         require_action_quiet(srp_tls_server_init(NULL, tls_cert_filename, tls_key_filename),
                              exit, ERROR("srp_tls_server_init failed."));
         require_action_quiet(srp_tls_client_init(), exit, ERROR("srp_tls_client_init failed."));
     }
 #endif

     succeeded = start_dnssd_proxy_listener();
     require_action_quiet(succeeded, exit, ERROR("start_dnssd_proxy_listener failed"));

 #if STUB_ROUTER
     if (server_state->stub_router_enabled) {
     #if SRP_FEATURE_DISCOVERY_PROXY_SERVER
         if (server_state->dnssd_dp_proxy_advertisements != NULL) {
             succeeded = advertise_dnssd_dp_proxy(server_state);
             require_action_quiet(succeeded, exit, ERROR("advertise_dnssd_dp_proxy failed"));
         }
     #endif
     }
 #endif

 #if SRP_FEATURE_DYNAMIC_CONFIGURATION
     succeeded = served_domain_init(server_state);
 #endif

 exit:
     return succeeded;
 }

 #if !SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY
 int
 main(int argc, char **argv)
 {
     int i;
     bool log_stderr = false;

     dnssd_proxy_udp_port = dnssd_proxy_tcp_port = 53;
     dnssd_proxy_tls_port = 853;

     // Parse command line arguments
     for (i = 1; i < argc; i++) {
         if (!strcmp(argv[i], "--tls-fail")) {
             tls_fail = true;
         } else if (!strcmp(argv[i], "--log-stderr")) {
             log_stderr = true;
         } else {
             return usage(argv[0]);
         }
     }

     OPENLOG("dnssd-proxy", log_stderr);

     if (!ioloop_init()) {
         return 1;
     }

     init_dnssd_proxy();

     ioloop();
 }
 #endif // #if !SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY

 #endif // (SRP_FEATURE_COMBINED_SRP_DNSSD_PROXY) || (!defined(BUILD_SRP_MDNS_PROXY) || (BUILD_SRP_MDNS_PROXY == 0))

 // Local Variables:
 // mode: C
 // tab-width: 4
 // c-file-style: "bsd"
 // c-basic-offset: 4
 // fill-column: 108
 // indent-tabs-mode: nil
 // End: