safing-portmaster/intel/resolve.go

// Copyright Safing ICS Technologies GmbH. Use of this source code is governed by the AGPL license that can be found in the LICENSE file.

package intel

import (
	"crypto/tls"
	"encoding/json"
	"errors"
	"fmt"
	"io/ioutil"
	"math/rand"
	"net"
	"net/http"
	"net/url"
	"sort"
	"strconv"
	"strings"
	"sync"
	"sync/atomic"
	"time"

	"github.com/miekg/dns"
	"github.com/tevino/abool"

	"github.com/Safing/safing-core/configuration"
	"github.com/Safing/safing-core/database"
	"github.com/Safing/safing-core/log"
	"github.com/Safing/safing-core/network/environment"
	"github.com/Safing/safing-core/network/netutils"
)

// TODO: make resolver interface for http package

// special tlds:

// localhost. [RFC6761] - respond with 127.0.0.1 and ::1 to A and AAAA queries, else nxdomain

// local. [RFC6762] - resolve if search, else resolve with mdns
// 10.in-addr.arpa. [RFC6761]
// 16.172.in-addr.arpa. [RFC6761]
// 17.172.in-addr.arpa. [RFC6761]
// 18.172.in-addr.arpa. [RFC6761]
// 19.172.in-addr.arpa. [RFC6761]
// 20.172.in-addr.arpa. [RFC6761]
// 21.172.in-addr.arpa. [RFC6761]
// 22.172.in-addr.arpa. [RFC6761]
// 23.172.in-addr.arpa. [RFC6761]
// 24.172.in-addr.arpa. [RFC6761]
// 25.172.in-addr.arpa. [RFC6761]
// 26.172.in-addr.arpa. [RFC6761]
// 27.172.in-addr.arpa. [RFC6761]
// 28.172.in-addr.arpa. [RFC6761]
// 29.172.in-addr.arpa. [RFC6761]
// 30.172.in-addr.arpa. [RFC6761]
// 31.172.in-addr.arpa. [RFC6761]
// 168.192.in-addr.arpa. [RFC6761]
// 254.169.in-addr.arpa. [RFC6762]
// 8.e.f.ip6.arpa. [RFC6762]
// 9.e.f.ip6.arpa. [RFC6762]
// a.e.f.ip6.arpa. [RFC6762]
// b.e.f.ip6.arpa. [RFC6762]

// example. [RFC6761] - resolve if search, else return nxdomain
// example.com. [RFC6761] - resolve if search, else return nxdomain
// example.net. [RFC6761] - resolve if search, else return nxdomain
// example.org. [RFC6761] - resolve if search, else return nxdomain
// invalid. [RFC6761] - resolve if search, else return nxdomain
// test. [RFC6761] - resolve if search, else return nxdomain
// onion. [RFC7686] - resolve if search, else return nxdomain

// resolvers:
// local
// global
// mdns

// scopes:
// local-inaddr -> local, mdns
// local -> local scopes, mdns
// global -> local scopes, global
// special -> local scopes, local

type Resolver struct {
	// static
	Server               string
	ServerAddress        string
	IP                   *net.IP
	Port                 uint16
	Resolve              func(resolver *Resolver, fqdn string, qtype dns.Type) (*RRCache, error)
	Search               *[]string
	AllowedSecurityLevel int8
	SkipFqdnBeforeInit   string
	HTTPClient           *http.Client
	Source               string

	// atomic
	Initialized *abool.AtomicBool
	InitLock    sync.Mutex
	LastFail    *int64
	Expires     *int64

	// must be locked
	LockReason sync.Mutex
	FailReason string

	// TODO: add:
	// Expiration (for server got from DHCP / ICMPv6)
	// bootstrapping (first query is already sent, wait for it to either succeed or fail - think about http bootstrapping here!)
	// expanded server info: type, server address, server port, options - so we do not have to parse this every time!
}

func (r *Resolver) String() string {
	return r.Server
}

func (r *Resolver) Address() string {
	return urlFormatAddress(r.IP, r.Port)
}

type Scope struct {
	Domain    string
	Resolvers []*Resolver
}

var (
	config = configuration.Get()

	globalResolvers []*Resolver // all resolvers
	localResolvers  []*Resolver // all resolvers that are in site-local or link-local IP ranges
	localScopes     []Scope     // list of scopes with a list of local resolvers that can resolve the scope
	mDNSResolver    *Resolver   // holds a reference to the mDNS resolver
	resolversLock   sync.RWMutex

	env = environment.NewInterface()

	dupReqMap  = make(map[string]*sync.Mutex)
	dupReqLock sync.Mutex
)

func init() {
	loadResolvers(false)
}

func indexOfResolver(server string, list []*Resolver) int {
	for k, v := range list {
		if v.Server == server {
			return k
		}
	}
	return -1
}

func indexOfScope(domain string, list *[]Scope) int {
	for k, v := range *list {
		if v.Domain == domain {
			return k
		}
	}
	return -1
}

func parseAddress(server string) (*net.IP, uint16, error) {
	delimiter := strings.LastIndex(server, ":")
	if delimiter < 0 {
		return nil, 0, errors.New("port missing")
	}
	ip := net.ParseIP(strings.Trim(server[:delimiter], "[]"))
	if ip == nil {
		return nil, 0, errors.New("invalid IP address")
	}
	port, err := strconv.Atoi(server[delimiter+1:])
	if err != nil || port < 1 || port > 65536 {
		return nil, 0, errors.New("invalid port")
	}
	return &ip, uint16(port), nil
}

func urlFormatAddress(ip *net.IP, port uint16) string {
	var address string
	if ipv4 := ip.To4(); ipv4 != nil {
		address = fmt.Sprintf("%s:%d", ipv4.String(), port)
	} else {
		address = fmt.Sprintf("[%s]:%d", ip.String(), port)
	}
	return address
}

func loadResolvers(resetResolvers bool) {
	// TODO: what happens when a lot of processes want to reload at once? we do not need to run this multiple times in a short time frame.
	resolversLock.Lock()
	defer resolversLock.Unlock()

	var newResolvers []*Resolver

configuredServersLoop:
	for _, server := range config.DNSServers {
		key := indexOfResolver(server, newResolvers)
		if key >= 0 {
			continue configuredServersLoop
		}
		key = indexOfResolver(server, globalResolvers)
		if resetResolvers || key == -1 {
			parts := strings.Split(server, "|")
			if len(parts) < 2 {
				log.Warningf("intel: invalid DNS server in config: %s (invalid format)", server)
				continue configuredServersLoop
			}
			var lastFail int64
			new := &Resolver{
				Server:        server,
				ServerAddress: parts[1],
				LastFail:      &lastFail,
				Source:        "config",
				Initialized:   abool.NewBool(false),
			}
			ip, port, err := parseAddress(parts[1])
			if err != nil {
				new.IP = ip
				new.Port = port
			}
			switch {
			case strings.HasPrefix(server, "DNS|"):
				new.Resolve = queryDNS
				new.AllowedSecurityLevel = configuration.SecurityLevelFortress
			case strings.HasPrefix(server, "DoH|"):
				new.Resolve = queryDNSoverHTTPS
				new.AllowedSecurityLevel = configuration.SecurityLevelFortress
				new.SkipFqdnBeforeInit = dns.Fqdn(strings.Split(parts[1], ":")[0])

				tls := &tls.Config{
				// TODO: use custom random
				// Rand: io.Reader,
				}
				tr := &http.Transport{
					MaxIdleConnsPerHost: 100,
					TLSClientConfig:     tls,
					// TODO: use custom resolver as of Go1.9
				}
				if len(parts) == 3 && strings.HasPrefix(parts[2], "df:") {
					// activate domain fronting
					tls.ServerName = parts[2][3:]
					addDomainFronting(new.SkipFqdnBeforeInit, dns.Fqdn(tls.ServerName))
					new.SkipFqdnBeforeInit = dns.Fqdn(tls.ServerName)
				}
				new.HTTPClient = &http.Client{Transport: tr}

			default:
				log.Warningf("intel: invalid DNS server in config: %s (not starting with a valid identifier)", server)
				continue configuredServersLoop
			}
			newResolvers = append(newResolvers, new)
		} else {
			newResolvers = append(newResolvers, globalResolvers[key])
		}
	}

	// add local resolvers
	assignedNameservers := environment.Nameservers()
assignedServersLoop:
	for _, nameserver := range assignedNameservers {
		server := fmt.Sprintf("DNS|%s", urlFormatAddress(&nameserver.IP, 53))
		key := indexOfResolver(server, newResolvers)
		if key >= 0 {
			continue assignedServersLoop
		}
		key = indexOfResolver(server, globalResolvers)
		if resetResolvers || key == -1 {
			var lastFail int64
			new := &Resolver{
				Server:               server,
				ServerAddress:        urlFormatAddress(&nameserver.IP, 53),
				IP:                   &nameserver.IP,
				Port:                 53,
				LastFail:             &lastFail,
				Resolve:              queryDNS,
				AllowedSecurityLevel: configuration.SecurityLevelFortress,
				Initialized:          abool.NewBool(false),
				Source:               "dhcp",
			}
			if netutils.IPIsLocal(nameserver.IP) && len(nameserver.Search) > 0 {
				// only allow searches for local resolvers
				var newSearch []string
				for _, value := range nameserver.Search {
					newSearch = append(newSearch, fmt.Sprintf(".%s.", strings.Trim(value, ".")))
				}
				new.Search = &newSearch
			}
			newResolvers = append(newResolvers, new)
		} else {
			newResolvers = append(newResolvers, globalResolvers[key])
		}
	}

	// save resolvers
	globalResolvers = newResolvers
	if len(globalResolvers) == 0 {
		log.Criticalf("intel: no (valid) dns servers found in configuration and system")
	}

	// make list with local resolvers
	localResolvers = make([]*Resolver, 0)
	for _, resolver := range globalResolvers {
		if resolver.IP != nil && netutils.IPIsLocal(*resolver.IP) {
			localResolvers = append(localResolvers, resolver)
		}
	}

	// add resolvers to every scope the cover
	localScopes = make([]Scope, 0)
	for _, resolver := range globalResolvers {

		if resolver.Search != nil {
			// add resolver to custom searches
			for _, search := range *resolver.Search {
				if search == "." {
					continue
				}
				key := indexOfScope(search, &localScopes)
				if key == -1 {
					localScopes = append(localScopes, Scope{
						Domain:    search,
						Resolvers: []*Resolver{resolver},
					})
				} else {
					localScopes[key].Resolvers = append(localScopes[key].Resolvers, resolver)
				}
			}

		}
	}

	// init mdns resolver
	if mDNSResolver == nil {
		cannotFail := int64(-1)
		mDNSResolver = &Resolver{
			Server:               "mDNS",
			Resolve:              queryMulticastDNS,
			AllowedSecurityLevel: config.DoNotUseMDNS.Level(),
			Initialized:          abool.NewBool(false),
			Source:               "static",
			LastFail:             &cannotFail,
		}
	}

	// sort scopes by length
	sort.Slice(localScopes,
		func(i, j int) bool {
			return len(localScopes[i].Domain) > len(localScopes[j].Domain)
		},
	)

	log.Trace("intel: loaded global resolvers:")
	for _, resolver := range globalResolvers {
		log.Tracef("intel: %s", resolver.Server)
	}
	log.Trace("intel: loaded local resolvers:")
	for _, resolver := range localResolvers {
		log.Tracef("intel: %s", resolver.Server)
	}
	log.Trace("intel: loaded scopes:")
	for _, scope := range localScopes {
		var scopeServers []string
		for _, resolver := range scope.Resolvers {
			scopeServers = append(scopeServers, resolver.Server)
		}
		log.Tracef("intel: %s: %s", scope.Domain, strings.Join(scopeServers, ", "))
	}

}

// Resolve resolves the given query for a domain and type and returns a RRCache object or nil, if the query failed.
func Resolve(fqdn string, qtype dns.Type, securityLevel int8) *RRCache {
	fqdn = dns.Fqdn(fqdn)

	// use this to time how long it takes resolve this domain
	// timed := time.Now()
	// defer log.Tracef("intel: took %s to get resolve %s%s", time.Now().Sub(timed).String(), fqdn, qtype.String())

	// handle request for localhost
	if fqdn == "localhost." {
		var rr dns.RR
		var err error
		switch uint16(qtype) {
		case dns.TypeA:
			rr, err = dns.NewRR("localhost. 3600 IN A 127.0.0.1")
		case dns.TypeAAAA:
			rr, err = dns.NewRR("localhost. 3600 IN AAAA ::1")
		default:
			return nil
		}
		if err != nil {
			return nil
		}
		return &RRCache{
			Answer: []dns.RR{rr},
		}
	}

	// check cache
	rrCache, err := GetRRCache(fqdn, qtype)
	if err != nil {
		switch err {
		case database.ErrNotFound:
		default:
			log.Warningf("intel: getting RRCache %s%s from database failed: %s", fqdn, qtype.String(), err)
		}
		return resolveAndCache(fqdn, qtype, securityLevel)
	}

	if rrCache.Expires <= time.Now().Unix() {
		rrCache.requestingNew = true
		go resolveAndCache(fqdn, qtype, securityLevel)
	}

	// randomize records to allow dumb clients (who only look at the first record) to reliably connect
	for i := range rrCache.Answer {
		j := rand.Intn(i + 1)
		rrCache.Answer[i], rrCache.Answer[j] = rrCache.Answer[j], rrCache.Answer[i]
	}

	return rrCache
}

func resolveAndCache(fqdn string, qtype dns.Type, securityLevel int8) *RRCache {
	// log.Tracef("intel: resolving %s%s", fqdn, qtype.String())

	rrCache, ok := checkDomainFronting(fqdn, qtype, securityLevel)
	if ok {
		if rrCache == nil {
			return nil
		}
		return rrCache
	}

	// dedup requests
	dupKey := fmt.Sprintf("%s%s", fqdn, qtype.String())
	dupReqLock.Lock()
	mutex, requestActive := dupReqMap[dupKey]
	if !requestActive {
		mutex = new(sync.Mutex)
		mutex.Lock()
		dupReqMap[dupKey] = mutex
		dupReqLock.Unlock()
	} else {
		dupReqLock.Unlock()
		log.Tracef("intel: waiting for duplicate query for %s to complete", dupKey)
		mutex.Lock()
		// wait until duplicate request is finished, then fetch current RRCache and return
		mutex.Unlock()
		var err error
		rrCache, err = GetRRCache(dupKey, qtype)
		if err == nil {
			return rrCache
		}
		// must have been nxdomain if we cannot get RRCache
		return nil
	}
	defer func() {
		dupReqLock.Lock()
		delete(dupReqMap, fqdn)
		dupReqLock.Unlock()
		mutex.Unlock()
	}()

	// resolve
	rrCache = intelligentResolve(fqdn, qtype, securityLevel)
	if rrCache == nil {
		return nil
	}

	// persist to database
	rrCache.Clean(600)
	rrCache.CreateWithType(fqdn, qtype)

	return rrCache
}

func intelligentResolve(fqdn string, qtype dns.Type, securityLevel int8) *RRCache {

	// TODO: handle being offline
	// TODO: handle multiple network connections

	if config.Changed() {
		log.Info("intel: config changed, reloading resolvers")
		loadResolvers(false)
	} else if env.NetworkChanged() {
		log.Info("intel: network changed, reloading resolvers")
		loadResolvers(true)
	}
	config.RLock()
	defer config.RUnlock()
	resolversLock.RLock()
	defer resolversLock.RUnlock()

	lastFailBoundary := time.Now().Unix() - config.DNSServerRetryRate
	preDottedFqdn := "." + fqdn

	// resolve:
	// reverse local -> local, mdns
	// local -> local scopes, mdns
	// special -> local scopes, local
	// global -> local scopes, global

	// local reverse scope
	if domainInScopes(preDottedFqdn, localReverseScopes) {
		// try local resolvers
		for _, resolver := range localResolvers {
			rrCache, ok := tryResolver(resolver, lastFailBoundary, fqdn, qtype, securityLevel)
			if ok && rrCache != nil && !rrCache.IsNXDomain() {
				return rrCache
			}
		}
		// check config
		if config.DoNotUseMDNS.IsSetWithLevel(securityLevel) {
			return nil
		}
		// try mdns
		rrCache, _ := tryResolver(mDNSResolver, lastFailBoundary, fqdn, qtype, securityLevel)
		return rrCache
	}

	// local scopes
	for _, scope := range localScopes {
		if strings.HasSuffix(preDottedFqdn, scope.Domain) {
			for _, resolver := range scope.Resolvers {
				rrCache, ok := tryResolver(resolver, lastFailBoundary, fqdn, qtype, securityLevel)
				if ok && rrCache != nil && !rrCache.IsNXDomain() {
					return rrCache
				}
			}
		}
	}

	switch {
	case strings.HasSuffix(preDottedFqdn, ".local."):
		// check config
		if config.DoNotUseMDNS.IsSetWithLevel(securityLevel) {
			return nil
		}
		// try mdns
		rrCache, _ := tryResolver(mDNSResolver, lastFailBoundary, fqdn, qtype, securityLevel)
		return rrCache
	case domainInScopes(preDottedFqdn, specialScopes):
		// check config
		if config.DoNotForwardSpecialDomains.IsSetWithLevel(securityLevel) {
			return nil
		}
		// try local resolvers
		for _, resolver := range localResolvers {
			rrCache, ok := tryResolver(resolver, lastFailBoundary, fqdn, qtype, securityLevel)
			if ok {
				return rrCache
			}
		}
	default:
		// try global resolvers
		for _, resolver := range globalResolvers {
			rrCache, ok := tryResolver(resolver, lastFailBoundary, fqdn, qtype, securityLevel)
			if ok {
				return rrCache
			}
		}
	}

	log.Criticalf("intel: failed to resolve %s%s: all resolvers failed (or were skipped to fulfill the security level)", fqdn, qtype.String())
	return nil

	// TODO: check if there would be resolvers available in lower security modes and alert user

}

func tryResolver(resolver *Resolver, lastFailBoundary int64, fqdn string, qtype dns.Type, securityLevel int8) (*RRCache, bool) {
	// skip if not allowed in current security level
	if resolver.AllowedSecurityLevel < config.SecurityLevel() || resolver.AllowedSecurityLevel < securityLevel {
		log.Tracef("intel: skipping resolver %s, because it isn't allowed to operate on the current security level: %d|%d", resolver, config.SecurityLevel(), securityLevel)
		return nil, false
	}
	// skip if not security level denies assigned dns servers
	if config.DoNotUseAssignedDNS.IsSetWithLevel(securityLevel) && resolver.Source == "dhcp" {
		log.Tracef("intel: skipping resolver %s, because assigned nameservers are not allowed on the current security level: %d|%d (%d)", resolver, config.SecurityLevel(), securityLevel, int8(config.DoNotUseAssignedDNS))
		return nil, false
	}
	// check if failed recently
	if atomic.LoadInt64(resolver.LastFail) > lastFailBoundary {
		return nil, false
	}
	// TODO: put SkipFqdnBeforeInit back into !resolver.Initialized.IsSet() as soon as Go1.9 arrives and we can use a custom resolver
	// skip resolver if initializing and fqdn is set to skip
	if fqdn == resolver.SkipFqdnBeforeInit {
		return nil, false
	}
	// check if resolver is already initialized
	if !resolver.Initialized.IsSet() {
		// first should init, others wait
		resolver.InitLock.Lock()
		if resolver.Initialized.IsSet() {
			// unlock immediately if resolver was initialized
			resolver.InitLock.Unlock()
		} else {
			// initialize and unlock when finished
			defer resolver.InitLock.Unlock()
		}
		// check if previous init failed
		if atomic.LoadInt64(resolver.LastFail) > lastFailBoundary {
			return nil, false
		}
	}
	// resolve
	log.Tracef("intel: trying to resolve %s%s with %s", fqdn, qtype.String(), resolver.Server)
	rrCache, err := resolver.Resolve(resolver, fqdn, qtype)
	if err != nil {
		// check if failing is disabled
		if atomic.LoadInt64(resolver.LastFail) == -1 {
			log.Tracef("intel: non-failing resolver %s failed (%s), moving to next", resolver, err)
			return nil, false
		}
		log.Warningf("intel: resolver %s failed (%s), moving to next", resolver, err)
		resolver.LockReason.Lock()
		resolver.FailReason = err.Error()
		resolver.LockReason.Unlock()
		atomic.StoreInt64(resolver.LastFail, time.Now().Unix())
		resolver.Initialized.UnSet()
		return nil, false
	}
	resolver.Initialized.SetToIf(false, true)
	return rrCache, true
}

func queryDNS(resolver *Resolver, fqdn string, qtype dns.Type) (*RRCache, error) {

	q := new(dns.Msg)
	q.SetQuestion(fqdn, uint16(qtype))

	var reply *dns.Msg
	var err error
	for i := 0; i < 5; i++ {
		client := new(dns.Client)
		reply, _, err = client.Exchange(q, resolver.ServerAddress)
		if err != nil {

			// TODO: handle special cases
			// 1. connect: network is unreachable
			// 2. timeout

			if nerr, ok := err.(net.Error); ok && nerr.Timeout() {
				log.Tracef("intel: retrying to resolve %s%s with %s, error was: %s", fqdn, qtype.String(), resolver.Server, err)
				continue
			}
			break
		}
	}

	if err != nil {
		log.Warningf("resolving %s%s failed: %s", fqdn, qtype.String(), err)
		return nil, fmt.Errorf("resolving %s%s failed: %s", fqdn, qtype.String(), err)
	}

	new := &RRCache{
		Answer: reply.Answer,
		Ns:     reply.Ns,
		Extra:  reply.Extra,
	}

	// TODO: check if reply.Answer is valid
	return new, nil
}

type DnsOverHttpsReply struct {
	Status     uint32
	Truncated  bool `json:"TC"`
	Answer     []DohRR
	Additional []DohRR
}

type DohRR struct {
	Name  string `json:"name"`
	Qtype uint16 `json:"type"`
	TTL   uint32 `json:"TTL"`
	Data  string `json:"data"`
}

func queryDNSoverHTTPS(resolver *Resolver, fqdn string, qtype dns.Type) (*RRCache, error) {

	// API documentation: https://developers.google.com/speed/public-dns/docs/dns-over-https

	payload := url.Values{}
	payload.Add("name", fqdn)
	payload.Add("type", strconv.Itoa(int(qtype)))
	payload.Add("edns_client_subnet", "0.0.0.0/0")
	// TODO: add random - only use upper- and lower-case letters, digits, hyphen, period, underscore and tilde
	// payload.Add("random_padding", "")

	resp, err := resolver.HTTPClient.Get(fmt.Sprintf("https://%s/resolve?%s", resolver.ServerAddress, payload.Encode()))
	if err != nil {
		return nil, fmt.Errorf("resolving %s%s failed: http error: %s", fqdn, qtype.String(), err)
		// TODO: handle special cases
		// 1. connect: network is unreachable
		// intel: resolver DoH|dns.google.com:443|df:www.google.com failed (resolving discovery-v4-4.syncthing.net.A failed: http error: Get https://dns.google.com:443/resolve?edns_client_subnet=0.0.0.0%2F0&name=discovery-v4-4.syncthing.net.&type=1: dial tcp [2a00:1450:4001:819::2004]:443: connect: network is unreachable), moving to next
		// 2. timeout
	}
	if resp.StatusCode != 200 {
		return nil, fmt.Errorf("resolving %s%s failed: request was unsuccessful, got code %d", fqdn, qtype.String(), resp.StatusCode)
	}

	defer resp.Body.Close()
	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("resolving %s%s failed: error reading response body: %s", fqdn, qtype.String(), err)
	}

	var reply DnsOverHttpsReply
	err = json.Unmarshal(body, &reply)
	if err != nil {
		return nil, fmt.Errorf("resolving %s%s failed: error parsing response body: %s", fqdn, qtype.String(), err)
	}

	if reply.Status != 0 {
		// this happens if there is a server error (e.g. DNSSEC fail), ignore for now
		// TODO: do something more intelligent
	}

	new := new(RRCache)

	// TODO: handle TXT records

	for _, entry := range reply.Answer {
		rr, err := dns.NewRR(fmt.Sprintf("%s %d IN %s %s", entry.Name, entry.TTL, dns.Type(entry.Qtype).String(), entry.Data))
		if err != nil {
			log.Warningf("intel: resolving %s%s failed: failed to parse record to DNS: %s %d IN %s %s", fqdn, qtype.String(), entry.Name, entry.TTL, dns.Type(entry.Qtype).String(), entry.Data)
			continue
		}
		new.Answer = append(new.Answer, rr)
	}

	for _, entry := range reply.Additional {
		rr, err := dns.NewRR(fmt.Sprintf("%s %d IN %s %s", entry.Name, entry.TTL, dns.Type(entry.Qtype).String(), entry.Data))
		if err != nil {
			log.Warningf("intel: resolving %s%s failed: failed to parse record to DNS: %s %d IN %s %s", fqdn, qtype.String(), entry.Name, entry.TTL, dns.Type(entry.Qtype).String(), entry.Data)
			continue
		}
		new.Extra = append(new.Extra, rr)
	}

	return new, nil
}

// TODO: implement T-DNS: DNS over TCP/TLS
// server list: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers