diff --git a/Android.bp b/Android.bp
index 9763730..114b2e1 100644
--- a/Android.bp
+++ b/Android.bp
@@ -10,8 +10,6 @@
         "-Werror",
         // Override -Wno-error=implicit-fallthrough from soong
         "-Werror=implicit-fallthrough",
-        "-Werror=sometimes-uninitialized",
-        "-Werror=conditional-uninitialized",
         "-Wnullable-to-nonnull-conversion",
         "-Wsign-compare",
         "-Wthread-safety",
diff --git a/OWNERS b/OWNERS
index 7d617ec..107eefc 100644
--- a/OWNERS
+++ b/OWNERS
@@ -4,7 +4,6 @@
 jchalard@google.com
 lorenzo@google.com
 maze@google.com
-nuccachen@google.com
 reminv@google.com
 satk@google.com
 xiaom@google.com
diff --git a/PREUPLOAD.cfg b/PREUPLOAD.cfg
index 27eac94..c8dbf77 100644
--- a/PREUPLOAD.cfg
+++ b/PREUPLOAD.cfg
@@ -1,6 +1,5 @@
 [Builtin Hooks]
 clang_format = true
-commit_msg_test_field = false
 
 [Builtin Hooks Options]
 clang_format = --commit ${PREUPLOAD_COMMIT} --style file --extensions c,h,cc,cpp
diff --git a/TEST_MAPPING b/TEST_MAPPING
index 095fa7d..2d3673c 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -1,20 +1,10 @@
 {
     "presubmit": [
-        { "name": "libnetdbpf_test" },
         { "name": "netd_integration_test" },
         { "name": "netd_unit_test" },
-        { "name": "netdclient_test" },
-        { "name": "netdutils_test" }
-    ],
-    "postsubmit": [
-        { "name": "libnetdbpf_test",
-          "keywords": ["netd-device-kernel-4.9", "netd-device-kernel-4.14"]},
-        { "name": "netd_integration_test",
-          "keywords": ["netd-device-kernel-4.9", "netd-device-kernel-4.14"]},
-        { "name": "netd_unit_test",
-          "keywords": ["netd-device-kernel-4.9", "netd-device-kernel-4.14"]}
-    ],
-    "imports": [
-        { "path": "packages/modules/DnsResolver" }
+        { "name": "libnetdbpf_test" },
+        { "name": "netdutils_test" },
+        { "name": "resolv_integration_test" },
+        { "name": "resolv_unit_test" }
     ]
 }
diff --git a/apex/Android.bp b/apex/Android.bp
new file mode 100644
index 0000000..c1d33e1
--- /dev/null
+++ b/apex/Android.bp
@@ -0,0 +1,41 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+apex {
+    name: "com.android.resolv",
+    manifest: "manifest.json",
+    multilib: {
+        first: {
+             native_shared_libs: ["libnetd_resolv"],
+        },
+    },
+    key: "com.android.resolv.key",
+    certificate: ":com.android.resolv.certificate",
+
+    // Use a custom AndroidManifest.xml used for API targeting.
+    androidManifest: "AndroidManifest.xml",
+}
+
+apex_key {
+    name: "com.android.resolv.key",
+    public_key: "com.android.resolv.avbpubkey",
+    private_key: "com.android.resolv.pem",
+}
+
+android_app_certificate {
+     name: "com.android.resolv.certificate",
+     // will use cert.pk8 and cert.x509.pem
+     certificate: "testcert",
+}
diff --git a/apex/AndroidManifest.xml b/apex/AndroidManifest.xml
new file mode 100644
index 0000000..9d6455c
--- /dev/null
+++ b/apex/AndroidManifest.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+  package="com.android.resolv">
+  <!-- APEX does not have classes.dex -->
+  <application android:hasCode="false" />
+  <!--
+    * The interface between the resolver and netd is backwards compatible, so the resolver APEX
+    * can work with any version of netd.
+    -->
+  <uses-sdk
+      android:targetSdkVersion="29"
+  />
+</manifest>
diff --git a/apex/OWNERS b/apex/OWNERS
new file mode 100644
index 0000000..bc97a1b
--- /dev/null
+++ b/apex/OWNERS
@@ -0,0 +1,4 @@
+chenbruce@google.com
+codewiz@google.com
+martinwu@google.com
+
diff --git a/apex/com.android.resolv.avbpubkey b/apex/com.android.resolv.avbpubkey
new file mode 100644
index 0000000..e0af34c
--- /dev/null
+++ b/apex/com.android.resolv.avbpubkey
Binary files differ
diff --git a/apex/com.android.resolv.pem b/apex/com.android.resolv.pem
new file mode 100644
index 0000000..6eb688d
--- /dev/null
+++ b/apex/com.android.resolv.pem
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJJwIBAAKCAgEAqcW/Lsj7Ftp8jUpWaW82J+uSpIlcs5w/vsIBEPW/nrakXvLG
+GBA1gauamV+2hvQ76CIkXqsYeaBl8jo1JZuF+ek0tEtHnvMCuGWZZmJSni9CWdXa
+GjQf74+HD0LcVYZd07xjW4aR42httOq9S9zGEucQHaTSQ0C0JBRFMUaAva7QJG15
+w0oqogze7TKTxO2aXZ9R1n3STprY+dv5FXcgGNraAZiSZRYc2FDvgE3J1V1PrdV8
+9RZv6133Iz5eINxR/6MTo2yxNxwZ6gsLD72gTX4N7nc9xtbC9WXCi8Uf7b6dhfyf
+zwZfJSKnwHh6EMa1AdIEgSSdIjbbcCP5mFscbvzUWNuAtUn8RWXUFOF5ssWsTMQC
+QtmfAnbVYH3oMxv3HBlDzS4CVMBmIBUZDbtvpPdQYBJPA/l/kU4DVjCv6Kpgx5Z3
+tVXVA9elta6eZ2dXL7aOPeOJS7OwP6nnEZr/7JJ8NRtQNOwRUU1xRcTxkwRmr/2A
+4h2qoYvxCOebqijvobKzB9cCzM5PvQzLA2aF7yohMN24HNNcTaybeBY6yUGd/iaD
+q0xyD8t7XyoEpMs7SOKkVp08G/kpp7hxRWUzADhhYrvMEAIsyIxX5jSTZYtvYLU/
+UMbfpUNE3qQEYNMv6d5+/Psv8EAjQA5mkNiSY/VWWnPkWapha8MAvYA9nTcCAwEA
+AQKCAgBKG8gY5CK3FyjHhGu0GpfJVUvuBwgwX0R0QLu2a4/5+EBIMjHGz0yMDhyu
+VtmWj4aXDlBSAt3sOdhGpKIOiJUzQll/Wl0pRWsqky8jQkhORNLx5CgQyDAoor6S
+Kt2Dd+P9SX8VtOh6HFvHXbDELNtJ5RNj3U7rjJMWLMMHf38zTdwOCrvcQ8PYeUXW
+xP08OXvo4mMW/lWPeoi8iQlyFU4ti1se1zsQZVayFqJ1n387ZEAj4c1qLyEr3RjE
+ibUNIx+oN8eazxeMtveY8rkhZeVT7nKmZebRpW31MTZ7TNFjNpIMqvoXpPBjhX00
+x2KBcDwTT1ooBZOSG+AuU4Xgu+Ts1+6nZKbhnQuxvgslFyDEdtuID7nuXu08D3B2
+OpCtrQt08QS/dLHpcOhSMjkxqH2aITVPQgGWK16E7pcVex/Lapyjr4ETx1GqjpCL
+uKhmvGsrcdUD9fETzV5ZsMBHrnCSlq0XRnWFuGYmxlSIAciNUTMFfy7D/ml++Boe
+S33HwuaJlnUp3iAbIddXXx+zZHBocJ1Iznl1iu8CMdh+79wMOPkcMDRRNZPpMca+
+ukfGRRdrtyPyrWdrv9d+jtORBC3L9Kgg5yCEXe3HZCSLj/9UUrEAAACEw/IuYxy0
+AsDwpHS9WuqvLYbFPL3UQlSlFJWKkgCZwO+K+c2MsVnllWI0AQKCAQEA0NqVa0Jx
+TGxE2EEEgxA63c+rp5Qm2IlKns+tbnWnfI6XW/JiFkDqTVkIcg6F3dVyjEaZnGWa
+MPCORCtOGQ8IyAYQANyza/CW2+i0YvJBSMmCsbo7wUdrYU9krPRLLWYLhue5HdTP
+5+H+lFXmu3o36YhhWwfMflZsV1MOzRF3eIH3FaTgzoXmBQH3CH5y2c3OWjhMrTnz
+51HZFPu3XB3wmqEIyHAsQke68HxgyJ7uBYUmdAIYYMLgV3Jp/ds+QxXSqwYz97tS
+oe6778QLqcn/Q9LtonagDMO/ATSw/0fLt1+8QLdbksDTC4MUoaGKxuiL7sy5PnKd
+72oV75t06Tz26QKCAQEA0BiyFaC3EcZG6KmoZvM+bHGK9gp5tKr0AgERLAVe+M/f
+1NsBxf1HxoHlkudGRo64J+SwM+ZVVh5UPtrb1Le5a3IR9qL++ZfPM1WuvlHz9uBc
+lJLPozboWoUovbfaoKQtuRzzOYBwodwAbY02LNNtM33jqXNUN0MM0L3ZH3FmOglU
+u/4dH+EvgLDpnCV0czMlGSo9I9977Nvy3dQBXjzz9EF+covAhq7skmfwDblTAZR7
+EkmsCmoeEoKRAEtKgAxs0Hgyo2iMIxYy0pdvjGhJe64JQb3EKLjxhYsadnI+S5YI
+QBH9+EX/ZLSii+cIkEeh1lSMk9uT1/Rp4V40sdmfHwKCAQA9oTLUWt/qCEzsb4sw
+TbrBN4XUxpAL979wS6JG5SsOQ1mAxW6SWIeLWYl3drej9Vd+81pi30x3wpSIoyrB
+lEEoHTndt0KuyGkL7YhFZm1DWEtbvLPjXfre1TnFG7WPaPxfy8NBfUn4iCTCivKy
+Qed730WzQgLjCQehYR4N/2h8xAUwet3ns3Vj5ueJtx6XDPcmglSGDYLesLVZTsoV
+wbP9PSXFV+yHhnkwe9NngBaGxHrLYs7kxrzCsT17rpWZ4DexRfxRzxIcPMFyiCxU
+5wmPbw+2kEC8Y4rahTzxp7MCopp/klvQW1wrmnudEnlMJtUcG4dSWSonuutMMFh4
+dwf5AoIBAEX9+HAT1V9yHEmHPvAZooZhDkdBMLxWv6mo6DixOcdgS73RR+BrF2gq
+Kqhlh5qVyFUKs0VRlKRZoSZfAI+kmAYOoQIewrn6mKOAjzzOXctMnXcPhi00e6Ru
+o0xkeXGMpyBbH2fYzolycOZoF6+uEU2/awKEmu/XaokPQec0ghjFKK3ug6dEW3Di
+kECHzIouyqyTK2tUcN8y/5YjB67Fu5wNJ1WpscDbNxDrSq+jBMtEQLze8LG0DZdW
+OSUrLcyx4SuhMg8KTBBFGCUC8G7+aLDj0ZM+G6tCwWGUbvsl49QSi4XZR13pVURv
+CTkbJSM6JLHtUDcvJKP/PlmiEQE83CsCggEAOIlm8zRHeJe3GdZAPIwV8EYCh7rd
+ghRjGIwzjylazzZyeHLQBKaIwNdlgOZG1HqTljdp4ZE0f+Oyh2lGOqQEqWjMBJPp
+yZG1jBCCsJMfTweWxzLhmzV4UUQ+MZQDjZ7uOKGYwN/rkhW30zZMenoZ+PywFhhl
+ldnPsQMBvqS03eCIaQveRkq8S/qA3uDGPjsEPTaYMJgw9/imsP8hW3z+kd7hH76R
+Guk98WHe3wvasV1RNOp5ixwUQgVmFJLrTVX+dfSKLw0XzekkG/1Uis7r2HXCfoaZ
+boHvICyW0kmhnsOVA7mWwByhUav9Ghevm9czVATTIGiA8lIZxFFbvr2KTg==
+-----END RSA PRIVATE KEY-----
diff --git a/apex/manifest.json b/apex/manifest.json
new file mode 100644
index 0000000..f3f5b02
--- /dev/null
+++ b/apex/manifest.json
@@ -0,0 +1,4 @@
+{
+  "name": "com.android.resolv",
+  "version": 299900000
+}
diff --git a/apex/testcert.pk8 b/apex/testcert.pk8
new file mode 100644
index 0000000..adfc589
--- /dev/null
+++ b/apex/testcert.pk8
Binary files differ
diff --git a/apex/testcert.x509.pem b/apex/testcert.x509.pem
new file mode 100644
index 0000000..cba30d6
--- /dev/null
+++ b/apex/testcert.x509.pem
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGADCCA+igAwIBAgIJAJiRMVvanGUaMA0GCSqGSIb3DQEBCwUAMIGUMQswCQYD
+VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4g
+VmlldzEQMA4GA1UECgwHQW5kcm9pZDEQMA4GA1UECwwHQW5kcm9pZDEQMA4GA1UE
+AwwHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAe
+Fw0xODEwMzAxMjEzNTFaFw00NjAzMTcxMjEzNTFaMIGUMQswCQYDVQQGEwJVUzET
+MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEQMA4G
+A1UECgwHQW5kcm9pZDEQMA4GA1UECwwHQW5kcm9pZDEQMA4GA1UEAwwHQW5kcm9p
+ZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBAL3ghKA8Gz9qOORY8gMY4wlB2tCJLDUO2tFG
+LVK1UphtQMp+YEcz/0VQKVV7de7z6V4EMQ5P1HbxHOsjcKn/zXAl4YgFt7b5kZbC
+bpNK4CYHEfho3j6fpYtq5d9q8rIA2kI0uZkkqPy1zXKTl2C2PjOoAnLQRk5xBVQG
+M10/wYsf7yX36mSWoJJwKPp/EzVFpA+hX8HpljeIiZ6CFzKwJdqv9zO/xzfp6NsX
+Tv5EGdkDxmw3qQqKgyl8dLMTZ/2zNfvVOMeZDusEPDF7A/lbU1byLWrKQdCzVb40
+yc7BCSRGYwM29R/byOcgD+lslwKSGzgzNmQXICt1tXz9bSJR8qh4tlAaiRc3ZKBe
+hJWIFGkGtD/cDGtDE5DbNAOz6CdSDdE2XN0Qf0cfN1RHVE6fo2FtFicRRVuFBt8M
+2cbQ7bzmEvtHD6W6dsf120FH7gppXKmnhMx1WazpxR2QltbiYDTy2ZZi4paS/jDB
+fL9gMCWp3Ohg2y74NGfUw5CQWQsDpcki6I7RvwClBCyOV51LHn5LE/nY4DkVrZxk
+Pw0/YrTWz5J5PbdMetTuIunE4ec4lm8nZnh1ET+2MHx2+RoyF5vBs4rp1KHHRaEA
+veD2AfQOWxz7kOG9+akFot7n+QoWEGdwY0mJ9jsO/IITCjv3VbD7o0OoJv1R2AW5
+sK2KQ4PDAgMBAAGjUzBRMB0GA1UdDgQWBBT2EbrayXGhY6VCvSlLtRNyjW9ceDAf
+BgNVHSMEGDAWgBT2EbrayXGhY6VCvSlLtRNyjW9ceDAPBgNVHRMBAf8EBTADAQH/
+MA0GCSqGSIb3DQEBCwUAA4ICAQC7SsWap9zDKmuR0qMUZ6wlualnag0hUG1jZHQP
+t63KO6LmNNMSuXRX60Zcq6WWzgLOyoT4HqHZZ47Jamfb4XQQcnWMMW0tJ3pDtTkz
+dZILBInHJO8QPYI8Du6XWsDLSvMajq6ueBtO3NdcgsNL7eiHf3WoOtajLZxFM94Z
+MESkUQOIsqHolYeTMHLTsuGkX1CK2Zw3Xn18bUSTYwZCHa6mYH00ItUBfetGCnWh
+Y7bth/R15Cc+hocSB7ZsOa/R5kDyDdFDIKrnV5nH5Yd7CryrYC6Ac5UarYrxSJTq
+eKPwqUlJB/tJW/lvdLt8YaURbFGzf/ZqU12zZRafYjmMjcQvfpzMoDSnbvHTA9IR
+ZGO7dwhwykoSaL4/8LWde49xQUq6F2pQBRmEr+7mTzml1MaM5cWEk5emkCMXgLog
+k+c56CAk1EdM1teWik7wR0TIqkkYyYJHTSg61GkXUIXrZJ6iYx2ejDg1+QTPm9rU
+Yr7nP52gVkQuUAX1+xB6wKLSDizQJw8SNiUGXl5+2vwV6+0BI3/CXlQ8I/nRPBC1
+oqOIkRSbE+IF7DP9QvYuNG/3bZZQ8LUVeHxqI5Mq8K2VIJZd95AIwPNMH34SaDGz
+9xjG28Fq4ZkuDP0pCsHM9d2XEwK5PEVS18WW5fJ/QcJKMno4IPTB70ZBBjVzv6Y+
+MYjOrw==
+-----END CERTIFICATE-----
diff --git a/bpf_progs/Android.bp b/bpf_progs/Android.bp
index 7b1f015..a393035 100644
--- a/bpf_progs/Android.bp
+++ b/bpf_progs/Android.bp
@@ -14,11 +14,6 @@
 // limitations under the License.
 //
 
-cc_library_headers {
-    name: "netd_bpf_progs_headers",
-    export_include_dirs: ["."],
-}
-
 //
 // bpf kernel programs
 //
diff --git a/bpf_progs/bpf_net_helpers.h b/bpf_progs/bpf_net_helpers.h
deleted file mode 100644
index 714b7e6e..0000000
--- a/bpf_progs/bpf_net_helpers.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2019 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef NETDBPF_BPF_NET_HELPERS_H
-#define NETDBPF_BPF_NET_HELPERS_H
-
-#include <linux/bpf.h>
-#include <linux/if_packet.h>
-#include <stdbool.h>
-#include <stdint.h>
-
-// this returns 0 iff skb->sk is NULL
-static uint64_t (*bpf_get_socket_cookie)(struct __sk_buff* skb) = (void*)BPF_FUNC_get_socket_cookie;
-
-static uint32_t (*bpf_get_socket_uid)(struct __sk_buff* skb) = (void*)BPF_FUNC_get_socket_uid;
-static int (*bpf_skb_load_bytes)(struct __sk_buff* skb, int off, void* to,
-                                 int len) = (void*)BPF_FUNC_skb_load_bytes;
-
-static int (*bpf_skb_change_proto)(struct __sk_buff* skb, __be16 proto,
-                                   __u64 flags) = (void*)BPF_FUNC_skb_change_proto;
-static int (*bpf_l3_csum_replace)(struct __sk_buff* skb, __u32 offset, __u64 from, __u64 to,
-                                  __u64 flags) = (void*)BPF_FUNC_l3_csum_replace;
-static int (*bpf_l4_csum_replace)(struct __sk_buff* skb, __u32 offset, __u64 from, __u64 to,
-                                  __u64 flags) = (void*)BPF_FUNC_l4_csum_replace;
-static int (*bpf_redirect)(__u32 ifindex, __u64 flags) = (void*)BPF_FUNC_redirect;
-
-// Android only supports little endian architectures
-#define htons(x) (__builtin_constant_p(x) ? ___constant_swab16(x) : __builtin_bswap16(x))
-#define htonl(x) (__builtin_constant_p(x) ? ___constant_swab32(x) : __builtin_bswap32(x))
-#define ntohs(x) htons(x)
-#define ntohl(x) htonl(x)
-
-static inline __always_inline __unused bool is_received_skb(struct __sk_buff* skb) {
-    return skb->pkt_type == PACKET_HOST || skb->pkt_type == PACKET_BROADCAST ||
-           skb->pkt_type == PACKET_MULTICAST;
-}
-
-#endif  // NETDBPF_BPF_NET_HELPERS_H
diff --git a/bpf_progs/clatd.c b/bpf_progs/clatd.c
index fb7acfa..578d244 100644
--- a/bpf_progs/clatd.c
+++ b/bpf_progs/clatd.c
@@ -23,16 +23,31 @@
 #include <linux/ipv6.h>
 #include <linux/pkt_cls.h>
 #include <linux/swab.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
 #include <stdbool.h>
 #include <stdint.h>
 
 #include "bpf_helpers.h"
-#include "bpf_net_helpers.h"
 #include "netdbpf/bpf_shared.h"
 
+// bionic/libc/kernel/uapi/linux/udp.h:
+//   struct __kernel_udphdr {
+// bionic/libc/kernel/tools/defaults.py:
+//   # We want to support both BSD and Linux member names in struct udphdr.
+//   "udphdr": "__kernel_udphdr",
+// so instead it just doesn't work... ugh.
+#define udphdr __kernel_udphdr
+
 // From kernel:include/net/ip.h
 #define IP_DF 0x4000  // Flag: "Don't Fragment"
 
+// Android only supports little endian architectures
+#define htons(x) (__builtin_constant_p(x) ? ___constant_swab16(x) : __builtin_bswap16(x))
+#define htonl(x) (__builtin_constant_p(x) ? ___constant_swab32(x) : __builtin_bswap32(x))
+#define ntohs(x) htons(x)
+#define ntohl(x) htonl(x)
+
 DEFINE_BPF_MAP(clat_ingress_map, HASH, ClatIngressKey, ClatIngressValue, 16)
 
 static inline __always_inline int nat64(struct __sk_buff* skb, bool is_ethernet) {
@@ -41,6 +56,8 @@
     const void* data_end = (void*)(long)skb->data_end;
     const struct ethhdr* const eth = is_ethernet ? data : NULL;  // used iff is_ethernet
     const struct ipv6hdr* const ip6 = is_ethernet ? (void*)(eth + 1) : data;
+    const struct tcphdr* const tcp = (void*)(ip6 + 1);
+    const struct udphdr* const udp = (void*)(ip6 + 1);
 
     // Must be meta-ethernet IPv6 frame
     if (skb->protocol != htons(ETH_P_IPV6)) return TC_ACT_OK;
@@ -58,10 +75,12 @@
     if (ntohs(ip6->payload_len) > 0xFFFF - sizeof(struct iphdr)) return TC_ACT_OK;
 
     switch (ip6->nexthdr) {
-        case IPPROTO_TCP:  // For TCP & UDP the checksum neutrality of the chosen IPv6
-        case IPPROTO_UDP:  // address means there is no need to update their checksums.
-        case IPPROTO_GRE:  // We do not need to bother looking at GRE/ESP headers,
-        case IPPROTO_ESP:  // since there is never a checksum to update.
+        case IPPROTO_TCP:  // If TCP, must have 20 byte minimal TCP header
+            if (tcp + 1 > (struct tcphdr*)data_end) return TC_ACT_OK;
+            break;
+
+        case IPPROTO_UDP:  // If UDP, must have 8 byte minimal UDP header
+            if (udp + 1 > (struct udphdr*)data_end) return TC_ACT_OK;
             break;
 
         default:  // do not know how to handle anything else
@@ -116,9 +135,8 @@
     // Note that there is no L4 checksum update: we are relying on the checksum neutrality
     // of the ipv6 address chosen by netd's ClatdController.
 
-    // Packet mutations begin - point of no return, but if this first modification fails
-    // the packet is probably still pristine, so let clatd handle it.
-    if (bpf_skb_change_proto(skb, htons(ETH_P_IP), 0)) return TC_ACT_OK;
+    // Packet mutations begin - point of no return.
+    if (bpf_skb_change_proto(skb, htons(ETH_P_IP), 0)) return TC_ACT_SHOT;
 
     // bpf_skb_change_proto() invalidates all pointers - reload them.
     data = (void*)(long)skb->data;
diff --git a/bpf_progs/netd.c b/bpf_progs/netd.c
index 3212314..1362be2 100644
--- a/bpf_progs/netd.c
+++ b/bpf_progs/netd.c
@@ -51,7 +51,9 @@
     // that skb->sk is NULL during RX (early decap socket lookup failure),
     // which commonly happens for incoming packets to an unconnected udp socket.
     // Additionally bpf_get_socket_cookie() returns 0 if skb->sk is NULL
-    if ((sock_uid == 65534) && !bpf_get_socket_cookie(skb) && is_received_skb(skb))
+    if ((sock_uid == 65534) && !bpf_get_socket_cookie(skb) &&
+        (skb->pkt_type == PACKET_HOST || skb->pkt_type == PACKET_BROADCAST ||
+         skb->pkt_type == PACKET_MULTICAST))
         return BPF_MATCH;
 
     UidOwnerValue* whitelistMatch = bpf_uid_owner_map_lookup_elem(&sock_uid);
diff --git a/bpf_progs/netd.h b/bpf_progs/netd.h
index be9aaee..8be21be 100644
--- a/bpf_progs/netd.h
+++ b/bpf_progs/netd.h
@@ -29,7 +29,6 @@
 #include <linux/ipv6.h>
 #include <stdbool.h>
 #include <stdint.h>
-#include "bpf_net_helpers.h"
 #include "netdbpf/bpf_shared.h"
 
 typedef struct {
diff --git a/client/Android.bp b/client/Android.bp
index 7b51322..bb52430 100644
--- a/client/Android.bp
+++ b/client/Android.bp
@@ -21,10 +21,10 @@
     header_libs: [
         "libnetd_client_headers",
         "libbase_headers", // for unique_fd.h
-        "libnetd_resolv_headers",
     ],
     export_header_lib_headers: ["libnetd_client_headers"],
     include_dirs: [
+        "system/netd/resolv",
         "system/netd/libnetdutils/include",
     ],
     defaults: ["netd_defaults"],
@@ -38,10 +38,9 @@
     defaults: ["netd_defaults"],
     test_suites: ["device-tests"],
     include_dirs: [
+        "system/netd/resolv",
         "system/netd/include",
-    ],
-    header_libs: [
-        "libnetd_resolv_headers",
+        "system/netd/libnetdutils/include",
     ],
     static_libs: [
         "libgmock",
diff --git a/client/NetdClient.cpp b/client/NetdClient.cpp
index d5945d0..a7dc0ad 100644
--- a/client/NetdClient.cpp
+++ b/client/NetdClient.cpp
@@ -130,7 +130,7 @@
     const int ret = libcConnect(sockfd, addr, addrlen);
     // Save errno so it isn't clobbered by sending ON_CONNECT_COMPLETE
     const int connectErrno = errno;
-    const auto latencyMs = static_cast<unsigned>(s.timeTakenUs() / 1000);
+    const unsigned latencyMs = lround(s.timeTaken());
     // Send an ON_CONNECT_COMPLETE command that includes sockaddr and connect latency for reporting
     if (shouldSetFwmark) {
         FwmarkConnectInfo connectInfo(ret == 0 ? 0 : connectErrno, latencyMs, addr);
diff --git a/client/NetdClientTest.cpp b/client/NetdClientTest.cpp
index b523ccc..6f2fc09 100644
--- a/client/NetdClientTest.cpp
+++ b/client/NetdClientTest.cpp
@@ -36,10 +36,9 @@
         pollfd fds[1] = {{.fd = dnsProxyFd, .events = POLLIN}};
         enum { SERVERFD = 0 };
 
-        int poll_result = TEMP_FAILURE_RETRY(poll(fds, std::size(fds), -1));
-        ASSERT_GT(poll_result, 0);
+        const int s = TEMP_FAILURE_RETRY(poll(fds, std::size(fds), -1));
+        if (s <= 0) break;
 
-        if (fds[SERVERFD].revents & POLLERR) return;
         if (fds[SERVERFD].revents & POLLIN) {
             char buf[4096];
             TEMP_FAILURE_RETRY(read(fds[SERVERFD].fd, &buf, sizeof(buf)));
diff --git a/include/BinderUtil.h b/include/BinderUtil.h
index 6b41465..9333dcd 100644
--- a/include/BinderUtil.h
+++ b/include/BinderUtil.h
@@ -14,11 +14,8 @@
  * limitations under the License.
  */
 
-#pragma once
-
-#include <android-base/stringprintf.h>
-#include <json/value.h>
-#include <json/writer.h>
+#ifndef NETD_INCLUDE_BINDER_UTIL_H
+#define NETD_INCLUDE_BINDER_UTIL_H
 
 #ifdef ANDROID_BINDER_STATUS_H
 #define IS_BINDER_OK(__ex__) (__ex__ == ::android::binder::Status::EX_NONE)
@@ -107,3 +104,5 @@
             ::android::base::StringPrintf(" <%.2fms>", logTransaction["duration_ms"].asFloat()));
     logFn(output);
 }
+
+#endif /* NETD_INCLUDE_BINDER_UTIL_H */
diff --git a/libnetdbpf/Android.bp b/libnetdbpf/Android.bp
index 574e7c3..b5fefac 100644
--- a/libnetdbpf/Android.bp
+++ b/libnetdbpf/Android.bp
@@ -26,6 +26,7 @@
         "libbpf_android",
         "liblog",
         "libnetdutils",
+        "libutils",
     ],
     export_include_dirs: ["include"],
     defaults: ["netd_defaults"],
diff --git a/libnetdbpf/BpfNetworkStats.cpp b/libnetdbpf/BpfNetworkStats.cpp
index 30b43fa..fe86cc1 100644
--- a/libnetdbpf/BpfNetworkStats.cpp
+++ b/libnetdbpf/BpfNetworkStats.cpp
@@ -191,7 +191,7 @@
         return ret;
     }
 
-    BpfMap<uint32_t, uint8_t> configurationMap(mapRetrieve(CONFIGURATION_MAP_PATH, BPF_OPEN_FLAGS));
+    BpfMap<uint32_t, uint8_t> configurationMap(mapRetrieve(CONFIGURATION_MAP_PATH, 0));
     if (!configurationMap.isValid()) {
         int ret = -errno;
         ALOGE("get configuration map fd failed: %s", strerror(errno));
@@ -241,10 +241,7 @@
             return netdutils::status::ok;
         }
         StatsKey fakeKey = {
-                .uid = (uint32_t)UID_ALL,
-                .tag = (uint32_t)TAG_NONE,
-                .counterSet = (uint32_t)SET_ALL,
-        };
+            .uid = (uint32_t)UID_ALL, .counterSet = (uint32_t)SET_ALL, .tag = (uint32_t)TAG_NONE};
         lines->push_back(populateStatsEntry(fakeKey, value, ifname));
         return netdutils::status::ok;
     };
@@ -324,8 +321,6 @@
 }
 
 stats_line& stats_line::operator=(const stats_line& rhs) {
-    if (this == &rhs) return *this;
-
     strlcpy(iface, rhs.iface, sizeof(iface));
     uid = rhs.uid;
     set = rhs.set;
diff --git a/libnetdbpf/BpfNetworkStatsTest.cpp b/libnetdbpf/BpfNetworkStatsTest.cpp
index 057f2a9..8153127 100644
--- a/libnetdbpf/BpfNetworkStatsTest.cpp
+++ b/libnetdbpf/BpfNetworkStatsTest.cpp
@@ -201,10 +201,10 @@
     SKIP_IF_BPF_NOT_SUPPORTED;
 
     StatsValue value1 = {
-            .rxPackets = 0,
             .rxBytes = 0,
-            .txPackets = 0,
+            .rxPackets = 0,
             .txBytes = 0,
+            .txPackets = 0,
     };
     Stats result1 = {};
     ASSERT_EQ(0, bpfGetUidStatsInternal(TEST_UID1, &result1, mFakeAppUidStatsMap));
@@ -217,17 +217,15 @@
     updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
     updateIfaceMap(IFACE_NAME2, IFACE_INDEX2);
     updateIfaceMap(IFACE_NAME3, IFACE_INDEX3);
-    StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
-            .rxBytes = TEST_BYTES0,
-            .txPackets = TEST_PACKET1,
-            .txBytes = TEST_BYTES1,
-    };
+    StatsValue value1 = {.rxBytes = TEST_BYTES0,
+                         .rxPackets = TEST_PACKET0,
+                         .txBytes = TEST_BYTES1,
+                         .txPackets = TEST_PACKET1,};
     StatsValue value2 = {
-            .rxPackets = TEST_PACKET0 * 2,
-            .rxBytes = TEST_BYTES0 * 2,
-            .txPackets = TEST_PACKET1 * 2,
-            .txBytes = TEST_BYTES1 * 2,
+        .rxBytes = TEST_BYTES0 * 2,
+        .rxPackets = TEST_PACKET0 * 2,
+        .txBytes = TEST_BYTES1 * 2,
+        .txPackets = TEST_PACKET1 * 2,
     };
     ASSERT_TRUE(isOk(mFakeAppUidStatsMap.writeValue(TEST_UID1, value1, BPF_ANY)));
     ASSERT_TRUE(isOk(mFakeAppUidStatsMap.writeValue(TEST_UID2, value2, BPF_ANY)));
@@ -260,16 +258,16 @@
     updateIfaceMap(IFACE_NAME2, IFACE_INDEX2);
     updateIfaceMap(IFACE_NAME3, IFACE_INDEX3);
     StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
-            .rxBytes = TEST_BYTES0,
-            .txPackets = TEST_PACKET1,
-            .txBytes = TEST_BYTES1,
+        .rxBytes = TEST_BYTES0,
+        .rxPackets = TEST_PACKET0,
+        .txBytes = TEST_BYTES1,
+        .txPackets = TEST_PACKET1,
     };
     StatsValue value2 = {
-            .rxPackets = TEST_PACKET1,
-            .rxBytes = TEST_BYTES1,
-            .txPackets = TEST_PACKET0,
-            .txBytes = TEST_BYTES0,
+        .rxBytes = TEST_BYTES1,
+        .rxPackets = TEST_PACKET1,
+        .txBytes = TEST_BYTES0,
+        .txPackets = TEST_PACKET0,
     };
     uint32_t ifaceStatsKey = IFACE_INDEX1;
     EXPECT_TRUE(isOk(mFakeIfaceStatsMap.writeValue(ifaceStatsKey, value1, BPF_ANY)));
@@ -290,10 +288,10 @@
     ASSERT_EQ(0, bpfGetIfaceStatsInternal(NULL, &totalResult, mFakeIfaceStatsMap,
                                           mFakeIfaceIndexNameMap));
     StatsValue totalValue = {
-            .rxPackets = TEST_PACKET0 * 2 + TEST_PACKET1,
-            .rxBytes = TEST_BYTES0 * 2 + TEST_BYTES1,
-            .txPackets = TEST_PACKET1 * 2 + TEST_PACKET0,
-            .txBytes = TEST_BYTES1 * 2 + TEST_BYTES0,
+        .rxBytes = TEST_BYTES0 * 2 + TEST_BYTES1,
+        .rxPackets = TEST_PACKET0 * 2 + TEST_PACKET1,
+        .txBytes = TEST_BYTES1 * 2 + TEST_BYTES0,
+        .txPackets = TEST_PACKET1 * 2 + TEST_PACKET0,
     };
     expectStatsEqual(totalValue, totalResult);
 }
@@ -303,12 +301,10 @@
 
     updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
     updateIfaceMap(IFACE_NAME2, IFACE_INDEX2);
-    StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
-            .rxBytes = TEST_BYTES0,
-            .txPackets = TEST_PACKET1,
-            .txBytes = TEST_BYTES1,
-    };
+    StatsValue value1 = {.rxBytes = TEST_BYTES0,
+                         .rxPackets = TEST_PACKET0,
+                         .txBytes = TEST_BYTES1,
+                         .txPackets = TEST_PACKET1,};
     populateFakeStats(TEST_UID1, TEST_TAG, IFACE_INDEX1, TEST_COUNTERSET0, value1, mFakeStatsMap);
     populateFakeStats(TEST_UID1, TEST_TAG, IFACE_INDEX2, TEST_COUNTERSET0, value1, mFakeStatsMap);
     populateFakeStats(TEST_UID1, TEST_TAG + 1, IFACE_INDEX1, TEST_COUNTERSET0, value1,
@@ -340,12 +336,10 @@
 
     updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
     updateIfaceMap(IFACE_NAME2, IFACE_INDEX2);
-    StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
-            .rxBytes = TEST_BYTES0,
-            .txPackets = TEST_PACKET1,
-            .txBytes = TEST_BYTES1,
-    };
+    StatsValue value1 = {.rxBytes = TEST_BYTES0,
+                         .rxPackets = TEST_PACKET0,
+                         .txBytes = TEST_BYTES1,
+                         .txPackets = TEST_PACKET1,};
     populateFakeStats(0, 0, 0, OVERFLOW_COUNTERSET, value1, mFakeStatsMap);
     populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET0, value1, mFakeStatsMap);
     populateFakeStats(TEST_UID1, 0, IFACE_INDEX2, TEST_COUNTERSET0, value1, mFakeStatsMap);
@@ -376,28 +370,22 @@
     SKIP_IF_BPF_NOT_SUPPORTED;
 
     updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
-    StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
-            .rxBytes = TEST_BYTES0 * 20,
-            .txPackets = TEST_PACKET1,
-            .txBytes = TEST_BYTES1 * 20,
-    };
+    StatsValue value1 = {.rxBytes = TEST_BYTES0 * 20,
+                         .rxPackets = TEST_PACKET0,
+                         .txBytes = TEST_BYTES1 * 20,
+                         .txPackets = TEST_PACKET1,};
     uint32_t ifaceIndex = UNKNOWN_IFACE;
     populateFakeStats(TEST_UID1, 0, ifaceIndex, TEST_COUNTERSET0, value1, mFakeStatsMap);
     populateFakeStats(TEST_UID1, 0, IFACE_INDEX1, TEST_COUNTERSET0, value1, mFakeStatsMap);
-    StatsValue value2 = {
-            .rxPackets = TEST_PACKET0,
-            .rxBytes = TEST_BYTES0 * 40,
-            .txPackets = TEST_PACKET1,
-            .txBytes = TEST_BYTES1 * 40,
-    };
+    StatsValue value2 = {.rxBytes = TEST_BYTES0 * 40,
+                         .rxPackets = TEST_PACKET0,
+                         .txBytes = TEST_BYTES1 * 40,
+                         .txPackets = TEST_PACKET1,};
     populateFakeStats(TEST_UID1, 0, IFACE_INDEX2, TEST_COUNTERSET0, value2, mFakeStatsMap);
-    StatsKey curKey = {
-            .uid = TEST_UID1,
-            .tag = 0,
-            .counterSet = TEST_COUNTERSET0,
-            .ifaceIndex = ifaceIndex,
-    };
+    StatsKey curKey = {.uid = TEST_UID1,
+                       .tag = 0,
+                       .ifaceIndex = ifaceIndex,
+                       .counterSet = TEST_COUNTERSET0};
     char ifname[IFNAMSIZ];
     int64_t unknownIfaceBytesTotal = 0;
     ASSERT_EQ(-ENODEV, getIfaceNameFromMap(mFakeIfaceIndexNameMap, mFakeStatsMap, ifaceIndex,
@@ -424,16 +412,16 @@
     updateIfaceMap(IFACE_NAME3, IFACE_INDEX3);
     updateIfaceMap(LONG_IFACE_NAME, IFACE_INDEX4);
     StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
-            .rxBytes = TEST_BYTES0,
-            .txPackets = TEST_PACKET1,
-            .txBytes = TEST_BYTES1,
+        .rxBytes = TEST_BYTES0,
+        .rxPackets = TEST_PACKET0,
+        .txBytes = TEST_BYTES1,
+        .txPackets = TEST_PACKET1,
     };
     StatsValue value2 = {
-            .rxPackets = TEST_PACKET1,
-            .rxBytes = TEST_BYTES1,
-            .txPackets = TEST_PACKET0,
-            .txBytes = TEST_BYTES0,
+        .rxBytes = TEST_BYTES1,
+        .rxPackets = TEST_PACKET1,
+        .txBytes = TEST_BYTES0,
+        .txPackets = TEST_PACKET0,
     };
     uint32_t ifaceStatsKey = IFACE_INDEX1;
     EXPECT_TRUE(isOk(mFakeIfaceStatsMap.writeValue(ifaceStatsKey, value1, BPF_ANY)));
@@ -464,22 +452,22 @@
     updateIfaceMap(IFACE_NAME1, IFACE_INDEX3);  // Duplicate!
 
     StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
             .rxBytes = TEST_BYTES0,
-            .txPackets = TEST_PACKET1,
+            .rxPackets = TEST_PACKET0,
             .txBytes = TEST_BYTES1,
+            .txPackets = TEST_PACKET1,
     };
     StatsValue value2 = {
-            .rxPackets = TEST_PACKET1,
             .rxBytes = TEST_BYTES1,
-            .txPackets = TEST_PACKET0,
+            .rxPackets = TEST_PACKET1,
             .txBytes = TEST_BYTES0,
+            .txPackets = TEST_PACKET0,
     };
     StatsValue value3 = {
-            .rxPackets = TEST_PACKET0 * 2,
             .rxBytes = TEST_BYTES0 * 2,
-            .txPackets = TEST_PACKET1 * 2,
+            .rxPackets = TEST_PACKET0 * 2,
             .txBytes = TEST_BYTES1 * 2,
+            .txPackets = TEST_PACKET1 * 2,
     };
 
     std::vector<stats_line> lines;
@@ -553,10 +541,10 @@
     updateIfaceMap(IFACE_NAME1, IFACE_INDEX1);
 
     StatsValue value1 = {
-            .rxPackets = TEST_PACKET0,
             .rxBytes = TEST_BYTES0,
-            .txPackets = TEST_PACKET1,
+            .rxPackets = TEST_PACKET0,
             .txBytes = TEST_BYTES1,
+            .txPackets = TEST_PACKET1,
     };
 
     // Mutate uid, 0 < TEST_UID1 < INT_MAX < INT_MIN < UINT_MAX.
diff --git a/libnetdbpf/include/netdbpf/bpf_shared.h b/libnetdbpf/include/netdbpf/bpf_shared.h
index 933172a..66d20ec 100644
--- a/libnetdbpf/include/netdbpf/bpf_shared.h
+++ b/libnetdbpf/include/netdbpf/bpf_shared.h
@@ -87,7 +87,7 @@
     IIF_MATCH = (1 << 5),
 };
 
-enum BpfPermissionMatch {
+enum BpfPemissionMatch {
     BPF_PERMISSION_INTERNET = 1 << 2,
     BPF_PERMISSION_UPDATE_DEVICE_STATS = 1 << 3,
 };
diff --git a/libnetdutils/AndroidTest.xml b/libnetdutils/AndroidTest.xml
new file mode 100644
index 0000000..dc13361
--- /dev/null
+++ b/libnetdutils/AndroidTest.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2018 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for netdutils_test">
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="netdutils_test->/data/local/tmp/netdutils_test" />
+    </target_preparer>
+    <option name="test-suite-tag" value="apct" />
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="netdutils_test" />
+    </test>
+</configuration>
diff --git a/libnetdutils/InternetAddresses.cpp b/libnetdutils/InternetAddresses.cpp
index 78d30b2..944ed91 100644
--- a/libnetdutils/InternetAddresses.cpp
+++ b/libnetdutils/InternetAddresses.cpp
@@ -61,8 +61,9 @@
     };
     addrinfo* res;
     const int ret = getaddrinfo(repr.c_str(), nullptr, &hints, &res);
-    ScopedAddrinfo res_cleanup(res);
+    // TODO: move ScopedAddrinfo into libnetdutils and use it here.
     if (ret != 0) {
+        freeaddrinfo(res);
         return false;
     }
 
@@ -83,6 +84,7 @@
             break;
     }
 
+    freeaddrinfo(res);
     return rval;
 }
 
diff --git a/libnetdutils/ThreadUtilTest.cpp b/libnetdutils/ThreadUtilTest.cpp
index 8fad8b8..2fe63b7 100644
--- a/libnetdutils/ThreadUtilTest.cpp
+++ b/libnetdutils/ThreadUtilTest.cpp
@@ -14,49 +14,22 @@
  * limitations under the License.
  */
 
-#include <string>
-
-#include <android-base/expected.h>
 #include <gtest/gtest.h>
-#include <netdutils/ThreadUtil.h>
 
-namespace android::netdutils {
+#include "netdutils/ThreadUtil.h"
+
+namespace android {
+namespace netdutils {
 
 namespace {
 
-android::base::expected<std::string, int> getThreadName() {
-    char name[16] = {};
-    if (const int ret = pthread_getname_np(pthread_self(), name, sizeof(name)); ret != 0) {
-        return android::base::unexpected(ret);
-    }
-    return std::string(name);
-}
-
 class NoopRun {
   public:
-    explicit NoopRun(const std::string& name = "") : mName(name) { instanceNum++; }
-
-    // Destructor happens in the thread.
-    ~NoopRun() {
-        if (checkName) {
-            auto expected = getThreadName();
-            EXPECT_TRUE(expected.has_value());
-            EXPECT_EQ(mExpectedName, expected.value());
-        }
-        instanceNum--;
-    }
+    NoopRun() { instanceNum++; }
+    ~NoopRun() { instanceNum--; }
 
     void run() {}
 
-    std::string threadName() { return mName; }
-
-    // Set the expected thread name which will be used to check if it matches the actual thread
-    // name which is returned from the system call. The check will happen in the destructor.
-    void setExpectedName(const std::string& expectedName) {
-        checkName = true;
-        mExpectedName = expectedName;
-    }
-
     static bool waitForAllReleased(int timeoutMs) {
         constexpr int intervalMs = 20;
         int limit = timeoutMs / intervalMs;
@@ -71,11 +44,6 @@
 
     // To track how many instances are alive.
     static std::atomic<int> instanceNum;
-
-  private:
-    std::string mName;
-    std::string mExpectedName;
-    bool checkName = false;
 };
 
 std::atomic<int> NoopRun::instanceNum;
@@ -93,30 +61,5 @@
     EXPECT_EQ(0, NoopRun::instanceNum);
 }
 
-TEST(ThreadUtilTest, SetThreadName) {
-    NoopRun::instanceNum = 0;
-
-    // Test thread name empty.
-    NoopRun* obj1 = new NoopRun();
-    obj1->setExpectedName("");
-
-    // Test normal case.
-    NoopRun* obj2 = new NoopRun("TestName");
-    obj2->setExpectedName("TestName");
-
-    // Test thread name too long.
-    std::string name("TestNameTooooLong");
-    NoopRun* obj3 = new NoopRun(name);
-    obj3->setExpectedName(name.substr(0, 15));
-
-    // Thread names are examined in their destructors.
-    EXPECT_EQ(3, NoopRun::instanceNum);
-    threadLaunch(obj1);
-    threadLaunch(obj2);
-    threadLaunch(obj3);
-
-    EXPECT_TRUE(NoopRun::waitForAllReleased(1000));
-    EXPECT_EQ(0, NoopRun::instanceNum);
-}
-
-}  // namespace android::netdutils
+}  // namespace netdutils
+}  // namespace android
diff --git a/libnetdutils/include/netdutils/InternetAddresses.h b/libnetdutils/include/netdutils/InternetAddresses.h
index e817b78..07a6e90 100644
--- a/libnetdutils/include/netdutils/InternetAddresses.h
+++ b/libnetdutils/include/netdutils/InternetAddresses.h
@@ -14,9 +14,9 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETDUTILS_INTERNETADDRESSES_H_
+#define NETDUTILS_INTERNETADDRESSES_H_
 
-#include <netdb.h>
 #include <netinet/in.h>
 #include <stdint.h>
 #include <cstring>
@@ -104,16 +104,6 @@
 
 }  // namespace internal_
 
-struct AddrinfoDeleter {
-    void operator()(struct addrinfo* p) const {
-        if (p != nullptr) {
-            freeaddrinfo(p);
-        }
-    }
-};
-
-typedef std::unique_ptr<struct addrinfo, struct AddrinfoDeleter> ScopedAddrinfo;
-
 inline bool usesScopedIds(const in6_addr& ipv6) {
     return (IN6_IS_ADDR_LINKLOCAL(&ipv6) || IN6_IS_ADDR_MC_LINKLOCAL(&ipv6));
 }
@@ -242,23 +232,6 @@
   public:
     // TODO: static forString
 
-    static IPSockAddr toIPSockAddr(const std::string& repr, in_port_t port) {
-        return IPSockAddr(IPAddress::forString(repr), port);
-    }
-    static IPSockAddr toIPSockAddr(const sockaddr& sa) {
-        switch (sa.sa_family) {
-            case AF_INET:
-                return IPSockAddr(*reinterpret_cast<const sockaddr_in*>(&sa));
-            case AF_INET6:
-                return IPSockAddr(*reinterpret_cast<const sockaddr_in6*>(&sa));
-            default:
-                return IPSockAddr();
-        }
-    }
-    static IPSockAddr toIPSockAddr(const sockaddr_storage& ss) {
-        return toIPSockAddr(*reinterpret_cast<const sockaddr*>(&ss));
-    }
-
     IPSockAddr() = default;
     IPSockAddr(const IPSockAddr&) = default;
     IPSockAddr(IPSockAddr&&) = default;
@@ -318,3 +291,5 @@
 
 }  // namespace netdutils
 }  // namespace android
+
+#endif  // NETDUTILS_INTERNETADDRESSES_H_
diff --git a/libnetdutils/include/netdutils/NetworkConstants.h b/libnetdutils/include/netdutils/NetworkConstants.h
index dead9a1..682ceaf 100644
--- a/libnetdutils/include/netdutils/NetworkConstants.h
+++ b/libnetdutils/include/netdutils/NetworkConstants.h
@@ -14,7 +14,8 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETDUTILS_NETWORKCONSTANTS_H_
+#define NETDUTILS_NETWORKCONSTANTS_H_
 
 namespace android {
 namespace netdutils {
@@ -25,8 +26,7 @@
 constexpr int IPV6_ADDR_LEN = 16;
 constexpr int IPV6_ADDR_BITS = 128;
 
-// Referred from SHA256_DIGEST_LENGTH in boringssl
-constexpr size_t SHA256_SIZE = 32;
-
 }  // namespace netdutils
 }  // namespace android
+
+#endif  // NETDUTILS_NETWORKCONSTANTS_H_
diff --git a/libnetdutils/include/netdutils/Stopwatch.h b/libnetdutils/include/netdutils/Stopwatch.h
index e7b4326..18e2050 100644
--- a/libnetdutils/include/netdutils/Stopwatch.h
+++ b/libnetdutils/include/netdutils/Stopwatch.h
@@ -29,12 +29,22 @@
 
   public:
     Stopwatch() : mStart(clock::now()) {}
+
     virtual ~Stopwatch() = default;
 
+    float timeTaken() const { return getElapsed(clock::now()); }
+
     int64_t timeTakenUs() const { return getElapsedUs(clock::now()); }
-    int64_t getTimeAndResetUs() {
+
+    float getTimeAndReset() {
         const auto& now = clock::now();
-        int64_t elapsed = getElapsedUs(now);
+        float elapsed = getElapsed(now);
+        mStart = now;
+        return elapsed;
+    }
+    float getTimeAndResetUs() {
+        const auto& now = clock::now();
+        float elapsed = getElapsedUs(now);
         mStart = now;
         return elapsed;
     }
@@ -42,6 +52,10 @@
   private:
     time_point mStart;
 
+    float getElapsed(const time_point& now) const {
+        using ms = std::chrono::duration<float, std::ratio<1, 1000>>;
+        return (std::chrono::duration_cast<ms>(now - mStart)).count();
+    }
     int64_t getElapsedUs(const time_point& now) const {
         return (std::chrono::duration_cast<std::chrono::microseconds>(now - mStart)).count();
     }
diff --git a/libnetdutils/include/netdutils/ThreadUtil.h b/libnetdutils/include/netdutils/ThreadUtil.h
index 62e6f70..2ef97ef 100644
--- a/libnetdutils/include/netdutils/ThreadUtil.h
+++ b/libnetdutils/include/netdutils/ThreadUtil.h
@@ -34,22 +34,9 @@
     pthread_attr_t attr;
 };
 
-inline void setThreadName(std::string name) {
-    // MAX_TASK_COMM_LEN=16 is not exported by bionic.
-    const size_t MAX_TASK_COMM_LEN = 16;
-
-    // Crop name to 16 bytes including the NUL byte, as required by pthread_setname_np()
-    if (name.size() >= MAX_TASK_COMM_LEN) name.resize(MAX_TASK_COMM_LEN - 1);
-
-    if (int ret = pthread_setname_np(pthread_self(), name.c_str()); ret != 0) {
-        LOG(WARNING) << "Unable to set thread name to " << name << ": " << strerror(ret);
-    }
-}
-
 template <typename T>
 inline void* runAndDelete(void* obj) {
     std::unique_ptr<T> handler(reinterpret_cast<T*>(obj));
-    setThreadName(handler->threadName().c_str());
     handler->run();
     return nullptr;
 }
diff --git a/resolv/Android.bp b/resolv/Android.bp
new file mode 100644
index 0000000..d1bf2e1
--- /dev/null
+++ b/resolv/Android.bp
@@ -0,0 +1,223 @@
+cc_library_headers {
+    name: "libnetd_resolv_headers",
+    export_include_dirs: ["include"],
+}
+
+aidl_interface {
+    name: "dnsresolver_aidl_interface",
+    local_include_dir: "binder",
+    srcs: [
+        "binder/android/net/IDnsResolver.aidl",
+        "binder/android/net/ResolverParamsParcel.aidl",
+    ],
+    imports: [
+        "netd_event_listener_interface",
+    ],
+    backend: {
+        ndk: {
+            gen_log: true,
+        },
+    },
+    api_dir: "aidl/dnsresolver",
+    versions: [
+        "1",
+        "2",
+    ],
+}
+
+cc_test_library {
+    name: "libnetd_test_metrics_listener",
+    defaults: ["netd_defaults"],
+    srcs: [
+        "tests/BaseTestMetricsListener.cpp",
+        "tests/TestMetrics.cpp",
+    ],
+    include_dirs: [
+        "system/netd/include",
+    ],
+    shared_libs: [
+        "libbinder",
+        "libutils",
+        "netd_event_listener_interface-V1-cpp",
+    ],
+}
+
+cc_library {
+    name: "libnetd_resolv",
+    version_script: "libnetd_resolv.map.txt",
+    defaults: ["netd_defaults"],
+    srcs: [
+        "getaddrinfo.cpp",
+        "gethnamaddr.cpp",
+        "sethostent.cpp",
+        "res_cache.cpp",
+        "res_comp.cpp",
+        "res_debug.cpp",
+        "res_init.cpp",
+        "res_mkquery.cpp",
+        "res_query.cpp",
+        "res_send.cpp",
+        "res_state.cpp",
+        "res_stats.cpp",
+        "Dns64Configuration.cpp",
+        "DnsProxyListener.cpp",
+        "DnsResolver.cpp",
+        "DnsResolverService.cpp",
+        "DnsTlsDispatcher.cpp",
+        "DnsTlsQueryMap.cpp",
+        "DnsTlsTransport.cpp",
+        "DnsTlsServer.cpp",
+        "DnsTlsSessionCache.cpp",
+        "DnsTlsSocket.cpp",
+        "PrivateDnsConfiguration.cpp",
+        "ResolverController.cpp",
+        "ResolverEventReporter.cpp",
+    ],
+    // Link everything statically (except for libc) to minimize our dependence
+    // on system ABIs
+    stl: "libc++_static",
+    static_libs: [
+        "libbase",
+        "libcrypto",
+        "libcutils",
+        "libjsoncpp",
+        "liblog",
+        "libnetdutils",
+        "libssl",
+        "libstatslog_resolv",
+        "libstatssocket",
+        "libsysutils",
+        "libutils",
+        "netd_event_listener_interface-ndk_platform",
+        "dnsresolver_aidl_interface-ndk_platform",
+        "server_configurable_flags",
+        "stats_proto",
+        "libprotobuf-cpp-lite",
+    ],
+    shared_libs: [
+        "libbinder_ndk",
+    ],
+    include_dirs: [
+        "system/netd/include",
+        "system/netd/server",
+    ],
+    export_include_dirs: ["include"],
+    // TODO: pie in the sky: make this code clang-tidy clean
+    tidy: false,
+    product_variables: {
+        debuggable: {
+            cppflags: [
+                "-DRESOLV_ALLOW_VERBOSE_LOGGING=1",
+            ],
+        },
+    },
+}
+
+cc_library_static {
+    name: "stats_proto",
+    defaults: ["netd_defaults"],
+    proto: {
+        export_proto_headers: true,
+        type: "lite",
+    },
+    srcs: [
+        "stats.proto",
+    ],
+}
+
+genrule {
+    name: "statslog_resolv.h",
+    tools: ["stats-log-api-gen"],
+    cmd: "$(location stats-log-api-gen) --header $(genDir)/statslog_resolv.h --module resolv --namespace android,net,stats",
+    out: [
+        "statslog_resolv.h",
+    ],
+}
+
+genrule {
+    name: "statslog_resolv.cpp",
+    tools: ["stats-log-api-gen"],
+    cmd: "$(location stats-log-api-gen) --cpp $(genDir)/statslog_resolv.cpp --module resolv --namespace android,net,stats --importHeader statslog_resolv.h",
+    out: [
+        "statslog_resolv.cpp",
+    ],
+}
+
+cc_library_static {
+    name: "libstatslog_resolv",
+    generated_sources: ["statslog_resolv.cpp"],
+    generated_headers: ["statslog_resolv.h"],
+    defaults: ["netd_defaults"],
+    export_generated_headers: ["statslog_resolv.h"],
+    static_libs: [
+        "libcutils",
+        "liblog",
+        "libstatssocket",
+        "libutils",
+    ],
+}
+
+cc_test {
+    name: "resolv_integration_test",
+    test_suites: ["device-tests"],
+    require_root: true,
+    defaults: ["netd_defaults"],
+    srcs: [
+        "dns_responder/dns_responder.cpp",
+        "resolver_test.cpp",
+        "dnsresolver_binder_test.cpp",
+    ],
+    include_dirs: [
+        "system/netd/resolv/include",
+        "system/netd/server",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder",
+        "libcrypto",
+        "liblog",
+        "libnetd_client",
+        "libssl",
+        "libutils",
+    ],
+    static_libs: [
+        "libgmock",
+        "libnetd_test_dnsresponder",
+        "libnetd_test_metrics_listener",
+        "libnetd_test_tun_interface",
+        "liblogwrap",
+        "libnetdutils",
+        "netd_aidl_interface-V2-cpp",
+        "netd_event_listener_interface-V1-cpp",
+        "dnsresolver_aidl_interface-V2-cpp",
+    ],
+    tidy: false,
+    compile_multilib: "both",
+}
+
+cc_test {
+    name: "resolv_unit_test",
+    test_suites: ["device-tests"],
+    defaults: ["netd_defaults"],
+    srcs: [
+        "dns_tls_test.cpp",
+        "libnetd_resolv_test.cpp",
+        "res_cache_test.cpp",
+    ],
+    shared_libs: [
+        "libbase",
+        "libcrypto",
+        "libcutils",
+        "liblog",
+        "libssl",
+    ],
+    static_libs: [
+        "libgmock",
+        "libnetd_resolv",
+        "libnetd_test_dnsresponder",
+        "libnetdutils",
+        "libprotobuf-cpp-lite",
+        "server_configurable_flags",
+        "stats_proto",
+    ],
+}
diff --git a/resolv/AndroidTest.xml b/resolv/AndroidTest.xml
new file mode 100644
index 0000000..f5715c9
--- /dev/null
+++ b/resolv/AndroidTest.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<!-- This test config file is auto-generated. -->
+<configuration description="Config for resolv_integration_test.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-native" />
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="resolv_integration_test->/data/local/tmp/resolv_integration_test" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="resolv_integration_test" />
+        <!--
+            On 2018-12-12, GetAddrInfoStressTest_Binder_100 suddenly jumped
+            from ~1xs to ~70s runtime in APCT continuous integration, causing
+            resolv_integration_test to flake with the default 60s timeout.
+            We're not sure what caused the regression, but it's not due to a change
+            in the Android image and unlikely to affect users.
+            Just bump the timeout to 120s for now.
+        -->
+        <option name="native-test-timeout" value="120000" />
+    </test>
+</configuration>
diff --git a/resolv/Dns64Configuration.cpp b/resolv/Dns64Configuration.cpp
new file mode 100644
index 0000000..a1dfdca
--- /dev/null
+++ b/resolv/Dns64Configuration.cpp
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "Dns64Configuration"
+#define DBG 0
+
+#include "Dns64Configuration.h"
+
+#include <log/log.h>
+#include <netdb.h>
+#include <thread>
+#include <utility>
+
+#include <arpa/inet.h>
+
+#include "DnsResolver.h"
+#include "NetdConstants.h"  // ScopedAddrinfo
+#include "getaddrinfo.h"
+#include "netd_resolv/resolv.h"
+#include "netdutils/BackoffSequence.h"
+#include "netdutils/DumpWriter.h"
+#include "netid_client.h"
+#include "stats.pb.h"
+
+namespace android {
+
+using android::net::NetworkDnsEventReported;
+using netdutils::DumpWriter;
+using netdutils::IPAddress;
+using netdutils::IPPrefix;
+
+namespace net {
+
+const char Dns64Configuration::kIPv4OnlyHost[] = "ipv4only.arpa.";
+const char Dns64Configuration::kIPv4Literal1[] = "192.0.0.170";
+const char Dns64Configuration::kIPv4Literal2[] = "192.0.0.171";
+
+void Dns64Configuration::startPrefixDiscovery(unsigned netId) {
+    std::lock_guard guard(mMutex);
+
+    // TODO: Keep previous prefix for a while
+    // Currently, we remove current prefix, if any, before starting a prefix discovery.
+    // This causes that Netd and framework temporarily forgets DNS64 prefix even the prefix may be
+    // discovered in a short time.
+    removeDns64Config(netId);
+
+    Dns64Config cfg(getNextId(), netId);
+    // Emplace a copy of |cfg| in the map.
+    mDns64Configs.emplace(std::make_pair(netId, cfg));
+
+    // Note that capturing |cfg| in this lambda creates a copy.
+    std::thread discovery_thread([this, cfg] {
+        // Make a mutable copy rather than mark the whole lambda mutable.
+        // No particular reason.
+        Dns64Config evalCfg(cfg);
+
+        auto backoff = netdutils::BackoffSequence<>::Builder()
+                               .withInitialRetransmissionTime(std::chrono::seconds(1))
+                               .withMaximumRetransmissionTime(std::chrono::seconds(3600))
+                               .build();
+
+        while (true) {
+            if (!this->shouldContinueDiscovery(evalCfg)) break;
+
+            android_net_context netcontext{};
+            mGetNetworkContextCallback(evalCfg.netId, 0, &netcontext);
+
+            // Prefix discovery must bypass private DNS because in strict mode
+            // the server generally won't know the NAT64 prefix.
+            netcontext.flags |= NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS;
+            if (doRfc7050PrefixDiscovery(netcontext, &evalCfg)) {
+                this->recordDns64Config(evalCfg);
+                break;
+            }
+
+            if (!this->shouldContinueDiscovery(evalCfg)) break;
+
+            if (!backoff.hasNextTimeout()) break;
+            {
+                std::unique_lock<std::mutex> cvGuard(mMutex);
+                // TODO: Consider some chrono math, combined with wait_until()
+                // perhaps, to prevent early re-resolves from the removal of
+                // other netids with IPv6-only nameservers.
+                mCv.wait_for(cvGuard, backoff.getNextTimeout());
+            }
+        }
+    });
+    discovery_thread.detach();
+}
+
+void Dns64Configuration::stopPrefixDiscovery(unsigned netId) {
+    std::lock_guard guard(mMutex);
+    removeDns64Config(netId);
+    mCv.notify_all();
+}
+
+IPPrefix Dns64Configuration::getPrefix64Locked(unsigned netId) const REQUIRES(mMutex) {
+    const auto& iter = mDns64Configs.find(netId);
+    if (iter != mDns64Configs.end()) return iter->second.prefix64;
+
+    return IPPrefix{};
+}
+
+IPPrefix Dns64Configuration::getPrefix64(unsigned netId) const {
+    std::lock_guard guard(mMutex);
+    return getPrefix64Locked(netId);
+}
+
+void Dns64Configuration::dump(DumpWriter& dw, unsigned netId) {
+    static const char kLabel[] = "DNS64 config";
+
+    std::lock_guard guard(mMutex);
+
+    const auto& iter = mDns64Configs.find(netId);
+    if (iter == mDns64Configs.end()) {
+        dw.println("%s: none", kLabel);
+        return;
+    }
+
+    const Dns64Config& cfg = iter->second;
+    if (cfg.prefix64.length() == 0) {
+        dw.println("%s: no prefix yet discovered", kLabel);
+    } else {
+        dw.println("%s: discovered prefix %s", kLabel, cfg.prefix64.toString().c_str());
+    }
+}
+
+// NOTE: The full RFC 7050 DNS64 discovery process is not implemented here.
+// Instead, and more simplistic version of the same thing is done, and it
+// currently assumes the DNS64 prefix is a /96.
+bool Dns64Configuration::doRfc7050PrefixDiscovery(const android_net_context& netcontext,
+                                                  Dns64Config* cfg) {
+    ALOGW("(%u, %u) Detecting NAT64 prefix from DNS...", cfg->netId, cfg->discoveryId);
+
+    const struct addrinfo hints = {
+            .ai_family = AF_INET6,
+    };
+
+    // TODO: Refactor so that netd can get all the regular getaddrinfo handling
+    // that regular apps get. We bypass the UNIX socket connection back to
+    // ourselves, which means we also bypass all the special netcontext flag
+    // handling and the resolver event logging.
+    struct addrinfo* res = nullptr;
+    NetworkDnsEventReported event;
+    const int status = android_getaddrinfofornetcontext(kIPv4OnlyHost, nullptr, &hints, &netcontext,
+                                                        &res, &event);
+    ScopedAddrinfo result(res);
+    if (status != 0) {
+        ALOGW("(%u, %u) plat_prefix/dns(%s) status = %d/%s", cfg->netId, cfg->discoveryId,
+              kIPv4OnlyHost, status, gai_strerror(status));
+        return false;
+    }
+
+    // Use only the first result.  If other records are present, possibly
+    // with differing DNS64 prefixes they are ignored. Note that this is a
+    // violation of https://tools.ietf.org/html/rfc7050#section-3
+    //
+    //     "A node MUST look through all of the received AAAA resource records
+    //      to collect one or more Pref64::/n."
+    //
+    // TODO: Consider remedying this.
+    if (result->ai_family != AF_INET6) {
+        ALOGW("(%u, %u) plat_prefix/unexpected address family: %d", cfg->netId, cfg->discoveryId,
+              result->ai_family);
+        return false;
+    }
+    const IPAddress ipv6(reinterpret_cast<sockaddr_in6*>(result->ai_addr)->sin6_addr);
+    // Only /96 DNS64 prefixes are supported at this time.
+    cfg->prefix64 = IPPrefix(ipv6, 96);
+
+    ALOGW("(%u, %u) Detected NAT64 prefix %s", cfg->netId, cfg->discoveryId,
+          cfg->prefix64.toString().c_str());
+
+    return true;
+}
+
+bool Dns64Configuration::isDiscoveryInProgress(const Dns64Config& cfg) const REQUIRES(mMutex) {
+    const auto& iter = mDns64Configs.find(cfg.netId);
+    if (iter == mDns64Configs.end()) return false;
+
+    const Dns64Config& currentCfg = iter->second;
+    return (currentCfg.discoveryId == cfg.discoveryId);
+}
+
+bool Dns64Configuration::reportNat64PrefixStatus(unsigned netId, bool added, const IPPrefix& pfx) {
+    if (pfx.ip().family() != AF_INET6 || pfx.ip().scope_id() != 0) {
+        ALOGW("Abort to send NAT64 prefix notification. Unexpected NAT64 prefix (%u, %d, %s).",
+              netId, added, pfx.toString().c_str());
+        return false;
+    }
+    Nat64PrefixInfo args = {netId, added, pfx.ip().toString(), (uint8_t)pfx.length()};
+    mPrefixCallback(args);
+    return true;
+}
+
+bool Dns64Configuration::shouldContinueDiscovery(const Dns64Config& cfg) {
+    std::lock_guard guard(mMutex);
+    return isDiscoveryInProgress(cfg);
+}
+
+void Dns64Configuration::removeDns64Config(unsigned netId) REQUIRES(mMutex) {
+    IPPrefix prefix = getPrefix64Locked(netId);
+    mDns64Configs.erase(netId);
+    if (!prefix.isUninitialized()) {
+        reportNat64PrefixStatus(netId, PREFIX_REMOVED, prefix);
+    }
+}
+
+void Dns64Configuration::recordDns64Config(const Dns64Config& cfg) {
+    std::lock_guard guard(mMutex);
+    if (!isDiscoveryInProgress(cfg)) return;
+
+    removeDns64Config(cfg.netId);
+    mDns64Configs.emplace(std::make_pair(cfg.netId, cfg));
+
+    reportNat64PrefixStatus(cfg.netId, PREFIX_ADDED, cfg.prefix64);
+
+    // TODO: consider extending INetdEventListener to report the DNS64 prefix
+    // up to ConnectivityService to potentially include this in LinkProperties.
+}
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/Dns64Configuration.h b/resolv/Dns64Configuration.h
new file mode 100644
index 0000000..58b115e
--- /dev/null
+++ b/resolv/Dns64Configuration.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef DNS_DNS64CONFIGURATION_H_
+#define DNS_DNS64CONFIGURATION_H_
+
+#include <netinet/in.h>
+#include <condition_variable>
+#include <cstdlib>
+#include <mutex>
+#include <unordered_map>
+
+#include <android-base/thread_annotations.h>
+#include "netdutils/DumpWriter.h"
+#include "netdutils/InternetAddresses.h"
+
+struct android_net_context;
+
+namespace android {
+namespace net {
+
+/**
+ * This class handles RFC 7050 -style DNS64 prefix discovery.
+ *
+ * The ResolverController starts DNS64 prefix discovery when it observes a
+ * a network with only IPv6 nameservers. (It stops discovery whenever an IPv4
+ * nameserver is added or the network is deleted.)
+ *
+ * Each time prefix discovery is started, a new discoveryId is generated so
+ * that running resolution threads can notice they are no longer the most
+ * recent resolution attempt. This results in the backoff schedule of resolution
+ * being reset.
+ *
+ * Thread-safety: All public methods in this class MUST be thread-safe.
+ * (In other words: this class handles all its locking privately.)
+ */
+class Dns64Configuration {
+  public:
+    // Simple data struct for passing back packet NAT64 prefix event information to the
+    // Dns64PrefixCallback callback.
+    struct Nat64PrefixInfo {
+        unsigned netId;
+        bool added;
+        std::string prefixString;
+        uint8_t prefixLength;
+    };
+
+    // Callback that is triggered for every NAT64 prefix event.
+    using Nat64PrefixCallback = std::function<void(const Nat64PrefixInfo&)>;
+
+    using GetNetworkContextCallback = std::function<void(uint32_t, uint32_t, android_net_context*)>;
+
+    // Parameters from RFC 7050 section 8.
+    static const char kIPv4OnlyHost[];  // "ipv4only.arpa."
+    static const char kIPv4Literal1[];  // 192.0.0.170
+    static const char kIPv4Literal2[];  // 192.0.0.171
+
+    Dns64Configuration() = delete;
+    Dns64Configuration(GetNetworkContextCallback getNetworkCallback,
+                       Nat64PrefixCallback prefixCallback)
+        : mGetNetworkContextCallback(std::move(getNetworkCallback)),
+          mPrefixCallback(std::move(prefixCallback)) {}
+    Dns64Configuration(const Dns64Configuration&) = delete;
+    Dns64Configuration(Dns64Configuration&&) = delete;
+    Dns64Configuration& operator=(const Dns64Configuration&) = delete;
+    Dns64Configuration& operator=(Dns64Configuration&&) = delete;
+
+    void startPrefixDiscovery(unsigned netId);
+    void stopPrefixDiscovery(unsigned netId);
+    netdutils::IPPrefix getPrefix64(unsigned netId) const;
+
+    void dump(netdutils::DumpWriter& dw, unsigned netId);
+
+  private:
+    struct Dns64Config {
+        Dns64Config(unsigned pseudoRandomId, unsigned network)
+            : discoveryId(pseudoRandomId), netId(network) {}
+
+        const unsigned int discoveryId;
+        const unsigned int netId;
+        netdutils::IPPrefix prefix64{};
+    };
+
+    enum { PREFIX_REMOVED, PREFIX_ADDED };
+
+    static bool doRfc7050PrefixDiscovery(const android_net_context& netcontext, Dns64Config* cfg);
+
+    unsigned getNextId() REQUIRES(mMutex) { return mNextId++; }
+    netdutils::IPPrefix getPrefix64Locked(unsigned netId) const REQUIRES(mMutex);
+    bool isDiscoveryInProgress(const Dns64Config& cfg) const REQUIRES(mMutex);
+    bool reportNat64PrefixStatus(unsigned netId, bool added, const netdutils::IPPrefix& pfx)
+            REQUIRES(mMutex);
+
+    bool shouldContinueDiscovery(const Dns64Config& cfg);
+    void recordDns64Config(const Dns64Config& cfg);
+    void removeDns64Config(unsigned netId) REQUIRES(mMutex);
+
+    mutable std::mutex mMutex;
+    std::condition_variable mCv;
+    unsigned int mNextId GUARDED_BY(mMutex);
+    std::unordered_map<unsigned, Dns64Config> mDns64Configs GUARDED_BY(mMutex);
+    const GetNetworkContextCallback mGetNetworkContextCallback;
+    const Nat64PrefixCallback mPrefixCallback;
+};
+
+}  // namespace net
+}  // namespace android
+
+#endif  // DNS_DNS64CONFIGURATION_H_
diff --git a/resolv/DnsProxyListener.cpp b/resolv/DnsProxyListener.cpp
new file mode 100644
index 0000000..8925bc4
--- /dev/null
+++ b/resolv/DnsProxyListener.cpp
@@ -0,0 +1,1259 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "DnsProxyListener.h"
+
+#include <arpa/inet.h>
+#include <dirent.h>
+#include <errno.h>
+#include <linux/if.h>
+#include <math.h>
+#include <net/if.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+
+#define LOG_TAG "DnsProxyListener"
+
+#include <algorithm>
+#include <vector>
+
+#include <android-base/stringprintf.h>
+#include <android/multinetwork.h>  // ResNsendFlags
+#include <cutils/misc.h>           // FIRST_APPLICATION_UID
+#include <netdutils/InternetAddresses.h>
+#include <netdutils/OperationLimiter.h>
+#include <netdutils/ResponseCode.h>
+#include <netdutils/Slice.h>
+#include <netdutils/Stopwatch.h>
+#include <netdutils/ThreadUtil.h>
+#include <private/android_filesystem_config.h>  // AID_SYSTEM
+#include <statslog_resolv.h>
+#include <sysutils/SocketClient.h>
+
+#include "DnsResolver.h"
+#include "NetdClient.h"  // NETID_USE_LOCAL_NAMESERVERS
+#include "NetdPermissions.h"
+#include "PrivateDnsConfiguration.h"
+#include "ResolverEventReporter.h"
+#include "getaddrinfo.h"
+#include "gethnamaddr.h"
+#include "netd_resolv/stats.h"  // RCODE_TIMEOUT
+#include "res_send.h"
+#include "resolv_cache.h"
+#include "resolv_private.h"
+#include "stats.pb.h"
+
+using aidl::android::net::metrics::INetdEventListener;
+using android::net::NetworkDnsEventReported;
+
+namespace android {
+
+using netdutils::ResponseCode;
+using netdutils::Stopwatch;
+
+namespace net {
+namespace {
+
+// Limits the number of outstanding DNS queries by client UID.
+constexpr int MAX_QUERIES_PER_UID = 256;
+
+// Max packet size for answer, sync with getaddrinfo.c
+constexpr int MAXPACKET = 8 * 1024;
+
+android::netdutils::OperationLimiter<uid_t> queryLimiter(MAX_QUERIES_PER_UID);
+
+void logArguments(int argc, char** argv) {
+    if (!WOULD_LOG(VERBOSE)) return;
+    for (int i = 0; i < argc; i++) {
+        LOG(VERBOSE) << __func__ << ": argv[" << i << "]=" << (argv[i] ? argv[i] : "null");
+    }
+}
+
+template<typename T>
+void tryThreadOrError(SocketClient* cli, T* handler) {
+    cli->incRef();
+
+    const int rval = netdutils::threadLaunch(handler);
+    if (rval == 0) {
+        // SocketClient decRef() happens in the handler's run() method.
+        return;
+    }
+
+    char* msg = nullptr;
+    asprintf(&msg, "%s (%d)", strerror(-rval), -rval);
+    cli->sendMsg(ResponseCode::OperationFailed, msg, false);
+    free(msg);
+
+    delete handler;
+    cli->decRef();
+}
+
+bool checkAndClearUseLocalNameserversFlag(unsigned* netid) {
+    if (netid == nullptr || ((*netid) & NETID_USE_LOCAL_NAMESERVERS) == 0) {
+        return false;
+    }
+    *netid = (*netid) & ~NETID_USE_LOCAL_NAMESERVERS;
+    return true;
+}
+
+constexpr bool requestingUseLocalNameservers(unsigned flags) {
+    return (flags & NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS) != 0;
+}
+
+inline bool queryingViaTls(unsigned dns_netid) {
+    // TODO: The simpler PrivateDnsStatus should suffice here.
+    ExternalPrivateDnsStatus privateDnsStatus = {PrivateDnsMode::OFF, 0, {}};
+    gPrivateDnsConfiguration.getStatus(dns_netid, &privateDnsStatus);
+    switch (static_cast<PrivateDnsMode>(privateDnsStatus.mode)) {
+        case PrivateDnsMode::OPPORTUNISTIC:
+            for (int i = 0; i < privateDnsStatus.numServers; i++) {
+                if (privateDnsStatus.serverStatus[i].validation == Validation::success) {
+                    return true;
+                }
+            }
+            return false;
+        case PrivateDnsMode::STRICT:
+            return true;
+        default:
+            return false;
+    }
+}
+
+bool hasPermissionToBypassPrivateDns(uid_t uid) {
+    static_assert(AID_SYSTEM >= 0 && AID_SYSTEM < FIRST_APPLICATION_UID,
+        "Calls from AID_SYSTEM must not result in a permission check to avoid deadlock.");
+    if (uid >= 0 && uid < FIRST_APPLICATION_UID) {
+        return true;
+    }
+
+    for (const char* const permission :
+         {PERM_CONNECTIVITY_USE_RESTRICTED_NETWORKS, PERM_NETWORK_BYPASS_PRIVATE_DNS,
+          PERM_MAINLINE_NETWORK_STACK}) {
+        if (gResNetdCallbacks.check_calling_permission(permission)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+void maybeFixupNetContext(android_net_context* ctx) {
+    if (requestingUseLocalNameservers(ctx->flags) && !hasPermissionToBypassPrivateDns(ctx->uid)) {
+        // Not permitted; clear the flag.
+        ctx->flags &= ~NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS;
+    }
+
+    if (!requestingUseLocalNameservers(ctx->flags)) {
+        // If we're not explicitly bypassing DNS-over-TLS servers, check whether
+        // DNS-over-TLS is in use as an indicator for when to use more modern
+        // DNS resolution mechanics.
+        if (queryingViaTls(ctx->dns_netid)) {
+            ctx->flags |= NET_CONTEXT_FLAG_USE_EDNS;
+        }
+    }
+}
+
+void addIpAddrWithinLimit(std::vector<std::string>* ip_addrs, const sockaddr* addr,
+                          socklen_t addrlen);
+
+int extractResNsendAnswers(const uint8_t* answer, size_t anslen, int ipType,
+                           std::vector<std::string>* ip_addrs) {
+    int total_ip_addr_count = 0;
+    ns_msg handle;
+    if (ns_initparse((const uint8_t*) answer, anslen, &handle) < 0) {
+        return 0;
+    }
+    int ancount = ns_msg_count(handle, ns_s_an);
+    ns_rr rr;
+    for (int i = 0; i < ancount; i++) {
+        if (ns_parserr(&handle, ns_s_an, i, &rr) < 0) {
+            continue;
+        }
+        const uint8_t* rdata = ns_rr_rdata(rr);
+        if (ipType == ns_t_a) {
+            sockaddr_in sin = {.sin_family = AF_INET};
+            memcpy(&sin.sin_addr, rdata, sizeof(sin.sin_addr));
+            addIpAddrWithinLimit(ip_addrs, (sockaddr*) &sin, sizeof(sin));
+            total_ip_addr_count++;
+        } else if (ipType == ns_t_aaaa) {
+            sockaddr_in6 sin6 = {.sin6_family = AF_INET6};
+            memcpy(&sin6.sin6_addr, rdata, sizeof(sin6.sin6_addr));
+            addIpAddrWithinLimit(ip_addrs, (sockaddr*) &sin6, sizeof(sin6));
+            total_ip_addr_count++;
+        }
+    }
+
+    return total_ip_addr_count;
+}
+
+int extractGetAddrInfoAnswers(const addrinfo* result, std::vector<std::string>* ip_addrs) {
+    int total_ip_addr_count = 0;
+    if (result == nullptr) {
+        return 0;
+    }
+    for (const addrinfo* ai = result; ai; ai = ai->ai_next) {
+        sockaddr* ai_addr = ai->ai_addr;
+        if (ai_addr) {
+            addIpAddrWithinLimit(ip_addrs, ai_addr, ai->ai_addrlen);
+            total_ip_addr_count++;
+        }
+    }
+    return total_ip_addr_count;
+}
+
+int extractGetHostByNameAnswers(const hostent* hp, std::vector<std::string>* ip_addrs) {
+    int total_ip_addr_count = 0;
+    if (hp == nullptr) {
+        return 0;
+    }
+    if (hp->h_addrtype == AF_INET) {
+        in_addr** list = (in_addr**) hp->h_addr_list;
+        for (int i = 0; list[i] != nullptr; i++) {
+            sockaddr_in sin = {.sin_family = AF_INET, .sin_addr = *list[i]};
+            addIpAddrWithinLimit(ip_addrs, (sockaddr*) &sin, sizeof(sin));
+            total_ip_addr_count++;
+        }
+    } else if (hp->h_addrtype == AF_INET6) {
+        in6_addr** list = (in6_addr**) hp->h_addr_list;
+        for (int i = 0; list[i] != nullptr; i++) {
+            sockaddr_in6 sin6 = {.sin6_family = AF_INET6, .sin6_addr = *list[i]};
+            addIpAddrWithinLimit(ip_addrs, (sockaddr*) &sin6, sizeof(sin6));
+            total_ip_addr_count++;
+        }
+    }
+    return total_ip_addr_count;
+}
+
+int rcodeToAiError(int rcode) {
+    switch (rcode) {
+        case NOERROR:
+            return 0;
+        case RCODE_TIMEOUT:
+            return NETD_RESOLV_TIMEOUT;
+        default:
+            return EAI_NODATA;
+    }
+}
+
+int resNSendToAiError(int err, int rcode) {
+    if (err > 0) {
+        return rcodeToAiError(rcode);
+    }
+    if (err == -ETIMEDOUT) {
+        return NETD_RESOLV_TIMEOUT;
+    }
+    return EAI_SYSTEM;
+}
+
+template <typename IntegralType>
+bool simpleStrtoul(const char* input, IntegralType* output, int base = 10) {
+    char* endPtr;
+    errno = 0;
+    auto result = strtoul(input, &endPtr, base);
+    // Check the length in order to ensure there is no "-" sign
+    if (!*input || *endPtr || (endPtr - input) != static_cast<ptrdiff_t>(strlen(input)) ||
+        (errno == ERANGE && (result == ULONG_MAX))) {
+        return false;
+    }
+    *output = result;
+    return true;
+}
+
+bool setQueryId(uint8_t* msg, size_t msgLen, uint16_t query_id) {
+    if (msgLen < sizeof(HEADER)) {
+        errno = EINVAL;
+        return false;
+    }
+    auto hp = reinterpret_cast<HEADER*>(msg);
+    hp->id = htons(query_id);
+    return true;
+}
+
+bool parseQuery(const uint8_t* msg, size_t msgLen, uint16_t* query_id, int* rr_type,
+                std::string* rr_name) {
+    ns_msg handle;
+    ns_rr rr;
+    if (ns_initparse((const uint8_t*)msg, msgLen, &handle) < 0 ||
+        ns_parserr(&handle, ns_s_qd, 0, &rr) < 0) {
+        return false;
+    }
+    *query_id = ns_msg_id(handle);
+    *rr_name = ns_rr_name(rr);
+    *rr_type = ns_rr_type(rr);
+    return true;
+}
+
+void initDnsEvent(NetworkDnsEventReported* event) {
+    // The value 0 has the special meaning of unset/unknown in Westworld atoms.
+    event->set_hints_ai_flags(-1);
+    event->set_res_nsend_flags(-1);
+}
+
+// Return 0 if the event should not be logged.
+// Otherwise, return subsampling_denom
+uint32_t getDnsEventSubsamplingRate(int netid, int returnCode) {
+    uint32_t subsampling_denom = resolv_cache_get_subsampling_denom(netid, returnCode);
+    if (subsampling_denom == 0) return 0;
+    // Sample the event with a chance of 1 / denom.
+    return (arc4random_uniform(subsampling_denom) == 0) ? subsampling_denom : 0;
+}
+
+void reportDnsEvent(int eventType, const android_net_context& netContext, int latencyUs,
+                    int returnCode, NetworkDnsEventReported& event, const std::string& query_name,
+                    const std::vector<std::string>& ip_addrs = {}, int total_ip_addr_count = 0) {
+    if (uint32_t rate = getDnsEventSubsamplingRate(netContext.dns_netid, returnCode)) {
+        const std::string& dnsQueryStats = event.dns_query_events().SerializeAsString();
+        stats::BytesField dnsQueryBytesField{dnsQueryStats.c_str(), dnsQueryStats.size()};
+        event.set_return_code(static_cast<ReturnCode>(returnCode));
+        android::net::stats::stats_write(android::net::stats::NETWORK_DNS_EVENT_REPORTED,
+                                         event.event_type(), event.return_code(),
+                                         event.latency_micros(), event.hints_ai_flags(),
+                                         event.res_nsend_flags(), event.network_type(),
+                                         event.private_dns_modes(), dnsQueryBytesField, rate);
+    }
+
+    const auto& listeners = ResolverEventReporter::getInstance().getListeners();
+    if (listeners.size() == 0) {
+        LOG(ERROR) << __func__
+                   << ": DNS event not sent since no INetdEventListener receiver is available.";
+        return;
+    }
+    const int latencyMs = latencyUs / 1000;
+    for (const auto& it : listeners) {
+        it->onDnsEvent(netContext.dns_netid, eventType, returnCode, latencyMs, query_name, ip_addrs,
+                       total_ip_addr_count, netContext.uid);
+    }
+}
+
+bool onlyIPv4Answers(const addrinfo* res) {
+    // Null addrinfo pointer isn't checked because the caller doesn't pass null pointer.
+
+    for (const addrinfo* ai = res; ai; ai = ai->ai_next)
+        if (ai->ai_family != AF_INET) return false;
+
+    return true;
+}
+
+bool isSpecialUseIPv4Address(const struct in_addr& ia) {
+    const uint32_t addr = ntohl(ia.s_addr);
+
+    // Only check necessary IP ranges in RFC 5735 section 4
+    return ((addr & 0xff000000) == 0x00000000) ||  // "This" Network
+           ((addr & 0xff000000) == 0x7f000000) ||  // Loopback
+           ((addr & 0xffff0000) == 0xa9fe0000) ||  // Link Local
+           ((addr & 0xf0000000) == 0xe0000000) ||  // Multicast
+           (addr == INADDR_BROADCAST);             // Limited Broadcast
+}
+
+bool isSpecialUseIPv4Address(const struct sockaddr* sa) {
+    if (sa->sa_family != AF_INET) return false;
+
+    return isSpecialUseIPv4Address(((struct sockaddr_in*) sa)->sin_addr);
+}
+
+bool onlyNonSpecialUseIPv4Addresses(struct hostent* hp) {
+    // Null hostent pointer isn't checked because the caller doesn't pass null pointer.
+
+    if (hp->h_addrtype != AF_INET) return false;
+
+    for (int i = 0; hp->h_addr_list[i] != nullptr; i++)
+        if (isSpecialUseIPv4Address(*(struct in_addr*) hp->h_addr_list[i])) return false;
+
+    return true;
+}
+
+bool onlyNonSpecialUseIPv4Addresses(const addrinfo* res) {
+    // Null addrinfo pointer isn't checked because the caller doesn't pass null pointer.
+
+    for (const addrinfo* ai = res; ai; ai = ai->ai_next) {
+        if (ai->ai_family != AF_INET) return false;
+        if (isSpecialUseIPv4Address(ai->ai_addr)) return false;
+    }
+
+    return true;
+}
+
+void logDnsQueryResult(const struct hostent* hp) {
+    if (!WOULD_LOG(DEBUG)) return;
+    if (hp == nullptr) return;
+
+    LOG(DEBUG) << __func__ << ": DNS records:";
+    for (int i = 0; hp->h_addr_list[i] != nullptr; i++) {
+        char ip_addr[INET6_ADDRSTRLEN];
+        if (inet_ntop(hp->h_addrtype, hp->h_addr_list[i], ip_addr, sizeof(ip_addr)) != nullptr) {
+            LOG(DEBUG) << __func__ << ": [" << i << "] " << hp->h_addrtype;
+        } else {
+            PLOG(DEBUG) << __func__ << ": [" << i << "] numeric hostname translation fail";
+        }
+    }
+}
+
+void logDnsQueryResult(const addrinfo* res) {
+    if (!WOULD_LOG(DEBUG)) return;
+    if (res == nullptr) return;
+
+    int i;
+    const addrinfo* ai;
+    LOG(DEBUG) << __func__ << ": DNS records:";
+    for (ai = res, i = 0; ai; ai = ai->ai_next, i++) {
+        if ((ai->ai_family != AF_INET) && (ai->ai_family != AF_INET6)) continue;
+        char ip_addr[INET6_ADDRSTRLEN];
+        int ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, ip_addr, sizeof(ip_addr), nullptr, 0,
+                              NI_NUMERICHOST);
+        if (!ret) {
+            LOG(DEBUG) << __func__ << ": [" << i << "] " << ai->ai_flags << " " << ai->ai_family
+                       << " " << ai->ai_socktype << " " << ai->ai_protocol;
+        } else {
+            LOG(DEBUG) << __func__ << ": [" << i << "] numeric hostname translation fail " << ret;
+        }
+    }
+}
+
+bool isValidNat64Prefix(const netdutils::IPPrefix prefix) {
+    if (prefix.family() != AF_INET6) {
+        LOG(ERROR) << __func__ << ": Only IPv6 NAT64 prefixes are supported " << prefix.family();
+        return false;
+    }
+    if (prefix.length() != 96) {
+        LOG(ERROR) << __func__ << ": Only /96 NAT64 prefixes are supported " << prefix.length();
+        return false;
+    }
+    return true;
+}
+
+bool synthesizeNat64PrefixWithARecord(const netdutils::IPPrefix& prefix, struct hostent* hp) {
+    if (hp == nullptr) return false;
+    if (!onlyNonSpecialUseIPv4Addresses(hp)) return false;
+    if (!isValidNat64Prefix(prefix)) return false;
+
+    struct sockaddr_storage ss = netdutils::IPSockAddr(prefix.ip());
+    struct sockaddr_in6* v6prefix = (struct sockaddr_in6*) &ss;
+    for (int i = 0; hp->h_addr_list[i] != nullptr; i++) {
+        struct in_addr iaOriginal = *(struct in_addr*) hp->h_addr_list[i];
+        struct in6_addr* ia6 = (struct in6_addr*) hp->h_addr_list[i];
+        memset(ia6, 0, sizeof(struct in6_addr));
+
+        // Synthesize /96 NAT64 prefix in place. The space has reserved by getanswer() and
+        // _hf_gethtbyname2() in system/netd/resolv/gethnamaddr.cpp and
+        // system/netd/resolv/sethostent.cpp.
+        *ia6 = v6prefix->sin6_addr;
+        ia6->s6_addr32[3] = iaOriginal.s_addr;
+
+        if (WOULD_LOG(DEBUG)) {
+            char buf[INET6_ADDRSTRLEN];  // big enough for either IPv4 or IPv6
+            inet_ntop(AF_INET, &iaOriginal.s_addr, buf, sizeof(buf));
+            LOG(DEBUG) << __func__ << ": DNS A record: " << buf;
+            inet_ntop(AF_INET6, &v6prefix->sin6_addr, buf, sizeof(buf));
+            LOG(DEBUG) << __func__ << ": NAT64 prefix: " << buf;
+            inet_ntop(AF_INET6, ia6, buf, sizeof(buf));
+            LOG(DEBUG) << __func__ << ": DNS64 Synthesized AAAA record: " << buf;
+        }
+    }
+    hp->h_addrtype = AF_INET6;
+    hp->h_length = sizeof(in6_addr);
+
+    logDnsQueryResult(hp);
+    return true;
+}
+
+bool synthesizeNat64PrefixWithARecord(const netdutils::IPPrefix& prefix, addrinfo* result) {
+    if (result == nullptr) return false;
+    if (!onlyNonSpecialUseIPv4Addresses(result)) return false;
+    if (!isValidNat64Prefix(prefix)) return false;
+
+    struct sockaddr_storage ss = netdutils::IPSockAddr(prefix.ip());
+    struct sockaddr_in6* v6prefix = (struct sockaddr_in6*) &ss;
+    for (addrinfo* ai = result; ai; ai = ai->ai_next) {
+        struct sockaddr_in sinOriginal = *(struct sockaddr_in*) ai->ai_addr;
+        struct sockaddr_in6* sin6 = (struct sockaddr_in6*) ai->ai_addr;
+        memset(sin6, 0, sizeof(sockaddr_in6));
+
+        // Synthesize /96 NAT64 prefix in place. The space has reserved by get_ai() in
+        // system/netd/resolv/getaddrinfo.cpp.
+        sin6->sin6_addr = v6prefix->sin6_addr;
+        sin6->sin6_addr.s6_addr32[3] = sinOriginal.sin_addr.s_addr;
+        sin6->sin6_family = AF_INET6;
+        sin6->sin6_port = sinOriginal.sin_port;
+        ai->ai_addrlen = sizeof(struct sockaddr_in6);
+        ai->ai_family = AF_INET6;
+
+        if (WOULD_LOG(DEBUG)) {
+            char buf[INET6_ADDRSTRLEN];  // big enough for either IPv4 or IPv6
+            inet_ntop(AF_INET, &sinOriginal.sin_addr.s_addr, buf, sizeof(buf));
+            LOG(DEBUG) << __func__ << ": DNS A record: " << buf;
+            inet_ntop(AF_INET6, &v6prefix->sin6_addr, buf, sizeof(buf));
+            LOG(DEBUG) << __func__ << ": NAT64 prefix: " << buf;
+            inet_ntop(AF_INET6, &sin6->sin6_addr, buf, sizeof(buf));
+            LOG(DEBUG) << __func__ << ": DNS64 Synthesized AAAA record: " << buf;
+        }
+    }
+    logDnsQueryResult(result);
+    return true;
+}
+
+bool getDns64Prefix(unsigned netId, netdutils::IPPrefix* prefix) {
+    return !gDnsResolv->resolverCtrl.getPrefix64(netId, prefix);
+}
+
+}  // namespace
+
+DnsProxyListener::DnsProxyListener() : FrameworkListener(SOCKET_NAME) {
+    registerCmd(new GetAddrInfoCmd());
+    registerCmd(new GetHostByAddrCmd());
+    registerCmd(new GetHostByNameCmd());
+    registerCmd(new ResNSendCommand());
+    registerCmd(new GetDnsNetIdCommand());
+}
+
+DnsProxyListener::GetAddrInfoHandler::GetAddrInfoHandler(SocketClient* c, char* host, char* service,
+                                                         addrinfo* hints,
+                                                         const android_net_context& netcontext)
+    : mClient(c), mHost(host), mService(service), mHints(hints), mNetContext(netcontext) {}
+
+DnsProxyListener::GetAddrInfoHandler::~GetAddrInfoHandler() {
+    free(mHost);
+    free(mService);
+    free(mHints);
+}
+
+static bool sendBE32(SocketClient* c, uint32_t data) {
+    uint32_t be_data = htonl(data);
+    return c->sendData(&be_data, sizeof(be_data)) == 0;
+}
+
+// Sends 4 bytes of big-endian length, followed by the data.
+// Returns true on success.
+static bool sendLenAndData(SocketClient* c, const int len, const void* data) {
+    return sendBE32(c, len) && (len == 0 || c->sendData(data, len) == 0);
+}
+
+// Returns true on success
+static bool sendhostent(SocketClient* c, hostent* hp) {
+    bool success = true;
+    int i;
+    if (hp->h_name != nullptr) {
+        success &= sendLenAndData(c, strlen(hp->h_name)+1, hp->h_name);
+    } else {
+        success &= sendLenAndData(c, 0, "") == 0;
+    }
+
+    for (i=0; hp->h_aliases[i] != nullptr; i++) {
+        success &= sendLenAndData(c, strlen(hp->h_aliases[i])+1, hp->h_aliases[i]);
+    }
+    success &= sendLenAndData(c, 0, ""); // null to indicate we're done
+
+    uint32_t buf = htonl(hp->h_addrtype);
+    success &= c->sendData(&buf, sizeof(buf)) == 0;
+
+    buf = htonl(hp->h_length);
+    success &= c->sendData(&buf, sizeof(buf)) == 0;
+
+    for (i=0; hp->h_addr_list[i] != nullptr; i++) {
+        success &= sendLenAndData(c, 16, hp->h_addr_list[i]);
+    }
+    success &= sendLenAndData(c, 0, ""); // null to indicate we're done
+    return success;
+}
+
+static bool sendaddrinfo(SocketClient* c, addrinfo* ai) {
+    // struct addrinfo {
+    //      int     ai_flags;       /* AI_PASSIVE, AI_CANONNAME, AI_NUMERICHOST */
+    //      int     ai_family;      /* PF_xxx */
+    //      int     ai_socktype;    /* SOCK_xxx */
+    //      int     ai_protocol;    /* 0 or IPPROTO_xxx for IPv4 and IPv6 */
+    //      socklen_t ai_addrlen;   /* length of ai_addr */
+    //      char    *ai_canonname;  /* canonical name for hostname */
+    //      struct  sockaddr *ai_addr;      /* binary address */
+    //      struct  addrinfo *ai_next;      /* next structure in linked list */
+    // };
+
+    // Write the struct piece by piece because we might be a 64-bit netd
+    // talking to a 32-bit process.
+    bool success =
+            sendBE32(c, ai->ai_flags) &&
+            sendBE32(c, ai->ai_family) &&
+            sendBE32(c, ai->ai_socktype) &&
+            sendBE32(c, ai->ai_protocol);
+    if (!success) {
+        return false;
+    }
+
+    // ai_addrlen and ai_addr.
+    if (!sendLenAndData(c, ai->ai_addrlen, ai->ai_addr)) {
+        return false;
+    }
+
+    // strlen(ai_canonname) and ai_canonname.
+    if (!sendLenAndData(c, ai->ai_canonname ? strlen(ai->ai_canonname) + 1 : 0, ai->ai_canonname)) {
+        return false;
+    }
+
+    return true;
+}
+
+void DnsProxyListener::GetAddrInfoHandler::doDns64Synthesis(int32_t* rv, addrinfo** res,
+                                                            NetworkDnsEventReported* event) {
+    if (mHost == nullptr) return;
+
+    const bool ipv6WantedButNoData = (mHints && mHints->ai_family == AF_INET6 && *rv == EAI_NODATA);
+    const bool unspecWantedButNoIPv6 =
+            ((!mHints || mHints->ai_family == AF_UNSPEC) && *rv == 0 && onlyIPv4Answers(*res));
+
+    if (!ipv6WantedButNoData && !unspecWantedButNoIPv6) {
+        return;
+    }
+
+    netdutils::IPPrefix prefix{};
+    if (!getDns64Prefix(mNetContext.dns_netid, &prefix)) {
+        return;
+    }
+
+    if (ipv6WantedButNoData) {
+        // If caller wants IPv6 answers but no data, try to query IPv4 answers for synthesis
+        const uid_t uid = mClient->getUid();
+        if (queryLimiter.start(uid)) {
+            mHints->ai_family = AF_INET;
+            // Don't need to do freeaddrinfo(res) before starting new DNS lookup because previous
+            // DNS lookup is failed with error EAI_NODATA.
+            *rv = android_getaddrinfofornetcontext(mHost, mService, mHints, &mNetContext, res,
+                                                   event);
+            queryLimiter.finish(uid);
+            if (*rv) {
+                *rv = EAI_NODATA;  // return original error code
+                return;
+            }
+        } else {
+            LOG(ERROR) << __func__ << ": from UID " << uid << ", max concurrent queries reached";
+            return;
+        }
+    }
+
+    if (!synthesizeNat64PrefixWithARecord(prefix, *res)) {
+        if (ipv6WantedButNoData) {
+            // If caller wants IPv6 answers but no data and failed to synthesize IPv6 answers,
+            // don't return the IPv4 answers.
+            *rv = EAI_NODATA;  // return original error code
+            if (*res) {
+                freeaddrinfo(*res);
+                *res = nullptr;
+            }
+        }
+    }
+}
+
+void DnsProxyListener::GetAddrInfoHandler::run() {
+    LOG(DEBUG) << "GetAddrInfoHandler::run: {" << mNetContext.app_netid << " "
+               << mNetContext.app_mark << " " << mNetContext.dns_netid << " "
+               << mNetContext.dns_mark << " " << mNetContext.uid << " " << mNetContext.flags << "}";
+
+    addrinfo* result = nullptr;
+    Stopwatch s;
+    maybeFixupNetContext(&mNetContext);
+    const uid_t uid = mClient->getUid();
+    int32_t rv = 0;
+    NetworkDnsEventReported event;
+    initDnsEvent(&event);
+    if (queryLimiter.start(uid)) {
+        rv = android_getaddrinfofornetcontext(mHost, mService, mHints, &mNetContext, &result,
+                                              &event);
+        queryLimiter.finish(uid);
+    } else {
+        // Note that this error code is currently not passed down to the client.
+        // android_getaddrinfo_proxy() returns EAI_NODATA on any error.
+        rv = EAI_MEMORY;
+        LOG(ERROR) << "GetAddrInfoHandler::run: from UID " << uid
+                   << ", max concurrent queries reached";
+    }
+
+    doDns64Synthesis(&rv, &result, &event);
+    const int32_t latencyUs = saturate_cast<int32_t>(s.timeTakenUs());
+    event.set_latency_micros(latencyUs);
+    event.set_event_type(EVENT_GETADDRINFO);
+    event.set_hints_ai_flags((mHints ? mHints->ai_flags : 0));
+
+    if (rv) {
+        // getaddrinfo failed
+        mClient->sendBinaryMsg(ResponseCode::DnsProxyOperationFailed, &rv, sizeof(rv));
+    } else {
+        bool success = !mClient->sendCode(ResponseCode::DnsProxyQueryResult);
+        addrinfo* ai = result;
+        while (ai && success) {
+            success = sendBE32(mClient, 1) && sendaddrinfo(mClient, ai);
+            ai = ai->ai_next;
+        }
+        success = success && sendBE32(mClient, 0);
+        if (!success) {
+            LOG(WARNING) << "GetAddrInfoHandler::run: Error writing DNS result to client";
+        }
+    }
+    std::vector<std::string> ip_addrs;
+    const int total_ip_addr_count = extractGetAddrInfoAnswers(result, &ip_addrs);
+    reportDnsEvent(INetdEventListener::EVENT_GETADDRINFO, mNetContext, latencyUs, rv, event, mHost,
+                   ip_addrs, total_ip_addr_count);
+    freeaddrinfo(result);
+    mClient->decRef();
+}
+
+namespace {
+
+void addIpAddrWithinLimit(std::vector<std::string>* ip_addrs, const sockaddr* addr,
+                          socklen_t addrlen) {
+    // ipAddresses array is limited to first INetdEventListener::DNS_REPORTED_IP_ADDRESSES_LIMIT
+    // addresses for A and AAAA. Total count of addresses is provided, to be able to tell whether
+    // some addresses didn't get logged.
+    if (ip_addrs->size() < INetdEventListener::DNS_REPORTED_IP_ADDRESSES_LIMIT) {
+        char ip_addr[INET6_ADDRSTRLEN];
+        if (getnameinfo(addr, addrlen, ip_addr, sizeof(ip_addr), nullptr, 0, NI_NUMERICHOST) == 0) {
+            ip_addrs->push_back(std::string(ip_addr));
+        }
+    }
+}
+
+}  // namespace
+
+DnsProxyListener::GetAddrInfoCmd::GetAddrInfoCmd() : FrameworkCommand("getaddrinfo") {}
+
+int DnsProxyListener::GetAddrInfoCmd::runCommand(SocketClient *cli,
+                                            int argc, char **argv) {
+    logArguments(argc, argv);
+
+    if (argc != 8) {
+        char* msg = nullptr;
+        asprintf( &msg, "Invalid number of arguments to getaddrinfo: %i", argc);
+        LOG(WARNING) << "GetAddrInfoCmd::runCommand: " << (msg ? msg : "null");
+        cli->sendMsg(ResponseCode::CommandParameterError, msg, false);
+        free(msg);
+        return -1;
+    }
+
+    char* name = argv[1];
+    if (strcmp("^", name) == 0) {
+        name = nullptr;
+    } else {
+        name = strdup(name);
+    }
+
+    char* service = argv[2];
+    if (strcmp("^", service) == 0) {
+        service = nullptr;
+    } else {
+        service = strdup(service);
+    }
+
+    addrinfo* hints = nullptr;
+    int ai_flags = strtol(argv[3], nullptr, 10);
+    int ai_family = strtol(argv[4], nullptr, 10);
+    int ai_socktype = strtol(argv[5], nullptr, 10);
+    int ai_protocol = strtol(argv[6], nullptr, 10);
+    unsigned netId = strtoul(argv[7], nullptr, 10);
+    const bool useLocalNameservers = checkAndClearUseLocalNameserversFlag(&netId);
+    const uid_t uid = cli->getUid();
+
+    android_net_context netcontext;
+    gResNetdCallbacks.get_network_context(netId, uid, &netcontext);
+
+    if (useLocalNameservers) {
+        netcontext.flags |= NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS;
+    }
+
+    if (ai_flags != -1 || ai_family != -1 ||
+        ai_socktype != -1 || ai_protocol != -1) {
+        hints = (addrinfo*) calloc(1, sizeof(addrinfo));
+        hints->ai_flags = ai_flags;
+        hints->ai_family = ai_family;
+        hints->ai_socktype = ai_socktype;
+        hints->ai_protocol = ai_protocol;
+    }
+
+    DnsProxyListener::GetAddrInfoHandler* handler =
+            new DnsProxyListener::GetAddrInfoHandler(cli, name, service, hints, netcontext);
+    tryThreadOrError(cli, handler);
+    return 0;
+}
+
+/*******************************************************
+ *                  ResNSendCommand                    *
+ *******************************************************/
+DnsProxyListener::ResNSendCommand::ResNSendCommand() : FrameworkCommand("resnsend") {}
+
+int DnsProxyListener::ResNSendCommand::runCommand(SocketClient* cli, int argc, char** argv) {
+    logArguments(argc, argv);
+
+    const uid_t uid = cli->getUid();
+    if (argc != 4) {
+        LOG(WARNING) << "ResNSendCommand::runCommand: resnsend: from UID " << uid
+                     << ", invalid number of arguments to resnsend: " << argc;
+        sendBE32(cli, -EINVAL);
+        return -1;
+    }
+
+    unsigned netId;
+    if (!simpleStrtoul(argv[1], &netId)) {
+        LOG(WARNING) << "ResNSendCommand::runCommand: resnsend: from UID " << uid
+                     << ", invalid netId";
+        sendBE32(cli, -EINVAL);
+        return -1;
+    }
+
+    uint32_t flags;
+    if (!simpleStrtoul(argv[2], &flags)) {
+        LOG(WARNING) << "ResNSendCommand::runCommand: resnsend: from UID " << uid
+                     << ", invalid flags";
+        sendBE32(cli, -EINVAL);
+        return -1;
+    }
+
+    const bool useLocalNameservers = checkAndClearUseLocalNameserversFlag(&netId);
+
+    android_net_context netcontext;
+    gResNetdCallbacks.get_network_context(netId, uid, &netcontext);
+
+    if (useLocalNameservers) {
+        netcontext.flags |= NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS;
+    }
+
+    DnsProxyListener::ResNSendHandler* handler =
+            new DnsProxyListener::ResNSendHandler(cli, argv[3], flags, netcontext);
+    tryThreadOrError(cli, handler);
+    return 0;
+}
+
+DnsProxyListener::ResNSendHandler::ResNSendHandler(SocketClient* c, std::string msg, uint32_t flags,
+                                                   const android_net_context& netcontext)
+    : mClient(c), mMsg(std::move(msg)), mFlags(flags), mNetContext(netcontext) {}
+
+DnsProxyListener::ResNSendHandler::~ResNSendHandler() {
+    mClient->decRef();
+}
+
+void DnsProxyListener::ResNSendHandler::run() {
+    LOG(DEBUG) << "ResNSendHandler::run: " << mFlags << " / {" << mNetContext.app_netid << " "
+               << mNetContext.app_mark << " " << mNetContext.dns_netid << " "
+               << mNetContext.dns_mark << " " << mNetContext.uid << " " << mNetContext.flags << "}";
+
+    Stopwatch s;
+    maybeFixupNetContext(&mNetContext);
+
+    // Decode
+    std::vector<uint8_t> msg(MAXPACKET, 0);
+
+    // Max length of mMsg is less than 1024 since the CMD_BUF_SIZE in FrameworkListener is 1024
+    int msgLen = b64_pton(mMsg.c_str(), msg.data(), MAXPACKET);
+    if (msgLen == -1) {
+        // Decode fail
+        sendBE32(mClient, -EILSEQ);
+        return;
+    }
+
+    const uid_t uid = mClient->getUid();
+    int rr_type = 0;
+    std::string rr_name;
+    uint16_t original_query_id = 0;
+
+    // TODO: Handle the case which is msg contains more than one query
+    if (!parseQuery(msg.data(), msgLen, &original_query_id, &rr_type, &rr_name) ||
+        !setQueryId(msg.data(), msgLen, arc4random_uniform(65536))) {
+        // If the query couldn't be parsed, block the request.
+        LOG(WARNING) << "ResNSendHandler::run: resnsend: from UID " << uid << ", invalid query";
+        sendBE32(mClient, -EINVAL);
+        return;
+    }
+
+    // Send DNS query
+    std::vector<uint8_t> ansBuf(MAXPACKET, 0);
+    int arcode, nsendAns = -1;
+    NetworkDnsEventReported event;
+    initDnsEvent(&event);
+    if (queryLimiter.start(uid)) {
+        nsendAns = resolv_res_nsend(&mNetContext, msg.data(), msgLen, ansBuf.data(), MAXPACKET,
+                                    &arcode, static_cast<ResNsendFlags>(mFlags), &event);
+        queryLimiter.finish(uid);
+    } else {
+        LOG(WARNING) << "ResNSendHandler::run: resnsend: from UID " << uid
+                     << ", max concurrent queries reached";
+        nsendAns = -EBUSY;
+    }
+
+    const int32_t latencyUs = saturate_cast<int32_t>(s.timeTakenUs());
+    event.set_latency_micros(latencyUs);
+    event.set_event_type(EVENT_RES_NSEND);
+    event.set_res_nsend_flags(static_cast<ResNsendFlags>(mFlags));
+
+    // Fail, send -errno
+    if (nsendAns < 0) {
+        sendBE32(mClient, nsendAns);
+        if (rr_type == ns_t_a || rr_type == ns_t_aaaa) {
+            reportDnsEvent(INetdEventListener::EVENT_RES_NSEND, mNetContext, latencyUs,
+                           resNSendToAiError(nsendAns, arcode), event, rr_name);
+        }
+        return;
+    }
+
+    // Send rcode
+    if (!sendBE32(mClient, arcode)) {
+        PLOG(WARNING) << "ResNSendHandler::run: resnsend: failed to send rcode to uid " << uid;
+        return;
+    }
+
+    // Restore query id and send answer
+    if (!setQueryId(ansBuf.data(), nsendAns, original_query_id) ||
+        !sendLenAndData(mClient, nsendAns, ansBuf.data())) {
+        PLOG(WARNING) << "ResNSendHandler::run: resnsend: failed to send answer to uid " << uid;
+        return;
+    }
+
+    if (rr_type == ns_t_a || rr_type == ns_t_aaaa) {
+        std::vector<std::string> ip_addrs;
+        const int total_ip_addr_count =
+                extractResNsendAnswers((uint8_t*) ansBuf.data(), nsendAns, rr_type, &ip_addrs);
+        reportDnsEvent(INetdEventListener::EVENT_RES_NSEND, mNetContext, latencyUs,
+                       resNSendToAiError(nsendAns, arcode), event, rr_name, ip_addrs,
+                       total_ip_addr_count);
+    }
+}
+
+namespace {
+
+bool sendCodeAndBe32(SocketClient* c, int code, int data) {
+    return !c->sendCode(code) && sendBE32(c, data);
+}
+
+}  // namespace
+
+/*******************************************************
+ *                  GetDnsNetId                        *
+ *******************************************************/
+DnsProxyListener::GetDnsNetIdCommand::GetDnsNetIdCommand() : FrameworkCommand("getdnsnetid") {}
+
+int DnsProxyListener::GetDnsNetIdCommand::runCommand(SocketClient* cli, int argc, char** argv) {
+    logArguments(argc, argv);
+
+    const uid_t uid = cli->getUid();
+    if (argc != 2) {
+        LOG(WARNING) << "GetDnsNetIdCommand::runCommand: getdnsnetid: from UID " << uid
+                     << ", invalid number of arguments to getdnsnetid: " << argc;
+        sendCodeAndBe32(cli, ResponseCode::DnsProxyQueryResult, -EINVAL);
+        return -1;
+    }
+
+    unsigned netId;
+    if (!simpleStrtoul(argv[1], &netId)) {
+        LOG(WARNING) << "GetDnsNetIdCommand::runCommand: getdnsnetid: from UID " << uid
+                     << ", invalid netId";
+        sendCodeAndBe32(cli, ResponseCode::DnsProxyQueryResult, -EINVAL);
+        return -1;
+    }
+
+    const bool useLocalNameservers = checkAndClearUseLocalNameserversFlag(&netId);
+    android_net_context netcontext;
+    gResNetdCallbacks.get_network_context(netId, uid, &netcontext);
+
+    if (useLocalNameservers) {
+        netcontext.app_netid |= NETID_USE_LOCAL_NAMESERVERS;
+    }
+
+    return sendCodeAndBe32(cli, ResponseCode::DnsProxyQueryResult, netcontext.app_netid) ? 0 : -1;
+}
+
+/*******************************************************
+ *                  GetHostByName                      *
+ *******************************************************/
+DnsProxyListener::GetHostByNameCmd::GetHostByNameCmd() : FrameworkCommand("gethostbyname") {}
+
+int DnsProxyListener::GetHostByNameCmd::runCommand(SocketClient *cli,
+                                            int argc, char **argv) {
+    logArguments(argc, argv);
+
+    if (argc != 4) {
+        char* msg = nullptr;
+        asprintf(&msg, "Invalid number of arguments to gethostbyname: %i", argc);
+        LOG(WARNING) << "GetHostByNameCmd::runCommand: " << (msg ? msg : "null");
+        cli->sendMsg(ResponseCode::CommandParameterError, msg, false);
+        free(msg);
+        return -1;
+    }
+
+    uid_t uid = cli->getUid();
+    unsigned netId = strtoul(argv[1], nullptr, 10);
+    const bool useLocalNameservers = checkAndClearUseLocalNameserversFlag(&netId);
+    char* name = argv[2];
+    int af = strtol(argv[3], nullptr, 10);
+
+    if (strcmp(name, "^") == 0) {
+        name = nullptr;
+    } else {
+        name = strdup(name);
+    }
+
+    android_net_context netcontext;
+    gResNetdCallbacks.get_network_context(netId, uid, &netcontext);
+
+    if (useLocalNameservers) {
+        netcontext.flags |= NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS;
+    }
+
+    DnsProxyListener::GetHostByNameHandler* handler =
+            new DnsProxyListener::GetHostByNameHandler(cli, name, af, netcontext);
+    tryThreadOrError(cli, handler);
+    return 0;
+}
+
+DnsProxyListener::GetHostByNameHandler::GetHostByNameHandler(SocketClient* c, char* name, int af,
+                                                             const android_net_context& netcontext)
+    : mClient(c), mName(name), mAf(af), mNetContext(netcontext) {}
+
+DnsProxyListener::GetHostByNameHandler::~GetHostByNameHandler() {
+    free(mName);
+}
+
+void DnsProxyListener::GetHostByNameHandler::doDns64Synthesis(int32_t* rv, struct hostent** hpp,
+                                                              NetworkDnsEventReported* event) {
+    // Don't have to consider family AF_UNSPEC case because gethostbyname{, 2} only supports
+    // family AF_INET or AF_INET6.
+    const bool ipv6WantedButNoData = (mAf == AF_INET6 && *rv == EAI_NODATA);
+
+    if (!ipv6WantedButNoData) {
+        return;
+    }
+
+    netdutils::IPPrefix prefix{};
+    if (!getDns64Prefix(mNetContext.dns_netid, &prefix)) {
+        return;
+    }
+
+    // If caller wants IPv6 answers but no data, try to query IPv4 answers for synthesis
+    const uid_t uid = mClient->getUid();
+    if (queryLimiter.start(uid)) {
+        *rv = android_gethostbynamefornetcontext(mName, AF_INET, &mNetContext, hpp, event);
+        queryLimiter.finish(uid);
+        if (*rv) {
+            *rv = EAI_NODATA;  // return original error code
+            return;
+        }
+    } else {
+        LOG(ERROR) << __func__ << ": from UID " << uid << ", max concurrent queries reached";
+        return;
+    }
+
+    if (!synthesizeNat64PrefixWithARecord(prefix, *hpp)) {
+        // If caller wants IPv6 answers but no data and failed to synthesize IPv4 answers,
+        // don't return the IPv4 answers.
+        *hpp = nullptr;
+    }
+}
+
+void DnsProxyListener::GetHostByNameHandler::run() {
+    Stopwatch s;
+    maybeFixupNetContext(&mNetContext);
+    const uid_t uid = mClient->getUid();
+    hostent* hp = nullptr;
+    int32_t rv = 0;
+    NetworkDnsEventReported event;
+    initDnsEvent(&event);
+    if (queryLimiter.start(uid)) {
+        rv = android_gethostbynamefornetcontext(mName, mAf, &mNetContext, &hp, &event);
+        queryLimiter.finish(uid);
+    } else {
+        rv = EAI_MEMORY;
+        LOG(ERROR) << "GetHostByNameHandler::run: from UID " << uid
+                   << ", max concurrent queries reached";
+    }
+
+    doDns64Synthesis(&rv, &hp, &event);
+    const int32_t latencyUs = saturate_cast<int32_t>(s.timeTakenUs());
+    event.set_latency_micros(latencyUs);
+    event.set_event_type(EVENT_GETHOSTBYNAME);
+
+    LOG(DEBUG) << "GetHostByNameHandler::run: errno: " << (hp ? "success" : strerror(errno));
+
+    bool success = true;
+    if (hp) {
+        // hp is not nullptr iff. rv is 0.
+        success = mClient->sendCode(ResponseCode::DnsProxyQueryResult) == 0;
+        success &= sendhostent(mClient, hp);
+    } else {
+        success = mClient->sendBinaryMsg(ResponseCode::DnsProxyOperationFailed, nullptr, 0) == 0;
+    }
+
+    if (!success) {
+        LOG(WARNING) << "GetHostByNameHandler::run: Error writing DNS result to client";
+    }
+
+    std::vector<std::string> ip_addrs;
+    const int total_ip_addr_count = extractGetHostByNameAnswers(hp, &ip_addrs);
+    reportDnsEvent(INetdEventListener::EVENT_GETHOSTBYNAME, mNetContext, latencyUs, rv, event,
+                   mName, ip_addrs, total_ip_addr_count);
+    mClient->decRef();
+}
+
+
+/*******************************************************
+ *                  GetHostByAddr                      *
+ *******************************************************/
+DnsProxyListener::GetHostByAddrCmd::GetHostByAddrCmd() : FrameworkCommand("gethostbyaddr") {}
+
+int DnsProxyListener::GetHostByAddrCmd::runCommand(SocketClient *cli,
+                                            int argc, char **argv) {
+    logArguments(argc, argv);
+
+    if (argc != 5) {
+        char* msg = nullptr;
+        asprintf(&msg, "Invalid number of arguments to gethostbyaddr: %i", argc);
+        LOG(WARNING) << "GetHostByAddrCmd::runCommand: " << (msg ? msg : "null");
+        cli->sendMsg(ResponseCode::CommandParameterError, msg, false);
+        free(msg);
+        return -1;
+    }
+
+    char* addrStr = argv[1];
+    int addrLen = strtol(argv[2], nullptr, 10);
+    int addrFamily = strtol(argv[3], nullptr, 10);
+    uid_t uid = cli->getUid();
+    unsigned netId = strtoul(argv[4], nullptr, 10);
+    const bool useLocalNameservers = checkAndClearUseLocalNameserversFlag(&netId);
+
+    void* addr = malloc(sizeof(in6_addr));
+    errno = 0;
+    int result = inet_pton(addrFamily, addrStr, addr);
+    if (result <= 0) {
+        char* msg = nullptr;
+        asprintf(&msg, "inet_pton(\"%s\") failed %s", addrStr, strerror(errno));
+        LOG(WARNING) << "GetHostByAddrCmd::runCommand: " << (msg ? msg : "null");
+        cli->sendMsg(ResponseCode::OperationFailed, msg, false);
+        free(addr);
+        free(msg);
+        return -1;
+    }
+
+    android_net_context netcontext;
+    gResNetdCallbacks.get_network_context(netId, uid, &netcontext);
+
+    if (useLocalNameservers) {
+        netcontext.flags |= NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS;
+    }
+
+    DnsProxyListener::GetHostByAddrHandler* handler = new DnsProxyListener::GetHostByAddrHandler(
+            cli, addr, addrLen, addrFamily, netcontext);
+    tryThreadOrError(cli, handler);
+    return 0;
+}
+
+DnsProxyListener::GetHostByAddrHandler::GetHostByAddrHandler(SocketClient* c, void* address,
+                                                             int addressLen, int addressFamily,
+                                                             const android_net_context& netcontext)
+    : mClient(c),
+      mAddress(address),
+      mAddressLen(addressLen),
+      mAddressFamily(addressFamily),
+      mNetContext(netcontext) {}
+
+DnsProxyListener::GetHostByAddrHandler::~GetHostByAddrHandler() {
+    free(mAddress);
+}
+
+void DnsProxyListener::GetHostByAddrHandler::doDns64ReverseLookup(struct hostent** hpp,
+                                                                  NetworkDnsEventReported* event) {
+    if (*hpp != nullptr || mAddressFamily != AF_INET6 || !mAddress) {
+        return;
+    }
+
+    netdutils::IPPrefix prefix{};
+    if (!getDns64Prefix(mNetContext.dns_netid, &prefix)) {
+        return;
+    }
+
+    if (!isValidNat64Prefix(prefix)) {
+        return;
+    }
+
+    struct sockaddr_storage ss = netdutils::IPSockAddr(prefix.ip());
+    struct sockaddr_in6* v6prefix = (struct sockaddr_in6*) &ss;
+    struct in6_addr v6addr = *(in6_addr*) mAddress;
+    // Check if address has NAT64 prefix. Only /96 IPv6 NAT64 prefixes are supported
+    if ((v6addr.s6_addr32[0] != v6prefix->sin6_addr.s6_addr32[0]) ||
+        (v6addr.s6_addr32[1] != v6prefix->sin6_addr.s6_addr32[1]) ||
+        (v6addr.s6_addr32[2] != v6prefix->sin6_addr.s6_addr32[2])) {
+        return;
+    }
+
+    const uid_t uid = mClient->getUid();
+    if (queryLimiter.start(uid)) {
+        // Remove NAT64 prefix and do reverse DNS query
+        struct in_addr v4addr = {.s_addr = v6addr.s6_addr32[3]};
+        android_gethostbyaddrfornetcontext(&v4addr, sizeof(v4addr), AF_INET, &mNetContext, hpp,
+                                           event);
+        queryLimiter.finish(uid);
+        if (*hpp) {
+            // Replace IPv4 address with original queried IPv6 address in place. The space has
+            // reserved by dns_gethtbyaddr() and netbsd_gethostent_r() in
+            // system/netd/resolv/gethnamaddr.cpp.
+            // Note that android_gethostbyaddrfornetcontext returns only one entry in result.
+            memcpy((*hpp)->h_addr_list[0], &v6addr, sizeof(v6addr));
+            (*hpp)->h_addrtype = AF_INET6;
+            (*hpp)->h_length = sizeof(struct in6_addr);
+        }
+    } else {
+        LOG(ERROR) << __func__ << ": from UID " << uid << ", max concurrent queries reached";
+    }
+}
+
+void DnsProxyListener::GetHostByAddrHandler::run() {
+    Stopwatch s;
+    maybeFixupNetContext(&mNetContext);
+    const uid_t uid = mClient->getUid();
+    hostent* hp = nullptr;
+    int32_t rv = 0;
+    NetworkDnsEventReported event;
+    initDnsEvent(&event);
+    if (queryLimiter.start(uid)) {
+        rv = android_gethostbyaddrfornetcontext(mAddress, mAddressLen, mAddressFamily, &mNetContext,
+                                                &hp, &event);
+        queryLimiter.finish(uid);
+    } else {
+        rv = EAI_MEMORY;
+        LOG(ERROR) << "GetHostByAddrHandler::run: from UID " << uid
+                   << ", max concurrent queries reached";
+    }
+
+    doDns64ReverseLookup(&hp, &event);
+    const int32_t latencyUs = saturate_cast<int32_t>(s.timeTakenUs());
+    event.set_latency_micros(latencyUs);
+    event.set_event_type(EVENT_GETHOSTBYADDR);
+
+    LOG(DEBUG) << "GetHostByAddrHandler::run: result: " << (hp ? "success" : gai_strerror(rv));
+
+    bool success = true;
+    if (hp) {
+        success = mClient->sendCode(ResponseCode::DnsProxyQueryResult) == 0;
+        success &= sendhostent(mClient, hp);
+    } else {
+        success = mClient->sendBinaryMsg(ResponseCode::DnsProxyOperationFailed, nullptr, 0) == 0;
+    }
+
+    if (!success) {
+        LOG(WARNING) << "GetHostByAddrHandler::run: Error writing DNS result to client";
+    }
+
+    reportDnsEvent(INetdEventListener::EVENT_GETHOSTBYADDR, mNetContext, latencyUs, rv, event,
+                   (hp && hp->h_name) ? hp->h_name : "null", {}, 0);
+    mClient->decRef();
+}
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/DnsProxyListener.h b/resolv/DnsProxyListener.h
new file mode 100644
index 0000000..9b71bc5
--- /dev/null
+++ b/resolv/DnsProxyListener.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <string>
+
+#include <netd_resolv/resolv.h>  // android_net_context
+#include <sysutils/FrameworkCommand.h>
+#include <sysutils/FrameworkListener.h>
+
+struct addrinfo;
+struct hostent;
+
+namespace android {
+namespace net {
+
+class NetworkDnsEventReported;
+
+class DnsProxyListener : public FrameworkListener {
+  public:
+    DnsProxyListener();
+    virtual ~DnsProxyListener() {}
+
+    static constexpr const char* SOCKET_NAME = "dnsproxyd";
+
+  private:
+    class GetAddrInfoCmd : public FrameworkCommand {
+      public:
+        GetAddrInfoCmd();
+        virtual ~GetAddrInfoCmd() {}
+        int runCommand(SocketClient* c, int argc, char** argv) override;
+    };
+
+    /* ------ getaddrinfo ------*/
+    class GetAddrInfoHandler {
+      public:
+        // Note: All of host, service, and hints may be NULL
+        GetAddrInfoHandler(SocketClient* c, char* host, char* service, addrinfo* hints,
+                           const android_net_context& netcontext);
+        ~GetAddrInfoHandler();
+
+        void run();
+
+      private:
+        void doDns64Synthesis(int32_t* rv, addrinfo** res, NetworkDnsEventReported* event);
+
+        SocketClient* mClient;  // ref counted
+        char* mHost;            // owned. TODO: convert to std::string.
+        char* mService;         // owned. TODO: convert to std::string.
+        addrinfo* mHints;       // owned
+        android_net_context mNetContext;
+    };
+
+    /* ------ gethostbyname ------*/
+    class GetHostByNameCmd : public FrameworkCommand {
+      public:
+        GetHostByNameCmd();
+        virtual ~GetHostByNameCmd() {}
+        int runCommand(SocketClient* c, int argc, char** argv) override;
+    };
+
+    class GetHostByNameHandler {
+      public:
+        GetHostByNameHandler(SocketClient* c, char* name, int af,
+                             const android_net_context& netcontext);
+        ~GetHostByNameHandler();
+
+        void run();
+
+      private:
+        void doDns64Synthesis(int32_t* rv, hostent** hpp, NetworkDnsEventReported* event);
+
+        SocketClient* mClient;  // ref counted
+        char* mName;            // owned. TODO: convert to std::string.
+        int mAf;
+        android_net_context mNetContext;
+    };
+
+    /* ------ gethostbyaddr ------*/
+    class GetHostByAddrCmd : public FrameworkCommand {
+      public:
+        GetHostByAddrCmd();
+        virtual ~GetHostByAddrCmd() {}
+        int runCommand(SocketClient* c, int argc, char** argv) override;
+    };
+
+    class GetHostByAddrHandler {
+      public:
+        GetHostByAddrHandler(SocketClient* c, void* address, int addressLen, int addressFamily,
+                             const android_net_context& netcontext);
+        ~GetHostByAddrHandler();
+
+        void run();
+
+      private:
+        void doDns64ReverseLookup(hostent** hpp, NetworkDnsEventReported* event);
+
+        SocketClient* mClient;  // ref counted
+        void* mAddress;         // address to lookup; owned
+        int mAddressLen;        // length of address to look up
+        int mAddressFamily;     // address family
+        android_net_context mNetContext;
+    };
+
+    /* ------ resnsend ------*/
+    class ResNSendCommand : public FrameworkCommand {
+      public:
+        ResNSendCommand();
+        virtual ~ResNSendCommand() {}
+        int runCommand(SocketClient* c, int argc, char** argv) override;
+    };
+
+    class ResNSendHandler {
+      public:
+        ResNSendHandler(SocketClient* c, std::string msg, uint32_t flags,
+                        const android_net_context& netcontext);
+        ~ResNSendHandler();
+
+        void run();
+
+      private:
+        SocketClient* mClient;  // ref counted
+        std::string mMsg;
+        uint32_t mFlags;
+        android_net_context mNetContext;
+    };
+
+    /* ------ getdnsnetid ------*/
+    class GetDnsNetIdCommand : public FrameworkCommand {
+      public:
+        GetDnsNetIdCommand();
+        virtual ~GetDnsNetIdCommand() {}
+        int runCommand(SocketClient* c, int argc, char** argv) override;
+    };
+};
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/DnsResolver.cpp b/resolv/DnsResolver.cpp
new file mode 100644
index 0000000..092ff3f
--- /dev/null
+++ b/resolv/DnsResolver.cpp
@@ -0,0 +1,82 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "DnsResolver.h"
+
+#include <android-base/logging.h>
+#include <android-base/properties.h>
+
+#include "DnsProxyListener.h"
+#include "DnsResolverService.h"
+#include "netd_resolv/resolv.h"
+#include "res_debug.h"
+
+bool resolv_init(const ResolverNetdCallbacks* callbacks) {
+    android::base::InitLogging(/*argv=*/nullptr);
+    android::base::SetDefaultTag("libnetd_resolv");
+    LOG(INFO) << __func__ << ": Initializing resolver";
+    resolv_set_log_severity(android::base::WARNING);
+
+    android::net::gResNetdCallbacks = *callbacks;
+    android::net::gDnsResolv = android::net::DnsResolver::getInstance();
+    return android::net::gDnsResolv->start();
+}
+
+namespace android {
+namespace net {
+
+namespace {
+
+bool verifyCallbacks() {
+    return gResNetdCallbacks.check_calling_permission && gResNetdCallbacks.get_network_context &&
+           gResNetdCallbacks.log;
+}
+
+}  // namespace
+
+DnsResolver* gDnsResolv = nullptr;
+ResolverNetdCallbacks gResNetdCallbacks;
+netdutils::Log gDnsResolverLog("dnsResolver");
+
+DnsResolver* DnsResolver::getInstance() {
+    // Instantiated on first use.
+    static DnsResolver instance;
+    return &instance;
+}
+
+bool DnsResolver::start() {
+    if (!verifyCallbacks()) {
+        LOG(ERROR) << __func__ << ": Callback verification failed";
+        return false;
+    }
+    if (mDnsProxyListener.startListener()) {
+        PLOG(ERROR) << __func__ << ": Unable to start DnsProxyListener";
+        return false;
+    }
+    binder_status_t ret;
+    if ((ret = DnsResolverService::start()) != STATUS_OK) {
+        LOG(ERROR) << __func__ << ": Unable to start DnsResolverService: " << ret;
+        return false;
+    }
+    return true;
+}
+
+int DnsResolver::setLogSeverity(int32_t logSeverity) {
+    return resolv_set_log_severity(logSeverity);
+}
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/DnsResolver.h b/resolv/DnsResolver.h
new file mode 100644
index 0000000..6d8d2ce
--- /dev/null
+++ b/resolv/DnsResolver.h
@@ -0,0 +1,51 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_RESOLVER_H_
+#define _DNS_RESOLVER_H_
+
+#include "DnsProxyListener.h"
+#include "ResolverController.h"
+#include "netd_resolv/resolv.h"
+#include "netdutils/Log.h"
+
+namespace android {
+namespace net {
+
+class DnsResolver {
+  public:
+    static DnsResolver* getInstance();
+    bool start();
+    int setLogSeverity(int32_t logSeverity);
+
+    DnsResolver(DnsResolver const&) = delete;
+    void operator=(DnsResolver const&) = delete;
+
+    ResolverController resolverCtrl;
+
+  private:
+    DnsResolver() {}
+    DnsProxyListener mDnsProxyListener;
+};
+
+extern DnsResolver* gDnsResolv;
+extern ResolverNetdCallbacks gResNetdCallbacks;
+extern netdutils::Log gDnsResolverLog;
+
+}  // namespace net
+}  // namespace android
+
+#endif  // _DNS_RESOLVER_H_
diff --git a/resolv/DnsResolverService.cpp b/resolv/DnsResolverService.cpp
new file mode 100644
index 0000000..8eefd22
--- /dev/null
+++ b/resolv/DnsResolverService.cpp
@@ -0,0 +1,297 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "DnsResolverService"
+
+#include "DnsResolverService.h"
+
+#include <set>
+#include <vector>
+
+#include <android-base/stringprintf.h>
+#include <android-base/strings.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <json/value.h>
+#include <json/writer.h>
+#include <log/log.h>
+#include <netdutils/DumpWriter.h>
+#include <openssl/base64.h>
+#include <private/android_filesystem_config.h>  // AID_SYSTEM
+
+#include "BinderUtil.h"
+#include "DnsResolver.h"
+#include "NetdConstants.h"    // SHA256_SIZE
+#include "NetdPermissions.h"  // PERM_*
+#include "ResolverEventReporter.h"
+#include "resolv_cache.h"
+
+using aidl::android::net::ResolverParamsParcel;
+using android::base::Join;
+using android::base::StringPrintf;
+using android::netdutils::DumpWriter;
+
+namespace android {
+namespace net {
+
+namespace {
+
+#define ENFORCE_ANY_PERMISSION(...)                                      \
+    do {                                                                 \
+        ::ndk::ScopedAStatus status = checkAnyPermission({__VA_ARGS__}); \
+        if (!status.isOk()) {                                            \
+            return status;                                               \
+        }                                                                \
+    } while (0)
+
+#define ENFORCE_INTERNAL_PERMISSIONS() \
+    ENFORCE_ANY_PERMISSION(PERM_CONNECTIVITY_INTERNAL, PERM_MAINLINE_NETWORK_STACK)
+
+#define ENFORCE_NETWORK_STACK_PERMISSIONS() \
+    ENFORCE_ANY_PERMISSION(PERM_NETWORK_STACK, PERM_MAINLINE_NETWORK_STACK)
+
+inline ::ndk::ScopedAStatus statusFromErrcode(int ret) {
+    if (ret) {
+        return ::ndk::ScopedAStatus(
+                AStatus_fromServiceSpecificErrorWithMessage(-ret, strerror(-ret)));
+    }
+    return ::ndk::ScopedAStatus(AStatus_newOk());
+}
+
+}  // namespace
+
+DnsResolverService::DnsResolverService() {
+    // register log callback to BnDnsResolver::logFunc
+    BnDnsResolver::logFunc =
+            std::bind(binderCallLogFn, std::placeholders::_1,
+                      [](const std::string& msg) { gResNetdCallbacks.log(msg.c_str()); });
+}
+
+binder_status_t DnsResolverService::start() {
+    // TODO: Add disableBackgroundScheduling(true) after libbinder_ndk support it. b/126506010
+    // NetdNativeService does call disableBackgroundScheduling currently, so it is fine now.
+    DnsResolverService* resolverService = new DnsResolverService();
+    binder_status_t status =
+            AServiceManager_addService(resolverService->asBinder().get(), getServiceName());
+    if (status != STATUS_OK) {
+        return status;
+    }
+
+    ABinderProcess_startThreadPool();
+
+    // TODO: register log callback if binder NDK backend support it. b/126501406
+
+    return STATUS_OK;
+}
+
+binder_status_t DnsResolverService::dump(int fd, const char**, uint32_t) {
+    auto dump_permission = checkAnyPermission({PERM_DUMP});
+    if (!dump_permission.isOk()) {
+        return STATUS_PERMISSION_DENIED;
+    }
+
+    // This method does not grab any locks. If individual classes need locking
+    // their dump() methods MUST handle locking appropriately.
+    DumpWriter dw(fd);
+    for (auto netId : resolv_list_caches()) {
+        dw.println("NetId: %u", netId);
+        gDnsResolv->resolverCtrl.dump(dw, netId);
+        dw.blankline();
+    }
+
+    return STATUS_OK;
+}
+
+::ndk::ScopedAStatus DnsResolverService::isAlive(bool* alive) {
+    ENFORCE_INTERNAL_PERMISSIONS();
+
+    *alive = true;
+
+    return ::ndk::ScopedAStatus(AStatus_newOk());
+}
+
+::ndk::ScopedAStatus DnsResolverService::registerEventListener(
+        const std::shared_ptr<aidl::android::net::metrics::INetdEventListener>& listener) {
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    int res = ResolverEventReporter::getInstance().addListener(listener);
+
+    return statusFromErrcode(res);
+}
+
+::ndk::ScopedAStatus DnsResolverService::checkAnyPermission(
+        const std::vector<const char*>& permissions) {
+    // TODO: Remove callback and move this to unnamed namespace after libbiner_ndk supports
+    // check_permission.
+    if (!gResNetdCallbacks.check_calling_permission) {
+        return ::ndk::ScopedAStatus(AStatus_fromExceptionCodeWithMessage(
+                EX_NULL_POINTER, "check_calling_permission is null"));
+    }
+    pid_t pid = AIBinder_getCallingPid();
+    uid_t uid = AIBinder_getCallingUid();
+
+    // If the caller is the system UID, don't check permissions.
+    // Otherwise, if the system server's binder thread pool is full, and all the threads are
+    // blocked on a thread that's waiting for us to complete, we deadlock. http://b/69389492
+    //
+    // From a security perspective, there is currently no difference, because:
+    // 1. The only permissions we check in netd's binder interface are CONNECTIVITY_INTERNAL
+    //    and NETWORK_STACK, which the system server always has (or MAINLINE_NETWORK_STACK, which
+    //    is equivalent to having both CONNECTIVITY_INTERNAL and NETWORK_STACK).
+    // 2. AID_SYSTEM always has all permissions. See ActivityManager#checkComponentPermission.
+    if (uid == AID_SYSTEM) {
+        return ::ndk::ScopedAStatus(AStatus_newOk());
+    }
+
+    for (const char* permission : permissions) {
+        if (gResNetdCallbacks.check_calling_permission(permission)) {
+            return ::ndk::ScopedAStatus(AStatus_newOk());
+        }
+    }
+
+    auto err = StringPrintf("UID %d / PID %d does not have any of the following permissions: %s",
+                            uid, pid, Join(permissions, ',').c_str());
+    return ::ndk::ScopedAStatus(AStatus_fromExceptionCodeWithMessage(EX_SECURITY, err.c_str()));
+}
+
+namespace {
+
+// Parse a base64 encoded string into a vector of bytes.
+// On failure, return an empty vector.
+static std::vector<uint8_t> parseBase64(const std::string& input) {
+    std::vector<uint8_t> decoded;
+    size_t out_len;
+    if (EVP_DecodedLength(&out_len, input.size()) != 1) {
+        return decoded;
+    }
+    // out_len is now an upper bound on the output length.
+    decoded.resize(out_len);
+    if (EVP_DecodeBase64(decoded.data(), &out_len, decoded.size(),
+                         reinterpret_cast<const uint8_t*>(input.data()), input.size()) == 1) {
+        // Possibly shrink the vector if the actual output was smaller than the bound.
+        decoded.resize(out_len);
+    } else {
+        decoded.clear();
+    }
+    if (out_len != SHA256_SIZE) {
+        decoded.clear();
+    }
+    return decoded;
+}
+
+}  // namespace
+
+::ndk::ScopedAStatus DnsResolverService::setResolverConfiguration(
+        const ResolverParamsParcel& resolverParams) {
+    // Locking happens in PrivateDnsConfiguration and res_* functions.
+    ENFORCE_INTERNAL_PERMISSIONS();
+    // TODO: Remove this log after AIDL gen_log supporting more types, b/129732660
+    auto entry =
+            gDnsResolverLog.newEntry()
+                    .prettyFunction(__PRETTY_FUNCTION__)
+                    .args(resolverParams.netId, resolverParams.servers, resolverParams.domains,
+                          resolverParams.sampleValiditySeconds, resolverParams.successThreshold,
+                          resolverParams.minSamples, resolverParams.maxSamples,
+                          resolverParams.baseTimeoutMsec, resolverParams.retryCount,
+                          resolverParams.tlsServers, resolverParams.tlsFingerprints);
+
+    std::set<std::vector<uint8_t>> decoded_fingerprints;
+    for (const std::string& fingerprint : resolverParams.tlsFingerprints) {
+        std::vector<uint8_t> decoded = parseBase64(fingerprint);
+        if (decoded.empty()) {
+            return ::ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(
+                    EINVAL, "ResolverController error: bad fingerprint"));
+        }
+        decoded_fingerprints.emplace(decoded);
+    }
+
+    int res =
+            gDnsResolv->resolverCtrl.setResolverConfiguration(resolverParams, decoded_fingerprints);
+
+    gResNetdCallbacks.log(entry.returns(res).withAutomaticDuration().toString().c_str());
+
+    return statusFromErrcode(res);
+}
+
+::ndk::ScopedAStatus DnsResolverService::getResolverInfo(
+        int32_t netId, std::vector<std::string>* servers, std::vector<std::string>* domains,
+        std::vector<std::string>* tlsServers, std::vector<int32_t>* params,
+        std::vector<int32_t>* stats, std::vector<int32_t>* wait_for_pending_req_timeout_count) {
+    // Locking happens in PrivateDnsConfiguration and res_* functions.
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    int res = gDnsResolv->resolverCtrl.getResolverInfo(netId, servers, domains, tlsServers, params,
+                                                       stats, wait_for_pending_req_timeout_count);
+
+    return statusFromErrcode(res);
+}
+
+::ndk::ScopedAStatus DnsResolverService::startPrefix64Discovery(int32_t netId) {
+    // Locking happens in Dns64Configuration.
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    gDnsResolv->resolverCtrl.startPrefix64Discovery(netId);
+
+    return ::ndk::ScopedAStatus(AStatus_newOk());
+}
+
+::ndk::ScopedAStatus DnsResolverService::stopPrefix64Discovery(int32_t netId) {
+    // Locking happens in Dns64Configuration.
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    gDnsResolv->resolverCtrl.stopPrefix64Discovery(netId);
+
+    return ::ndk::ScopedAStatus(AStatus_newOk());
+}
+
+::ndk::ScopedAStatus DnsResolverService::getPrefix64(int netId, std::string* stringPrefix) {
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    netdutils::IPPrefix prefix{};
+    int res = gDnsResolv->resolverCtrl.getPrefix64(netId, &prefix);
+    *stringPrefix = prefix.toString();
+
+    return statusFromErrcode(res);
+}
+
+::ndk::ScopedAStatus DnsResolverService::setLogSeverity(int32_t logSeverity) {
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    int res = gDnsResolv->setLogSeverity(logSeverity);
+
+    return statusFromErrcode(res);
+}
+
+::ndk::ScopedAStatus DnsResolverService::destroyNetworkCache(int netId) {
+    // Locking happens in res_cache.cpp functions.
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    gDnsResolv->resolverCtrl.destroyNetworkCache(netId);
+
+    return ::ndk::ScopedAStatus(AStatus_newOk());
+}
+
+::ndk::ScopedAStatus DnsResolverService::createNetworkCache(int netId) {
+    // Locking happens in res_cache.cpp functions.
+    ENFORCE_NETWORK_STACK_PERMISSIONS();
+
+    int res = gDnsResolv->resolverCtrl.createNetworkCache(netId);
+
+    return statusFromErrcode(res);
+}
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/DnsResolverService.h b/resolv/DnsResolverService.h
new file mode 100644
index 0000000..1a1c9e7
--- /dev/null
+++ b/resolv/DnsResolverService.h
@@ -0,0 +1,72 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_RESOLVER_SERVICE_H_
+#define _DNS_RESOLVER_SERVICE_H_
+
+#include <vector>
+
+#include <aidl/android/net/BnDnsResolver.h>
+#include <aidl/android/net/ResolverParamsParcel.h>
+#include <android/binder_ibinder.h>
+
+#include "netd_resolv/resolv.h"
+
+namespace android {
+namespace net {
+
+class DnsResolverService : public aidl::android::net::BnDnsResolver {
+  public:
+    static binder_status_t start();
+    static char const* getServiceName() { return "dnsresolver"; }
+
+    binder_status_t dump(int fd, const char** args, uint32_t numArgs) override;
+
+    ::ndk::ScopedAStatus isAlive(bool* alive) override;
+    ::ndk::ScopedAStatus registerEventListener(
+            const std::shared_ptr<aidl::android::net::metrics::INetdEventListener>& listener)
+            override;
+
+    // Resolver commands.
+    ::ndk::ScopedAStatus setResolverConfiguration(
+            const aidl::android::net::ResolverParamsParcel& resolverParams) override;
+    ::ndk::ScopedAStatus getResolverInfo(
+            int32_t netId, std::vector<std::string>* servers, std::vector<std::string>* domains,
+            std::vector<std::string>* tlsServers, std::vector<int32_t>* params,
+            std::vector<int32_t>* stats,
+            std::vector<int32_t>* wait_for_pending_req_timeout_count) override;
+    ::ndk::ScopedAStatus destroyNetworkCache(int32_t netId) override;
+    ::ndk::ScopedAStatus createNetworkCache(int32_t netId) override;
+
+    // DNS64-related commands
+    ::ndk::ScopedAStatus startPrefix64Discovery(int32_t netId) override;
+    ::ndk::ScopedAStatus stopPrefix64Discovery(int32_t netId) override;
+    // (internal use only)
+    ::ndk::ScopedAStatus getPrefix64(int netId, std::string* stringPrefix) override;
+
+    // Debug log command
+    ::ndk::ScopedAStatus setLogSeverity(int32_t logSeverity) override;
+
+  private:
+    DnsResolverService();
+    // TODO: Remove below items after libbiner_ndk supports check_permission.
+    ::ndk::ScopedAStatus checkAnyPermission(const std::vector<const char*>& permissions);
+};
+
+}  // namespace net
+}  // namespace android
+
+#endif  // _DNS_RESOLVER_SERVICE_H_
diff --git a/resolv/DnsTlsDispatcher.cpp b/resolv/DnsTlsDispatcher.cpp
new file mode 100644
index 0000000..baafa53
--- /dev/null
+++ b/resolv/DnsTlsDispatcher.cpp
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "DnsTlsDispatcher"
+//#define LOG_NDEBUG 0
+
+#include "DnsTlsDispatcher.h"
+#include <netdutils/Stopwatch.h>
+#include "DnsTlsSocketFactory.h"
+#include "resolv_private.h"
+#include "stats.pb.h"
+
+#include "log/log.h"
+
+namespace android {
+namespace net {
+
+using android::netdutils::Stopwatch;
+using netdutils::Slice;
+
+// static
+std::mutex DnsTlsDispatcher::sLock;
+
+DnsTlsDispatcher::DnsTlsDispatcher() {
+    mFactory.reset(new DnsTlsSocketFactory());
+}
+
+std::list<DnsTlsServer> DnsTlsDispatcher::getOrderedServerList(
+        const std::list<DnsTlsServer> &tlsServers, unsigned mark) const {
+    // Our preferred DnsTlsServer order is:
+    //     1) reuse existing IPv6 connections
+    //     2) reuse existing IPv4 connections
+    //     3) establish new IPv6 connections
+    //     4) establish new IPv4 connections
+    std::list<DnsTlsServer> existing6;
+    std::list<DnsTlsServer> existing4;
+    std::list<DnsTlsServer> new6;
+    std::list<DnsTlsServer> new4;
+
+    // Pull out any servers for which we might have existing connections and
+    // place them at the from the list of servers to try.
+    {
+        std::lock_guard guard(sLock);
+
+        for (const auto& tlsServer : tlsServers) {
+            const Key key = std::make_pair(mark, tlsServer);
+            if (mStore.find(key) != mStore.end()) {
+                switch (tlsServer.ss.ss_family) {
+                    case AF_INET:
+                        existing4.push_back(tlsServer);
+                        break;
+                    case AF_INET6:
+                        existing6.push_back(tlsServer);
+                        break;
+                }
+            } else {
+                switch (tlsServer.ss.ss_family) {
+                    case AF_INET:
+                        new4.push_back(tlsServer);
+                        break;
+                    case AF_INET6:
+                        new6.push_back(tlsServer);
+                        break;
+                }
+            }
+        }
+    }
+
+    auto& out = existing6;
+    out.splice(out.cend(), existing4);
+    out.splice(out.cend(), new6);
+    out.splice(out.cend(), new4);
+    return out;
+}
+
+DnsTlsTransport::Response DnsTlsDispatcher::query(const std::list<DnsTlsServer>& tlsServers,
+                                                  res_state statp, const Slice query,
+                                                  const Slice ans, int* resplen) {
+    const std::list<DnsTlsServer> orderedServers(getOrderedServerList(tlsServers, statp->_mark));
+
+    if (orderedServers.empty()) ALOGW("Empty DnsTlsServer list");
+
+    DnsTlsTransport::Response code = DnsTlsTransport::Response::internal_error;
+    int serverCount = 0;
+    for (const auto& server : orderedServers) {
+        DnsQueryEvent* dnsQueryEvent =
+                statp->event->mutable_dns_query_events()->add_dns_query_event();
+        dnsQueryEvent->set_rcode(NS_R_INTERNAL_ERROR);
+        Stopwatch query_stopwatch;
+        code = this->query(server, statp->_mark, query, ans, resplen);
+
+        dnsQueryEvent->set_latency_micros(saturate_cast<int32_t>(query_stopwatch.timeTakenUs()));
+        dnsQueryEvent->set_dns_server_index(serverCount++);
+        dnsQueryEvent->set_ip_version(ipFamilyToIPVersion(server.ss.ss_family));
+        dnsQueryEvent->set_protocol(PROTO_DOT);
+        dnsQueryEvent->set_type(getQueryType(query.base(), query.size()));
+
+        switch (code) {
+            // These response codes are valid responses and not expected to
+            // change if another server is queried.
+            case DnsTlsTransport::Response::success:
+                dnsQueryEvent->set_rcode(
+                        static_cast<NsRcode>(reinterpret_cast<HEADER*>(ans.base())->rcode));
+                [[fallthrough]];
+            case DnsTlsTransport::Response::limit_error:
+                return code;
+            // These response codes might differ when trying other servers, so
+            // keep iterating to see if we can get a different (better) result.
+            case DnsTlsTransport::Response::network_error:
+                // Sync from res_tls_send in res_send.cpp
+                dnsQueryEvent->set_rcode(NS_R_TIMEOUT);
+                [[fallthrough]];
+            case DnsTlsTransport::Response::internal_error:
+                continue;
+            // No "default" statement.
+        }
+    }
+
+    return code;
+}
+
+DnsTlsTransport::Response DnsTlsDispatcher::query(const DnsTlsServer& server, unsigned mark,
+                                                  const Slice query,
+                                                  const Slice ans, int *resplen) {
+    const Key key = std::make_pair(mark, server);
+    Transport* xport;
+    {
+        std::lock_guard guard(sLock);
+        auto it = mStore.find(key);
+        if (it == mStore.end()) {
+            xport = new Transport(server, mark, mFactory.get());
+            mStore[key].reset(xport);
+        } else {
+            xport = it->second.get();
+        }
+        ++xport->useCount;
+    }
+
+    ALOGV("Sending query of length %zu", query.size());
+    auto res = xport->transport.query(query);
+    ALOGV("Awaiting response");
+    const auto& result = res.get();
+    DnsTlsTransport::Response code = result.code;
+    if (code == DnsTlsTransport::Response::success) {
+        if (result.response.size() > ans.size()) {
+            ALOGV("Response too large: %zu > %zu", result.response.size(), ans.size());
+            code = DnsTlsTransport::Response::limit_error;
+        } else {
+            ALOGV("Got response successfully");
+            *resplen = result.response.size();
+            netdutils::copy(ans, netdutils::makeSlice(result.response));
+        }
+    } else {
+        ALOGV("Query failed: %u", (unsigned int) code);
+    }
+
+    auto now = std::chrono::steady_clock::now();
+    {
+        std::lock_guard guard(sLock);
+        --xport->useCount;
+        xport->lastUsed = now;
+        cleanup(now);
+    }
+    return code;
+}
+
+// This timeout effectively controls how long to keep SSL session tickets.
+static constexpr std::chrono::minutes IDLE_TIMEOUT(5);
+void DnsTlsDispatcher::cleanup(std::chrono::time_point<std::chrono::steady_clock> now) {
+    // To avoid scanning mStore after every query, return early if a cleanup has been
+    // performed recently.
+    if (now - mLastCleanup < IDLE_TIMEOUT) {
+        return;
+    }
+    for (auto it = mStore.begin(); it != mStore.end();) {
+        auto& s = it->second;
+        if (s->useCount == 0 && now - s->lastUsed > IDLE_TIMEOUT) {
+            it = mStore.erase(it);
+        } else {
+            ++it;
+        }
+    }
+    mLastCleanup = now;
+}
+
+}  // end of namespace net
+}  // end of namespace android
diff --git a/resolv/DnsTlsDispatcher.h b/resolv/DnsTlsDispatcher.h
new file mode 100644
index 0000000..b8e9968
--- /dev/null
+++ b/resolv/DnsTlsDispatcher.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_DNSTLSDISPATCHER_H
+#define _DNS_DNSTLSDISPATCHER_H
+
+#include <list>
+#include <map>
+#include <memory>
+#include <mutex>
+
+#include <android-base/thread_annotations.h>
+#include <netdutils/Slice.h>
+
+#include "DnsTlsServer.h"
+#include "DnsTlsTransport.h"
+#include "IDnsTlsSocketFactory.h"
+#include "resolv_private.h"
+
+namespace android {
+namespace net {
+
+// This is a singleton class that manages the collection of active DnsTlsTransports.
+// Queries made here are dispatched to an existing or newly constructed DnsTlsTransport.
+class DnsTlsDispatcher {
+  public:
+    // Default constructor.
+    DnsTlsDispatcher();
+
+    // Constructor with dependency injection for testing.
+    explicit DnsTlsDispatcher(std::unique_ptr<IDnsTlsSocketFactory> factory)
+        : mFactory(std::move(factory)) {}
+
+    // Enqueues |query| for resolution via the given |tlsServers| on the
+    // network indicated by |mark|; writes the response into |ans|, and stores
+    // the count of bytes written in |resplen|. Returns a success or error code.
+    // The order in which servers from |tlsServers| are queried may not be the
+    // order passed in by the caller.
+    DnsTlsTransport::Response query(const std::list<DnsTlsServer>& tlsServers,
+                                    res_state _Nonnull statp, const netdutils::Slice query,
+                                    const netdutils::Slice ans, int* _Nonnull resplen);
+
+    // Given a |query|, sends it to the server on the network indicated by |mark|,
+    // and writes the response into |ans|,  and indicates
+    // the number of bytes written in |resplen|.  Returns a success or error code.
+    DnsTlsTransport::Response query(const DnsTlsServer& server, unsigned mark,
+                                    const netdutils::Slice query, const netdutils::Slice ans,
+                                    int* _Nonnull resplen);
+
+  private:
+    // This lock is static so that it can be used to annotate the Transport struct.
+    // DnsTlsDispatcher is a singleton in practice, so making this static does not change
+    // the locking behavior.
+    static std::mutex sLock;
+
+    // Key = <mark, server>
+    typedef std::pair<unsigned, const DnsTlsServer> Key;
+
+    // Transport is a thin wrapper around DnsTlsTransport, adding reference counting and
+    // usage monitoring so we can expire idle sessions from the cache.
+    struct Transport {
+        Transport(const DnsTlsServer& server, unsigned mark, IDnsTlsSocketFactory* _Nonnull factory)
+            : transport(server, mark, factory) {}
+        // DnsTlsTransport is thread-safe, so it doesn't need to be guarded.
+        DnsTlsTransport transport;
+        // This use counter and timestamp are used to ensure that only idle sessions are
+        // destroyed.
+        int useCount GUARDED_BY(sLock) = 0;
+        // lastUsed is only guaranteed to be meaningful after useCount is decremented to zero.
+        std::chrono::time_point<std::chrono::steady_clock> lastUsed GUARDED_BY(sLock);
+    };
+
+    // Cache of reusable DnsTlsTransports.  Transports stay in cache as long as
+    // they are in use and for a few minutes after.
+    // The key is a (netid, server) pair.  The netid is first for lexicographic comparison speed.
+    std::map<Key, std::unique_ptr<Transport>> mStore GUARDED_BY(sLock);
+
+    // The last time we did a cleanup.  For efficiency, we only perform a cleanup once every
+    // few minutes.
+    std::chrono::time_point<std::chrono::steady_clock> mLastCleanup GUARDED_BY(sLock);
+
+    // Drop any cache entries whose useCount is zero and which have not been used recently.
+    // This function performs a linear scan of mStore.
+    void cleanup(std::chrono::time_point<std::chrono::steady_clock> now) REQUIRES(sLock);
+
+    // Return a sorted list of DnsTlsServers in preference order.
+    std::list<DnsTlsServer> getOrderedServerList(const std::list<DnsTlsServer>& tlsServers,
+                                                 unsigned mark) const;
+
+    // Trivial factory for DnsTlsSockets.  Dependency injection is only used for testing.
+    std::unique_ptr<IDnsTlsSocketFactory> mFactory;
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_DNSTLSDISPATCHER_H
diff --git a/resolv/DnsTlsQueryMap.cpp b/resolv/DnsTlsQueryMap.cpp
new file mode 100644
index 0000000..6e6399c
--- /dev/null
+++ b/resolv/DnsTlsQueryMap.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "DnsTlsQueryMap"
+//#define LOG_NDEBUG 0
+
+#include "DnsTlsQueryMap.h"
+
+#include "log/log.h"
+
+namespace android {
+namespace net {
+
+std::unique_ptr<DnsTlsQueryMap::QueryFuture> DnsTlsQueryMap::recordQuery(
+        const netdutils::Slice query) {
+    std::lock_guard guard(mLock);
+
+    // Store the query so it can be matched to the response or reissued.
+    if (query.size() < 2) {
+        ALOGW("Query is too short");
+        return nullptr;
+    }
+    int32_t newId = getFreeId();
+    if (newId < 0) {
+        ALOGW("All query IDs are in use");
+        return nullptr;
+    }
+    Query q = { .newId = static_cast<uint16_t>(newId), .query = query };
+    std::map<uint16_t, QueryPromise>::iterator it;
+    bool inserted;
+    std::tie(it, inserted) = mQueries.emplace(newId, q);
+    if (!inserted) {
+        ALOGE("Failed to store pending query");
+        return nullptr;
+    }
+    return std::make_unique<QueryFuture>(q, it->second.result.get_future());
+}
+
+void DnsTlsQueryMap::expire(QueryPromise* p) {
+    Result r = { .code = Response::network_error };
+    p->result.set_value(r);
+}
+
+void DnsTlsQueryMap::markTried(uint16_t newId) {
+    std::lock_guard guard(mLock);
+    auto it = mQueries.find(newId);
+    if (it != mQueries.end()) {
+        it->second.tries++;
+    }
+}
+
+void DnsTlsQueryMap::cleanup() {
+    std::lock_guard guard(mLock);
+    for (auto it = mQueries.begin(); it != mQueries.end();) {
+        auto& p = it->second;
+        if (p.tries >= kMaxTries) {
+            expire(&p);
+            it = mQueries.erase(it);
+        } else {
+            ++it;
+        }
+    }
+}
+
+int32_t DnsTlsQueryMap::getFreeId() {
+    if (mQueries.empty()) {
+        return 0;
+    }
+    uint16_t maxId = mQueries.rbegin()->first;
+    if (maxId < UINT16_MAX) {
+        return maxId + 1;
+    }
+    if (mQueries.size() == UINT16_MAX + 1) {
+        // Map is full.
+        return -1;
+    }
+    // Linear scan.
+    uint16_t nextId = 0;
+    for (auto& pair : mQueries) {
+        uint16_t id = pair.first;
+        if (id != nextId) {
+            // Found a gap.
+            return nextId;
+        }
+        nextId = id + 1;
+    }
+    // Unreachable (but the compiler isn't smart enough to prove it).
+    return -1;
+}
+
+std::vector<DnsTlsQueryMap::Query> DnsTlsQueryMap::getAll() {
+    std::lock_guard guard(mLock);
+    std::vector<DnsTlsQueryMap::Query> queries;
+    for (auto& q : mQueries) {
+        queries.push_back(q.second.query);
+    }
+    return queries;
+}
+
+bool DnsTlsQueryMap::empty() {
+    std::lock_guard guard(mLock);
+    return mQueries.empty();
+}
+
+void DnsTlsQueryMap::clear() {
+    std::lock_guard guard(mLock);
+    for (auto& q : mQueries) {
+        expire(&q.second);
+    }
+    mQueries.clear();
+}
+
+void DnsTlsQueryMap::onResponse(std::vector<uint8_t> response) {
+    ALOGV("Got response of size %zu", response.size());
+    if (response.size() < 2) {
+        ALOGW("Response is too short");
+        return;
+    }
+    uint16_t id = response[0] << 8 | response[1];
+    std::lock_guard guard(mLock);
+    auto it = mQueries.find(id);
+    if (it == mQueries.end()) {
+        ALOGW("Discarding response: unknown ID %d", id);
+        return;
+    }
+    Result r = { .code = Response::success, .response = std::move(response) };
+    // Rewrite ID to match the query
+    const uint8_t* data = it->second.query.query.base();
+    r.response[0] = data[0];
+    r.response[1] = data[1];
+    ALOGV("Sending result to dispatcher");
+    it->second.result.set_value(std::move(r));
+    mQueries.erase(it);
+}
+
+}  // end of namespace net
+}  // end of namespace android
diff --git a/resolv/DnsTlsQueryMap.h b/resolv/DnsTlsQueryMap.h
new file mode 100644
index 0000000..c5ab023
--- /dev/null
+++ b/resolv/DnsTlsQueryMap.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_DNSTLSQUERYMAP_H
+#define _DNS_DNSTLSQUERYMAP_H
+
+#include <future>
+#include <map>
+#include <mutex>
+#include <vector>
+
+#include <android-base/thread_annotations.h>
+#include <netdutils/Slice.h>
+
+#include "DnsTlsServer.h"
+
+namespace android {
+namespace net {
+
+// Keeps track of queries and responses.  This class matches responses with queries.
+// All methods are thread-safe and non-blocking.
+class DnsTlsQueryMap {
+  public:
+    struct Query {
+        // The new ID number assigned to this query.
+        uint16_t newId;
+        // A query that has been passed to recordQuery(), with its original ID number.
+        const netdutils::Slice query;
+    };
+
+    typedef DnsTlsServer::Response Response;
+    typedef DnsTlsServer::Result Result;
+
+    struct QueryFuture {
+        QueryFuture(Query query, std::future<Result> result)
+            : query(query), result(std::move(result)) {}
+        Query query;
+        // A future which will resolve to the result of this query.
+        std::future<Result> result;
+    };
+
+    // Returns an object containing everything needed to complete processing of
+    // this query, or null if the query could not be recorded.
+    std::unique_ptr<QueryFuture> recordQuery(const netdutils::Slice query);
+
+    // Process a response, including a new ID.  If the response
+    // is not recognized as matching any query, it will be ignored.
+    void onResponse(std::vector<uint8_t> response);
+
+    // Clear all map contents.  This causes all pending queries to resolve with failure.
+    void clear();
+
+    // Get all pending queries.  This returns a shallow copy, mostly for thread-safety.
+    std::vector<Query> getAll();
+
+    // Mark a query has having been retried.  If the query hits the retry limit, it will
+    // be expired at the next call to cleanup.
+    void markTried(uint16_t newId);
+    void cleanup();
+
+    // Returns true if there are no pending queries.
+    bool empty();
+
+  private:
+    std::mutex mLock;
+
+    struct QueryPromise {
+        QueryPromise(Query query) : query(query) {}
+        Query query;
+        // Number of times the query has been tried.  Limited to kMaxTries.
+        int tries = 0;
+        // A promise whose future is returned by recordQuery()
+        // It is fulfilled by onResponse().
+        std::promise<Result> result;
+    };
+
+    // The maximum number of times we will send a query before abandoning it.
+    static constexpr int kMaxTries = 3;
+
+    // Outstanding queries by newId.
+    std::map<uint16_t, QueryPromise> mQueries GUARDED_BY(mLock);
+
+    // Get a "newId" number that is not currently in use.  Returns -1 if there are none.
+    int32_t getFreeId() REQUIRES(mLock);
+
+    // Fulfill the result with an error code.
+    static void expire(QueryPromise* _Nonnull p);
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_DNSTLSQUERYMAP_H
diff --git a/resolv/DnsTlsServer.cpp b/resolv/DnsTlsServer.cpp
new file mode 100644
index 0000000..a97c672
--- /dev/null
+++ b/resolv/DnsTlsServer.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "DnsTlsServer.h"
+
+#include <algorithm>
+
+namespace {
+
+// Returns a tuple of references to the elements of a.
+auto make_tie(const sockaddr_in& a) {
+    return std::tie(a.sin_port, a.sin_addr.s_addr);
+}
+
+// Returns a tuple of references to the elements of a.
+auto make_tie(const sockaddr_in6& a) {
+    // Skip flowinfo, which is not relevant.
+    return std::tie(
+        a.sin6_port,
+        a.sin6_addr,
+        a.sin6_scope_id
+    );
+}
+
+} // namespace
+
+// These binary operators make sockaddr_storage comparable.  They need to be
+// in the global namespace so that the std::tuple < and == operators can see them.
+static bool operator <(const in6_addr& x, const in6_addr& y) {
+    return std::lexicographical_compare(
+            std::begin(x.s6_addr), std::end(x.s6_addr),
+            std::begin(y.s6_addr), std::end(y.s6_addr));
+}
+
+static bool operator ==(const in6_addr& x, const in6_addr& y) {
+    return std::equal(
+            std::begin(x.s6_addr), std::end(x.s6_addr),
+            std::begin(y.s6_addr), std::end(y.s6_addr));
+}
+
+static bool operator <(const sockaddr_storage& x, const sockaddr_storage& y) {
+    if (x.ss_family != y.ss_family) {
+        return x.ss_family < y.ss_family;
+    }
+    // Same address family.
+    if (x.ss_family == AF_INET) {
+        const sockaddr_in& x_sin = reinterpret_cast<const sockaddr_in&>(x);
+        const sockaddr_in& y_sin = reinterpret_cast<const sockaddr_in&>(y);
+        return make_tie(x_sin) < make_tie(y_sin);
+    } else if (x.ss_family == AF_INET6) {
+        const sockaddr_in6& x_sin6 = reinterpret_cast<const sockaddr_in6&>(x);
+        const sockaddr_in6& y_sin6 = reinterpret_cast<const sockaddr_in6&>(y);
+        return make_tie(x_sin6) < make_tie(y_sin6);
+    }
+    return false;  // Unknown address type.  This is an error.
+}
+
+static bool operator ==(const sockaddr_storage& x, const sockaddr_storage& y) {
+    if (x.ss_family != y.ss_family) {
+        return false;
+    }
+    // Same address family.
+    if (x.ss_family == AF_INET) {
+        const sockaddr_in& x_sin = reinterpret_cast<const sockaddr_in&>(x);
+        const sockaddr_in& y_sin = reinterpret_cast<const sockaddr_in&>(y);
+        return make_tie(x_sin) == make_tie(y_sin);
+    } else if (x.ss_family == AF_INET6) {
+        const sockaddr_in6& x_sin6 = reinterpret_cast<const sockaddr_in6&>(x);
+        const sockaddr_in6& y_sin6 = reinterpret_cast<const sockaddr_in6&>(y);
+        return make_tie(x_sin6) == make_tie(y_sin6);
+    }
+    return false;  // Unknown address type.  This is an error.
+}
+
+namespace android {
+namespace net {
+
+// This comparison ignores ports and fingerprints.
+bool AddressComparator::operator() (const DnsTlsServer& x, const DnsTlsServer& y) const {
+    if (x.ss.ss_family != y.ss.ss_family) {
+        return x.ss.ss_family < y.ss.ss_family;
+    }
+    // Same address family.
+    if (x.ss.ss_family == AF_INET) {
+        const sockaddr_in& x_sin = reinterpret_cast<const sockaddr_in&>(x.ss);
+        const sockaddr_in& y_sin = reinterpret_cast<const sockaddr_in&>(y.ss);
+        return x_sin.sin_addr.s_addr < y_sin.sin_addr.s_addr;
+    } else if (x.ss.ss_family == AF_INET6) {
+        const sockaddr_in6& x_sin6 = reinterpret_cast<const sockaddr_in6&>(x.ss);
+        const sockaddr_in6& y_sin6 = reinterpret_cast<const sockaddr_in6&>(y.ss);
+        return std::tie(x_sin6.sin6_addr, x_sin6.sin6_scope_id) <
+                std::tie(y_sin6.sin6_addr, y_sin6.sin6_scope_id);
+    }
+    return false;  // Unknown address type.  This is an error.
+}
+
+// Returns a tuple of references to the elements of s.
+auto make_tie(const DnsTlsServer& s) {
+    return std::tie(
+        s.ss,
+        s.name,
+        s.fingerprints,
+        s.protocol
+    );
+}
+
+bool DnsTlsServer::operator <(const DnsTlsServer& other) const {
+    return make_tie(*this) < make_tie(other);
+}
+
+bool DnsTlsServer::operator ==(const DnsTlsServer& other) const {
+    return make_tie(*this) == make_tie(other);
+}
+
+bool DnsTlsServer::wasExplicitlyConfigured() const {
+    return !name.empty() || !fingerprints.empty();
+}
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/DnsTlsServer.h b/resolv/DnsTlsServer.h
new file mode 100644
index 0000000..7fc4a35
--- /dev/null
+++ b/resolv/DnsTlsServer.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_DNSTLSSERVER_H
+#define _DNS_DNSTLSSERVER_H
+
+#include <set>
+#include <string>
+#include <vector>
+
+#include <netinet/in.h>
+
+#include <netd_resolv/params.h>
+
+namespace android {
+namespace net {
+
+// DnsTlsServer represents a recursive resolver that supports, or may support, a
+// secure protocol.
+struct DnsTlsServer {
+    // Default constructor.
+    DnsTlsServer() {}
+
+    // Allow sockaddr_storage to be promoted to DnsTlsServer automatically.
+    DnsTlsServer(const sockaddr_storage& ss) : ss(ss) {}
+
+    enum class Response : uint8_t { success, network_error, limit_error, internal_error };
+
+    struct Result {
+        Response code;
+        std::vector<uint8_t> response;
+    };
+
+    // The server location, including IP and port.
+    sockaddr_storage ss = {};
+
+    // A set of SHA256 public key fingerprints.  If this set is nonempty, the server
+    // must present a self-consistent certificate chain that contains a certificate
+    // whose public key matches one of these fingerprints.  Otherwise, the client will
+    // terminate the connection.
+    std::set<std::vector<uint8_t>> fingerprints;
+
+    // The server's hostname.  If this string is nonempty, the server must present a
+    // certificate that indicates this name and has a valid chain to a trusted root CA.
+    std::string name;
+
+    // Placeholder.  More protocols might be defined in the future.
+    int protocol = IPPROTO_TCP;
+
+    // Exact comparison of DnsTlsServer objects
+    bool operator<(const DnsTlsServer& other) const;
+    bool operator==(const DnsTlsServer& other) const;
+
+    bool wasExplicitlyConfigured() const;
+};
+
+// This comparison only checks the IP address.  It ignores ports, names, and fingerprints.
+struct AddressComparator {
+    bool operator()(const DnsTlsServer& x, const DnsTlsServer& y) const;
+};
+
+}  // namespace net
+}  // namespace android
+
+#endif  // _DNS_DNSTLSSERVER_H
diff --git a/resolv/DnsTlsSessionCache.cpp b/resolv/DnsTlsSessionCache.cpp
new file mode 100644
index 0000000..8d6dc6b
--- /dev/null
+++ b/resolv/DnsTlsSessionCache.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "DnsTlsSessionCache.h"
+
+#define LOG_TAG "DnsTlsSessionCache"
+//#define LOG_NDEBUG 0
+
+#include "log/log.h"
+
+namespace android {
+namespace net {
+
+bool DnsTlsSessionCache::prepareSsl(SSL* ssl) {
+    // Add this cache as the 0-index extra data for the socket.
+    // This is used by newSessionCallback.
+    int ret = SSL_set_ex_data(ssl, 0, this);
+    return ret == 1;
+}
+
+void DnsTlsSessionCache::prepareSslContext(SSL_CTX* ssl_ctx) {
+    SSL_CTX_set_session_cache_mode(ssl_ctx, SSL_SESS_CACHE_CLIENT);
+    SSL_CTX_sess_set_new_cb(ssl_ctx, &DnsTlsSessionCache::newSessionCallback);
+}
+
+// static
+int DnsTlsSessionCache::newSessionCallback(SSL* ssl, SSL_SESSION* session) {
+    if (!ssl || !session) {
+        ALOGE("Null SSL object in new session callback");
+        return 0;
+    }
+    DnsTlsSessionCache* cache = reinterpret_cast<DnsTlsSessionCache*>(
+            SSL_get_ex_data(ssl, 0));
+    if (!cache) {
+        ALOGE("null transport in new session callback");
+        return 0;
+    }
+    ALOGV("Recording session");
+    cache->recordSession(session);
+    return 1;  // Increment the refcount of session.
+}
+
+void DnsTlsSessionCache::recordSession(SSL_SESSION* session) {
+    std::lock_guard guard(mLock);
+    mSessions.emplace_front(session);
+    if (mSessions.size() > kMaxSize) {
+        ALOGV("Too many sessions; trimming");
+        mSessions.pop_back();
+    }
+}
+
+bssl::UniquePtr<SSL_SESSION> DnsTlsSessionCache::getSession() {
+    std::lock_guard guard(mLock);
+    if (mSessions.size() == 0) {
+        ALOGV("No known sessions");
+        return nullptr;
+    }
+    bssl::UniquePtr<SSL_SESSION> ret = std::move(mSessions.front());
+    mSessions.pop_front();
+    return ret;
+}
+
+}  // end of namespace net
+}  // end of namespace android
diff --git a/resolv/DnsTlsSessionCache.h b/resolv/DnsTlsSessionCache.h
new file mode 100644
index 0000000..e1a88cf
--- /dev/null
+++ b/resolv/DnsTlsSessionCache.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_DNSTLSSESSIONCACHE_H
+#define _DNS_DNSTLSSESSIONCACHE_H
+
+#include <deque>
+#include <mutex>
+
+#include <openssl/ssl.h>
+
+#include <android-base/thread_annotations.h>
+
+namespace android {
+namespace net {
+
+// Cache of recently seen SSL_SESSIONs.  This is used to support session tickets.
+// This class is thread-safe.
+class DnsTlsSessionCache {
+  public:
+    // Prepare SSL objects to use this session cache.  These methods must be called
+    // before making use of either object.
+    void prepareSslContext(SSL_CTX* _Nonnull ssl_ctx);
+    bool prepareSsl(SSL* _Nonnull ssl);
+
+    // Get the most recently discovered session.  For TLS 1.3 compatibility and
+    // maximum privacy, each session will only be returned once, so the caller
+    // gains ownership of the session.  (Here and throughout,
+    // bssl::UniquePtr<SSL_SESSION> is actually serving as a reference counted
+    // pointer.)
+    bssl::UniquePtr<SSL_SESSION> getSession() EXCLUDES(mLock);
+
+  private:
+    static constexpr size_t kMaxSize = 5;
+    static int newSessionCallback(SSL* _Nullable ssl, SSL_SESSION* _Nullable session);
+
+    std::mutex mLock;
+    void recordSession(SSL_SESSION* _Nullable session) EXCLUDES(mLock);
+
+    // Queue of sessions, from least recently added to most recently.
+    std::deque<bssl::UniquePtr<SSL_SESSION>> mSessions GUARDED_BY(mLock);
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_DNSTLSSESSIONCACHE_H
diff --git a/resolv/DnsTlsSocket.cpp b/resolv/DnsTlsSocket.cpp
new file mode 100644
index 0000000..a63d221
--- /dev/null
+++ b/resolv/DnsTlsSocket.cpp
@@ -0,0 +1,548 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "DnsTlsSocket"
+//#define LOG_NDEBUG 0
+
+#include "DnsTlsSocket.h"
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <errno.h>
+#include <linux/tcp.h>
+#include <openssl/err.h>
+#include <openssl/sha.h>
+#include <sys/eventfd.h>
+#include <sys/poll.h>
+#include <algorithm>
+
+#include "DnsTlsSessionCache.h"
+#include "IDnsTlsSocketObserver.h"
+
+#include "log/log.h"
+#include "netdutils/SocketOption.h"
+
+namespace android {
+
+using netdutils::enableSockopt;
+using netdutils::enableTcpKeepAlives;
+using netdutils::isOk;
+using netdutils::Slice;
+using netdutils::Status;
+
+namespace net {
+namespace {
+
+constexpr const char kCaCertDir[] = "/system/etc/security/cacerts";
+constexpr size_t SHA256_SIZE = SHA256_DIGEST_LENGTH;
+
+int waitForReading(int fd) {
+    struct pollfd fds = { .fd = fd, .events = POLLIN };
+    const int ret = TEMP_FAILURE_RETRY(poll(&fds, 1, -1));
+    return ret;
+}
+
+int waitForWriting(int fd) {
+    struct pollfd fds = { .fd = fd, .events = POLLOUT };
+    const int ret = TEMP_FAILURE_RETRY(poll(&fds, 1, -1));
+    return ret;
+}
+
+}  // namespace
+
+Status DnsTlsSocket::tcpConnect() {
+    ALOGV("%u connecting TCP socket", mMark);
+    int type = SOCK_NONBLOCK | SOCK_CLOEXEC;
+    switch (mServer.protocol) {
+        case IPPROTO_TCP:
+            type |= SOCK_STREAM;
+            break;
+        default:
+            return Status(EPROTONOSUPPORT);
+    }
+
+    mSslFd.reset(socket(mServer.ss.ss_family, type, mServer.protocol));
+    if (mSslFd.get() == -1) {
+        ALOGE("Failed to create socket");
+        return Status(errno);
+    }
+
+    const socklen_t len = sizeof(mMark);
+    if (setsockopt(mSslFd.get(), SOL_SOCKET, SO_MARK, &mMark, len) == -1) {
+        ALOGE("Failed to set socket mark");
+        mSslFd.reset();
+        return Status(errno);
+    }
+
+    const Status tfo = enableSockopt(mSslFd.get(), SOL_TCP, TCP_FASTOPEN_CONNECT);
+    if (!isOk(tfo) && tfo.code() != ENOPROTOOPT) {
+        ALOGI("Failed to enable TFO: %s", tfo.msg().c_str());
+    }
+
+    // Send 5 keepalives, 3 seconds apart, after 15 seconds of inactivity.
+    enableTcpKeepAlives(mSslFd.get(), 15U, 5U, 3U).ignoreError();
+
+    if (connect(mSslFd.get(), reinterpret_cast<const struct sockaddr *>(&mServer.ss),
+                sizeof(mServer.ss)) != 0 &&
+            errno != EINPROGRESS) {
+        ALOGV("Socket failed to connect");
+        mSslFd.reset();
+        return Status(errno);
+    }
+
+    return netdutils::status::ok;
+}
+
+bool getSPKIDigest(const X509* cert, std::vector<uint8_t>* out) {
+    int spki_len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), nullptr);
+    unsigned char spki[spki_len];
+    unsigned char* temp = spki;
+    if (spki_len != i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &temp)) {
+        ALOGW("SPKI length mismatch");
+        return false;
+    }
+    out->resize(SHA256_SIZE);
+    unsigned int digest_len = 0;
+    int ret = EVP_Digest(spki, spki_len, out->data(), &digest_len, EVP_sha256(), nullptr);
+    if (ret != 1) {
+        ALOGW("Server cert digest extraction failed");
+        return false;
+    }
+    if (digest_len != out->size()) {
+        ALOGW("Wrong digest length: %d", digest_len);
+        return false;
+    }
+    return true;
+}
+
+bool DnsTlsSocket::initialize() {
+    // This method should only be called once, at the beginning, so locking should be
+    // unnecessary.  This lock only serves to help catch bugs in code that calls this method.
+    std::lock_guard guard(mLock);
+    if (mSslCtx) {
+        // This is a bug in the caller.
+        return false;
+    }
+    mSslCtx.reset(SSL_CTX_new(TLS_method()));
+    if (!mSslCtx) {
+        return false;
+    }
+
+    // Load system CA certs for hostname verification.
+    //
+    // For discussion of alternative, sustainable approaches see b/71909242.
+    if (SSL_CTX_load_verify_locations(mSslCtx.get(), nullptr, kCaCertDir) != 1) {
+        ALOGE("Failed to load CA cert dir: %s", kCaCertDir);
+        return false;
+    }
+
+    // Enable TLS false start
+    SSL_CTX_set_false_start_allowed_without_alpn(mSslCtx.get(), 1);
+    SSL_CTX_set_mode(mSslCtx.get(), SSL_MODE_ENABLE_FALSE_START);
+
+    // Enable session cache
+    mCache->prepareSslContext(mSslCtx.get());
+
+    // Connect
+    Status status = tcpConnect();
+    if (!status.ok()) {
+        return false;
+    }
+    mSsl = sslConnect(mSslFd.get());
+    if (!mSsl) {
+        return false;
+    }
+
+    mEventFd.reset(eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC));
+
+    // Start the I/O loop.
+    mLoopThread.reset(new std::thread(&DnsTlsSocket::loop, this));
+
+    return true;
+}
+
+bssl::UniquePtr<SSL> DnsTlsSocket::sslConnect(int fd) {
+    if (!mSslCtx) {
+        ALOGE("Internal error: context is null in sslConnect");
+        return nullptr;
+    }
+    if (!SSL_CTX_set_min_proto_version(mSslCtx.get(), TLS1_2_VERSION)) {
+        ALOGE("Failed to set minimum TLS version");
+        return nullptr;
+    }
+
+    bssl::UniquePtr<SSL> ssl(SSL_new(mSslCtx.get()));
+    // This file descriptor is owned by mSslFd, so don't let libssl close it.
+    bssl::UniquePtr<BIO> bio(BIO_new_socket(fd, BIO_NOCLOSE));
+    SSL_set_bio(ssl.get(), bio.get(), bio.get());
+    bio.release();
+
+    if (!mCache->prepareSsl(ssl.get())) {
+        return nullptr;
+    }
+
+    if (!mServer.name.empty()) {
+        if (SSL_set_tlsext_host_name(ssl.get(), mServer.name.c_str()) != 1) {
+            ALOGE("Failed to set SNI to %s", mServer.name.c_str());
+            return nullptr;
+        }
+        X509_VERIFY_PARAM* param = SSL_get0_param(ssl.get());
+        if (X509_VERIFY_PARAM_set1_host(param, mServer.name.data(), mServer.name.size()) != 1) {
+            ALOGE("Failed to set verify host param to %s", mServer.name.c_str());
+            return nullptr;
+        }
+        // This will cause the handshake to fail if certificate verification fails.
+        SSL_set_verify(ssl.get(), SSL_VERIFY_PEER, nullptr);
+    }
+
+    bssl::UniquePtr<SSL_SESSION> session = mCache->getSession();
+    if (session) {
+        ALOGV("Setting session");
+        SSL_set_session(ssl.get(), session.get());
+    } else {
+        ALOGV("No session available");
+    }
+
+    for (;;) {
+        ALOGV("%u Calling SSL_connect", mMark);
+        int ret = SSL_connect(ssl.get());
+        ALOGV("%u SSL_connect returned %d", mMark, ret);
+        if (ret == 1) break;  // SSL handshake complete;
+
+        const int ssl_err = SSL_get_error(ssl.get(), ret);
+        switch (ssl_err) {
+            case SSL_ERROR_WANT_READ:
+                if (waitForReading(fd) != 1) {
+                    ALOGW("SSL_connect read error: %d", errno);
+                    return nullptr;
+                }
+                break;
+            case SSL_ERROR_WANT_WRITE:
+                if (waitForWriting(fd) != 1) {
+                    ALOGW("SSL_connect write error");
+                    return nullptr;
+                }
+                break;
+            default:
+                ALOGW("SSL_connect error %d, errno=%d", ssl_err, errno);
+                return nullptr;
+        }
+    }
+
+    // TODO: Call SSL_shutdown before discarding the session if validation fails.
+    if (!mServer.fingerprints.empty()) {
+        ALOGV("Checking DNS over TLS fingerprint");
+
+        // We only care that the chain is internally self-consistent, not that
+        // it chains to a trusted root, so we can ignore some kinds of errors.
+        // TODO: Add a CA root verification mode that respects these errors.
+        int verify_result = SSL_get_verify_result(ssl.get());
+        switch (verify_result) {
+            case X509_V_OK:
+            case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+            case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+            case X509_V_ERR_CERT_UNTRUSTED:
+                break;
+            default:
+                ALOGW("Invalid certificate chain, error %d", verify_result);
+                return nullptr;
+        }
+
+        STACK_OF(X509) *chain = SSL_get_peer_cert_chain(ssl.get());
+        if (!chain) {
+            ALOGW("Server has null certificate");
+            return nullptr;
+        }
+        // Chain and its contents are owned by ssl, so we don't need to free explicitly.
+        bool matched = false;
+        for (size_t i = 0; i < sk_X509_num(chain); ++i) {
+            // This appears to be O(N^2), but there doesn't seem to be a straightforward
+            // way to walk a STACK_OF nondestructively in linear time.
+            X509* cert = sk_X509_value(chain, i);
+            std::vector<uint8_t> digest;
+            if (!getSPKIDigest(cert, &digest)) {
+                ALOGE("Digest computation failed");
+                return nullptr;
+            }
+
+            if (mServer.fingerprints.count(digest) > 0) {
+                matched = true;
+                break;
+            }
+        }
+
+        if (!matched) {
+            ALOGW("No matching fingerprint");
+            return nullptr;
+        }
+
+        ALOGV("DNS over TLS fingerprint is correct");
+    }
+
+    ALOGV("%u handshake complete", mMark);
+
+    return ssl;
+}
+
+void DnsTlsSocket::sslDisconnect() {
+    if (mSsl) {
+        SSL_shutdown(mSsl.get());
+        mSsl.reset();
+    }
+    mSslFd.reset();
+}
+
+bool DnsTlsSocket::sslWrite(const Slice buffer) {
+    ALOGV("%u Writing %zu bytes", mMark, buffer.size());
+    for (;;) {
+        int ret = SSL_write(mSsl.get(), buffer.base(), buffer.size());
+        if (ret == int(buffer.size())) break;  // SSL write complete;
+
+        if (ret < 1) {
+            const int ssl_err = SSL_get_error(mSsl.get(), ret);
+            switch (ssl_err) {
+                case SSL_ERROR_WANT_WRITE:
+                    if (waitForWriting(mSslFd.get()) != 1) {
+                        ALOGV("SSL_write error");
+                        return false;
+                    }
+                    continue;
+                case 0:
+                    break;  // SSL write complete;
+                default:
+                    ALOGV("SSL_write error %d", ssl_err);
+                    return false;
+            }
+        }
+    }
+    ALOGV("%u Wrote %zu bytes", mMark, buffer.size());
+    return true;
+}
+
+void DnsTlsSocket::loop() {
+    std::lock_guard guard(mLock);
+    std::deque<std::vector<uint8_t>> q;
+
+    const int timeout_msecs = DnsTlsSocket::kIdleTimeout.count() * 1000;
+    while (true) {
+        // poll() ignores negative fds
+        struct pollfd fds[2] = { { .fd = -1 }, { .fd = -1 } };
+        enum { SSLFD = 0, EVENTFD = 1 };
+
+        // Always listen for a response from server.
+        fds[SSLFD].fd = mSslFd.get();
+        fds[SSLFD].events = POLLIN;
+
+        // If we have pending queries, wait for space to write one.
+        // Otherwise, listen for new queries.
+        // Note: This blocks the destructor until q is empty, i.e. until all pending
+        // queries are sent or have failed to send.
+        if (!q.empty()) {
+            fds[SSLFD].events |= POLLOUT;
+        } else {
+            fds[EVENTFD].fd = mEventFd.get();
+            fds[EVENTFD].events = POLLIN;
+        }
+
+        const int s = TEMP_FAILURE_RETRY(poll(fds, std::size(fds), timeout_msecs));
+        if (s == 0) {
+            ALOGV("Idle timeout");
+            break;
+        }
+        if (s < 0) {
+            ALOGV("Poll failed: %d", errno);
+            break;
+        }
+        if (fds[SSLFD].revents & (POLLIN | POLLERR | POLLHUP)) {
+            if (!readResponse()) {
+                ALOGV("SSL remote close or read error.");
+                break;
+            }
+        }
+        if (fds[EVENTFD].revents & (POLLIN | POLLERR)) {
+            int64_t num_queries;
+            ssize_t res = read(mEventFd.get(), &num_queries, sizeof(num_queries));
+            if (res < 0) {
+                ALOGW("Error during eventfd read");
+                break;
+            } else if (res == 0) {
+                ALOGW("eventfd closed; disconnecting");
+                break;
+            } else if (res != sizeof(num_queries)) {
+                ALOGE("Int size mismatch: %zd != %zu", res, sizeof(num_queries));
+                break;
+            } else if (num_queries < 0) {
+                ALOGV("Negative eventfd read indicates destructor-initiated shutdown");
+                break;
+            }
+            // Take ownership of all pending queries.  (q is always empty here.)
+            mQueue.swap(q);
+        } else if (fds[SSLFD].revents & POLLOUT) {
+            // q cannot be empty here.
+            // Sending the entire queue here would risk a TCP flow control deadlock, so
+            // we only send a single query on each cycle of this loop.
+            // TODO: Coalesce multiple pending queries if there is enough space in the
+            // write buffer.
+            if (!sendQuery(q.front())) {
+                break;
+            }
+            q.pop_front();
+        }
+    }
+    ALOGV("Disconnecting");
+    sslDisconnect();
+    ALOGV("Calling onClosed");
+    mObserver->onClosed();
+    ALOGV("Ending loop");
+}
+
+DnsTlsSocket::~DnsTlsSocket() {
+    ALOGV("Destructor");
+    // This will trigger an orderly shutdown in loop().
+    requestLoopShutdown();
+    {
+        // Wait for the orderly shutdown to complete.
+        std::lock_guard guard(mLock);
+        if (mLoopThread && std::this_thread::get_id() == mLoopThread->get_id()) {
+            ALOGE("Violation of re-entrance precondition");
+            return;
+        }
+    }
+    if (mLoopThread) {
+        ALOGV("Waiting for loop thread to terminate");
+        mLoopThread->join();
+        mLoopThread.reset();
+    }
+    ALOGV("Destructor completed");
+}
+
+bool DnsTlsSocket::query(uint16_t id, const Slice query) {
+    // Compose the entire message in a single buffer, so that it can be
+    // sent as a single TLS record.
+    std::vector<uint8_t> buf(query.size() + 4);
+    // Write 2-byte length
+    uint16_t len = query.size() + 2;  // + 2 for the ID.
+    buf[0] = len >> 8;
+    buf[1] = len;
+    // Write 2-byte ID
+    buf[2] = id >> 8;
+    buf[3] = id;
+    // Copy body
+    std::memcpy(buf.data() + 4, query.base(), query.size());
+
+    mQueue.push(std::move(buf));
+    // Increment the mEventFd counter by 1.
+    return incrementEventFd(1);
+}
+
+void DnsTlsSocket::requestLoopShutdown() {
+    if (mEventFd != -1) {
+        // Write a negative number to the eventfd.  This triggers an immediate shutdown.
+        incrementEventFd(INT64_MIN);
+    }
+}
+
+bool DnsTlsSocket::incrementEventFd(const int64_t count) {
+    if (mEventFd == -1) {
+        ALOGE("eventfd is not initialized");
+        return false;
+    }
+    ssize_t written = write(mEventFd.get(), &count, sizeof(count));
+    if (written != sizeof(count)) {
+        ALOGE("Failed to increment eventfd by %" PRId64, count);
+        return false;
+    }
+    return true;
+}
+
+// Read exactly len bytes into buffer or fail with an SSL error code
+int DnsTlsSocket::sslRead(const Slice buffer, bool wait) {
+    size_t remaining = buffer.size();
+    while (remaining > 0) {
+        int ret = SSL_read(mSsl.get(), buffer.limit() - remaining, remaining);
+        if (ret == 0) {
+            ALOGW_IF(remaining < buffer.size(), "SSL closed with %zu of %zu bytes remaining",
+                     remaining, buffer.size());
+            return SSL_ERROR_ZERO_RETURN;
+        }
+
+        if (ret < 0) {
+            const int ssl_err = SSL_get_error(mSsl.get(), ret);
+            if (wait && ssl_err == SSL_ERROR_WANT_READ) {
+                if (waitForReading(mSslFd.get()) != 1) {
+                    ALOGV("Poll failed in sslRead: %d", errno);
+                    return SSL_ERROR_SYSCALL;
+                }
+                continue;
+            } else {
+                ALOGV("SSL_read error %d", ssl_err);
+                return ssl_err;
+            }
+        }
+
+        remaining -= ret;
+        wait = true;  // Once a read is started, try to finish.
+    }
+    return SSL_ERROR_NONE;
+}
+
+bool DnsTlsSocket::sendQuery(const std::vector<uint8_t>& buf) {
+    if (!sslWrite(netdutils::makeSlice(buf))) {
+        return false;
+    }
+    ALOGV("%u SSL_write complete", mMark);
+    return true;
+}
+
+bool DnsTlsSocket::readResponse() {
+    ALOGV("reading response");
+    uint8_t responseHeader[2];
+    int err = sslRead(Slice(responseHeader, 2), false);
+    if (err == SSL_ERROR_WANT_READ) {
+        ALOGV("Ignoring spurious wakeup from server");
+        return true;
+    }
+    if (err != SSL_ERROR_NONE) {
+        return false;
+    }
+    // Truncate responses larger than MAX_SIZE.  This is safe because a DNS packet is
+    // always invalid when truncated, so the response will be treated as an error.
+    constexpr uint16_t MAX_SIZE = 8192;
+    const uint16_t responseSize = (responseHeader[0] << 8) | responseHeader[1];
+    ALOGV("%u Expecting response of size %i", mMark, responseSize);
+    std::vector<uint8_t> response(std::min(responseSize, MAX_SIZE));
+    if (sslRead(netdutils::makeSlice(response), true) != SSL_ERROR_NONE) {
+        ALOGV("%u Failed to read %zu bytes", mMark, response.size());
+        return false;
+    }
+    uint16_t remainingBytes = responseSize - response.size();
+    while (remainingBytes > 0) {
+        constexpr uint16_t CHUNK_SIZE = 2048;
+        std::vector<uint8_t> discard(std::min(remainingBytes, CHUNK_SIZE));
+        if (sslRead(netdutils::makeSlice(discard), true) != SSL_ERROR_NONE) {
+            ALOGV("%u Failed to discard %zu bytes", mMark, discard.size());
+            return false;
+        }
+        remainingBytes -= discard.size();
+    }
+    ALOGV("%u SSL_read complete", mMark);
+
+    mObserver->onResponse(std::move(response));
+    return true;
+}
+
+}  // end of namespace net
+}  // end of namespace android
diff --git a/resolv/DnsTlsSocket.h b/resolv/DnsTlsSocket.h
new file mode 100644
index 0000000..2940500
--- /dev/null
+++ b/resolv/DnsTlsSocket.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_DNSTLSSOCKET_H
+#define _DNS_DNSTLSSOCKET_H
+
+#include <openssl/ssl.h>
+#include <future>
+#include <mutex>
+
+#include <android-base/thread_annotations.h>
+#include <android-base/unique_fd.h>
+#include <netdutils/Slice.h>
+#include <netdutils/Status.h>
+
+#include "DnsTlsServer.h"
+#include "IDnsTlsSocket.h"
+#include "LockedQueue.h"
+
+namespace android {
+namespace net {
+
+class IDnsTlsSocketObserver;
+class DnsTlsSessionCache;
+
+// A class for managing a TLS socket that sends and receives messages in
+// [length][value] format, with a 2-byte length (i.e. DNS-over-TCP format).
+// This class is not aware of query-response pairing or anything else about DNS.
+// For the observer:
+// This class is not re-entrant: the observer is not permitted to wait for a call to query()
+// or the destructor in a callback.  Doing so will result in deadlocks.
+// This class may call the observer at any time after initialize(), until the destructor
+// returns (but not after).
+class DnsTlsSocket : public IDnsTlsSocket {
+  public:
+    DnsTlsSocket(const DnsTlsServer& server, unsigned mark,
+                 IDnsTlsSocketObserver* _Nonnull observer, DnsTlsSessionCache* _Nonnull cache)
+        : mMark(mark), mServer(server), mObserver(observer), mCache(cache) {}
+    ~DnsTlsSocket();
+
+    // Creates the SSL context for this session and connect.  Returns false on failure.
+    // This method should be called after construction and before use of a DnsTlsSocket.
+    // Only call this method once per DnsTlsSocket.
+    bool initialize() EXCLUDES(mLock);
+
+    // Send a query on the provided SSL socket.  |query| contains
+    // the body of a query, not including the ID header. This function will typically return before
+    // the query is actually sent.  If this function fails, DnsTlsSocketObserver will be
+    // notified that the socket is closed.
+    // Note that success here indicates successful sending, not receipt of a response.
+    // Thread-safe.
+    bool query(uint16_t id, const netdutils::Slice query) override EXCLUDES(mLock);
+
+  private:
+    // Lock to be held by the SSL event loop thread.  This is not normally in contention.
+    std::mutex mLock;
+
+    // Forwards queries and receives responses.  Blocks until the idle timeout.
+    void loop() EXCLUDES(mLock);
+    std::unique_ptr<std::thread> mLoopThread GUARDED_BY(mLock);
+
+    // On success, sets mSslFd to a socket connected to mAddr (the
+    // connection will likely be in progress if mProtocol is IPPROTO_TCP).
+    // On error, returns the errno.
+    netdutils::Status tcpConnect() REQUIRES(mLock);
+
+    // Connect an SSL session on the provided socket.  If connection fails, closing the
+    // socket remains the caller's responsibility.
+    bssl::UniquePtr<SSL> sslConnect(int fd) REQUIRES(mLock);
+
+    // Disconnect the SSL session and close the socket.
+    void sslDisconnect() REQUIRES(mLock);
+
+    // Writes a buffer to the socket.
+    bool sslWrite(const netdutils::Slice buffer) REQUIRES(mLock);
+
+    // Reads exactly the specified number of bytes from the socket, or fails.
+    // Returns SSL_ERROR_NONE on success.
+    // If |wait| is true, then this function always blocks.  Otherwise, it
+    // will return SSL_ERROR_WANT_READ if there is no data from the server to read.
+    int sslRead(const netdutils::Slice buffer, bool wait) REQUIRES(mLock);
+
+    bool sendQuery(const std::vector<uint8_t>& buf) REQUIRES(mLock);
+    bool readResponse() REQUIRES(mLock);
+
+    // Similar to query(), this function uses incrementEventFd to send a message to the
+    // loop thread.  However, instead of incrementing the counter by one (indicating a
+    // new query), it wraps the counter to negative, which we use to indicate a shutdown
+    // request.
+    void requestLoopShutdown() EXCLUDES(mLock);
+
+    // This function sends a message to the loop thread by incrementing mEventFd.
+    bool incrementEventFd(int64_t count) EXCLUDES(mLock);
+
+    // Queue of pending queries.  query() pushes items onto the queue and notifies
+    // the loop thread by incrementing mEventFd.  loop() reads items off the queue.
+    LockedQueue<std::vector<uint8_t>> mQueue;
+
+    // eventfd socket used for notifying the SSL thread when queries are ready to send.
+    // This socket acts similarly to an atomic counter, incremented by query() and cleared
+    // by loop().  We have to use a socket because the SSL thread needs to wait in poll()
+    // for input from either a remote server or a query thread.  Since eventfd does not have
+    // EOF, we indicate a close request by setting the counter to a negative number.
+    // This file descriptor is opened by initialize(), and closed implicitly after
+    // destruction.
+    base::unique_fd mEventFd;
+
+    // SSL Socket fields.
+    bssl::UniquePtr<SSL_CTX> mSslCtx GUARDED_BY(mLock);
+    base::unique_fd mSslFd GUARDED_BY(mLock);
+    bssl::UniquePtr<SSL> mSsl GUARDED_BY(mLock);
+    static constexpr std::chrono::seconds kIdleTimeout = std::chrono::seconds(20);
+
+    const unsigned mMark;  // Socket mark
+    const DnsTlsServer mServer;
+    IDnsTlsSocketObserver* _Nonnull const mObserver;
+    DnsTlsSessionCache* _Nonnull const mCache;
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_DNSTLSSOCKET_H
diff --git a/resolv/DnsTlsSocketFactory.h b/resolv/DnsTlsSocketFactory.h
new file mode 100644
index 0000000..af4011d
--- /dev/null
+++ b/resolv/DnsTlsSocketFactory.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_DNSTLSSOCKETFACTORY_H
+#define _DNS_DNSTLSSOCKETFACTORY_H
+
+#include <memory>
+
+#include "DnsTlsSocket.h"
+#include "IDnsTlsSocketFactory.h"
+
+namespace android {
+namespace net {
+
+class IDnsTlsSocketObserver;
+class DnsTlsSessionCache;
+struct DnsTlsServer;
+
+// Trivial RAII factory for DnsTlsSocket.  This is owned by DnsTlsDispatcher.
+class DnsTlsSocketFactory : public IDnsTlsSocketFactory {
+  public:
+    std::unique_ptr<IDnsTlsSocket> createDnsTlsSocket(const DnsTlsServer& server, unsigned mark,
+                                                      IDnsTlsSocketObserver* _Nonnull observer,
+                                                      DnsTlsSessionCache* _Nonnull cache) override {
+        auto socket = std::make_unique<DnsTlsSocket>(server, mark, observer, cache);
+        if (!socket->initialize()) {
+            return nullptr;
+        }
+        return std::move(socket);
+    }
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_DNSTLSSOCKETFACTORY_H
diff --git a/resolv/DnsTlsTransport.cpp b/resolv/DnsTlsTransport.cpp
new file mode 100644
index 0000000..0f9042e
--- /dev/null
+++ b/resolv/DnsTlsTransport.cpp
@@ -0,0 +1,214 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "DnsTlsTransport"
+//#define LOG_NDEBUG 0
+
+#include "DnsTlsTransport.h"
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include "DnsTlsSocketFactory.h"
+#include "IDnsTlsSocketFactory.h"
+
+#include "log/log.h"
+
+namespace android {
+namespace net {
+
+std::future<DnsTlsTransport::Result> DnsTlsTransport::query(const netdutils::Slice query) {
+    std::lock_guard guard(mLock);
+
+    auto record = mQueries.recordQuery(query);
+    if (!record) {
+        return std::async(std::launch::deferred, []{
+            return (Result) { .code = Response::internal_error };
+        });
+    }
+
+    if (!mSocket) {
+        ALOGV("No socket for query.  Opening socket and sending.");
+        doConnect();
+    } else {
+        sendQuery(record->query);
+    }
+
+    return std::move(record->result);
+}
+
+bool DnsTlsTransport::sendQuery(const DnsTlsQueryMap::Query q) {
+    // Strip off the ID number and send the new ID instead.
+    bool sent = mSocket->query(q.newId, netdutils::drop(q.query, 2));
+    if (sent) {
+        mQueries.markTried(q.newId);
+    }
+    return sent;
+}
+
+void DnsTlsTransport::doConnect() {
+    ALOGV("Constructing new socket");
+    mSocket = mFactory->createDnsTlsSocket(mServer, mMark, this, &mCache);
+
+    if (mSocket) {
+        auto queries = mQueries.getAll();
+        ALOGV("Initialization succeeded.  Reissuing %zu queries.", queries.size());
+        for(auto& q : queries) {
+            if (!sendQuery(q)) {
+                break;
+            }
+        }
+    } else {
+        ALOGV("Initialization failed.");
+        mSocket.reset();
+        ALOGV("Failing all pending queries.");
+        mQueries.clear();
+    }
+}
+
+void DnsTlsTransport::onResponse(std::vector<uint8_t> response) {
+    mQueries.onResponse(std::move(response));
+}
+
+void DnsTlsTransport::onClosed() {
+    std::lock_guard guard(mLock);
+    if (mClosing) {
+        return;
+    }
+    // Move remaining operations to a new thread.
+    // This is necessary because
+    // 1. onClosed is currently running on a thread that blocks mSocket's destructor
+    // 2. doReconnect will call that destructor
+    if (mReconnectThread) {
+        // Complete cleanup of a previous reconnect thread, if present.
+        mReconnectThread->join();
+        // Joining a thread that is trying to acquire mLock, while holding mLock,
+        // looks like it risks a deadlock.  However, a deadlock will not occur because
+        // once onClosed is called, it cannot be called again until after doReconnect
+        // acquires mLock.
+    }
+    mReconnectThread.reset(new std::thread(&DnsTlsTransport::doReconnect, this));
+}
+
+void DnsTlsTransport::doReconnect() {
+    std::lock_guard guard(mLock);
+    if (mClosing) {
+        return;
+    }
+    mQueries.cleanup();
+    if (!mQueries.empty()) {
+        ALOGV("Fast reconnect to retry remaining queries");
+        doConnect();
+    } else {
+        ALOGV("No pending queries.  Going idle.");
+        mSocket.reset();
+    }
+}
+
+DnsTlsTransport::~DnsTlsTransport() {
+    ALOGV("Destructor");
+    {
+        std::lock_guard guard(mLock);
+        ALOGV("Locked destruction procedure");
+        mQueries.clear();
+        mClosing = true;
+    }
+    // It's possible that a reconnect thread was spawned and waiting for mLock.
+    // It's safe for that thread to run now because mClosing is true (and mQueries is empty),
+    // but we need to wait for it to finish before allowing destruction to proceed.
+    if (mReconnectThread) {
+        ALOGV("Waiting for reconnect thread to terminate");
+        mReconnectThread->join();
+        mReconnectThread.reset();
+    }
+    // Ensure that the socket is destroyed, and can clean up its callback threads,
+    // before any of this object's fields become invalid.
+    mSocket.reset();
+    ALOGV("Destructor completed");
+}
+
+// static
+// TODO: Use this function to preheat the session cache.
+// That may require moving it to DnsTlsDispatcher.
+bool DnsTlsTransport::validate(const DnsTlsServer& server, unsigned netid, uint32_t mark) {
+    ALOGV("Beginning validation on %u", netid);
+    // Generate "<random>-dnsotls-ds.metric.gstatic.com", which we will lookup through |ss| in
+    // order to prove that it is actually a working DNS over TLS server.
+    static const char kDnsSafeChars[] =
+            "abcdefhijklmnopqrstuvwxyz"
+            "ABCDEFHIJKLMNOPQRSTUVWXYZ"
+            "0123456789";
+    const auto c = [](uint8_t rnd) -> uint8_t {
+        return kDnsSafeChars[(rnd % std::size(kDnsSafeChars))];
+    };
+    uint8_t rnd[8];
+    arc4random_buf(rnd, std::size(rnd));
+    // We could try to use res_mkquery() here, but it's basically the same.
+    uint8_t query[] = {
+        rnd[6], rnd[7],  // [0-1]   query ID
+        1, 0,  // [2-3]   flags; query[2] = 1 for recursion desired (RD).
+        0, 1,  // [4-5]   QDCOUNT (number of queries)
+        0, 0,  // [6-7]   ANCOUNT (number of answers)
+        0, 0,  // [8-9]   NSCOUNT (number of name server records)
+        0, 0,  // [10-11] ARCOUNT (number of additional records)
+        17, c(rnd[0]), c(rnd[1]), c(rnd[2]), c(rnd[3]), c(rnd[4]), c(rnd[5]),
+            '-', 'd', 'n', 's', 'o', 't', 'l', 's', '-', 'd', 's',
+        6, 'm', 'e', 't', 'r', 'i', 'c',
+        7, 'g', 's', 't', 'a', 't', 'i', 'c',
+        3, 'c', 'o', 'm',
+        0,  // null terminator of FQDN (root TLD)
+        0, ns_t_aaaa,  // QTYPE
+        0, ns_c_in     // QCLASS
+    };
+    const int qlen = std::size(query);
+
+    int replylen = 0;
+    DnsTlsSocketFactory factory;
+    DnsTlsTransport transport(server, mark, &factory);
+    auto r = transport.query(netdutils::Slice(query, qlen)).get();
+    if (r.code != Response::success) {
+        ALOGV("query failed");
+        return false;
+    }
+
+    const std::vector<uint8_t>& recvbuf = r.response;
+    if (recvbuf.size() < NS_HFIXEDSZ) {
+        ALOGW("short response: %d", replylen);
+        return false;
+    }
+
+    const int qdcount = (recvbuf[4] << 8) | recvbuf[5];
+    if (qdcount != 1) {
+        ALOGW("reply query count != 1: %d", qdcount);
+        return false;
+    }
+
+    const int ancount = (recvbuf[6] << 8) | recvbuf[7];
+    ALOGV("%u answer count: %d", netid, ancount);
+
+    // TODO: Further validate the response contents (check for valid AAAA record, ...).
+    // Note that currently, integration tests rely on this function accepting a
+    // response with zero records.
+#if 0
+    for (int i = 0; i < resplen; i++) {
+        ALOGD("recvbuf[%d] = %d %c", i, recvbuf[i], recvbuf[i]);
+    }
+#endif
+    return true;
+}
+
+}  // end of namespace net
+}  // end of namespace android
diff --git a/resolv/DnsTlsTransport.h b/resolv/DnsTlsTransport.h
new file mode 100644
index 0000000..6c98fa6
--- /dev/null
+++ b/resolv/DnsTlsTransport.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_DNSTLSTRANSPORT_H
+#define _DNS_DNSTLSTRANSPORT_H
+
+#include <future>
+#include <map>
+#include <mutex>
+#include <vector>
+
+#include <android-base/thread_annotations.h>
+#include <android-base/unique_fd.h>
+#include <netdutils/Slice.h>
+
+#include "DnsTlsQueryMap.h"
+#include "DnsTlsServer.h"
+#include "DnsTlsSessionCache.h"
+#include "IDnsTlsSocket.h"
+#include "IDnsTlsSocketObserver.h"
+
+namespace android {
+namespace net {
+
+class IDnsTlsSocketFactory;
+
+// Manages at most one DnsTlsSocket at a time.  This class handles socket lifetime issues,
+// such as reopening the socket and reissuing pending queries.
+class DnsTlsTransport : public IDnsTlsSocketObserver {
+  public:
+    DnsTlsTransport(const DnsTlsServer& server, unsigned mark,
+                    IDnsTlsSocketFactory* _Nonnull factory)
+        : mMark(mark), mServer(server), mFactory(factory) {}
+    ~DnsTlsTransport();
+
+    typedef DnsTlsServer::Response Response;
+    typedef DnsTlsServer::Result Result;
+
+    // Given a |query|, this method sends it to the server and returns the result asynchronously.
+    std::future<Result> query(const netdutils::Slice query) EXCLUDES(mLock);
+
+    // Check that a given TLS server is fully working on the specified netid, and has the
+    // provided SHA-256 fingerprint (if nonempty).  This function is used in ResolverController
+    // to ensure that we don't enable DNS over TLS on networks where it doesn't actually work.
+    static bool validate(const DnsTlsServer& server, unsigned netid, uint32_t mark);
+
+    // Implement IDnsTlsSocketObserver
+    void onResponse(std::vector<uint8_t> response) override;
+    void onClosed() override EXCLUDES(mLock);
+
+  private:
+    std::mutex mLock;
+
+    DnsTlsSessionCache mCache;
+    DnsTlsQueryMap mQueries;
+
+    const unsigned mMark;  // Socket mark
+    const DnsTlsServer mServer;
+    IDnsTlsSocketFactory* _Nonnull const mFactory;
+
+    void doConnect() REQUIRES(mLock);
+
+    // doReconnect is used by onClosed.  It runs on the reconnect thread.
+    void doReconnect() EXCLUDES(mLock);
+    std::unique_ptr<std::thread> mReconnectThread GUARDED_BY(mLock);
+
+    // Used to prevent onClosed from starting a reconnect during the destructor.
+    bool mClosing GUARDED_BY(mLock) = false;
+
+    // Sending queries on the socket is thread-safe, but construction/destruction is not.
+    std::unique_ptr<IDnsTlsSocket> mSocket GUARDED_BY(mLock);
+
+    // Send a query to the socket.
+    bool sendQuery(const DnsTlsQueryMap::Query q) REQUIRES(mLock);
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_DNSTLSTRANSPORT_H
diff --git a/resolv/IDnsTlsSocket.h b/resolv/IDnsTlsSocket.h
new file mode 100644
index 0000000..0f2800e
--- /dev/null
+++ b/resolv/IDnsTlsSocket.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_IDNSTLSSOCKET_H
+#define _DNS_IDNSTLSSOCKET_H
+
+#include <cstddef>
+#include <cstdint>
+
+#include <netdutils/Slice.h>
+
+namespace android {
+namespace net {
+
+class IDnsTlsSocketObserver;
+class DnsTlsSessionCache;
+
+// A class for managing a TLS socket that sends and receives messages in
+// [length][value] format, with a 2-byte length (i.e. DNS-over-TCP format).
+// This interface is not aware of query-response pairing or anything else about DNS.
+class IDnsTlsSocket {
+  public:
+    virtual ~IDnsTlsSocket(){};
+    // Send a query on the provided SSL socket.  |query| contains
+    // the body of a query, not including the ID bytes.  This function will typically return before
+    // the query is actually sent.  If this function fails, the observer will be
+    // notified that the socket is closed.
+    // Note that a true return value indicates successful sending, not receipt of a response.
+    virtual bool query(uint16_t id, const netdutils::Slice query) = 0;
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_IDNSTLSSOCKET_H
diff --git a/resolv/IDnsTlsSocketFactory.h b/resolv/IDnsTlsSocketFactory.h
new file mode 100644
index 0000000..a391f59
--- /dev/null
+++ b/resolv/IDnsTlsSocketFactory.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_IDNSTLSSOCKETFACTORY_H
+#define _DNS_IDNSTLSSOCKETFACTORY_H
+
+#include "IDnsTlsSocket.h"
+
+namespace android {
+namespace net {
+
+class IDnsTlsSocketObserver;
+class DnsTlsSessionCache;
+struct DnsTlsServer;
+
+// Dependency injection interface for DnsTlsSocketFactory.
+// This pattern allows mocking of DnsTlsSocket for tests.
+class IDnsTlsSocketFactory {
+  public:
+    virtual ~IDnsTlsSocketFactory(){};
+    virtual std::unique_ptr<IDnsTlsSocket> createDnsTlsSocket(
+            const DnsTlsServer& server, unsigned mark, IDnsTlsSocketObserver* _Nonnull observer,
+            DnsTlsSessionCache* _Nonnull cache) = 0;
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_IDNSTLSSOCKETFACTORY_H
diff --git a/resolv/IDnsTlsSocketObserver.h b/resolv/IDnsTlsSocketObserver.h
new file mode 100644
index 0000000..980f74a
--- /dev/null
+++ b/resolv/IDnsTlsSocketObserver.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_IDNSTLSSOCKETOBSERVER_H
+#define _DNS_IDNSTLSSOCKETOBSERVER_H
+
+namespace android {
+namespace net {
+
+// Interface to listen for DNS query responses on a socket, and to be notified
+// when the socket is closed by the remote peer.  This is only implemented by
+// DnsTlsTransport, but it is a separate interface for clarity and to avoid a
+// circular dependency with DnsTlsSocket.
+class IDnsTlsSocketObserver {
+  public:
+    virtual ~IDnsTlsSocketObserver(){};
+    virtual void onResponse(std::vector<uint8_t> response) = 0;
+
+    virtual void onClosed() = 0;
+};
+
+}  // namespace net
+}  // namespace android
+
+#endif  // _DNS_IDNSTLSSOCKETOBSERVER_H
diff --git a/resolv/LockedQueue.h b/resolv/LockedQueue.h
new file mode 100644
index 0000000..0481eda
--- /dev/null
+++ b/resolv/LockedQueue.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _DNS_LOCKED_QUEUE_H
+#define _DNS_LOCKED_QUEUE_H
+
+#include <algorithm>
+#include <deque>
+#include <mutex>
+
+#include <android-base/thread_annotations.h>
+
+namespace android {
+namespace net {
+
+template <typename T>
+class LockedQueue {
+  public:
+    // Push an item onto the queue.
+    void push(T item) {
+        std::lock_guard guard(mLock);
+        mQueue.push_front(std::move(item));
+    }
+
+    // Swap out the contents of the queue
+    void swap(std::deque<T>& other) {
+        std::lock_guard guard(mLock);
+        mQueue.swap(other);
+    }
+
+  private:
+    std::mutex mLock;
+    std::deque<T> mQueue GUARDED_BY(mLock);
+};
+
+}  // end of namespace net
+}  // end of namespace android
+
+#endif  // _DNS_LOCKEDQUEUE_H
diff --git a/resolv/NOTICE b/resolv/NOTICE
new file mode 100644
index 0000000..7504f4d
--- /dev/null
+++ b/resolv/NOTICE
@@ -0,0 +1,418 @@
+Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the project nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (C) 2008 The Android Open Source Project
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+ * Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (C) 2014 The Android Open Source Project
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+ * Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (C) 2016 The Android Open Source Project
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+-------------------------------------------------------------------
+
+Copyright (c) 1983, 1987, 1989
+   The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 1985
+   The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. All advertising materials mentioning features or use of this software
+   must display the following acknowledgement:
+    This product includes software developed by the University of
+    California, Berkeley and its contributors.
+4. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 1985, 1988, 1993
+   The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+Portions Copyright (c) 1993 by Digital Equipment Corporation.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies, and that
+the name of Digital Equipment Corporation not be used in advertising or
+publicity pertaining to distribution of the document or software without
+specific, written prior permission.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 1985, 1989, 1993
+   The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. All advertising materials mentioning features or use of this software
+   must display the following acknowledgement:
+    This product includes software developed by the University of
+    California, Berkeley and its contributors.
+4. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 1985, 1993
+   The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. All advertising materials mentioning features or use of this software
+   must display the following acknowledgement:
+    This product includes software developed by the University of
+    California, Berkeley and its contributors.
+4. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 1985, 1993
+   The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+Copyright (c) 1995-1999 by Internet Software Consortium.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+Copyright (c) 1999 by Internet Software Consortium.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+-------------------------------------------------------------------
+
+Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+-------------------------------------------------------------------
+
+Portions Copyright (C) 2004, 2005, 2008, 2009  Internet Systems Consortium, Inc. ("ISC")
+Portions Copyright (C) 1996-2003  Internet Software Consortium.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+-------------------------------------------------------------------
+
+Portions Copyright (c) 1993 by Digital Equipment Corporation.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies, and that
+the name of Digital Equipment Corporation not be used in advertising or
+publicity pertaining to distribution of the document or software without
+specific, written prior permission.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+-------------------------------------------------------------------
+
+Portions Copyright (c) 1995 by International Business Machines, Inc.
+
+International Business Machines, Inc. (hereinafter called IBM) grants
+permission under its copyrights to use, copy, modify, and distribute this
+Software with or without fee, provided that the above copyright notice and
+all paragraphs of this notice appear in all copies, and that the name of IBM
+not be used in connection with the marketing of any product incorporating
+the Software or modifications thereof, without specific, written prior
+permission.
+
+To the extent it has a right to do so, IBM grants an immunity from suit
+under its patents, if any, for the use, sale or manufacture of products to
+the extent that such products are used for performing Domain Name System
+dynamic updates in TCP/IP networks by means of the Software.  No immunity is
+granted for any product per se or for any other function of any product.
+
+THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
+INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
+DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+-------------------------------------------------------------------
+
diff --git a/resolv/PrivateDnsConfiguration.cpp b/resolv/PrivateDnsConfiguration.cpp
new file mode 100644
index 0000000..1a88275
--- /dev/null
+++ b/resolv/PrivateDnsConfiguration.cpp
@@ -0,0 +1,315 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "PrivateDnsConfiguration"
+#define DBG 0
+
+#include "PrivateDnsConfiguration.h"
+
+#include <log/log.h>
+#include <netdb.h>
+#include <sys/socket.h>
+
+#include "DnsTlsTransport.h"
+#include "ResolverEventReporter.h"
+#include "netd_resolv/resolv.h"
+#include "netdutils/BackoffSequence.h"
+
+namespace android {
+namespace net {
+
+std::string addrToString(const sockaddr_storage* addr) {
+    char out[INET6_ADDRSTRLEN] = {0};
+    getnameinfo((const sockaddr*) addr, sizeof(sockaddr_storage), out, INET6_ADDRSTRLEN, nullptr, 0,
+                NI_NUMERICHOST);
+    return std::string(out);
+}
+
+bool parseServer(const char* server, sockaddr_storage* parsed) {
+    addrinfo hints = {.ai_family = AF_UNSPEC, .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV};
+    addrinfo* res;
+
+    int err = getaddrinfo(server, "853", &hints, &res);
+    if (err != 0) {
+        ALOGW("Failed to parse server address (%s): %s", server, gai_strerror(err));
+        return false;
+    }
+
+    memcpy(parsed, res->ai_addr, res->ai_addrlen);
+    freeaddrinfo(res);
+    return true;
+}
+
+int PrivateDnsConfiguration::set(int32_t netId, uint32_t mark,
+                                 const std::vector<std::string>& servers, const std::string& name,
+                                 const std::set<std::vector<uint8_t>>& fingerprints) {
+    if (DBG) {
+        ALOGD("PrivateDnsConfiguration::set(%u, 0x%x, %zu, %s, %zu)", netId, mark, servers.size(),
+              name.c_str(), fingerprints.size());
+    }
+
+    const bool explicitlyConfigured = !name.empty() || !fingerprints.empty();
+
+    // Parse the list of servers that has been passed in
+    std::set<DnsTlsServer> tlsServers;
+    for (size_t i = 0; i < servers.size(); ++i) {
+        sockaddr_storage parsed;
+        if (!parseServer(servers[i].c_str(), &parsed)) {
+            return -EINVAL;
+        }
+        DnsTlsServer server(parsed);
+        server.name = name;
+        server.fingerprints = fingerprints;
+        tlsServers.insert(server);
+    }
+
+    std::lock_guard guard(mPrivateDnsLock);
+    if (explicitlyConfigured) {
+        mPrivateDnsModes[netId] = PrivateDnsMode::STRICT;
+    } else if (!tlsServers.empty()) {
+        mPrivateDnsModes[netId] = PrivateDnsMode::OPPORTUNISTIC;
+    } else {
+        mPrivateDnsModes[netId] = PrivateDnsMode::OFF;
+        mPrivateDnsTransports.erase(netId);
+        return 0;
+    }
+
+    // Create the tracker if it was not present
+    auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair == mPrivateDnsTransports.end()) {
+        // No TLS tracker yet for this netId.
+        bool added;
+        std::tie(netPair, added) = mPrivateDnsTransports.emplace(netId, PrivateDnsTracker());
+        if (!added) {
+            ALOGE("Memory error while recording private DNS for netId %d", netId);
+            return -ENOMEM;
+        }
+    }
+    auto& tracker = netPair->second;
+
+    // Remove any servers from the tracker that are not in |servers| exactly.
+    for (auto it = tracker.begin(); it != tracker.end();) {
+        if (tlsServers.count(it->first) == 0) {
+            it = tracker.erase(it);
+        } else {
+            ++it;
+        }
+    }
+
+    // Add any new or changed servers to the tracker, and initiate async checks for them.
+    for (const auto& server : tlsServers) {
+        if (needsValidation(tracker, server)) {
+            validatePrivateDnsProvider(server, tracker, netId, mark);
+        }
+    }
+    return 0;
+}
+
+PrivateDnsStatus PrivateDnsConfiguration::getStatus(unsigned netId) {
+    PrivateDnsStatus status{PrivateDnsMode::OFF, {}};
+    std::lock_guard guard(mPrivateDnsLock);
+
+    const auto mode = mPrivateDnsModes.find(netId);
+    if (mode == mPrivateDnsModes.end()) return status;
+    status.mode = mode->second;
+
+    const auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair != mPrivateDnsTransports.end()) {
+        for (const auto& serverPair : netPair->second) {
+            if (serverPair.second == Validation::success) {
+                status.validatedServers.push_back(serverPair.first);
+            }
+        }
+    }
+
+    return status;
+}
+
+void PrivateDnsConfiguration::getStatus(unsigned netId, ExternalPrivateDnsStatus* status) {
+    std::lock_guard guard(mPrivateDnsLock);
+
+    const auto mode = mPrivateDnsModes.find(netId);
+    if (mode == mPrivateDnsModes.end()) return;
+    status->mode = mode->second;
+
+    const auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair != mPrivateDnsTransports.end()) {
+        int count = 0;
+        for (const auto& serverPair : netPair->second) {
+            status->serverStatus[count].ss = serverPair.first.ss;
+            status->serverStatus[count].hostname =
+                    serverPair.first.name.empty() ? "" : serverPair.first.name.c_str();
+            status->serverStatus[count].validation = serverPair.second;
+            count++;
+            if (count >= MAXNS) break;  // Lose the rest
+        }
+        status->numServers = count;
+    }
+}
+
+void PrivateDnsConfiguration::clear(unsigned netId) {
+    if (DBG) {
+        ALOGD("PrivateDnsConfiguration::clear(%u)", netId);
+    }
+    std::lock_guard guard(mPrivateDnsLock);
+    mPrivateDnsModes.erase(netId);
+    mPrivateDnsTransports.erase(netId);
+}
+
+void PrivateDnsConfiguration::validatePrivateDnsProvider(const DnsTlsServer& server,
+                                                         PrivateDnsTracker& tracker, unsigned netId,
+                                                         uint32_t mark) REQUIRES(mPrivateDnsLock) {
+    if (DBG) {
+        ALOGD("validatePrivateDnsProvider(%s, %u)", addrToString(&server.ss).c_str(), netId);
+    }
+
+    tracker[server] = Validation::in_process;
+    if (DBG) {
+        ALOGD("Server %s marked as in_process.  Tracker now has size %zu",
+              addrToString(&server.ss).c_str(), tracker.size());
+    }
+    // Note that capturing |server| and |netId| in this lambda create copies.
+    std::thread validate_thread([this, server, netId, mark] {
+        // cat /proc/sys/net/ipv4/tcp_syn_retries yields "6".
+        //
+        // Start with a 1 minute delay and backoff to once per hour.
+        //
+        // Assumptions:
+        //     [1] Each TLS validation is ~10KB of certs+handshake+payload.
+        //     [2] Network typically provision clients with <=4 nameservers.
+        //     [3] Average month has 30 days.
+        //
+        // Each validation pass in a given hour is ~1.2MB of data. And 24
+        // such validation passes per day is about ~30MB per month, in the
+        // worst case. Otherwise, this will cost ~600 SYNs per month
+        // (6 SYNs per ip, 4 ips per validation pass, 24 passes per day).
+        auto backoff = netdutils::BackoffSequence<>::Builder()
+                               .withInitialRetransmissionTime(std::chrono::seconds(60))
+                               .withMaximumRetransmissionTime(std::chrono::seconds(3600))
+                               .build();
+
+        while (true) {
+            // ::validate() is a blocking call that performs network operations.
+            // It can take milliseconds to minutes, up to the SYN retry limit.
+            const bool success = DnsTlsTransport::validate(server, netId, mark);
+            if (DBG) {
+                ALOGD("validateDnsTlsServer returned %d for %s", success,
+                      addrToString(&server.ss).c_str());
+            }
+
+            const bool needs_reeval = this->recordPrivateDnsValidation(server, netId, success);
+            if (!needs_reeval) {
+                break;
+            }
+
+            if (backoff.hasNextTimeout()) {
+                std::this_thread::sleep_for(backoff.getNextTimeout());
+            } else {
+                break;
+            }
+        }
+    });
+    validate_thread.detach();
+}
+
+bool PrivateDnsConfiguration::recordPrivateDnsValidation(const DnsTlsServer& server, unsigned netId,
+                                                         bool success) {
+    constexpr bool NEEDS_REEVALUATION = true;
+    constexpr bool DONT_REEVALUATE = false;
+
+    std::lock_guard guard(mPrivateDnsLock);
+
+    auto netPair = mPrivateDnsTransports.find(netId);
+    if (netPair == mPrivateDnsTransports.end()) {
+        ALOGW("netId %u was erased during private DNS validation", netId);
+        return DONT_REEVALUATE;
+    }
+
+    const auto mode = mPrivateDnsModes.find(netId);
+    if (mode == mPrivateDnsModes.end()) {
+        ALOGW("netId %u has no private DNS validation mode", netId);
+        return DONT_REEVALUATE;
+    }
+    const bool modeDoesReevaluation = (mode->second == PrivateDnsMode::STRICT);
+
+    bool reevaluationStatus =
+            (success || !modeDoesReevaluation) ? DONT_REEVALUATE : NEEDS_REEVALUATION;
+
+    auto& tracker = netPair->second;
+    auto serverPair = tracker.find(server);
+    if (serverPair == tracker.end()) {
+        ALOGW("Server %s was removed during private DNS validation",
+              addrToString(&server.ss).c_str());
+        success = false;
+        reevaluationStatus = DONT_REEVALUATE;
+    } else if (!(serverPair->first == server)) {
+        // TODO: It doesn't seem correct to overwrite the tracker entry for
+        // |server| down below in this circumstance... Fix this.
+        ALOGW("Server %s was changed during private DNS validation",
+              addrToString(&server.ss).c_str());
+        success = false;
+        reevaluationStatus = DONT_REEVALUATE;
+    }
+
+    // Send a validation event to NetdEventListenerService.
+    const auto& listeners = ResolverEventReporter::getInstance().getListeners();
+    if (listeners.size() != 0) {
+        for (const auto& it : listeners) {
+            it->onPrivateDnsValidationEvent(netId, addrToString(&server.ss), server.name, success);
+        }
+        if (DBG) {
+            ALOGD("Sent validation %s event on netId %u for %s with hostname %s",
+                  success ? "success" : "failure", netId, addrToString(&server.ss).c_str(),
+                  server.name.c_str());
+        }
+    } else {
+        ALOGE("Validation event not sent since no INetdEventListener receiver is available.");
+    }
+
+    if (success) {
+        tracker[server] = Validation::success;
+        if (DBG) {
+            ALOGD("Validation succeeded for %s! Tracker now has %zu entries.",
+                  addrToString(&server.ss).c_str(), tracker.size());
+        }
+    } else {
+        // Validation failure is expected if a user is on a captive portal.
+        // TODO: Trigger a second validation attempt after captive portal login
+        // succeeds.
+        tracker[server] = (reevaluationStatus == NEEDS_REEVALUATION) ? Validation::in_process
+                                                                     : Validation::fail;
+        if (DBG) {
+            ALOGD("Validation failed for %s!", addrToString(&server.ss).c_str());
+        }
+    }
+
+    return reevaluationStatus;
+}
+
+// Start validation for newly added servers as well as any servers that have
+// landed in Validation::fail state. Note that servers that have failed
+// multiple validation attempts but for which there is still a validating
+// thread running are marked as being Validation::in_process.
+bool PrivateDnsConfiguration::needsValidation(const PrivateDnsTracker& tracker,
+                                              const DnsTlsServer& server) {
+    const auto& iter = tracker.find(server);
+    return (iter == tracker.end()) || (iter->second == Validation::fail);
+}
+
+PrivateDnsConfiguration gPrivateDnsConfiguration;
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/PrivateDnsConfiguration.h b/resolv/PrivateDnsConfiguration.h
new file mode 100644
index 0000000..50fb54d
--- /dev/null
+++ b/resolv/PrivateDnsConfiguration.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef NETD_RESOLV_PRIVATEDNSCONFIGURATION_H
+#define NETD_RESOLV_PRIVATEDNSCONFIGURATION_H
+
+#include <list>
+#include <map>
+#include <mutex>
+#include <vector>
+
+#include <android-base/thread_annotations.h>
+
+#include "DnsTlsServer.h"
+
+namespace android {
+namespace net {
+
+// The DNS over TLS mode on a specific netId.
+enum class PrivateDnsMode : uint8_t { OFF, OPPORTUNISTIC, STRICT };
+
+// Validation status of a DNS over TLS server (on a specific netId).
+enum class Validation : uint8_t { in_process, success, fail, unknown_server, unknown_netid };
+
+struct PrivateDnsStatus {
+    PrivateDnsMode mode;
+    std::list<DnsTlsServer> validatedServers;
+};
+
+// TODO: remove this C-style struct and use PrivateDnsStatus everywhere.
+struct ExternalPrivateDnsStatus {
+    PrivateDnsMode mode;
+    int numServers;
+    struct PrivateDnsInfo {
+        sockaddr_storage ss;
+        const char* hostname;
+        Validation validation;
+    } serverStatus[MAXNS];
+};
+
+class PrivateDnsConfiguration {
+  public:
+    int set(int32_t netId, uint32_t mark, const std::vector<std::string>& servers,
+            const std::string& name, const std::set<std::vector<uint8_t>>& fingerprints);
+
+    PrivateDnsStatus getStatus(unsigned netId);
+
+    // DEPRECATED, use getStatus() above.
+    void getStatus(unsigned netId, ExternalPrivateDnsStatus* status);
+
+    void clear(unsigned netId);
+
+  private:
+    typedef std::map<DnsTlsServer, Validation, AddressComparator> PrivateDnsTracker;
+
+    void validatePrivateDnsProvider(const DnsTlsServer& server, PrivateDnsTracker& tracker,
+                                    unsigned netId, uint32_t mark) REQUIRES(mPrivateDnsLock);
+
+    bool recordPrivateDnsValidation(const DnsTlsServer& server, unsigned netId, bool success);
+
+    // Start validation for newly added servers as well as any servers that have
+    // landed in Validation::fail state. Note that servers that have failed
+    // multiple validation attempts but for which there is still a validating
+    // thread running are marked as being Validation::in_process.
+    bool needsValidation(const PrivateDnsTracker& tracker, const DnsTlsServer& server);
+
+    std::mutex mPrivateDnsLock;
+    std::map<unsigned, PrivateDnsMode> mPrivateDnsModes GUARDED_BY(mPrivateDnsLock);
+    // Structure for tracking the validation status of servers on a specific netId.
+    // Using the AddressComparator ensures at most one entry per IP address.
+    std::map<unsigned, PrivateDnsTracker> mPrivateDnsTransports GUARDED_BY(mPrivateDnsLock);
+};
+
+extern PrivateDnsConfiguration gPrivateDnsConfiguration;
+
+}  // namespace net
+}  // namespace android
+
+#endif /* NETD_RESOLV_PRIVATEDNSCONFIGURATION_H */
diff --git a/resolv/README.md b/resolv/README.md
new file mode 100644
index 0000000..8fe4c89
--- /dev/null
+++ b/resolv/README.md
@@ -0,0 +1,134 @@
+# DNS-over-TLS query forwarder design
+
+## Overview
+
+The DNS-over-TLS query forwarder consists of five classes:
+ * `DnsTlsDispatcher`
+ * `DnsTlsTransport`
+ * `DnsTlsQueryMap`
+ * `DnsTlsSessionCache`
+ * `DnsTlsSocket`
+
+`DnsTlsDispatcher` is a singleton class whose `query` method is the DnsTls's
+only public interface.  `DnsTlsDispatcher` is just a table holding the
+`DnsTlsTransport` for each server (represented by a `DnsTlsServer` struct) and
+network.  `DnsTlsDispatcher` also blocks each query thread, waiting on a
+`std::future` returned by `DnsTlsTransport` that represents the response.
+
+`DnsTlsTransport` sends each query over a `DnsTlsSocket`, opening a
+new one if necessary.  It also has to listen for responses from the
+`DnsTlsSocket`, which happen on a different thread.
+`IDnsTlsSocketObserver` is an interface defining how `DnsTlsSocket` returns
+responses to `DnsTlsTransport`.
+
+`DnsTlsQueryMap` and `DnsTlsSessionCache` are helper classes owned by `DnsTlsTransport`.
+`DnsTlsQueryMap` handles ID renumbering and query-response pairing.
+`DnsTlsSessionCache` allows TLS session resumption.
+
+`DnsTlsSocket` interleaves all queries onto a single socket, and reports all
+responses to `DnsTlsTransport` (through the `IDnsTlsObserver` interface).  It doesn't
+know anything about which queries correspond to which responses, and does not retain
+state to indicate whether there is an outstanding query.
+
+## Threading
+
+### Overall patterns
+
+For clarity, each of the five classes in this design is thread-safe and holds one lock.
+Classes that spawn a helper thread call `thread::join()` in their destructor to ensure
+that it is cleaned up appropriately.
+
+All the classes here make full use of Clang thread annotations (and also null-pointer
+annotations) to minimize the likelihood of a latent threading bug.  The unit tests are
+also heavily threaded to exercise this functionality.
+
+This code creates O(1) threads per socket, and does not create a new thread for each
+query or response.  However, DnsProxyListener does create a thread for each query.
+
+### Threading in `DnsTlsSocket`
+
+`DnsTlsSocket` can receive queries on any thread, and send them over a
+"reliable datagram pipe" (`socketpair()` in `SOCK_SEQPACKET` mode).
+The query method writes a struct (containing a pointer to the query) to the pipe
+from its thread, and the loop thread (which owns the SSL socket)
+reads off the other end of the pipe.  The pipe doesn't actually have a queue "inside";
+instead, any queueing happens by blocking the query thread until the
+socket thread can read the datagram off the other end.
+
+We need to pass messages between threads using a pipe, and not a condition variable
+or a thread-safe queue, because the socket thread has to be blocked
+in `poll()` waiting for data from the server, but also has to be woken
+up on inputs from the query threads.  Therefore, inputs from the query
+threads have to arrive on a socket, so that `poll()` can listen for them.
+(There can only be a single thread because [you can't use different threads
+to read and write in OpenSSL](https://www.openssl.org/blog/blog/2017/02/21/threads/)).
+
+## ID renumbering
+
+`DnsTlsDispatcher` accepts queries that have colliding ID numbers and still sends them on
+a single socket.  To avoid confusion at the server, `DnsTlsQueryMap` assigns each
+query a new ID for transmission, records the mapping from input IDs to sent IDs, and
+applies the inverse mapping to responses before returning them to the caller.
+
+`DnsTlsQueryMap` assigns each new query the ID number one greater than the largest
+ID number of an outstanding query.  This means that ID numbers are initially sequential
+and usually small.  If the largest possible ID number is already in use,
+`DnsTlsQueryMap` will scan the ID space to find an available ID, or fail the query
+if there are no available IDs.  Queries will not block waiting for an ID number to
+become available.
+
+## Time constants
+
+`DnsTlsSocket` imposes a 20-second inactivity timeout.  A socket that has been idle for
+20 seconds will be closed.  This sets the limit of tolerance for slow replies,
+which could happen as a result of malfunctioning authoritative DNS servers.
+If there are any pending queries, `DnsTlsTransport` will retry them.
+
+`DnsTlsQueryMap` imposes a retry limit of 3.  `DnsTlsTransport` will retry the query up
+to 3 times before reporting failure to `DnsTlsDispatcher`.
+This limit helps to ensure proper functioning in the case of a recursive resolver that
+is malfunctioning or is flooded with requests that are stalled due to malfunctioning
+authoritative servers.
+
+`DnsTlsDispatcher` maintains a 5-minute timeout.  Any `DnsTlsTransport` that has had no
+outstanding queries for 5 minutes will be destroyed at the next query on a different
+transport.
+This sets the limit on how long session tickets will be preserved during idle periods,
+because each `DnsTlsTransport` owns a `DnsTlsSessionCache`.  Imposing this timeout
+increases latency on the first query after an idle period, but also helps to avoid
+unbounded memory usage.
+
+`DnsTlsSessionCache` sets a limit of 5 sessions in each cache, expiring the oldest one
+when the limit is reached.  However, because the client code does not currently
+reuse sessions more than once, it should not be possible to hit this limit.
+
+## Testing
+
+Unit tests are in `dns_tls_test.cpp`. They cover all the classes except
+`DnsTlsSocket` (which requires `CAP_NET_ADMIN` because it uses `setsockopt(SO_MARK)`) and
+`DnsTlsSessionCache` (which requires integration with libssl).  These classes are
+exercised by the integration tests in `../tests/resolv_test.cpp`.
+
+### Dependency Injection
+
+For unit testing, we would like to be able to mock out `DnsTlsSocket`.  This is
+particularly required for unit testing of `DnsTlsDispatcher` and `DnsTlsTransport`.
+To make these unit tests possible, this code uses a dependency injection pattern:
+`DnsTlsSocket` is produced by a `DnsTlsSocketFactory`, and both of these have a
+defined interface.
+
+`DnsTlsDispatcher`'s constructor takes an `IDnsTlsSocketFactory`,
+which in production is a `DnsTlsSocketFactory`.  However, in unit tests, we can
+substitute a test factory that returns a fake socket, so that the unit tests can
+run without actually connecting over TLS to a test server.  (The integration tests
+do actual TLS.)
+
+## Logging
+
+This code uses `ALOGV` throughout for low-priority logging, and does not use
+`ALOGD`.  `ALOGV` is disabled by default, unless activated by `#define LOG_NDEBUG 0`.
+(`ALOGD` is not disabled by default, requiring extra measures to avoid spamming the
+system log in production builds.)
+
+## Reference
+ * [BoringSSL API docs](https://commondatastorage.googleapis.com/chromium-boringssl-docs/headers.html)
diff --git a/resolv/ResolverController.cpp b/resolv/ResolverController.cpp
new file mode 100644
index 0000000..ac24259
--- /dev/null
+++ b/resolv/ResolverController.cpp
@@ -0,0 +1,383 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "ResolverController"
+
+#include "ResolverController.h"
+
+#include <set>
+#include <string>
+#include <vector>
+
+#include <netdb.h>
+
+#include <aidl/android/net/IDnsResolver.h>
+#include <android-base/logging.h>
+#include <android-base/strings.h>
+
+#include "Dns64Configuration.h"
+#include "DnsResolver.h"
+#include "Fwmark.h"
+#include "PrivateDnsConfiguration.h"
+#include "ResolverEventReporter.h"
+#include "ResolverStats.h"
+#include "netd_resolv/stats.h"
+#include "resolv_cache.h"
+
+using namespace std::placeholders;
+using aidl::android::net::ResolverParamsParcel;
+
+namespace android {
+
+using netdutils::DumpWriter;
+
+namespace net {
+
+namespace {
+
+std::string addrToString(const sockaddr_storage* addr) {
+    char out[INET6_ADDRSTRLEN] = {0};
+    getnameinfo((const sockaddr*)addr, sizeof(sockaddr_storage), out, INET6_ADDRSTRLEN, nullptr, 0,
+                NI_NUMERICHOST);
+    return std::string(out);
+}
+
+const char* getPrivateDnsModeString(PrivateDnsMode mode) {
+    switch (mode) {
+        case PrivateDnsMode::OFF:
+            return "OFF";
+        case PrivateDnsMode::OPPORTUNISTIC:
+            return "OPPORTUNISTIC";
+        case PrivateDnsMode::STRICT:
+            return "STRICT";
+    }
+}
+
+constexpr const char* validationStatusToString(Validation value) {
+    switch (value) {
+        case Validation::in_process:
+            return "in_process";
+        case Validation::success:
+            return "success";
+        case Validation::fail:
+            return "fail";
+        case Validation::unknown_server:
+            return "unknown_server";
+        case Validation::unknown_netid:
+            return "unknown_netid";
+        default:
+            return "unknown_status";
+    }
+}
+
+void sendNat64PrefixEvent(const Dns64Configuration::Nat64PrefixInfo& args) {
+    const auto& listeners = ResolverEventReporter::getInstance().getListeners();
+    if (listeners.size() == 0) {
+        LOG(ERROR) << __func__ << ": No available listener. dropping NAT64 prefix event";
+        return;
+    }
+    for (const auto& it : listeners) {
+        it->onNat64PrefixEvent(args.netId, args.added, args.prefixString, args.prefixLength);
+    }
+}
+
+int getDnsInfo(unsigned netId, std::vector<std::string>* servers, std::vector<std::string>* domains,
+               res_params* params, std::vector<android::net::ResolverStats>* stats,
+               std::vector<int32_t>* wait_for_pending_req_timeout_count) {
+    using aidl::android::net::IDnsResolver;
+    using android::net::ResolverStats;
+    static_assert(ResolverStats::STATS_SUCCESSES == IDnsResolver::RESOLVER_STATS_SUCCESSES &&
+                          ResolverStats::STATS_ERRORS == IDnsResolver::RESOLVER_STATS_ERRORS &&
+                          ResolverStats::STATS_TIMEOUTS == IDnsResolver::RESOLVER_STATS_TIMEOUTS &&
+                          ResolverStats::STATS_INTERNAL_ERRORS ==
+                                  IDnsResolver::RESOLVER_STATS_INTERNAL_ERRORS &&
+                          ResolverStats::STATS_RTT_AVG == IDnsResolver::RESOLVER_STATS_RTT_AVG &&
+                          ResolverStats::STATS_LAST_SAMPLE_TIME ==
+                                  IDnsResolver::RESOLVER_STATS_LAST_SAMPLE_TIME &&
+                          ResolverStats::STATS_USABLE == IDnsResolver::RESOLVER_STATS_USABLE &&
+                          ResolverStats::STATS_COUNT == IDnsResolver::RESOLVER_STATS_COUNT,
+                  "AIDL and ResolverStats.h out of sync");
+    int nscount = -1;
+    sockaddr_storage res_servers[MAXNS];
+    int dcount = -1;
+    char res_domains[MAXDNSRCH][MAXDNSRCHPATH];
+    res_stats res_stats[MAXNS];
+    servers->clear();
+    domains->clear();
+    *params = res_params{};
+    stats->clear();
+    int res_wait_for_pending_req_timeout_count;
+    int revision_id = android_net_res_stats_get_info_for_net(
+            netId, &nscount, res_servers, &dcount, res_domains, params, res_stats,
+            &res_wait_for_pending_req_timeout_count);
+
+    // If the netId is unknown (which can happen for valid net IDs for which no DNS servers have
+    // yet been configured), there is no revision ID. In this case there is no data to return.
+    if (revision_id < 0) {
+        return 0;
+    }
+
+    // Verify that the returned data is sane.
+    if (nscount < 0 || nscount > MAXNS || dcount < 0 || dcount > MAXDNSRCH) {
+        LOG(ERROR) << __func__ << ": nscount = " << nscount << ", dcount = " << dcount;
+        return -ENOTRECOVERABLE;
+    }
+
+    // Determine which servers are considered usable by the resolver.
+    bool valid_servers[MAXNS];
+    std::fill_n(valid_servers, MAXNS, false);
+    android_net_res_stats_get_usable_servers(params, res_stats, nscount, valid_servers);
+
+    // Convert the server sockaddr structures to std::string.
+    stats->resize(nscount);
+    for (int i = 0; i < nscount; ++i) {
+        char hbuf[NI_MAXHOST];
+        int rv =
+                getnameinfo(reinterpret_cast<const sockaddr*>(&res_servers[i]),
+                            sizeof(res_servers[i]), hbuf, sizeof(hbuf), nullptr, 0, NI_NUMERICHOST);
+        std::string server_str;
+        if (rv == 0) {
+            server_str.assign(hbuf);
+        } else {
+            LOG(ERROR) << "getnameinfo() failed for server #" << i << ": " << gai_strerror(rv);
+            server_str.assign("<invalid>");
+        }
+        servers->push_back(std::move(server_str));
+        android::net::ResolverStats& cur_stats = (*stats)[i];
+        android_net_res_stats_aggregate(&res_stats[i], &cur_stats.successes, &cur_stats.errors,
+                                        &cur_stats.timeouts, &cur_stats.internal_errors,
+                                        &cur_stats.rtt_avg, &cur_stats.last_sample_time);
+        cur_stats.usable = valid_servers[i];
+    }
+
+    // Convert the stack-allocated search domain strings to std::string.
+    for (int i = 0; i < dcount; ++i) {
+        domains->push_back(res_domains[i]);
+    }
+
+    (*wait_for_pending_req_timeout_count)[0] = res_wait_for_pending_req_timeout_count;
+    return 0;
+}
+
+}  // namespace
+
+ResolverController::ResolverController()
+    : mDns64Configuration(
+              [](uint32_t netId, uint32_t uid, android_net_context* netcontext) {
+                  gResNetdCallbacks.get_network_context(netId, uid, netcontext);
+              },
+              std::bind(sendNat64PrefixEvent, _1)) {}
+
+void ResolverController::destroyNetworkCache(unsigned netId) {
+    LOG(VERBOSE) << __func__ << ": netId = " << netId;
+
+    resolv_delete_cache_for_net(netId);
+    mDns64Configuration.stopPrefixDiscovery(netId);
+    gPrivateDnsConfiguration.clear(netId);
+}
+
+int ResolverController::createNetworkCache(unsigned netId) {
+    LOG(VERBOSE) << __func__ << ": netId = " << netId;
+
+    return resolv_create_cache_for_net(netId);
+}
+
+int ResolverController::setResolverConfiguration(
+        const ResolverParamsParcel& resolverParams,
+        const std::set<std::vector<uint8_t>>& tlsFingerprints) {
+    using aidl::android::net::IDnsResolver;
+
+    // At private DNS validation time, we only know the netId, so we have to guess/compute the
+    // corresponding socket mark.
+    Fwmark fwmark;
+    fwmark.netId = resolverParams.netId;
+    fwmark.explicitlySelected = true;
+    fwmark.protectedFromVpn = true;
+    fwmark.permission = PERMISSION_SYSTEM;
+
+    // Allow at most MAXNS private DNS servers in a network to prevent too many broken servers.
+    std::vector<std::string> tlsServers = resolverParams.tlsServers;
+    if (tlsServers.size() > MAXNS) {
+        tlsServers.resize(MAXNS);
+    }
+    const int err = gPrivateDnsConfiguration.set(resolverParams.netId, fwmark.intValue, tlsServers,
+                                                 resolverParams.tlsName, tlsFingerprints);
+    if (err != 0) {
+        return err;
+    }
+
+    // Convert network-assigned server list to bionic's format.
+    const size_t serverCount = std::min<size_t>(MAXNS, resolverParams.servers.size());
+    std::vector<const char*> server_ptrs;
+    for (size_t i = 0; i < serverCount; ++i) {
+        server_ptrs.push_back(resolverParams.servers[i].c_str());
+    }
+
+    std::string domains_str = android::base::Join(resolverParams.domains, " ");
+
+    // TODO: Change resolv_set_nameservers_for_net() to use ResolverParamsParcel directly.
+    res_params res_params = {};
+    res_params.sample_validity = resolverParams.sampleValiditySeconds;
+    res_params.success_threshold = resolverParams.successThreshold;
+    res_params.min_samples = resolverParams.minSamples;
+    res_params.max_samples = resolverParams.maxSamples;
+    res_params.base_timeout_msec = resolverParams.baseTimeoutMsec;
+    res_params.retry_count = resolverParams.retryCount;
+
+    LOG(VERBOSE) << "setDnsServers netId = " << resolverParams.netId
+                 << ", numservers = " << resolverParams.domains.size();
+
+    return -resolv_set_nameservers_for_net(resolverParams.netId, server_ptrs.data(),
+                                           server_ptrs.size(), domains_str.c_str(), &res_params);
+}
+
+int ResolverController::getResolverInfo(int32_t netId, std::vector<std::string>* servers,
+                                        std::vector<std::string>* domains,
+                                        std::vector<std::string>* tlsServers,
+                                        std::vector<int32_t>* params, std::vector<int32_t>* stats,
+                                        std::vector<int32_t>* wait_for_pending_req_timeout_count) {
+    using aidl::android::net::IDnsResolver;
+    using android::net::ResolverStats;
+    res_params res_params;
+    std::vector<ResolverStats> res_stats;
+    int ret = getDnsInfo(netId, servers, domains, &res_params, &res_stats,
+                         wait_for_pending_req_timeout_count);
+    if (ret != 0) {
+        return ret;
+    }
+
+    // Serialize the information for binder.
+    ResolverStats::encodeAll(res_stats, stats);
+
+    ExternalPrivateDnsStatus privateDnsStatus = {PrivateDnsMode::OFF, 0, {}};
+    gPrivateDnsConfiguration.getStatus(netId, &privateDnsStatus);
+    for (int i = 0; i < privateDnsStatus.numServers; i++) {
+        std::string tlsServer_str = addrToString(&(privateDnsStatus.serverStatus[i].ss));
+        tlsServers->push_back(std::move(tlsServer_str));
+    }
+
+    params->resize(IDnsResolver::RESOLVER_PARAMS_COUNT);
+    (*params)[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY] = res_params.sample_validity;
+    (*params)[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD] = res_params.success_threshold;
+    (*params)[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES] = res_params.min_samples;
+    (*params)[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES] = res_params.max_samples;
+    (*params)[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC] = res_params.base_timeout_msec;
+    (*params)[IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT] = res_params.retry_count;
+    return 0;
+}
+
+void ResolverController::startPrefix64Discovery(int32_t netId) {
+    mDns64Configuration.startPrefixDiscovery(netId);
+}
+
+void ResolverController::stopPrefix64Discovery(int32_t netId) {
+    return mDns64Configuration.stopPrefixDiscovery(netId);
+}
+
+// TODO: use StatusOr<T> to wrap the result.
+int ResolverController::getPrefix64(unsigned netId, netdutils::IPPrefix* prefix) {
+    netdutils::IPPrefix p = mDns64Configuration.getPrefix64(netId);
+    if (p.family() != AF_INET6 || p.length() == 0) {
+        LOG(ERROR) << "No valid NAT64 prefix (" << netId << ", " << p.toString().c_str() << ")";
+
+        return -ENOENT;
+    }
+    *prefix = p;
+    return 0;
+}
+
+void ResolverController::dump(DumpWriter& dw, unsigned netId) {
+    // No lock needed since Bionic's resolver locks all accessed data structures internally.
+    using android::net::ResolverStats;
+    std::vector<std::string> servers;
+    std::vector<std::string> domains;
+    res_params params = {};
+    std::vector<ResolverStats> stats;
+    std::vector<int32_t> wait_for_pending_req_timeout_count(1, 0);
+    time_t now = time(nullptr);
+    int rv = getDnsInfo(netId, &servers, &domains, &params, &stats,
+                        &wait_for_pending_req_timeout_count);
+    dw.incIndent();
+    if (rv != 0) {
+        dw.println("getDnsInfo() failed for netid %u", netId);
+    } else {
+        if (servers.empty()) {
+            dw.println("No DNS servers defined");
+        } else {
+            dw.println("DnsEvent subsampling map: " +
+                       android::base::Join(resolv_cache_dump_subsampling_map(netId), ' '));
+            dw.println(
+                    "DNS servers: # IP (total, successes, errors, timeouts, internal errors, "
+                    "RTT avg, last sample)");
+            dw.incIndent();
+            for (size_t i = 0; i < servers.size(); ++i) {
+                if (i < stats.size()) {
+                    const ResolverStats& s = stats[i];
+                    int total = s.successes + s.errors + s.timeouts + s.internal_errors;
+                    if (total > 0) {
+                        int time_delta = (s.last_sample_time > 0) ? now - s.last_sample_time : -1;
+                        dw.println("%s (%d, %d, %d, %d, %d, %dms, %ds)%s", servers[i].c_str(),
+                                   total, s.successes, s.errors, s.timeouts, s.internal_errors,
+                                   s.rtt_avg, time_delta, s.usable ? "" : " BROKEN");
+                    } else {
+                        dw.println("%s <no data>", servers[i].c_str());
+                    }
+                } else {
+                    dw.println("%s <no stats>", servers[i].c_str());
+                }
+            }
+            dw.decIndent();
+        }
+        if (domains.empty()) {
+            dw.println("No search domains defined");
+        } else {
+            std::string domains_str = android::base::Join(domains, ", ");
+            dw.println("search domains: %s", domains_str.c_str());
+        }
+        if (params.sample_validity != 0) {
+            dw.println(
+                    "DNS parameters: sample validity = %us, success threshold = %u%%, "
+                    "samples (min, max) = (%u, %u), base_timeout = %dmsec, retry count = "
+                    "%dtimes",
+                    params.sample_validity, params.success_threshold, params.min_samples,
+                    params.max_samples, params.base_timeout_msec, params.retry_count);
+        }
+
+        mDns64Configuration.dump(dw, netId);
+        ExternalPrivateDnsStatus privateDnsStatus = {PrivateDnsMode::OFF, 0, {}};
+        gPrivateDnsConfiguration.getStatus(netId, &privateDnsStatus);
+        dw.println("Private DNS mode: %s", getPrivateDnsModeString(privateDnsStatus.mode));
+        if (!privateDnsStatus.numServers) {
+            dw.println("No Private DNS servers configured");
+        } else {
+            dw.println("Private DNS configuration (%u entries)", privateDnsStatus.numServers);
+            dw.incIndent();
+            for (int i = 0; i < privateDnsStatus.numServers; i++) {
+                dw.println("%s name{%s} status{%s}",
+                           addrToString(&(privateDnsStatus.serverStatus[i].ss)).c_str(),
+                           privateDnsStatus.serverStatus[i].hostname,
+                           validationStatusToString(static_cast<Validation>(
+                                   privateDnsStatus.serverStatus[i].validation)));
+            }
+            dw.decIndent();
+        }
+        dw.println("Concurrent DNS query timeout: %d", wait_for_pending_req_timeout_count[0]);
+    }
+    dw.decIndent();
+}
+
+}  // namespace net
+}  // namespace android
diff --git a/resolv/ResolverController.h b/resolv/ResolverController.h
new file mode 100644
index 0000000..6d08cdb
--- /dev/null
+++ b/resolv/ResolverController.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _RESOLVER_CONTROLLER_H_
+#define _RESOLVER_CONTROLLER_H_
+
+#include <list>
+#include <set>
+#include <vector>
+
+#include <aidl/android/net/ResolverParamsParcel.h>
+#include "Dns64Configuration.h"
+#include "netd_resolv/resolv.h"
+#include "netdutils/DumpWriter.h"
+
+struct res_params;
+
+namespace android {
+namespace net {
+
+struct ResolverStats;
+
+class ResolverController {
+  public:
+    ResolverController();
+    ~ResolverController() = default;
+
+    void destroyNetworkCache(unsigned netid);
+    int createNetworkCache(unsigned netid);
+
+    int getPrefix64(unsigned netId, netdutils::IPPrefix* prefix);
+
+    // Binder specific functions, which convert between the ResolverParamsParcel and the
+    // actual data structures, and call setDnsServer() / getDnsInfo() for the actual processing.
+    int setResolverConfiguration(const aidl::android::net::ResolverParamsParcel& resolverParams,
+                                 const std::set<std::vector<uint8_t>>& tlsFingerprints);
+
+    int getResolverInfo(int32_t netId, std::vector<std::string>* servers,
+                        std::vector<std::string>* domains, std::vector<std::string>* tlsServers,
+                        std::vector<int32_t>* params, std::vector<int32_t>* stats,
+                        std::vector<int32_t>* wait_for_pending_req_timeout_count);
+
+    void startPrefix64Discovery(int32_t netId);
+    void stopPrefix64Discovery(int32_t netId);
+
+    void dump(netdutils::DumpWriter& dw, unsigned netId);
+
+  private:
+    Dns64Configuration mDns64Configuration;
+};
+}  // namespace net
+}  // namespace android
+
+#endif /* _RESOLVER_CONTROLLER_H_ */
diff --git a/resolv/ResolverEventReporter.cpp b/resolv/ResolverEventReporter.cpp
new file mode 100644
index 0000000..ccec08b
--- /dev/null
+++ b/resolv/ResolverEventReporter.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "ResolverEventReporter"
+
+#include "ResolverEventReporter.h"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+
+using aidl::android::net::metrics::INetdEventListener;
+
+ResolverEventReporter& ResolverEventReporter::getInstance() {
+    // It should be initialized only once.
+    static ResolverEventReporter instance;
+
+    // Add framework metrics listener. Because the binder service "netd_listener" may be launched
+    // later than Netd, try to get binder handler in every instance query if any. The framework
+    // metrics listener should be added only once if it has been already added successfully.
+    instance.addDefaultListener();
+
+    return instance;
+}
+
+ResolverEventReporter::ListenerSet ResolverEventReporter::getListeners() const {
+    return getListenersImpl();
+}
+
+int ResolverEventReporter::addListener(const std::shared_ptr<INetdEventListener>& listener) {
+    return addListenerImpl(listener);
+}
+
+// TODO: Consider registering metrics listener from framework and remove this function.
+// Currently, the framework listener "netd_listener" is shared by netd and libnetd_resolv.
+// Consider breaking it into two listeners. Once it has done, may let framework register
+// the listener proactively.
+void ResolverEventReporter::addDefaultListener() {
+    std::lock_guard lock(mMutex);
+
+    static bool added = false;
+    if (added) return;
+
+    // Use the non-blocking call AServiceManager_checkService in order not to delay DNS
+    // lookup threads when the netd_listener service is not ready.
+    ndk::SpAIBinder binder = ndk::SpAIBinder(AServiceManager_checkService("netd_listener"));
+    std::shared_ptr<INetdEventListener> listener = INetdEventListener::fromBinder(binder);
+
+    if (listener == nullptr) return;
+
+    if (!addListenerImplLocked(listener)) added = true;
+}
+
+void ResolverEventReporter::handleBinderDied(const void* who) {
+    std::lock_guard lock(mMutex);
+
+    // Use the raw binder pointer address to be the identification of dead binder. Treat "who"
+    // which passes the raw address of dead binder as an identification only.
+    auto found = std::find_if(mListeners.begin(), mListeners.end(),
+                              [=](const auto& it) { return static_cast<void*>(it.get()) == who; });
+
+    if (found != mListeners.end()) mListeners.erase(found);
+}
+
+ResolverEventReporter::ListenerSet ResolverEventReporter::getListenersImpl() const {
+    std::lock_guard lock(mMutex);
+    return mListeners;
+}
+
+int ResolverEventReporter::addListenerImpl(const std::shared_ptr<INetdEventListener>& listener) {
+    std::lock_guard lock(mMutex);
+    return addListenerImplLocked(listener);
+}
+
+int ResolverEventReporter::addListenerImplLocked(
+        const std::shared_ptr<INetdEventListener>& listener) {
+    if (listener == nullptr) {
+        LOG(ERROR) << "The listener should not be null";
+        return -EINVAL;
+    }
+
+    // TODO: Perhaps ignore the listener which comes from the same binder.
+    const auto& it = mListeners.find(listener);
+    if (it != mListeners.end()) {
+        LOG(WARNING) << "The listener was already subscribed";
+        return -EEXIST;
+    }
+
+    static AIBinder_DeathRecipient* deathRecipient = nullptr;
+    if (deathRecipient == nullptr) {
+        // The AIBinder_DeathRecipient object is used to manage all death recipients for multiple
+        // binder objects. It doesn't released because there should have at least one binder object
+        // from framework.
+        // TODO: Considering to remove death recipient for the binder object from framework because
+        // it doesn't need death recipient actually.
+        deathRecipient = AIBinder_DeathRecipient_new([](void* cookie) {
+            ResolverEventReporter::getInstance().handleBinderDied(cookie);
+        });
+    }
+
+    // Pass the raw binder pointer address to be the cookie of the death recipient. While the death
+    // notification is fired, the cookie is used for identifying which binder was died. Because
+    // the NDK binder doesn't pass dead binder pointer to binder death handler, the binder death
+    // handler can't know who was died via wp<IBinder>. The reason for wp<IBinder> is not passed
+    // is that NDK binder can't transform a wp<IBinder> to a wp<AIBinder> in some cases.
+    // See more information in b/128712772.
+    auto binder = listener->asBinder().get();
+    auto cookie = static_cast<void*>(listener.get());  // Used for dead binder identification.
+    binder_status_t status = AIBinder_linkToDeath(binder, deathRecipient, cookie);
+
+    if (STATUS_OK != status) {
+        LOG(ERROR) << "Failed to register death notification for INetdEventListener";
+        return -EAGAIN;
+    }
+
+    mListeners.insert(listener);
+    return 0;
+}
\ No newline at end of file
diff --git a/resolv/ResolverEventReporter.h b/resolv/ResolverEventReporter.h
new file mode 100644
index 0000000..eb0d9cf
--- /dev/null
+++ b/resolv/ResolverEventReporter.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef NETD_RESOLV_EVENT_REPORTER_H
+#define NETD_RESOLV_EVENT_REPORTER_H
+
+#include <set>
+
+#include <android-base/thread_annotations.h>
+
+#include "aidl/android/net/metrics/INetdEventListener.h"
+
+/*
+ * This class can be used to get the binder reference to the netd events listener service
+ * via stable runtime ABI which is achieved from libbinder_ndk. It also allows that
+ * register an event listener.
+ */
+class ResolverEventReporter {
+  public:
+    ResolverEventReporter(ResolverEventReporter const&) = delete;
+    ResolverEventReporter(ResolverEventReporter&&) = delete;
+    ResolverEventReporter& operator=(ResolverEventReporter const&) = delete;
+    ResolverEventReporter& operator=(ResolverEventReporter&&) = delete;
+
+    using ListenerSet = std::set<std::shared_ptr<aidl::android::net::metrics::INetdEventListener>>;
+
+    // Get the instance of the singleton ResolverEventReporter.
+    static ResolverEventReporter& getInstance();
+
+    // Return the binder from the singleton ResolverEventReporter. This method is threadsafe.
+    ListenerSet getListeners() const;
+
+    // Add the binder to the singleton ResolverEventReporter. This method is threadsafe.
+    int addListener(
+            const std::shared_ptr<aidl::android::net::metrics::INetdEventListener>& listener);
+
+  private:
+    ResolverEventReporter() = default;
+    ~ResolverEventReporter() = default;
+
+    void addDefaultListener() EXCLUDES(mMutex);
+    int addListenerImpl(
+            const std::shared_ptr<aidl::android::net::metrics::INetdEventListener>& listener)
+            EXCLUDES(mMutex);
+    int addListenerImplLocked(
+            const std::shared_ptr<aidl::android::net::metrics::INetdEventListener>& listener)
+            REQUIRES(mMutex);
+    ListenerSet getListenersImpl() const EXCLUDES(mMutex);
+    void handleBinderDied(const void* who) EXCLUDES(mMutex);
+
+    mutable std::mutex mMutex;
+    ListenerSet mListeners GUARDED_BY(mMutex);
+};
+
+#endif  // NETD_RESOLV_EVENT_REPORTER_H
diff --git a/resolv/ResolverStats.h b/resolv/ResolverStats.h
new file mode 100644
index 0000000..9140af8
--- /dev/null
+++ b/resolv/ResolverStats.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _RESOLVER_STATS_H_
+#define _RESOLVER_STATS_H_
+
+#include <time.h>
+
+namespace android {
+namespace net {
+
+struct ResolverStats {
+    // Offsets into the per-server resolver stats as encoded in vector<int32_t> stats of
+    // getResolverInfo() of Netd's binder interface. The stats are based on data reported by
+    // android_net_res_stats_get_info_for_net(), the usability is calculated by applying
+    // android_net_res_stats_get_usable_servers() to this data.
+    enum ResolverStatsOffsets {
+        STATS_SUCCESSES = 0,     // # successes counted for this server
+        STATS_ERRORS,            // # errors
+        STATS_TIMEOUTS,          // # timeouts
+        STATS_INTERNAL_ERRORS,   // # internal errors
+        STATS_RTT_AVG,           // average round-trip-time
+        STATS_LAST_SAMPLE_TIME,  // time in s when the last sample was recorded
+        STATS_USABLE,            // whether the server is considered usable
+        STATS_COUNT              // total count of integers in the per-server data
+    };
+
+    int successes{-1};
+    int errors{-1};
+    int timeouts{-1};
+    int internal_errors{-1};
+    int rtt_avg{-1};
+    time_t last_sample_time{0};
+    bool usable{false};
+
+    // Serialize the resolver stats to the end of |out|.
+    void encode(std::vector<int32_t>* out) const;
+
+    // Read the serialized resolverstats starting at |in[ofs]|.
+    ssize_t decode(const std::vector<int32_t>& in, ssize_t ofs);
+
+    // Serialize the contents of |stats| and append them to the end of |out|. Multiple arrays
+    // can be written to the same output vector in sequence, however, the corresponding call
+    // to decodeAll() will return the combined contents in one vector.
+    static void encodeAll(const std::vector<ResolverStats>& stats, std::vector<int32_t>* out);
+
+    // Decodes the serialized ResolverStats from |in| and appends them to stats.
+    static bool decodeAll(const std::vector<int32_t>& in, std::vector<ResolverStats>* stats);
+};
+
+inline void ResolverStats::encode(std::vector<int32_t>* out) const {
+    size_t ofs = out->size();
+    out->resize(ofs + STATS_COUNT);
+    int32_t* cur = &(*out)[ofs];
+    cur[STATS_SUCCESSES] = successes;
+    cur[STATS_ERRORS] = errors;
+    cur[STATS_TIMEOUTS] = timeouts;
+    cur[STATS_INTERNAL_ERRORS] = internal_errors;
+    cur[STATS_RTT_AVG] = rtt_avg;
+    cur[STATS_LAST_SAMPLE_TIME] = last_sample_time;
+    cur[STATS_USABLE] = usable;
+}
+
+// Read the serialized resolverstats starting at |in[ofs]|.
+inline ssize_t ResolverStats::decode(const std::vector<int32_t>& in, ssize_t ofs) {
+    if (ofs < 0 || static_cast<size_t>(ofs) + STATS_COUNT > in.size()) {
+        return -1;
+    }
+    const int32_t* cur = &in[ofs];
+    successes = cur[STATS_SUCCESSES];
+    errors = cur[STATS_ERRORS];
+    timeouts = cur[STATS_TIMEOUTS];
+    internal_errors = cur[STATS_INTERNAL_ERRORS];
+    rtt_avg = cur[STATS_RTT_AVG];
+    last_sample_time = cur[STATS_LAST_SAMPLE_TIME];
+    usable = cur[STATS_USABLE];
+    return ofs + STATS_COUNT;
+}
+
+inline void ResolverStats::encodeAll(const std::vector<ResolverStats>& stats,
+                                     std::vector<int32_t>* out) {
+    for (const auto& s : stats) {
+        s.encode(out);
+    }
+}
+
+// TODO: Replace with a better representation, e.g. a Parcelable.
+inline bool ResolverStats::decodeAll(const std::vector<int32_t>& in,
+                                     std::vector<ResolverStats>* stats) {
+    ssize_t size = in.size();
+    if (size % STATS_COUNT) {
+        return false;
+    }
+    stats->resize(size / STATS_COUNT);
+    ssize_t ofs = 0;
+    for (auto& s : *stats) {
+        ofs = s.decode(in, ofs);
+        if (ofs < 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
+}  // namespace net
+}  // namespace android
+
+#endif /* _RESOLVER_STATS_H_ */
diff --git a/resolv/aidl/dnsresolver/1/android/net/IDnsResolver.aidl b/resolv/aidl/dnsresolver/1/android/net/IDnsResolver.aidl
new file mode 100644
index 0000000..c4b2b6d
--- /dev/null
+++ b/resolv/aidl/dnsresolver/1/android/net/IDnsResolver.aidl
@@ -0,0 +1,27 @@
+package android.net;
+interface IDnsResolver {
+  boolean isAlive();
+  void registerEventListener(android.net.metrics.INetdEventListener listener);
+  void setResolverConfiguration(in android.net.ResolverParamsParcel resolverParams);
+  void getResolverInfo(int netId, out @utf8InCpp String[] servers, out @utf8InCpp String[] domains, out @utf8InCpp String[] tlsServers, out int[] params, out int[] stats, out int[] wait_for_pending_req_timeout_count);
+  void startPrefix64Discovery(int netId);
+  void stopPrefix64Discovery(int netId);
+  @utf8InCpp String getPrefix64(int netId);
+  void createNetworkCache(int netId);
+  void destroyNetworkCache(int netId);
+  const int RESOLVER_PARAMS_SAMPLE_VALIDITY = 0;
+  const int RESOLVER_PARAMS_SUCCESS_THRESHOLD = 1;
+  const int RESOLVER_PARAMS_MIN_SAMPLES = 2;
+  const int RESOLVER_PARAMS_MAX_SAMPLES = 3;
+  const int RESOLVER_PARAMS_BASE_TIMEOUT_MSEC = 4;
+  const int RESOLVER_PARAMS_RETRY_COUNT = 5;
+  const int RESOLVER_PARAMS_COUNT = 6;
+  const int RESOLVER_STATS_SUCCESSES = 0;
+  const int RESOLVER_STATS_ERRORS = 1;
+  const int RESOLVER_STATS_TIMEOUTS = 2;
+  const int RESOLVER_STATS_INTERNAL_ERRORS = 3;
+  const int RESOLVER_STATS_RTT_AVG = 4;
+  const int RESOLVER_STATS_LAST_SAMPLE_TIME = 5;
+  const int RESOLVER_STATS_USABLE = 6;
+  const int RESOLVER_STATS_COUNT = 7;
+}
diff --git a/resolv/aidl/dnsresolver/1/android/net/ResolverParamsParcel.aidl b/resolv/aidl/dnsresolver/1/android/net/ResolverParamsParcel.aidl
new file mode 100644
index 0000000..b808bae
--- /dev/null
+++ b/resolv/aidl/dnsresolver/1/android/net/ResolverParamsParcel.aidl
@@ -0,0 +1,15 @@
+package android.net;
+parcelable ResolverParamsParcel {
+  int netId;
+  int sampleValiditySeconds;
+  int successThreshold;
+  int minSamples;
+  int maxSamples;
+  int baseTimeoutMsec;
+  int retryCount;
+  @utf8InCpp String[] servers;
+  @utf8InCpp String[] domains;
+  @utf8InCpp String tlsName;
+  @utf8InCpp String[] tlsServers;
+  @utf8InCpp String[] tlsFingerprints;
+}
diff --git a/resolv/aidl/dnsresolver/2/android/net/IDnsResolver.aidl b/resolv/aidl/dnsresolver/2/android/net/IDnsResolver.aidl
new file mode 100644
index 0000000..846bbec
--- /dev/null
+++ b/resolv/aidl/dnsresolver/2/android/net/IDnsResolver.aidl
@@ -0,0 +1,50 @@
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a frozen snapshot of an AIDL interface (or parcelable). Do not
+// try to edit this file. It looks like you are doing that because you have
+// modified an AIDL interface in a backward-incompatible way, e.g., deleting a
+// function from an interface or a field from a parcelable and it broke the
+// build. That breakage is intended.
+//
+// You must not make a backward incompatible changes to the AIDL files built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.net;
+interface IDnsResolver {
+  boolean isAlive();
+  void registerEventListener(android.net.metrics.INetdEventListener listener);
+  void setResolverConfiguration(in android.net.ResolverParamsParcel resolverParams);
+  void getResolverInfo(int netId, out @utf8InCpp String[] servers, out @utf8InCpp String[] domains, out @utf8InCpp String[] tlsServers, out int[] params, out int[] stats, out int[] wait_for_pending_req_timeout_count);
+  void startPrefix64Discovery(int netId);
+  void stopPrefix64Discovery(int netId);
+  @utf8InCpp String getPrefix64(int netId);
+  void createNetworkCache(int netId);
+  void destroyNetworkCache(int netId);
+  void setLogSeverity(int logSeverity);
+  const int RESOLVER_PARAMS_SAMPLE_VALIDITY = 0;
+  const int RESOLVER_PARAMS_SUCCESS_THRESHOLD = 1;
+  const int RESOLVER_PARAMS_MIN_SAMPLES = 2;
+  const int RESOLVER_PARAMS_MAX_SAMPLES = 3;
+  const int RESOLVER_PARAMS_BASE_TIMEOUT_MSEC = 4;
+  const int RESOLVER_PARAMS_RETRY_COUNT = 5;
+  const int RESOLVER_PARAMS_COUNT = 6;
+  const int RESOLVER_STATS_SUCCESSES = 0;
+  const int RESOLVER_STATS_ERRORS = 1;
+  const int RESOLVER_STATS_TIMEOUTS = 2;
+  const int RESOLVER_STATS_INTERNAL_ERRORS = 3;
+  const int RESOLVER_STATS_RTT_AVG = 4;
+  const int RESOLVER_STATS_LAST_SAMPLE_TIME = 5;
+  const int RESOLVER_STATS_USABLE = 6;
+  const int RESOLVER_STATS_COUNT = 7;
+  const int DNS_RESOLVER_LOG_VERBOSE = 0;
+  const int DNS_RESOLVER_LOG_DEBUG = 1;
+  const int DNS_RESOLVER_LOG_INFO = 2;
+  const int DNS_RESOLVER_LOG_WARNING = 3;
+  const int DNS_RESOLVER_LOG_ERROR = 4;
+}
diff --git a/resolv/aidl/dnsresolver/2/android/net/ResolverParamsParcel.aidl b/resolv/aidl/dnsresolver/2/android/net/ResolverParamsParcel.aidl
new file mode 100644
index 0000000..a37f938
--- /dev/null
+++ b/resolv/aidl/dnsresolver/2/android/net/ResolverParamsParcel.aidl
@@ -0,0 +1,32 @@
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a frozen snapshot of an AIDL interface (or parcelable). Do not
+// try to edit this file. It looks like you are doing that because you have
+// modified an AIDL interface in a backward-incompatible way, e.g., deleting a
+// function from an interface or a field from a parcelable and it broke the
+// build. That breakage is intended.
+//
+// You must not make a backward incompatible changes to the AIDL files built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.net;
+parcelable ResolverParamsParcel {
+  int netId;
+  int sampleValiditySeconds;
+  int successThreshold;
+  int minSamples;
+  int maxSamples;
+  int baseTimeoutMsec;
+  int retryCount;
+  @utf8InCpp String[] servers;
+  @utf8InCpp String[] domains;
+  @utf8InCpp String tlsName;
+  @utf8InCpp String[] tlsServers;
+  @utf8InCpp String[] tlsFingerprints;
+}
diff --git a/resolv/binder/android/net/IDnsResolver.aidl b/resolv/binder/android/net/IDnsResolver.aidl
new file mode 100644
index 0000000..f6f4092
--- /dev/null
+++ b/resolv/binder/android/net/IDnsResolver.aidl
@@ -0,0 +1,164 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net;
+
+import android.net.ResolverParamsParcel;
+import android.net.metrics.INetdEventListener;
+
+/** {@hide} */
+interface IDnsResolver {
+    /**
+     * Returns true if the service is responding.
+     */
+    boolean isAlive();
+
+   /**
+    * Register event listener
+    * DnsResolver supports multiple event listeners, but only one per unique address of the
+    * binder interface. A newer listener won't be registered if DnsResolver has an old one on
+    * the same address of the binder interface.
+    *
+    * @param listener event listener to register.
+    * @throws ServiceSpecificException in case of failure, with an error code corresponding to the
+    *         unix errno.
+    */
+    void registerEventListener(INetdEventListener listener);
+
+    // TODO: Delete these from the public interface
+    // Array indices for resolver parameters.
+    const int RESOLVER_PARAMS_SAMPLE_VALIDITY = 0;
+    const int RESOLVER_PARAMS_SUCCESS_THRESHOLD = 1;
+    const int RESOLVER_PARAMS_MIN_SAMPLES = 2;
+    const int RESOLVER_PARAMS_MAX_SAMPLES = 3;
+    const int RESOLVER_PARAMS_BASE_TIMEOUT_MSEC = 4;
+    const int RESOLVER_PARAMS_RETRY_COUNT = 5;
+    const int RESOLVER_PARAMS_COUNT = 6;
+
+    /**
+     * Sets the name servers, search domains and resolver params for the given network. Flushes the
+     * cache as needed (i.e. when the servers or the number of samples to store changes).
+     *
+     * @param resolverParams the resolver parameters to be wrapped into parcel.
+     * @throws ServiceSpecificException in case of failure, with an error code corresponding to the
+     *         unix errno.
+     */
+    void setResolverConfiguration(in ResolverParamsParcel resolverParams);
+
+    // Array indices for resolver stats.
+    const int RESOLVER_STATS_SUCCESSES = 0;
+    const int RESOLVER_STATS_ERRORS = 1;
+    const int RESOLVER_STATS_TIMEOUTS = 2;
+    const int RESOLVER_STATS_INTERNAL_ERRORS = 3;
+    const int RESOLVER_STATS_RTT_AVG = 4;
+    const int RESOLVER_STATS_LAST_SAMPLE_TIME = 5;
+    const int RESOLVER_STATS_USABLE = 6;
+    const int RESOLVER_STATS_COUNT = 7;
+
+    /**
+     * Retrieves the name servers, search domains and resolver stats associated with the given
+     * network ID.
+     *
+     * @param netId the network ID of the network for which information should be retrieved.
+     * @param servers the DNS servers that are currently configured for the network.
+     * @param domains the search domains currently configured.
+     * @param tlsServers the DNS-over-TLS servers that are currently configured for the network.
+     * @param params the resolver parameters configured, i.e. the contents of __res_params in order.
+     * @param stats the stats for each server in the order specified by RESOLVER_STATS_XXX
+     *         constants, serialized as an int array. The contents of this array are the number of
+     *         <ul>
+     *           <li> successes,
+     *           <li> errors,
+     *           <li> timeouts,
+     *           <li> internal errors,
+     *           <li> the RTT average,
+     *           <li> the time of the last recorded sample,
+     *           <li> and an integer indicating whether the server is usable (1) or broken (0).
+     *         </ul>
+     *         in this order. For example, the timeout counter for server N is stored at position
+     *         RESOLVER_STATS_COUNT*N + RESOLVER_STATS_TIMEOUTS
+     * @param wait_for_pending_req_timeout_count an internal counter used to count the number of
+     *        timeouts while resolver is handling concurrent DNS queries on the same hostname.
+     * @throws ServiceSpecificException in case of failure, with an error code corresponding to the
+     *         unix errno.
+     *
+     * TODO: Consider replacing stats and params with parcelables.
+     */
+    void getResolverInfo(int netId, out @utf8InCpp String[] servers,
+            out @utf8InCpp String[] domains, out @utf8InCpp String[] tlsServers, out int[] params,
+            out int[] stats, out int[] wait_for_pending_req_timeout_count);
+
+    /**
+     * Starts NAT64 prefix discovery on the given network.
+     *
+     * @param netId the netId to start prefix discovery on.
+     */
+    void startPrefix64Discovery(int netId);
+
+    /**
+     * Stops NAT64 prefix discovery on the given network.
+     *
+     * @param netId the netId to stop prefix discovery on.
+     */
+    void stopPrefix64Discovery(int netId);
+
+    /**
+     * Get NAT64 prefix in format Pref64::/n which is described in RFC6147 section 2. This
+     * interface is used for internal test only. Don't use it for other purposes because doing so
+     * would cause race conditions with the NAT64 prefix notifications.
+     *
+     * @param netId the network ID of the network to get the prefix
+     * @return the NAT64 prefix if the query operation was successful
+     * @throws ServiceSpecificException in case of failure, with an error code indicating the
+     *         cause of the the failure.
+     *
+     * TODO: Remove this once the tests have been updated to listen for onNat64PrefixEvent.
+     */
+    @utf8InCpp String getPrefix64(int netId);
+
+    /**
+     * Create cache for the given network.
+     *
+     * @param netId the network ID of the network to create.
+     * @throws ServiceSpecificException in case of failure, with an error code indicating the
+     *         cause of the failure.
+     */
+    void createNetworkCache(int netId);
+
+    /**
+     * Destroy cache for the given network.
+     *
+     * @param netId the network ID of the network to destroy.
+     */
+    void destroyNetworkCache(int netId);
+
+    // Refer to enum LogSeverity from system/core/base/include/android-base/logging.h
+    const int DNS_RESOLVER_LOG_VERBOSE = 0;
+    const int DNS_RESOLVER_LOG_DEBUG = 1;
+    const int DNS_RESOLVER_LOG_INFO = 2;
+    const int DNS_RESOLVER_LOG_WARNING = 3;
+    const int DNS_RESOLVER_LOG_ERROR = 4;
+
+    /**
+     * Set DNS resolver log severity
+     *
+     * @param logSeverity print log in "VERBOSE", "DEBUG", "INFO", "WARNING", "ERROR".
+     *
+     * @throws ServiceSpecificException in case of failure, with an error code corresponding to the
+     *         POSIX errno.
+     */
+    void setLogSeverity(int logSeverity);
+}
diff --git a/resolv/binder/android/net/ResolverParamsParcel.aidl b/resolv/binder/android/net/ResolverParamsParcel.aidl
new file mode 100644
index 0000000..d25880f
--- /dev/null
+++ b/resolv/binder/android/net/ResolverParamsParcel.aidl
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.net;
+
+/**
+ * Configuration for a resolver parameters.
+ *
+ * {@hide}
+ */
+parcelable ResolverParamsParcel {
+    /**
+     * The network ID of the network for which information should be configured.
+     */
+    int netId;
+
+    /**
+     * Sample lifetime in seconds.
+     */
+    int sampleValiditySeconds;
+
+    /**
+     * Use to judge if the server is considered broken.
+     */
+    int successThreshold;
+
+    /**
+     * Min. # samples.
+     */
+    int minSamples;
+
+    /**
+     * Max # samples.
+     */
+    int maxSamples;
+
+    /**
+     * Retransmission interval in milliseconds.
+     */
+    int baseTimeoutMsec;
+
+    /**
+     * Number of retries.
+     */
+    int retryCount;
+
+    /**
+     * The DNS servers to configure for the network.
+     */
+    @utf8InCpp String[] servers;
+
+    /**
+     * The search domains to configure.
+     */
+    @utf8InCpp String[] domains;
+
+    /**
+     * The TLS subject name to require for all servers, or empty if there is none.
+     */
+    @utf8InCpp String   tlsName;
+
+    /**
+     * The DNS servers to configure for strict mode Private DNS.
+     */
+    @utf8InCpp String[] tlsServers;
+
+    /**
+     * An array containing TLS public key fingerprints (pins) of which each server must match
+     * at least one, or empty if there are no pinned keys.
+     */
+    // DEPRECATED: remove tlsFingerprints in new code
+    @utf8InCpp String[] tlsFingerprints;
+}
diff --git a/resolv/dns_responder/Android.bp b/resolv/dns_responder/Android.bp
new file mode 100644
index 0000000..4c28c21
--- /dev/null
+++ b/resolv/dns_responder/Android.bp
@@ -0,0 +1,24 @@
+cc_library_static {
+    name: "libnetd_test_dnsresponder",
+    defaults: ["netd_defaults"],
+    shared_libs: [
+        "libbase",
+        "libbinder",
+        "liblog",
+        "libnetd_client",
+        "libnetdutils",
+        "libssl",
+        "dnsresolver_aidl_interface-V2-cpp",
+        "netd_aidl_interface-V2-cpp",
+    ],
+    static_libs: ["libutils"],
+    include_dirs: [
+        "system/netd/server",
+    ],
+    srcs: [
+        "dns_responder.cpp",
+        "dns_responder_client.cpp",
+        "dns_tls_frontend.cpp",
+    ],
+    export_include_dirs: ["."],
+}
diff --git a/resolv/dns_responder/dns_responder.cpp b/resolv/dns_responder/dns_responder.cpp
new file mode 100644
index 0000000..5047255
--- /dev/null
+++ b/resolv/dns_responder/dns_responder.cpp
@@ -0,0 +1,994 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dns_responder.h"
+
+#include <arpa/inet.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/epoll.h>
+#include <sys/eventfd.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <set>
+
+#include <iostream>
+#include <vector>
+
+#define LOG_TAG "DNSResponder"
+#include <android-base/strings.h>
+#include <log/log.h>
+#include <netdutils/SocketOption.h>
+
+#include "NetdConstants.h"
+
+using android::netdutils::enableSockopt;
+
+namespace test {
+
+std::string errno2str() {
+    char error_msg[512] = { 0 };
+    // It actually calls __gnu_strerror_r() which returns the type |char*| rather than |int|.
+    // PLOG is an option though it requires lots of changes from ALOGx() to LOG(x).
+    return strerror_r(errno, error_msg, sizeof(error_msg));
+}
+
+#define APLOGI(fmt, ...) ALOGI(fmt ": [%d] %s", __VA_ARGS__, errno, errno2str().c_str())
+
+#if 0
+#define DBGLOG(fmt, ...) ALOGI(fmt, __VA_ARGS__)
+#else
+#define DBGLOG(fmt, ...)
+#endif
+
+std::string str2hex(const char* buffer, size_t len) {
+    std::string str(len*2, '\0');
+    for (size_t i = 0 ; i < len ; ++i) {
+        static const char* hex = "0123456789ABCDEF";
+        uint8_t c = buffer[i];
+        str[i*2] = hex[c >> 4];
+        str[i*2 + 1] = hex[c & 0x0F];
+    }
+    return str;
+}
+
+std::string addr2str(const sockaddr* sa, socklen_t sa_len) {
+    char host_str[NI_MAXHOST] = { 0 };
+    int rv = getnameinfo(sa, sa_len, host_str, sizeof(host_str), nullptr, 0,
+                         NI_NUMERICHOST);
+    if (rv == 0) return std::string(host_str);
+    return std::string();
+}
+
+/* DNS struct helpers */
+
+const char* dnstype2str(unsigned dnstype) {
+    static std::unordered_map<unsigned, const char*> kTypeStrs = {
+        { ns_type::ns_t_a, "A" },
+        { ns_type::ns_t_ns, "NS" },
+        { ns_type::ns_t_md, "MD" },
+        { ns_type::ns_t_mf, "MF" },
+        { ns_type::ns_t_cname, "CNAME" },
+        { ns_type::ns_t_soa, "SOA" },
+        { ns_type::ns_t_mb, "MB" },
+        { ns_type::ns_t_mb, "MG" },
+        { ns_type::ns_t_mr, "MR" },
+        { ns_type::ns_t_null, "NULL" },
+        { ns_type::ns_t_wks, "WKS" },
+        { ns_type::ns_t_ptr, "PTR" },
+        { ns_type::ns_t_hinfo, "HINFO" },
+        { ns_type::ns_t_minfo, "MINFO" },
+        { ns_type::ns_t_mx, "MX" },
+        { ns_type::ns_t_txt, "TXT" },
+        { ns_type::ns_t_rp, "RP" },
+        { ns_type::ns_t_afsdb, "AFSDB" },
+        { ns_type::ns_t_x25, "X25" },
+        { ns_type::ns_t_isdn, "ISDN" },
+        { ns_type::ns_t_rt, "RT" },
+        { ns_type::ns_t_nsap, "NSAP" },
+        { ns_type::ns_t_nsap_ptr, "NSAP-PTR" },
+        { ns_type::ns_t_sig, "SIG" },
+        { ns_type::ns_t_key, "KEY" },
+        { ns_type::ns_t_px, "PX" },
+        { ns_type::ns_t_gpos, "GPOS" },
+        { ns_type::ns_t_aaaa, "AAAA" },
+        { ns_type::ns_t_loc, "LOC" },
+        { ns_type::ns_t_nxt, "NXT" },
+        { ns_type::ns_t_eid, "EID" },
+        { ns_type::ns_t_nimloc, "NIMLOC" },
+        { ns_type::ns_t_srv, "SRV" },
+        { ns_type::ns_t_naptr, "NAPTR" },
+        { ns_type::ns_t_kx, "KX" },
+        { ns_type::ns_t_cert, "CERT" },
+        { ns_type::ns_t_a6, "A6" },
+        { ns_type::ns_t_dname, "DNAME" },
+        { ns_type::ns_t_sink, "SINK" },
+        { ns_type::ns_t_opt, "OPT" },
+        { ns_type::ns_t_apl, "APL" },
+        { ns_type::ns_t_tkey, "TKEY" },
+        { ns_type::ns_t_tsig, "TSIG" },
+        { ns_type::ns_t_ixfr, "IXFR" },
+        { ns_type::ns_t_axfr, "AXFR" },
+        { ns_type::ns_t_mailb, "MAILB" },
+        { ns_type::ns_t_maila, "MAILA" },
+        { ns_type::ns_t_any, "ANY" },
+        { ns_type::ns_t_zxfr, "ZXFR" },
+    };
+    auto it = kTypeStrs.find(dnstype);
+    static const char* kUnknownStr{ "UNKNOWN" };
+    if (it == kTypeStrs.end()) return kUnknownStr;
+    return it->second;
+}
+
+const char* dnsclass2str(unsigned dnsclass) {
+    static std::unordered_map<unsigned, const char*> kClassStrs = {
+        { ns_class::ns_c_in , "Internet" },
+        { 2, "CSNet" },
+        { ns_class::ns_c_chaos, "ChaosNet" },
+        { ns_class::ns_c_hs, "Hesiod" },
+        { ns_class::ns_c_none, "none" },
+        { ns_class::ns_c_any, "any" }
+    };
+    auto it = kClassStrs.find(dnsclass);
+    static const char* kUnknownStr{ "UNKNOWN" };
+    if (it == kClassStrs.end()) return kUnknownStr;
+    return it->second;
+}
+
+struct DNSName {
+    std::string name;
+    const char* read(const char* buffer, const char* buffer_end);
+    char* write(char* buffer, const char* buffer_end) const;
+    const char* toString() const;
+private:
+    const char* parseField(const char* buffer, const char* buffer_end,
+                           bool* last);
+};
+
+const char* DNSName::toString() const {
+    return name.c_str();
+}
+
+const char* DNSName::read(const char* buffer, const char* buffer_end) {
+    const char* cur = buffer;
+    bool last = false;
+    do {
+        cur = parseField(cur, buffer_end, &last);
+        if (cur == nullptr) {
+            ALOGI("parsing failed at line %d", __LINE__);
+            return nullptr;
+        }
+    } while (!last);
+    return cur;
+}
+
+char* DNSName::write(char* buffer, const char* buffer_end) const {
+    char* buffer_cur = buffer;
+    for (size_t pos = 0 ; pos < name.size() ; ) {
+        size_t dot_pos = name.find('.', pos);
+        if (dot_pos == std::string::npos) {
+            // Sanity check, should never happen unless parseField is broken.
+            ALOGI("logic error: all names are expected to end with a '.'");
+            return nullptr;
+        }
+        size_t len = dot_pos - pos;
+        if (len >= 256) {
+            ALOGI("name component '%s' is %zu long, but max is 255",
+                    name.substr(pos, dot_pos - pos).c_str(), len);
+            return nullptr;
+        }
+        if (buffer_cur + sizeof(uint8_t) + len > buffer_end) {
+            ALOGI("buffer overflow at line %d", __LINE__);
+            return nullptr;
+        }
+        *buffer_cur++ = len;
+        buffer_cur = std::copy(std::next(name.begin(), pos),
+                               std::next(name.begin(), dot_pos),
+                               buffer_cur);
+        pos = dot_pos + 1;
+    }
+    // Write final zero.
+    *buffer_cur++ = 0;
+    return buffer_cur;
+}
+
+const char* DNSName::parseField(const char* buffer, const char* buffer_end,
+                                bool* last) {
+    if (buffer + sizeof(uint8_t) > buffer_end) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    unsigned field_type = *buffer >> 6;
+    unsigned ofs = *buffer & 0x3F;
+    const char* cur = buffer + sizeof(uint8_t);
+    if (field_type == 0) {
+        // length + name component
+        if (ofs == 0) {
+            *last = true;
+            return cur;
+        }
+        if (cur + ofs > buffer_end) {
+            ALOGI("parsing failed at line %d", __LINE__);
+            return nullptr;
+        }
+        name.append(cur, ofs);
+        name.push_back('.');
+        return cur + ofs;
+    } else if (field_type == 3) {
+        ALOGI("name compression not implemented");
+        return nullptr;
+    }
+    ALOGI("invalid name field type");
+    return nullptr;
+}
+
+struct DNSQuestion {
+    DNSName qname;
+    unsigned qtype;
+    unsigned qclass;
+    const char* read(const char* buffer, const char* buffer_end);
+    char* write(char* buffer, const char* buffer_end) const;
+    std::string toString() const;
+};
+
+const char* DNSQuestion::read(const char* buffer, const char* buffer_end) {
+    const char* cur = qname.read(buffer, buffer_end);
+    if (cur == nullptr) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    if (cur + 2*sizeof(uint16_t) > buffer_end) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    qtype = ntohs(*reinterpret_cast<const uint16_t*>(cur));
+    qclass = ntohs(*reinterpret_cast<const uint16_t*>(cur + sizeof(uint16_t)));
+    return cur + 2*sizeof(uint16_t);
+}
+
+char* DNSQuestion::write(char* buffer, const char* buffer_end) const {
+    char* buffer_cur = qname.write(buffer, buffer_end);
+    if (buffer_cur == nullptr) return nullptr;
+    if (buffer_cur + 2*sizeof(uint16_t) > buffer_end) {
+        ALOGI("buffer overflow on line %d", __LINE__);
+        return nullptr;
+    }
+    *reinterpret_cast<uint16_t*>(buffer_cur) = htons(qtype);
+    *reinterpret_cast<uint16_t*>(buffer_cur + sizeof(uint16_t)) =
+            htons(qclass);
+    return buffer_cur + 2*sizeof(uint16_t);
+}
+
+std::string DNSQuestion::toString() const {
+    char buffer[4096];
+    int len = snprintf(buffer, sizeof(buffer), "Q<%s,%s,%s>", qname.toString(),
+                       dnstype2str(qtype), dnsclass2str(qclass));
+    return std::string(buffer, len);
+}
+
+struct DNSRecord {
+    DNSName name;
+    unsigned rtype;
+    unsigned rclass;
+    unsigned ttl;
+    std::vector<char> rdata;
+    const char* read(const char* buffer, const char* buffer_end);
+    char* write(char* buffer, const char* buffer_end) const;
+    std::string toString() const;
+private:
+    struct IntFields {
+        uint16_t rtype;
+        uint16_t rclass;
+        uint32_t ttl;
+        uint16_t rdlen;
+    } __attribute__((__packed__));
+
+    const char* readIntFields(const char* buffer, const char* buffer_end,
+            unsigned* rdlen);
+    char* writeIntFields(unsigned rdlen, char* buffer,
+                         const char* buffer_end) const;
+};
+
+const char* DNSRecord::read(const char* buffer, const char* buffer_end) {
+    const char* cur = name.read(buffer, buffer_end);
+    if (cur == nullptr) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    unsigned rdlen = 0;
+    cur = readIntFields(cur, buffer_end, &rdlen);
+    if (cur == nullptr) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    if (cur + rdlen > buffer_end) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    rdata.assign(cur, cur + rdlen);
+    return cur + rdlen;
+}
+
+char* DNSRecord::write(char* buffer, const char* buffer_end) const {
+    char* buffer_cur = name.write(buffer, buffer_end);
+    if (buffer_cur == nullptr) return nullptr;
+    buffer_cur = writeIntFields(rdata.size(), buffer_cur, buffer_end);
+    if (buffer_cur == nullptr) return nullptr;
+    if (buffer_cur + rdata.size() > buffer_end) {
+        ALOGI("buffer overflow on line %d", __LINE__);
+        return nullptr;
+    }
+    return std::copy(rdata.begin(), rdata.end(), buffer_cur);
+}
+
+std::string DNSRecord::toString() const {
+    char buffer[4096];
+    int len = snprintf(buffer, sizeof(buffer), "R<%s,%s,%s>", name.toString(),
+                       dnstype2str(rtype), dnsclass2str(rclass));
+    return std::string(buffer, len);
+}
+
+const char* DNSRecord::readIntFields(const char* buffer, const char* buffer_end,
+                                     unsigned* rdlen) {
+    if (buffer + sizeof(IntFields) > buffer_end ) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    const auto& intfields = *reinterpret_cast<const IntFields*>(buffer);
+    rtype = ntohs(intfields.rtype);
+    rclass = ntohs(intfields.rclass);
+    ttl = ntohl(intfields.ttl);
+    *rdlen = ntohs(intfields.rdlen);
+    return buffer + sizeof(IntFields);
+}
+
+char* DNSRecord::writeIntFields(unsigned rdlen, char* buffer,
+                                const char* buffer_end) const {
+    if (buffer + sizeof(IntFields) > buffer_end ) {
+        ALOGI("buffer overflow on line %d", __LINE__);
+        return nullptr;
+    }
+    auto& intfields = *reinterpret_cast<IntFields*>(buffer);
+    intfields.rtype = htons(rtype);
+    intfields.rclass = htons(rclass);
+    intfields.ttl = htonl(ttl);
+    intfields.rdlen = htons(rdlen);
+    return buffer + sizeof(IntFields);
+}
+
+struct DNSHeader {
+    unsigned id;
+    bool ra;
+    uint8_t rcode;
+    bool qr;
+    uint8_t opcode;
+    bool aa;
+    bool tr;
+    bool rd;
+    bool ad;
+    std::vector<DNSQuestion> questions;
+    std::vector<DNSRecord> answers;
+    std::vector<DNSRecord> authorities;
+    std::vector<DNSRecord> additionals;
+    const char* read(const char* buffer, const char* buffer_end);
+    char* write(char* buffer, const char* buffer_end) const;
+    std::string toString() const;
+
+private:
+    struct Header {
+        uint16_t id;
+        uint8_t flags0;
+        uint8_t flags1;
+        uint16_t qdcount;
+        uint16_t ancount;
+        uint16_t nscount;
+        uint16_t arcount;
+    } __attribute__((__packed__));
+
+    const char* readHeader(const char* buffer, const char* buffer_end,
+                           unsigned* qdcount, unsigned* ancount,
+                           unsigned* nscount, unsigned* arcount);
+};
+
+const char* DNSHeader::read(const char* buffer, const char* buffer_end) {
+    unsigned qdcount;
+    unsigned ancount;
+    unsigned nscount;
+    unsigned arcount;
+    const char* cur = readHeader(buffer, buffer_end, &qdcount, &ancount,
+                                 &nscount, &arcount);
+    if (cur == nullptr) {
+        ALOGI("parsing failed at line %d", __LINE__);
+        return nullptr;
+    }
+    if (qdcount) {
+        questions.resize(qdcount);
+        for (unsigned i = 0 ; i < qdcount ; ++i) {
+            cur = questions[i].read(cur, buffer_end);
+            if (cur == nullptr) {
+                ALOGI("parsing failed at line %d", __LINE__);
+                return nullptr;
+            }
+        }
+    }
+    if (ancount) {
+        answers.resize(ancount);
+        for (unsigned i = 0 ; i < ancount ; ++i) {
+            cur = answers[i].read(cur, buffer_end);
+            if (cur == nullptr) {
+                ALOGI("parsing failed at line %d", __LINE__);
+                return nullptr;
+            }
+        }
+    }
+    if (nscount) {
+        authorities.resize(nscount);
+        for (unsigned i = 0 ; i < nscount ; ++i) {
+            cur = authorities[i].read(cur, buffer_end);
+            if (cur == nullptr) {
+                ALOGI("parsing failed at line %d", __LINE__);
+                return nullptr;
+            }
+        }
+    }
+    if (arcount) {
+        additionals.resize(arcount);
+        for (unsigned i = 0 ; i < arcount ; ++i) {
+            cur = additionals[i].read(cur, buffer_end);
+            if (cur == nullptr) {
+                ALOGI("parsing failed at line %d", __LINE__);
+                return nullptr;
+            }
+        }
+    }
+    return cur;
+}
+
+char* DNSHeader::write(char* buffer, const char* buffer_end) const {
+    if (buffer + sizeof(Header) > buffer_end) {
+        ALOGI("buffer overflow on line %d", __LINE__);
+        return nullptr;
+    }
+    Header& header = *reinterpret_cast<Header*>(buffer);
+    // bytes 0-1
+    header.id = htons(id);
+    // byte 2: 7:qr, 3-6:opcode, 2:aa, 1:tr, 0:rd
+    header.flags0 = (qr << 7) | (opcode << 3) | (aa << 2) | (tr << 1) | rd;
+    // byte 3: 7:ra, 6:zero, 5:ad, 4:cd, 0-3:rcode
+    // Fake behavior: if the query set the "ad" bit, set it in the response too.
+    // In a real server, this should be set only if the data is authentic and the
+    // query contained an "ad" bit or DNSSEC extensions.
+    header.flags1 = (ad << 5) | rcode;
+    // rest of header
+    header.qdcount = htons(questions.size());
+    header.ancount = htons(answers.size());
+    header.nscount = htons(authorities.size());
+    header.arcount = htons(additionals.size());
+    char* buffer_cur = buffer + sizeof(Header);
+    for (const DNSQuestion& question : questions) {
+        buffer_cur = question.write(buffer_cur, buffer_end);
+        if (buffer_cur == nullptr) return nullptr;
+    }
+    for (const DNSRecord& answer : answers) {
+        buffer_cur = answer.write(buffer_cur, buffer_end);
+        if (buffer_cur == nullptr) return nullptr;
+    }
+    for (const DNSRecord& authority : authorities) {
+        buffer_cur = authority.write(buffer_cur, buffer_end);
+        if (buffer_cur == nullptr) return nullptr;
+    }
+    for (const DNSRecord& additional : additionals) {
+        buffer_cur = additional.write(buffer_cur, buffer_end);
+        if (buffer_cur == nullptr) return nullptr;
+    }
+    return buffer_cur;
+}
+
+std::string DNSHeader::toString() const {
+    // TODO
+    return std::string();
+}
+
+const char* DNSHeader::readHeader(const char* buffer, const char* buffer_end,
+                                  unsigned* qdcount, unsigned* ancount,
+                                  unsigned* nscount, unsigned* arcount) {
+    if (buffer + sizeof(Header) > buffer_end)
+        return nullptr;
+    const auto& header = *reinterpret_cast<const Header*>(buffer);
+    // bytes 0-1
+    id = ntohs(header.id);
+    // byte 2: 7:qr, 3-6:opcode, 2:aa, 1:tr, 0:rd
+    qr = header.flags0 >> 7;
+    opcode = (header.flags0 >> 3) & 0x0F;
+    aa = (header.flags0 >> 2) & 1;
+    tr = (header.flags0 >> 1) & 1;
+    rd = header.flags0 & 1;
+    // byte 3: 7:ra, 6:zero, 5:ad, 4:cd, 0-3:rcode
+    ra = header.flags1 >> 7;
+    ad = (header.flags1 >> 5) & 1;
+    rcode = header.flags1 & 0xF;
+    // rest of header
+    *qdcount = ntohs(header.qdcount);
+    *ancount = ntohs(header.ancount);
+    *nscount = ntohs(header.nscount);
+    *arcount = ntohs(header.arcount);
+    return buffer + sizeof(Header);
+}
+
+/* DNS responder */
+
+DNSResponder::DNSResponder(std::string listen_address, std::string listen_service,
+                           int poll_timeout_ms, ns_rcode error_rcode)
+    : listen_address_(std::move(listen_address)),
+      listen_service_(std::move(listen_service)),
+      poll_timeout_ms_(poll_timeout_ms),
+      error_rcode_(error_rcode) {}
+
+DNSResponder::~DNSResponder() {
+    stopServer();
+}
+
+void DNSResponder::addMapping(const std::string& name, ns_type type, const std::string& addr) {
+    std::lock_guard lock(mappings_mutex_);
+    auto it = mappings_.find(QueryKey(name, type));
+    if (it != mappings_.end()) {
+        ALOGI("Overwriting mapping for (%s, %s), previous address %s, new "
+              "address %s",
+              name.c_str(), dnstype2str(type), it->second.c_str(), addr.c_str());
+        it->second = addr;
+        return;
+    }
+    mappings_.try_emplace({name, type}, addr);
+}
+
+void DNSResponder::removeMapping(const std::string& name, ns_type type) {
+    std::lock_guard lock(mappings_mutex_);
+    auto it = mappings_.find(QueryKey(name, type));
+    if (it != mappings_.end()) {
+        ALOGI("Cannot remove mapping mapping from (%s, %s), not present", name.c_str(),
+              dnstype2str(type));
+        return;
+    }
+    mappings_.erase(it);
+}
+
+void DNSResponder::setResponseProbability(double response_probability) {
+    response_probability_ = response_probability;
+}
+
+void DNSResponder::setEdns(Edns edns) {
+    edns_ = edns;
+}
+
+bool DNSResponder::running() const {
+    return socket_.get() != -1;
+}
+
+bool DNSResponder::startServer() {
+    if (running()) {
+        ALOGI("server already running");
+        return false;
+    }
+
+    // Set up UDP socket.
+    addrinfo ai_hints{
+        .ai_family = AF_UNSPEC,
+        .ai_socktype = SOCK_DGRAM,
+        .ai_flags = AI_PASSIVE
+    };
+    addrinfo* ai_res = nullptr;
+    int rv = getaddrinfo(listen_address_.c_str(), listen_service_.c_str(),
+                         &ai_hints, &ai_res);
+    ScopedAddrinfo ai_res_cleanup(ai_res);
+    if (rv) {
+        ALOGI("getaddrinfo(%s, %s) failed: %s", listen_address_.c_str(),
+            listen_service_.c_str(), gai_strerror(rv));
+        return false;
+    }
+    for (const addrinfo* ai = ai_res ; ai ; ai = ai->ai_next) {
+        socket_.reset(socket(ai->ai_family, ai->ai_socktype | SOCK_NONBLOCK, ai->ai_protocol));
+        if (socket_.get() < 0) {
+            APLOGI("ignore creating socket %d failed", socket_.get());
+            continue;
+        }
+        enableSockopt(socket_.get(), SOL_SOCKET, SO_REUSEPORT).ignoreError();
+        enableSockopt(socket_.get(), SOL_SOCKET, SO_REUSEADDR).ignoreError();
+        std::string host_str = addr2str(ai->ai_addr, ai->ai_addrlen);
+        if (bind(socket_.get(), ai->ai_addr, ai->ai_addrlen)) {
+            APLOGI("failed to bind UDP %s:%s", host_str.c_str(), listen_service_.c_str());
+            continue;
+        }
+        ALOGI("bound to UDP %s:%s", host_str.c_str(), listen_service_.c_str());
+        break;
+    }
+
+    // Set up eventfd socket.
+    event_fd_.reset(eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC));
+    if (event_fd_.get() == -1) {
+        APLOGI("failed to create eventfd %d", event_fd_.get());
+        return false;
+    }
+
+    // Set up epoll socket.
+    epoll_fd_.reset(epoll_create1(EPOLL_CLOEXEC));
+    if (epoll_fd_.get() < 0) {
+        APLOGI("epoll_create1() failed on fd %d", epoll_fd_.get());
+        return false;
+    }
+
+    ALOGI("adding socket %d to epoll", socket_.get());
+    if (!addFd(socket_.get(), EPOLLIN)) {
+        ALOGE("failed to add the socket %d to epoll", socket_.get());
+        return false;
+    }
+    ALOGI("adding eventfd %d to epoll", event_fd_.get());
+    if (!addFd(event_fd_.get(), EPOLLIN)) {
+        ALOGE("failed to add the eventfd %d to epoll", event_fd_.get());
+        return false;
+    }
+
+    {
+        std::lock_guard lock(update_mutex_);
+        handler_thread_ = std::thread(&DNSResponder::requestHandler, this);
+    }
+    ALOGI("server started successfully");
+    return true;
+}
+
+bool DNSResponder::stopServer() {
+    std::lock_guard lock(update_mutex_);
+    if (!running()) {
+        ALOGI("server not running");
+        return false;
+    }
+    ALOGI("stopping server");
+    if (!sendToEventFd()) {
+        return false;
+    }
+    handler_thread_.join();
+    epoll_fd_.reset();
+    socket_.reset();
+    ALOGI("server stopped successfully");
+    return true;
+}
+
+std::vector<std::pair<std::string, ns_type >> DNSResponder::queries() const {
+    std::lock_guard lock(queries_mutex_);
+    return queries_;
+}
+
+std::string DNSResponder::dumpQueries() const {
+    std::lock_guard lock(queries_mutex_);
+    std::string out;
+    for (const auto& q : queries_) {
+        out += "{\"" + q.first + "\", " + std::to_string(q.second) + "} ";
+    }
+    return out;
+}
+
+void DNSResponder::clearQueries() {
+    std::lock_guard lock(queries_mutex_);
+    queries_.clear();
+}
+
+void DNSResponder::requestHandler() {
+    epoll_event evs[EPOLL_MAX_EVENTS];
+    while (true) {
+        int n = epoll_wait(epoll_fd_.get(), evs, EPOLL_MAX_EVENTS, poll_timeout_ms_);
+        if (n == 0) continue;
+        if (n < 0) {
+            APLOGI("epoll_wait() failed, n=%d", n);
+            return;
+        }
+
+        for (int i = 0; i < n; i++) {
+            const int fd = evs[i].data.fd;
+            const uint32_t events = evs[i].events;
+            if (fd == event_fd_.get() && (events & (EPOLLIN | EPOLLERR))) {
+                handleEventFd();
+                return;
+            } else if (fd == socket_.get() && (events & (EPOLLIN | EPOLLERR))) {
+                handleQuery();
+            } else {
+                ALOGW("unexpected epoll events 0x%x on fd %d", events, fd);
+            }
+        }
+    }
+}
+
+bool DNSResponder::handleDNSRequest(const char* buffer, ssize_t len,
+                                    char* response, size_t* response_len)
+                                    const {
+    DBGLOG("request: '%s'", str2hex(buffer, len).c_str());
+    const char* buffer_end = buffer + len;
+    DNSHeader header;
+    const char* cur = header.read(buffer, buffer_end);
+    // TODO(imaipi): for now, unparsable messages are silently dropped, fix.
+    if (cur == nullptr) {
+        ALOGI("failed to parse query");
+        return false;
+    }
+    if (header.qr) {
+        ALOGI("response received instead of a query");
+        return false;
+    }
+    if (header.opcode != ns_opcode::ns_o_query) {
+        ALOGI("unsupported request opcode received");
+        return makeErrorResponse(&header, ns_rcode::ns_r_notimpl, response,
+                                 response_len);
+    }
+    if (header.questions.empty()) {
+        ALOGI("no questions present");
+        return makeErrorResponse(&header, ns_rcode::ns_r_formerr, response,
+                                 response_len);
+    }
+    if (!header.answers.empty()) {
+        ALOGI("already %zu answers present in query", header.answers.size());
+        return makeErrorResponse(&header, ns_rcode::ns_r_formerr, response,
+                                 response_len);
+    }
+
+    if (edns_ == Edns::FORMERR_UNCOND) {
+        ALOGI("force to return RCODE FORMERR");
+        return makeErrorResponse(&header, ns_rcode::ns_r_formerr, response, response_len);
+    }
+
+    if (!header.additionals.empty() && edns_ != Edns::ON) {
+        ALOGI("DNS request has an additional section (assumed EDNS). "
+              "Simulating an ancient (pre-EDNS) server, and returning %s",
+              edns_ == Edns::FORMERR_ON_EDNS ? "RCODE FORMERR." : "no response.");
+        if (edns_ == Edns::FORMERR_ON_EDNS) {
+            return makeErrorResponse(&header, ns_rcode::ns_r_formerr, response, response_len);
+        }
+        // No response.
+        return false;
+    }
+    {
+        std::lock_guard lock(queries_mutex_);
+        for (const DNSQuestion& question : header.questions) {
+            queries_.push_back(make_pair(question.qname.name,
+                                         ns_type(question.qtype)));
+        }
+    }
+
+    // Ignore requests with the preset probability.
+    auto constexpr bound = std::numeric_limits<unsigned>::max();
+    if (arc4random_uniform(bound) > bound * response_probability_) {
+        if (error_rcode_ < 0) {
+            ALOGI("Returning no response");
+            return false;
+        } else {
+            ALOGI("returning RCODE %d in accordance with probability distribution",
+                  static_cast<int>(error_rcode_));
+            return makeErrorResponse(&header, error_rcode_, response, response_len);
+        }
+    }
+
+    for (const DNSQuestion& question : header.questions) {
+        if (question.qclass != ns_class::ns_c_in &&
+            question.qclass != ns_class::ns_c_any) {
+            ALOGI("unsupported question class %u", question.qclass);
+            return makeErrorResponse(&header, ns_rcode::ns_r_notimpl, response,
+                                     response_len);
+        }
+
+        if (!addAnswerRecords(question, &header.answers)) {
+            return makeErrorResponse(&header, ns_rcode::ns_r_servfail, response, response_len);
+        }
+    }
+
+    header.qr = true;
+    char* response_cur = header.write(response, response + *response_len);
+    if (response_cur == nullptr) {
+        return false;
+    }
+    *response_len = response_cur - response;
+    return true;
+}
+
+bool DNSResponder::addAnswerRecords(const DNSQuestion& question,
+                                    std::vector<DNSRecord>* answers) const {
+    std::lock_guard guard(mappings_mutex_);
+    std::string rname = question.qname.name;
+    std::vector<int> rtypes;
+
+    if (question.qtype == ns_type::ns_t_a || question.qtype == ns_type::ns_t_aaaa)
+        rtypes.push_back(ns_type::ns_t_cname);
+    rtypes.push_back(question.qtype);
+    for (int rtype : rtypes) {
+        std::set<std::string> cnames_Loop;
+        std::unordered_map<QueryKey, std::string, QueryKeyHash>::const_iterator it;
+        while ((it = mappings_.find(QueryKey(rname, rtype))) != mappings_.end()) {
+            if (rtype == ns_type::ns_t_cname) {
+                // When detect CNAME infinite loops by cnames_Loop, it won't save the duplicate one.
+                // As following, the query will stop on loop3 by detecting the same cname.
+                // loop1.{"a.xxx.com", ns_type::ns_t_cname, "b.xxx.com"}(insert in answer record)
+                // loop2.{"b.xxx.com", ns_type::ns_t_cname, "a.xxx.com"}(insert in answer record)
+                // loop3.{"a.xxx.com", ns_type::ns_t_cname, "b.xxx.com"}(When the same cname record
+                //   is found in cnames_Loop already, break the query loop.)
+                if (cnames_Loop.find(it->first.name) != cnames_Loop.end()) break;
+                cnames_Loop.insert(it->first.name);
+            }
+            DNSRecord record{
+                    .name = {.name = it->first.name},
+                    .rtype = it->first.type,
+                    .rclass = ns_class::ns_c_in,
+                    .ttl = 5,  // seconds
+            };
+            fillAnswerRdata(it->second, record);
+            answers->push_back(std::move(record));
+            if (rtype != ns_type::ns_t_cname) break;
+            rname = it->second;
+        }
+    }
+
+    if (answers->size() == 0) {
+        // TODO(imaipi): handle correctly
+        ALOGI("no mapping found for %s %s, lazily refusing to add an answer",
+              question.qname.name.c_str(), dnstype2str(question.qtype));
+    }
+
+    return true;
+}
+
+bool DNSResponder::fillAnswerRdata(const std::string& rdatastr, DNSRecord& record) const {
+    if (record.rtype == ns_type::ns_t_a) {
+        record.rdata.resize(4);
+        if (inet_pton(AF_INET, rdatastr.c_str(), record.rdata.data()) != 1) {
+            ALOGI("inet_pton(AF_INET, %s) failed", rdatastr.c_str());
+            return false;
+        }
+    } else if (record.rtype == ns_type::ns_t_aaaa) {
+        record.rdata.resize(16);
+        if (inet_pton(AF_INET6, rdatastr.c_str(), record.rdata.data()) != 1) {
+            ALOGI("inet_pton(AF_INET6, %s) failed", rdatastr.c_str());
+            return false;
+        }
+    } else if ((record.rtype == ns_type::ns_t_ptr) || (record.rtype == ns_type::ns_t_cname)) {
+        constexpr char delimiter = '.';
+        std::string name = rdatastr;
+        std::vector<char> rdata;
+
+        // Generating PTRDNAME field(section 3.3.12) or CNAME field(section 3.3.1) in rfc1035.
+        // The "name" should be an absolute domain name which ends in a dot.
+        if (name.back() != delimiter) {
+            ALOGI("invalid absolute domain name");
+            return false;
+        }
+        name.pop_back();  // remove the dot in tail
+        for (const std::string& label : android::base::Split(name, {delimiter})) {
+            // The length of label is limited to 63 octets or less. See RFC 1035 section 3.1.
+            if (label.length() == 0 || label.length() > 63) {
+                ALOGI("invalid label length");
+                return false;
+            }
+
+            rdata.push_back(label.length());
+            rdata.insert(rdata.end(), label.begin(), label.end());
+        }
+        rdata.push_back(0);  // Length byte of zero terminates the label list
+
+        // The length of domain name is limited to 255 octets or less. See RFC 1035 section 3.1.
+        if (rdata.size() > 255) {
+            ALOGI("invalid name length");
+            return false;
+        }
+        record.rdata = move(rdata);
+    } else {
+        ALOGI("unhandled qtype %s", dnstype2str(record.rtype));
+        return false;
+    }
+    return true;
+}
+
+bool DNSResponder::makeErrorResponse(DNSHeader* header, ns_rcode rcode,
+                                     char* response, size_t* response_len)
+                                     const {
+    header->answers.clear();
+    header->authorities.clear();
+    header->additionals.clear();
+    header->rcode = rcode;
+    header->qr = true;
+    char* response_cur = header->write(response, response + *response_len);
+    if (response_cur == nullptr) return false;
+    *response_len = response_cur - response;
+    return true;
+}
+
+void DNSResponder::setDeferredResp(bool deferred_resp) {
+    std::lock_guard<std::mutex> guard(cv_mutex_for_deferred_resp_);
+    deferred_resp_ = deferred_resp;
+    if (!deferred_resp_) {
+        cv_for_deferred_resp_.notify_one();
+    }
+}
+
+bool DNSResponder::addFd(int fd, uint32_t events) {
+    epoll_event ev;
+    ev.events = events;
+    ev.data.fd = fd;
+    if (epoll_ctl(epoll_fd_.get(), EPOLL_CTL_ADD, fd, &ev) < 0) {
+        APLOGI("epoll_ctl() for socket %d failed", fd);
+        return false;
+    }
+    return true;
+}
+
+void DNSResponder::handleQuery() {
+    char buffer[4096];
+    sockaddr_storage sa;
+    socklen_t sa_len = sizeof(sa);
+    ssize_t len;
+    do {
+        len = recvfrom(socket_.get(), buffer, sizeof(buffer), 0, (sockaddr*)&sa, &sa_len);
+    } while (len < 0 && (errno == EAGAIN || errno == EINTR));
+    if (len <= 0) {
+        APLOGI("recvfrom() failed, len=%zu", len);
+        return;
+    }
+    DBGLOG("read %zd bytes", len);
+    std::lock_guard lock(cv_mutex_);
+    char response[4096];
+    size_t response_len = sizeof(response);
+    if (handleDNSRequest(buffer, len, response, &response_len) && response_len > 0) {
+        // place wait_for after handleDNSRequest() so we can check the number of queries in
+        // test case before it got responded.
+        std::unique_lock guard(cv_mutex_for_deferred_resp_);
+        cv_for_deferred_resp_.wait(
+                guard, [this]() REQUIRES(cv_mutex_for_deferred_resp_) { return !deferred_resp_; });
+
+        len = sendto(socket_.get(), response, response_len, 0,
+                     reinterpret_cast<const sockaddr*>(&sa), sa_len);
+        std::string host_str = addr2str(reinterpret_cast<const sockaddr*>(&sa), sa_len);
+        if (len > 0) {
+            DBGLOG("sent %zu bytes to %s", len, host_str.c_str());
+        } else {
+            APLOGI("sendto() failed for %s", host_str.c_str());
+        }
+        // Test that the response is actually a correct DNS message.
+        const char* response_end = response + len;
+        DNSHeader header;
+        const char* cur = header.read(response, response_end);
+        if (cur == nullptr) ALOGW("response is flawed");
+    } else {
+        ALOGW("not responding");
+    }
+    cv.notify_one();
+    return;
+}
+
+bool DNSResponder::sendToEventFd() {
+    const uint64_t data = 1;
+    if (const ssize_t rt = write(event_fd_.get(), &data, sizeof(data)); rt != sizeof(data)) {
+        APLOGI("failed to write eventfd, rt=%zd", rt);
+        return false;
+    }
+    return true;
+}
+
+void DNSResponder::handleEventFd() {
+    int64_t data;
+    if (const ssize_t rt = read(event_fd_.get(), &data, sizeof(data)); rt != sizeof(data)) {
+        APLOGI("ignore reading eventfd failed, rt=%zd", rt);
+    }
+}
+
+}  // namespace test
diff --git a/resolv/dns_responder/dns_responder.h b/resolv/dns_responder/dns_responder.h
new file mode 100644
index 0000000..99b601f
--- /dev/null
+++ b/resolv/dns_responder/dns_responder.h
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless requied by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef DNS_RESPONDER_H
+#define DNS_RESPONDER_H
+
+#include <arpa/nameser.h>
+
+#include <atomic>
+#include <condition_variable>
+#include <mutex>
+#include <string>
+#include <thread>
+#include <unordered_map>
+#include <vector>
+
+#include <android-base/thread_annotations.h>
+#include "android-base/unique_fd.h"
+
+namespace test {
+
+struct DNSHeader;
+struct DNSQuestion;
+struct DNSRecord;
+
+inline const std::string kDefaultListenAddr = "127.0.0.3";
+inline const std::string kDefaultListenService = "53";
+inline const int kDefaultPollTimoutMillis = -1;
+
+/*
+ * Simple DNS responder, which replies to queries with the registered response
+ * for that type. Class is assumed to be IN. If no response is registered, the
+ * default error response code is returned.
+ */
+class DNSResponder {
+  public:
+    DNSResponder(std::string listen_address = kDefaultListenAddr,
+                 std::string listen_service = kDefaultListenService,
+                 int poll_timeout_ms = kDefaultPollTimoutMillis,
+                 ns_rcode error_rcode = ns_rcode::ns_r_servfail);
+    ~DNSResponder();
+
+    enum class Edns : uint8_t {
+        ON,
+        FORMERR_ON_EDNS, // DNS server not supporting EDNS will reply FORMERR.
+        FORMERR_UNCOND,  // DNS server reply FORMERR unconditionally
+        DROP             // DNS server not supporting EDNS will not do any response.
+    };
+
+    void addMapping(const std::string& name, ns_type type, const std::string& addr);
+    void removeMapping(const std::string& name, ns_type type);
+    void setResponseProbability(double response_probability);
+    void setEdns(Edns edns);
+    bool running() const;
+    bool startServer();
+    bool stopServer();
+    const std::string& listen_address() const {
+        return listen_address_;
+    }
+    const std::string& listen_service() const {
+        return listen_service_;
+    }
+    std::vector<std::pair<std::string, ns_type>> queries() const;
+    std::string dumpQueries() const;
+    void clearQueries();
+    std::condition_variable& getCv() { return cv; }
+    std::mutex& getCvMutex() { return cv_mutex_; }
+    void setDeferredResp(bool deferred_resp);
+
+  private:
+    // Key used for accessing mappings.
+    struct QueryKey {
+        std::string name;
+        unsigned type;
+
+        QueryKey(std::string n, unsigned t) : name(move(n)), type(t) {}
+        bool operator == (const QueryKey& o) const {
+            return name == o.name && type == o.type;
+        }
+        bool operator < (const QueryKey& o) const {
+            if (name < o.name) return true;
+            if (name > o.name) return false;
+            return type < o.type;
+        }
+    };
+
+    struct QueryKeyHash {
+        size_t operator() (const QueryKey& key) const {
+            return std::hash<std::string>()(key.name) +
+                   static_cast<size_t>(key.type);
+        }
+    };
+
+    void requestHandler();
+
+    // Parses and generates a response message for incoming DNS requests.
+    // Returns false to ignore the request, which might be due to either parsing error
+    // or unresponsiveness.
+    bool handleDNSRequest(const char* buffer, ssize_t buffer_len,
+                          char* response, size_t* response_len) const;
+
+    bool addAnswerRecords(const DNSQuestion& question, std::vector<DNSRecord>* answers) const;
+
+    bool fillAnswerRdata(const std::string& rdatastr, DNSRecord& record) const;
+
+    bool generateErrorResponse(DNSHeader* header, ns_rcode rcode,
+                               char* response, size_t* response_len) const;
+    bool makeErrorResponse(DNSHeader* header, ns_rcode rcode, char* response,
+                           size_t* response_len) const;
+
+    // Add a new file descriptor to be polled by the handler thread.
+    bool addFd(int fd, uint32_t events);
+
+    // Read the query sent from the client and send the answer back to the client. It
+    // makes sure the I/O communicated with the client is correct.
+    void handleQuery();
+
+    // Trigger the handler thread to terminate.
+    bool sendToEventFd();
+
+    // Used in the handler thread for the termination signal.
+    void handleEventFd();
+
+    // Address and service to listen on, currently limited to UDP.
+    const std::string listen_address_;
+    const std::string listen_service_;
+    // epoll_wait() timeout in ms.
+    const int poll_timeout_ms_;
+    // Error code to return for requests for an unknown name.
+    const ns_rcode error_rcode_;
+    // Probability that a valid response is being sent instead of being sent
+    // instead of returning error_rcode_.
+    std::atomic<double> response_probability_ = 1.0;
+    // Maximum number of fds for epoll.
+    const int EPOLL_MAX_EVENTS = 2;
+
+    // Control how the DNS server behaves when it receives the requests containing OPT RR.
+    // If it's set Edns::ON, the server can recognize and reply the response; if it's set
+    // Edns::FORMERR_ON_EDNS, the server behaves like an old DNS server that doesn't support EDNS0,
+    // and replying FORMERR; if it's Edns::DROP, the server doesn't support EDNS0 either, and
+    // ignoring the requests.
+    std::atomic<Edns> edns_ = Edns::ON;
+
+    // Mappings from (name, type) to registered response and the
+    // mutex protecting them.
+    std::unordered_map<QueryKey, std::string, QueryKeyHash> mappings_
+        GUARDED_BY(mappings_mutex_);
+    mutable std::mutex mappings_mutex_;
+    // Query names received so far and the corresponding mutex.
+    mutable std::vector<std::pair<std::string, ns_type>> queries_
+        GUARDED_BY(queries_mutex_);
+    mutable std::mutex queries_mutex_;
+    // Socket on which the server is listening.
+    android::base::unique_fd socket_;
+    // File descriptor for epoll.
+    android::base::unique_fd epoll_fd_;
+    // Eventfd used to signal for the handler thread termination.
+    android::base::unique_fd event_fd_;
+    // Thread for handling incoming threads.
+    std::thread handler_thread_ GUARDED_BY(update_mutex_);
+    std::mutex update_mutex_;
+    std::condition_variable cv;
+    std::mutex cv_mutex_;
+
+    std::condition_variable cv_for_deferred_resp_;
+    std::mutex cv_mutex_for_deferred_resp_;
+    bool deferred_resp_ GUARDED_BY(cv_mutex_for_deferred_resp_) = false;
+};
+
+}  // namespace test
+
+#endif  // DNS_RESPONDER_H
diff --git a/resolv/dns_responder/dns_responder_client.cpp b/resolv/dns_responder/dns_responder_client.cpp
new file mode 100644
index 0000000..3a87c21
--- /dev/null
+++ b/resolv/dns_responder/dns_responder_client.cpp
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "dns_responder_client"
+#include "dns_responder_client.h"
+
+#include <android-base/logging.h>
+#include <android-base/stringprintf.h>
+#include <utils/Log.h>
+
+// TODO: make this dynamic and stop depending on implementation details.
+#define TEST_OEM_NETWORK "oem29"
+#define TEST_NETID 30
+
+// TODO: move this somewhere shared.
+static const char* ANDROID_DNS_MODE = "ANDROID_DNS_MODE";
+
+using android::base::StringPrintf;
+using android::net::INetd;
+using android::net::ResolverParamsParcel;
+
+void DnsResponderClient::SetupMappings(unsigned num_hosts, const std::vector<std::string>& domains,
+        std::vector<Mapping>* mappings) {
+    mappings->resize(num_hosts * domains.size());
+    auto mappings_it = mappings->begin();
+    for (unsigned i = 0 ; i < num_hosts ; ++i) {
+        for (const auto& domain : domains) {
+            mappings_it->host = StringPrintf("host%u", i);
+            mappings_it->entry = StringPrintf("%s.%s.", mappings_it->host.c_str(),
+                    domain.c_str());
+            mappings_it->ip4 = StringPrintf("192.0.2.%u", i%253 + 1);
+            mappings_it->ip6 = StringPrintf("2001:db8::%x", i%65534 + 1);
+            ++mappings_it;
+        }
+    }
+}
+
+// TODO: Use SetResolverConfiguration() with ResolverParamsParcel struct directly.
+// DEPRECATED: Use SetResolverConfiguration() in new code
+static ResolverParamsParcel makeResolverParamsParcel(
+        int netId, const std::vector<int>& params, const std::vector<std::string>& servers,
+        const std::vector<std::string>& domains, const std::string& tlsHostname,
+        const std::vector<std::string>& tlsServers,
+        const std::vector<std::string>& tlsFingerprints) {
+    using android::net::IDnsResolver;
+    ResolverParamsParcel paramsParcel;
+
+    paramsParcel.netId = netId;
+    paramsParcel.sampleValiditySeconds = params[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY];
+    paramsParcel.successThreshold = params[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD];
+    paramsParcel.minSamples = params[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES];
+    paramsParcel.maxSamples = params[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES];
+    if (params.size() > IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC) {
+        paramsParcel.baseTimeoutMsec = params[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC];
+    } else {
+        paramsParcel.baseTimeoutMsec = 0;
+    }
+    if (params.size() > IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT) {
+        paramsParcel.retryCount = params[IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT];
+    } else {
+        paramsParcel.retryCount = 0;
+    }
+    paramsParcel.servers = servers;
+    paramsParcel.domains = domains;
+    paramsParcel.tlsName = tlsHostname;
+    paramsParcel.tlsServers = tlsServers;
+    paramsParcel.tlsFingerprints = tlsFingerprints;
+
+    return paramsParcel;
+}
+
+bool DnsResponderClient::SetResolversForNetwork(const std::vector<std::string>& servers,
+        const std::vector<std::string>& domains, const std::vector<int>& params) {
+    const auto& resolverParams =
+            makeResolverParamsParcel(TEST_NETID, params, servers, domains, "", {}, {});
+    const auto rv = mDnsResolvSrv->setResolverConfiguration(resolverParams);
+    return rv.isOk();
+}
+
+bool DnsResponderClient::SetResolversWithTls(const std::vector<std::string>& servers,
+        const std::vector<std::string>& domains, const std::vector<int>& params,
+        const std::vector<std::string>& tlsServers,
+        const std::string& name, const std::vector<std::string>& fingerprints) {
+    const auto& resolverParams = makeResolverParamsParcel(TEST_NETID, params, servers, domains,
+                                                          name, tlsServers, fingerprints);
+    const auto rv = mDnsResolvSrv->setResolverConfiguration(resolverParams);
+    if (!rv.isOk()) ALOGI("SetResolversWithTls() -> %s", rv.toString8().c_str());
+    return rv.isOk();
+}
+
+void DnsResponderClient::SetupDNSServers(unsigned num_servers, const std::vector<Mapping>& mappings,
+        std::vector<std::unique_ptr<test::DNSResponder>>* dns,
+        std::vector<std::string>* servers) {
+    const char* listen_srv = "53";
+    dns->resize(num_servers);
+    servers->resize(num_servers);
+    for (unsigned i = 0 ; i < num_servers ; ++i) {
+        auto& server = (*servers)[i];
+        auto& d = (*dns)[i];
+        server = StringPrintf("127.0.0.%u", i + 100);
+        d = std::make_unique<test::DNSResponder>(server, listen_srv, 250, ns_rcode::ns_r_servfail);
+        for (const auto& mapping : mappings) {
+            d->addMapping(mapping.entry.c_str(), ns_type::ns_t_a, mapping.ip4.c_str());
+            d->addMapping(mapping.entry.c_str(), ns_type::ns_t_aaaa, mapping.ip6.c_str());
+        }
+        d->startServer();
+    }
+}
+
+int DnsResponderClient::SetupOemNetwork() {
+    mNetdSrv->networkDestroy(TEST_NETID);
+    mDnsResolvSrv->destroyNetworkCache(TEST_NETID);
+    auto ret = mNetdSrv->networkCreatePhysical(TEST_NETID, INetd::PERMISSION_NONE);
+    if (!ret.isOk()) {
+        fprintf(stderr, "Creating physical network %d failed, %s\n", TEST_NETID,
+                ret.toString8().string());
+        return -1;
+    }
+    ret = mDnsResolvSrv->createNetworkCache(TEST_NETID);
+    if (!ret.isOk()) {
+        fprintf(stderr, "Creating network cache %d failed, %s\n", TEST_NETID,
+                ret.toString8().string());
+        return -1;
+    }
+    setNetworkForProcess(TEST_NETID);
+    if ((unsigned)TEST_NETID != getNetworkForProcess()) {
+        return -1;
+    }
+    return TEST_NETID;
+}
+
+void DnsResponderClient::TearDownOemNetwork(int oemNetId) {
+    if (oemNetId != -1) {
+        mNetdSrv->networkDestroy(oemNetId);
+        mDnsResolvSrv->destroyNetworkCache(oemNetId);
+    }
+}
+
+void DnsResponderClient::SetUp() {
+    // binder setup
+    auto binder = android::defaultServiceManager()->getService(android::String16("netd"));
+    mNetdSrv = android::interface_cast<android::net::INetd>(binder);
+    if (mNetdSrv == nullptr) {
+        LOG(FATAL) << "Can't connect to service 'netd'. Missing root privileges? uid=" << getuid();
+    }
+
+    auto resolvBinder =
+            android::defaultServiceManager()->getService(android::String16("dnsresolver"));
+    mDnsResolvSrv = android::interface_cast<android::net::IDnsResolver>(resolvBinder);
+
+    // Ensure resolutions go via proxy.
+    setenv(ANDROID_DNS_MODE, "", 1);
+    mOemNetId = SetupOemNetwork();
+}
+
+void DnsResponderClient::TearDown() {
+    TearDownOemNetwork(mOemNetId);
+}
diff --git a/resolv/dns_responder/dns_responder_client.h b/resolv/dns_responder/dns_responder_client.h
new file mode 100644
index 0000000..678be02
--- /dev/null
+++ b/resolv/dns_responder/dns_responder_client.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless requied by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef DNS_RESPONDER_CLIENT_H
+#define DNS_RESPONDER_CLIENT_H
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include <cutils/sockets.h>
+
+#include <private/android_filesystem_config.h>
+#include <utils/StrongPointer.h>
+
+#include "NetdClient.h"
+#include "android/net/IDnsResolver.h"
+#include "android/net/INetd.h"
+#include "binder/IServiceManager.h"
+#include "dns_responder.h"
+
+#define SKIP_IF_RESOLVER_VERSION_NEWER_THAN(service, version) \
+    do {                                                      \
+        if ((service)->getInterfaceVersion() > (version)) {   \
+            return;                                           \
+        }                                                     \
+    } while (0)
+
+inline const std::vector<std::string> kDefaultServers = {"127.0.0.3"};
+inline const std::vector<std::string> kDefaultSearchDomains = {"example.com"};
+inline const std::vector<int> kDefaultParams = {
+        300,      // sample validity in seconds
+        25,       // success threshod in percent
+        8,    8,  // {MIN,MAX}_SAMPLES
+        1000,     // BASE_TIMEOUT_MSEC
+        2,        // retry count
+};
+
+class DnsResponderClient {
+public:
+    struct Mapping {
+        std::string host;
+        std::string entry;
+        std::string ip4;
+        std::string ip6;
+    };
+
+    virtual ~DnsResponderClient() = default;
+
+    static void SetupMappings(unsigned num_hosts, const std::vector<std::string>& domains,
+            std::vector<Mapping>* mappings);
+
+    bool SetResolversForNetwork(const std::vector<std::string>& servers = kDefaultServers,
+                                const std::vector<std::string>& domains = kDefaultSearchDomains,
+                                const std::vector<int>& params = kDefaultParams);
+
+    bool SetResolversForNetwork(const std::vector<std::string>& servers,
+            const std::vector<std::string>& searchDomains,
+            const std::string& params);
+
+    bool SetResolversWithTls(const std::vector<std::string>& servers,
+            const std::vector<std::string>& searchDomains,
+            const std::vector<int>& params,
+            const std::string& name,
+            const std::vector<std::string>& fingerprints) {
+        // Pass servers as both network-assigned and TLS servers.  Tests can
+        // determine on which server and by which protocol queries arrived.
+        return SetResolversWithTls(servers, searchDomains, params,
+                                   servers, name, fingerprints);
+    }
+
+    bool SetResolversWithTls(const std::vector<std::string>& servers,
+            const std::vector<std::string>& searchDomains,
+            const std::vector<int>& params,
+            const std::vector<std::string>& tlsServers,
+            const std::string& name,
+            const std::vector<std::string>& fingerprints);
+
+    static void SetupDNSServers(unsigned num_servers, const std::vector<Mapping>& mappings,
+            std::vector<std::unique_ptr<test::DNSResponder>>* dns,
+            std::vector<std::string>* servers);
+
+    int SetupOemNetwork();
+
+    void TearDownOemNetwork(int oemNetId);
+
+    virtual void SetUp();
+    virtual void TearDown();
+
+    android::net::IDnsResolver* resolvService() const { return mDnsResolvSrv.get(); }
+    android::net::INetd* netdService() const { return mNetdSrv.get(); }
+
+  private:
+    android::sp<android::net::INetd> mNetdSrv = nullptr;
+    android::sp<android::net::IDnsResolver> mDnsResolvSrv = nullptr;
+    int mOemNetId = -1;
+};
+
+#endif  // DNS_RESPONDER_CLIENT_H
diff --git a/resolv/dns_responder/dns_tls_frontend.cpp b/resolv/dns_responder/dns_tls_frontend.cpp
new file mode 100644
index 0000000..83e36ed
--- /dev/null
+++ b/resolv/dns_responder/dns_tls_frontend.cpp
@@ -0,0 +1,421 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dns_tls_frontend.h"
+
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/ssl.h>
+#include <sys/eventfd.h>
+#include <sys/poll.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define LOG_TAG "DnsTlsFrontend"
+#include <log/log.h>
+#include <netdutils/SocketOption.h>
+
+#include "NetdConstants.h"  // SHA256_SIZE
+
+using android::netdutils::enableSockopt;
+
+namespace {
+
+// Copied from DnsTlsTransport.
+bool getSPKIDigest(const X509* cert, std::vector<uint8_t>* out) {
+    int spki_len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), nullptr);
+    unsigned char spki[spki_len];
+    unsigned char* temp = spki;
+    if (spki_len != i2d_X509_PUBKEY(X509_get_X509_PUBKEY(cert), &temp)) {
+        ALOGE("SPKI length mismatch");
+        return false;
+    }
+    out->resize(SHA256_SIZE);
+    unsigned int digest_len = 0;
+    int ret = EVP_Digest(spki, spki_len, out->data(), &digest_len, EVP_sha256(), nullptr);
+    if (ret != 1) {
+        ALOGE("Server cert digest extraction failed");
+        return false;
+    }
+    if (digest_len != out->size()) {
+        ALOGE("Wrong digest length: %d", digest_len);
+        return false;
+    }
+    return true;
+}
+
+std::string errno2str() {
+    char error_msg[512] = { 0 };
+    return strerror_r(errno, error_msg, sizeof(error_msg));
+}
+
+#define APLOGI(fmt, ...) ALOGI(fmt ": [%d] %s", __VA_ARGS__, errno, errno2str().c_str())
+
+std::string addr2str(const sockaddr* sa, socklen_t sa_len) {
+    char host_str[NI_MAXHOST] = { 0 };
+    int rv = getnameinfo(sa, sa_len, host_str, sizeof(host_str), nullptr, 0,
+                         NI_NUMERICHOST);
+    if (rv == 0) return std::string(host_str);
+    return std::string();
+}
+
+bssl::UniquePtr<EVP_PKEY> make_private_key() {
+    bssl::UniquePtr<BIGNUM> e(BN_new());
+    if (!e) {
+        ALOGE("BN_new failed");
+        return nullptr;
+    }
+    if (!BN_set_word(e.get(), RSA_F4)) {
+        ALOGE("BN_set_word failed");
+        return nullptr;
+    }
+
+    bssl::UniquePtr<RSA> rsa(RSA_new());
+    if (!rsa) {
+        ALOGE("RSA_new failed");
+        return nullptr;
+    }
+    if (!RSA_generate_key_ex(rsa.get(), 2048, e.get(), nullptr)) {
+        ALOGE("RSA_generate_key_ex failed");
+        return nullptr;
+    }
+
+    bssl::UniquePtr<EVP_PKEY> privkey(EVP_PKEY_new());
+    if (!privkey) {
+        ALOGE("EVP_PKEY_new failed");
+        return nullptr;
+    }
+    if(!EVP_PKEY_assign_RSA(privkey.get(), rsa.get())) {
+        ALOGE("EVP_PKEY_assign_RSA failed");
+        return nullptr;
+    }
+
+    // |rsa| is now owned by |privkey|, so no need to free it.
+    rsa.release();
+    return privkey;
+}
+
+bssl::UniquePtr<X509> make_cert(EVP_PKEY* privkey, EVP_PKEY* parent_key) {
+    bssl::UniquePtr<X509> cert(X509_new());
+    if (!cert) {
+        ALOGE("X509_new failed");
+        return nullptr;
+    }
+
+    ASN1_INTEGER_set(X509_get_serialNumber(cert.get()), 1);
+
+    // Set one hour expiration.
+    X509_gmtime_adj(X509_get_notBefore(cert.get()), 0);
+    X509_gmtime_adj(X509_get_notAfter(cert.get()), 60 * 60);
+
+    X509_set_pubkey(cert.get(), privkey);
+
+    if (!X509_sign(cert.get(), parent_key, EVP_sha256())) {
+        ALOGE("X509_sign failed");
+        return nullptr;
+    }
+
+    return cert;
+}
+
+}
+
+namespace test {
+
+bool DnsTlsFrontend::startServer() {
+    SSL_load_error_strings();
+    OpenSSL_add_ssl_algorithms();
+
+    // reset queries_ to 0 every time startServer called
+    // which would help us easy to check queries_ via calling waitForQueries
+    queries_ = 0;
+
+    ctx_.reset(SSL_CTX_new(TLS_server_method()));
+    if (!ctx_) {
+        ALOGE("SSL context creation failed");
+        return false;
+    }
+
+    SSL_CTX_set_ecdh_auto(ctx_.get(), 1);
+
+    // Make certificate chain
+    std::vector<bssl::UniquePtr<EVP_PKEY>> keys(chain_length_);
+    for (int i = 0; i < chain_length_; ++i) {
+        keys[i] = make_private_key();
+    }
+    std::vector<bssl::UniquePtr<X509>> certs(chain_length_);
+    for (int i = 0; i < chain_length_; ++i) {
+        int next = std::min(i + 1, chain_length_ - 1);
+        certs[i] = make_cert(keys[i].get(), keys[next].get());
+    }
+
+    // Install certificate chain.
+    if (SSL_CTX_use_certificate(ctx_.get(), certs[0].get()) <= 0) {
+        ALOGE("SSL_CTX_use_certificate failed");
+        return false;
+    }
+    if (SSL_CTX_use_PrivateKey(ctx_.get(), keys[0].get()) <= 0 ) {
+        ALOGE("SSL_CTX_use_PrivateKey failed");
+        return false;
+    }
+    for (int i = 1; i < chain_length_; ++i) {
+        if (SSL_CTX_add1_chain_cert(ctx_.get(), certs[i].get()) != 1) {
+            ALOGE("SSL_CTX_add1_chain_cert failed");
+            return false;
+        }
+    }
+
+    // Report the fingerprint of the "middle" cert.  For N = 2, this is the root.
+    int fp_index = chain_length_ / 2;
+    if (!getSPKIDigest(certs[fp_index].get(), &fingerprint_)) {
+        ALOGE("getSPKIDigest failed");
+        return false;
+    }
+
+    // Set up TCP server socket for clients.
+    addrinfo frontend_ai_hints{
+        .ai_family = AF_UNSPEC,
+        .ai_socktype = SOCK_STREAM,
+        .ai_flags = AI_PASSIVE
+    };
+    addrinfo* frontend_ai_res = nullptr;
+    int rv = getaddrinfo(listen_address_.c_str(), listen_service_.c_str(),
+                         &frontend_ai_hints, &frontend_ai_res);
+    ScopedAddrinfo frontend_ai_res_cleanup(frontend_ai_res);
+    if (rv) {
+        ALOGE("frontend getaddrinfo(%s, %s) failed: %s", listen_address_.c_str(),
+            listen_service_.c_str(), gai_strerror(rv));
+        return false;
+    }
+
+    for (const addrinfo* ai = frontend_ai_res ; ai ; ai = ai->ai_next) {
+        android::base::unique_fd s(socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol));
+        if (s.get() < 0) {
+            APLOGI("ignore creating socket failed %d", s.get());
+            continue;
+        }
+        enableSockopt(s.get(), SOL_SOCKET, SO_REUSEPORT).ignoreError();
+        enableSockopt(s.get(), SOL_SOCKET, SO_REUSEADDR).ignoreError();
+        std::string host_str = addr2str(ai->ai_addr, ai->ai_addrlen);
+        if (bind(s.get(), ai->ai_addr, ai->ai_addrlen)) {
+            APLOGI("failed to bind TCP %s:%s", host_str.c_str(), listen_service_.c_str());
+            continue;
+        }
+        ALOGI("bound to TCP %s:%s", host_str.c_str(), listen_service_.c_str());
+        socket_ = std::move(s);
+        break;
+    }
+
+    if (listen(socket_.get(), 1) < 0) {
+        APLOGI("failed to listen socket %d", socket_.get());
+        return false;
+    }
+
+    // Set up UDP client socket to backend.
+    addrinfo backend_ai_hints{
+        .ai_family = AF_UNSPEC,
+        .ai_socktype = SOCK_DGRAM
+    };
+    addrinfo* backend_ai_res = nullptr;
+    rv = getaddrinfo(backend_address_.c_str(), backend_service_.c_str(),
+                         &backend_ai_hints, &backend_ai_res);
+    ScopedAddrinfo backend_ai_res_cleanup(backend_ai_res);
+    if (rv) {
+        ALOGE("backend getaddrinfo(%s, %s) failed: %s", listen_address_.c_str(),
+            listen_service_.c_str(), gai_strerror(rv));
+        return false;
+    }
+    backend_socket_.reset(socket(backend_ai_res->ai_family, backend_ai_res->ai_socktype,
+                                 backend_ai_res->ai_protocol));
+    if (backend_socket_.get() < 0) {
+        APLOGI("backend socket %d creation failed", backend_socket_.get());
+        return false;
+    }
+
+    // connect() always fails in the test DnsTlsSocketTest.SlowDestructor because of
+    // no backend server. Don't check it.
+    connect(backend_socket_.get(), backend_ai_res->ai_addr, backend_ai_res->ai_addrlen);
+
+    // Set up eventfd socket.
+    event_fd_.reset(eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC));
+    if (event_fd_.get() == -1) {
+        APLOGI("failed to create eventfd %d", event_fd_.get());
+        return false;
+    }
+
+    {
+        std::lock_guard lock(update_mutex_);
+        handler_thread_ = std::thread(&DnsTlsFrontend::requestHandler, this);
+    }
+    ALOGI("server started successfully");
+    return true;
+}
+
+void DnsTlsFrontend::requestHandler() {
+    ALOGD("Request handler started");
+    enum { EVENT_FD = 0, LISTEN_FD = 1 };
+    pollfd fds[2] = {{.fd = event_fd_.get(), .events = POLLIN},
+                     {.fd = socket_.get(), .events = POLLIN}};
+
+    while (true) {
+        int poll_code = poll(fds, std::size(fds), -1);
+        if (poll_code <= 0) {
+            APLOGI("Poll failed with error %d", poll_code);
+            break;
+        }
+
+        if (fds[EVENT_FD].revents & (POLLIN | POLLERR)) {
+            handleEventFd();
+            break;
+        }
+        if (fds[LISTEN_FD].revents & (POLLIN | POLLERR)) {
+            sockaddr_storage addr;
+            socklen_t len = sizeof(addr);
+
+            ALOGD("Trying to accept a client");
+            android::base::unique_fd client(
+                    accept4(socket_.get(), reinterpret_cast<sockaddr*>(&addr), &len, SOCK_CLOEXEC));
+            if (client.get() < 0) {
+                // Stop
+                APLOGI("failed to accept client socket %d", client.get());
+                break;
+            }
+
+            bssl::UniquePtr<SSL> ssl(SSL_new(ctx_.get()));
+            SSL_set_fd(ssl.get(), client.get());
+
+            ALOGD("Doing SSL handshake");
+            bool success = false;
+            if (SSL_accept(ssl.get()) <= 0) {
+                ALOGI("SSL negotiation failure");
+            } else {
+                ALOGD("SSL handshake complete");
+                success = handleOneRequest(ssl.get());
+            }
+
+            if (success) {
+                // Increment queries_ as late as possible, because it represents
+                // a query that is fully processed, and the response returned to the
+                // client, including cleanup actions.
+                ++queries_;
+            }
+        }
+    }
+    ALOGD("Ending loop");
+}
+
+bool DnsTlsFrontend::handleOneRequest(SSL* ssl) {
+    uint8_t queryHeader[2];
+    if (SSL_read(ssl, &queryHeader, 2) != 2) {
+        ALOGI("Not enough header bytes");
+        return false;
+    }
+    const uint16_t qlen = (queryHeader[0] << 8) | queryHeader[1];
+    uint8_t query[qlen];
+    size_t qbytes = 0;
+    while (qbytes < qlen) {
+        int ret = SSL_read(ssl, query + qbytes, qlen - qbytes);
+        if (ret <= 0) {
+            ALOGI("Error while reading query");
+            return false;
+        }
+        qbytes += ret;
+    }
+    int sent = send(backend_socket_.get(), query, qlen, 0);
+    if (sent != qlen) {
+        ALOGI("Failed to send query");
+        return false;
+    }
+    const int max_size = 4096;
+    uint8_t recv_buffer[max_size];
+    int rlen = recv(backend_socket_.get(), recv_buffer, max_size, 0);
+    if (rlen <= 0) {
+        ALOGI("Failed to receive response");
+        return false;
+    }
+    uint8_t responseHeader[2];
+    responseHeader[0] = rlen >> 8;
+    responseHeader[1] = rlen;
+    if (SSL_write(ssl, responseHeader, 2) != 2) {
+        ALOGI("Failed to write response header");
+        return false;
+    }
+    if (SSL_write(ssl, recv_buffer, rlen) != rlen) {
+        ALOGI("Failed to write response body");
+        return false;
+    }
+    return true;
+}
+
+bool DnsTlsFrontend::stopServer() {
+    std::lock_guard lock(update_mutex_);
+    if (!running()) {
+        ALOGI("server not running");
+        return false;
+    }
+
+    ALOGI("stopping frontend");
+    if (!sendToEventFd()) {
+        return false;
+    }
+    handler_thread_.join();
+    socket_.reset();
+    backend_socket_.reset();
+    event_fd_.reset();
+    ctx_.reset();
+    fingerprint_.clear();
+    ALOGI("frontend stopped successfully");
+    return true;
+}
+
+bool DnsTlsFrontend::waitForQueries(int number, int timeoutMs) const {
+    constexpr int intervalMs = 20;
+    int limit = timeoutMs / intervalMs;
+    for (int count = 0; count <= limit; ++count) {
+        bool done = queries_ >= number;
+        // Always sleep at least one more interval after we are done, to wait for
+        // any immediate post-query actions that the client may take (such as
+        // marking this server as reachable during validation).
+        usleep(intervalMs * 1000);
+        if (done) {
+            // For ensuring that calls have sufficient headroom for slow machines
+            ALOGD("Query arrived in %d/%d of allotted time", count, limit);
+            return true;
+        }
+    }
+    return false;
+}
+
+bool DnsTlsFrontend::sendToEventFd() {
+    const uint64_t data = 1;
+    if (const ssize_t rt = write(event_fd_.get(), &data, sizeof(data)); rt != sizeof(data)) {
+        APLOGI("failed to write eventfd, rt=%zd", rt);
+        return false;
+    }
+    return true;
+}
+
+void DnsTlsFrontend::handleEventFd() {
+    int64_t data;
+    if (const ssize_t rt = read(event_fd_.get(), &data, sizeof(data)); rt != sizeof(data)) {
+        APLOGI("ignore reading eventfd failed, rt=%zd", rt);
+    }
+}
+
+}  // namespace test
diff --git a/resolv/dns_responder/dns_tls_frontend.h b/resolv/dns_responder/dns_tls_frontend.h
new file mode 100644
index 0000000..32a2771
--- /dev/null
+++ b/resolv/dns_responder/dns_tls_frontend.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless requied by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef DNS_TLS_FRONTEND_H
+#define DNS_TLS_FRONTEND_H
+
+#include <arpa/nameser.h>
+
+#include <atomic>
+#include <mutex>
+#include <string>
+#include <thread>
+#include <unordered_map>
+#include <vector>
+
+#include <android-base/thread_annotations.h>
+#include <android-base/unique_fd.h>
+#include <openssl/ssl.h>
+
+namespace test {
+
+/*
+ * Simple DNS over TLS reverse proxy that forwards to a UDP backend.
+ * Only handles a single request at a time.
+ */
+class DnsTlsFrontend {
+  public:
+    DnsTlsFrontend(const std::string& listen_address, const std::string& listen_service,
+                   const std::string& backend_address, const std::string& backend_service)
+        : listen_address_(listen_address),
+          listen_service_(listen_service),
+          backend_address_(backend_address),
+          backend_service_(backend_service) {}
+    ~DnsTlsFrontend() {
+        stopServer();
+    }
+    const std::string& listen_address() const {
+        return listen_address_;
+    }
+    const std::string& listen_service() const {
+        return listen_service_;
+    }
+    bool running() const {
+        return socket_ != -1;
+    }
+    bool startServer();
+    bool stopServer();
+    int queries() const { return queries_; }
+    void clearQueries() { queries_ = 0; }
+    bool waitForQueries(int number, int timeoutMs) const;
+    void set_chain_length(int length) { chain_length_ = length; }
+    // Represents a fingerprint from the middle of the certificate chain.
+    const std::vector<uint8_t>& fingerprint() const { return fingerprint_; }
+
+  private:
+    void requestHandler();
+    bool handleOneRequest(SSL* ssl);
+
+    // Trigger the handler thread to terminate.
+    bool sendToEventFd();
+
+    // Used in the handler thread for the termination signal.
+    void handleEventFd();
+
+    std::string listen_address_;
+    std::string listen_service_;
+    std::string backend_address_;
+    std::string backend_service_;
+    bssl::UniquePtr<SSL_CTX> ctx_;
+    // Socket on which the server is listening for a TCP connection with a client.
+    android::base::unique_fd socket_;
+    // Socket used to communicate with the backend DNS server.
+    android::base::unique_fd backend_socket_;
+    // Eventfd used to signal for the handler thread termination.
+    android::base::unique_fd event_fd_;
+    std::atomic<int> queries_ = 0;
+    std::thread handler_thread_ GUARDED_BY(update_mutex_);
+    std::mutex update_mutex_;
+    int chain_length_ = 1;
+    std::vector<uint8_t> fingerprint_;
+};
+
+}  // namespace test
+
+#endif  // DNS_TLS_FRONTEND_H
diff --git a/resolv/dns_tls_test.cpp b/resolv/dns_tls_test.cpp
new file mode 100644
index 0000000..0bcad30
--- /dev/null
+++ b/resolv/dns_tls_test.cpp
@@ -0,0 +1,963 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "dns_tls_test"
+#define LOG_NDEBUG 1  // Set to 0 to enable verbose debug logging
+
+#include <gtest/gtest.h>
+
+#include "DnsTlsDispatcher.h"
+#include "DnsTlsQueryMap.h"
+#include "DnsTlsServer.h"
+#include "DnsTlsSessionCache.h"
+#include "DnsTlsSocket.h"
+#include "DnsTlsTransport.h"
+#include "IDnsTlsSocket.h"
+#include "IDnsTlsSocketFactory.h"
+#include "IDnsTlsSocketObserver.h"
+
+#include "dns_responder/dns_tls_frontend.h"
+
+#include <chrono>
+#include <arpa/inet.h>
+#include <android-base/macros.h>
+#include <netdutils/Slice.h>
+
+#include "log/log.h"
+
+namespace android {
+namespace net {
+
+using netdutils::Slice;
+using netdutils::makeSlice;
+
+typedef std::vector<uint8_t> bytevec;
+
+static void parseServer(const char* server, in_port_t port, sockaddr_storage* parsed) {
+    sockaddr_in* sin = reinterpret_cast<sockaddr_in*>(parsed);
+    if (inet_pton(AF_INET, server, &(sin->sin_addr)) == 1) {
+        // IPv4 parse succeeded, so it's IPv4
+        sin->sin_family = AF_INET;
+        sin->sin_port = htons(port);
+        return;
+    }
+    sockaddr_in6* sin6 = reinterpret_cast<sockaddr_in6*>(parsed);
+    if (inet_pton(AF_INET6, server, &(sin6->sin6_addr)) == 1){
+        // IPv6 parse succeeded, so it's IPv6.
+        sin6->sin6_family = AF_INET6;
+        sin6->sin6_port = htons(port);
+        return;
+    }
+    ALOGE("Failed to parse server address: %s", server);
+}
+
+bytevec FINGERPRINT1 = { 1 };
+bytevec FINGERPRINT2 = { 2 };
+
+std::string SERVERNAME1 = "dns.example.com";
+std::string SERVERNAME2 = "dns.example.org";
+
+// BaseTest just provides constants that are useful for the tests.
+class BaseTest : public ::testing::Test {
+  protected:
+    BaseTest() {
+        parseServer("192.0.2.1", 853, &V4ADDR1);
+        parseServer("192.0.2.2", 853, &V4ADDR2);
+        parseServer("2001:db8::1", 853, &V6ADDR1);
+        parseServer("2001:db8::2", 853, &V6ADDR2);
+
+        SERVER1 = DnsTlsServer(V4ADDR1);
+        SERVER1.fingerprints.insert(FINGERPRINT1);
+        SERVER1.name = SERVERNAME1;
+    }
+
+    sockaddr_storage V4ADDR1;
+    sockaddr_storage V4ADDR2;
+    sockaddr_storage V6ADDR1;
+    sockaddr_storage V6ADDR2;
+
+    DnsTlsServer SERVER1;
+};
+
+bytevec make_query(uint16_t id, size_t size) {
+    bytevec vec(size);
+    vec[0] = id >> 8;
+    vec[1] = id;
+    // Arbitrarily fill the query body with unique data.
+    for (size_t i = 2; i < size; ++i) {
+        vec[i] = id + i;
+    }
+    return vec;
+}
+
+// Query constants
+const unsigned MARK = 123;
+const uint16_t ID = 52;
+const uint16_t SIZE = 22;
+const bytevec QUERY = make_query(ID, SIZE);
+
+template <class T>
+class FakeSocketFactory : public IDnsTlsSocketFactory {
+  public:
+    FakeSocketFactory() {}
+    std::unique_ptr<IDnsTlsSocket> createDnsTlsSocket(
+            const DnsTlsServer& server ATTRIBUTE_UNUSED,
+            unsigned mark ATTRIBUTE_UNUSED,
+            IDnsTlsSocketObserver* observer,
+            DnsTlsSessionCache* cache ATTRIBUTE_UNUSED) override {
+        return std::make_unique<T>(observer);
+    }
+};
+
+bytevec make_echo(uint16_t id, const Slice query) {
+    bytevec response(query.size() + 2);
+    response[0] = id >> 8;
+    response[1] = id;
+    // Echo the query as the fake response.
+    memcpy(response.data() + 2, query.base(), query.size());
+    return response;
+}
+
+// Simplest possible fake server.  This just echoes the query as the response.
+class FakeSocketEcho : public IDnsTlsSocket {
+  public:
+    explicit FakeSocketEcho(IDnsTlsSocketObserver* observer) : mObserver(observer) {}
+    bool query(uint16_t id, const Slice query) override {
+        // Return the response immediately (asynchronously).
+        std::thread(&IDnsTlsSocketObserver::onResponse, mObserver, make_echo(id, query)).detach();
+        return true;
+    }
+
+  private:
+    IDnsTlsSocketObserver* const mObserver;
+};
+
+class TransportTest : public BaseTest {};
+
+TEST_F(TransportTest, Query) {
+    FakeSocketFactory<FakeSocketEcho> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    auto r = transport.query(makeSlice(QUERY)).get();
+
+    EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+    EXPECT_EQ(QUERY, r.response);
+}
+
+// Fake Socket that echoes the observed query ID as the response body.
+class FakeSocketId : public IDnsTlsSocket {
+  public:
+    explicit FakeSocketId(IDnsTlsSocketObserver* observer) : mObserver(observer) {}
+    bool query(uint16_t id, const Slice query ATTRIBUTE_UNUSED) override {
+        // Return the response immediately (asynchronously).
+        bytevec response(4);
+        // Echo the ID in the header to match the response to the query.
+        // This will be overwritten by DnsTlsQueryMap.
+        response[0] = id >> 8;
+        response[1] = id;
+        // Echo the ID in the body, so that the test can verify which ID was used by
+        // DnsTlsQueryMap.
+        response[2] = id >> 8;
+        response[3] = id;
+        std::thread(&IDnsTlsSocketObserver::onResponse, mObserver, response).detach();
+        return true;
+    }
+
+  private:
+    IDnsTlsSocketObserver* const mObserver;
+};
+
+// Test that IDs are properly reused
+TEST_F(TransportTest, IdReuse) {
+    FakeSocketFactory<FakeSocketId> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    for (int i = 0; i < 100; ++i) {
+        // Send a query.
+        std::future<DnsTlsServer::Result> f = transport.query(makeSlice(QUERY));
+        // Wait for the response.
+        DnsTlsServer::Result r = f.get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+
+        // All queries should have an observed ID of zero, because it is returned to the ID pool
+        // after each use.
+        EXPECT_EQ(0, (r.response[2] << 8) | r.response[3]);
+    }
+}
+
+// These queries might be handled in serial or parallel as they race the
+// responses.
+TEST_F(TransportTest, RacingQueries_10000) {
+    FakeSocketFactory<FakeSocketEcho> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    // Fewer than 65536 queries to avoid ID exhaustion.
+    const int num_queries = 10000;
+    results.reserve(num_queries);
+    for (int i = 0; i < num_queries; ++i) {
+        results.push_back(transport.query(makeSlice(QUERY)));
+    }
+    for (auto& result : results) {
+        auto r = result.get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(QUERY, r.response);
+    }
+}
+
+// A server that waits until sDelay queries are queued before responding.
+class FakeSocketDelay : public IDnsTlsSocket {
+  public:
+    explicit FakeSocketDelay(IDnsTlsSocketObserver* observer) : mObserver(observer) {}
+    ~FakeSocketDelay() { std::lock_guard guard(mLock); }
+    static size_t sDelay;
+    static bool sReverse;
+
+    bool query(uint16_t id, const Slice query) override {
+        ALOGV("FakeSocketDelay got query with ID %d", int(id));
+        std::lock_guard guard(mLock);
+        // Check for duplicate IDs.
+        EXPECT_EQ(0U, mIds.count(id));
+        mIds.insert(id);
+
+        // Store response.
+        mResponses.push_back(make_echo(id, query));
+
+        ALOGV("Up to %zu out of %zu queries", mResponses.size(), sDelay);
+        if (mResponses.size() == sDelay) {
+            std::thread(&FakeSocketDelay::sendResponses, this).detach();
+        }
+        return true;
+    }
+
+  private:
+    void sendResponses() {
+        std::lock_guard guard(mLock);
+        if (sReverse) {
+            std::reverse(std::begin(mResponses), std::end(mResponses));
+        }
+        for (auto& response : mResponses) {
+            mObserver->onResponse(response);
+        }
+        mIds.clear();
+        mResponses.clear();
+    }
+
+    std::mutex mLock;
+    IDnsTlsSocketObserver* const mObserver;
+    std::set<uint16_t> mIds GUARDED_BY(mLock);
+    std::vector<bytevec> mResponses GUARDED_BY(mLock);
+};
+
+size_t FakeSocketDelay::sDelay;
+bool FakeSocketDelay::sReverse;
+
+TEST_F(TransportTest, ParallelColliding) {
+    FakeSocketDelay::sDelay = 10;
+    FakeSocketDelay::sReverse = false;
+    FakeSocketFactory<FakeSocketDelay> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    // Fewer than 65536 queries to avoid ID exhaustion.
+    results.reserve(FakeSocketDelay::sDelay);
+    for (size_t i = 0; i < FakeSocketDelay::sDelay; ++i) {
+        results.push_back(transport.query(makeSlice(QUERY)));
+    }
+    for (auto& result : results) {
+        auto r = result.get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(QUERY, r.response);
+    }
+}
+
+TEST_F(TransportTest, ParallelColliding_Max) {
+    FakeSocketDelay::sDelay = 65536;
+    FakeSocketDelay::sReverse = false;
+    FakeSocketFactory<FakeSocketDelay> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    // Exactly 65536 queries should still be possible in parallel,
+    // even if they all have the same original ID.
+    results.reserve(FakeSocketDelay::sDelay);
+    for (size_t i = 0; i < FakeSocketDelay::sDelay; ++i) {
+        results.push_back(transport.query(makeSlice(QUERY)));
+    }
+    for (auto& result : results) {
+        auto r = result.get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(QUERY, r.response);
+    }
+}
+
+TEST_F(TransportTest, ParallelUnique) {
+    FakeSocketDelay::sDelay = 10;
+    FakeSocketDelay::sReverse = false;
+    FakeSocketFactory<FakeSocketDelay> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<bytevec> queries(FakeSocketDelay::sDelay);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    results.reserve(FakeSocketDelay::sDelay);
+    for (size_t i = 0; i < FakeSocketDelay::sDelay; ++i) {
+        queries[i] = make_query(i, SIZE);
+        results.push_back(transport.query(makeSlice(queries[i])));
+    }
+    for (size_t i = 0 ; i < FakeSocketDelay::sDelay; ++i) {
+        auto r = results[i].get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(queries[i], r.response);
+    }
+}
+
+TEST_F(TransportTest, ParallelUnique_Max) {
+    FakeSocketDelay::sDelay = 65536;
+    FakeSocketDelay::sReverse = false;
+    FakeSocketFactory<FakeSocketDelay> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<bytevec> queries(FakeSocketDelay::sDelay);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    // Exactly 65536 queries should still be possible in parallel,
+    // and they should all be mapped correctly back to the original ID.
+    results.reserve(FakeSocketDelay::sDelay);
+    for (size_t i = 0; i < FakeSocketDelay::sDelay; ++i) {
+        queries[i] = make_query(i, SIZE);
+        results.push_back(transport.query(makeSlice(queries[i])));
+    }
+    for (size_t i = 0 ; i < FakeSocketDelay::sDelay; ++i) {
+        auto r = results[i].get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(queries[i], r.response);
+    }
+}
+
+TEST_F(TransportTest, IdExhaustion) {
+    const int num_queries = 65536;
+    // A delay of 65537 is unreachable, because the maximum number
+    // of outstanding queries is 65536.
+    FakeSocketDelay::sDelay = num_queries + 1;
+    FakeSocketDelay::sReverse = false;
+    FakeSocketFactory<FakeSocketDelay> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    // Issue the maximum number of queries.
+    results.reserve(num_queries);
+    for (int i = 0; i < num_queries; ++i) {
+        results.push_back(transport.query(makeSlice(QUERY)));
+    }
+
+    // The ID space is now full, so subsequent queries should fail immediately.
+    auto r = transport.query(makeSlice(QUERY)).get();
+    EXPECT_EQ(DnsTlsTransport::Response::internal_error, r.code);
+    EXPECT_TRUE(r.response.empty());
+
+    for (auto& result : results) {
+        // All other queries should remain outstanding.
+        EXPECT_EQ(std::future_status::timeout,
+                result.wait_for(std::chrono::duration<int>::zero()));
+    }
+}
+
+// Responses can come back from the server in any order.  This should have no
+// effect on Transport's observed behavior.
+TEST_F(TransportTest, ReverseOrder) {
+    FakeSocketDelay::sDelay = 10;
+    FakeSocketDelay::sReverse = true;
+    FakeSocketFactory<FakeSocketDelay> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<bytevec> queries(FakeSocketDelay::sDelay);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    results.reserve(FakeSocketDelay::sDelay);
+    for (size_t i = 0; i < FakeSocketDelay::sDelay; ++i) {
+        queries[i] = make_query(i, SIZE);
+        results.push_back(transport.query(makeSlice(queries[i])));
+    }
+    for (size_t i = 0 ; i < FakeSocketDelay::sDelay; ++i) {
+        auto r = results[i].get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(queries[i], r.response);
+    }
+}
+
+TEST_F(TransportTest, ReverseOrder_Max) {
+    FakeSocketDelay::sDelay = 65536;
+    FakeSocketDelay::sReverse = true;
+    FakeSocketFactory<FakeSocketDelay> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    std::vector<bytevec> queries(FakeSocketDelay::sDelay);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    results.reserve(FakeSocketDelay::sDelay);
+    for (size_t i = 0; i < FakeSocketDelay::sDelay; ++i) {
+        queries[i] = make_query(i, SIZE);
+        results.push_back(transport.query(makeSlice(queries[i])));
+    }
+    for (size_t i = 0 ; i < FakeSocketDelay::sDelay; ++i) {
+        auto r = results[i].get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(queries[i], r.response);
+    }
+}
+
+// Returning null from the factory indicates a connection failure.
+class NullSocketFactory : public IDnsTlsSocketFactory {
+  public:
+    NullSocketFactory() {}
+    std::unique_ptr<IDnsTlsSocket> createDnsTlsSocket(
+            const DnsTlsServer& server ATTRIBUTE_UNUSED,
+            unsigned mark ATTRIBUTE_UNUSED,
+            IDnsTlsSocketObserver* observer ATTRIBUTE_UNUSED,
+            DnsTlsSessionCache* cache ATTRIBUTE_UNUSED) override {
+        return nullptr;
+    }
+};
+
+TEST_F(TransportTest, ConnectFail) {
+    NullSocketFactory factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    auto r = transport.query(makeSlice(QUERY)).get();
+
+    EXPECT_EQ(DnsTlsTransport::Response::network_error, r.code);
+    EXPECT_TRUE(r.response.empty());
+}
+
+// Simulate a socket that connects but then immediately receives a server
+// close notification.
+class FakeSocketClose : public IDnsTlsSocket {
+  public:
+    explicit FakeSocketClose(IDnsTlsSocketObserver* observer)
+        : mCloser(&IDnsTlsSocketObserver::onClosed, observer) {}
+    ~FakeSocketClose() { mCloser.join(); }
+    bool query(uint16_t id ATTRIBUTE_UNUSED,
+               const Slice query ATTRIBUTE_UNUSED) override {
+        return true;
+    }
+
+  private:
+    std::thread mCloser;
+};
+
+TEST_F(TransportTest, CloseRetryFail) {
+    FakeSocketFactory<FakeSocketClose> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    auto r = transport.query(makeSlice(QUERY)).get();
+
+    EXPECT_EQ(DnsTlsTransport::Response::network_error, r.code);
+    EXPECT_TRUE(r.response.empty());
+}
+
+// Simulate a server that occasionally closes the connection and silently
+// drops some queries.
+class FakeSocketLimited : public IDnsTlsSocket {
+  public:
+    static int sLimit;  // Number of queries to answer per socket.
+    static size_t sMaxSize;  // Silently discard queries greater than this size.
+    explicit FakeSocketLimited(IDnsTlsSocketObserver* observer)
+        : mObserver(observer), mQueries(0) {}
+    ~FakeSocketLimited() {
+        {
+            ALOGV("~FakeSocketLimited acquiring mLock");
+            std::lock_guard guard(mLock);
+            ALOGV("~FakeSocketLimited acquired mLock");
+            for (auto& thread : mThreads) {
+                ALOGV("~FakeSocketLimited joining response thread");
+                thread.join();
+                ALOGV("~FakeSocketLimited joined response thread");
+            }
+            mThreads.clear();
+        }
+
+        if (mCloser) {
+            ALOGV("~FakeSocketLimited joining closer thread");
+            mCloser->join();
+            ALOGV("~FakeSocketLimited joined closer thread");
+        }
+    }
+    bool query(uint16_t id, const Slice query) override {
+        ALOGV("FakeSocketLimited::query acquiring mLock");
+        std::lock_guard guard(mLock);
+        ALOGV("FakeSocketLimited::query acquired mLock");
+        ++mQueries;
+
+        if (mQueries <= sLimit) {
+            ALOGV("size %zu vs. limit of %zu", query.size(), sMaxSize);
+            if (query.size() <= sMaxSize) {
+                // Return the response immediately (asynchronously).
+                mThreads.emplace_back(&IDnsTlsSocketObserver::onResponse, mObserver, make_echo(id, query));
+            }
+        }
+        if (mQueries == sLimit) {
+            mCloser = std::make_unique<std::thread>(&FakeSocketLimited::sendClose, this);
+        }
+        return mQueries <= sLimit;
+    }
+
+  private:
+    void sendClose() {
+        {
+            ALOGV("FakeSocketLimited::sendClose acquiring mLock");
+            std::lock_guard guard(mLock);
+            ALOGV("FakeSocketLimited::sendClose acquired mLock");
+            for (auto& thread : mThreads) {
+                ALOGV("FakeSocketLimited::sendClose joining response thread");
+                thread.join();
+                ALOGV("FakeSocketLimited::sendClose joined response thread");
+            }
+            mThreads.clear();
+        }
+        mObserver->onClosed();
+    }
+    std::mutex mLock;
+    IDnsTlsSocketObserver* const mObserver;
+    int mQueries GUARDED_BY(mLock);
+    std::vector<std::thread> mThreads GUARDED_BY(mLock);
+    std::unique_ptr<std::thread> mCloser GUARDED_BY(mLock);
+};
+
+int FakeSocketLimited::sLimit;
+size_t FakeSocketLimited::sMaxSize;
+
+TEST_F(TransportTest, SilentDrop) {
+    FakeSocketLimited::sLimit = 10;  // Close the socket after 10 queries.
+    FakeSocketLimited::sMaxSize = 0;  // Silently drop all queries
+    FakeSocketFactory<FakeSocketLimited> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+
+    // Queue up 10 queries.  They will all be ignored, and after the 10th,
+    // the socket will close.  Transport will retry them all, until they
+    // all hit the retry limit and expire.
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    results.reserve(FakeSocketLimited::sLimit);
+    for (int i = 0; i < FakeSocketLimited::sLimit; ++i) {
+        results.push_back(transport.query(makeSlice(QUERY)));
+    }
+    for (auto& result : results) {
+        auto r = result.get();
+        EXPECT_EQ(DnsTlsTransport::Response::network_error, r.code);
+        EXPECT_TRUE(r.response.empty());
+    }
+}
+
+TEST_F(TransportTest, PartialDrop) {
+    FakeSocketLimited::sLimit = 10;  // Close the socket after 10 queries.
+    FakeSocketLimited::sMaxSize = SIZE - 2;  // Silently drop "long" queries
+    FakeSocketFactory<FakeSocketLimited> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+
+    // Queue up 100 queries, alternating "short" which will be served and "long"
+    // which will be dropped.
+    const int num_queries = 10 * FakeSocketLimited::sLimit;
+    std::vector<bytevec> queries(num_queries);
+    std::vector<std::future<DnsTlsTransport::Result>> results;
+    results.reserve(num_queries);
+    for (int i = 0; i < num_queries; ++i) {
+        queries[i] = make_query(i, SIZE + (i % 2));
+        results.push_back(transport.query(makeSlice(queries[i])));
+    }
+    // Just check the short queries, which are at the even indices.
+    for (int i = 0; i < num_queries; i += 2) {
+        auto r = results[i].get();
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        EXPECT_EQ(queries[i], r.response);
+    }
+}
+
+// Simulate a malfunctioning server that injects extra miscellaneous
+// responses to queries that were not asked.  This will cause wrong answers but
+// must not crash the Transport.
+class FakeSocketGarbage : public IDnsTlsSocket {
+  public:
+    explicit FakeSocketGarbage(IDnsTlsSocketObserver* observer) : mObserver(observer) {
+        // Inject a garbage event.
+        mThreads.emplace_back(&IDnsTlsSocketObserver::onResponse, mObserver, make_query(ID + 1, SIZE));
+    }
+    ~FakeSocketGarbage() {
+        std::lock_guard guard(mLock);
+        for (auto& thread : mThreads) {
+            thread.join();
+        }
+    }
+    bool query(uint16_t id, const Slice query) override {
+        std::lock_guard guard(mLock);
+        // Return the response twice.
+        auto echo = make_echo(id, query);
+        mThreads.emplace_back(&IDnsTlsSocketObserver::onResponse, mObserver, echo);
+        mThreads.emplace_back(&IDnsTlsSocketObserver::onResponse, mObserver, echo);
+        // Also return some other garbage
+        mThreads.emplace_back(&IDnsTlsSocketObserver::onResponse, mObserver, make_query(id + 1, query.size() + 2));
+        return true;
+    }
+
+  private:
+    std::mutex mLock;
+    std::vector<std::thread> mThreads GUARDED_BY(mLock);
+    IDnsTlsSocketObserver* const mObserver;
+};
+
+TEST_F(TransportTest, IgnoringGarbage) {
+    FakeSocketFactory<FakeSocketGarbage> factory;
+    DnsTlsTransport transport(SERVER1, MARK, &factory);
+    for (int i = 0; i < 10; ++i) {
+        auto r = transport.query(makeSlice(QUERY)).get();
+
+        EXPECT_EQ(DnsTlsTransport::Response::success, r.code);
+        // Don't check the response because this server is malfunctioning.
+    }
+}
+
+// Dispatcher tests
+class DispatcherTest : public BaseTest {};
+
+TEST_F(DispatcherTest, Query) {
+    bytevec ans(4096);
+    int resplen = 0;
+
+    auto factory = std::make_unique<FakeSocketFactory<FakeSocketEcho>>();
+    DnsTlsDispatcher dispatcher(std::move(factory));
+    auto r = dispatcher.query(SERVER1, MARK, makeSlice(QUERY),
+                              makeSlice(ans), &resplen);
+
+    EXPECT_EQ(DnsTlsTransport::Response::success, r);
+    EXPECT_EQ(int(QUERY.size()), resplen);
+    ans.resize(resplen);
+    EXPECT_EQ(QUERY, ans);
+}
+
+TEST_F(DispatcherTest, AnswerTooLarge) {
+    bytevec ans(SIZE - 1);  // Too small to hold the answer
+    int resplen = 0;
+
+    auto factory = std::make_unique<FakeSocketFactory<FakeSocketEcho>>();
+    DnsTlsDispatcher dispatcher(std::move(factory));
+    auto r = dispatcher.query(SERVER1, MARK, makeSlice(QUERY),
+                              makeSlice(ans), &resplen);
+
+    EXPECT_EQ(DnsTlsTransport::Response::limit_error, r);
+}
+
+template<class T>
+class TrackingFakeSocketFactory : public IDnsTlsSocketFactory {
+  public:
+    TrackingFakeSocketFactory() {}
+    std::unique_ptr<IDnsTlsSocket> createDnsTlsSocket(
+            const DnsTlsServer& server,
+            unsigned mark,
+            IDnsTlsSocketObserver* observer,
+            DnsTlsSessionCache* cache ATTRIBUTE_UNUSED) override {
+        std::lock_guard guard(mLock);
+        keys.emplace(mark, server);
+        return std::make_unique<T>(observer);
+    }
+    std::multiset<std::pair<unsigned, DnsTlsServer>> keys;
+
+  private:
+    std::mutex mLock;
+};
+
+TEST_F(DispatcherTest, Dispatching) {
+    FakeSocketDelay::sDelay = 5;
+    FakeSocketDelay::sReverse = true;
+    auto factory = std::make_unique<TrackingFakeSocketFactory<FakeSocketDelay>>();
+    auto* weak_factory = factory.get();  // Valid as long as dispatcher is in scope.
+    DnsTlsDispatcher dispatcher(std::move(factory));
+
+    // Populate a vector of two servers and two socket marks, four combinations
+    // in total.
+    std::vector<std::pair<unsigned, DnsTlsServer>> keys;
+    keys.emplace_back(MARK, SERVER1);
+    keys.emplace_back(MARK + 1, SERVER1);
+    keys.emplace_back(MARK, V4ADDR2);
+    keys.emplace_back(MARK + 1, V4ADDR2);
+
+    // Do several queries on each server.  They should all succeed.
+    std::vector<std::thread> threads;
+    for (size_t i = 0; i < FakeSocketDelay::sDelay * keys.size(); ++i) {
+        auto key = keys[i % keys.size()];
+        threads.emplace_back([key, i] (DnsTlsDispatcher* dispatcher) {
+            auto q = make_query(i, SIZE);
+            bytevec ans(4096);
+            int resplen = 0;
+            unsigned mark = key.first;
+            const DnsTlsServer& server = key.second;
+            auto r = dispatcher->query(server, mark, makeSlice(q),
+                                       makeSlice(ans), &resplen);
+            EXPECT_EQ(DnsTlsTransport::Response::success, r);
+            EXPECT_EQ(int(q.size()), resplen);
+            ans.resize(resplen);
+            EXPECT_EQ(q, ans);
+        }, &dispatcher);
+    }
+    for (auto& thread : threads) {
+        thread.join();
+    }
+    // We expect that the factory created one socket for each key.
+    EXPECT_EQ(keys.size(), weak_factory->keys.size());
+    for (auto& key : keys) {
+        EXPECT_EQ(1U, weak_factory->keys.count(key));
+    }
+}
+
+// Check DnsTlsServer's comparison logic.
+AddressComparator ADDRESS_COMPARATOR;
+bool isAddressEqual(const DnsTlsServer& s1, const DnsTlsServer& s2) {
+    bool cmp1 = ADDRESS_COMPARATOR(s1, s2);
+    bool cmp2 = ADDRESS_COMPARATOR(s2, s1);
+    EXPECT_FALSE(cmp1 && cmp2);
+    return !cmp1 && !cmp2;
+}
+
+void checkUnequal(const DnsTlsServer& s1, const DnsTlsServer& s2) {
+    EXPECT_TRUE(s1 == s1);
+    EXPECT_TRUE(s2 == s2);
+    EXPECT_TRUE(isAddressEqual(s1, s1));
+    EXPECT_TRUE(isAddressEqual(s2, s2));
+
+    EXPECT_TRUE(s1 < s2 ^ s2 < s1);
+    EXPECT_FALSE(s1 == s2);
+    EXPECT_FALSE(s2 == s1);
+}
+
+class ServerTest : public BaseTest {};
+
+TEST_F(ServerTest, IPv4) {
+    checkUnequal(V4ADDR1, V4ADDR2);
+    EXPECT_FALSE(isAddressEqual(V4ADDR1, V4ADDR2));
+}
+
+TEST_F(ServerTest, IPv6) {
+    checkUnequal(V6ADDR1, V6ADDR2);
+    EXPECT_FALSE(isAddressEqual(V6ADDR1, V6ADDR2));
+}
+
+TEST_F(ServerTest, MixedAddressFamily) {
+    checkUnequal(V6ADDR1, V4ADDR1);
+    EXPECT_FALSE(isAddressEqual(V6ADDR1, V4ADDR1));
+}
+
+TEST_F(ServerTest, IPv6ScopeId) {
+    DnsTlsServer s1(V6ADDR1), s2(V6ADDR1);
+    sockaddr_in6* addr1 = reinterpret_cast<sockaddr_in6*>(&s1.ss);
+    addr1->sin6_scope_id = 1;
+    sockaddr_in6* addr2 = reinterpret_cast<sockaddr_in6*>(&s2.ss);
+    addr2->sin6_scope_id = 2;
+    checkUnequal(s1, s2);
+    EXPECT_FALSE(isAddressEqual(s1, s2));
+
+    EXPECT_FALSE(s1.wasExplicitlyConfigured());
+    EXPECT_FALSE(s2.wasExplicitlyConfigured());
+}
+
+TEST_F(ServerTest, IPv6FlowInfo) {
+    DnsTlsServer s1(V6ADDR1), s2(V6ADDR1);
+    sockaddr_in6* addr1 = reinterpret_cast<sockaddr_in6*>(&s1.ss);
+    addr1->sin6_flowinfo = 1;
+    sockaddr_in6* addr2 = reinterpret_cast<sockaddr_in6*>(&s2.ss);
+    addr2->sin6_flowinfo = 2;
+    // All comparisons ignore flowinfo.
+    EXPECT_EQ(s1, s2);
+    EXPECT_TRUE(isAddressEqual(s1, s2));
+
+    EXPECT_FALSE(s1.wasExplicitlyConfigured());
+    EXPECT_FALSE(s2.wasExplicitlyConfigured());
+}
+
+TEST_F(ServerTest, Port) {
+    DnsTlsServer s1, s2;
+    parseServer("192.0.2.1", 853, &s1.ss);
+    parseServer("192.0.2.1", 854, &s2.ss);
+    checkUnequal(s1, s2);
+    EXPECT_TRUE(isAddressEqual(s1, s2));
+
+    DnsTlsServer s3, s4;
+    parseServer("2001:db8::1", 853, &s3.ss);
+    parseServer("2001:db8::1", 852, &s4.ss);
+    checkUnequal(s3, s4);
+    EXPECT_TRUE(isAddressEqual(s3, s4));
+
+    EXPECT_FALSE(s1.wasExplicitlyConfigured());
+    EXPECT_FALSE(s2.wasExplicitlyConfigured());
+}
+
+TEST_F(ServerTest, Name) {
+    DnsTlsServer s1(V4ADDR1), s2(V4ADDR1);
+    s1.name = SERVERNAME1;
+    checkUnequal(s1, s2);
+    s2.name = SERVERNAME2;
+    checkUnequal(s1, s2);
+    EXPECT_TRUE(isAddressEqual(s1, s2));
+
+    EXPECT_TRUE(s1.wasExplicitlyConfigured());
+    EXPECT_TRUE(s2.wasExplicitlyConfigured());
+}
+
+TEST_F(ServerTest, Fingerprint) {
+    DnsTlsServer s1(V4ADDR1), s2(V4ADDR1);
+
+    s1.fingerprints.insert(FINGERPRINT1);
+    checkUnequal(s1, s2);
+    EXPECT_TRUE(isAddressEqual(s1, s2));
+
+    s2.fingerprints.insert(FINGERPRINT2);
+    checkUnequal(s1, s2);
+    EXPECT_TRUE(isAddressEqual(s1, s2));
+
+    s2.fingerprints.insert(FINGERPRINT1);
+    checkUnequal(s1, s2);
+    EXPECT_TRUE(isAddressEqual(s1, s2));
+
+    s1.fingerprints.insert(FINGERPRINT2);
+    EXPECT_EQ(s1, s2);
+    EXPECT_TRUE(isAddressEqual(s1, s2));
+
+    EXPECT_TRUE(s1.wasExplicitlyConfigured());
+    EXPECT_TRUE(s2.wasExplicitlyConfigured());
+}
+
+TEST(QueryMapTest, Basic) {
+    DnsTlsQueryMap map;
+
+    EXPECT_TRUE(map.empty());
+
+    bytevec q0 = make_query(999, SIZE);
+    bytevec q1 = make_query(888, SIZE);
+    bytevec q2 = make_query(777, SIZE);
+
+    auto f0 = map.recordQuery(makeSlice(q0));
+    auto f1 = map.recordQuery(makeSlice(q1));
+    auto f2 = map.recordQuery(makeSlice(q2));
+
+    // Check return values of recordQuery
+    EXPECT_EQ(0, f0->query.newId);
+    EXPECT_EQ(1, f1->query.newId);
+    EXPECT_EQ(2, f2->query.newId);
+
+    // Check side effects of recordQuery
+    EXPECT_FALSE(map.empty());
+
+    auto all = map.getAll();
+    EXPECT_EQ(3U, all.size());
+
+    EXPECT_EQ(0, all[0].newId);
+    EXPECT_EQ(1, all[1].newId);
+    EXPECT_EQ(2, all[2].newId);
+
+    EXPECT_EQ(makeSlice(q0), all[0].query);
+    EXPECT_EQ(makeSlice(q1), all[1].query);
+    EXPECT_EQ(makeSlice(q2), all[2].query);
+
+    bytevec a0 = make_query(0, SIZE);
+    bytevec a1 = make_query(1, SIZE);
+    bytevec a2 = make_query(2, SIZE);
+
+    // Return responses out of order
+    map.onResponse(a2);
+    map.onResponse(a0);
+    map.onResponse(a1);
+
+    EXPECT_TRUE(map.empty());
+
+    auto r0 = f0->result.get();
+    auto r1 = f1->result.get();
+    auto r2 = f2->result.get();
+
+    EXPECT_EQ(DnsTlsQueryMap::Response::success, r0.code);
+    EXPECT_EQ(DnsTlsQueryMap::Response::success, r1.code);
+    EXPECT_EQ(DnsTlsQueryMap::Response::success, r2.code);
+
+    const bytevec& d0 = r0.response;
+    const bytevec& d1 = r1.response;
+    const bytevec& d2 = r2.response;
+
+    // The ID should match the query
+    EXPECT_EQ(999, d0[0] << 8 | d0[1]);
+    EXPECT_EQ(888, d1[0] << 8 | d1[1]);
+    EXPECT_EQ(777, d2[0] << 8 | d2[1]);
+    // The body should match the answer
+    EXPECT_EQ(bytevec(a0.begin() + 2, a0.end()), bytevec(d0.begin() + 2, d0.end()));
+    EXPECT_EQ(bytevec(a1.begin() + 2, a1.end()), bytevec(d1.begin() + 2, d1.end()));
+    EXPECT_EQ(bytevec(a2.begin() + 2, a2.end()), bytevec(d2.begin() + 2, d2.end()));
+}
+
+TEST(QueryMapTest, FillHole) {
+    DnsTlsQueryMap map;
+    std::vector<std::unique_ptr<DnsTlsQueryMap::QueryFuture>> futures(UINT16_MAX + 1);
+    for (uint32_t i = 0; i <= UINT16_MAX; ++i) {
+        futures[i] = map.recordQuery(makeSlice(QUERY));
+        ASSERT_TRUE(futures[i]);  // answers[i] should be nonnull.
+        EXPECT_EQ(i, futures[i]->query.newId);
+    }
+
+    // The map should now be full.
+    EXPECT_EQ(size_t(UINT16_MAX + 1), map.getAll().size());
+
+    // Trying to add another query should fail because the map is full.
+    EXPECT_FALSE(map.recordQuery(makeSlice(QUERY)));
+
+    // Send an answer to query 40000
+    auto answer = make_query(40000, SIZE);
+    map.onResponse(answer);
+    auto result = futures[40000]->result.get();
+    EXPECT_EQ(DnsTlsQueryMap::Response::success, result.code);
+    EXPECT_EQ(ID, result.response[0] << 8 | result.response[1]);
+    EXPECT_EQ(bytevec(answer.begin() + 2, answer.end()),
+              bytevec(result.response.begin() + 2, result.response.end()));
+
+    // There should now be room in the map.
+    EXPECT_EQ(size_t(UINT16_MAX), map.getAll().size());
+    auto f = map.recordQuery(makeSlice(QUERY));
+    ASSERT_TRUE(f);
+    EXPECT_EQ(40000, f->query.newId);
+
+    // The map should now be full again.
+    EXPECT_EQ(size_t(UINT16_MAX + 1), map.getAll().size());
+    EXPECT_FALSE(map.recordQuery(makeSlice(QUERY)));
+}
+
+class StubObserver : public IDnsTlsSocketObserver {
+  public:
+    bool closed = false;
+    void onResponse(std::vector<uint8_t>) override {}
+
+    void onClosed() override { closed = true; }
+};
+
+TEST(DnsTlsSocketTest, SlowDestructor) {
+    constexpr char tls_addr[] = "127.0.0.3";
+    constexpr char tls_port[] = "8530";  // High-numbered port so root isn't required.
+    // This test doesn't perform any queries, so the backend address can be invalid.
+    constexpr char backend_addr[] = "192.0.2.1";
+    constexpr char backend_port[] = "1";
+
+    test::DnsTlsFrontend tls(tls_addr, tls_port, backend_addr, backend_port);
+    ASSERT_TRUE(tls.startServer());
+
+    DnsTlsServer server;
+    parseServer(tls_addr, 8530, &server.ss);
+
+    StubObserver observer;
+    ASSERT_FALSE(observer.closed);
+    DnsTlsSessionCache cache;
+    auto socket = std::make_unique<DnsTlsSocket>(server, MARK, &observer, &cache);
+    ASSERT_TRUE(socket->initialize());
+
+    // Test: Time the socket destructor.  This should be fast.
+    auto before = std::chrono::steady_clock::now();
+    socket.reset();
+    auto after = std::chrono::steady_clock::now();
+    auto delay = after - before;
+    ALOGV("Shutdown took %lld ns", delay / std::chrono::nanoseconds{1});
+    EXPECT_TRUE(observer.closed);
+    // Shutdown should complete in milliseconds, but if the shutdown signal is lost
+    // it will wait for the timeout, which is expected to take 20seconds.
+    EXPECT_LT(delay, std::chrono::seconds{5});
+}
+
+} // end of namespace net
+} // end of namespace android
diff --git a/resolv/dnsresolver_binder_test.cpp b/resolv/dnsresolver_binder_test.cpp
new file mode 100644
index 0000000..97dea53
--- /dev/null
+++ b/resolv/dnsresolver_binder_test.cpp
@@ -0,0 +1,373 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * binder_test.cpp - unit tests for netd binder RPCs.
+ */
+
+#ifdef NDEBUG
+#undef NDEBUG
+#endif
+
+#include <vector>
+
+#include <openssl/base64.h>
+
+#include <android-base/strings.h>
+#include <android/net/IDnsResolver.h>
+#include <binder/IPCThreadState.h>
+#include <binder/IServiceManager.h>
+#include <gmock/gmock-matchers.h>
+#include <gtest/gtest.h>
+#include <netdb.h>
+#include <netdutils/Stopwatch.h>
+#include "tests/BaseTestMetricsListener.h"
+#include "tests/TestMetrics.h"
+
+#include "NetdConstants.h"  // SHA256_SIZE
+#include "ResolverStats.h"
+#include "dns_responder.h"
+#include "dns_responder_client.h"
+
+namespace binder = android::binder;
+
+using android::IBinder;
+using android::IServiceManager;
+using android::ProcessState;
+using android::sp;
+using android::String16;
+using android::String8;
+using android::net::IDnsResolver;
+using android::net::ResolverParamsParcel;
+using android::net::ResolverStats;
+using android::net::metrics::INetdEventListener;
+using android::net::metrics::TestOnDnsEvent;
+using android::netdutils::Stopwatch;
+
+// TODO: make this dynamic and stop depending on implementation details.
+// Sync from TEST_NETID in dns_responder_client.cpp as resolver_test.cpp does.
+constexpr int TEST_NETID = 30;
+
+class DnsResolverBinderTest : public ::testing::Test {
+  public:
+    DnsResolverBinderTest() {
+        sp<IServiceManager> sm = android::defaultServiceManager();
+        sp<IBinder> binder = sm->getService(String16("dnsresolver"));
+        if (binder != nullptr) {
+            mDnsResolver = android::interface_cast<IDnsResolver>(binder);
+        }
+        // This could happen when the test isn't running as root, or if netd isn't running.
+        assert(nullptr != mDnsResolver.get());
+        // Create cache for test
+        mDnsResolver->createNetworkCache(TEST_NETID);
+    }
+
+    ~DnsResolverBinderTest() {
+        // Destroy cache for test
+        mDnsResolver->destroyNetworkCache(TEST_NETID);
+    }
+
+  protected:
+    sp<IDnsResolver> mDnsResolver;
+};
+
+class TimedOperation : public Stopwatch {
+  public:
+    explicit TimedOperation(const std::string& name) : mName(name) {}
+    virtual ~TimedOperation() { fprintf(stderr, "    %s: %6.1f ms\n", mName.c_str(), timeTaken()); }
+
+  private:
+    std::string mName;
+};
+
+namespace {
+
+std::string base64Encode(const std::vector<uint8_t>& input) {
+    size_t out_len;
+    EXPECT_EQ(1, EVP_EncodedLength(&out_len, input.size()));
+    // out_len includes the trailing NULL.
+    uint8_t output_bytes[out_len];
+    EXPECT_EQ(out_len - 1, EVP_EncodeBlock(output_bytes, input.data(), input.size()));
+    return std::string(reinterpret_cast<char*>(output_bytes));
+}
+
+// TODO: Convert tests to ResolverParamsParcel and delete this stub.
+ResolverParamsParcel makeResolverParamsParcel(int netId, const std::vector<int>& params,
+                                              const std::vector<std::string>& servers,
+                                              const std::vector<std::string>& domains,
+                                              const std::string& tlsHostname,
+                                              const std::vector<std::string>& tlsServers,
+                                              const std::vector<std::string>& tlsFingerprints) {
+    using android::net::IDnsResolver;
+    ResolverParamsParcel paramsParcel;
+
+    paramsParcel.netId = netId;
+    paramsParcel.sampleValiditySeconds = params[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY];
+    paramsParcel.successThreshold = params[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD];
+    paramsParcel.minSamples = params[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES];
+    paramsParcel.maxSamples = params[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES];
+    if (params.size() > IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC) {
+        paramsParcel.baseTimeoutMsec = params[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC];
+    } else {
+        paramsParcel.baseTimeoutMsec = 0;
+    }
+    if (params.size() > IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT) {
+        paramsParcel.retryCount = params[IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT];
+    } else {
+        paramsParcel.retryCount = 0;
+    }
+    paramsParcel.servers = servers;
+    paramsParcel.domains = domains;
+    paramsParcel.tlsName = tlsHostname;
+    paramsParcel.tlsServers = tlsServers;
+    paramsParcel.tlsFingerprints = tlsFingerprints;
+
+    return paramsParcel;
+}
+
+}  // namespace
+
+TEST_F(DnsResolverBinderTest, IsAlive) {
+    TimedOperation t("isAlive RPC");
+    bool isAlive = false;
+    mDnsResolver->isAlive(&isAlive);
+    ASSERT_TRUE(isAlive);
+}
+
+// TODO: Move this test to resolver_test.cpp
+TEST_F(DnsResolverBinderTest, EventListener_onDnsEvent) {
+    // The test configs are used to trigger expected events. The expected results are defined in
+    // expectedResults.
+    static const struct TestConfig {
+        std::string hostname;
+        int returnCode;
+    } testConfigs[] = {
+            {"hi", 0 /*success*/},
+            {"nonexistent", EAI_NODATA},
+    };
+
+    // The expected results define expected event content for test verification.
+    static const std::vector<TestOnDnsEvent::TestResult> expectedResults = {
+            {TEST_NETID, INetdEventListener::EVENT_GETADDRINFO, 0 /*success*/, 1, "hi", "1.2.3.4"},
+            {TEST_NETID, INetdEventListener::EVENT_GETADDRINFO, EAI_NODATA, 0, "nonexistent", ""},
+    };
+
+    // Start the Binder thread pool.
+    // TODO: Consider doing this once if there has another event listener unit test.
+    android::ProcessState::self()->startThreadPool();
+
+    // Setup network.
+    // TODO: Setup device configuration and DNS responser server as resolver test does.
+    // Currently, leave DNS related configuration in this test because only it needs DNS
+    // client-server testing environment.
+    DnsResponderClient dnsClient;
+    dnsClient.SetUp();
+
+    // Setup DNS responder server.
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    test::DNSResponder dns(listen_addr, listen_srv, 250, ns_rcode::ns_r_servfail);
+    dns.addMapping("hi.example.com.", ns_type::ns_t_a, "1.2.3.4");
+    ASSERT_TRUE(dns.startServer());
+
+    // Setup DNS configuration.
+    const std::vector<std::string> test_servers = {listen_addr};
+    std::vector<std::string> test_domains = {"example.com"};
+    std::vector<int> test_params = {300 /*sample_validity*/, 25 /*success_threshold*/,
+                                    8 /*min_samples*/, 8 /*max_samples*/};
+
+    ASSERT_TRUE(dnsClient.SetResolversForNetwork(test_servers, test_domains, test_params));
+    dns.clearQueries();
+
+    // Register event listener.
+    android::sp<TestOnDnsEvent> testOnDnsEvent = new TestOnDnsEvent(expectedResults);
+    android::binder::Status status = mDnsResolver->registerEventListener(
+            android::interface_cast<INetdEventListener>(testOnDnsEvent));
+    ASSERT_TRUE(status.isOk()) << status.exceptionMessage();
+
+    // DNS queries.
+    // Once all expected events of expectedResults are received by the listener, the unit test will
+    // be notified. Otherwise, notified with a timeout expired failure.
+    auto& cv = testOnDnsEvent->getCv();
+    auto& cvMutex = testOnDnsEvent->getCvMutex();
+    {
+        std::unique_lock lock(cvMutex);
+
+        for (const auto& config : testConfigs) {
+            SCOPED_TRACE(config.hostname);
+
+            addrinfo* result = nullptr;
+            addrinfo hints = {.ai_family = AF_INET, .ai_socktype = SOCK_DGRAM};
+            int status = getaddrinfo(config.hostname.c_str(), nullptr, &hints, &result);
+            EXPECT_EQ(config.returnCode, status);
+
+            if (result) freeaddrinfo(result);
+        }
+
+        // Wait for receiving expected events.
+        EXPECT_EQ(std::cv_status::no_timeout, cv.wait_for(lock, std::chrono::seconds(2)));
+    }
+
+    // Verify that all testcases are passed.
+    EXPECT_TRUE(testOnDnsEvent->isVerified());
+
+    dnsClient.TearDown();
+}
+
+TEST_F(DnsResolverBinderTest, SetResolverConfiguration_Tls) {
+    // Certificate fingerprints are no longer supported by the module.
+    SKIP_IF_RESOLVER_VERSION_NEWER_THAN(mDnsResolver, 2);
+
+    const std::vector<std::string> LOCALLY_ASSIGNED_DNS{"8.8.8.8", "2001:4860:4860::8888"};
+    std::vector<uint8_t> fp(SHA256_SIZE);
+    std::vector<uint8_t> short_fp(1);
+    std::vector<uint8_t> long_fp(SHA256_SIZE + 1);
+    std::vector<std::string> test_domains;
+    std::vector<int> test_params = {300, 25, 8, 8};
+    static const struct TestData {
+        const std::vector<std::string> servers;
+        const std::string tlsName;
+        const std::vector<std::vector<uint8_t>> tlsFingerprints;
+        const int expectedReturnCode;
+    } kTlsTestData[] = {
+            {{"192.0.2.1"}, "", {}, 0},
+            {{"2001:db8::2"}, "host.name", {}, 0},
+            {{"192.0.2.3"}, "@@@@", {fp}, 0},
+            {{"2001:db8::4"}, "", {fp}, 0},
+            {{}, "", {}, 0},
+            {{""}, "", {}, EINVAL},
+            {{"192.0.*.5"}, "", {}, EINVAL},
+            {{"2001:dg8::6"}, "", {}, EINVAL},
+            {{"2001:db8::c"}, "", {short_fp}, EINVAL},
+            {{"192.0.2.12"}, "", {long_fp}, EINVAL},
+            {{"2001:db8::e"}, "", {fp, fp, fp}, 0},
+            {{"192.0.2.14"}, "", {fp, short_fp}, EINVAL},
+    };
+
+    for (size_t i = 0; i < std::size(kTlsTestData); i++) {
+        const auto& td = kTlsTestData[i];
+
+        std::vector<std::string> fingerprints;
+        for (const auto& fingerprint : td.tlsFingerprints) {
+            fingerprints.push_back(base64Encode(fingerprint));
+        }
+        const auto resolverParams =
+                makeResolverParamsParcel(TEST_NETID, test_params, LOCALLY_ASSIGNED_DNS,
+                                         test_domains, td.tlsName, td.servers, fingerprints);
+        binder::Status status = mDnsResolver->setResolverConfiguration(resolverParams);
+
+        if (td.expectedReturnCode == 0) {
+            SCOPED_TRACE(String8::format("test case %zu should have passed", i));
+            SCOPED_TRACE(status.toString8());
+            EXPECT_EQ(0, status.exceptionCode());
+        } else {
+            SCOPED_TRACE(String8::format("test case %zu should have failed", i));
+            EXPECT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
+            EXPECT_EQ(td.expectedReturnCode, status.serviceSpecificErrorCode());
+        }
+    }
+}
+
+TEST_F(DnsResolverBinderTest, GetResolverInfo) {
+    std::vector<std::string> servers = {"127.0.0.1", "127.0.0.2"};
+    std::vector<std::string> domains = {"example.com"};
+    std::vector<int> testParams = {
+            300,     // sample validity in seconds
+            25,      // success threshod in percent
+            8,   8,  // {MIN,MAX}_SAMPLES
+            100,     // BASE_TIMEOUT_MSEC
+            2,       // retry count
+    };
+    const auto resolverParams =
+            makeResolverParamsParcel(TEST_NETID, testParams, servers, domains, "", {}, {});
+    binder::Status status = mDnsResolver->setResolverConfiguration(resolverParams);
+    EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
+
+    std::vector<std::string> res_servers;
+    std::vector<std::string> res_domains;
+    std::vector<std::string> res_tls_servers;
+    std::vector<int32_t> params32;
+    std::vector<int32_t> stats32;
+    std::vector<int32_t> wait_for_pending_req_timeout_count32{0};
+    status = mDnsResolver->getResolverInfo(TEST_NETID, &res_servers, &res_domains, &res_tls_servers,
+                                           &params32, &stats32,
+                                           &wait_for_pending_req_timeout_count32);
+
+    EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
+    EXPECT_EQ(servers.size(), res_servers.size());
+    EXPECT_EQ(domains.size(), res_domains.size());
+    EXPECT_EQ(0U, res_tls_servers.size());
+    ASSERT_EQ(static_cast<size_t>(IDnsResolver::RESOLVER_PARAMS_COUNT), testParams.size());
+    EXPECT_EQ(testParams[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY],
+              params32[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY]);
+    EXPECT_EQ(testParams[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD],
+              params32[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD]);
+    EXPECT_EQ(testParams[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES],
+              params32[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES]);
+    EXPECT_EQ(testParams[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES],
+              params32[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES]);
+    EXPECT_EQ(testParams[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC],
+              params32[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC]);
+
+    std::vector<ResolverStats> stats;
+    ResolverStats::decodeAll(stats32, &stats);
+
+    EXPECT_EQ(servers.size(), stats.size());
+
+    EXPECT_THAT(res_servers, testing::UnorderedElementsAreArray(servers));
+    EXPECT_THAT(res_domains, testing::UnorderedElementsAreArray(domains));
+}
+
+TEST_F(DnsResolverBinderTest, CreateDestroyNetworkCache) {
+    // Must not be the same as TEST_NETID
+    const int ANOTHER_TEST_NETID = TEST_NETID + 1;
+
+    // Create a new network cache.
+    EXPECT_TRUE(mDnsResolver->createNetworkCache(ANOTHER_TEST_NETID).isOk());
+
+    // create it again, expect a EEXIST.
+    EXPECT_EQ(EEXIST,
+              mDnsResolver->createNetworkCache(ANOTHER_TEST_NETID).serviceSpecificErrorCode());
+
+    // destroy it.
+    EXPECT_TRUE(mDnsResolver->destroyNetworkCache(ANOTHER_TEST_NETID).isOk());
+
+    // re-create it
+    EXPECT_TRUE(mDnsResolver->createNetworkCache(ANOTHER_TEST_NETID).isOk());
+
+    // destroy it.
+    EXPECT_TRUE(mDnsResolver->destroyNetworkCache(ANOTHER_TEST_NETID).isOk());
+
+    // re-destroy it
+    EXPECT_TRUE(mDnsResolver->destroyNetworkCache(ANOTHER_TEST_NETID).isOk());
+}
+
+TEST_F(DnsResolverBinderTest, setLogSeverity) {
+    // Expect fail
+    EXPECT_EQ(EINVAL, mDnsResolver->setLogSeverity(-1).serviceSpecificErrorCode());
+
+    // Test set different log level
+    EXPECT_TRUE(mDnsResolver->setLogSeverity(IDnsResolver::DNS_RESOLVER_LOG_VERBOSE).isOk());
+
+    EXPECT_TRUE(mDnsResolver->setLogSeverity(IDnsResolver::DNS_RESOLVER_LOG_DEBUG).isOk());
+
+    EXPECT_TRUE(mDnsResolver->setLogSeverity(IDnsResolver::DNS_RESOLVER_LOG_INFO).isOk());
+
+    EXPECT_TRUE(mDnsResolver->setLogSeverity(IDnsResolver::DNS_RESOLVER_LOG_WARNING).isOk());
+
+    EXPECT_TRUE(mDnsResolver->setLogSeverity(IDnsResolver::DNS_RESOLVER_LOG_ERROR).isOk());
+
+    // Set back to default
+    EXPECT_TRUE(mDnsResolver->setLogSeverity(IDnsResolver::DNS_RESOLVER_LOG_WARNING).isOk());
+}
diff --git a/resolv/getaddrinfo.cpp b/resolv/getaddrinfo.cpp
new file mode 100644
index 0000000..bb9ef07
--- /dev/null
+++ b/resolv/getaddrinfo.cpp
@@ -0,0 +1,1832 @@
+/*	$NetBSD: getaddrinfo.c,v 1.82 2006/03/25 12:09:40 rpaulo Exp $	*/
+/*	$KAME: getaddrinfo.c,v 1.29 2000/08/31 17:26:57 itojun Exp $	*/
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#define LOG_TAG "getaddrinfo"
+
+#include "getaddrinfo.h"
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <assert.h>
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <net/if.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+#include <android-base/logging.h>
+
+#include "netd_resolv/resolv.h"
+#include "resolv_cache.h"
+#include "resolv_private.h"
+
+#define ANY 0
+
+using android::net::NetworkDnsEventReported;
+
+const char in_addrany[] = {0, 0, 0, 0};
+const char in_loopback[] = {127, 0, 0, 1};
+const char in6_addrany[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+const char in6_loopback[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1};
+
+const struct afd {
+    int a_af;
+    int a_addrlen;
+    int a_socklen;
+    int a_off;
+    const char* a_addrany;
+    const char* a_loopback;
+    int a_scoped;
+} afdl[] = {
+        {PF_INET6, sizeof(struct in6_addr), sizeof(struct sockaddr_in6),
+         offsetof(struct sockaddr_in6, sin6_addr), in6_addrany, in6_loopback, 1},
+        {PF_INET, sizeof(struct in_addr), sizeof(struct sockaddr_in),
+         offsetof(struct sockaddr_in, sin_addr), in_addrany, in_loopback, 0},
+        {0, 0, 0, 0, NULL, NULL, 0},
+};
+
+struct Explore {
+    int e_af;
+    int e_socktype;
+    int e_protocol;
+    int e_wild;
+#define WILD_AF(ex) ((ex).e_wild & 0x01)
+#define WILD_SOCKTYPE(ex) ((ex).e_wild & 0x02)
+#define WILD_PROTOCOL(ex) ((ex).e_wild & 0x04)
+};
+
+const Explore explore_options[] = {
+        {PF_INET6, SOCK_DGRAM, IPPROTO_UDP, 0x07},
+        {PF_INET6, SOCK_STREAM, IPPROTO_TCP, 0x07},
+        {PF_INET6, SOCK_RAW, ANY, 0x05},
+        {PF_INET, SOCK_DGRAM, IPPROTO_UDP, 0x07},
+        {PF_INET, SOCK_STREAM, IPPROTO_TCP, 0x07},
+        {PF_INET, SOCK_RAW, ANY, 0x05},
+        {PF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP, 0x07},
+        {PF_UNSPEC, SOCK_STREAM, IPPROTO_TCP, 0x07},
+        {PF_UNSPEC, SOCK_RAW, ANY, 0x05},
+};
+
+#define PTON_MAX 16
+#define MAXPACKET (8 * 1024)
+
+typedef union {
+    HEADER hdr;
+    u_char buf[MAXPACKET];
+} querybuf;
+
+struct res_target {
+    struct res_target* next;
+    const char* name;  /* domain name */
+    int qclass, qtype; /* class and type of query */
+    u_char* answer;    /* buffer to put answer */
+    int anslen;        /* size of answer buffer */
+    int n;             /* result length */
+};
+
+static int str2number(const char*);
+static int explore_fqdn(const struct addrinfo*, const char*, const char*, struct addrinfo**,
+                        const struct android_net_context*, NetworkDnsEventReported* event);
+static int explore_null(const struct addrinfo*, const char*, struct addrinfo**);
+static int explore_numeric(const struct addrinfo*, const char*, const char*, struct addrinfo**,
+                           const char*);
+static int explore_numeric_scope(const struct addrinfo*, const char*, const char*,
+                                 struct addrinfo**);
+static int get_canonname(const struct addrinfo*, struct addrinfo*, const char*);
+static struct addrinfo* get_ai(const struct addrinfo*, const struct afd*, const char*);
+static int get_portmatch(const struct addrinfo*, const char*);
+static int get_port(const struct addrinfo*, const char*, int);
+static const struct afd* find_afd(int);
+static int ip6_str2scopeid(const char*, struct sockaddr_in6*, u_int32_t*);
+
+static struct addrinfo* getanswer(const querybuf*, int, const char*, int, const struct addrinfo*,
+                                  int* herrno);
+static int dns_getaddrinfo(const char* name, const addrinfo* pai,
+                           const android_net_context* netcontext, addrinfo** rv,
+                           NetworkDnsEventReported* event);
+static void _sethtent(FILE**);
+static void _endhtent(FILE**);
+static struct addrinfo* _gethtent(FILE**, const char*, const struct addrinfo*);
+static bool files_getaddrinfo(const char* name, const addrinfo* pai, addrinfo** res);
+static int _find_src_addr(const struct sockaddr*, struct sockaddr*, unsigned, uid_t);
+
+static int res_queryN(const char* name, res_target* target, res_state res, int* herrno);
+static int res_searchN(const char* name, res_target* target, res_state res, int* herrno);
+static int res_querydomainN(const char* name, const char* domain, res_target* target, res_state res,
+                            int* herrno);
+
+const char* const ai_errlist[] = {
+        "Success",
+        "Address family for hostname not supported",    /* EAI_ADDRFAMILY */
+        "Temporary failure in name resolution",         /* EAI_AGAIN      */
+        "Invalid value for ai_flags",                   /* EAI_BADFLAGS   */
+        "Non-recoverable failure in name resolution",   /* EAI_FAIL       */
+        "ai_family not supported",                      /* EAI_FAMILY     */
+        "Memory allocation failure",                    /* EAI_MEMORY     */
+        "No address associated with hostname",          /* EAI_NODATA     */
+        "hostname nor servname provided, or not known", /* EAI_NONAME     */
+        "servname not supported for ai_socktype",       /* EAI_SERVICE    */
+        "ai_socktype not supported",                    /* EAI_SOCKTYPE   */
+        "System error returned in errno",               /* EAI_SYSTEM     */
+        "Invalid value for hints",                      /* EAI_BADHINTS	  */
+        "Resolved protocol is unknown",                 /* EAI_PROTOCOL   */
+        "Argument buffer overflow",                     /* EAI_OVERFLOW   */
+        "Unknown error",                                /* EAI_MAX        */
+};
+
+/* XXX macros that make external reference is BAD. */
+
+#define GET_AI(ai, afd, addr)                                \
+    do {                                                     \
+        /* external reference: pai, error, and label free */ \
+        (ai) = get_ai(pai, (afd), (addr));                   \
+        if ((ai) == NULL) {                                  \
+            error = EAI_MEMORY;                              \
+            goto free;                                       \
+        }                                                    \
+    } while (0)
+
+#define GET_PORT(ai, serv)                             \
+    do {                                               \
+        /* external reference: error and label free */ \
+        error = get_port((ai), (serv), 0);             \
+        if (error != 0) goto free;                     \
+    } while (0)
+
+#define MATCH_FAMILY(x, y, w) \
+    ((x) == (y) || ((w) && ((x) == PF_UNSPEC || (y) == PF_UNSPEC)))
+#define MATCH(x, y, w) ((x) == (y) || ((w) && ((x) == ANY || (y) == ANY)))
+
+const char* gai_strerror(int ecode) {
+    if (ecode < 0 || ecode > EAI_MAX) ecode = EAI_MAX;
+    return ai_errlist[ecode];
+}
+
+void freeaddrinfo(struct addrinfo* ai) {
+    while (ai) {
+        struct addrinfo* next = ai->ai_next;
+        if (ai->ai_canonname) free(ai->ai_canonname);
+        // Also frees ai->ai_addr which points to extra space beyond addrinfo
+        free(ai);
+        ai = next;
+    }
+}
+
+static int str2number(const char* p) {
+    char* ep;
+    unsigned long v;
+
+    assert(p != NULL);
+
+    if (*p == '\0') return -1;
+    ep = NULL;
+    errno = 0;
+    v = strtoul(p, &ep, 10);
+    if (errno == 0 && ep && *ep == '\0' && v <= UINT_MAX)
+        return v;
+    else
+        return -1;
+}
+
+/*
+ * The following functions determine whether IPv4 or IPv6 connectivity is
+ * available in order to implement AI_ADDRCONFIG.
+ *
+ * Strictly speaking, AI_ADDRCONFIG should not look at whether connectivity is
+ * available, but whether addresses of the specified family are "configured
+ * on the local system". However, bionic doesn't currently support getifaddrs,
+ * so checking for connectivity is the next best thing.
+ */
+static int have_ipv6(unsigned mark, uid_t uid) {
+    static const struct sockaddr_in6 sin6_test = {
+            .sin6_family = AF_INET6,
+            .sin6_addr.s6_addr = {// 2000::
+                                  0x20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}};
+    sockaddr_union addr = {.sin6 = sin6_test};
+    return _find_src_addr(&addr.sa, NULL, mark, uid) == 1;
+}
+
+static int have_ipv4(unsigned mark, uid_t uid) {
+    static const struct sockaddr_in sin_test = {
+            .sin_family = AF_INET,
+            .sin_addr.s_addr = __constant_htonl(0x08080808L)  // 8.8.8.8
+    };
+    sockaddr_union addr = {.sin = sin_test};
+    return _find_src_addr(&addr.sa, NULL, mark, uid) == 1;
+}
+
+// Internal version of getaddrinfo(), but limited to AI_NUMERICHOST.
+// NOTE: also called by resolv_set_nameservers_for_net().
+int getaddrinfo_numeric(const char* hostname, const char* servname, addrinfo hints,
+                        addrinfo** result) {
+    hints.ai_flags = AI_NUMERICHOST;
+    const android_net_context netcontext = {
+            .app_netid = NETID_UNSET,
+            .app_mark = MARK_UNSET,
+            .dns_netid = NETID_UNSET,
+            .dns_mark = MARK_UNSET,
+            .uid = NET_CONTEXT_INVALID_UID,
+    };
+    NetworkDnsEventReported event;
+    return android_getaddrinfofornetcontext(hostname, servname, &hints, &netcontext, result,
+                                            &event);
+}
+
+int android_getaddrinfofornetcontext(const char* hostname, const char* servname,
+                                     const struct addrinfo* hints,
+                                     const struct android_net_context* netcontext,
+                                     struct addrinfo** res, NetworkDnsEventReported* event) {
+    struct addrinfo sentinel = {};
+    struct addrinfo* cur = &sentinel;
+    int error = 0;
+
+    // hostname is allowed to be nullptr
+    // servname is allowed to be nullptr
+    // hints is allowed to be nullptr
+    assert(res != nullptr);
+    assert(netcontext != nullptr);
+    assert(event != nullptr);
+
+    struct addrinfo ai = {
+            .ai_flags = 0,
+            .ai_family = PF_UNSPEC,
+            .ai_socktype = ANY,
+            .ai_protocol = ANY,
+            .ai_addrlen = 0,
+            .ai_canonname = nullptr,
+            .ai_addr = nullptr,
+            .ai_next = nullptr,
+    };
+
+    do {
+        if (hostname == NULL && servname == NULL) {
+            error = EAI_NONAME;
+            break;
+        }
+        if (hints) {
+            /* error check for hints */
+            if (hints->ai_addrlen || hints->ai_canonname || hints->ai_addr || hints->ai_next) {
+                error = EAI_BADHINTS;
+                break;
+            }
+            if (hints->ai_flags & ~AI_MASK) {
+                error = EAI_BADFLAGS;
+                break;
+            }
+
+            if (!(hints->ai_family == PF_UNSPEC || hints->ai_family == PF_INET ||
+                  hints->ai_family == PF_INET6)) {
+                error = EAI_FAMILY;
+                break;
+            }
+
+            ai = *hints;
+
+            /*
+             * if both socktype/protocol are specified, check if they
+             * are meaningful combination.
+             */
+            if (ai.ai_socktype != ANY && ai.ai_protocol != ANY) {
+                for (const Explore& ex : explore_options) {
+                    if (ai.ai_family != ex.e_af) continue;
+                    if (ex.e_socktype == ANY) continue;
+                    if (ex.e_protocol == ANY) continue;
+                    if (ai.ai_socktype == ex.e_socktype && ai.ai_protocol != ex.e_protocol) {
+                        error = EAI_BADHINTS;
+                        break;
+                    }
+                }
+                if (error) break;
+            }
+        }
+
+        /*
+         * Check for special cases:
+         * (1) numeric servname is disallowed if socktype/protocol are left unspecified.
+         * (2) servname is disallowed for raw and other inet{,6} sockets.
+         */
+        if (MATCH_FAMILY(ai.ai_family, PF_INET, 1) || MATCH_FAMILY(ai.ai_family, PF_INET6, 1)) {
+            struct addrinfo tmp = ai;
+            if (tmp.ai_family == PF_UNSPEC) {
+                tmp.ai_family = PF_INET6;
+            }
+            error = get_portmatch(&tmp, servname);
+            if (error) break;
+        }
+
+        // NULL hostname, or numeric hostname
+        for (const Explore& ex : explore_options) {
+            /* PF_UNSPEC entries are prepared for DNS queries only */
+            if (ex.e_af == PF_UNSPEC) continue;
+
+            if (!MATCH_FAMILY(ai.ai_family, ex.e_af, WILD_AF(ex))) continue;
+            if (!MATCH(ai.ai_socktype, ex.e_socktype, WILD_SOCKTYPE(ex))) continue;
+            if (!MATCH(ai.ai_protocol, ex.e_protocol, WILD_PROTOCOL(ex))) continue;
+
+            struct addrinfo tmp = ai;
+            if (tmp.ai_family == PF_UNSPEC) tmp.ai_family = ex.e_af;
+            if (tmp.ai_socktype == ANY && ex.e_socktype != ANY) tmp.ai_socktype = ex.e_socktype;
+            if (tmp.ai_protocol == ANY && ex.e_protocol != ANY) tmp.ai_protocol = ex.e_protocol;
+
+            LOG(DEBUG) << __func__ << ": explore_numeric: ai_family=" << tmp.ai_family
+                       << " ai_socktype=" << tmp.ai_socktype << " ai_protocol=" << tmp.ai_protocol;
+            if (hostname == nullptr)
+                error = explore_null(&tmp, servname, &cur->ai_next);
+            else
+                error = explore_numeric_scope(&tmp, hostname, servname, &cur->ai_next);
+
+            if (error) break;
+
+            while (cur->ai_next) cur = cur->ai_next;
+        }
+        if (error) break;
+
+        /*
+         * XXX
+         * If numeric representation of AF1 can be interpreted as FQDN
+         * representation of AF2, we need to think again about the code below.
+         */
+        if (sentinel.ai_next) break;
+
+        if (hostname == nullptr) {
+            error = EAI_NODATA;
+            break;
+        }
+        if (ai.ai_flags & AI_NUMERICHOST) {
+            error = EAI_NONAME;
+            break;
+        }
+
+        /*
+         * hostname as alphabetical name.
+         * We would like to prefer AF_INET6 over AF_INET, so we'll make a outer loop by AFs.
+         */
+        for (const Explore& ex : explore_options) {
+            // Require exact match for family field
+            if (ai.ai_family != ex.e_af) continue;
+
+            if (!MATCH(ai.ai_socktype, ex.e_socktype, WILD_SOCKTYPE(ex))) {
+                continue;
+            }
+            if (!MATCH(ai.ai_protocol, ex.e_protocol, WILD_PROTOCOL(ex))) {
+                continue;
+            }
+
+            struct addrinfo tmp = ai;
+            if (tmp.ai_socktype == ANY && ex.e_socktype != ANY) tmp.ai_socktype = ex.e_socktype;
+            if (tmp.ai_protocol == ANY && ex.e_protocol != ANY) tmp.ai_protocol = ex.e_protocol;
+
+            LOG(DEBUG) << __func__ << ": explore_fqdn(): ai_family=" << tmp.ai_family
+                       << " ai_socktype=" << tmp.ai_socktype << " ai_protocol=" << tmp.ai_protocol;
+            error = explore_fqdn(&tmp, hostname, servname, &cur->ai_next, netcontext, event);
+
+            while (cur->ai_next) cur = cur->ai_next;
+        }
+
+        if (sentinel.ai_next) {
+            error = 0;
+        } else if (error == 0) {
+            error = EAI_FAIL;
+        }
+    } while (0);
+
+    if (error) {
+        freeaddrinfo(sentinel.ai_next);
+        *res = nullptr;
+    } else {
+        *res = sentinel.ai_next;
+    }
+    return error;
+}
+
+// FQDN hostname, DNS lookup
+static int explore_fqdn(const struct addrinfo* pai, const char* hostname, const char* servname,
+                        struct addrinfo** res, const struct android_net_context* netcontext,
+                        NetworkDnsEventReported* event) {
+    struct addrinfo* result;
+    int error = 0;
+
+    assert(pai != NULL);
+    /* hostname may be NULL */
+    /* servname may be NULL */
+    assert(res != NULL);
+
+    result = NULL;
+
+    // If the servname does not match socktype/protocol, ignore it.
+    if (get_portmatch(pai, servname) != 0) return 0;
+
+    if (!files_getaddrinfo(hostname, pai, &result)) {
+        error = dns_getaddrinfo(hostname, pai, netcontext, &result, event);
+    }
+    if (!error) {
+        struct addrinfo* cur;
+        for (cur = result; cur; cur = cur->ai_next) {
+            GET_PORT(cur, servname);
+            /* canonname should be filled already */
+        }
+        *res = result;
+        return 0;
+    }
+
+free:
+    freeaddrinfo(result);
+    return error;
+}
+
+/*
+ * hostname == NULL.
+ * passive socket -> anyaddr (0.0.0.0 or ::)
+ * non-passive socket -> localhost (127.0.0.1 or ::1)
+ */
+static int explore_null(const struct addrinfo* pai, const char* servname, struct addrinfo** res) {
+    int s;
+    const struct afd* afd;
+    struct addrinfo* cur;
+    struct addrinfo sentinel;
+    int error;
+
+    LOG(DEBUG) << __func__;
+
+    assert(pai != NULL);
+    /* servname may be NULL */
+    assert(res != NULL);
+
+    *res = NULL;
+    sentinel.ai_next = NULL;
+    cur = &sentinel;
+
+    /*
+     * filter out AFs that are not supported by the kernel
+     * XXX errno?
+     */
+    s = socket(pai->ai_family, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+    if (s < 0) {
+        if (errno != EMFILE) return 0;
+    } else
+        close(s);
+
+    /*
+     * if the servname does not match socktype/protocol, ignore it.
+     */
+    if (get_portmatch(pai, servname) != 0) return 0;
+
+    afd = find_afd(pai->ai_family);
+    if (afd == NULL) return 0;
+
+    if (pai->ai_flags & AI_PASSIVE) {
+        GET_AI(cur->ai_next, afd, afd->a_addrany);
+        GET_PORT(cur->ai_next, servname);
+    } else {
+        GET_AI(cur->ai_next, afd, afd->a_loopback);
+        GET_PORT(cur->ai_next, servname);
+    }
+    cur = cur->ai_next;
+
+    *res = sentinel.ai_next;
+    return 0;
+
+free:
+    freeaddrinfo(sentinel.ai_next);
+    return error;
+}
+
+/*
+ * numeric hostname
+ */
+static int explore_numeric(const struct addrinfo* pai, const char* hostname, const char* servname,
+                           struct addrinfo** res, const char* canonname) {
+    const struct afd* afd;
+    struct addrinfo* cur;
+    struct addrinfo sentinel;
+    int error;
+    char pton[PTON_MAX];
+
+    assert(pai != NULL);
+    /* hostname may be NULL */
+    /* servname may be NULL */
+    assert(res != NULL);
+
+    *res = NULL;
+    sentinel.ai_next = NULL;
+    cur = &sentinel;
+
+    /*
+     * if the servname does not match socktype/protocol, ignore it.
+     */
+    if (get_portmatch(pai, servname) != 0) return 0;
+
+    afd = find_afd(pai->ai_family);
+    if (afd == NULL) return 0;
+
+    if (inet_pton(afd->a_af, hostname, pton) == 1) {
+        if (pai->ai_family == afd->a_af || pai->ai_family == PF_UNSPEC /*?*/) {
+            GET_AI(cur->ai_next, afd, pton);
+            GET_PORT(cur->ai_next, servname);
+            if ((pai->ai_flags & AI_CANONNAME)) {
+                /*
+                 * Set the numeric address itself as
+                 * the canonical name, based on a
+                 * clarification in rfc2553bis-03.
+                 */
+                error = get_canonname(pai, cur->ai_next, canonname);
+                if (error != 0) {
+                    freeaddrinfo(sentinel.ai_next);
+                    return error;
+                }
+            }
+            while (cur->ai_next) cur = cur->ai_next;
+        } else
+            return EAI_FAMILY;
+    }
+
+    *res = sentinel.ai_next;
+    return 0;
+
+free:
+    freeaddrinfo(sentinel.ai_next);
+    return error;
+}
+
+/*
+ * numeric hostname with scope
+ */
+static int explore_numeric_scope(const struct addrinfo* pai, const char* hostname,
+                                 const char* servname, struct addrinfo** res) {
+    const struct afd* afd;
+    struct addrinfo* cur;
+    int error;
+    const char *cp, *scope, *addr;
+    struct sockaddr_in6* sin6;
+
+    LOG(DEBUG) << __func__;
+
+    assert(pai != NULL);
+    /* hostname may be NULL */
+    /* servname may be NULL */
+    assert(res != NULL);
+
+    /*
+     * if the servname does not match socktype/protocol, ignore it.
+     */
+    if (get_portmatch(pai, servname) != 0) return 0;
+
+    afd = find_afd(pai->ai_family);
+    if (afd == NULL) return 0;
+
+    if (!afd->a_scoped) return explore_numeric(pai, hostname, servname, res, hostname);
+
+    cp = strchr(hostname, SCOPE_DELIMITER);
+    if (cp == NULL) return explore_numeric(pai, hostname, servname, res, hostname);
+
+    /*
+     * Handle special case of <scoped_address><delimiter><scope id>
+     */
+    char* hostname2 = strdup(hostname);
+    if (hostname2 == NULL) return EAI_MEMORY;
+    /* terminate at the delimiter */
+    hostname2[cp - hostname] = '\0';
+    addr = hostname2;
+    scope = cp + 1;
+
+    error = explore_numeric(pai, addr, servname, res, hostname);
+    if (error == 0) {
+        u_int32_t scopeid;
+
+        for (cur = *res; cur; cur = cur->ai_next) {
+            if (cur->ai_family != AF_INET6) continue;
+            sin6 = (struct sockaddr_in6*) (void*) cur->ai_addr;
+            if (ip6_str2scopeid(scope, sin6, &scopeid) == -1) {
+                free(hostname2);
+                return (EAI_NODATA); /* XXX: is return OK? */
+            }
+            sin6->sin6_scope_id = scopeid;
+        }
+    }
+
+    free(hostname2);
+
+    return error;
+}
+
+static int get_canonname(const struct addrinfo* pai, struct addrinfo* ai, const char* str) {
+    assert(pai != NULL);
+    assert(ai != NULL);
+    assert(str != NULL);
+
+    if ((pai->ai_flags & AI_CANONNAME) != 0) {
+        ai->ai_canonname = strdup(str);
+        if (ai->ai_canonname == NULL) return EAI_MEMORY;
+    }
+    return 0;
+}
+
+static struct addrinfo* get_ai(const struct addrinfo* pai, const struct afd* afd,
+                               const char* addr) {
+    char* p;
+    struct addrinfo* ai;
+
+    assert(pai != NULL);
+    assert(afd != NULL);
+    assert(addr != NULL);
+
+    ai = (struct addrinfo*) malloc(sizeof(struct addrinfo) + sizeof(sockaddr_union));
+    if (ai == NULL) return NULL;
+
+    memcpy(ai, pai, sizeof(struct addrinfo));
+    ai->ai_addr = (struct sockaddr*) (void*) (ai + 1);
+    memset(ai->ai_addr, 0, sizeof(sockaddr_union));
+
+    ai->ai_addrlen = afd->a_socklen;
+    ai->ai_addr->sa_family = ai->ai_family = afd->a_af;
+    p = (char*) (void*) (ai->ai_addr);
+    memcpy(p + afd->a_off, addr, (size_t) afd->a_addrlen);
+    return ai;
+}
+
+static int get_portmatch(const struct addrinfo* ai, const char* servname) {
+    assert(ai != NULL);
+    /* servname may be NULL */
+
+    return get_port(ai, servname, 1);
+}
+
+static int get_port(const struct addrinfo* ai, const char* servname, int matchonly) {
+    const char* proto;
+    struct servent* sp;
+    int port;
+    int allownumeric;
+
+    assert(ai != NULL);
+    /* servname may be NULL */
+
+    if (servname == NULL) return 0;
+    switch (ai->ai_family) {
+        case AF_INET:
+        case AF_INET6:
+            break;
+        default:
+            return 0;
+    }
+
+    switch (ai->ai_socktype) {
+        case SOCK_RAW:
+            return EAI_SERVICE;
+        case SOCK_DGRAM:
+        case SOCK_STREAM:
+            allownumeric = 1;
+            break;
+        case ANY:
+            allownumeric = 1;
+            break;
+        default:
+            return EAI_SOCKTYPE;
+    }
+
+    port = str2number(servname);
+    if (port >= 0) {
+        if (!allownumeric) return EAI_SERVICE;
+        if (port < 0 || port > 65535) return EAI_SERVICE;
+        port = htons(port);
+    } else {
+        if (ai->ai_flags & AI_NUMERICSERV) return EAI_NONAME;
+
+        switch (ai->ai_socktype) {
+            case SOCK_DGRAM:
+                proto = "udp";
+                break;
+            case SOCK_STREAM:
+                proto = "tcp";
+                break;
+            default:
+                proto = NULL;
+                break;
+        }
+
+        if ((sp = getservbyname(servname, proto)) == NULL) return EAI_SERVICE;
+        port = sp->s_port;
+    }
+
+    if (!matchonly) {
+        switch (ai->ai_family) {
+            case AF_INET:
+                ((struct sockaddr_in*) (void*) ai->ai_addr)->sin_port = port;
+                break;
+            case AF_INET6:
+                ((struct sockaddr_in6*) (void*) ai->ai_addr)->sin6_port = port;
+                break;
+        }
+    }
+
+    return 0;
+}
+
+static const struct afd* find_afd(int af) {
+    const struct afd* afd;
+
+    if (af == PF_UNSPEC) return NULL;
+    for (afd = afdl; afd->a_af; afd++) {
+        if (afd->a_af == af) return afd;
+    }
+    return NULL;
+}
+
+// Convert a string to a scope identifier.
+static int ip6_str2scopeid(const char* scope, struct sockaddr_in6* sin6, u_int32_t* scopeid) {
+    u_long lscopeid;
+    struct in6_addr* a6;
+    char* ep;
+
+    assert(scope != NULL);
+    assert(sin6 != NULL);
+    assert(scopeid != NULL);
+
+    a6 = &sin6->sin6_addr;
+
+    /* empty scopeid portion is invalid */
+    if (*scope == '\0') return -1;
+
+    if (IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6)) {
+        /*
+         * We currently assume a one-to-one mapping between links
+         * and interfaces, so we simply use interface indices for
+         * like-local scopes.
+         */
+        *scopeid = if_nametoindex(scope);
+        if (*scopeid == 0) goto trynumeric;
+        return 0;
+    }
+
+    /* still unclear about literal, allow numeric only - placeholder */
+    if (IN6_IS_ADDR_SITELOCAL(a6) || IN6_IS_ADDR_MC_SITELOCAL(a6)) goto trynumeric;
+    if (IN6_IS_ADDR_MC_ORGLOCAL(a6))
+        goto trynumeric;
+    else
+        goto trynumeric; /* global */
+
+    /* try to convert to a numeric id as a last resort */
+trynumeric:
+    errno = 0;
+    lscopeid = strtoul(scope, &ep, 10);
+    *scopeid = (u_int32_t)(lscopeid & 0xffffffffUL);
+    if (errno == 0 && ep && *ep == '\0' && *scopeid == lscopeid)
+        return 0;
+    else
+        return -1;
+}
+
+/* code duplicate with gethnamaddr.c */
+
+#define BOUNDED_INCR(x)      \
+    do {                     \
+        BOUNDS_CHECK(cp, x); \
+        cp += (x);           \
+    } while (0)
+
+#define BOUNDS_CHECK(ptr, count)     \
+    do {                             \
+        if (eom - (ptr) < (count)) { \
+            *herrno = NO_RECOVERY;   \
+            return NULL;             \
+        }                            \
+    } while (0)
+
+static struct addrinfo* getanswer(const querybuf* answer, int anslen, const char* qname, int qtype,
+                                  const struct addrinfo* pai, int* herrno) {
+    struct addrinfo sentinel = {};
+    struct addrinfo *cur;
+    struct addrinfo ai;
+    const struct afd* afd;
+    char* canonname;
+    const HEADER* hp;
+    const u_char* cp;
+    int n;
+    const u_char* eom;
+    char *bp, *ep;
+    int type, ancount, qdcount;
+    int haveanswer, had_error;
+    char tbuf[MAXDNAME];
+    int (*name_ok)(const char*);
+    char hostbuf[8 * 1024];
+
+    assert(answer != NULL);
+    assert(qname != NULL);
+    assert(pai != NULL);
+
+    cur = &sentinel;
+
+    canonname = NULL;
+    eom = answer->buf + anslen;
+    switch (qtype) {
+        case T_A:
+        case T_AAAA:
+        case T_ANY: /*use T_ANY only for T_A/T_AAAA lookup*/
+            name_ok = res_hnok;
+            break;
+        default:
+            return NULL; /* XXX should be abort(); */
+    }
+    /*
+     * find first satisfactory answer
+     */
+    hp = &answer->hdr;
+    ancount = ntohs(hp->ancount);
+    qdcount = ntohs(hp->qdcount);
+    bp = hostbuf;
+    ep = hostbuf + sizeof hostbuf;
+    cp = answer->buf;
+    BOUNDED_INCR(HFIXEDSZ);
+    if (qdcount != 1) {
+        *herrno = NO_RECOVERY;
+        return (NULL);
+    }
+    n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+    if ((n < 0) || !(*name_ok)(bp)) {
+        *herrno = NO_RECOVERY;
+        return (NULL);
+    }
+    BOUNDED_INCR(n + QFIXEDSZ);
+    if (qtype == T_A || qtype == T_AAAA || qtype == T_ANY) {
+        /* res_send() has already verified that the query name is the
+         * same as the one we sent; this just gets the expanded name
+         * (i.e., with the succeeding search-domain tacked on).
+         */
+        n = strlen(bp) + 1; /* for the \0 */
+        if (n >= MAXHOSTNAMELEN) {
+            *herrno = NO_RECOVERY;
+            return (NULL);
+        }
+        canonname = bp;
+        bp += n;
+        /* The qname can be abbreviated, but h_name is now absolute. */
+        qname = canonname;
+    }
+    haveanswer = 0;
+    had_error = 0;
+    while (ancount-- > 0 && cp < eom && !had_error) {
+        n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+        if ((n < 0) || !(*name_ok)(bp)) {
+            had_error++;
+            continue;
+        }
+        cp += n; /* name */
+        BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ);
+        type = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ; /* type */
+        int cl = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ + INT32SZ; /* class, TTL */
+        n = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ; /* len */
+        BOUNDS_CHECK(cp, n);
+        if (cl != C_IN) {
+            /* XXX - debug? syslog? */
+            cp += n;
+            continue; /* XXX - had_error++ ? */
+        }
+        if ((qtype == T_A || qtype == T_AAAA || qtype == T_ANY) && type == T_CNAME) {
+            n = dn_expand(answer->buf, eom, cp, tbuf, sizeof tbuf);
+            if ((n < 0) || !(*name_ok)(tbuf)) {
+                had_error++;
+                continue;
+            }
+            cp += n;
+            /* Get canonical name. */
+            n = strlen(tbuf) + 1; /* for the \0 */
+            if (n > ep - bp || n >= MAXHOSTNAMELEN) {
+                had_error++;
+                continue;
+            }
+            strlcpy(bp, tbuf, (size_t)(ep - bp));
+            canonname = bp;
+            bp += n;
+            continue;
+        }
+        if (qtype == T_ANY) {
+            if (!(type == T_A || type == T_AAAA)) {
+                cp += n;
+                continue;
+            }
+        } else if (type != qtype) {
+            if (type != T_KEY && type != T_SIG)
+                LOG(DEBUG) << __func__ << ": asked for \"" << qname << " " << p_class(C_IN) << " "
+                           << p_type(qtype) << "\", got type \"" << p_type(type) << "\"";
+            cp += n;
+            continue; /* XXX - had_error++ ? */
+        }
+        switch (type) {
+            case T_A:
+            case T_AAAA:
+                if (strcasecmp(canonname, bp) != 0) {
+                    LOG(DEBUG) << __func__ << ": asked for \"" << canonname << "\", got \"" << bp
+                               << "\"";
+                    cp += n;
+                    continue; /* XXX - had_error++ ? */
+                }
+                if (type == T_A && n != INADDRSZ) {
+                    cp += n;
+                    continue;
+                }
+                if (type == T_AAAA && n != IN6ADDRSZ) {
+                    cp += n;
+                    continue;
+                }
+                if (type == T_AAAA) {
+                    struct in6_addr in6;
+                    memcpy(&in6, cp, IN6ADDRSZ);
+                    if (IN6_IS_ADDR_V4MAPPED(&in6)) {
+                        cp += n;
+                        continue;
+                    }
+                }
+                if (!haveanswer) {
+                    int nn;
+
+                    canonname = bp;
+                    nn = strlen(bp) + 1; /* for the \0 */
+                    bp += nn;
+                }
+
+                /* don't overwrite pai */
+                ai = *pai;
+                ai.ai_family = (type == T_A) ? AF_INET : AF_INET6;
+                afd = find_afd(ai.ai_family);
+                if (afd == NULL) {
+                    cp += n;
+                    continue;
+                }
+                cur->ai_next = get_ai(&ai, afd, (const char*) cp);
+                if (cur->ai_next == NULL) had_error++;
+                while (cur && cur->ai_next) cur = cur->ai_next;
+                cp += n;
+                break;
+            default:
+                abort();
+        }
+        if (!had_error) haveanswer++;
+    }
+    if (haveanswer) {
+        if (!canonname)
+            (void) get_canonname(pai, sentinel.ai_next, qname);
+        else
+            (void) get_canonname(pai, sentinel.ai_next, canonname);
+        *herrno = NETDB_SUCCESS;
+        return sentinel.ai_next;
+    }
+
+    *herrno = NO_RECOVERY;
+    return NULL;
+}
+
+struct addrinfo_sort_elem {
+    struct addrinfo* ai;
+    int has_src_addr;
+    sockaddr_union src_addr;
+    int original_order;
+};
+
+static int _get_scope(const struct sockaddr* addr) {
+    if (addr->sa_family == AF_INET6) {
+        const struct sockaddr_in6* addr6 = (const struct sockaddr_in6*) addr;
+        if (IN6_IS_ADDR_MULTICAST(&addr6->sin6_addr)) {
+            return IPV6_ADDR_MC_SCOPE(&addr6->sin6_addr);
+        } else if (IN6_IS_ADDR_LOOPBACK(&addr6->sin6_addr) ||
+                   IN6_IS_ADDR_LINKLOCAL(&addr6->sin6_addr)) {
+            /*
+             * RFC 4291 section 2.5.3 says loopback is to be treated as having
+             * link-local scope.
+             */
+            return IPV6_ADDR_SCOPE_LINKLOCAL;
+        } else if (IN6_IS_ADDR_SITELOCAL(&addr6->sin6_addr)) {
+            return IPV6_ADDR_SCOPE_SITELOCAL;
+        } else {
+            return IPV6_ADDR_SCOPE_GLOBAL;
+        }
+    } else if (addr->sa_family == AF_INET) {
+        const struct sockaddr_in* addr4 = (const struct sockaddr_in*) addr;
+        unsigned long int na = ntohl(addr4->sin_addr.s_addr);
+
+        if (IN_LOOPBACK(na) ||                 /* 127.0.0.0/8 */
+            (na & 0xffff0000) == 0xa9fe0000) { /* 169.254.0.0/16 */
+            return IPV6_ADDR_SCOPE_LINKLOCAL;
+        } else {
+            /*
+             * RFC 6724 section 3.2. Other IPv4 addresses, including private addresses
+             * and shared addresses (100.64.0.0/10), are assigned global scope.
+             */
+            return IPV6_ADDR_SCOPE_GLOBAL;
+        }
+    } else {
+        /*
+         * This should never happen.
+         * Return a scope with low priority as a last resort.
+         */
+        return IPV6_ADDR_SCOPE_NODELOCAL;
+    }
+}
+
+/* These macros are modelled after the ones in <netinet/in6.h>. */
+
+/* RFC 4380, section 2.6 */
+#define IN6_IS_ADDR_TEREDO(a) \
+    ((*(const uint32_t*) (const void*) (&(a)->s6_addr[0]) == ntohl(0x20010000)))
+
+/* RFC 3056, section 2. */
+#define IN6_IS_ADDR_6TO4(a) (((a)->s6_addr[0] == 0x20) && ((a)->s6_addr[1] == 0x02))
+
+/* 6bone testing address area (3ffe::/16), deprecated in RFC 3701. */
+#define IN6_IS_ADDR_6BONE(a) (((a)->s6_addr[0] == 0x3f) && ((a)->s6_addr[1] == 0xfe))
+
+/*
+ * Get the label for a given IPv4/IPv6 address.
+ * RFC 6724, section 2.1.
+ */
+
+static int _get_label(const struct sockaddr* addr) {
+    if (addr->sa_family == AF_INET) {
+        return 4;
+    } else if (addr->sa_family == AF_INET6) {
+        const struct sockaddr_in6* addr6 = (const struct sockaddr_in6*) addr;
+        if (IN6_IS_ADDR_LOOPBACK(&addr6->sin6_addr)) {
+            return 0;
+        } else if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) {
+            return 4;
+        } else if (IN6_IS_ADDR_6TO4(&addr6->sin6_addr)) {
+            return 2;
+        } else if (IN6_IS_ADDR_TEREDO(&addr6->sin6_addr)) {
+            return 5;
+        } else if (IN6_IS_ADDR_ULA(&addr6->sin6_addr)) {
+            return 13;
+        } else if (IN6_IS_ADDR_V4COMPAT(&addr6->sin6_addr)) {
+            return 3;
+        } else if (IN6_IS_ADDR_SITELOCAL(&addr6->sin6_addr)) {
+            return 11;
+        } else if (IN6_IS_ADDR_6BONE(&addr6->sin6_addr)) {
+            return 12;
+        } else {
+            /* All other IPv6 addresses, including global unicast addresses. */
+            return 1;
+        }
+    } else {
+        /*
+         * This should never happen.
+         * Return a semi-random label as a last resort.
+         */
+        return 1;
+    }
+}
+
+/*
+ * Get the precedence for a given IPv4/IPv6 address.
+ * RFC 6724, section 2.1.
+ */
+
+static int _get_precedence(const struct sockaddr* addr) {
+    if (addr->sa_family == AF_INET) {
+        return 35;
+    } else if (addr->sa_family == AF_INET6) {
+        const struct sockaddr_in6* addr6 = (const struct sockaddr_in6*) addr;
+        if (IN6_IS_ADDR_LOOPBACK(&addr6->sin6_addr)) {
+            return 50;
+        } else if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) {
+            return 35;
+        } else if (IN6_IS_ADDR_6TO4(&addr6->sin6_addr)) {
+            return 30;
+        } else if (IN6_IS_ADDR_TEREDO(&addr6->sin6_addr)) {
+            return 5;
+        } else if (IN6_IS_ADDR_ULA(&addr6->sin6_addr)) {
+            return 3;
+        } else if (IN6_IS_ADDR_V4COMPAT(&addr6->sin6_addr) ||
+                   IN6_IS_ADDR_SITELOCAL(&addr6->sin6_addr) ||
+                   IN6_IS_ADDR_6BONE(&addr6->sin6_addr)) {
+            return 1;
+        } else {
+            /* All other IPv6 addresses, including global unicast addresses. */
+            return 40;
+        }
+    } else {
+        return 1;
+    }
+}
+
+/*
+ * Find number of matching initial bits between the two addresses a1 and a2.
+ */
+
+static int _common_prefix_len(const struct in6_addr* a1, const struct in6_addr* a2) {
+    const char* p1 = (const char*) a1;
+    const char* p2 = (const char*) a2;
+    unsigned i;
+
+    for (i = 0; i < sizeof(*a1); ++i) {
+        int x, j;
+
+        if (p1[i] == p2[i]) {
+            continue;
+        }
+        x = p1[i] ^ p2[i];
+        for (j = 0; j < CHAR_BIT; ++j) {
+            if (x & (1 << (CHAR_BIT - 1))) {
+                return i * CHAR_BIT + j;
+            }
+            x <<= 1;
+        }
+    }
+    return sizeof(*a1) * CHAR_BIT;
+}
+
+/*
+ * Compare two source/destination address pairs.
+ * RFC 6724, section 6.
+ */
+
+static int _rfc6724_compare(const void* ptr1, const void* ptr2) {
+    const struct addrinfo_sort_elem* a1 = (const struct addrinfo_sort_elem*) ptr1;
+    const struct addrinfo_sort_elem* a2 = (const struct addrinfo_sort_elem*) ptr2;
+    int scope_src1, scope_dst1, scope_match1;
+    int scope_src2, scope_dst2, scope_match2;
+    int label_src1, label_dst1, label_match1;
+    int label_src2, label_dst2, label_match2;
+    int precedence1, precedence2;
+    int prefixlen1, prefixlen2;
+
+    /* Rule 1: Avoid unusable destinations. */
+    if (a1->has_src_addr != a2->has_src_addr) {
+        return a2->has_src_addr - a1->has_src_addr;
+    }
+
+    /* Rule 2: Prefer matching scope. */
+    scope_src1 = _get_scope(&a1->src_addr.sa);
+    scope_dst1 = _get_scope(a1->ai->ai_addr);
+    scope_match1 = (scope_src1 == scope_dst1);
+
+    scope_src2 = _get_scope(&a2->src_addr.sa);
+    scope_dst2 = _get_scope(a2->ai->ai_addr);
+    scope_match2 = (scope_src2 == scope_dst2);
+
+    if (scope_match1 != scope_match2) {
+        return scope_match2 - scope_match1;
+    }
+
+    /*
+     * Rule 3: Avoid deprecated addresses.
+     * TODO(sesse): We don't currently have a good way of finding this.
+     */
+
+    /*
+     * Rule 4: Prefer home addresses.
+     * TODO(sesse): We don't currently have a good way of finding this.
+     */
+
+    /* Rule 5: Prefer matching label. */
+    label_src1 = _get_label(&a1->src_addr.sa);
+    label_dst1 = _get_label(a1->ai->ai_addr);
+    label_match1 = (label_src1 == label_dst1);
+
+    label_src2 = _get_label(&a2->src_addr.sa);
+    label_dst2 = _get_label(a2->ai->ai_addr);
+    label_match2 = (label_src2 == label_dst2);
+
+    if (label_match1 != label_match2) {
+        return label_match2 - label_match1;
+    }
+
+    /* Rule 6: Prefer higher precedence. */
+    precedence1 = _get_precedence(a1->ai->ai_addr);
+    precedence2 = _get_precedence(a2->ai->ai_addr);
+    if (precedence1 != precedence2) {
+        return precedence2 - precedence1;
+    }
+
+    /*
+     * Rule 7: Prefer native transport.
+     * TODO(sesse): We don't currently have a good way of finding this.
+     */
+
+    /* Rule 8: Prefer smaller scope. */
+    if (scope_dst1 != scope_dst2) {
+        return scope_dst1 - scope_dst2;
+    }
+
+    /*
+     * Rule 9: Use longest matching prefix.
+     * We implement this for IPv6 only, as the rules in RFC 6724 don't seem
+     * to work very well directly applied to IPv4. (glibc uses information from
+     * the routing table for a custom IPv4 implementation here.)
+     */
+    if (a1->has_src_addr && a1->ai->ai_addr->sa_family == AF_INET6 && a2->has_src_addr &&
+        a2->ai->ai_addr->sa_family == AF_INET6) {
+        const struct sockaddr_in6* a1_src = &a1->src_addr.sin6;
+        const struct sockaddr_in6* a1_dst = (const struct sockaddr_in6*) a1->ai->ai_addr;
+        const struct sockaddr_in6* a2_src = &a2->src_addr.sin6;
+        const struct sockaddr_in6* a2_dst = (const struct sockaddr_in6*) a2->ai->ai_addr;
+        prefixlen1 = _common_prefix_len(&a1_src->sin6_addr, &a1_dst->sin6_addr);
+        prefixlen2 = _common_prefix_len(&a2_src->sin6_addr, &a2_dst->sin6_addr);
+        if (prefixlen1 != prefixlen2) {
+            return prefixlen2 - prefixlen1;
+        }
+    }
+
+    /*
+     * Rule 10: Leave the order unchanged.
+     * We need this since qsort() is not necessarily stable.
+     */
+    return a1->original_order - a2->original_order;
+}
+
+/*
+ * Find the source address that will be used if trying to connect to the given
+ * address. src_addr must be large enough to hold a struct sockaddr_in6.
+ *
+ * Returns 1 if a source address was found, 0 if the address is unreachable,
+ * and -1 if a fatal error occurred. If 0 or -1, the contents of src_addr are
+ * undefined.
+ */
+
+static int _find_src_addr(const struct sockaddr* addr, struct sockaddr* src_addr, unsigned mark,
+                          uid_t uid) {
+    int sock;
+    int ret;
+    socklen_t len;
+
+    switch (addr->sa_family) {
+        case AF_INET:
+            len = sizeof(struct sockaddr_in);
+            break;
+        case AF_INET6:
+            len = sizeof(struct sockaddr_in6);
+            break;
+        default:
+            /* No known usable source address for non-INET families. */
+            return 0;
+    }
+
+    sock = socket(addr->sa_family, SOCK_DGRAM | SOCK_CLOEXEC, IPPROTO_UDP);
+    if (sock == -1) {
+        if (errno == EAFNOSUPPORT) {
+            return 0;
+        } else {
+            return -1;
+        }
+    }
+    if (mark != MARK_UNSET && setsockopt(sock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) {
+        close(sock);
+        return 0;
+    }
+    if (uid > 0 && uid != NET_CONTEXT_INVALID_UID && fchown(sock, uid, (gid_t) -1) < 0) {
+        close(sock);
+        return 0;
+    }
+    do {
+        ret = connect(sock, addr, len);
+    } while (ret == -1 && errno == EINTR);
+
+    if (ret == -1) {
+        close(sock);
+        return 0;
+    }
+
+    if (src_addr && getsockname(sock, src_addr, &len) == -1) {
+        close(sock);
+        return -1;
+    }
+    close(sock);
+    return 1;
+}
+
+/*
+ * Sort the linked list starting at sentinel->ai_next in RFC6724 order.
+ * Will leave the list unchanged if an error occurs.
+ */
+
+static void _rfc6724_sort(struct addrinfo* list_sentinel, unsigned mark, uid_t uid) {
+    struct addrinfo* cur;
+    int nelem = 0, i;
+    struct addrinfo_sort_elem* elems;
+
+    cur = list_sentinel->ai_next;
+    while (cur) {
+        ++nelem;
+        cur = cur->ai_next;
+    }
+
+    elems = (struct addrinfo_sort_elem*) malloc(nelem * sizeof(struct addrinfo_sort_elem));
+    if (elems == NULL) {
+        goto error;
+    }
+
+    /*
+     * Convert the linked list to an array that also contains the candidate
+     * source address for each destination address.
+     */
+    for (i = 0, cur = list_sentinel->ai_next; i < nelem; ++i, cur = cur->ai_next) {
+        int has_src_addr;
+        assert(cur != NULL);
+        elems[i].ai = cur;
+        elems[i].original_order = i;
+
+        has_src_addr = _find_src_addr(cur->ai_addr, &elems[i].src_addr.sa, mark, uid);
+        if (has_src_addr == -1) {
+            goto error;
+        }
+        elems[i].has_src_addr = has_src_addr;
+    }
+
+    /* Sort the addresses, and rearrange the linked list so it matches the sorted order. */
+    qsort((void*) elems, nelem, sizeof(struct addrinfo_sort_elem), _rfc6724_compare);
+
+    list_sentinel->ai_next = elems[0].ai;
+    for (i = 0; i < nelem - 1; ++i) {
+        elems[i].ai->ai_next = elems[i + 1].ai;
+    }
+    elems[nelem - 1].ai->ai_next = NULL;
+
+error:
+    free(elems);
+}
+
+static int dns_getaddrinfo(const char* name, const addrinfo* pai,
+                           const android_net_context* netcontext, addrinfo** rv,
+                           NetworkDnsEventReported* event) {
+    res_target q = {};
+    res_target q2 = {};
+
+    auto buf = std::make_unique<querybuf>();
+    auto buf2 = std::make_unique<querybuf>();
+
+    switch (pai->ai_family) {
+        case AF_UNSPEC: {
+            /* prefer IPv6 */
+            q.name = name;
+            q.qclass = C_IN;
+            q.answer = buf->buf;
+            q.anslen = sizeof(buf->buf);
+            int query_ipv6 = 1, query_ipv4 = 1;
+            if (pai->ai_flags & AI_ADDRCONFIG) {
+                query_ipv6 = have_ipv6(netcontext->app_mark, netcontext->uid);
+                query_ipv4 = have_ipv4(netcontext->app_mark, netcontext->uid);
+            }
+            if (query_ipv6) {
+                q.qtype = T_AAAA;
+                if (query_ipv4) {
+                    q.next = &q2;
+                    q2.name = name;
+                    q2.qclass = C_IN;
+                    q2.qtype = T_A;
+                    q2.answer = buf2->buf;
+                    q2.anslen = sizeof(buf2->buf);
+                }
+            } else if (query_ipv4) {
+                q.qtype = T_A;
+            } else {
+                return EAI_NODATA;
+            }
+            break;
+        }
+        case AF_INET:
+            q.name = name;
+            q.qclass = C_IN;
+            q.qtype = T_A;
+            q.answer = buf->buf;
+            q.anslen = sizeof(buf->buf);
+            break;
+        case AF_INET6:
+            q.name = name;
+            q.qclass = C_IN;
+            q.qtype = T_AAAA;
+            q.answer = buf->buf;
+            q.anslen = sizeof(buf->buf);
+            break;
+        default:
+            return EAI_FAMILY;
+    }
+
+    res_state res = res_get_state();
+    if (!res) return EAI_MEMORY;
+
+    /* this just sets our netid val in the thread private data so we don't have to
+     * modify the api's all the way down to res_send.c's res_nsend.  We could
+     * fully populate the thread private data here, but if we get down there
+     * and have a cache hit that would be wasted, so we do the rest there on miss
+     */
+    res_setnetcontext(res, netcontext, event);
+
+    int he;
+    if (res_searchN(name, &q, res, &he) < 0) {
+        // Return h_errno (he) to catch more detailed errors rather than EAI_NODATA.
+        // Note that res_searchN() doesn't set the pair NETDB_INTERNAL and errno.
+        // See also herrnoToAiErrno().
+        return herrnoToAiErrno(he);
+    }
+
+    addrinfo sentinel = {};
+    addrinfo* cur = &sentinel;
+    addrinfo* ai = getanswer(buf.get(), q.n, q.name, q.qtype, pai, &he);
+    if (ai) {
+        cur->ai_next = ai;
+        while (cur && cur->ai_next) cur = cur->ai_next;
+    }
+    if (q.next) {
+        ai = getanswer(buf2.get(), q2.n, q2.name, q2.qtype, pai, &he);
+        if (ai) cur->ai_next = ai;
+    }
+    if (sentinel.ai_next == NULL) {
+        // Note that getanswer() doesn't set the pair NETDB_INTERNAL and errno.
+        // See also herrnoToAiErrno().
+        return herrnoToAiErrno(he);
+    }
+
+    _rfc6724_sort(&sentinel, netcontext->app_mark, netcontext->uid);
+
+    *rv = sentinel.ai_next;
+    return 0;
+}
+
+static void _sethtent(FILE** hostf) {
+    if (!*hostf)
+        *hostf = fopen(_PATH_HOSTS, "re");
+    else
+        rewind(*hostf);
+}
+
+static void _endhtent(FILE** hostf) {
+    if (*hostf) {
+        (void) fclose(*hostf);
+        *hostf = NULL;
+    }
+}
+
+static struct addrinfo* _gethtent(FILE** hostf, const char* name, const struct addrinfo* pai) {
+    char* p;
+    char *cp, *tname, *cname;
+    struct addrinfo *res0, *res;
+    int error;
+    const char* addr;
+    char hostbuf[8 * 1024];
+
+    assert(name != NULL);
+    assert(pai != NULL);
+
+    if (!*hostf && !(*hostf = fopen(_PATH_HOSTS, "re"))) return (NULL);
+again:
+    if (!(p = fgets(hostbuf, sizeof hostbuf, *hostf))) return (NULL);
+    if (*p == '#') goto again;
+    if (!(cp = strpbrk(p, "#\n"))) goto again;
+    *cp = '\0';
+    if (!(cp = strpbrk(p, " \t"))) goto again;
+    *cp++ = '\0';
+    addr = p;
+    /* if this is not something we're looking for, skip it. */
+    cname = NULL;
+    while (cp && *cp) {
+        if (*cp == ' ' || *cp == '\t') {
+            cp++;
+            continue;
+        }
+        if (!cname) cname = cp;
+        tname = cp;
+        if ((cp = strpbrk(cp, " \t")) != NULL) *cp++ = '\0';
+        if (strcasecmp(name, tname) == 0) goto found;
+    }
+    goto again;
+
+found:
+    error = getaddrinfo_numeric(addr, nullptr, *pai, &res0);
+    if (error) goto again;
+    for (res = res0; res; res = res->ai_next) {
+        /* cover it up */
+        res->ai_flags = pai->ai_flags;
+
+        if (pai->ai_flags & AI_CANONNAME) {
+            if (get_canonname(pai, res, cname) != 0) {
+                freeaddrinfo(res0);
+                goto again;
+            }
+        }
+    }
+    return res0;
+}
+
+static bool files_getaddrinfo(const char* name, const addrinfo* pai, addrinfo** res) {
+    struct addrinfo sentinel = {};
+    struct addrinfo *p, *cur;
+    FILE* hostf = NULL;
+
+    cur = &sentinel;
+
+    _sethtent(&hostf);
+    while ((p = _gethtent(&hostf, name, pai)) != NULL) {
+        cur->ai_next = p;
+        while (cur && cur->ai_next) cur = cur->ai_next;
+    }
+    _endhtent(&hostf);
+
+    *res = sentinel.ai_next;
+    return sentinel.ai_next != NULL;
+}
+
+/* resolver logic */
+
+/*
+ * Formulate a normal query, send, and await answer.
+ * Returned answer is placed in supplied buffer "answer".
+ * Perform preliminary check of answer, returning success only
+ * if no error is indicated and the answer count is nonzero.
+ * Return the size of the response on success, -1 on error.
+ * Error number is left in *herrno.
+ *
+ * Caller must parse answer and determine whether it answers the question.
+ */
+static int res_queryN(const char* name, res_target* target, res_state res, int* herrno) {
+    u_char buf[MAXPACKET];
+    HEADER* hp;
+    int n;
+    struct res_target* t;
+    int rcode;
+    int ancount;
+
+    assert(name != NULL);
+    /* XXX: target may be NULL??? */
+
+    rcode = NOERROR;
+    ancount = 0;
+
+    for (t = target; t; t = t->next) {
+        u_char* answer;
+        int anslen;
+
+        hp = (HEADER*) (void*) t->answer;
+        bool retried = false;
+    again:
+        hp->rcode = NOERROR; /* default */
+
+        /* make it easier... */
+        int cl = t->qclass;
+        int type = t->qtype;
+        answer = t->answer;
+        anslen = t->anslen;
+
+        LOG(DEBUG) << __func__ << ": (" << cl << ", " << type << ")";
+
+        n = res_nmkquery(res, QUERY, name, cl, type, NULL, 0, NULL, buf, sizeof(buf));
+        if (n > 0 && (res->options & (RES_USE_EDNS0 | RES_USE_DNSSEC)) != 0 && !retried)
+            n = res_nopt(res, n, buf, sizeof(buf), anslen);
+        if (n <= 0) {
+            LOG(ERROR) << __func__ << ": res_nmkquery failed";
+            *herrno = NO_RECOVERY;
+            return n;
+        }
+
+        n = res_nsend(res, buf, n, answer, anslen, &rcode, 0);
+        if (n < 0 || hp->rcode != NOERROR || ntohs(hp->ancount) == 0) {
+            // Record rcode from DNS response header only if no timeout.
+            // Keep rcode timeout for reporting later if any.
+            if (rcode != RCODE_TIMEOUT) rcode = hp->rcode; /* record most recent error */
+            /* if the query choked with EDNS0, retry without EDNS0 */
+            if ((res->options & (RES_USE_EDNS0 | RES_USE_DNSSEC)) != 0 &&
+                (res->_flags & RES_F_EDNS0ERR) && !retried) {
+                LOG(DEBUG) << __func__ << ": retry without EDNS0";
+                retried = true;
+                goto again;
+            }
+            LOG(DEBUG) << __func__ << ": rcode=" << hp->rcode << ", ancount=" << ntohs(hp->ancount);
+            continue;
+        }
+
+        ancount += ntohs(hp->ancount);
+
+        t->n = n;
+    }
+
+    if (ancount == 0) {
+        switch (rcode) {
+            // Not defined in RFC.
+            case RCODE_TIMEOUT:
+                // DNS metrics monitors DNS query timeout.
+                *herrno = NETD_RESOLV_H_ERRNO_EXT_TIMEOUT;  // extended h_errno.
+                break;
+            // Defined in RFC 1035 section 4.1.1.
+            case NXDOMAIN:
+                *herrno = HOST_NOT_FOUND;
+                break;
+            case SERVFAIL:
+                *herrno = TRY_AGAIN;
+                break;
+            case NOERROR:
+                *herrno = NO_DATA;
+                break;
+            case FORMERR:
+            case NOTIMP:
+            case REFUSED:
+            default:
+                *herrno = NO_RECOVERY;
+                break;
+        }
+        return -1;
+    }
+    return ancount;
+}
+
+/*
+ * Formulate a normal query, send, and retrieve answer in supplied buffer.
+ * Return the size of the response on success, -1 on error.
+ * If enabled, implement search rules until answer or unrecoverable failure
+ * is detected.  Error code, if any, is left in *herrno.
+ */
+static int res_searchN(const char* name, res_target* target, res_state res, int* herrno) {
+    const char *cp, *const *domain;
+    HEADER* hp;
+    u_int dots;
+    int trailing_dot, ret, saved_herrno;
+    int got_nodata = 0, got_servfail = 0, tried_as_is = 0;
+
+    assert(name != NULL);
+    assert(target != NULL);
+
+    hp = (HEADER*) (void*) target->answer; /*XXX*/
+
+    errno = 0;
+    *herrno = HOST_NOT_FOUND; /* default, if we never query */
+    dots = 0;
+    for (cp = name; *cp; cp++) dots += (*cp == '.');
+    trailing_dot = 0;
+    if (cp > name && *--cp == '.') trailing_dot++;
+
+    /*
+     * If there are dots in the name already, let's just give it a try
+     * 'as is'.  The threshold can be set with the "ndots" option.
+     */
+    saved_herrno = -1;
+    if (dots >= res->ndots) {
+        ret = res_querydomainN(name, NULL, target, res, herrno);
+        if (ret > 0) return (ret);
+        saved_herrno = *herrno;
+        tried_as_is++;
+    }
+
+    /*
+     * We do at least one level of search if
+     *	- there is no dot and RES_DEFNAME is set, or
+     *	- there is at least one dot, there is no trailing dot,
+     *	  and RES_DNSRCH is set.
+     */
+    if ((!dots && (res->options & RES_DEFNAMES)) ||
+        (dots && !trailing_dot && (res->options & RES_DNSRCH))) {
+        int done = 0;
+
+        /* Unfortunately we need to set stuff up before
+         * the domain stuff is tried.  Will have a better
+         * fix after thread pools are used.
+         */
+        _resolv_populate_res_for_net(res);
+
+        for (domain = (const char* const*) res->dnsrch; *domain && !done; domain++) {
+            ret = res_querydomainN(name, *domain, target, res, herrno);
+            if (ret > 0) return ret;
+
+            /*
+             * If no server present, give up.
+             * If name isn't found in this domain,
+             * keep trying higher domains in the search list
+             * (if that's enabled).
+             * On a NO_DATA error, keep trying, otherwise
+             * a wildcard entry of another type could keep us
+             * from finding this entry higher in the domain.
+             * If we get some other error (negative answer or
+             * server failure), then stop searching up,
+             * but try the input name below in case it's
+             * fully-qualified.
+             */
+            if (errno == ECONNREFUSED) {
+                *herrno = TRY_AGAIN;
+                return -1;
+            }
+
+            switch (*herrno) {
+                case NO_DATA:
+                    got_nodata++;
+                    [[fallthrough]];
+                case HOST_NOT_FOUND:
+                    /* keep trying */
+                    break;
+                case TRY_AGAIN:
+                    if (hp->rcode == SERVFAIL) {
+                        /* try next search element, if any */
+                        got_servfail++;
+                        break;
+                    }
+                    [[fallthrough]];
+                default:
+                    /* anything else implies that we're done */
+                    done++;
+            }
+            /*
+             * if we got here for some reason other than DNSRCH,
+             * we only wanted one iteration of the loop, so stop.
+             */
+            if (!(res->options & RES_DNSRCH)) done++;
+        }
+    }
+
+    /*
+     * if we have not already tried the name "as is", do that now.
+     * note that we do this regardless of how many dots were in the
+     * name or whether it ends with a dot.
+     */
+    if (!tried_as_is) {
+        ret = res_querydomainN(name, NULL, target, res, herrno);
+        if (ret > 0) return ret;
+    }
+
+    /*
+     * if we got here, we didn't satisfy the search.
+     * if we did an initial full query, return that query's h_errno
+     * (note that we wouldn't be here if that query had succeeded).
+     * else if we ever got a nodata, send that back as the reason.
+     * else send back meaningless h_errno, that being the one from
+     * the last DNSRCH we did.
+     */
+    if (saved_herrno != -1)
+        *herrno = saved_herrno;
+    else if (got_nodata)
+        *herrno = NO_DATA;
+    else if (got_servfail)
+        *herrno = TRY_AGAIN;
+    return -1;
+}
+
+/*
+ * Perform a call on res_query on the concatenation of name and domain,
+ * removing a trailing dot from name if domain is NULL.
+ */
+static int res_querydomainN(const char* name, const char* domain, res_target* target, res_state res,
+                            int* herrno) {
+    char nbuf[MAXDNAME];
+    const char* longname = nbuf;
+    size_t n, d;
+
+    assert(name != NULL);
+
+    if (domain == NULL) {
+        // Check for trailing '.'; copy without '.' if present.
+        n = strlen(name);
+        if (n + 1 > sizeof(nbuf)) {
+            *herrno = NO_RECOVERY;
+            return -1;
+        }
+        if (n > 0 && name[--n] == '.') {
+            strncpy(nbuf, name, n);
+            nbuf[n] = '\0';
+        } else
+            longname = name;
+    } else {
+        n = strlen(name);
+        d = strlen(domain);
+        if (n + 1 + d + 1 > sizeof(nbuf)) {
+            *herrno = NO_RECOVERY;
+            return -1;
+        }
+        snprintf(nbuf, sizeof(nbuf), "%s.%s", name, domain);
+    }
+    return res_queryN(longname, target, res, herrno);
+}
diff --git a/resolv/getaddrinfo.h b/resolv/getaddrinfo.h
new file mode 100644
index 0000000..e8ba5dc
--- /dev/null
+++ b/resolv/getaddrinfo.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "netd_resolv/resolv.h"  // struct android_net_context
+#include "stats.pb.h"
+
+struct addrinfo;
+
+// This is the DNS proxy entry point for getaddrinfo().
+int android_getaddrinfofornetcontext(const char*, const char*, const addrinfo*,
+                                     const android_net_context*, addrinfo**,
+                                     android::net::NetworkDnsEventReported*);
diff --git a/resolv/gethnamaddr.cpp b/resolv/gethnamaddr.cpp
new file mode 100644
index 0000000..a40a7b7
--- /dev/null
+++ b/resolv/gethnamaddr.cpp
@@ -0,0 +1,960 @@
+/*	$NetBSD: gethnamaddr.c,v 1.91 2014/06/19 15:08:18 christos Exp $	*/
+
+/*
+ * ++Copyright++ 1985, 1988, 1993
+ * -
+ * Copyright (c) 1985, 1988, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * -
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ * -
+ * --Copyright--
+ */
+
+#include "gethnamaddr.h"
+
+#include <android-base/logging.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <assert.h>
+#include <ctype.h>
+#include <errno.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <unistd.h>
+#include <functional>
+#include <vector>
+
+#include "hostent.h"
+#include "netd_resolv/resolv.h"
+#include "resolv_cache.h"
+#include "resolv_private.h"
+#include "stats.pb.h"
+
+using android::net::NetworkDnsEventReported;
+
+// NetBSD uses _DIAGASSERT to null-check arguments and the like,
+// but it's clear from the number of mistakes in their assertions
+// that they don't actually test or ship with this.
+#define _DIAGASSERT(e) /* nothing */
+
+// TODO: unify macro ALIGNBYTES and ALIGN for all possible data type alignment of hostent
+// buffer.
+#define ALIGNBYTES (sizeof(uintptr_t) - 1)
+#define ALIGN(p) (((uintptr_t)(p) + ALIGNBYTES) & ~ALIGNBYTES)
+
+#define maybe_ok(res, nm, ok) (((res)->options & RES_NOCHECKNAME) != 0U || (ok)(nm) != 0)
+#define maybe_hnok(res, hn) maybe_ok((res), (hn), res_hnok)
+#define maybe_dnok(res, dn) maybe_ok((res), (dn), res_dnok)
+
+#define MAXPACKET (8 * 1024)
+
+typedef union {
+    HEADER hdr;
+    u_char buf[MAXPACKET];
+} querybuf;
+
+typedef union {
+    int32_t al;
+    char ac;
+} align;
+
+static struct hostent* getanswer(const querybuf*, int, const char*, int, res_state, struct hostent*,
+                                 char*, size_t, int*);
+static void convert_v4v6_hostent(struct hostent* hp, char** bpp, char* ep,
+                                 std::function<void(struct hostent* hp)> mapping_param,
+                                 std::function<void(char* src, char* dst)> mapping_addr);
+static void map_v4v6_address(const char*, char*);
+static void map_v4v6_hostent(struct hostent*, char**, char*);
+static void pad_v4v6_hostent(struct hostent* hp, char** bpp, char* ep);
+static void addrsort(char**, int, res_state);
+
+static int dns_gethtbyaddr(const unsigned char* uaddr, int len, int af,
+                           const android_net_context* netcontext, getnamaddr* info,
+                           NetworkDnsEventReported* event);
+static int dns_gethtbyname(const char* name, int af, getnamaddr* info);
+
+static int gethostbyname_internal(const char* name, int af, res_state res, hostent* hp, char* hbuf,
+                                  size_t hbuflen, const android_net_context* netcontext,
+                                  NetworkDnsEventReported* event);
+static int gethostbyname_internal_real(const char* name, int af, res_state res, hostent* hp,
+                                       char* buf, size_t buflen);
+static int android_gethostbyaddrfornetcontext_proxy_internal(const void*, socklen_t, int,
+                                                             struct hostent*, char*, size_t,
+                                                             const struct android_net_context*,
+                                                             NetworkDnsEventReported* event);
+static int android_gethostbyaddrfornetcontext_proxy(const void* addr, socklen_t len, int af,
+                                                    const struct android_net_context* netcontext,
+                                                    hostent** hp, NetworkDnsEventReported* event);
+
+#define BOUNDED_INCR(x)      \
+    do {                     \
+        BOUNDS_CHECK(cp, x); \
+        cp += (x);           \
+    } while (0)
+
+#define BOUNDS_CHECK(ptr, count)                     \
+    do {                                             \
+        if (eom - (ptr) < (count)) goto no_recovery; \
+    } while (0)
+
+static struct hostent* getanswer(const querybuf* answer, int anslen, const char* qname, int qtype,
+                                 res_state res, struct hostent* hent, char* buf, size_t buflen,
+                                 int* he) {
+    const HEADER* hp;
+    const u_char* cp;
+    int n;
+    size_t qlen;
+    const u_char *eom, *erdata;
+    char *bp, **hap, *ep;
+    int ancount, qdcount;
+    int haveanswer, had_error;
+    int toobig = 0;
+    char tbuf[MAXDNAME];
+    char* addr_ptrs[MAXADDRS];
+    const char* tname;
+    int (*name_ok)(const char*);
+    std::vector<char*> aliases;
+
+    _DIAGASSERT(answer != NULL);
+    _DIAGASSERT(qname != NULL);
+
+    tname = qname;
+    hent->h_name = NULL;
+    eom = answer->buf + anslen;
+    switch (qtype) {
+        case T_A:
+        case T_AAAA:
+            name_ok = res_hnok;
+            break;
+        case T_PTR:
+            name_ok = res_dnok;
+            break;
+        default:
+            *he = NO_RECOVERY;
+            return NULL; /* XXX should be abort(); */
+    }
+
+    /*
+     * find first satisfactory answer
+     */
+    hp = &answer->hdr;
+    ancount = ntohs(hp->ancount);
+    qdcount = ntohs(hp->qdcount);
+    bp = buf;
+    ep = buf + buflen;
+    cp = answer->buf;
+    BOUNDED_INCR(HFIXEDSZ);
+    if (qdcount != 1) goto no_recovery;
+
+    n = dn_expand(answer->buf, eom, cp, bp, (int) (ep - bp));
+    if ((n < 0) || !maybe_ok(res, bp, name_ok)) goto no_recovery;
+
+    BOUNDED_INCR(n + QFIXEDSZ);
+    if (qtype == T_A || qtype == T_AAAA) {
+        /* res_send() has already verified that the query name is the
+         * same as the one we sent; this just gets the expanded name
+         * (i.e., with the succeeding search-domain tacked on).
+         */
+        n = (int) strlen(bp) + 1; /* for the \0 */
+        if (n >= MAXHOSTNAMELEN) goto no_recovery;
+        hent->h_name = bp;
+        bp += n;
+        /* The qname can be abbreviated, but h_name is now absolute. */
+        qname = hent->h_name;
+    }
+    hent->h_addr_list = hap = addr_ptrs;
+    *hap = NULL;
+    haveanswer = 0;
+    had_error = 0;
+    while (ancount-- > 0 && cp < eom && !had_error) {
+        n = dn_expand(answer->buf, eom, cp, bp, (int) (ep - bp));
+        if ((n < 0) || !maybe_ok(res, bp, name_ok)) {
+            had_error++;
+            continue;
+        }
+        cp += n; /* name */
+        BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ);
+        int type = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ; /* type */
+        int cl = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ + INT32SZ; /* class, TTL */
+        n = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ; /* len */
+        BOUNDS_CHECK(cp, n);
+        erdata = cp + n;
+        if (cl != C_IN) {
+            /* XXX - debug? syslog? */
+            cp += n;
+            continue; /* XXX - had_error++ ? */
+        }
+        if ((qtype == T_A || qtype == T_AAAA) && type == T_CNAME) {
+            n = dn_expand(answer->buf, eom, cp, tbuf, (int) sizeof tbuf);
+            if ((n < 0) || !maybe_ok(res, tbuf, name_ok)) {
+                had_error++;
+                continue;
+            }
+            cp += n;
+            if (cp != erdata) goto no_recovery;
+            /* Store alias. */
+            aliases.push_back(bp);
+            n = (int) strlen(bp) + 1; /* for the \0 */
+            if (n >= MAXHOSTNAMELEN) {
+                had_error++;
+                continue;
+            }
+            bp += n;
+            /* Get canonical name. */
+            n = (int) strlen(tbuf) + 1; /* for the \0 */
+            if (n > ep - bp || n >= MAXHOSTNAMELEN) {
+                had_error++;
+                continue;
+            }
+            strlcpy(bp, tbuf, (size_t)(ep - bp));
+            hent->h_name = bp;
+            bp += n;
+            continue;
+        }
+        if (qtype == T_PTR && type == T_CNAME) {
+            n = dn_expand(answer->buf, eom, cp, tbuf, (int) sizeof tbuf);
+            if (n < 0 || !maybe_dnok(res, tbuf)) {
+                had_error++;
+                continue;
+            }
+            cp += n;
+            if (cp != erdata) goto no_recovery;
+            /* Get canonical name. */
+            n = (int) strlen(tbuf) + 1; /* for the \0 */
+            if (n > ep - bp || n >= MAXHOSTNAMELEN) {
+                had_error++;
+                continue;
+            }
+            strlcpy(bp, tbuf, (size_t)(ep - bp));
+            tname = bp;
+            bp += n;
+            continue;
+        }
+        if (type != qtype) {
+            if (type != T_KEY && type != T_SIG)
+                LOG(DEBUG) << __func__ << ": asked for \"" << qname << " " << p_class(C_IN) << " "
+                           << p_type(qtype) << "\", got type \"" << p_type(type) << "\"";
+            cp += n;
+            continue; /* XXX - had_error++ ? */
+        }
+        switch (type) {
+            case T_PTR:
+                if (strcasecmp(tname, bp) != 0) {
+                    LOG(DEBUG) << __func__ << ": asked for \"" << qname << "\", got \"" << bp
+                               << "\"";
+                    cp += n;
+                    continue; /* XXX - had_error++ ? */
+                }
+                n = dn_expand(answer->buf, eom, cp, bp, (int) (ep - bp));
+                if ((n < 0) || !maybe_hnok(res, bp)) {
+                    had_error++;
+                    break;
+                }
+                cp += n;
+                if (cp != erdata) goto no_recovery;
+                if (!haveanswer)
+                    hent->h_name = bp;
+                else
+                    aliases.push_back(bp);
+                if (n != -1) {
+                    n = (int) strlen(bp) + 1; /* for the \0 */
+                    if (n >= MAXHOSTNAMELEN) {
+                        had_error++;
+                        break;
+                    }
+                    bp += n;
+                }
+                break;
+            case T_A:
+            case T_AAAA:
+                if (strcasecmp(hent->h_name, bp) != 0) {
+                    LOG(DEBUG) << __func__ << ": asked for \"" << hent->h_name << "\", got \"" << bp
+                               << "\"";
+                    cp += n;
+                    continue; /* XXX - had_error++ ? */
+                }
+                if (n != hent->h_length) {
+                    cp += n;
+                    continue;
+                }
+                if (type == T_AAAA) {
+                    struct in6_addr in6;
+                    memcpy(&in6, cp, NS_IN6ADDRSZ);
+                    if (IN6_IS_ADDR_V4MAPPED(&in6)) {
+                        cp += n;
+                        continue;
+                    }
+                }
+                if (!haveanswer) {
+                    int nn;
+
+                    hent->h_name = bp;
+                    nn = (int) strlen(bp) + 1; /* for the \0 */
+                    bp += nn;
+                }
+
+                bp += sizeof(align) - (size_t)((u_long) bp % sizeof(align));
+
+                if (bp + n >= ep) {
+                    LOG(DEBUG) << __func__ << ": size (" << n << ") too big";
+                    had_error++;
+                    continue;
+                }
+                if (hap >= &addr_ptrs[MAXADDRS - 1]) {
+                    if (!toobig++) {
+                        LOG(DEBUG) << __func__ << ": Too many addresses (" << MAXADDRS << ")";
+                    }
+                    cp += n;
+                    continue;
+                }
+                (void) memcpy(*hap++ = bp, cp, (size_t) n);
+                bp += n;
+                cp += n;
+                if (cp != erdata) goto no_recovery;
+                break;
+            default:
+                abort();
+        }
+        if (!had_error) haveanswer++;
+    }
+    if (haveanswer) {
+        *hap = NULL;
+        /*
+         * Note: we sort even if host can take only one address
+         * in its return structures - should give it the "best"
+         * address in that case, not some random one
+         */
+        if (res->nsort && haveanswer > 1 && qtype == T_A) addrsort(addr_ptrs, haveanswer, res);
+        if (!hent->h_name) {
+            n = (int) strlen(qname) + 1; /* for the \0 */
+            if (n > ep - bp || n >= MAXHOSTNAMELEN) goto no_recovery;
+            strlcpy(bp, qname, (size_t)(ep - bp));
+            hent->h_name = bp;
+            bp += n;
+        }
+        if (res->options & RES_USE_INET6) map_v4v6_hostent(hent, &bp, ep);
+        if (hent->h_addrtype == AF_INET) pad_v4v6_hostent(hent, &bp, ep);
+        goto success;
+    }
+no_recovery:
+    *he = NO_RECOVERY;
+    return NULL;
+success:
+    bp = (char*) ALIGN(bp);
+    aliases.push_back(nullptr);
+    qlen = aliases.size() * sizeof(*hent->h_aliases);
+    if ((size_t)(ep - bp) < qlen) goto nospc;
+    hent->h_aliases = (char**) bp;
+    memcpy(bp, aliases.data(), qlen);
+
+    bp += qlen;
+    n = (int) (hap - addr_ptrs);
+    qlen = (n + 1) * sizeof(*hent->h_addr_list);
+    if ((size_t)(ep - bp) < qlen) goto nospc;
+    hent->h_addr_list = (char**) bp;
+    memcpy(bp, addr_ptrs, qlen);
+    *he = NETDB_SUCCESS;
+    return hent;
+nospc:
+    errno = ENOSPC;
+    *he = NETDB_INTERNAL;
+    return NULL;
+}
+
+static int gethostbyname_internal_real(const char* name, int af, res_state res, hostent* hp,
+                                       char* buf, size_t buflen) {
+    getnamaddr info;
+    size_t size;
+
+    _DIAGASSERT(name != NULL);
+
+    switch (af) {
+        case AF_INET:
+            size = NS_INADDRSZ;
+            break;
+        case AF_INET6:
+            size = NS_IN6ADDRSZ;
+            break;
+        default:
+            return EAI_FAMILY;
+    }
+    if (buflen < size) goto nospc;
+
+    hp->h_addrtype = af;
+    hp->h_length = (int) size;
+
+    /*
+     * disallow names consisting only of digits/dots, unless
+     * they end in a dot.
+     */
+    if (isdigit((u_char) name[0])) {
+        for (const char* cp = name;; ++cp) {
+            if (!*cp) {
+                if (*--cp == '.') break;
+                /*
+                 * All-numeric, no dot at the end.
+                 * Fake up a hostent as if we'd actually
+                 * done a lookup.
+                 */
+                goto fake;
+            }
+            if (!isdigit((u_char) *cp) && *cp != '.') break;
+        }
+    }
+    if ((isxdigit((u_char) name[0]) && strchr(name, ':') != NULL) || name[0] == ':') {
+        for (const char* cp = name;; ++cp) {
+            if (!*cp) {
+                if (*--cp == '.') break;
+                /*
+                 * All-IPv6-legal, no dot at the end.
+                 * Fake up a hostent as if we'd actually
+                 * done a lookup.
+                 */
+                goto fake;
+            }
+            if (!isxdigit((u_char) *cp) && *cp != ':' && *cp != '.') break;
+        }
+    }
+
+    info.hp = hp;
+    info.buf = buf;
+    info.buflen = buflen;
+    if (_hf_gethtbyname2(name, af, &info)) {
+        int error = dns_gethtbyname(name, af, &info);
+        if (error != 0) return error;
+    }
+    return 0;
+nospc:
+    return EAI_MEMORY;
+fake:
+    HENT_ARRAY(hp->h_addr_list, 1, buf, buflen);
+    HENT_ARRAY(hp->h_aliases, 0, buf, buflen);
+
+    hp->h_aliases[0] = NULL;
+    if (size > buflen) goto nospc;
+
+    if (inet_pton(af, name, buf) <= 0) {
+        return EAI_NODATA;
+    }
+    hp->h_addr_list[0] = buf;
+    hp->h_addr_list[1] = NULL;
+    buf += size;
+    buflen -= size;
+    HENT_SCOPY(hp->h_name, name, buf, buflen);
+    if (res->options & RES_USE_INET6) map_v4v6_hostent(hp, &buf, buf + buflen);
+    return 0;
+}
+
+// very similar in proxy-ness to android_getaddrinfo_proxy
+static int gethostbyname_internal(const char* name, int af, res_state res, hostent* hp, char* hbuf,
+                                  size_t hbuflen, const android_net_context* netcontext,
+                                  NetworkDnsEventReported* event) {
+    res_setnetcontext(res, netcontext, event);
+    return gethostbyname_internal_real(name, af, res, hp, hbuf, hbuflen);
+}
+
+static int android_gethostbyaddrfornetcontext_real(const void* addr, socklen_t len, int af,
+                                                   struct hostent* hp, char* buf, size_t buflen,
+                                                   const struct android_net_context* netcontext,
+                                                   NetworkDnsEventReported* event) {
+    const u_char* uaddr = (const u_char*) addr;
+    socklen_t size;
+    struct getnamaddr info;
+
+    _DIAGASSERT(addr != NULL);
+
+    if (af == AF_INET6 && len == NS_IN6ADDRSZ &&
+        (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr*) addr) ||
+         IN6_IS_ADDR_SITELOCAL((const struct in6_addr*) addr))) {
+        return EAI_NODATA;
+    }
+    if (af == AF_INET6 && len == NS_IN6ADDRSZ &&
+        (IN6_IS_ADDR_V4MAPPED((const struct in6_addr*) addr) ||
+         IN6_IS_ADDR_V4COMPAT((const struct in6_addr*) addr))) {
+        /* Unmap. */
+        uaddr += NS_IN6ADDRSZ - NS_INADDRSZ;
+        addr = uaddr;
+        af = AF_INET;
+        len = NS_INADDRSZ;
+    }
+    switch (af) {
+        case AF_INET:
+            size = NS_INADDRSZ;
+            break;
+        case AF_INET6:
+            size = NS_IN6ADDRSZ;
+            break;
+        default:
+            return EAI_FAMILY;
+    }
+    if (size != len) {
+        // TODO: Consider converting to a private extended EAI_* error code.
+        // Currently, the EAI_* value has no corresponding error code for invalid argument socket
+        // length. In order to not rely on errno, convert the original error code pair, EAI_SYSTEM
+        // and EINVAL, to EAI_FAIL.
+        return EAI_FAIL;
+    }
+    info.hp = hp;
+    info.buf = buf;
+    info.buflen = buflen;
+    if (_hf_gethtbyaddr(uaddr, len, af, &info)) {
+        int error = dns_gethtbyaddr(uaddr, len, af, netcontext, &info, event);
+        if (error != 0) return error;
+    }
+    return 0;
+}
+
+static int android_gethostbyaddrfornetcontext_proxy_internal(
+        const void* addr, socklen_t len, int af, struct hostent* hp, char* hbuf, size_t hbuflen,
+        const struct android_net_context* netcontext, NetworkDnsEventReported* event) {
+    return android_gethostbyaddrfornetcontext_real(addr, len, af, hp, hbuf, hbuflen, netcontext,
+                                                   event);
+}
+
+// TODO: Consider leaving function without returning error code as _gethtent() does because
+// the error code of the caller does not currently return to netd.
+struct hostent* netbsd_gethostent_r(FILE* hf, struct hostent* hent, char* buf, size_t buflen,
+                                    int* he) {
+    const size_t line_buf_size = sizeof(res_get_static()->hostbuf);
+    char *name;
+    char* cp;
+    int af, len;
+    size_t anum;
+    struct in6_addr host_addr;
+    std::vector<char*> aliases;
+
+    if (hf == NULL) {
+        *he = NETDB_INTERNAL;
+        errno = EINVAL;
+        return NULL;
+    }
+    char* p = NULL;
+
+    /* Allocate a new space to read file lines like upstream does.
+     * To keep reentrancy we cannot use res_get_static()->hostbuf here,
+     * as the buffer may be used to store content for a previous hostent
+     * returned by non-reentrant functions like gethostbyname().
+     */
+    if ((p = (char*) malloc(line_buf_size)) == NULL) {
+        goto nospc;
+    }
+    for (;;) {
+        if (!fgets(p, line_buf_size, hf)) {
+            free(p);
+            *he = HOST_NOT_FOUND;
+            return NULL;
+        }
+        if (*p == '#') {
+            continue;
+        }
+        if (!(cp = strpbrk(p, "#\n"))) {
+            continue;
+        }
+        *cp = '\0';
+        if (!(cp = strpbrk(p, " \t"))) continue;
+        *cp++ = '\0';
+        if (inet_pton(AF_INET6, p, &host_addr) > 0) {
+            af = AF_INET6;
+            len = NS_IN6ADDRSZ;
+        } else {
+            if (inet_pton(AF_INET, p, &host_addr) <= 0) continue;
+
+            res_state res = res_get_state();
+            if (res == NULL) goto nospc;
+            if (res->options & RES_USE_INET6) {
+                map_v4v6_address(buf, buf);
+                af = AF_INET6;
+                len = NS_IN6ADDRSZ;
+            } else {
+                af = AF_INET;
+                len = NS_INADDRSZ;
+            }
+        }
+
+        /* if this is not something we're looking for, skip it. */
+        if (hent->h_addrtype != 0 && hent->h_addrtype != af) continue;
+        if (hent->h_length != 0 && hent->h_length != len) continue;
+
+        while (*cp == ' ' || *cp == '\t') cp++;
+        if ((cp = strpbrk(name = cp, " \t")) != NULL) *cp++ = '\0';
+        while (cp && *cp) {
+            if (*cp == ' ' || *cp == '\t') {
+                cp++;
+                continue;
+            }
+            aliases.push_back(cp);
+            if ((cp = strpbrk(cp, " \t")) != NULL) *cp++ = '\0';
+        }
+        break;
+    }
+    hent->h_length = len;
+    hent->h_addrtype = af;
+    HENT_ARRAY(hent->h_addr_list, 1, buf, buflen);
+    anum = aliases.size();
+    HENT_ARRAY(hent->h_aliases, anum, buf, buflen);
+    HENT_COPY(hent->h_addr_list[0], &host_addr, hent->h_length, buf, buflen);
+    hent->h_addr_list[1] = NULL;
+
+    /* Reserve space for mapping IPv4 address to IPv6 address in place */
+    if (hent->h_addrtype == AF_INET) {
+        HENT_COPY(buf, NAT64_PAD, sizeof(NAT64_PAD), buf, buflen);
+    }
+
+    HENT_SCOPY(hent->h_name, name, buf, buflen);
+    for (size_t i = 0; i < anum; i++) HENT_SCOPY(hent->h_aliases[i], aliases[i], buf, buflen);
+    hent->h_aliases[anum] = NULL;
+    *he = NETDB_SUCCESS;
+    free(p);
+    return hent;
+nospc:
+    free(p);
+    errno = ENOSPC;
+    *he = NETDB_INTERNAL;
+    return NULL;
+}
+
+static void map_v4v6_address(const char* src, char* dst) {
+    u_char* p = (u_char*) dst;
+    char tmp[NS_INADDRSZ];
+    int i;
+
+    _DIAGASSERT(src != NULL);
+    _DIAGASSERT(dst != NULL);
+
+    /* Stash a temporary copy so our caller can update in place. */
+    memcpy(tmp, src, NS_INADDRSZ);
+    /* Mark this ipv6 addr as a mapped ipv4. */
+    for (i = 0; i < 10; i++) *p++ = 0x00;
+    *p++ = 0xff;
+    *p++ = 0xff;
+    /* Retrieve the saved copy and we're done. */
+    memcpy(p, tmp, NS_INADDRSZ);
+}
+
+static void convert_v4v6_hostent(struct hostent* hp, char** bpp, char* ep,
+                                 std::function<void(struct hostent* hp)> map_param,
+                                 std::function<void(char* src, char* dst)> map_addr) {
+    _DIAGASSERT(hp != NULL);
+    _DIAGASSERT(bpp != NULL);
+    _DIAGASSERT(ep != NULL);
+
+    if (hp->h_addrtype != AF_INET || hp->h_length != NS_INADDRSZ) return;
+    map_param(hp);
+    for (char** ap = hp->h_addr_list; *ap; ap++) {
+        int i = (int) (sizeof(align) - (size_t)((u_long) *bpp % sizeof(align)));
+
+        if (ep - *bpp < (i + NS_IN6ADDRSZ)) {
+            /* Out of memory.  Truncate address list here.  XXX */
+            *ap = NULL;
+            return;
+        }
+        *bpp += i;
+        map_addr(*ap, *bpp);
+        *ap = *bpp;
+        *bpp += NS_IN6ADDRSZ;
+    }
+}
+
+static void map_v4v6_hostent(struct hostent* hp, char** bpp, char* ep) {
+    convert_v4v6_hostent(hp, bpp, ep,
+                         [](struct hostent* hp) {
+                             hp->h_addrtype = AF_INET6;
+                             hp->h_length = NS_IN6ADDRSZ;
+                         },
+                         [](char* src, char* dst) { map_v4v6_address(src, dst); });
+}
+
+/* Reserve space for mapping IPv4 address to IPv6 address in place */
+static void pad_v4v6_hostent(struct hostent* hp, char** bpp, char* ep) {
+    convert_v4v6_hostent(hp, bpp, ep,
+                         [](struct hostent* hp) {
+                             (void) hp; /* unused */
+                         },
+                         [](char* src, char* dst) {
+                             memcpy(dst, src, NS_INADDRSZ);
+                             memcpy(dst + NS_INADDRSZ, NAT64_PAD, sizeof(NAT64_PAD));
+                         });
+}
+
+static void addrsort(char** ap, int num, res_state res) {
+    int i, j;
+    char** p;
+    short aval[MAXADDRS];
+    int needsort = 0;
+
+    _DIAGASSERT(ap != NULL);
+
+    p = ap;
+    for (i = 0; i < num; i++, p++) {
+        for (j = 0; (unsigned) j < res->nsort; j++)
+            if (res->sort_list[j].addr.s_addr ==
+                (((struct in_addr*) (void*) (*p))->s_addr & res->sort_list[j].mask))
+                break;
+        aval[i] = j;
+        if (needsort == 0 && i > 0 && j < aval[i - 1]) needsort = i;
+    }
+    if (!needsort) return;
+
+    while (needsort < num) {
+        for (j = needsort - 1; j >= 0; j--) {
+            if (aval[j] > aval[j + 1]) {
+                char* hp;
+
+                i = aval[j];
+                aval[j] = aval[j + 1];
+                aval[j + 1] = i;
+
+                hp = ap[j];
+                ap[j] = ap[j + 1];
+                ap[j + 1] = hp;
+            } else
+                break;
+        }
+        needsort++;
+    }
+}
+
+static int dns_gethtbyname(const char* name, int addr_type, getnamaddr* info) {
+    int n, type;
+    info->hp->h_addrtype = addr_type;
+
+    switch (info->hp->h_addrtype) {
+        case AF_INET:
+            info->hp->h_length = NS_INADDRSZ;
+            type = T_A;
+            break;
+        case AF_INET6:
+            info->hp->h_length = NS_IN6ADDRSZ;
+            type = T_AAAA;
+            break;
+        default:
+            return EAI_FAMILY;
+    }
+    auto buf = std::make_unique<querybuf>();
+
+    res_state res = res_get_state();
+    if (!res) return EAI_MEMORY;
+
+    int he;
+    n = res_nsearch(res, name, C_IN, type, buf->buf, (int)sizeof(buf->buf), &he);
+    if (n < 0) {
+        LOG(DEBUG) << __func__ << ": res_nsearch failed (" << n << ")";
+        // Return h_errno (he) to catch more detailed errors rather than EAI_NODATA.
+        // Note that res_nsearch() doesn't set the pair NETDB_INTERNAL and errno.
+        // See also herrnoToAiErrno().
+        return herrnoToAiErrno(he);
+    }
+    hostent* hp = getanswer(buf.get(), n, name, type, res, info->hp, info->buf, info->buflen, &he);
+    if (hp == NULL) return herrnoToAiErrno(he);
+
+    return 0;
+}
+
+static int dns_gethtbyaddr(const unsigned char* uaddr, int len, int af,
+                           const android_net_context* netcontext, getnamaddr* info,
+                           NetworkDnsEventReported* event) {
+    char qbuf[MAXDNAME + 1], *qp, *ep;
+    int n;
+    int advance;
+
+    info->hp->h_length = len;
+    info->hp->h_addrtype = af;
+
+    switch (info->hp->h_addrtype) {
+        case AF_INET:
+            (void) snprintf(qbuf, sizeof(qbuf), "%u.%u.%u.%u.in-addr.arpa", (uaddr[3] & 0xff),
+                            (uaddr[2] & 0xff), (uaddr[1] & 0xff), (uaddr[0] & 0xff));
+            break;
+
+        case AF_INET6:
+            qp = qbuf;
+            ep = qbuf + sizeof(qbuf) - 1;
+            for (n = NS_IN6ADDRSZ - 1; n >= 0; n--) {
+                advance = snprintf(qp, (size_t)(ep - qp), "%x.%x.", uaddr[n] & 0xf,
+                                   ((unsigned int) uaddr[n] >> 4) & 0xf);
+                if (advance > 0 && qp + advance < ep)
+                    qp += advance;
+                else {
+                    // TODO: Consider converting to a private extended EAI_* error code.
+                    // Currently, the EAI_* value has no corresponding error code for an internal
+                    // out of buffer space. In order to not rely on errno, convert the original
+                    // error code EAI_SYSTEM to EAI_MEMORY.
+                    return EAI_MEMORY;
+                }
+            }
+            if (strlcat(qbuf, "ip6.arpa", sizeof(qbuf)) >= sizeof(qbuf)) {
+                // TODO: Consider converting to a private extended EAI_* error code.
+                // Currently, the EAI_* value has no corresponding error code for an internal
+                // out of buffer space. In order to not rely on errno, convert the original
+                // error code EAI_SYSTEM to EAI_MEMORY.
+                return EAI_MEMORY;
+            }
+            break;
+        default:
+            return EAI_FAMILY;
+    }
+
+    auto buf = std::make_unique<querybuf>();
+
+    res_state res = res_get_state();
+    if (!res) return EAI_MEMORY;
+
+    res_setnetcontext(res, netcontext, event);
+    int he;
+    n = res_nquery(res, qbuf, C_IN, T_PTR, buf->buf, (int)sizeof(buf->buf), &he);
+    if (n < 0) {
+        LOG(DEBUG) << __func__ << ": res_nquery failed (" << n << ")";
+        // Note that res_nquery() doesn't set the pair NETDB_INTERNAL and errno.
+        // Return h_errno (he) to catch more detailed errors rather than EAI_NODATA.
+        // See also herrnoToAiErrno().
+        return herrnoToAiErrno(he);
+    }
+    hostent* hp = getanswer(buf.get(), n, qbuf, T_PTR, res, info->hp, info->buf, info->buflen, &he);
+    if (hp == NULL) return herrnoToAiErrno(he);
+
+    char* bf = (char*) (hp->h_addr_list + 2);
+    size_t blen = (size_t)(bf - info->buf);
+    if (blen + info->hp->h_length > info->buflen) goto nospc;
+    hp->h_addr_list[0] = bf;
+    hp->h_addr_list[1] = NULL;
+    memcpy(bf, uaddr, (size_t) info->hp->h_length);
+    if (info->hp->h_addrtype == AF_INET && (res->options & RES_USE_INET6)) {
+        if (blen + NS_IN6ADDRSZ > info->buflen) goto nospc;
+        map_v4v6_address(bf, bf);
+        hp->h_addrtype = AF_INET6;
+        hp->h_length = NS_IN6ADDRSZ;
+    }
+
+    /* Reserve enough space for mapping IPv4 address to IPv6 address in place */
+    if (info->hp->h_addrtype == AF_INET) {
+        if (blen + NS_IN6ADDRSZ > info->buflen) goto nospc;
+        // Pad zero to the unused address space
+        memcpy(bf + NS_INADDRSZ, NAT64_PAD, sizeof(NAT64_PAD));
+    }
+
+    return 0;
+
+nospc:
+    return EAI_MEMORY;
+}
+
+/*
+ * Non-reentrant versions.
+ */
+
+int android_gethostbynamefornetcontext(const char* name, int af,
+                                       const struct android_net_context* netcontext, hostent** hp,
+                                       NetworkDnsEventReported* event) {
+    assert(event != nullptr);
+
+    res_state res = res_get_state();
+    if (res == NULL) return EAI_MEMORY;
+    res_static* rs = res_get_static();  // For thread-safety.
+    int error;
+    error = gethostbyname_internal(name, af, res, &rs->host, rs->hostbuf, sizeof(rs->hostbuf),
+                                   netcontext, event);
+    if (error == 0) {
+        *hp = &rs->host;
+    }
+    return error;
+}
+
+int android_gethostbyaddrfornetcontext(const void* addr, socklen_t len, int af,
+                                       const struct android_net_context* netcontext, hostent** hp,
+                                       NetworkDnsEventReported* event) {
+    return android_gethostbyaddrfornetcontext_proxy(addr, len, af, netcontext, hp, event);
+}
+
+static int android_gethostbyaddrfornetcontext_proxy(const void* addr, socklen_t len, int af,
+                                                    const struct android_net_context* netcontext,
+                                                    hostent** hp, NetworkDnsEventReported* event) {
+    assert(event != nullptr);
+
+    struct res_static* rs = res_get_static();  // For thread-safety.
+    int error = android_gethostbyaddrfornetcontext_proxy_internal(
+            addr, len, af, &rs->host, rs->hostbuf, sizeof(rs->hostbuf), netcontext, event);
+    if (error == 0) *hp = &rs->host;
+    return error;
+}
+
+int herrnoToAiErrno(int he) {
+    switch (he) {
+        // extended h_errno
+        case NETD_RESOLV_H_ERRNO_EXT_TIMEOUT:
+            return NETD_RESOLV_TIMEOUT;
+        // legacy h_errno
+        case NETDB_SUCCESS:
+            return 0;
+        case HOST_NOT_FOUND:  // TODO: Perhaps convert HOST_NOT_FOUND to EAI_NONAME instead
+        case NO_DATA:         // NO_ADDRESS
+            return EAI_NODATA;
+        case TRY_AGAIN:
+            return EAI_AGAIN;
+        case NETDB_INTERNAL:
+            // TODO: Remove ENOSPC and call abort() immediately whenever any allocation fails.
+            if (errno == ENOSPC) return EAI_MEMORY;
+            // Theoretically, this should not happen. Leave this here just in case.
+            // Currently, getanswer() of {gethnamaddr, getaddrinfo}.cpp, res_nsearch() and
+            // res_searchN() use this function to convert error code. Only getanswer()
+            // of gethnamaddr.cpp may return the error code pair, herrno NETDB_INTERNAL and
+            // errno ENOSPC, which has already converted to EAI_MEMORY. The remaining functions
+            // don't set the pair herrno and errno.
+            return EAI_SYSTEM;  // see errno for detail
+        case NO_RECOVERY:
+        default:
+            return EAI_FAIL;  // TODO: Perhaps convert default to EAI_MAX (unknown error) instead
+    }
+}
diff --git a/resolv/gethnamaddr.h b/resolv/gethnamaddr.h
new file mode 100644
index 0000000..bfdb14e
--- /dev/null
+++ b/resolv/gethnamaddr.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <netdb.h>               // struct hostent
+#include "netd_resolv/resolv.h"  // struct android_net_context
+#include "stats.pb.h"
+
+// This is the entry point for the gethostbyname() family of legacy calls.
+int android_gethostbynamefornetcontext(const char*, int, const android_net_context*, hostent**,
+                                       android::net::NetworkDnsEventReported*);
+
+// This is the entry point for the gethostbyaddr() family of legacy calls.
+int android_gethostbyaddrfornetcontext(const void*, socklen_t, int, const android_net_context*,
+                                       hostent**, android::net::NetworkDnsEventReported*);
diff --git a/resolv/hostent.h b/resolv/hostent.h
new file mode 100644
index 0000000..4f6a33b
--- /dev/null
+++ b/resolv/hostent.h
@@ -0,0 +1,72 @@
+/*	$NetBSD: hostent.h,v 1.2 2013/08/27 09:56:12 christos Exp $	*/
+
+/*-
+ * Copyright (c) 2013 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Christos Zoulas.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef NETD_RESOLV_HOSTENT_H
+#define NETD_RESOLV_HOSTENT_H
+
+#include <netdb.h>
+#include <stdio.h>
+
+struct getnamaddr {
+    struct hostent* hp;
+    char* buf;
+    size_t buflen;
+};
+
+// /etc/hosts lookup
+int _hf_gethtbyaddr(const unsigned char* uaddr, int len, int af, getnamaddr* info);
+int _hf_gethtbyname2(const char* name, int af, getnamaddr* info);
+hostent* netbsd_gethostent_r(FILE*, struct hostent*, char*, size_t, int*);
+
+// Reserved padding for remapping IPv4 address to NAT64 synthesis IPv6 address
+static const char NAT64_PAD[NS_IN6ADDRSZ - NS_INADDRSZ] = {};
+
+#define HENT_ARRAY(dst, anum, ptr, len) do {     \
+        size_t _len = (anum + 1) * sizeof(*dst); \
+        if (_len > len) goto nospc;              \
+        dst = (char**) ptr;                      \
+        ptr += _len;                             \
+        len -= _len;                             \
+    } while (0)
+
+#define HENT_COPY(dst, src, slen, ptr, len) do { \
+        if ((size_t) slen > len) goto nospc;     \
+        memcpy(ptr, src, (size_t) slen);         \
+        dst = ptr;                               \
+        ptr += slen;                             \
+        len -= slen;                             \
+    } while (0)
+
+#define HENT_SCOPY(dst, src, ptr, len) do {  \
+        size_t _len = strlen(src) + 1;       \
+        HENT_COPY(dst, src, _len, ptr, len); \
+    } while (0)
+
+#endif  // NETD_RESOLV_HOSTENT_H
diff --git a/resolv/include/netd_resolv/params.h b/resolv/include/netd_resolv/params.h
new file mode 100644
index 0000000..93e6287
--- /dev/null
+++ b/resolv/include/netd_resolv/params.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef NETD_RESOLV_PARAMS_H
+#define NETD_RESOLV_PARAMS_H
+
+#include <stdint.h>
+
+#define MAXNS 4            // max # name servers we'll track
+#define MAXDNSRCH 6        // max # domains in search path
+#define MAXDNSRCHPATH 256  // max length of domain search paths
+#define MAXNSSAMPLES 64    // max # samples to store per server
+
+// Per-netid configuration parameters passed from netd to the resolver
+struct res_params {
+    uint16_t sample_validity;  // sample lifetime in s
+    // threshold of success / total samples below which a server is considered broken
+    uint8_t success_threshold;  // 0: disable, value / 100 otherwise
+    uint8_t min_samples;        // min # samples needed for statistics to be considered meaningful
+    uint8_t max_samples;        // max # samples taken into account for statistics
+    int base_timeout_msec;      // base query retry timeout (if 0, use RES_TIMEOUT)
+    int retry_count;            // number of retries
+};
+
+#define LIBNETD_RESOLV_PUBLIC extern "C" [[gnu::visibility("default")]]
+
+#endif  // NETD_RESOLV_PARAMS_H
diff --git a/resolv/include/netd_resolv/resolv.h b/resolv/include/netd_resolv/resolv.h
new file mode 100644
index 0000000..3a71110
--- /dev/null
+++ b/resolv/include/netd_resolv/resolv.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "params.h"
+
+#include <netinet/in.h>
+
+typedef union sockaddr_union {
+    struct sockaddr sa;
+    struct sockaddr_in sin;
+    struct sockaddr_in6 sin6;
+} sockaddr_union;
+
+/*
+ * Passing NETID_UNSET as the netId causes system/netd/resolv/DnsProxyListener.cpp to
+ * fill in the appropriate default netId for the query.
+ */
+#define NETID_UNSET 0u
+
+/*
+ * MARK_UNSET represents the default (i.e. unset) value for a socket mark.
+ */
+#define MARK_UNSET 0u
+
+/*
+ * Error code extending EAI_* codes defined in bionic/libc/include/netdb.h.
+ * This error code, including EAI_*, returned from android_getaddrinfofornetcontext()
+ * and android_gethostbynamefornetcontext() are used for DNS metrics.
+ */
+#define NETD_RESOLV_TIMEOUT 255  // consistent with RCODE_TIMEOUT
+
+/*
+ * A struct to capture context relevant to network operations.
+ *
+ * Application and DNS netids/marks can differ from one another under certain
+ * circumstances, notably when a VPN applies to the given uid's traffic but the
+ * VPN network does not have its own DNS servers explicitly provisioned.
+ *
+ * The introduction of per-UID routing means the uid is also an essential part
+ * of the evaluation context. Its proper uninitialized value is
+ * NET_CONTEXT_INVALID_UID.
+ */
+struct android_net_context {
+    unsigned app_netid;
+    unsigned app_mark;
+    unsigned dns_netid;
+    unsigned dns_mark;
+    uid_t uid;
+    unsigned flags;
+};
+
+#define NET_CONTEXT_INVALID_UID ((uid_t) -1)
+#define NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS 0x00000001
+#define NET_CONTEXT_FLAG_USE_EDNS 0x00000002
+
+// TODO: investigate having the resolver check permissions itself, either by adding support to
+// libbinder_ndk or by converting IPermissionController into a stable AIDL interface.
+typedef bool (*check_calling_permission_callback)(const char* permission);
+typedef void (*get_network_context_callback)(unsigned netid, uid_t uid,
+                                             android_net_context* netcontext);
+typedef void (*log_callback)(const char* msg);
+
+/*
+ * Some functions needed by the resolver (e.g. checkCallingPermission()) live in
+ * libraries with no ABI stability guarantees, such as libbinder.so.
+ * As a temporary workaround, we keep these functions in netd and call them via
+ * function pointers.
+ */
+struct ResolverNetdCallbacks {
+    check_calling_permission_callback check_calling_permission;
+    get_network_context_callback get_network_context;
+    log_callback log;
+};
+
+LIBNETD_RESOLV_PUBLIC bool resolv_has_nameservers(unsigned netid);
+
+// Set callbacks and bring DnsResolver up.
+LIBNETD_RESOLV_PUBLIC bool resolv_init(const ResolverNetdCallbacks* callbacks);
diff --git a/resolv/include/netd_resolv/resolv_stub.h b/resolv/include/netd_resolv/resolv_stub.h
new file mode 100644
index 0000000..41f56fa
--- /dev/null
+++ b/resolv/include/netd_resolv/resolv_stub.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef NETD_RESOLV_RESOLV_STUB_H
+#define NETD_RESOLV_RESOLV_STUB_H
+
+#include "resolv.h"
+#include "stats.h"
+
+// Struct containing function pointers for every function exported by libnetd_resolv.
+extern struct ResolvStub {
+    bool (*resolv_has_nameservers)(unsigned netid);
+
+    bool (*resolv_init)(const ResolverNetdCallbacks& callbacks);
+} RESOLV_STUB;
+
+int resolv_stub_init();
+
+#endif  // NETD_RESOLV_RESOLV_STUB_H
diff --git a/resolv/include/netd_resolv/stats.h b/resolv/include/netd_resolv/stats.h
new file mode 100644
index 0000000..7bfe845
--- /dev/null
+++ b/resolv/include/netd_resolv/stats.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef NETD_RES_STATS_H
+#define NETD_RES_STATS_H
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <sys/socket.h>
+#include <time.h>
+
+#include "params.h"
+
+#define RCODE_INTERNAL_ERROR 254
+#define RCODE_TIMEOUT 255
+
+struct res_sample {
+    time_t at;      // time in s at which the sample was recorded
+    uint16_t rtt;   // round-trip time in ms
+    uint8_t rcode;  // the DNS rcode or RCODE_XXX defined above
+};
+
+// Resolver reachability statistics and run-time parameters.
+struct res_stats {
+    // Stats of the last <sample_count> queries.
+    res_sample samples[MAXNSSAMPLES];
+    // The number of samples stored.
+    uint8_t sample_count;
+    // The next sample to modify.
+    uint8_t sample_next;
+};
+
+// Aggregates the reachability statistics for the given server based on on the stored samples.
+LIBNETD_RESOLV_PUBLIC void android_net_res_stats_aggregate(res_stats* stats, int* successes,
+                                                           int* errors, int* timeouts,
+                                                           int* internal_errors, int* rtt_avg,
+                                                           time_t* last_sample_time);
+
+LIBNETD_RESOLV_PUBLIC int android_net_res_stats_get_info_for_net(
+        unsigned netid, int* nscount, sockaddr_storage servers[MAXNS], int* dcount,
+        char domains[MAXDNSRCH][MAXDNSRCHPATH], res_params* params, res_stats stats[MAXNS],
+        int* wait_for_pending_req_timeout_count);
+
+// Returns an array of bools indicating which servers are considered good
+LIBNETD_RESOLV_PUBLIC int android_net_res_stats_get_usable_servers(const res_params* params,
+                                                                   res_stats stats[], int nscount,
+                                                                   bool valid_servers[]);
+
+#endif  // NETD_RES_STATS_H
diff --git a/resolv/libnetd_resolv.map.txt b/resolv/libnetd_resolv.map.txt
new file mode 100644
index 0000000..be193db
--- /dev/null
+++ b/resolv/libnetd_resolv.map.txt
@@ -0,0 +1,27 @@
+#
+# Copyright (C) 2018 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This lists the entry points visible to applications that use the
+# libnetd_resolv library. Other entry points present in the library won't be
+# usable.
+
+LIBNETD_RESOLV {
+  global:
+    resolv_has_nameservers;
+    resolv_init;
+  local:
+    *;
+};
diff --git a/resolv/libnetd_resolv_test.cpp b/resolv/libnetd_resolv_test.cpp
new file mode 100644
index 0000000..6e4b9ee
--- /dev/null
+++ b/resolv/libnetd_resolv_test.cpp
@@ -0,0 +1,609 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "libnetd_resolv_test"
+
+#include <gtest/gtest.h>
+
+#include <android-base/stringprintf.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include "dns_responder.h"
+#include "getaddrinfo.h"
+#include "gethnamaddr.h"
+#include "resolv_cache.h"
+#include "stats.pb.h"
+
+// TODO: make this dynamic and stop depending on implementation details.
+constexpr unsigned int TEST_NETID = 30;
+
+// Specifying 0 in ai_socktype or ai_protocol of struct addrinfo indicates that any type or
+// protocol can be returned by getaddrinfo().
+constexpr unsigned int ANY = 0;
+
+using android::base::StringPrintf;
+
+namespace android {
+namespace net {
+
+using android::net::NetworkDnsEventReported;
+
+// Minimize class ResolverTest to be class TestBase because class TestBase doesn't need all member
+// functions of class ResolverTest and class DnsResponderClient.
+class TestBase : public ::testing::Test {
+  protected:
+    void SetUp() override {
+        // Create cache for test
+        resolv_create_cache_for_net(TEST_NETID);
+    }
+    void TearDown() override {
+        // Delete cache for test
+        resolv_delete_cache_for_net(TEST_NETID);
+    }
+
+    static std::string ToString(const hostent* he) {
+        if (he == nullptr) return "<null>";
+        char buffer[INET6_ADDRSTRLEN];
+        if (!inet_ntop(he->h_addrtype, he->h_addr_list[0], buffer, sizeof(buffer))) {
+            return "<invalid>";
+        }
+        return buffer;
+    }
+
+    static std::string ToString(const addrinfo* ai) {
+        if (!ai) return "<null>";
+        for (const auto* aip = ai; aip != nullptr; aip = aip->ai_next) {
+            char host[NI_MAXHOST];
+            int rv = getnameinfo(aip->ai_addr, aip->ai_addrlen, host, sizeof(host), nullptr, 0,
+                                 NI_NUMERICHOST);
+            if (rv != 0) return gai_strerror(rv);
+            return host;
+        }
+        return "<invalid>";
+    }
+
+    size_t GetNumQueries(const test::DNSResponder& dns, const char* name) const {
+        auto queries = dns.queries();
+        size_t found = 0;
+        for (const auto& p : queries) {
+            if (p.first == name) {
+                ++found;
+            }
+        }
+        return found;
+    }
+
+    const char* mDefaultSearchDomains = "example.com";
+    const res_params mDefaultParams_Binder = {
+            .sample_validity = 300,
+            .success_threshold = 25,
+            .min_samples = 8,
+            .max_samples = 8,
+            .base_timeout_msec = 1000,
+            .retry_count = 2,
+    };
+    const android_net_context mNetcontext = {
+            .app_netid = TEST_NETID,
+            .app_mark = MARK_UNSET,
+            .dns_netid = TEST_NETID,
+            .dns_mark = MARK_UNSET,
+            .uid = NET_CONTEXT_INVALID_UID,
+    };
+};
+
+class GetAddrInfoForNetContextTest : public TestBase {};
+class GetHostByNameForNetContextTest : public TestBase {};
+
+TEST_F(GetAddrInfoForNetContextTest, InvalidParameters) {
+    // Both null "netcontext" and null "res" of android_getaddrinfofornetcontext() are not tested
+    // here because they are checked by assert() without returning any error number.
+
+    // Invalid hostname and servname.
+    // Both hostname and servname are null pointers. Expect error number EAI_NONAME.
+    struct addrinfo* result = nullptr;
+    NetworkDnsEventReported event;
+    int rv = android_getaddrinfofornetcontext(nullptr /*hostname*/, nullptr /*servname*/,
+                                              nullptr /*hints*/, &mNetcontext, &result, &event);
+    EXPECT_EQ(EAI_NONAME, rv);
+    if (result) {
+        freeaddrinfo(result);
+        result = nullptr;
+    }
+
+    // Invalid hints.
+    // These place holders are used to test function call with unrequired parameters.
+    // The content is not important because function call returns error directly if
+    // there have any unrequired parameter.
+    char placeholder_cname[] = "invalid_cname";
+    sockaddr placeholder_addr = {};
+    addrinfo placeholder_next = {};
+    static const struct TestConfig {
+        int ai_flags;
+        socklen_t ai_addrlen;
+        char* ai_canonname;
+        struct sockaddr* ai_addr;
+        struct addrinfo* ai_next;
+        int expected_errorno;  // expected result
+
+        std::string asParameters() const {
+            return StringPrintf("0x%x/%u/%s/%p/%p", ai_flags, ai_addrlen,
+                                ai_canonname ? ai_canonname : "(null)", (void*) ai_addr,
+                                (void*) ai_next);
+        }
+    } testConfigs[]{
+            {0, sizeof(struct in_addr) /*bad*/, nullptr, nullptr, nullptr, EAI_BADHINTS},
+            {0, 0, placeholder_cname /*bad*/, nullptr, nullptr, EAI_BADHINTS},
+            {0, 0, nullptr, &placeholder_addr /*bad*/, nullptr, EAI_BADHINTS},
+            {0, 0, nullptr, nullptr, &placeholder_next /*bad*/, EAI_BADHINTS},
+            {AI_ALL /*bad*/, 0, nullptr, nullptr, nullptr, EAI_BADFLAGS},
+            {AI_V4MAPPED_CFG /*bad*/, 0, nullptr, nullptr, nullptr, EAI_BADFLAGS},
+            {AI_V4MAPPED /*bad*/, 0, nullptr, nullptr, nullptr, EAI_BADFLAGS},
+            {AI_DEFAULT /*bad*/, 0, nullptr, nullptr, nullptr, EAI_BADFLAGS},
+    };
+
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(config.asParameters());
+
+        // In current test configuration set, ai_family, ai_protocol and ai_socktype are not
+        // checked because other fields cause hints error check failed first.
+        const struct addrinfo hints = {
+                .ai_flags = config.ai_flags,
+                .ai_family = AF_UNSPEC,
+                .ai_socktype = ANY,
+                .ai_protocol = ANY,
+                .ai_addrlen = config.ai_addrlen,
+                .ai_canonname = config.ai_canonname,
+                .ai_addr = config.ai_addr,
+                .ai_next = config.ai_next,
+        };
+
+        NetworkDnsEventReported event;
+        rv = android_getaddrinfofornetcontext("localhost", nullptr /*servname*/, &hints,
+                                              &mNetcontext, &result, &event);
+        EXPECT_EQ(config.expected_errorno, rv);
+
+        if (result) {
+            freeaddrinfo(result);
+            result = nullptr;
+        }
+    }
+}
+
+TEST_F(GetAddrInfoForNetContextTest, InvalidParameters_Family) {
+    for (int family = 0; family < AF_MAX; ++family) {
+        if (family == AF_UNSPEC || family == AF_INET || family == AF_INET6) {
+            continue;  // skip supported family
+        }
+        SCOPED_TRACE(StringPrintf("family: %d", family));
+
+        struct addrinfo* result = nullptr;
+        const struct addrinfo hints = {
+                .ai_family = family,  // unsupported family
+        };
+
+        NetworkDnsEventReported event;
+        int rv = android_getaddrinfofornetcontext("localhost", nullptr /*servname*/, &hints,
+                                                  &mNetcontext, &result, &event);
+        EXPECT_EQ(EAI_FAMILY, rv);
+
+        if (result) freeaddrinfo(result);
+    }
+}
+
+TEST_F(GetAddrInfoForNetContextTest, InvalidParameters_MeaningfulSocktypeAndProtocolCombination) {
+    static const int families[] = {PF_INET, PF_INET6, PF_UNSPEC};
+    // Skip to test socket type SOCK_RAW in meaningful combination (explore_options[]) of
+    // system\netd\resolv\getaddrinfo.cpp. In explore_options[], the socket type SOCK_RAW always
+    // comes with protocol ANY which causes skipping meaningful socktype/protocol combination
+    // check. So it nerver returns error number EAI_BADHINTS which we want to test in this test
+    // case.
+    static const int socktypes[] = {SOCK_STREAM, SOCK_DGRAM};
+
+    // If both socktype/protocol are specified, check non-meaningful combination returns
+    // expected error number EAI_BADHINTS. See meaningful combination in explore_options[] of
+    // system\netd\resolv\getaddrinfo.cpp.
+    for (const auto& family : families) {
+        for (const auto& socktype : socktypes) {
+            for (int protocol = 0; protocol < IPPROTO_MAX; ++protocol) {
+                SCOPED_TRACE(StringPrintf("family: %d, socktype: %d, protocol: %d", family,
+                                          socktype, protocol));
+
+                // Both socktype/protocol need to be specified.
+                if (!socktype || !protocol) continue;
+
+                // Skip meaningful combination in explore_options[] of
+                // system\netd\resolv\getaddrinfo.cpp.
+                if ((family == AF_INET6 && socktype == SOCK_DGRAM && protocol == IPPROTO_UDP) ||
+                    (family == AF_INET6 && socktype == SOCK_STREAM && protocol == IPPROTO_TCP) ||
+                    (family == AF_INET && socktype == SOCK_DGRAM && protocol == IPPROTO_UDP) ||
+                    (family == AF_INET && socktype == SOCK_STREAM && protocol == IPPROTO_TCP) ||
+                    (family == AF_UNSPEC && socktype == SOCK_DGRAM && protocol == IPPROTO_UDP) ||
+                    (family == AF_UNSPEC && socktype == SOCK_STREAM && protocol == IPPROTO_TCP)) {
+                    continue;
+                }
+
+                struct addrinfo* result = nullptr;
+                const struct addrinfo hints = {
+                        .ai_family = family,
+                        .ai_protocol = protocol,
+                        .ai_socktype = socktype,
+                };
+
+                NetworkDnsEventReported event;
+                int rv = android_getaddrinfofornetcontext("localhost", nullptr /*servname*/, &hints,
+                                                          &mNetcontext, &result, &event);
+                EXPECT_EQ(EAI_BADHINTS, rv);
+
+                if (result) freeaddrinfo(result);
+            }
+        }
+    }
+}
+
+TEST_F(GetAddrInfoForNetContextTest, InvalidParameters_PortNameAndNumber) {
+    constexpr char http_portno[] = "80";
+    constexpr char invalid_portno[] = "65536";  // out of valid port range from 0 to 65535
+    constexpr char http_portname[] = "http";
+    constexpr char invalid_portname[] = "invalid_portname";
+
+    static const struct TestConfig {
+        int ai_flags;
+        int ai_family;
+        int ai_socktype;
+        const char* servname;
+        int expected_errorno;  // expected result
+
+        std::string asParameters() const {
+            return StringPrintf("0x%x/%d/%d/%s", ai_flags, ai_family, ai_socktype,
+                                servname ? servname : "(null)");
+        }
+    } testConfigs[]{
+            {0, AF_INET, SOCK_RAW /*bad*/, http_portno, EAI_SERVICE},
+            {0, AF_INET6, SOCK_RAW /*bad*/, http_portno, EAI_SERVICE},
+            {0, AF_UNSPEC, SOCK_RAW /*bad*/, http_portno, EAI_SERVICE},
+            {0, AF_INET, SOCK_RDM /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET6, SOCK_RDM /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_UNSPEC, SOCK_RDM /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET, SOCK_SEQPACKET /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET6, SOCK_SEQPACKET /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_UNSPEC, SOCK_SEQPACKET /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET, SOCK_DCCP /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET6, SOCK_DCCP /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_UNSPEC, SOCK_DCCP /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET, SOCK_PACKET /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET6, SOCK_PACKET /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_UNSPEC, SOCK_PACKET /*bad*/, http_portno, EAI_SOCKTYPE},
+            {0, AF_INET, ANY, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_INET, SOCK_STREAM, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_INET, SOCK_DGRAM, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_INET6, ANY, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_INET6, SOCK_STREAM, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_INET6, SOCK_DGRAM, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_UNSPEC, ANY, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_UNSPEC, SOCK_STREAM, invalid_portno /*bad*/, EAI_SERVICE},
+            {0, AF_UNSPEC, SOCK_DGRAM, invalid_portno /*bad*/, EAI_SERVICE},
+            {AI_NUMERICSERV, AF_INET, ANY, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_INET, SOCK_STREAM, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_INET, SOCK_DGRAM, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_INET6, ANY, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_INET6, SOCK_STREAM, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_INET6, SOCK_DGRAM, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_UNSPEC, ANY, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_UNSPEC, SOCK_STREAM, http_portname /*bad*/, EAI_NONAME},
+            {AI_NUMERICSERV, AF_UNSPEC, SOCK_DGRAM, http_portname /*bad*/, EAI_NONAME},
+            {0, AF_INET, ANY, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_INET, SOCK_STREAM, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_INET, SOCK_DGRAM, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_INET6, ANY, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_INET6, SOCK_STREAM, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_INET6, SOCK_DGRAM, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_UNSPEC, ANY, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_UNSPEC, SOCK_STREAM, invalid_portname /*bad*/, EAI_SERVICE},
+            {0, AF_UNSPEC, SOCK_DGRAM, invalid_portname /*bad*/, EAI_SERVICE},
+    };
+
+    for (const auto& config : testConfigs) {
+        const std::string testParameters = config.asParameters();
+        SCOPED_TRACE(testParameters);
+
+        const struct addrinfo hints = {
+                .ai_flags = config.ai_flags,
+                .ai_family = config.ai_family,
+                .ai_socktype = config.ai_socktype,
+        };
+
+        struct addrinfo* result = nullptr;
+        NetworkDnsEventReported event;
+        int rv = android_getaddrinfofornetcontext("localhost", config.servname, &hints,
+                                                  &mNetcontext, &result, &event);
+        EXPECT_EQ(config.expected_errorno, rv);
+
+        if (result) freeaddrinfo(result);
+    }
+}
+
+TEST_F(GetAddrInfoForNetContextTest, AlphabeticalHostname_NoData) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char v4_host_name[] = "v4only.example.com.";
+    test::DNSResponder dns(listen_addr, listen_srv, 250, ns_rcode::ns_r_servfail);
+    dns.addMapping(v4_host_name, ns_type::ns_t_a, "1.2.3.3");
+    ASSERT_TRUE(dns.startServer());
+    const char* servers[] = {listen_addr};
+    ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                sizeof(servers) / sizeof(servers[0]),
+                                                mDefaultSearchDomains, &mDefaultParams_Binder));
+    dns.clearQueries();
+
+    // Want AAAA answer but DNS server has A answer only.
+    struct addrinfo* result = nullptr;
+    const addrinfo hints = {.ai_family = AF_INET6};
+    NetworkDnsEventReported event;
+    int rv = android_getaddrinfofornetcontext("v4only", nullptr, &hints, &mNetcontext, &result,
+                                              &event);
+    EXPECT_LE(1U, GetNumQueries(dns, v4_host_name));
+    EXPECT_TRUE(result == nullptr);
+    EXPECT_EQ(EAI_NODATA, rv);
+
+    if (result) freeaddrinfo(result);
+}
+
+TEST_F(GetAddrInfoForNetContextTest, AlphabeticalHostname) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char host_name[] = "sawadee.example.com.";
+    constexpr char v4addr[] = "1.2.3.4";
+    constexpr char v6addr[] = "::1.2.3.4";
+
+    test::DNSResponder dns(listen_addr, listen_srv, 250, ns_rcode::ns_r_servfail);
+    dns.addMapping(host_name, ns_type::ns_t_a, v4addr);
+    dns.addMapping(host_name, ns_type::ns_t_aaaa, v6addr);
+    ASSERT_TRUE(dns.startServer());
+    const char* servers[] = {listen_addr};
+    ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                sizeof(servers) / sizeof(servers[0]),
+                                                mDefaultSearchDomains, &mDefaultParams_Binder));
+
+    static const struct TestConfig {
+        int ai_family;
+        const std::string expected_addr;
+    } testConfigs[]{
+            {AF_INET, v4addr},
+            {AF_INET6, v6addr},
+    };
+
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(StringPrintf("family: %d", config.ai_family));
+        dns.clearQueries();
+
+        struct addrinfo* result = nullptr;
+        const struct addrinfo hints = {.ai_family = config.ai_family};
+        NetworkDnsEventReported event;
+        int rv = android_getaddrinfofornetcontext("sawadee", nullptr, &hints, &mNetcontext, &result,
+                                                  &event);
+        EXPECT_EQ(0, rv);
+        EXPECT_TRUE(result != nullptr);
+        EXPECT_EQ(1U, GetNumQueries(dns, host_name));
+        EXPECT_EQ(config.expected_addr, ToString(result));
+
+        if (result) freeaddrinfo(result);
+    }
+}
+
+TEST_F(GetAddrInfoForNetContextTest, ServerResponseError) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char host_name[] = "hello.example.com.";
+
+    static const struct TestConfig {
+        ns_rcode rcode;
+        int expected_errorno;  // expected result
+
+        // Only test failure RCODE [1..5] in RFC 1035 section 4.1.1 and skip successful RCODE 0
+        // which means no error.
+    } testConfigs[]{
+            // clang-format off
+            {ns_rcode::ns_r_formerr, EAI_FAIL},
+            {ns_rcode::ns_r_servfail, EAI_AGAIN},
+            {ns_rcode::ns_r_nxdomain, EAI_NODATA},
+            {ns_rcode::ns_r_notimpl, EAI_FAIL},
+            {ns_rcode::ns_r_refused, EAI_FAIL},
+            // clang-format on
+    };
+
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(StringPrintf("rcode: %d", config.rcode));
+
+        test::DNSResponder dns(listen_addr, listen_srv, 250,
+                               config.rcode /*response specific rcode*/);
+        dns.addMapping(host_name, ns_type::ns_t_a, "1.2.3.4");
+        dns.setResponseProbability(0.0);  // always ignore requests and response preset rcode
+        ASSERT_TRUE(dns.startServer());
+        const char* servers[] = {listen_addr};
+        ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                    sizeof(servers) / sizeof(servers[0]),
+                                                    mDefaultSearchDomains, &mDefaultParams_Binder));
+
+        struct addrinfo* result = nullptr;
+        const struct addrinfo hints = {.ai_family = AF_UNSPEC};
+        NetworkDnsEventReported event;
+        int rv = android_getaddrinfofornetcontext(host_name, nullptr, &hints, &mNetcontext, &result,
+                                                  &event);
+        EXPECT_EQ(config.expected_errorno, rv);
+
+        if (result) freeaddrinfo(result);
+    }
+}
+
+// TODO: Add private DNS server timeout test.
+TEST_F(GetAddrInfoForNetContextTest, ServerTimeout) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char host_name[] = "hello.example.com.";
+    test::DNSResponder dns(listen_addr, listen_srv, 250, static_cast<ns_rcode>(-1) /*no response*/);
+    dns.addMapping(host_name, ns_type::ns_t_a, "1.2.3.4");
+    dns.setResponseProbability(0.0);  // always ignore requests and don't response
+    ASSERT_TRUE(dns.startServer());
+    const char* servers[] = {listen_addr};
+    ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                sizeof(servers) / sizeof(servers[0]),
+                                                mDefaultSearchDomains, &mDefaultParams_Binder));
+
+    struct addrinfo* result = nullptr;
+    const struct addrinfo hints = {.ai_family = AF_UNSPEC};
+    NetworkDnsEventReported event;
+    int rv = android_getaddrinfofornetcontext("hello", nullptr, &hints, &mNetcontext, &result,
+                                              &event);
+    EXPECT_EQ(NETD_RESOLV_TIMEOUT, rv);
+
+    if (result) freeaddrinfo(result);
+}
+
+TEST_F(GetHostByNameForNetContextTest, AlphabeticalHostname) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char host_name[] = "jiababuei.example.com.";
+    constexpr char v4addr[] = "1.2.3.4";
+    constexpr char v6addr[] = "::1.2.3.4";
+
+    test::DNSResponder dns(listen_addr, listen_srv, 250, ns_rcode::ns_r_servfail);
+    dns.addMapping(host_name, ns_type::ns_t_a, v4addr);
+    dns.addMapping(host_name, ns_type::ns_t_aaaa, v6addr);
+    ASSERT_TRUE(dns.startServer());
+    const char* servers[] = {listen_addr};
+    ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                sizeof(servers) / sizeof(servers[0]),
+                                                mDefaultSearchDomains, &mDefaultParams_Binder));
+
+    static const struct TestConfig {
+        int ai_family;
+        const std::string expected_addr;
+    } testConfigs[]{
+            {AF_INET, v4addr},
+            {AF_INET6, v6addr},
+    };
+
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(StringPrintf("family: %d", config.ai_family));
+        dns.clearQueries();
+
+        struct hostent* hp = nullptr;
+        NetworkDnsEventReported event;
+        int rv = android_gethostbynamefornetcontext("jiababuei", config.ai_family, &mNetcontext,
+                                                    &hp, &event);
+        EXPECT_EQ(0, rv);
+        EXPECT_TRUE(hp != nullptr);
+        EXPECT_EQ(1U, GetNumQueries(dns, host_name));
+        EXPECT_EQ(config.expected_addr, ToString(hp));
+    }
+}
+
+TEST_F(GetHostByNameForNetContextTest, NoData) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char v4_host_name[] = "v4only.example.com.";
+    test::DNSResponder dns(listen_addr, listen_srv, 250, ns_rcode::ns_r_servfail);
+    dns.addMapping(v4_host_name, ns_type::ns_t_a, "1.2.3.3");
+    ASSERT_TRUE(dns.startServer());
+    const char* servers[] = {listen_addr};
+    ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                sizeof(servers) / sizeof(servers[0]),
+                                                mDefaultSearchDomains, &mDefaultParams_Binder));
+    dns.clearQueries();
+
+    // Want AAAA answer but DNS server has A answer only.
+    struct hostent* hp = nullptr;
+    NetworkDnsEventReported event;
+    int rv = android_gethostbynamefornetcontext("v4only", AF_INET6, &mNetcontext, &hp, &event);
+    EXPECT_LE(1U, GetNumQueries(dns, v4_host_name));
+    EXPECT_TRUE(hp == nullptr);
+    EXPECT_EQ(EAI_NODATA, rv);
+}
+
+TEST_F(GetHostByNameForNetContextTest, ServerResponseError) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char host_name[] = "hello.example.com.";
+
+    static const struct TestConfig {
+        ns_rcode rcode;
+        int expected_errorno;  // expected result
+
+        // Only test failure RCODE [1..5] in RFC 1035 section 4.1.1 and skip successful RCODE 0
+        // which means no error. Note that the return error codes aren't mapped by rcode in the
+        // test case SERVFAIL, NOTIMP and REFUSED. See the comment of res_nsend()
+        // in system\netd\resolv\res_query.cpp for more detail.
+    } testConfigs[]{
+            // clang-format off
+            {ns_rcode::ns_r_formerr, EAI_FAIL},
+            {ns_rcode::ns_r_servfail, EAI_AGAIN},  // Not mapped by rcode.
+            {ns_rcode::ns_r_nxdomain, EAI_NODATA},
+            {ns_rcode::ns_r_notimpl, EAI_AGAIN},  // Not mapped by rcode.
+            {ns_rcode::ns_r_refused, EAI_AGAIN},  // Not mapped by rcode.
+            // clang-format on
+    };
+
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(StringPrintf("rcode: %d", config.rcode));
+
+        test::DNSResponder dns(listen_addr, listen_srv, 250,
+                               config.rcode /*response specific rcode*/);
+        dns.addMapping(host_name, ns_type::ns_t_a, "1.2.3.4");
+        dns.setResponseProbability(0.0);  // always ignore requests and response preset rcode
+        ASSERT_TRUE(dns.startServer());
+        const char* servers[] = {listen_addr};
+        ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                    sizeof(servers) / sizeof(servers[0]),
+                                                    mDefaultSearchDomains, &mDefaultParams_Binder));
+
+        struct hostent* hp = nullptr;
+        NetworkDnsEventReported event;
+        int rv = android_gethostbynamefornetcontext(host_name, AF_INET, &mNetcontext, &hp, &event);
+        EXPECT_TRUE(hp == nullptr);
+        EXPECT_EQ(config.expected_errorno, rv);
+    }
+}
+
+// TODO: Add private DNS server timeout test.
+TEST_F(GetHostByNameForNetContextTest, ServerTimeout) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_srv[] = "53";
+    constexpr char host_name[] = "hello.example.com.";
+    test::DNSResponder dns(listen_addr, listen_srv, 250, static_cast<ns_rcode>(-1) /*no response*/);
+    dns.addMapping(host_name, ns_type::ns_t_a, "1.2.3.4");
+    dns.setResponseProbability(0.0);  // always ignore requests and don't response
+    ASSERT_TRUE(dns.startServer());
+    const char* servers[] = {listen_addr};
+    ASSERT_EQ(0, resolv_set_nameservers_for_net(TEST_NETID, servers,
+                                                sizeof(servers) / sizeof(servers[0]),
+                                                mDefaultSearchDomains, &mDefaultParams_Binder));
+
+    struct hostent* hp = nullptr;
+    NetworkDnsEventReported event;
+    int rv = android_gethostbynamefornetcontext(host_name, AF_INET, &mNetcontext, &hp, &event);
+    EXPECT_EQ(NETD_RESOLV_TIMEOUT, rv);
+}
+
+// Note that local host file function, files_getaddrinfo(), of android_getaddrinfofornetcontext()
+// is not tested because it only returns a boolean (success or failure) without any error number.
+
+// TODO: Add test NULL hostname, or numeric hostname for android_getaddrinfofornetcontext.
+// TODO: Add test invalid parameters for android_gethostbynamefornetcontext.
+// TODO: Add test for android_gethostbyaddrfornetcontext.
+
+}  // end of namespace net
+}  // end of namespace android
diff --git a/resolv/res_cache.cpp b/resolv/res_cache.cpp
new file mode 100644
index 0000000..d6f0cd8
--- /dev/null
+++ b/resolv/res_cache.cpp
@@ -0,0 +1,2113 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#define LOG_TAG "res_cache"
+
+#include "resolv_cache.h"
+
+#include <resolv.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include <mutex>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <errno.h>
+#include <linux/if.h>
+#include <net/if.h>
+#include <netdb.h>
+
+#include <android-base/logging.h>
+#include <android-base/parseint.h>
+#include <android-base/stringprintf.h>
+#include <android-base/strings.h>
+#include <android-base/thread_annotations.h>
+#include <android/multinetwork.h>  // ResNsendFlags
+
+#include <server_configurable_flags/get_flags.h>
+
+#include "res_state_ext.h"
+#include "resolv_private.h"
+
+// NOTE: verbose logging MUST NOT be left enabled in production binaries.
+// It floods logs at high rate, and can leak privacy-sensitive information.
+constexpr bool kDumpData = false;
+
+/* This code implements a small and *simple* DNS resolver cache.
+ *
+ * It is only used to cache DNS answers for a time defined by the smallest TTL
+ * among the answer records in order to reduce DNS traffic. It is not supposed
+ * to be a full DNS cache, since we plan to implement that in the future in a
+ * dedicated process running on the system.
+ *
+ * Note that its design is kept simple very intentionally, i.e.:
+ *
+ *  - it takes raw DNS query packet data as input, and returns raw DNS
+ *    answer packet data as output
+ *
+ *    (this means that two similar queries that encode the DNS name
+ *     differently will be treated distinctly).
+ *
+ *    the smallest TTL value among the answer records are used as the time
+ *    to keep an answer in the cache.
+ *
+ *    this is bad, but we absolutely want to avoid parsing the answer packets
+ *    (and should be solved by the later full DNS cache process).
+ *
+ *  - the implementation is just a (query-data) => (answer-data) hash table
+ *    with a trivial least-recently-used expiration policy.
+ *
+ * Doing this keeps the code simple and avoids to deal with a lot of things
+ * that a full DNS cache is expected to do.
+ *
+ * The API is also very simple:
+ *
+ *   - the client calls _resolv_cache_get() to obtain a handle to the cache.
+ *     this will initialize the cache on first usage. the result can be NULL
+ *     if the cache is disabled.
+ *
+ *   - the client calls _resolv_cache_lookup() before performing a query
+ *
+ *     if the function returns RESOLV_CACHE_FOUND, a copy of the answer data
+ *     has been copied into the client-provided answer buffer.
+ *
+ *     if the function returns RESOLV_CACHE_NOTFOUND, the client should perform
+ *     a request normally, *then* call _resolv_cache_add() to add the received
+ *     answer to the cache.
+ *
+ *     if the function returns RESOLV_CACHE_UNSUPPORTED, the client should
+ *     perform a request normally, and *not* call _resolv_cache_add()
+ *
+ *     note that RESOLV_CACHE_UNSUPPORTED is also returned if the answer buffer
+ *     is too short to accomodate the cached result.
+ */
+
+/* default number of entries kept in the cache. This value has been
+ * determined by browsing through various sites and counting the number
+ * of corresponding requests. Keep in mind that our framework is currently
+ * performing two requests per name lookup (one for IPv4, the other for IPv6)
+ *
+ *    www.google.com      4
+ *    www.ysearch.com     6
+ *    www.amazon.com      8
+ *    www.nytimes.com     22
+ *    www.espn.com        28
+ *    www.msn.com         28
+ *    www.lemonde.fr      35
+ *
+ * (determined in 2009-2-17 from Paris, France, results may vary depending
+ *  on location)
+ *
+ * most high-level websites use lots of media/ad servers with different names
+ * but these are generally reused when browsing through the site.
+ *
+ * As such, a value of 64 should be relatively comfortable at the moment.
+ *
+ * ******************************************
+ * * NOTE - this has changed.
+ * * 1) we've added IPv6 support so each dns query results in 2 responses
+ * * 2) we've made this a system-wide cache, so the cost is less (it's not
+ * *    duplicated in each process) and the need is greater (more processes
+ * *    making different requests).
+ * * Upping by 2x for IPv6
+ * * Upping by another 5x for the centralized nature
+ * *****************************************
+ */
+#define CONFIG_MAX_ENTRIES (64 * 2 * 5)
+
+/** BOUNDED BUFFER FORMATTING **/
+
+/* technical note:
+ *
+ *   the following debugging routines are used to append data to a bounded
+ *   buffer they take two parameters that are:
+ *
+ *   - p : a pointer to the current cursor position in the buffer
+ *         this value is initially set to the buffer's address.
+ *
+ *   - end : the address of the buffer's limit, i.e. of the first byte
+ *           after the buffer. this address should never be touched.
+ *
+ *           IMPORTANT: it is assumed that end > buffer_address, i.e.
+ *                      that the buffer is at least one byte.
+ *
+ *   the bprint_x() functions return the new value of 'p' after the data
+ *   has been appended, and also ensure the following:
+ *
+ *   - the returned value will never be strictly greater than 'end'
+ *
+ *   - a return value equal to 'end' means that truncation occurred
+ *     (in which case, end[-1] will be set to 0)
+ *
+ *   - after returning from a bprint_x() function, the content of the buffer
+ *     is always 0-terminated, even in the event of truncation.
+ *
+ *  these conventions allow you to call bprint_x() functions multiple times and
+ *  only check for truncation at the end of the sequence, as in:
+ *
+ *     char  buff[1000], *p = buff, *end = p + sizeof(buff);
+ *
+ *     p = bprint_c(p, end, '"');
+ *     p = bprint_s(p, end, my_string);
+ *     p = bprint_c(p, end, '"');
+ *
+ *     if (p >= end) {
+ *        // buffer was too small
+ *     }
+ *
+ *     printf( "%s", buff );
+ */
+
+/* Defaults used for initializing res_params */
+
+// If successes * 100 / total_samples is less than this value, the server is considered failing
+#define SUCCESS_THRESHOLD 75
+// Sample validity in seconds. Set to -1 to disable skipping failing servers.
+#define NSSAMPLE_VALIDITY 1800
+
+/* add a char to a bounded buffer */
+static char* bprint_c(char* p, char* end, int c) {
+    if (p < end) {
+        if (p + 1 == end)
+            *p++ = 0;
+        else {
+            *p++ = (char) c;
+            *p = 0;
+        }
+    }
+    return p;
+}
+
+/* add a sequence of bytes to a bounded buffer */
+static char* bprint_b(char* p, char* end, const char* buf, int len) {
+    int avail = end - p;
+
+    if (avail <= 0 || len <= 0) return p;
+
+    if (avail > len) avail = len;
+
+    memcpy(p, buf, avail);
+    p += avail;
+
+    if (p < end)
+        p[0] = 0;
+    else
+        end[-1] = 0;
+
+    return p;
+}
+
+/* add a string to a bounded buffer */
+static char* bprint_s(char* p, char* end, const char* str) {
+    return bprint_b(p, end, str, strlen(str));
+}
+
+/* add a formatted string to a bounded buffer */
+static char* bprint(char* p, char* end, const char* format, ...) {
+    int avail, n;
+    va_list args;
+
+    avail = end - p;
+
+    if (avail <= 0) return p;
+
+    va_start(args, format);
+    n = vsnprintf(p, avail, format, args);
+    va_end(args);
+
+    /* certain C libraries return -1 in case of truncation */
+    if (n < 0 || n > avail) n = avail;
+
+    p += n;
+    /* certain C libraries do not zero-terminate in case of truncation */
+    if (p == end) p[-1] = 0;
+
+    return p;
+}
+
+/* add a hex value to a bounded buffer, up to 8 digits */
+static char* bprint_hex(char* p, char* end, unsigned value, int numDigits) {
+    char text[sizeof(unsigned) * 2];
+    int nn = 0;
+
+    while (numDigits-- > 0) {
+        text[nn++] = "0123456789abcdef"[(value >> (numDigits * 4)) & 15];
+    }
+    return bprint_b(p, end, text, nn);
+}
+
+/* add the hexadecimal dump of some memory area to a bounded buffer */
+static char* bprint_hexdump(char* p, char* end, const uint8_t* data, int datalen) {
+    int lineSize = 16;
+
+    while (datalen > 0) {
+        int avail = datalen;
+        int nn;
+
+        if (avail > lineSize) avail = lineSize;
+
+        for (nn = 0; nn < avail; nn++) {
+            if (nn > 0) p = bprint_c(p, end, ' ');
+            p = bprint_hex(p, end, data[nn], 2);
+        }
+        for (; nn < lineSize; nn++) {
+            p = bprint_s(p, end, "   ");
+        }
+        p = bprint_s(p, end, "  ");
+
+        for (nn = 0; nn < avail; nn++) {
+            int c = data[nn];
+
+            if (c < 32 || c > 127) c = '.';
+
+            p = bprint_c(p, end, c);
+        }
+        p = bprint_c(p, end, '\n');
+
+        data += avail;
+        datalen -= avail;
+    }
+    return p;
+}
+
+/* dump the content of a query of packet to the log */
+static void dump_bytes(const uint8_t* base, int len) {
+    if (!kDumpData) return;
+
+    char buff[1024];
+    char *p = buff, *end = p + sizeof(buff);
+
+    p = bprint_hexdump(p, end, base, len);
+    LOG(INFO) << __func__ << ": " << buff;
+}
+
+static time_t _time_now(void) {
+    struct timeval tv;
+
+    gettimeofday(&tv, NULL);
+    return tv.tv_sec;
+}
+
+/* reminder: the general format of a DNS packet is the following:
+ *
+ *    HEADER  (12 bytes)
+ *    QUESTION  (variable)
+ *    ANSWER (variable)
+ *    AUTHORITY (variable)
+ *    ADDITIONNAL (variable)
+ *
+ * the HEADER is made of:
+ *
+ *   ID     : 16 : 16-bit unique query identification field
+ *
+ *   QR     :  1 : set to 0 for queries, and 1 for responses
+ *   Opcode :  4 : set to 0 for queries
+ *   AA     :  1 : set to 0 for queries
+ *   TC     :  1 : truncation flag, will be set to 0 in queries
+ *   RD     :  1 : recursion desired
+ *
+ *   RA     :  1 : recursion available (0 in queries)
+ *   Z      :  3 : three reserved zero bits
+ *   RCODE  :  4 : response code (always 0=NOERROR in queries)
+ *
+ *   QDCount: 16 : question count
+ *   ANCount: 16 : Answer count (0 in queries)
+ *   NSCount: 16: Authority Record count (0 in queries)
+ *   ARCount: 16: Additionnal Record count (0 in queries)
+ *
+ * the QUESTION is made of QDCount Question Record (QRs)
+ * the ANSWER is made of ANCount RRs
+ * the AUTHORITY is made of NSCount RRs
+ * the ADDITIONNAL is made of ARCount RRs
+ *
+ * Each Question Record (QR) is made of:
+ *
+ *   QNAME   : variable : Query DNS NAME
+ *   TYPE    : 16       : type of query (A=1, PTR=12, MX=15, AAAA=28, ALL=255)
+ *   CLASS   : 16       : class of query (IN=1)
+ *
+ * Each Resource Record (RR) is made of:
+ *
+ *   NAME    : variable : DNS NAME
+ *   TYPE    : 16       : type of query (A=1, PTR=12, MX=15, AAAA=28, ALL=255)
+ *   CLASS   : 16       : class of query (IN=1)
+ *   TTL     : 32       : seconds to cache this RR (0=none)
+ *   RDLENGTH: 16       : size of RDDATA in bytes
+ *   RDDATA  : variable : RR data (depends on TYPE)
+ *
+ * Each QNAME contains a domain name encoded as a sequence of 'labels'
+ * terminated by a zero. Each label has the following format:
+ *
+ *    LEN  : 8     : lenght of label (MUST be < 64)
+ *    NAME : 8*LEN : label length (must exclude dots)
+ *
+ * A value of 0 in the encoding is interpreted as the 'root' domain and
+ * terminates the encoding. So 'www.android.com' will be encoded as:
+ *
+ *   <3>www<7>android<3>com<0>
+ *
+ * Where <n> represents the byte with value 'n'
+ *
+ * Each NAME reflects the QNAME of the question, but has a slightly more
+ * complex encoding in order to provide message compression. This is achieved
+ * by using a 2-byte pointer, with format:
+ *
+ *    TYPE   : 2  : 0b11 to indicate a pointer, 0b01 and 0b10 are reserved
+ *    OFFSET : 14 : offset to another part of the DNS packet
+ *
+ * The offset is relative to the start of the DNS packet and must point
+ * A pointer terminates the encoding.
+ *
+ * The NAME can be encoded in one of the following formats:
+ *
+ *   - a sequence of simple labels terminated by 0 (like QNAMEs)
+ *   - a single pointer
+ *   - a sequence of simple labels terminated by a pointer
+ *
+ * A pointer shall always point to either a pointer of a sequence of
+ * labels (which can themselves be terminated by either a 0 or a pointer)
+ *
+ * The expanded length of a given domain name should not exceed 255 bytes.
+ *
+ * NOTE: we don't parse the answer packets, so don't need to deal with NAME
+ *       records, only QNAMEs.
+ */
+
+#define DNS_HEADER_SIZE 12
+
+#define DNS_TYPE_A "\00\01"     /* big-endian decimal 1 */
+#define DNS_TYPE_PTR "\00\014"  /* big-endian decimal 12 */
+#define DNS_TYPE_MX "\00\017"   /* big-endian decimal 15 */
+#define DNS_TYPE_AAAA "\00\034" /* big-endian decimal 28 */
+#define DNS_TYPE_ALL "\00\0377" /* big-endian decimal 255 */
+
+#define DNS_CLASS_IN "\00\01" /* big-endian decimal 1 */
+
+typedef struct {
+    const uint8_t* base;
+    const uint8_t* end;
+    const uint8_t* cursor;
+} DnsPacket;
+
+static void _dnsPacket_init(DnsPacket* packet, const uint8_t* buff, int bufflen) {
+    packet->base = buff;
+    packet->end = buff + bufflen;
+    packet->cursor = buff;
+}
+
+static void _dnsPacket_rewind(DnsPacket* packet) {
+    packet->cursor = packet->base;
+}
+
+static void _dnsPacket_skip(DnsPacket* packet, int count) {
+    const uint8_t* p = packet->cursor + count;
+
+    if (p > packet->end) p = packet->end;
+
+    packet->cursor = p;
+}
+
+static int _dnsPacket_readInt16(DnsPacket* packet) {
+    const uint8_t* p = packet->cursor;
+
+    if (p + 2 > packet->end) return -1;
+
+    packet->cursor = p + 2;
+    return (p[0] << 8) | p[1];
+}
+
+/** QUERY CHECKING **/
+
+/* check bytes in a dns packet. returns 1 on success, 0 on failure.
+ * the cursor is only advanced in the case of success
+ */
+static int _dnsPacket_checkBytes(DnsPacket* packet, int numBytes, const void* bytes) {
+    const uint8_t* p = packet->cursor;
+
+    if (p + numBytes > packet->end) return 0;
+
+    if (memcmp(p, bytes, numBytes) != 0) return 0;
+
+    packet->cursor = p + numBytes;
+    return 1;
+}
+
+/* parse and skip a given QNAME stored in a query packet,
+ * from the current cursor position. returns 1 on success,
+ * or 0 for malformed data.
+ */
+static int _dnsPacket_checkQName(DnsPacket* packet) {
+    const uint8_t* p = packet->cursor;
+    const uint8_t* end = packet->end;
+
+    for (;;) {
+        int c;
+
+        if (p >= end) break;
+
+        c = *p++;
+
+        if (c == 0) {
+            packet->cursor = p;
+            return 1;
+        }
+
+        /* we don't expect label compression in QNAMEs */
+        if (c >= 64) break;
+
+        p += c;
+        /* we rely on the bound check at the start
+         * of the loop here */
+    }
+    /* malformed data */
+    LOG(INFO) << __func__ << ": malformed QNAME";
+    return 0;
+}
+
+/* parse and skip a given QR stored in a packet.
+ * returns 1 on success, and 0 on failure
+ */
+static int _dnsPacket_checkQR(DnsPacket* packet) {
+    if (!_dnsPacket_checkQName(packet)) return 0;
+
+    /* TYPE must be one of the things we support */
+    if (!_dnsPacket_checkBytes(packet, 2, DNS_TYPE_A) &&
+        !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_PTR) &&
+        !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_MX) &&
+        !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_AAAA) &&
+        !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_ALL)) {
+        LOG(INFO) << __func__ << ": unsupported TYPE";
+        return 0;
+    }
+    /* CLASS must be IN */
+    if (!_dnsPacket_checkBytes(packet, 2, DNS_CLASS_IN)) {
+        LOG(INFO) << __func__ << ": unsupported CLASS";
+        return 0;
+    }
+
+    return 1;
+}
+
+/* check the header of a DNS Query packet, return 1 if it is one
+ * type of query we can cache, or 0 otherwise
+ */
+static int _dnsPacket_checkQuery(DnsPacket* packet) {
+    const uint8_t* p = packet->base;
+    int qdCount, anCount, dnCount, arCount;
+
+    if (p + DNS_HEADER_SIZE > packet->end) {
+        LOG(INFO) << __func__ << ": query packet too small";
+        return 0;
+    }
+
+    /* QR must be set to 0, opcode must be 0 and AA must be 0 */
+    /* RA, Z, and RCODE must be 0 */
+    if ((p[2] & 0xFC) != 0 || (p[3] & 0xCF) != 0) {
+        LOG(INFO) << __func__ << ": query packet flags unsupported";
+        return 0;
+    }
+
+    /* Note that we ignore the TC, RD, CD, and AD bits here for the
+     * following reasons:
+     *
+     * - there is no point for a query packet sent to a server
+     *   to have the TC bit set, but the implementation might
+     *   set the bit in the query buffer for its own needs
+     *   between a _resolv_cache_lookup and a
+     *   _resolv_cache_add. We should not freak out if this
+     *   is the case.
+     *
+     * - we consider that the result from a query might depend on
+     *   the RD, AD, and CD bits, so these bits
+     *   should be used to differentiate cached result.
+     *
+     *   this implies that these bits are checked when hashing or
+     *   comparing query packets, but not TC
+     */
+
+    /* ANCOUNT, DNCOUNT and ARCOUNT must be 0 */
+    qdCount = (p[4] << 8) | p[5];
+    anCount = (p[6] << 8) | p[7];
+    dnCount = (p[8] << 8) | p[9];
+    arCount = (p[10] << 8) | p[11];
+
+    if (anCount != 0 || dnCount != 0 || arCount > 1) {
+        LOG(INFO) << __func__ << ": query packet contains non-query records";
+        return 0;
+    }
+
+    if (qdCount == 0) {
+        LOG(INFO) << __func__ << ": query packet doesn't contain query record";
+        return 0;
+    }
+
+    /* Check QDCOUNT QRs */
+    packet->cursor = p + DNS_HEADER_SIZE;
+
+    for (; qdCount > 0; qdCount--)
+        if (!_dnsPacket_checkQR(packet)) return 0;
+
+    return 1;
+}
+
+/** QUERY DEBUGGING **/
+static char* dnsPacket_bprintQName(DnsPacket* packet, char* bp, char* bend) {
+    const uint8_t* p = packet->cursor;
+    const uint8_t* end = packet->end;
+    int first = 1;
+
+    for (;;) {
+        int c;
+
+        if (p >= end) break;
+
+        c = *p++;
+
+        if (c == 0) {
+            packet->cursor = p;
+            return bp;
+        }
+
+        /* we don't expect label compression in QNAMEs */
+        if (c >= 64) break;
+
+        if (first)
+            first = 0;
+        else
+            bp = bprint_c(bp, bend, '.');
+
+        bp = bprint_b(bp, bend, (const char*) p, c);
+
+        p += c;
+        /* we rely on the bound check at the start
+         * of the loop here */
+    }
+    /* malformed data */
+    bp = bprint_s(bp, bend, "<MALFORMED>");
+    return bp;
+}
+
+static char* dnsPacket_bprintQR(DnsPacket* packet, char* p, char* end) {
+#define QQ(x) \
+    { DNS_TYPE_##x, #x }
+    static const struct {
+        const char* typeBytes;
+        const char* typeString;
+    } qTypes[] = {QQ(A), QQ(PTR), QQ(MX), QQ(AAAA), QQ(ALL), {NULL, NULL}};
+    int nn;
+    const char* typeString = NULL;
+
+    /* dump QNAME */
+    p = dnsPacket_bprintQName(packet, p, end);
+
+    /* dump TYPE */
+    p = bprint_s(p, end, " (");
+
+    for (nn = 0; qTypes[nn].typeBytes != NULL; nn++) {
+        if (_dnsPacket_checkBytes(packet, 2, qTypes[nn].typeBytes)) {
+            typeString = qTypes[nn].typeString;
+            break;
+        }
+    }
+
+    if (typeString != NULL)
+        p = bprint_s(p, end, typeString);
+    else {
+        int typeCode = _dnsPacket_readInt16(packet);
+        p = bprint(p, end, "UNKNOWN-%d", typeCode);
+    }
+
+    p = bprint_c(p, end, ')');
+
+    /* skip CLASS */
+    _dnsPacket_skip(packet, 2);
+    return p;
+}
+
+/* this function assumes the packet has already been checked */
+static char* dnsPacket_bprintQuery(DnsPacket* packet, char* p, char* end) {
+    int qdCount;
+
+    if (packet->base[2] & 0x1) {
+        p = bprint_s(p, end, "RECURSIVE ");
+    }
+
+    _dnsPacket_skip(packet, 4);
+    qdCount = _dnsPacket_readInt16(packet);
+    _dnsPacket_skip(packet, 6);
+
+    for (; qdCount > 0; qdCount--) {
+        p = dnsPacket_bprintQR(packet, p, end);
+    }
+    return p;
+}
+
+/** QUERY HASHING SUPPORT
+ **
+ ** THE FOLLOWING CODE ASSUMES THAT THE INPUT PACKET HAS ALREADY
+ ** BEEN SUCCESFULLY CHECKED.
+ **/
+
+/* use 32-bit FNV hash function */
+#define FNV_MULT 16777619U
+#define FNV_BASIS 2166136261U
+
+static unsigned _dnsPacket_hashBytes(DnsPacket* packet, int numBytes, unsigned hash) {
+    const uint8_t* p = packet->cursor;
+    const uint8_t* end = packet->end;
+
+    while (numBytes > 0 && p < end) {
+        hash = hash * FNV_MULT ^ *p++;
+    }
+    packet->cursor = p;
+    return hash;
+}
+
+static unsigned _dnsPacket_hashQName(DnsPacket* packet, unsigned hash) {
+    const uint8_t* p = packet->cursor;
+    const uint8_t* end = packet->end;
+
+    for (;;) {
+        int c;
+
+        if (p >= end) { /* should not happen */
+            LOG(INFO) << __func__ << ": INTERNAL_ERROR: read-overflow";
+            break;
+        }
+
+        c = *p++;
+
+        if (c == 0) break;
+
+        if (c >= 64) {
+            LOG(INFO) << __func__ << ": INTERNAL_ERROR: malformed domain";
+            break;
+        }
+        if (p + c >= end) {
+            LOG(INFO) << __func__ << ": INTERNAL_ERROR: simple label read-overflow";
+            break;
+        }
+        while (c > 0) {
+            hash = hash * FNV_MULT ^ *p++;
+            c -= 1;
+        }
+    }
+    packet->cursor = p;
+    return hash;
+}
+
+static unsigned _dnsPacket_hashQR(DnsPacket* packet, unsigned hash) {
+    hash = _dnsPacket_hashQName(packet, hash);
+    hash = _dnsPacket_hashBytes(packet, 4, hash); /* TYPE and CLASS */
+    return hash;
+}
+
+static unsigned _dnsPacket_hashRR(DnsPacket* packet, unsigned hash) {
+    int rdlength;
+    hash = _dnsPacket_hashQR(packet, hash);
+    hash = _dnsPacket_hashBytes(packet, 4, hash); /* TTL */
+    rdlength = _dnsPacket_readInt16(packet);
+    hash = _dnsPacket_hashBytes(packet, rdlength, hash); /* RDATA */
+    return hash;
+}
+
+static unsigned _dnsPacket_hashQuery(DnsPacket* packet) {
+    unsigned hash = FNV_BASIS;
+    int count, arcount;
+    _dnsPacket_rewind(packet);
+
+    /* ignore the ID */
+    _dnsPacket_skip(packet, 2);
+
+    /* we ignore the TC bit for reasons explained in
+     * _dnsPacket_checkQuery().
+     *
+     * however we hash the RD bit to differentiate
+     * between answers for recursive and non-recursive
+     * queries.
+     */
+    hash = hash * FNV_MULT ^ (packet->base[2] & 1);
+
+    /* mark the first header byte as processed */
+    _dnsPacket_skip(packet, 1);
+
+    /* process the second header byte */
+    hash = _dnsPacket_hashBytes(packet, 1, hash);
+
+    /* read QDCOUNT */
+    count = _dnsPacket_readInt16(packet);
+
+    /* assume: ANcount and NScount are 0 */
+    _dnsPacket_skip(packet, 4);
+
+    /* read ARCOUNT */
+    arcount = _dnsPacket_readInt16(packet);
+
+    /* hash QDCOUNT QRs */
+    for (; count > 0; count--) hash = _dnsPacket_hashQR(packet, hash);
+
+    /* hash ARCOUNT RRs */
+    for (; arcount > 0; arcount--) hash = _dnsPacket_hashRR(packet, hash);
+
+    return hash;
+}
+
+/** QUERY COMPARISON
+ **
+ ** THE FOLLOWING CODE ASSUMES THAT THE INPUT PACKETS HAVE ALREADY
+ ** BEEN SUCCESSFULLY CHECKED.
+ **/
+
+static int _dnsPacket_isEqualDomainName(DnsPacket* pack1, DnsPacket* pack2) {
+    const uint8_t* p1 = pack1->cursor;
+    const uint8_t* end1 = pack1->end;
+    const uint8_t* p2 = pack2->cursor;
+    const uint8_t* end2 = pack2->end;
+
+    for (;;) {
+        int c1, c2;
+
+        if (p1 >= end1 || p2 >= end2) {
+            LOG(INFO) << __func__ << ": INTERNAL_ERROR: read-overflow";
+            break;
+        }
+        c1 = *p1++;
+        c2 = *p2++;
+        if (c1 != c2) break;
+
+        if (c1 == 0) {
+            pack1->cursor = p1;
+            pack2->cursor = p2;
+            return 1;
+        }
+        if (c1 >= 64) {
+            LOG(INFO) << __func__ << ": INTERNAL_ERROR: malformed domain";
+            break;
+        }
+        if ((p1 + c1 > end1) || (p2 + c1 > end2)) {
+            LOG(INFO) << __func__ << ": INTERNAL_ERROR: simple label read-overflow";
+            break;
+        }
+        if (memcmp(p1, p2, c1) != 0) break;
+        p1 += c1;
+        p2 += c1;
+        /* we rely on the bound checks at the start of the loop */
+    }
+    /* not the same, or one is malformed */
+    LOG(INFO) << __func__ << ": different DN";
+    return 0;
+}
+
+static int _dnsPacket_isEqualBytes(DnsPacket* pack1, DnsPacket* pack2, int numBytes) {
+    const uint8_t* p1 = pack1->cursor;
+    const uint8_t* p2 = pack2->cursor;
+
+    if (p1 + numBytes > pack1->end || p2 + numBytes > pack2->end) return 0;
+
+    if (memcmp(p1, p2, numBytes) != 0) return 0;
+
+    pack1->cursor += numBytes;
+    pack2->cursor += numBytes;
+    return 1;
+}
+
+static int _dnsPacket_isEqualQR(DnsPacket* pack1, DnsPacket* pack2) {
+    /* compare domain name encoding + TYPE + CLASS */
+    if (!_dnsPacket_isEqualDomainName(pack1, pack2) ||
+        !_dnsPacket_isEqualBytes(pack1, pack2, 2 + 2))
+        return 0;
+
+    return 1;
+}
+
+static int _dnsPacket_isEqualRR(DnsPacket* pack1, DnsPacket* pack2) {
+    int rdlength1, rdlength2;
+    /* compare query + TTL */
+    if (!_dnsPacket_isEqualQR(pack1, pack2) || !_dnsPacket_isEqualBytes(pack1, pack2, 4)) return 0;
+
+    /* compare RDATA */
+    rdlength1 = _dnsPacket_readInt16(pack1);
+    rdlength2 = _dnsPacket_readInt16(pack2);
+    if (rdlength1 != rdlength2 || !_dnsPacket_isEqualBytes(pack1, pack2, rdlength1)) return 0;
+
+    return 1;
+}
+
+static int _dnsPacket_isEqualQuery(DnsPacket* pack1, DnsPacket* pack2) {
+    int count1, count2, arcount1, arcount2;
+
+    /* compare the headers, ignore most fields */
+    _dnsPacket_rewind(pack1);
+    _dnsPacket_rewind(pack2);
+
+    /* compare RD, ignore TC, see comment in _dnsPacket_checkQuery */
+    if ((pack1->base[2] & 1) != (pack2->base[2] & 1)) {
+        LOG(INFO) << __func__ << ": different RD";
+        return 0;
+    }
+
+    if (pack1->base[3] != pack2->base[3]) {
+        LOG(INFO) << __func__ << ": different CD or AD";
+        return 0;
+    }
+
+    /* mark ID and header bytes as compared */
+    _dnsPacket_skip(pack1, 4);
+    _dnsPacket_skip(pack2, 4);
+
+    /* compare QDCOUNT */
+    count1 = _dnsPacket_readInt16(pack1);
+    count2 = _dnsPacket_readInt16(pack2);
+    if (count1 != count2 || count1 < 0) {
+        LOG(INFO) << __func__ << ": different QDCOUNT";
+        return 0;
+    }
+
+    /* assume: ANcount and NScount are 0 */
+    _dnsPacket_skip(pack1, 4);
+    _dnsPacket_skip(pack2, 4);
+
+    /* compare ARCOUNT */
+    arcount1 = _dnsPacket_readInt16(pack1);
+    arcount2 = _dnsPacket_readInt16(pack2);
+    if (arcount1 != arcount2 || arcount1 < 0) {
+        LOG(INFO) << __func__ << ": different ARCOUNT";
+        return 0;
+    }
+
+    /* compare the QDCOUNT QRs */
+    for (; count1 > 0; count1--) {
+        if (!_dnsPacket_isEqualQR(pack1, pack2)) {
+            LOG(INFO) << __func__ << ": different QR";
+            return 0;
+        }
+    }
+
+    /* compare the ARCOUNT RRs */
+    for (; arcount1 > 0; arcount1--) {
+        if (!_dnsPacket_isEqualRR(pack1, pack2)) {
+            LOG(INFO) << __func__ << ": different additional RR";
+            return 0;
+        }
+    }
+    return 1;
+}
+
+/* cache entry. for simplicity, 'hash' and 'hlink' are inlined in this
+ * structure though they are conceptually part of the hash table.
+ *
+ * similarly, mru_next and mru_prev are part of the global MRU list
+ */
+typedef struct Entry {
+    unsigned int hash;   /* hash value */
+    struct Entry* hlink; /* next in collision chain */
+    struct Entry* mru_prev;
+    struct Entry* mru_next;
+
+    const uint8_t* query;
+    int querylen;
+    const uint8_t* answer;
+    int answerlen;
+    time_t expires; /* time_t when the entry isn't valid any more */
+    int id;         /* for debugging purpose */
+} Entry;
+
+/*
+ * Find the TTL for a negative DNS result.  This is defined as the minimum
+ * of the SOA records TTL and the MINIMUM-TTL field (RFC-2308).
+ *
+ * Return 0 if not found.
+ */
+static u_long answer_getNegativeTTL(ns_msg handle) {
+    int n, nscount;
+    u_long result = 0;
+    ns_rr rr;
+
+    nscount = ns_msg_count(handle, ns_s_ns);
+    for (n = 0; n < nscount; n++) {
+        if ((ns_parserr(&handle, ns_s_ns, n, &rr) == 0) && (ns_rr_type(rr) == ns_t_soa)) {
+            const u_char* rdata = ns_rr_rdata(rr);          // find the data
+            const u_char* edata = rdata + ns_rr_rdlen(rr);  // add the len to find the end
+            int len;
+            u_long ttl, rec_result = ns_rr_ttl(rr);
+
+            // find the MINIMUM-TTL field from the blob of binary data for this record
+            // skip the server name
+            len = dn_skipname(rdata, edata);
+            if (len == -1) continue;  // error skipping
+            rdata += len;
+
+            // skip the admin name
+            len = dn_skipname(rdata, edata);
+            if (len == -1) continue;  // error skipping
+            rdata += len;
+
+            if (edata - rdata != 5 * NS_INT32SZ) continue;
+            // skip: serial number + refresh interval + retry interval + expiry
+            rdata += NS_INT32SZ * 4;
+            // finally read the MINIMUM TTL
+            ttl = ntohl(*reinterpret_cast<const uint32_t*>(rdata));
+            if (ttl < rec_result) {
+                rec_result = ttl;
+            }
+            // Now that the record is read successfully, apply the new min TTL
+            if (n == 0 || rec_result < result) {
+                result = rec_result;
+            }
+        }
+    }
+    return result;
+}
+
+/*
+ * Parse the answer records and find the appropriate
+ * smallest TTL among the records.  This might be from
+ * the answer records if found or from the SOA record
+ * if it's a negative result.
+ *
+ * The returned TTL is the number of seconds to
+ * keep the answer in the cache.
+ *
+ * In case of parse error zero (0) is returned which
+ * indicates that the answer shall not be cached.
+ */
+static u_long answer_getTTL(const void* answer, int answerlen) {
+    ns_msg handle;
+    int ancount, n;
+    u_long result, ttl;
+    ns_rr rr;
+
+    result = 0;
+    if (ns_initparse((const uint8_t*) answer, answerlen, &handle) >= 0) {
+        // get number of answer records
+        ancount = ns_msg_count(handle, ns_s_an);
+
+        if (ancount == 0) {
+            // a response with no answers?  Cache this negative result.
+            result = answer_getNegativeTTL(handle);
+        } else {
+            for (n = 0; n < ancount; n++) {
+                if (ns_parserr(&handle, ns_s_an, n, &rr) == 0) {
+                    ttl = ns_rr_ttl(rr);
+                    if (n == 0 || ttl < result) {
+                        result = ttl;
+                    }
+                } else {
+                    PLOG(INFO) << __func__ << ": ns_parserr failed ancount no = " << n;
+                }
+            }
+        }
+    } else {
+        PLOG(INFO) << __func__ << ": ns_initparse failed";
+    }
+
+    LOG(INFO) << __func__ << ": TTL = " << result;
+    return result;
+}
+
+static void entry_free(Entry* e) {
+    /* everything is allocated in a single memory block */
+    if (e) {
+        free(e);
+    }
+}
+
+static void entry_mru_remove(Entry* e) {
+    e->mru_prev->mru_next = e->mru_next;
+    e->mru_next->mru_prev = e->mru_prev;
+}
+
+static void entry_mru_add(Entry* e, Entry* list) {
+    Entry* first = list->mru_next;
+
+    e->mru_next = first;
+    e->mru_prev = list;
+
+    list->mru_next = e;
+    first->mru_prev = e;
+}
+
+/* compute the hash of a given entry, this is a hash of most
+ * data in the query (key) */
+static unsigned entry_hash(const Entry* e) {
+    DnsPacket pack[1];
+
+    _dnsPacket_init(pack, e->query, e->querylen);
+    return _dnsPacket_hashQuery(pack);
+}
+
+/* initialize an Entry as a search key, this also checks the input query packet
+ * returns 1 on success, or 0 in case of unsupported/malformed data */
+static int entry_init_key(Entry* e, const void* query, int querylen) {
+    DnsPacket pack[1];
+
+    memset(e, 0, sizeof(*e));
+
+    e->query = (const uint8_t*) query;
+    e->querylen = querylen;
+    e->hash = entry_hash(e);
+
+    _dnsPacket_init(pack, e->query, e->querylen);
+
+    return _dnsPacket_checkQuery(pack);
+}
+
+/* allocate a new entry as a cache node */
+static Entry* entry_alloc(const Entry* init, const void* answer, int answerlen) {
+    Entry* e;
+    int size;
+
+    size = sizeof(*e) + init->querylen + answerlen;
+    e = (Entry*) calloc(size, 1);
+    if (e == NULL) return e;
+
+    e->hash = init->hash;
+    e->query = (const uint8_t*) (e + 1);
+    e->querylen = init->querylen;
+
+    memcpy((char*) e->query, init->query, e->querylen);
+
+    e->answer = e->query + e->querylen;
+    e->answerlen = answerlen;
+
+    memcpy((char*) e->answer, answer, e->answerlen);
+
+    return e;
+}
+
+static int entry_equals(const Entry* e1, const Entry* e2) {
+    DnsPacket pack1[1], pack2[1];
+
+    if (e1->querylen != e2->querylen) {
+        return 0;
+    }
+    _dnsPacket_init(pack1, e1->query, e1->querylen);
+    _dnsPacket_init(pack2, e2->query, e2->querylen);
+
+    return _dnsPacket_isEqualQuery(pack1, pack2);
+}
+
+/* We use a simple hash table with external collision lists
+ * for simplicity, the hash-table fields 'hash' and 'hlink' are
+ * inlined in the Entry structure.
+ */
+
+/* Maximum time for a thread to wait for an pending request */
+constexpr int PENDING_REQUEST_TIMEOUT = 20;
+
+typedef struct resolv_cache {
+    int max_entries;
+    int num_entries;
+    Entry mru_list;
+    int last_id;
+    Entry* entries;
+    struct pending_req_info {
+        unsigned int hash;
+        struct pending_req_info* next;
+    } pending_requests;
+} Cache;
+
+struct resolv_cache_info {
+    unsigned netid;
+    Cache* cache;
+    struct resolv_cache_info* next;
+    int nscount;
+    char* nameservers[MAXNS];
+    struct addrinfo* nsaddrinfo[MAXNS];
+    int revision_id;  // # times the nameservers have been replaced
+    res_params params;
+    struct res_stats nsstats[MAXNS];
+    char defdname[MAXDNSRCHPATH];
+    int dnsrch_offset[MAXDNSRCH + 1];  // offsets into defdname
+    int wait_for_pending_req_timeout_count;
+    // Map format: ReturnCode:rate_denom
+    std::unordered_map<int, uint32_t> dns_event_subsampling_map;
+};
+
+// A helper class for the Clang Thread Safety Analysis to deal with
+// std::unique_lock.
+class SCOPED_CAPABILITY ScopedAssumeLocked {
+  public:
+    ScopedAssumeLocked(std::mutex& mutex) ACQUIRE(mutex) {}
+    ~ScopedAssumeLocked() RELEASE() {}
+};
+
+// lock protecting everything in the resolve_cache_info structs (next ptr, etc)
+static std::mutex cache_mutex;
+static std::condition_variable cv;
+
+/* gets cache associated with a network, or NULL if none exists */
+static resolv_cache* find_named_cache_locked(unsigned netid) REQUIRES(cache_mutex);
+static int resolv_create_cache_for_net_locked(unsigned netid) REQUIRES(cache_mutex);
+
+static void cache_flush_pending_requests_locked(struct resolv_cache* cache) {
+    resolv_cache::pending_req_info *ri, *tmp;
+    if (!cache) return;
+
+    ri = cache->pending_requests.next;
+
+    while (ri) {
+        tmp = ri;
+        ri = ri->next;
+        free(tmp);
+    }
+
+    cache->pending_requests.next = NULL;
+    cv.notify_all();
+}
+
+// Return true - if there is a pending request in |cache| matching |key|.
+// Return false - if no pending request is found matching the key. Optionally
+//                link a new one if parameter append_if_not_found is true.
+static bool cache_has_pending_request_locked(resolv_cache* cache, const Entry* key,
+                                             bool append_if_not_found) {
+    if (!cache || !key) return false;
+
+    resolv_cache::pending_req_info* ri = cache->pending_requests.next;
+    resolv_cache::pending_req_info* prev = &cache->pending_requests;
+    while (ri) {
+        if (ri->hash == key->hash) {
+            return true;
+        }
+        prev = ri;
+        ri = ri->next;
+    }
+
+    if (append_if_not_found) {
+        ri = (resolv_cache::pending_req_info*)calloc(1, sizeof(resolv_cache::pending_req_info));
+        if (ri) {
+            ri->hash = key->hash;
+            prev->next = ri;
+        }
+    }
+    return false;
+}
+
+// Notify all threads that the cache entry |key| has become available
+static void _cache_notify_waiting_tid_locked(struct resolv_cache* cache, const Entry* key) {
+    if (!cache || !key) return;
+
+    resolv_cache::pending_req_info* ri = cache->pending_requests.next;
+    resolv_cache::pending_req_info* prev = &cache->pending_requests;
+    while (ri) {
+        if (ri->hash == key->hash) {
+            // remove item from list and destroy
+            prev->next = ri->next;
+            free(ri);
+            cv.notify_all();
+            return;
+        }
+        prev = ri;
+        ri = ri->next;
+    }
+}
+
+void _resolv_cache_query_failed(unsigned netid, const void* query, int querylen, uint32_t flags) {
+    // We should not notify with these flags.
+    if (flags & (ANDROID_RESOLV_NO_CACHE_STORE | ANDROID_RESOLV_NO_CACHE_LOOKUP)) {
+        return;
+    }
+    Entry key[1];
+    Cache* cache;
+
+    if (!entry_init_key(key, query, querylen)) return;
+
+    std::lock_guard guard(cache_mutex);
+
+    cache = find_named_cache_locked(netid);
+
+    if (cache) {
+        _cache_notify_waiting_tid_locked(cache, key);
+    }
+}
+
+static void cache_flush_locked(Cache* cache) {
+    int nn;
+
+    for (nn = 0; nn < cache->max_entries; nn++) {
+        Entry** pnode = (Entry**) &cache->entries[nn];
+
+        while (*pnode != NULL) {
+            Entry* node = *pnode;
+            *pnode = node->hlink;
+            entry_free(node);
+        }
+    }
+
+    // flush pending request
+    cache_flush_pending_requests_locked(cache);
+
+    cache->mru_list.mru_next = cache->mru_list.mru_prev = &cache->mru_list;
+    cache->num_entries = 0;
+    cache->last_id = 0;
+
+    LOG(INFO) << __func__ << ": *** DNS CACHE FLUSHED ***";
+}
+
+static resolv_cache* resolv_cache_create() {
+    struct resolv_cache* cache;
+
+    cache = (struct resolv_cache*) calloc(sizeof(*cache), 1);
+    if (cache) {
+        cache->max_entries = CONFIG_MAX_ENTRIES;
+        cache->entries = (Entry*) calloc(sizeof(*cache->entries), cache->max_entries);
+        if (cache->entries) {
+            cache->mru_list.mru_prev = cache->mru_list.mru_next = &cache->mru_list;
+            LOG(INFO) << __func__ << ": cache created";
+        } else {
+            free(cache);
+            cache = NULL;
+        }
+    }
+    return cache;
+}
+
+static void dump_query(const uint8_t* query, int querylen) {
+    if (!WOULD_LOG(VERBOSE)) return;
+
+    char temp[256], *p = temp, *end = p + sizeof(temp);
+    DnsPacket pack[1];
+
+    _dnsPacket_init(pack, query, querylen);
+    p = dnsPacket_bprintQuery(pack, p, end);
+    LOG(VERBOSE) << __func__ << ": " << temp;
+}
+
+static void cache_dump_mru(Cache* cache) {
+    char temp[512], *p = temp, *end = p + sizeof(temp);
+    Entry* e;
+
+    p = bprint(temp, end, "MRU LIST (%2d): ", cache->num_entries);
+    for (e = cache->mru_list.mru_next; e != &cache->mru_list; e = e->mru_next)
+        p = bprint(p, end, " %d", e->id);
+
+    LOG(INFO) << __func__ << ": " << temp;
+}
+
+/* This function tries to find a key within the hash table
+ * In case of success, it will return a *pointer* to the hashed key.
+ * In case of failure, it will return a *pointer* to NULL
+ *
+ * So, the caller must check '*result' to check for success/failure.
+ *
+ * The main idea is that the result can later be used directly in
+ * calls to _resolv_cache_add or _resolv_cache_remove as the 'lookup'
+ * parameter. This makes the code simpler and avoids re-searching
+ * for the key position in the htable.
+ *
+ * The result of a lookup_p is only valid until you alter the hash
+ * table.
+ */
+static Entry** _cache_lookup_p(Cache* cache, Entry* key) {
+    int index = key->hash % cache->max_entries;
+    Entry** pnode = (Entry**) &cache->entries[index];
+
+    while (*pnode != NULL) {
+        Entry* node = *pnode;
+
+        if (node == NULL) break;
+
+        if (node->hash == key->hash && entry_equals(node, key)) break;
+
+        pnode = &node->hlink;
+    }
+    return pnode;
+}
+
+/* Add a new entry to the hash table. 'lookup' must be the
+ * result of an immediate previous failed _lookup_p() call
+ * (i.e. with *lookup == NULL), and 'e' is the pointer to the
+ * newly created entry
+ */
+static void _cache_add_p(Cache* cache, Entry** lookup, Entry* e) {
+    *lookup = e;
+    e->id = ++cache->last_id;
+    entry_mru_add(e, &cache->mru_list);
+    cache->num_entries += 1;
+
+    LOG(INFO) << __func__ << ": entry " << e->id << " added (count=" << cache->num_entries << ")";
+}
+
+/* Remove an existing entry from the hash table,
+ * 'lookup' must be the result of an immediate previous
+ * and succesful _lookup_p() call.
+ */
+static void _cache_remove_p(Cache* cache, Entry** lookup) {
+    Entry* e = *lookup;
+
+    LOG(INFO) << __func__ << ": entry " << e->id << " removed (count=" << cache->num_entries - 1
+              << ")";
+
+    entry_mru_remove(e);
+    *lookup = e->hlink;
+    entry_free(e);
+    cache->num_entries -= 1;
+}
+
+/* Remove the oldest entry from the hash table.
+ */
+static void _cache_remove_oldest(Cache* cache) {
+    Entry* oldest = cache->mru_list.mru_prev;
+    Entry** lookup = _cache_lookup_p(cache, oldest);
+
+    if (*lookup == NULL) { /* should not happen */
+        LOG(INFO) << __func__ << ": OLDEST NOT IN HTABLE ?";
+        return;
+    }
+    LOG(INFO) << __func__ << ": Cache full - removing oldest";
+    dump_query(oldest->query, oldest->querylen);
+    _cache_remove_p(cache, lookup);
+}
+
+/* Remove all expired entries from the hash table.
+ */
+static void _cache_remove_expired(Cache* cache) {
+    Entry* e;
+    time_t now = _time_now();
+
+    for (e = cache->mru_list.mru_next; e != &cache->mru_list;) {
+        // Entry is old, remove
+        if (now >= e->expires) {
+            Entry** lookup = _cache_lookup_p(cache, e);
+            if (*lookup == NULL) { /* should not happen */
+                LOG(INFO) << __func__ << ": ENTRY NOT IN HTABLE ?";
+                return;
+            }
+            e = e->mru_next;
+            _cache_remove_p(cache, lookup);
+        } else {
+            e = e->mru_next;
+        }
+    }
+}
+
+// gets a resolv_cache_info associated with a network, or NULL if not found
+static resolv_cache_info* find_cache_info_locked(unsigned netid) REQUIRES(cache_mutex);
+
+ResolvCacheStatus _resolv_cache_lookup(unsigned netid, const void* query, int querylen,
+                                       void* answer, int answersize, int* answerlen,
+                                       uint32_t flags) {
+    // Skip cache lookup, return RESOLV_CACHE_NOTFOUND directly so that it is
+    // possible to cache the answer of this query.
+    // If ANDROID_RESOLV_NO_CACHE_STORE is set, return RESOLV_CACHE_SKIP to skip possible cache
+    // storing.
+    if (flags & ANDROID_RESOLV_NO_CACHE_LOOKUP) {
+        return flags & ANDROID_RESOLV_NO_CACHE_STORE ? RESOLV_CACHE_SKIP : RESOLV_CACHE_NOTFOUND;
+    }
+    Entry key;
+    Entry** lookup;
+    Entry* e;
+    time_t now;
+    Cache* cache;
+
+    LOG(INFO) << __func__ << ": lookup";
+    dump_query((u_char*) query, querylen);
+
+    /* we don't cache malformed queries */
+    if (!entry_init_key(&key, query, querylen)) {
+        LOG(INFO) << __func__ << ": unsupported query";
+        return RESOLV_CACHE_UNSUPPORTED;
+    }
+    /* lookup cache */
+    std::unique_lock lock(cache_mutex);
+    ScopedAssumeLocked assume_lock(cache_mutex);
+    cache = find_named_cache_locked(netid);
+    if (cache == NULL) {
+        return RESOLV_CACHE_UNSUPPORTED;
+    }
+
+    /* see the description of _lookup_p to understand this.
+     * the function always return a non-NULL pointer.
+     */
+    lookup = _cache_lookup_p(cache, &key);
+    e = *lookup;
+
+    if (e == NULL) {
+        LOG(INFO) << __func__ << ": NOT IN CACHE";
+        // If it is no-cache-store mode, we won't wait for possible query.
+        if (flags & ANDROID_RESOLV_NO_CACHE_STORE) {
+            return RESOLV_CACHE_SKIP;
+        }
+
+        if (!cache_has_pending_request_locked(cache, &key, true)) {
+            return RESOLV_CACHE_NOTFOUND;
+
+        } else {
+            LOG(INFO) << __func__ << ": Waiting for previous request";
+            // wait until (1) timeout OR
+            //            (2) cv is notified AND no pending request matching the |key|
+            // (cv notifier should delete pending request before sending notification.)
+            bool ret = cv.wait_for(lock, std::chrono::seconds(PENDING_REQUEST_TIMEOUT),
+                                   [netid, &cache, &key]() REQUIRES(cache_mutex) {
+                                       // Must update cache as it could have been deleted
+                                       cache = find_named_cache_locked(netid);
+                                       return !cache_has_pending_request_locked(cache, &key, false);
+                                   });
+            if (!cache) {
+                return RESOLV_CACHE_NOTFOUND;
+            }
+            if (ret == false) {
+                resolv_cache_info* info = find_cache_info_locked(netid);
+                if (info != NULL) {
+                    info->wait_for_pending_req_timeout_count++;
+                }
+            }
+            lookup = _cache_lookup_p(cache, &key);
+            e = *lookup;
+            if (e == NULL) {
+                return RESOLV_CACHE_NOTFOUND;
+            }
+        }
+    }
+
+    now = _time_now();
+
+    /* remove stale entries here */
+    if (now >= e->expires) {
+        LOG(INFO) << __func__ << ": NOT IN CACHE (STALE ENTRY " << *lookup << "DISCARDED)";
+        dump_query(e->query, e->querylen);
+        _cache_remove_p(cache, lookup);
+        return RESOLV_CACHE_NOTFOUND;
+    }
+
+    *answerlen = e->answerlen;
+    if (e->answerlen > answersize) {
+        /* NOTE: we return UNSUPPORTED if the answer buffer is too short */
+        LOG(INFO) << __func__ << ": ANSWER TOO LONG";
+        return RESOLV_CACHE_UNSUPPORTED;
+    }
+
+    memcpy(answer, e->answer, e->answerlen);
+
+    /* bump up this entry to the top of the MRU list */
+    if (e != cache->mru_list.mru_next) {
+        entry_mru_remove(e);
+        entry_mru_add(e, &cache->mru_list);
+    }
+
+    LOG(INFO) << __func__ << ": FOUND IN CACHE entry=" << e;
+    return RESOLV_CACHE_FOUND;
+}
+
+void _resolv_cache_add(unsigned netid, const void* query, int querylen, const void* answer,
+                       int answerlen) {
+    Entry key[1];
+    Entry* e;
+    Entry** lookup;
+    u_long ttl;
+    Cache* cache = NULL;
+
+    /* don't assume that the query has already been cached
+     */
+    if (!entry_init_key(key, query, querylen)) {
+        LOG(INFO) << __func__ << ": passed invalid query?";
+        return;
+    }
+
+    std::lock_guard guard(cache_mutex);
+
+    cache = find_named_cache_locked(netid);
+    if (cache == NULL) {
+        return;
+    }
+
+    LOG(INFO) << __func__ << ": query:";
+    dump_query((u_char*)query, querylen);
+    res_pquery((u_char*)answer, answerlen);
+    if (kDumpData) {
+        LOG(INFO) << __func__ << ": answer:";
+        dump_bytes((u_char*)answer, answerlen);
+    }
+
+    lookup = _cache_lookup_p(cache, key);
+    e = *lookup;
+
+    // Should only happen on ANDROID_RESOLV_NO_CACHE_LOOKUP
+    if (e != NULL) {
+        LOG(INFO) << __func__ << ": ALREADY IN CACHE (" << e << ") ? IGNORING ADD";
+        _cache_notify_waiting_tid_locked(cache, key);
+        return;
+    }
+
+    if (cache->num_entries >= cache->max_entries) {
+        _cache_remove_expired(cache);
+        if (cache->num_entries >= cache->max_entries) {
+            _cache_remove_oldest(cache);
+        }
+        // TODO: It looks useless, remove below code after having test to prove it.
+        lookup = _cache_lookup_p(cache, key);
+        e = *lookup;
+        if (e != NULL) {
+            LOG(INFO) << __func__ << ": ALREADY IN CACHE (" << e << ") ? IGNORING ADD";
+            _cache_notify_waiting_tid_locked(cache, key);
+            return;
+        }
+    }
+
+    ttl = answer_getTTL(answer, answerlen);
+    if (ttl > 0) {
+        e = entry_alloc(key, answer, answerlen);
+        if (e != NULL) {
+            e->expires = ttl + _time_now();
+            _cache_add_p(cache, lookup, e);
+        }
+    }
+
+    cache_dump_mru(cache);
+    _cache_notify_waiting_tid_locked(cache, key);
+}
+
+// Head of the list of caches.
+static struct resolv_cache_info res_cache_list GUARDED_BY(cache_mutex);
+
+// insert resolv_cache_info into the list of resolv_cache_infos
+static void insert_cache_info_locked(resolv_cache_info* cache_info);
+// creates a resolv_cache_info
+static resolv_cache_info* create_cache_info();
+// empty the nameservers set for the named cache
+static void free_nameservers_locked(resolv_cache_info* cache_info);
+// return 1 if the provided list of name servers differs from the list of name servers
+// currently attached to the provided cache_info
+static int resolv_is_nameservers_equal_locked(resolv_cache_info* cache_info, const char** servers,
+                                              int numservers);
+// clears the stats samples contained withing the given cache_info
+static void res_cache_clear_stats_locked(resolv_cache_info* cache_info);
+
+// public API for netd to query if name server is set on specific netid
+bool resolv_has_nameservers(unsigned netid) {
+    std::lock_guard guard(cache_mutex);
+    resolv_cache_info* info = find_cache_info_locked(netid);
+    return (info != nullptr) && (info->nscount > 0);
+}
+
+namespace {
+
+// Map format: ReturnCode:rate_denom
+// if the ReturnCode is not associated with any rate_denom, use default
+// Sampling rate varies by return code; events to log are chosen randomly, with a
+// probability proportional to the sampling rate.
+constexpr const char DEFAULT_SUBSAMPLING_MAP[] = "default:1 0:100 7:10";
+
+std::unordered_map<int, uint32_t> resolv_get_dns_event_subsampling_map() {
+    using android::base::ParseInt;
+    using android::base::ParseUint;
+    using android::base::Split;
+    using server_configurable_flags::GetServerConfigurableFlag;
+    std::unordered_map<int, uint32_t> sampling_rate_map{};
+    std::vector<std::string> subsampling_vector =
+            Split(GetServerConfigurableFlag("netd_native", "dns_event_subsample_map",
+                                            DEFAULT_SUBSAMPLING_MAP),
+                  " ");
+    for (const auto& pair : subsampling_vector) {
+        std::vector<std::string> rate_denom = Split(pair, ":");
+        int return_code;
+        uint32_t denom;
+        if (rate_denom.size() != 2) {
+            LOG(ERROR) << __func__ << ": invalid subsampling_pair = " << pair;
+            continue;
+        }
+        if (rate_denom[0] == "default") {
+            return_code = DNSEVENT_SUBSAMPLING_MAP_DEFAULT_KEY;
+        } else if (!ParseInt(rate_denom[0], &return_code)) {
+            LOG(ERROR) << __func__ << ": parse subsampling_pair failed = " << pair;
+            continue;
+        }
+        if (!ParseUint(rate_denom[1], &denom)) {
+            LOG(ERROR) << __func__ << ": parse subsampling_pair failed = " << pair;
+            continue;
+        }
+        sampling_rate_map[return_code] = denom;
+    }
+    return sampling_rate_map;
+}
+
+}  // namespace
+
+static int resolv_create_cache_for_net_locked(unsigned netid) {
+    resolv_cache* cache = find_named_cache_locked(netid);
+    // Should not happen
+    if (cache) {
+        LOG(ERROR) << __func__ << ": Cache is already created, netId: " << netid;
+        return -EEXIST;
+    }
+
+    resolv_cache_info* cache_info = create_cache_info();
+    if (!cache_info) return -ENOMEM;
+    cache = resolv_cache_create();
+    if (!cache) {
+        free(cache_info);
+        return -ENOMEM;
+    }
+    cache_info->cache = cache;
+    cache_info->netid = netid;
+    cache_info->dns_event_subsampling_map = resolv_get_dns_event_subsampling_map();
+    insert_cache_info_locked(cache_info);
+
+    return 0;
+}
+
+int resolv_create_cache_for_net(unsigned netid) {
+    std::lock_guard guard(cache_mutex);
+    return resolv_create_cache_for_net_locked(netid);
+}
+
+void resolv_delete_cache_for_net(unsigned netid) {
+    std::lock_guard guard(cache_mutex);
+
+    struct resolv_cache_info* prev_cache_info = &res_cache_list;
+
+    while (prev_cache_info->next) {
+        struct resolv_cache_info* cache_info = prev_cache_info->next;
+
+        if (cache_info->netid == netid) {
+            prev_cache_info->next = cache_info->next;
+            cache_flush_locked(cache_info->cache);
+            free(cache_info->cache->entries);
+            free(cache_info->cache);
+            free_nameservers_locked(cache_info);
+            free(cache_info);
+            break;
+        }
+
+        prev_cache_info = prev_cache_info->next;
+    }
+}
+
+std::vector<unsigned> resolv_list_caches() {
+    std::lock_guard guard(cache_mutex);
+    struct resolv_cache_info* cache_info = res_cache_list.next;
+    std::vector<unsigned> result;
+    while (cache_info) {
+        result.push_back(cache_info->netid);
+        cache_info = cache_info->next;
+    }
+    return result;
+}
+
+static resolv_cache_info* create_cache_info() {
+    return (struct resolv_cache_info*) calloc(sizeof(struct resolv_cache_info), 1);
+}
+
+// TODO: convert this to a simple and efficient C++ container.
+static void insert_cache_info_locked(struct resolv_cache_info* cache_info) {
+    struct resolv_cache_info* last;
+    for (last = &res_cache_list; last->next; last = last->next) {}
+    last->next = cache_info;
+}
+
+static resolv_cache* find_named_cache_locked(unsigned netid) {
+    resolv_cache_info* info = find_cache_info_locked(netid);
+    if (info != NULL) return info->cache;
+    return NULL;
+}
+
+static resolv_cache_info* find_cache_info_locked(unsigned netid) {
+    struct resolv_cache_info* cache_info = res_cache_list.next;
+
+    while (cache_info) {
+        if (cache_info->netid == netid) {
+            break;
+        }
+
+        cache_info = cache_info->next;
+    }
+    return cache_info;
+}
+
+static void resolv_set_default_params(res_params* params) {
+    params->sample_validity = NSSAMPLE_VALIDITY;
+    params->success_threshold = SUCCESS_THRESHOLD;
+    params->min_samples = 0;
+    params->max_samples = 0;
+    params->base_timeout_msec = 0;  // 0 = legacy algorithm
+    params->retry_count = 0;
+}
+
+static void resolv_set_experiment_params(res_params* params) {
+    using android::base::ParseInt;
+    using server_configurable_flags::GetServerConfigurableFlag;
+
+    if (params->retry_count == 0) {
+        params->retry_count = RES_DFLRETRY;
+        ParseInt(GetServerConfigurableFlag("netd_native", "retry_count", ""), &params->retry_count);
+    }
+
+    if (params->base_timeout_msec == 0) {
+        params->base_timeout_msec = RES_TIMEOUT;
+        ParseInt(GetServerConfigurableFlag("netd_native", "retransmission_time_interval", ""),
+                 &params->base_timeout_msec);
+    }
+}
+
+int resolv_set_nameservers_for_net(unsigned netid, const char** servers, const int numservers,
+                                   const char* domains, const res_params* params) {
+    char* cp;
+    int* offset;
+    struct addrinfo* nsaddrinfo[MAXNS];
+
+    if (numservers > MAXNS) {
+        LOG(ERROR) << __func__ << ": numservers=" << numservers << ", MAXNS=" << MAXNS;
+        return E2BIG;
+    }
+
+    // Parse the addresses before actually locking or changing any state, in case there is an error.
+    // As a side effect this also reduces the time the lock is kept.
+    char sbuf[NI_MAXSERV];
+    snprintf(sbuf, sizeof(sbuf), "%u", NAMESERVER_PORT);
+    for (int i = 0; i < numservers; i++) {
+        // The addrinfo structures allocated here are freed in free_nameservers_locked().
+        const addrinfo hints = {
+                .ai_family = AF_UNSPEC, .ai_socktype = SOCK_DGRAM, .ai_flags = AI_NUMERICHOST};
+        int rt = getaddrinfo_numeric(servers[i], sbuf, hints, &nsaddrinfo[i]);
+        if (rt != 0) {
+            for (int j = 0; j < i; j++) {
+                freeaddrinfo(nsaddrinfo[j]);
+            }
+            LOG(INFO) << __func__ << ": getaddrinfo_numeric(" << servers[i]
+                      << ") = " << gai_strerror(rt);
+            return EINVAL;
+        }
+    }
+
+    std::lock_guard guard(cache_mutex);
+
+    resolv_cache_info* cache_info = find_cache_info_locked(netid);
+
+    if (cache_info == NULL) return ENONET;
+
+    uint8_t old_max_samples = cache_info->params.max_samples;
+    if (params != NULL) {
+        cache_info->params = *params;
+    } else {
+        resolv_set_default_params(&cache_info->params);
+    }
+    resolv_set_experiment_params(&cache_info->params);
+    if (!resolv_is_nameservers_equal_locked(cache_info, servers, numservers)) {
+        // free current before adding new
+        free_nameservers_locked(cache_info);
+        for (int i = 0; i < numservers; i++) {
+            cache_info->nsaddrinfo[i] = nsaddrinfo[i];
+            cache_info->nameservers[i] = strdup(servers[i]);
+            LOG(INFO) << __func__ << ": netid = " << netid << ", addr = " << servers[i];
+        }
+        cache_info->nscount = numservers;
+
+        // Clear the NS statistics because the mapping to nameservers might have changed.
+        res_cache_clear_stats_locked(cache_info);
+
+        // increment the revision id to ensure that sample state is not written back if the
+        // servers change; in theory it would suffice to do so only if the servers or
+        // max_samples actually change, in practice the overhead of checking is higher than the
+        // cost, and overflows are unlikely
+        ++cache_info->revision_id;
+    } else {
+        if (cache_info->params.max_samples != old_max_samples) {
+            // If the maximum number of samples changes, the overhead of keeping the most recent
+            // samples around is not considered worth the effort, so they are cleared instead.
+            // All other parameters do not affect shared state: Changing these parameters does
+            // not invalidate the samples, as they only affect aggregation and the conditions
+            // under which servers are considered usable.
+            res_cache_clear_stats_locked(cache_info);
+            ++cache_info->revision_id;
+        }
+        for (int j = 0; j < numservers; j++) {
+            freeaddrinfo(nsaddrinfo[j]);
+        }
+    }
+
+    // Always update the search paths, since determining whether they actually changed is
+    // complex due to the zero-padding, and probably not worth the effort. Cache-flushing
+    // however is not necessary, since the stored cache entries do contain the domain, not
+    // just the host name.
+    strlcpy(cache_info->defdname, domains, sizeof(cache_info->defdname));
+    if ((cp = strchr(cache_info->defdname, '\n')) != NULL) *cp = '\0';
+    LOG(INFO) << __func__ << ": domains=\"" << cache_info->defdname << "\"";
+
+    cp = cache_info->defdname;
+    offset = cache_info->dnsrch_offset;
+    while (offset < cache_info->dnsrch_offset + MAXDNSRCH) {
+        while (*cp == ' ' || *cp == '\t') /* skip leading white space */
+            cp++;
+        if (*cp == '\0') /* stop if nothing more to do */
+            break;
+        *offset++ = cp - cache_info->defdname; /* record this search domain */
+        while (*cp) {                          /* zero-terminate it */
+            if (*cp == ' ' || *cp == '\t') {
+                *cp++ = '\0';
+                break;
+            }
+            cp++;
+        }
+    }
+    *offset = -1; /* cache_info->dnsrch_offset has MAXDNSRCH+1 items */
+
+    return 0;
+}
+
+static int resolv_is_nameservers_equal_locked(resolv_cache_info* cache_info, const char** servers,
+                                              int numservers) {
+    if (cache_info->nscount != numservers) {
+        return 0;
+    }
+
+    // Compare each name server against current name servers.
+    // TODO: this is incorrect if the list of current or previous nameservers
+    // contains duplicates. This does not really matter because the framework
+    // filters out duplicates, but we should probably fix it. It's also
+    // insensitive to the order of the nameservers; we should probably fix that
+    // too.
+    for (int i = 0; i < numservers; i++) {
+        for (int j = 0;; j++) {
+            if (j >= numservers) {
+                return 0;
+            }
+            if (strcmp(cache_info->nameservers[i], servers[j]) == 0) {
+                break;
+            }
+        }
+    }
+
+    return 1;
+}
+
+static void free_nameservers_locked(resolv_cache_info* cache_info) {
+    int i;
+    for (i = 0; i < cache_info->nscount; i++) {
+        free(cache_info->nameservers[i]);
+        cache_info->nameservers[i] = NULL;
+        if (cache_info->nsaddrinfo[i] != NULL) {
+            freeaddrinfo(cache_info->nsaddrinfo[i]);
+            cache_info->nsaddrinfo[i] = NULL;
+        }
+        cache_info->nsstats[i].sample_count = cache_info->nsstats[i].sample_next = 0;
+    }
+    cache_info->nscount = 0;
+    res_cache_clear_stats_locked(cache_info);
+    ++cache_info->revision_id;
+}
+
+void _resolv_populate_res_for_net(res_state statp) {
+    if (statp == NULL) {
+        return;
+    }
+    LOG(INFO) << __func__ << ": netid=" << statp->netid;
+
+    std::lock_guard guard(cache_mutex);
+    resolv_cache_info* info = find_cache_info_locked(statp->netid);
+    if (info != NULL) {
+        int nserv;
+        struct addrinfo* ai;
+        for (nserv = 0; nserv < MAXNS; nserv++) {
+            ai = info->nsaddrinfo[nserv];
+            if (ai == NULL) {
+                break;
+            }
+
+            if ((size_t) ai->ai_addrlen <= sizeof(statp->_u._ext.ext->nsaddrs[0])) {
+                if (statp->_u._ext.ext != NULL) {
+                    memcpy(&statp->_u._ext.ext->nsaddrs[nserv], ai->ai_addr, ai->ai_addrlen);
+                    statp->nsaddr_list[nserv].sin_family = AF_UNSPEC;
+                } else {
+                    if ((size_t) ai->ai_addrlen <= sizeof(statp->nsaddr_list[0])) {
+                        memcpy(&statp->nsaddr_list[nserv], ai->ai_addr, ai->ai_addrlen);
+                    } else {
+                        statp->nsaddr_list[nserv].sin_family = AF_UNSPEC;
+                    }
+                }
+            } else {
+                LOG(INFO) << __func__ << ": found too long addrlen";
+            }
+        }
+        statp->nscount = nserv;
+        // now do search domains.  Note that we cache the offsets as this code runs alot
+        // but the setting/offset-computer only runs when set/changed
+        // WARNING: Don't use str*cpy() here, this string contains zeroes.
+        memcpy(statp->defdname, info->defdname, sizeof(statp->defdname));
+        char** pp = statp->dnsrch;
+        int* p = info->dnsrch_offset;
+        while (pp < statp->dnsrch + MAXDNSRCH && *p != -1) {
+            *pp++ = &statp->defdname[0] + *p++;
+        }
+    }
+}
+
+/* Resolver reachability statistics. */
+
+static void _res_cache_add_stats_sample_locked(res_stats* stats, const res_sample* sample,
+                                               int max_samples) {
+    // Note: This function expects max_samples > 0, otherwise a (harmless) modification of the
+    // allocated but supposedly unused memory for samples[0] will happen
+    LOG(INFO) << __func__ << ": adding sample to stats, next = " << unsigned(stats->sample_next)
+              << ", count = " << unsigned(stats->sample_count);
+    stats->samples[stats->sample_next] = *sample;
+    if (stats->sample_count < max_samples) {
+        ++stats->sample_count;
+    }
+    if (++stats->sample_next >= max_samples) {
+        stats->sample_next = 0;
+    }
+}
+
+static void res_cache_clear_stats_locked(resolv_cache_info* cache_info) {
+    if (cache_info) {
+        for (int i = 0; i < MAXNS; ++i) {
+            cache_info->nsstats->sample_count = cache_info->nsstats->sample_next = 0;
+        }
+    }
+}
+
+int android_net_res_stats_get_info_for_net(unsigned netid, int* nscount,
+                                           struct sockaddr_storage servers[MAXNS], int* dcount,
+                                           char domains[MAXDNSRCH][MAXDNSRCHPATH],
+                                           res_params* params, struct res_stats stats[MAXNS],
+                                           int* wait_for_pending_req_timeout_count) {
+    int revision_id = -1;
+    std::lock_guard guard(cache_mutex);
+
+    resolv_cache_info* info = find_cache_info_locked(netid);
+    if (info) {
+        if (info->nscount > MAXNS) {
+            LOG(INFO) << __func__ << ": nscount " << info->nscount << " > MAXNS " << MAXNS;
+            errno = EFAULT;
+            return -1;
+        }
+        int i;
+        for (i = 0; i < info->nscount; i++) {
+            // Verify that the following assumptions are held, failure indicates corruption:
+            //  - getaddrinfo() may never return a sockaddr > sockaddr_storage
+            //  - all addresses are valid
+            //  - there is only one address per addrinfo thanks to numeric resolution
+            int addrlen = info->nsaddrinfo[i]->ai_addrlen;
+            if (addrlen < (int) sizeof(struct sockaddr) || addrlen > (int) sizeof(servers[0])) {
+                LOG(INFO) << __func__ << ": nsaddrinfo[" << i << "].ai_addrlen == " << addrlen;
+                errno = EMSGSIZE;
+                return -1;
+            }
+            if (info->nsaddrinfo[i]->ai_addr == NULL) {
+                LOG(INFO) << __func__ << ": nsaddrinfo[" << i << "].ai_addr == NULL";
+                errno = ENOENT;
+                return -1;
+            }
+            if (info->nsaddrinfo[i]->ai_next != NULL) {
+                LOG(INFO) << __func__ << ": nsaddrinfo[" << i << "].ai_next != NULL";
+                errno = ENOTUNIQ;
+                return -1;
+            }
+        }
+        *nscount = info->nscount;
+        for (i = 0; i < info->nscount; i++) {
+            memcpy(&servers[i], info->nsaddrinfo[i]->ai_addr, info->nsaddrinfo[i]->ai_addrlen);
+            stats[i] = info->nsstats[i];
+        }
+        for (i = 0; i < MAXDNSRCH; i++) {
+            const char* cur_domain = info->defdname + info->dnsrch_offset[i];
+            // dnsrch_offset[i] can either be -1 or point to an empty string to indicate the end
+            // of the search offsets. Checking for < 0 is not strictly necessary, but safer.
+            // TODO: Pass in a search domain array instead of a string to
+            // resolv_set_nameservers_for_net() and make this double check unnecessary.
+            if (info->dnsrch_offset[i] < 0 ||
+                ((size_t) info->dnsrch_offset[i]) >= sizeof(info->defdname) || !cur_domain[0]) {
+                break;
+            }
+            strlcpy(domains[i], cur_domain, MAXDNSRCHPATH);
+        }
+        *dcount = i;
+        *params = info->params;
+        revision_id = info->revision_id;
+        *wait_for_pending_req_timeout_count = info->wait_for_pending_req_timeout_count;
+    }
+
+    return revision_id;
+}
+
+std::vector<std::string> resolv_cache_dump_subsampling_map(unsigned netid) {
+    using android::base::StringPrintf;
+    std::lock_guard guard(cache_mutex);
+    resolv_cache_info* cache_info = find_cache_info_locked(netid);
+    if (cache_info == nullptr) return {};
+    std::vector<std::string> result;
+    for (const auto& pair : cache_info->dns_event_subsampling_map) {
+        result.push_back(StringPrintf("%s:%d",
+                                      (pair.first == DNSEVENT_SUBSAMPLING_MAP_DEFAULT_KEY)
+                                              ? "default"
+                                              : std::to_string(pair.first).c_str(),
+                                      pair.second));
+    }
+    return result;
+}
+
+// Decides whether an event should be sampled using a random number generator and
+// a sampling factor derived from the netid and the return code.
+//
+// Returns the subsampling rate if the event should be sampled, or 0 if it should be discarded.
+uint32_t resolv_cache_get_subsampling_denom(unsigned netid, int return_code) {
+    std::lock_guard guard(cache_mutex);
+    resolv_cache_info* cache_info = find_cache_info_locked(netid);
+    if (cache_info == nullptr) return 0;  // Don't log anything at all.
+    const auto& subsampling_map = cache_info->dns_event_subsampling_map;
+    auto search_returnCode = subsampling_map.find(return_code);
+    uint32_t denom;
+    if (search_returnCode != subsampling_map.end()) {
+        denom = search_returnCode->second;
+    } else {
+        auto search_default = subsampling_map.find(DNSEVENT_SUBSAMPLING_MAP_DEFAULT_KEY);
+        denom = (search_default == subsampling_map.end()) ? 0 : search_default->second;
+    }
+    return denom;
+}
+
+int resolv_cache_get_resolver_stats(unsigned netid, res_params* params, res_stats stats[MAXNS]) {
+    std::lock_guard guard(cache_mutex);
+    resolv_cache_info* info = find_cache_info_locked(netid);
+    if (info) {
+        memcpy(stats, info->nsstats, sizeof(info->nsstats));
+        *params = info->params;
+        return info->revision_id;
+    }
+
+    return -1;
+}
+
+void _resolv_cache_add_resolver_stats_sample(unsigned netid, int revision_id, int ns,
+                                             const res_sample* sample, int max_samples) {
+    if (max_samples <= 0) return;
+
+    std::lock_guard guard(cache_mutex);
+    resolv_cache_info* info = find_cache_info_locked(netid);
+
+    if (info && info->revision_id == revision_id) {
+        _res_cache_add_stats_sample_locked(&info->nsstats[ns], sample, max_samples);
+    }
+}
diff --git a/resolv/res_cache_test.cpp b/resolv/res_cache_test.cpp
new file mode 100644
index 0000000..0b09d88
--- /dev/null
+++ b/resolv/res_cache_test.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <netdb.h>
+
+#include <cutils/properties.h>
+#include <gmock/gmock-matchers.h>
+#include <gtest/gtest.h>
+
+#include "netd_resolv/stats.h"
+#include "resolv_cache.h"
+
+constexpr int TEST_NETID = 30;
+
+namespace {
+
+constexpr int EAI_OK = 0;
+constexpr char DNS_EVENT_SUBSAMPLING_MAP_FLAG[] =
+        "persist.device_config.netd_native.dns_event_subsample_map";
+
+class ScopedCacheCreate {
+  public:
+    explicit ScopedCacheCreate(unsigned netid, const char* subsampling_map,
+                               const char* property = DNS_EVENT_SUBSAMPLING_MAP_FLAG)
+        : mStoredNetId(netid), mStoredProperty(property) {
+        property_get(property, mStoredMap, "");
+        property_set(property, subsampling_map);
+        EXPECT_EQ(0, resolv_create_cache_for_net(netid));
+    }
+    ~ScopedCacheCreate() {
+        resolv_delete_cache_for_net(mStoredNetId);
+        property_set(mStoredProperty, mStoredMap);
+    }
+
+  private:
+    unsigned mStoredNetId;
+    const char* mStoredProperty;
+    char mStoredMap[PROPERTY_VALUE_MAX]{};
+};
+
+}  // namespace
+
+TEST(ResolvCacheTest, DnsEventSubsampling) {
+    // Test defaults, default flag is "default:1 0:100 7:10" if no experiment flag is set
+    {
+        ScopedCacheCreate scopedCacheCreate(TEST_NETID, "");
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_NODATA), 10U);
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_OK), 100U);
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_BADFLAGS),
+                  1U);  // default
+        EXPECT_THAT(resolv_cache_dump_subsampling_map(TEST_NETID),
+                    testing::UnorderedElementsAreArray({"default:1", "0:100", "7:10"}));
+    }
+    // Now change the experiment flag to "0:42 default:666"
+    {
+        ScopedCacheCreate scopedCacheCreate(TEST_NETID, "0:42 default:666");
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_OK), 42U);
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_NODATA),
+                  666U);  // default
+        EXPECT_THAT(resolv_cache_dump_subsampling_map(TEST_NETID),
+                    testing::UnorderedElementsAreArray({"default:666", "0:42"}));
+    }
+    // Now change the experiment flag to something illegal
+    {
+        ScopedCacheCreate scopedCacheCreate(TEST_NETID, "asvaxx");
+        // 0(disable log) is the default value if experiment flag is invalid.
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_OK), 0U);
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_NODATA), 0U);
+        EXPECT_TRUE(resolv_cache_dump_subsampling_map(TEST_NETID).empty());
+    }
+    // Test negative and zero denom
+    {
+        ScopedCacheCreate scopedCacheCreate(TEST_NETID, "0:-42 default:-666 7:10 10:0");
+        // 0(disable log) is the default value if no valid denom is set
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_OK), 0U);
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_BADFLAGS), 0U);
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_NODATA), 10U);
+        EXPECT_EQ(resolv_cache_get_subsampling_denom(TEST_NETID, EAI_SOCKTYPE), 0U);
+        EXPECT_THAT(resolv_cache_dump_subsampling_map(TEST_NETID),
+                    testing::UnorderedElementsAreArray({"7:10", "10:0"}));
+    }
+}
diff --git a/resolv/res_comp.cpp b/resolv/res_comp.cpp
new file mode 100644
index 0000000..98461b3
--- /dev/null
+++ b/resolv/res_comp.cpp
@@ -0,0 +1,212 @@
+/*	$NetBSD: res_comp.c,v 1.6 2004/05/22 23:47:09 christos Exp $	*/
+
+/*
+ * Copyright (c) 1985, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <arpa/nameser.h>
+#include <ctype.h>
+#include <netinet/in.h>
+#include <sys/param.h>
+#include <sys/types.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "resolv_private.h"
+
+/*
+ * Expand compressed domain name 'src' to full domain name.
+ * 'msg' is a pointer to the begining of the message,
+ * 'eom' points to the first location after the message,
+ * 'dst' is a pointer to a buffer of size 'dstsiz' for the result.
+ * Return size of compressed name or -1 if there was an error.
+ */
+int dn_expand(const u_char* msg, const u_char* eom, const u_char* src, char* dst, int dstsiz) {
+    int n = ns_name_uncompress(msg, eom, src, dst, (size_t) dstsiz);
+
+    if (n > 0 && dst[0] == '.') dst[0] = '\0';
+    return (n);
+}
+
+/*
+ * Pack domain name 'exp_dn' in presentation form into 'comp_dn'.
+ * Return the size of the compressed name or -1.
+ * 'length' is the size of the array pointed to by 'comp_dn'.
+ */
+int dn_comp(const char* src, u_char* dst, int dstsiz, u_char** dnptrs, u_char** lastdnptr) {
+    return (ns_name_compress(src, dst, (size_t) dstsiz, (const u_char**) dnptrs,
+                             (const u_char**) lastdnptr));
+}
+
+/*
+ * Skip over a compressed domain name. Return the size or -1.
+ */
+int dn_skipname(const u_char* ptr, const u_char* eom) {
+    const u_char* saveptr = ptr;
+
+    if (ns_name_skip(&ptr, eom) == -1) return (-1);
+    return (ptr - saveptr);
+}
+
+/*
+ * Verify that a domain name uses an acceptable character set.
+ */
+
+/*
+ * Note the conspicuous absence of ctype macros in these definitions.  On
+ * non-ASCII hosts, we can't depend on string literals or ctype macros to
+ * tell us anything about network-format data.  The rest of the BIND system
+ * is not careful about this, but for some reason, we're doing it right here.
+ */
+
+/* BIONIC: We also accept underscores in the middle of labels.
+ *         This extension is needed to make resolution on some VPN networks
+ *         work properly.
+ */
+
+#define PERIOD 0x2e
+#define hyphenchar(c) ((c) == 0x2d)
+#define bslashchar(c) ((c) == 0x5c)
+#define periodchar(c) ((c) == PERIOD)
+#define asterchar(c) ((c) == 0x2a)
+#define alphachar(c) (((c) >= 0x41 && (c) <= 0x5a) || ((c) >= 0x61 && (c) <= 0x7a))
+#define digitchar(c) ((c) >= 0x30 && (c) <= 0x39)
+#define underscorechar(c) ((c) == 0x5f)
+
+#define borderchar(c) (alphachar(c) || digitchar(c))
+#define middlechar(c) (borderchar(c) || hyphenchar(c) || underscorechar(c))
+#define domainchar(c) ((c) > 0x20 && (c) < 0x7f)
+
+int res_hnok(const char* dn) {
+    int pch = PERIOD, ch = *dn++;
+
+    while (ch != '\0') {
+        int nch = *dn++;
+
+        if (periodchar(ch)) {
+            ;
+        } else if (periodchar(pch)) {
+            if (!borderchar(ch)) return (0);
+        } else if (periodchar(nch) || nch == '\0') {
+            if (!borderchar(ch)) return (0);
+        } else {
+            if (!middlechar(ch)) return (0);
+        }
+        pch = ch, ch = nch;
+    }
+    return (1);
+}
+
+/*
+ * hostname-like (A, MX, WKS) owners can have "*" as their first label
+ * but must otherwise be as a host name.
+ */
+int res_ownok(const char* dn) {
+    if (asterchar(dn[0])) {
+        if (periodchar(dn[1])) return (res_hnok(dn + 2));
+        if (dn[1] == '\0') return (1);
+    }
+    return (res_hnok(dn));
+}
+
+/*
+ * SOA RNAMEs and RP RNAMEs can have any printable character in their first
+ * label, but the rest of the name has to look like a host name.
+ */
+int res_mailok(const char* dn) {
+    int ch, escaped = 0;
+
+    /* "." is a valid missing representation */
+    if (*dn == '\0') return (1);
+
+    /* otherwise <label>.<hostname> */
+    while ((ch = *dn++) != '\0') {
+        if (!domainchar(ch)) return (0);
+        if (!escaped && periodchar(ch)) break;
+        if (escaped)
+            escaped = 0;
+        else if (bslashchar(ch))
+            escaped = 1;
+    }
+    if (periodchar(ch)) return (res_hnok(dn));
+    return (0);
+}
+
+/*
+ * This function is quite liberal, since RFC 1034's character sets are only
+ * recommendations.
+ */
+int res_dnok(const char* dn) {
+    int ch;
+
+    while ((ch = *dn++) != '\0')
+        if (!domainchar(ch)) return (0);
+    return (1);
+}
diff --git a/resolv/res_debug.cpp b/resolv/res_debug.cpp
new file mode 100644
index 0000000..5b20a58
--- /dev/null
+++ b/resolv/res_debug.cpp
@@ -0,0 +1,540 @@
+/*	$NetBSD: res_debug.c,v 1.13 2012/06/25 22:32:45 abs Exp $	*/
+
+/*
+ * Portions Copyright (C) 2004, 2005, 2008, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1996-2003  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1985
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Portions Copyright (c) 1995 by International Business Machines, Inc.
+ *
+ * International Business Machines, Inc. (hereinafter called IBM) grants
+ * permission under its copyrights to use, copy, modify, and distribute this
+ * Software with or without fee, provided that the above copyright notice and
+ * all paragraphs of this notice appear in all copies, and that the name of IBM
+ * not be used in connection with the marketing of any product incorporating
+ * the Software or modifications thereof, without specific, written prior
+ * permission.
+ *
+ * To the extent it has a right to do so, IBM grants an immunity from suit
+ * under its patents, if any, for the use, sale or manufacture of products to
+ * the extent that such products are used for performing Domain Name System
+ * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
+ * granted for any product per se or for any other function of any product.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
+ * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+ * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#define LOG_TAG "res_debug"
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <netinet/in.h>
+
+#include <aidl/android/net/IDnsResolver.h>
+#include <android-base/logging.h>
+#include <ctype.h>
+#include <errno.h>
+#include <math.h>
+#include <netdb.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <time.h>
+
+#include "resolv_private.h"
+
+// Default to disabling verbose logging unless overridden by Android.bp
+// for debuggable builds.
+//
+// NOTE: Verbose resolver logs could contain PII -- do NOT enable in production builds
+#ifndef RESOLV_ALLOW_VERBOSE_LOGGING
+#define RESOLV_ALLOW_VERBOSE_LOGGING 0
+#endif
+
+struct res_sym {
+    int number;            /* Identifying number, like T_MX */
+    const char* name;      /* Its symbolic name, like "MX" */
+    const char* humanname; /* Its fun name, like "mail exchanger" */
+};
+
+// add a formatted string to a bounded buffer
+// TODO: convert to std::string
+static char* dbprint(char* p, char* end, const char* format, ...) {
+    int avail, n;
+    va_list args;
+
+    avail = end - p;
+
+    if (avail <= 0) return p;
+
+    va_start(args, format);
+    n = vsnprintf(p, avail, format, args);
+    va_end(args);
+
+    /* certain C libraries return -1 in case of truncation */
+    if (n < 0 || n > avail) n = avail;
+
+    p += n;
+    /* certain C libraries do not zero-terminate in case of truncation */
+    if (p == end) p[-1] = 0;
+
+    return p;
+}
+
+static void do_section(ns_msg* handle, ns_sect section) {
+    int n, rrnum;
+    int buflen = 2048;
+    ns_opcode opcode;
+    ns_rr rr;
+    char temp[2048], *p = temp, *end = p + sizeof(temp);
+
+    /*
+     * Print answer records.
+     */
+
+    char* buf = (char*) malloc((size_t) buflen);
+    if (buf == NULL) {
+        dbprint(p, end, ";; memory allocation failure\n");
+        LOG(VERBOSE) << __func__ << ": " << temp;
+        return;
+    }
+
+    opcode = (ns_opcode) ns_msg_getflag(*handle, ns_f_opcode);
+    rrnum = 0;
+    for (;;) {
+        if (ns_parserr(handle, section, rrnum, &rr)) {
+            if (errno != ENODEV)
+                dbprint(p, end, ";; ns_parserr: %s", strerror(errno));
+            goto cleanup;
+        }
+        if (section == ns_s_qd)
+            dbprint(p, end, ";;\t%s, type = %s, class = %s\n", ns_rr_name(rr),
+                    p_type(ns_rr_type(rr)), p_class(ns_rr_class(rr)));
+        else if (section == ns_s_ar && ns_rr_type(rr) == ns_t_opt) {
+            size_t rdatalen, ttl;
+            uint16_t optcode, optlen;
+
+            rdatalen = ns_rr_rdlen(rr);
+            ttl = ns_rr_ttl(rr);
+            dbprint(p, end, "; EDNS: version: %zu, udp=%u, flags=%04zx\n", (ttl >> 16) & 0xff,
+                    ns_rr_class(rr), ttl & 0xffff);
+            const u_char* cp = ns_rr_rdata(rr);
+            while (rdatalen <= ns_rr_rdlen(rr) && rdatalen >= 4) {
+                int i;
+
+                GETSHORT(optcode, cp);
+                GETSHORT(optlen, cp);
+
+                if (optcode == NS_OPT_NSID) {
+                    p = dbprint(p, end, "; NSID: ");
+                    if (optlen == 0) {
+                        p = dbprint(p, end, "; NSID\n");
+                    } else {
+                        p = dbprint(p, end, "; NSID: ");
+                        for (i = 0; i < optlen; i++) {
+                            p = dbprint(p, end, "%02x ", cp[i]);
+                        }
+                        p = dbprint(p, end, " (");
+                        for (i = 0; i < optlen; i++) {
+                            p = dbprint(p, end, "%c", isprint(cp[i]) ? cp[i] : '.');
+                        }
+                        p = dbprint(p, end, ")\n");
+                    }
+                } else {
+                    if (optlen == 0) {
+                        p = dbprint(p, end, "; OPT=%u\n", optcode);
+                    } else {
+                        p = dbprint(p, end, "; OPT=%u: ", optcode);
+                        for (i = 0; i < optlen; i++) {
+                            p = dbprint(p, end, "%02x ", cp[i]);
+                        }
+                        p = dbprint(p, end, " (");
+                        for (i = 0; i < optlen; i++) {
+                            p = dbprint(p, end, "%c", isprint(cp[i]) ? cp[i] : '.');
+                        }
+                        p = dbprint(p, end, ")\n");
+                    }
+                }
+                rdatalen -= 4 + optlen;
+                cp += optlen;
+            }
+        } else {
+            n = ns_sprintrr(handle, &rr, NULL, NULL, buf, (u_int) buflen);
+            if (n < 0) {
+                if (errno == ENOSPC) {
+                    free(buf);
+                    buf = NULL;
+                    if (buflen < 131072) {
+                        buf = (char*) malloc((size_t)(buflen += 1024));
+                    }
+                    if (buf == NULL) {
+                        p = dbprint(p, end, ";; memory allocation failure\n");
+                        LOG(VERBOSE) << __func__ << ": " << temp;
+                        return;
+                    }
+                    continue;
+                }
+                p = dbprint(p, end, ";; ns_sprintrr: %s\n", strerror(errno));
+                goto cleanup;
+            }
+            p = dbprint(p, end, ";; %s\n", buf);
+        }
+        rrnum++;
+    }
+cleanup:
+    free(buf);
+    LOG(VERBOSE) << temp;
+}
+
+/*
+ * Print the contents of a query.
+ * This is intended to be primarily a debugging routine.
+ */
+void res_pquery(const u_char* msg, int len) {
+    if (!WOULD_LOG(VERBOSE)) return;
+
+    ns_msg handle;
+    int qdcount, ancount, nscount, arcount;
+    u_int opcode, rcode, id;
+    char temp[2048], *p = temp, *end = p + sizeof(temp);
+
+    if (ns_initparse(msg, len, &handle) < 0) {
+        dbprint(p, end, ";; ns_initparse: %s\n", strerror(errno));
+        return;
+    }
+    opcode = ns_msg_getflag(handle, ns_f_opcode);
+    rcode = ns_msg_getflag(handle, ns_f_rcode);
+    id = ns_msg_id(handle);
+    qdcount = ns_msg_count(handle, ns_s_qd);
+    ancount = ns_msg_count(handle, ns_s_an);
+    nscount = ns_msg_count(handle, ns_s_ns);
+    arcount = ns_msg_count(handle, ns_s_ar);
+
+    /*
+     * Print header fields.
+     */
+    dbprint(p, end, ";; ->>HEADER<<- opcode: %s, status: %s, id: %d\n", _res_opcodes[opcode],
+            p_rcode((int)rcode), id);
+    p = dbprint(p, end, ";");
+    p = dbprint(p, end, "; flags:");
+    if (ns_msg_getflag(handle, ns_f_qr)) p = dbprint(p, end, " qr");
+    if (ns_msg_getflag(handle, ns_f_aa)) p = dbprint(p, end, " aa");
+    if (ns_msg_getflag(handle, ns_f_tc)) p = dbprint(p, end, " tc");
+    if (ns_msg_getflag(handle, ns_f_rd)) p = dbprint(p, end, " rd");
+    if (ns_msg_getflag(handle, ns_f_ra)) p = dbprint(p, end, " ra");
+    if (ns_msg_getflag(handle, ns_f_z)) p = dbprint(p, end, " ??");
+    if (ns_msg_getflag(handle, ns_f_ad)) p = dbprint(p, end, " ad");
+    if (ns_msg_getflag(handle, ns_f_cd)) p = dbprint(p, end, " cd");
+    p = dbprint(p, end, "; %s: %d", p_section(ns_s_qd, (int)opcode), qdcount);
+    p = dbprint(p, end, ", %s: %d", p_section(ns_s_an, (int)opcode), ancount);
+    p = dbprint(p, end, ", %s: %d", p_section(ns_s_ns, (int)opcode), nscount);
+    p = dbprint(p, end, ", %s: %d", p_section(ns_s_ar, (int)opcode), arcount);
+
+    LOG(VERBOSE) << temp;
+
+    /*
+     * Print the various sections.
+     */
+    do_section(&handle, ns_s_qd);
+    do_section(&handle, ns_s_an);
+    do_section(&handle, ns_s_ns);
+    do_section(&handle, ns_s_ar);
+    if (qdcount == 0 && ancount == 0 && nscount == 0 && arcount == 0) LOG(VERBOSE) << ";;";
+}
+
+/*
+ * Names of RR classes and qclasses.  Classes and qclasses are the same, except
+ * that C_ANY is a qclass but not a class.  (You can ask for records of class
+ * C_ANY, but you can't have any records of that class in the database.)
+ */
+static const struct res_sym p_class_syms[] = {
+        {C_IN, "IN", (char*) 0},     {C_CHAOS, "CH", (char*) 0},  {C_CHAOS, "CHAOS", (char*) 0},
+        {C_HS, "HS", (char*) 0},     {C_HS, "HESIOD", (char*) 0}, {C_ANY, "ANY", (char*) 0},
+        {C_NONE, "NONE", (char*) 0}, {C_IN, (char*) 0, (char*) 0}};
+
+/*
+ * Names of message sections.
+ */
+static const struct res_sym p_default_section_syms[] = {{ns_s_qd, "QUERY", (char*) 0},
+                                                        {ns_s_an, "ANSWER", (char*) 0},
+                                                        {ns_s_ns, "AUTHORITY", (char*) 0},
+                                                        {ns_s_ar, "ADDITIONAL", (char*) 0},
+                                                        {0, (char*) 0, (char*) 0}};
+
+static const struct res_sym p_update_section_syms[] = {{S_ZONE, "ZONE", (char*) 0},
+                                                       {S_PREREQ, "PREREQUISITE", (char*) 0},
+                                                       {S_UPDATE, "UPDATE", (char*) 0},
+                                                       {S_ADDT, "ADDITIONAL", (char*) 0},
+                                                       {0, (char*) 0, (char*) 0}};
+
+/*
+ * Names of RR types and qtypes.  Types and qtypes are the same, except
+ * that T_ANY is a qtype but not a type.  (You can ask for records of type
+ * T_ANY, but you can't have any records of that type in the database.)
+ */
+const struct res_sym p_type_syms[] = {
+        {ns_t_a, "A", "address"},
+        {ns_t_ns, "NS", "name server"},
+        {ns_t_md, "MD", "mail destination (deprecated)"},
+        {ns_t_mf, "MF", "mail forwarder (deprecated)"},
+        {ns_t_cname, "CNAME", "canonical name"},
+        {ns_t_soa, "SOA", "start of authority"},
+        {ns_t_mb, "MB", "mailbox"},
+        {ns_t_mg, "MG", "mail group member"},
+        {ns_t_mr, "MR", "mail rename"},
+        {ns_t_null, "NULL", "null"},
+        {ns_t_wks, "WKS", "well-known service (deprecated)"},
+        {ns_t_ptr, "PTR", "domain name pointer"},
+        {ns_t_hinfo, "HINFO", "host information"},
+        {ns_t_minfo, "MINFO", "mailbox information"},
+        {ns_t_mx, "MX", "mail exchanger"},
+        {ns_t_txt, "TXT", "text"},
+        {ns_t_rp, "RP", "responsible person"},
+        {ns_t_afsdb, "AFSDB", "DCE or AFS server"},
+        {ns_t_x25, "X25", "X25 address"},
+        {ns_t_isdn, "ISDN", "ISDN address"},
+        {ns_t_rt, "RT", "router"},
+        {ns_t_nsap, "NSAP", "nsap address"},
+        {ns_t_nsap_ptr, "NSAP_PTR", "domain name pointer"},
+        {ns_t_sig, "SIG", "signature"},
+        {ns_t_key, "KEY", "key"},
+        {ns_t_px, "PX", "mapping information"},
+        {ns_t_gpos, "GPOS", "geographical position (withdrawn)"},
+        {ns_t_aaaa, "AAAA", "IPv6 address"},
+        {ns_t_loc, "LOC", "location"},
+        {ns_t_nxt, "NXT", "next valid name (unimplemented)"},
+        {ns_t_eid, "EID", "endpoint identifier (unimplemented)"},
+        {ns_t_nimloc, "NIMLOC", "NIMROD locator (unimplemented)"},
+        {ns_t_srv, "SRV", "server selection"},
+        {ns_t_atma, "ATMA", "ATM address (unimplemented)"},
+        {ns_t_naptr, "NAPTR", "naptr"},
+        {ns_t_kx, "KX", "key exchange"},
+        {ns_t_cert, "CERT", "certificate"},
+        {ns_t_a6, "A", "IPv6 address (experminental)"},
+        {ns_t_dname, "DNAME", "non-terminal redirection"},
+        {ns_t_opt, "OPT", "opt"},
+        {ns_t_apl, "apl", "apl"},
+        {ns_t_ds, "DS", "delegation signer"},
+        {ns_t_sshfp, "SSFP", "SSH fingerprint"},
+        {ns_t_ipseckey, "IPSECKEY", "IPSEC key"},
+        {ns_t_rrsig, "RRSIG", "rrsig"},
+        {ns_t_nsec, "NSEC", "nsec"},
+        {ns_t_dnskey, "DNSKEY", "DNS key"},
+        {ns_t_dhcid, "DHCID", "dynamic host configuration identifier"},
+        {ns_t_nsec3, "NSEC3", "nsec3"},
+        {ns_t_nsec3param, "NSEC3PARAM", "NSEC3 parameters"},
+        {ns_t_hip, "HIP", "host identity protocol"},
+        {ns_t_spf, "SPF", "sender policy framework"},
+        {ns_t_tkey, "TKEY", "tkey"},
+        {ns_t_tsig, "TSIG", "transaction signature"},
+        {ns_t_ixfr, "IXFR", "incremental zone transfer"},
+        {ns_t_axfr, "AXFR", "zone transfer"},
+        {ns_t_zxfr, "ZXFR", "compressed zone transfer"},
+        {ns_t_mailb, "MAILB", "mailbox-related data (deprecated)"},
+        {ns_t_maila, "MAILA", "mail agent (deprecated)"},
+        {ns_t_naptr, "NAPTR", "URN Naming Authority"},
+        {ns_t_kx, "KX", "Key Exchange"},
+        {ns_t_cert, "CERT", "Certificate"},
+        {ns_t_a6, "A6", "IPv6 Address"},
+        {ns_t_dname, "DNAME", "dname"},
+        {ns_t_sink, "SINK", "Kitchen Sink (experimental)"},
+        {ns_t_opt, "OPT", "EDNS Options"},
+        {ns_t_any, "ANY", "\"any\""},
+        {ns_t_dlv, "DLV", "DNSSEC look-aside validation"},
+        {0, NULL, NULL}};
+
+/*
+ * Names of DNS rcodes.
+ */
+static const struct res_sym p_rcode_syms[] = {{ns_r_noerror, "NOERROR", "no error"},
+                                              {ns_r_formerr, "FORMERR", "format error"},
+                                              {ns_r_servfail, "SERVFAIL", "server failed"},
+                                              {ns_r_nxdomain, "NXDOMAIN", "no such domain name"},
+                                              {ns_r_notimpl, "NOTIMP", "not implemented"},
+                                              {ns_r_refused, "REFUSED", "refused"},
+                                              {ns_r_yxdomain, "YXDOMAIN", "domain name exists"},
+                                              {ns_r_yxrrset, "YXRRSET", "rrset exists"},
+                                              {ns_r_nxrrset, "NXRRSET", "rrset doesn't exist"},
+                                              {ns_r_notauth, "NOTAUTH", "not authoritative"},
+                                              {ns_r_notzone, "NOTZONE", "Not in zone"},
+                                              {ns_r_max, "", ""},
+                                              {ns_r_badsig, "BADSIG", "bad signature"},
+                                              {ns_r_badkey, "BADKEY", "bad key"},
+                                              {ns_r_badtime, "BADTIME", "bad time"},
+                                              {0, NULL, NULL}};
+
+static const char* sym_ntos(const struct res_sym* syms, int number, int* success) {
+    static char unname[20];
+
+    for (; syms->name != 0; syms++) {
+        if (number == syms->number) {
+            if (success) *success = 1;
+            return (syms->name);
+        }
+    }
+
+    snprintf(unname, sizeof(unname), "%d", number); /* XXX nonreentrant */
+    if (success) *success = 0;
+    return (unname);
+}
+
+/*
+ * Return a string for the type.
+ */
+const char* p_type(int type) {
+    int success;
+    const char* result;
+    static char typebuf[20];
+
+    result = sym_ntos(p_type_syms, type, &success);
+    if (success) return (result);
+    if (type < 0 || type > 0xffff) return ("BADTYPE");
+    snprintf(typebuf, sizeof(typebuf), "TYPE%d", type);
+    return (typebuf);
+}
+
+/*
+ * Return a string for the type.
+ */
+const char* p_section(int section, int opcode) {
+    const struct res_sym* symbols;
+
+    switch (opcode) {
+        case ns_o_update:
+            symbols = p_update_section_syms;
+            break;
+        default:
+            symbols = p_default_section_syms;
+            break;
+    }
+    return (sym_ntos(symbols, section, (int*) 0));
+}
+
+/*
+ * Return a mnemonic for class.
+ */
+const char* p_class(int cl) {
+    int success;
+    const char* result;
+    static char classbuf[20];
+
+    result = sym_ntos(p_class_syms, cl, &success);
+    if (success) return (result);
+    if (cl < 0 || cl > 0xffff) return ("BADCLASS");
+    snprintf(classbuf, sizeof(classbuf), "CLASS%d", cl);
+    return (classbuf);
+}
+
+/*
+ * Return a string for the rcode.
+ */
+const char* p_rcode(int rcode) {
+    return (sym_ntos(p_rcode_syms, rcode, (int*) 0));
+}
+
+int resolv_set_log_severity(uint32_t logSeverity) {
+    switch (logSeverity) {
+        case aidl::android::net::IDnsResolver::DNS_RESOLVER_LOG_VERBOSE:
+            logSeverity = android::base::VERBOSE;
+            // *** enable verbose logging only when DBG is set. It prints sensitive data ***
+            if (RESOLV_ALLOW_VERBOSE_LOGGING == false) {
+                logSeverity = android::base::DEBUG;
+                LOG(ERROR) << "Refusing to set VERBOSE logging in non-debuggable build";
+                // TODO: Return EACCES then callers could know if the log
+                // severity is acceptable
+            }
+            break;
+        case aidl::android::net::IDnsResolver::DNS_RESOLVER_LOG_DEBUG:
+            logSeverity = android::base::DEBUG;
+            break;
+        case aidl::android::net::IDnsResolver::DNS_RESOLVER_LOG_INFO:
+            logSeverity = android::base::INFO;
+            break;
+        case aidl::android::net::IDnsResolver::DNS_RESOLVER_LOG_WARNING:
+            logSeverity = android::base::WARNING;
+            break;
+        case aidl::android::net::IDnsResolver::DNS_RESOLVER_LOG_ERROR:
+            logSeverity = android::base::ERROR;
+            break;
+        default:
+            LOG(ERROR) << __func__ << ": invalid log severity: " << logSeverity;
+            return -EINVAL;
+    }
+    android::base::SetMinimumLogSeverity(static_cast<android::base::LogSeverity>(logSeverity));
+    return 0;
+}
diff --git a/resolv/res_debug.h b/resolv/res_debug.h
new file mode 100644
index 0000000..2ba31d4
--- /dev/null
+++ b/resolv/res_debug.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cinttypes>
+
+int resolv_set_log_severity(uint32_t logSeverity);
diff --git a/resolv/res_init.cpp b/resolv/res_init.cpp
new file mode 100644
index 0000000..bdbe162
--- /dev/null
+++ b/resolv/res_init.cpp
@@ -0,0 +1,399 @@
+/*	$NetBSD: res_init.c,v 1.8 2006/03/19 03:10:08 christos Exp $	*/
+
+/*
+ * Copyright (c) 1985, 1989, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define LOG_TAG "res_init"
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/types.h>
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <netinet/in.h>
+
+#include <android-base/logging.h>
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "netd_resolv/resolv.h"
+#include "res_state_ext.h"
+#include "resolv_private.h"
+
+
+static void res_setoptions(res_state, const char*, const char*);
+
+/*
+ * Resolver state default settings.
+ */
+
+/*
+ * Set up default settings.  If the configuration file exist, the values
+ * there will have precedence.  Otherwise, the server address is set to
+ * INADDR_ANY and the default domain name comes from the gethostname().
+ *
+ * An interrim version of this code (BIND 4.9, pre-4.4BSD) used 127.0.0.1
+ * rather than INADDR_ANY ("0.0.0.0") as the default name server address
+ * since it was noted that INADDR_ANY actually meant ``the first interface
+ * you "ifconfig"'d at boot time'' and if this was a SLIP or PPP interface,
+ * it had to be "up" in order for you to reach your own name server.  It
+ * was later decided that since the recommended practice is to always
+ * install local static routes through 127.0.0.1 for all your network
+ * interfaces, that we could solve this problem without a code change.
+ *
+ * The configuration file should always be used, since it is the only way
+ * to specify a default domain.  If you are running a server on your local
+ * machine, you should say "nameserver 0.0.0.0" or "nameserver 127.0.0.1"
+ * in the configuration file.
+ *
+ * Return 0 if completes successfully, -1 on error
+ */
+int res_ninit(res_state statp) {
+    return res_vinit(statp, 0);
+}
+
+/* This function has to be reachable by res_data.c but not publicly. */
+int res_vinit(res_state statp, int preinit) {
+    char *cp, **pp;
+    char buf[BUFSIZ];
+    int nserv = 0; /* number of nameserver records read from file */
+    int havesearch = 0;
+    int dots;
+    sockaddr_union u[2];
+
+    if ((statp->options & RES_INIT) != 0U) res_ndestroy(statp);
+
+    if (!preinit) {
+        statp->netid = NETID_UNSET;
+        statp->options = RES_DEFAULT;
+        statp->id = arc4random_uniform(65536);
+        statp->_mark = MARK_UNSET;
+    }
+
+    memset(u, 0, sizeof(u));
+    u[nserv].sin.sin_addr.s_addr = INADDR_ANY;
+    u[nserv].sin.sin_family = AF_INET;
+    u[nserv].sin.sin_port = htons(NAMESERVER_PORT);
+    nserv++;
+    statp->nscount = 0;
+    statp->ndots = 1;
+    statp->_vcsock = -1;
+    statp->_flags = 0;
+    statp->_u._ext.nscount = 0;
+    statp->_u._ext.ext = (res_state_ext*) malloc(sizeof(*statp->_u._ext.ext));
+    statp->use_local_nameserver = false;
+    if (statp->_u._ext.ext != NULL) {
+        memset(statp->_u._ext.ext, 0, sizeof(*statp->_u._ext.ext));
+        statp->_u._ext.ext->nsaddrs[0].sin = statp->nsaddr;
+        strcpy(statp->_u._ext.ext->nsuffix, "ip6.arpa");
+        strcpy(statp->_u._ext.ext->nsuffix2, "ip6.int");
+    }
+    statp->nsort = 0;
+    res_setservers(statp, u, nserv);
+
+    if (statp->defdname[0] == 0 && gethostname(buf, sizeof(statp->defdname) - 1) == 0 &&
+        (cp = strchr(buf, '.')) != NULL)
+        strcpy(statp->defdname, cp + 1);
+
+    /* find components of local domain that might be searched */
+    if (havesearch == 0) {
+        pp = statp->dnsrch;
+        *pp++ = statp->defdname;
+        *pp = NULL;
+
+        dots = 0;
+        for (cp = statp->defdname; *cp; cp++) dots += (*cp == '.');
+
+        cp = statp->defdname;
+        while (pp < statp->dnsrch + MAXDFLSRCH) {
+            if (dots < LOCALDOMAINPARTS) break;
+            cp = strchr(cp, '.') + 1; /* we know there is one */
+            *pp++ = cp;
+            dots--;
+        }
+        *pp = NULL;
+        LOG(DEBUG) << __func__ << ": dnsrch list:";
+        for (pp = statp->dnsrch; *pp; pp++) LOG(DEBUG) << "\t" << *pp;
+    }
+
+    if ((cp = getenv("RES_OPTIONS")) != NULL) res_setoptions(statp, cp, "env");
+    if (nserv > 0) {
+        statp->nscount = nserv;
+        statp->options |= RES_INIT;
+    }
+    return (0);
+}
+
+static void res_setoptions(res_state statp, const char* options, const char* source) {
+    const char* cp = options;
+    int i;
+    res_state_ext* ext = statp->_u._ext.ext;
+
+    LOG(DEBUG) << "res_setoptions(\"" << options << "\", \"" << source << "\")...";
+
+    while (*cp) {
+        /* skip leading and inner runs of spaces */
+        while (*cp == ' ' || *cp == '\t') cp++;
+        /* search for and process individual options */
+        if (!strncmp(cp, "ndots:", sizeof("ndots:") - 1)) {
+            i = atoi(cp + sizeof("ndots:") - 1);
+            if (i <= RES_MAXNDOTS)
+                statp->ndots = i;
+            else
+                statp->ndots = RES_MAXNDOTS;
+            LOG(DEBUG) << "\tndots=" << statp->ndots;
+
+        } else if (!strncmp(cp, "debug", sizeof("debug") - 1)) {
+            if (!(statp->options & RES_DEBUG)) {
+                LOG(DEBUG) << "res_setoptions(\"" << options << "\", \"" << source << "\")..";
+                statp->options |= RES_DEBUG;
+            }
+            LOG(DEBUG) << "\tdebug";
+
+        } else if (!strncmp(cp, "no_tld_query", sizeof("no_tld_query") - 1) ||
+                   !strncmp(cp, "no-tld-query", sizeof("no-tld-query") - 1)) {
+            statp->options |= RES_NOTLDQUERY;
+        } else if (!strncmp(cp, "inet6", sizeof("inet6") - 1)) {
+            statp->options |= RES_USE_INET6;
+        } else if (!strncmp(cp, "rotate", sizeof("rotate") - 1)) {
+            statp->options |= RES_ROTATE;
+        } else if (!strncmp(cp, "no-check-names", sizeof("no-check-names") - 1)) {
+            statp->options |= RES_NOCHECKNAME;
+        }
+        else if (!strncmp(cp, "edns0", sizeof("edns0") - 1)) {
+            statp->options |= RES_USE_EDNS0;
+        }
+        else if (!strncmp(cp, "dname", sizeof("dname") - 1)) {
+            statp->options |= RES_USE_DNAME;
+        } else if (!strncmp(cp, "nibble:", sizeof("nibble:") - 1)) {
+            if (ext == NULL) goto skip;
+            cp += sizeof("nibble:") - 1;
+            i = MIN(strcspn(cp, " \t"), sizeof(ext->nsuffix) - 1);
+            strncpy(ext->nsuffix, cp, (size_t) i);
+            ext->nsuffix[i] = '\0';
+        } else if (!strncmp(cp, "nibble2:", sizeof("nibble2:") - 1)) {
+            if (ext == NULL) goto skip;
+            cp += sizeof("nibble2:") - 1;
+            i = MIN(strcspn(cp, " \t"), sizeof(ext->nsuffix2) - 1);
+            strncpy(ext->nsuffix2, cp, (size_t) i);
+            ext->nsuffix2[i] = '\0';
+        } else if (!strncmp(cp, "v6revmode:", sizeof("v6revmode:") - 1)) {
+            cp += sizeof("v6revmode:") - 1;
+            /* "nibble" and "bitstring" used to be valid */
+            if (!strncmp(cp, "single", sizeof("single") - 1)) {
+                statp->options |= RES_NO_NIBBLE2;
+            } else if (!strncmp(cp, "both", sizeof("both") - 1)) {
+                statp->options &= ~RES_NO_NIBBLE2;
+            }
+        } else {
+            /* XXX - print a warning here? */
+        }
+    skip:
+        /* skip to next run of spaces */
+        while (*cp && *cp != ' ' && *cp != '\t') cp++;
+    }
+}
+
+/*
+ * This routine is for closing the socket if a virtual circuit is used and
+ * the program wants to close it.  This provides support for endhostent()
+ * which expects to close the socket.
+ *
+ * This routine is not expected to be user visible.
+ */
+void res_nclose(res_state statp) {
+    int ns;
+
+    if (statp->_vcsock >= 0) {
+        (void) close(statp->_vcsock);
+        statp->_vcsock = -1;
+        statp->_flags &= ~RES_F_VC;
+    }
+    for (ns = 0; ns < statp->_u._ext.nscount; ns++) {
+        if (statp->_u._ext.nssocks[ns] != -1) {
+            (void) close(statp->_u._ext.nssocks[ns]);
+            statp->_u._ext.nssocks[ns] = -1;
+        }
+    }
+}
+
+void res_ndestroy(res_state statp) {
+    res_nclose(statp);
+    if (statp->_u._ext.ext != NULL) free(statp->_u._ext.ext);
+    statp->options &= ~RES_INIT;
+    statp->_u._ext.ext = NULL;
+}
+
+void res_setservers(res_state statp, const sockaddr_union* set, int cnt) {
+    int i, nserv;
+    size_t size;
+
+    /* close open servers */
+    res_nclose(statp);
+
+    /* cause rtt times to be forgotten */
+    statp->_u._ext.nscount = 0;
+
+    nserv = 0;
+    for (i = 0; i < cnt && nserv < MAXNS; i++) {
+        switch (set->sin.sin_family) {
+            case AF_INET:
+                size = sizeof(set->sin);
+                if (statp->_u._ext.ext)
+                    memcpy(&statp->_u._ext.ext->nsaddrs[nserv], &set->sin, size);
+                if (size <= sizeof(statp->nsaddr_list[nserv]))
+                    memcpy(&statp->nsaddr_list[nserv], &set->sin, size);
+                else
+                    statp->nsaddr_list[nserv].sin_family = 0;
+                nserv++;
+                break;
+
+#ifdef HAS_INET6_STRUCTS
+            case AF_INET6:
+                size = sizeof(set->sin6);
+                if (statp->_u._ext.ext)
+                    memcpy(&statp->_u._ext.ext->nsaddrs[nserv], &set->sin6, size);
+                if (size <= sizeof(statp->nsaddr_list[nserv]))
+                    memcpy(&statp->nsaddr_list[nserv], &set->sin6, size);
+                else
+                    statp->nsaddr_list[nserv].sin_family = 0;
+                nserv++;
+                break;
+#endif
+
+            default:
+                break;
+        }
+        set++;
+    }
+    statp->nscount = nserv;
+}
+
+int res_getservers(res_state statp, sockaddr_union* set, int cnt) {
+    int i;
+    size_t size;
+    uint16_t family;
+
+    for (i = 0; i < statp->nscount && i < cnt; i++) {
+        if (statp->_u._ext.ext)
+            family = statp->_u._ext.ext->nsaddrs[i].sin.sin_family;
+        else
+            family = statp->nsaddr_list[i].sin_family;
+
+        switch (family) {
+            case AF_INET:
+                size = sizeof(set->sin);
+                if (statp->_u._ext.ext)
+                    memcpy(&set->sin, &statp->_u._ext.ext->nsaddrs[i], size);
+                else
+                    memcpy(&set->sin, &statp->nsaddr_list[i], size);
+                break;
+
+#ifdef HAS_INET6_STRUCTS
+            case AF_INET6:
+                size = sizeof(set->sin6);
+                if (statp->_u._ext.ext)
+                    memcpy(&set->sin6, &statp->_u._ext.ext->nsaddrs[i], size);
+                else
+                    memcpy(&set->sin6, &statp->nsaddr_list[i], size);
+                break;
+#endif
+
+            default:
+                set->sin.sin_family = 0;
+                break;
+        }
+        set++;
+    }
+    return (statp->nscount);
+}
+
+void res_setnetcontext(res_state statp, const struct android_net_context* netcontext,
+                       android::net::NetworkDnsEventReported* _Nonnull event) {
+    if (statp != NULL) {
+        statp->netid = netcontext->dns_netid;
+        statp->_mark = netcontext->dns_mark;
+        if (netcontext->flags & NET_CONTEXT_FLAG_USE_EDNS) {
+            statp->options |= RES_USE_EDNS0 | RES_USE_DNSSEC;
+        }
+        if (netcontext->flags & NET_CONTEXT_FLAG_USE_LOCAL_NAMESERVERS) {
+            statp->use_local_nameserver = true;
+        }
+        statp->event = event;
+    }
+}
diff --git a/resolv/res_mkquery.cpp b/resolv/res_mkquery.cpp
new file mode 100644
index 0000000..2371c7e
--- /dev/null
+++ b/resolv/res_mkquery.cpp
@@ -0,0 +1,250 @@
+/*	$NetBSD: res_mkquery.c,v 1.6 2006/01/24 17:40:32 christos Exp $	*/
+
+/*
+ * Copyright (c) 1985, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define LOG_TAG "res_mkquery"
+
+#include <algorithm>  // std::min()
+
+#include <arpa/nameser.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+
+#include <android-base/logging.h>
+
+#include "resolv_private.h"
+
+// Queries will be padded to a multiple of this length when EDNS0 is active.
+constexpr uint16_t kEdns0Padding = 128;
+
+extern const char* const _res_opcodes[] = {
+        "QUERY",  "IQUERY", "CQUERYM", "CQUERYU", /* experimental */
+        "NOTIFY",                                 /* experimental */
+        "UPDATE", "6",      "7",       "8",        "9",       "10",
+        "11",     "12",     "13",      "ZONEINIT", "ZONEREF",
+};
+
+/*
+ * Form all types of queries.
+ * Returns the size of the result or -1.
+ */
+int res_nmkquery(res_state statp, int op,    /* opcode of query */
+                 const char* dname,          /* domain name */
+                 int cl, int type,           /* class and type of query */
+                 const u_char* data,         /* resource record data */
+                 int datalen,                /* length of data */
+                 const u_char* /*newrr_in*/, /* new rr for modify or append */
+                 u_char* buf,                /* buffer to put query */
+                 int buflen)                 /* size of buffer */
+{
+    HEADER* hp;
+    u_char *cp, *ep;
+    int n;
+    u_char *dnptrs[20], **dpp, **lastdnptr;
+
+    LOG(DEBUG) << __func__ << ": (" << _res_opcodes[op] << ", " << p_class(cl) << ", "
+               << p_type(type) << ")";
+
+    /*
+     * Initialize header fields.
+     */
+    if ((buf == NULL) || (buflen < HFIXEDSZ)) return (-1);
+    memset(buf, 0, HFIXEDSZ);
+    hp = (HEADER*) (void*) buf;
+    hp->id = htons(arc4random_uniform(65536));
+    hp->opcode = op;
+    hp->rd = (statp->options & RES_RECURSE) != 0U;
+    hp->ad = (statp->options & RES_USE_DNSSEC) != 0U;
+    hp->rcode = NOERROR;
+    cp = buf + HFIXEDSZ;
+    ep = buf + buflen;
+    dpp = dnptrs;
+    *dpp++ = buf;
+    *dpp++ = NULL;
+    lastdnptr = dnptrs + sizeof dnptrs / sizeof dnptrs[0];
+    /*
+     * perform opcode specific processing
+     */
+    switch (op) {
+        case QUERY:
+            [[fallthrough]];
+        case NS_NOTIFY_OP:
+            if (ep - cp < QFIXEDSZ) return (-1);
+            if ((n = dn_comp(dname, cp, ep - cp - QFIXEDSZ, dnptrs, lastdnptr)) < 0) return (-1);
+            cp += n;
+            *reinterpret_cast<uint16_t*>(cp) = htons(type);
+            cp += INT16SZ;
+            *reinterpret_cast<uint16_t*>(cp) = htons(cl);
+            cp += INT16SZ;
+            hp->qdcount = htons(1);
+            if (op == QUERY || data == NULL) break;
+            /*
+             * Make an additional record for completion domain.
+             */
+            if ((ep - cp) < RRFIXEDSZ) return (-1);
+            n = dn_comp((const char*) data, cp, ep - cp - RRFIXEDSZ, dnptrs, lastdnptr);
+            if (n < 0) return (-1);
+            cp += n;
+            *reinterpret_cast<uint16_t*>(cp) = htons(ns_t_null);
+            cp += INT16SZ;
+            *reinterpret_cast<uint16_t*>(cp) = htons(cl);
+            cp += INT16SZ;
+            *reinterpret_cast<uint32_t*>(cp) = htonl(0);
+            cp += INT32SZ;
+            *reinterpret_cast<uint16_t*>(cp) = htons(0);
+            cp += INT16SZ;
+            hp->arcount = htons(1);
+            break;
+
+        case IQUERY:
+            /*
+             * Initialize answer section
+             */
+            if (ep - cp < 1 + RRFIXEDSZ + datalen) return (-1);
+            *cp++ = '\0'; /* no domain name */
+            *reinterpret_cast<uint16_t*>(cp) = htons(type);
+            cp += INT16SZ;
+            *reinterpret_cast<uint16_t*>(cp) = htons(cl);
+            cp += INT16SZ;
+            *reinterpret_cast<uint32_t*>(cp) = htonl(0);
+            cp += INT32SZ;
+            *reinterpret_cast<uint16_t*>(cp) = htons(datalen);
+            cp += INT16SZ;
+            if (datalen) {
+                memcpy(cp, data, (size_t) datalen);
+                cp += datalen;
+            }
+            hp->ancount = htons(1);
+            break;
+
+        default:
+            return (-1);
+    }
+    return (cp - buf);
+}
+
+int res_nopt(res_state statp, int n0, /* current offset in buffer */
+             u_char* buf,             /* buffer to put query */
+             int buflen,              /* size of buffer */
+             int anslen)              /* UDP answer buffer size */
+{
+    HEADER* hp;
+    u_char *cp, *ep;
+    u_int16_t flags = 0;
+
+    LOG(DEBUG) << __func__;
+
+    hp = (HEADER*) (void*) buf;
+    cp = buf + n0;
+    ep = buf + buflen;
+
+    if ((ep - cp) < 1 + RRFIXEDSZ) return (-1);
+
+    *cp++ = 0; /* "." */
+
+    // Attach OPT pseudo-RR, as documented in RFC2671 (EDNS0).
+    *reinterpret_cast<uint16_t*>(cp) = htons(ns_t_opt); /* TYPE */
+    cp += INT16SZ;
+    if (anslen > 0xffff) anslen = 0xffff;
+    *reinterpret_cast<uint16_t*>(cp) = htons(anslen); /* CLASS = UDP payload size */
+    cp += INT16SZ;
+    *cp++ = NOERROR; /* extended RCODE */
+    *cp++ = 0;       /* EDNS version */
+    if (statp->options & RES_USE_DNSSEC) {
+        LOG(DEBUG) << __func__ << ": ENDS0 DNSSEC";
+        flags |= NS_OPT_DNSSEC_OK;
+    }
+    *reinterpret_cast<uint16_t*>(cp) = htons(flags);
+    cp += INT16SZ;
+
+    // EDNS0 padding
+    const uint16_t minlen = static_cast<uint16_t>(cp - buf) + 3 * INT16SZ;
+    const uint16_t extra = minlen % kEdns0Padding;
+    uint16_t padlen = (kEdns0Padding - extra) % kEdns0Padding;
+    if (minlen > buflen) {
+        return -1;
+    }
+    padlen = std::min(padlen, static_cast<uint16_t>(buflen - minlen));
+    *reinterpret_cast<uint16_t*>(cp) = htons(padlen + 2 * INT16SZ); /* RDLEN */
+    cp += INT16SZ;
+    *reinterpret_cast<uint16_t*>(cp) = htons(NS_OPT_PADDING); /* OPTION-CODE */
+    cp += INT16SZ;
+    *reinterpret_cast<uint16_t*>(cp) = htons(padlen); /* OPTION-LENGTH */
+    cp += INT16SZ;
+    memset(cp, 0, padlen);
+    cp += padlen;
+
+    hp->arcount = htons(ntohs(hp->arcount) + 1);
+    return (cp - buf);
+}
diff --git a/resolv/res_query.cpp b/resolv/res_query.cpp
new file mode 100644
index 0000000..fbbcc31
--- /dev/null
+++ b/resolv/res_query.cpp
@@ -0,0 +1,380 @@
+/*	$NetBSD: res_query.c,v 1.7 2006/01/24 17:41:25 christos Exp $	*/
+
+/*
+ * Copyright (c) 1988, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#define LOG_TAG "res_query"
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <ctype.h>
+#include <errno.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <sys/param.h>
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <android-base/logging.h>
+
+#include "resolv_cache.h"
+#include "resolv_private.h"
+
+#if PACKETSZ > 1024
+#define MAXPACKET PACKETSZ
+#else
+#define MAXPACKET 1024
+#endif
+
+/*
+ * Formulate a normal query, send, and await answer.
+ * Returned answer is placed in supplied buffer "answer".
+ * Perform preliminary check of answer, returning success only
+ * if no error is indicated and the answer count is nonzero.
+ * Return the size of the response on success, -1 on error.
+ * Error number is left in *herrno.
+ *
+ * Caller must parse answer and determine whether it answers the question.
+ */
+int res_nquery(res_state statp, const char* name,  // domain name
+               int cl, int type,                   // class and type of query
+               u_char* answer,                     // buffer to put answer
+               int anslen,                         // size of answer buffer
+               int* herrno)                        // legacy and extended h_errno
+                                                   // NETD_RESOLV_H_ERRNO_EXT_*
+{
+    u_char buf[MAXPACKET];
+    HEADER* hp = (HEADER*) (void*) answer;
+    int n;
+    int rcode = NOERROR;
+    bool retried = false;
+
+again:
+    hp->rcode = NOERROR; /* default */
+
+    LOG(DEBUG) << __func__ << ": (" << cl << ", " << type << ")";
+
+    n = res_nmkquery(statp, QUERY, name, cl, type, NULL, 0, NULL, buf, sizeof(buf));
+    if (n > 0 && (statp->options & (RES_USE_EDNS0 | RES_USE_DNSSEC)) != 0U && !retried)
+        n = res_nopt(statp, n, buf, sizeof(buf), anslen);
+    if (n <= 0) {
+        LOG(DEBUG) << __func__ << ": mkquery failed";
+        *herrno = NO_RECOVERY;
+        return n;
+    }
+    n = res_nsend(statp, buf, n, answer, anslen, &rcode, 0);
+    if (n < 0) {
+        /* if the query choked with EDNS0, retry without EDNS0 */
+        if ((statp->options & (RES_USE_EDNS0 | RES_USE_DNSSEC)) != 0U &&
+            (statp->_flags & RES_F_EDNS0ERR) && !retried) {
+            LOG(DEBUG) << __func__ << ": retry without EDNS0";
+            retried = true;
+            goto again;
+        }
+        LOG(DEBUG) << __func__ << ": send error";
+
+        // Note that rcodes SERVFAIL, NOTIMP, REFUSED may cause res_nquery() to return a general
+        // error code EAI_AGAIN, but mapping the error code from rcode as res_queryN() does for
+        // getaddrinfo(). Different rcodes trigger different behaviors:
+        //
+        // - SERVFAIL, NOTIMP, REFUSED
+        //   These result in send_dg() returning 0, causing res_nsend() to try the next
+        //   nameserver. After all nameservers failed, res_nsend() returns -ETIMEDOUT, causing
+        //   res_nquery() to return EAI_AGAIN here regardless of the rcode from the DNS response.
+        //
+        // - NXDOMAIN, FORMERR
+        //   These rcodes may cause res_nsend() to return successfully (i.e. the result is a
+        //   positive integer). In this case, res_nquery() returns error number by referring
+        //   the rcode from the DNS response.
+        switch (rcode) {
+            case RCODE_TIMEOUT:  // Not defined in RFC.
+                // DNS metrics monitors DNS query timeout.
+                *herrno = NETD_RESOLV_H_ERRNO_EXT_TIMEOUT;  // extended h_errno.
+                break;
+            default:
+                *herrno = TRY_AGAIN;
+                break;
+        }
+        return n;
+    }
+
+    if (hp->rcode != NOERROR || ntohs(hp->ancount) == 0) {
+        LOG(DEBUG) << __func__ << ": rcode = (" << p_rcode(hp->rcode)
+                   << "), counts = an:" << ntohs(hp->ancount) << " ns:" << ntohs(hp->nscount)
+                   << " ar:" << ntohs(hp->arcount);
+
+        switch (hp->rcode) {
+            case NXDOMAIN:
+                *herrno = HOST_NOT_FOUND;
+                break;
+            case SERVFAIL:
+                *herrno = TRY_AGAIN;
+                break;
+            case NOERROR:
+                *herrno = NO_DATA;
+                break;
+            case FORMERR:
+            case NOTIMP:
+            case REFUSED:
+            default:
+                *herrno = NO_RECOVERY;
+                break;
+        }
+        return -1;
+    }
+    return n;
+}
+
+/*
+ * Formulate a normal query, send, and retrieve answer in supplied buffer.
+ * Return the size of the response on success, -1 on error.
+ * If enabled, implement search rules until answer or unrecoverable failure
+ * is detected.  Error code, if any, is left in *herrno.
+ */
+int res_nsearch(res_state statp, const char* name, /* domain name */
+                int cl, int type,                  /* class and type of query */
+                u_char* answer,                    /* buffer to put answer */
+                int anslen,                        /* size of answer */
+                int* herrno)                       /* legacy and extended
+                                                      h_errno NETD_RESOLV_H_ERRNO_EXT_* */
+{
+    const char *cp, *const *domain;
+    HEADER* hp = (HEADER*) (void*) answer;
+    u_int dots;
+    int trailing_dot, ret, saved_herrno;
+    int got_nodata = 0, got_servfail = 0, root_on_list = 0;
+    int tried_as_is = 0;
+    int searched = 0;
+
+    errno = 0;
+    *herrno = HOST_NOT_FOUND; /* True if we never query. */
+
+    dots = 0;
+    for (cp = name; *cp != '\0'; cp++) dots += (*cp == '.');
+    trailing_dot = 0;
+    if (cp > name && *--cp == '.') trailing_dot++;
+
+    /*
+     * If there are enough dots in the name, let's just give it a
+     * try 'as is'. The threshold can be set with the "ndots" option.
+     * Also, query 'as is', if there is a trailing dot in the name.
+     */
+    saved_herrno = -1;
+    if (dots >= statp->ndots || trailing_dot) {
+        ret = res_nquerydomain(statp, name, NULL, cl, type, answer, anslen, herrno);
+        if (ret > 0 || trailing_dot) return ret;
+        saved_herrno = *herrno;
+        tried_as_is++;
+    }
+
+    /*
+     * We do at least one level of search if
+     *	- there is no dot and RES_DEFNAME is set, or
+     *	- there is at least one dot, there is no trailing dot,
+     *	  and RES_DNSRCH is set.
+     */
+    if ((!dots && (statp->options & RES_DEFNAMES) != 0U) ||
+        (dots && !trailing_dot && (statp->options & RES_DNSRCH) != 0U)) {
+        int done = 0;
+
+        /* Unfortunately we need to load network-specific info
+         * (dns servers, search domains) before
+         * the domain stuff is tried.  Will have a better
+         * fix after thread pools are used as this will
+         * be loaded once for the thread instead of each
+         * time a query is tried.
+         */
+        _resolv_populate_res_for_net(statp);
+
+        for (domain = (const char* const*) statp->dnsrch; *domain && !done; domain++) {
+            searched = 1;
+
+            if (domain[0][0] == '\0' || (domain[0][0] == '.' && domain[0][1] == '\0'))
+                root_on_list++;
+
+            ret = res_nquerydomain(statp, name, *domain, cl, type, answer, anslen, herrno);
+            if (ret > 0) return ret;
+
+            /*
+             * If no server present, give up.
+             * If name isn't found in this domain,
+             * keep trying higher domains in the search list
+             * (if that's enabled).
+             * On a NO_DATA error, keep trying, otherwise
+             * a wildcard entry of another type could keep us
+             * from finding this entry higher in the domain.
+             * If we get some other error (negative answer or
+             * server failure), then stop searching up,
+             * but try the input name below in case it's
+             * fully-qualified.
+             */
+            if (errno == ECONNREFUSED) {
+                *herrno = TRY_AGAIN;
+                return -1;
+            }
+
+            switch (*herrno) {
+                case NO_DATA:
+                    got_nodata++;
+                    break;
+                case HOST_NOT_FOUND:
+                    /* keep trying */
+                    break;
+                case TRY_AGAIN:
+                    if (hp->rcode == SERVFAIL) {
+                        /* try next search element, if any */
+                        got_servfail++;
+                        break;
+                    }
+                    [[fallthrough]];
+                default:
+                    /* anything else implies that we're done */
+                    done++;
+            }
+
+            /* if we got here for some reason other than DNSRCH,
+             * we only wanted one iteration of the loop, so stop.
+             */
+            if ((statp->options & RES_DNSRCH) == 0U) done++;
+        }
+    }
+
+    /*
+     * If the query has not already been tried as is then try it
+     * unless RES_NOTLDQUERY is set and there were no dots.
+     */
+    if ((dots || !searched || (statp->options & RES_NOTLDQUERY) == 0U) &&
+        !(tried_as_is || root_on_list)) {
+        ret = res_nquerydomain(statp, name, NULL, cl, type, answer, anslen, herrno);
+        if (ret > 0) return ret;
+    }
+
+    /* if we got here, we didn't satisfy the search.
+     * if we did an initial full query, return that query's H_ERRNO
+     * (note that we wouldn't be here if that query had succeeded).
+     * else if we ever got a nodata, send that back as the reason.
+     * else send back meaningless H_ERRNO, that being the one from
+     * the last DNSRCH we did.
+     */
+    if (saved_herrno != -1)
+        *herrno = saved_herrno;
+    else if (got_nodata)
+        *herrno = NO_DATA;
+    else if (got_servfail)
+        *herrno = TRY_AGAIN;
+    return -1;
+}
+
+/*
+ * Perform a call on res_query on the concatenation of name and domain,
+ * removing a trailing dot from name if domain is NULL.
+ */
+int res_nquerydomain(res_state statp, const char* name, const char* domain, int cl,
+                     int type,       /* class and type of query */
+                     u_char* answer, /* buffer to put answer */
+                     int anslen,     /* size of answer */
+                     int* herrno)    /* legacy and extended h_errno NETD_RESOLV_H_ERRNO_EXT_* */
+{
+    char nbuf[MAXDNAME];
+    const char* longname = nbuf;
+    int n, d;
+
+    if (domain == NULL) {
+        LOG(DEBUG) << __func__ << ": (null, " << cl << ", " << type << ")";
+        /*
+         * Check for trailing '.';
+         * copy without '.' if present.
+         */
+        n = strlen(name);
+        if (n >= MAXDNAME) {
+            *herrno = NO_RECOVERY;
+            return -1;
+        }
+        n--;
+        if (n >= 0 && name[n] == '.') {
+            strncpy(nbuf, name, (size_t) n);
+            nbuf[n] = '\0';
+        } else
+            longname = name;
+    } else {
+        LOG(DEBUG) << __func__ << ": (" << cl << ", " << type << ")";
+        n = strlen(name);
+        d = strlen(domain);
+        if (n + d + 1 >= MAXDNAME) {
+            *herrno = NO_RECOVERY;
+            return -1;
+        }
+        snprintf(nbuf, sizeof(nbuf), "%s.%s", name, domain);
+    }
+    return res_nquery(statp, longname, cl, type, answer, anslen, herrno);
+}
diff --git a/resolv/res_send.cpp b/resolv/res_send.cpp
new file mode 100644
index 0000000..1ccfc74
--- /dev/null
+++ b/resolv/res_send.cpp
@@ -0,0 +1,1372 @@
+/*	$NetBSD: res_send.c,v 1.9 2006/01/24 17:41:25 christos Exp $	*/
+
+/*
+ * Copyright (c) 1985, 1989, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ * 	This product includes software developed by the University of
+ * 	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Send query to name server and wait for reply.
+ */
+
+#define LOG_TAG "res_send"
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/uio.h>
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <netinet/in.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <poll.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <android-base/logging.h>
+#include <android/multinetwork.h>  // ResNsendFlags
+
+#include <netdutils/Slice.h>
+#include <netdutils/Stopwatch.h>
+#include "DnsTlsDispatcher.h"
+#include "DnsTlsTransport.h"
+#include "PrivateDnsConfiguration.h"
+#include "netd_resolv/resolv.h"
+#include "netd_resolv/stats.h"
+#include "private/android_filesystem_config.h"
+#include "res_state_ext.h"
+#include "resolv_cache.h"
+#include "resolv_private.h"
+#include "stats.pb.h"
+
+// TODO: use the namespace something like android::netd_resolv for libnetd_resolv
+using namespace android::net;
+using android::net::NetworkDnsEventReported;
+using android::netdutils::Slice;
+using android::netdutils::Stopwatch;
+
+static DnsTlsDispatcher sDnsTlsDispatcher;
+
+static int get_salen(const struct sockaddr*);
+static struct sockaddr* get_nsaddr(res_state, size_t);
+static int send_vc(res_state, res_params* params, const u_char*, int, u_char*, int, int*, int,
+                   time_t*, int*, int*);
+static int send_dg(res_state, res_params* params, const u_char*, int, u_char*, int, int*, int, int*,
+                   int*, time_t*, int*, int*);
+static void Aerror(const res_state, const char*, int, const struct sockaddr*, int);
+static void Perror(const res_state, const char*, int);
+
+static int sock_eq(struct sockaddr*, struct sockaddr*);
+static int connect_with_timeout(int sock, const struct sockaddr* nsap, socklen_t salen,
+                                const struct timespec timeout);
+static int retrying_poll(const int sock, short events, const struct timespec* finish);
+static int res_tls_send(res_state, const Slice query, const Slice answer, int* rcode,
+                        bool* fallback);
+
+NsType getQueryType(const uint8_t* msg, size_t msgLen) {
+    ns_msg handle;
+    ns_rr rr;
+    if (ns_initparse((const uint8_t*)msg, msgLen, &handle) < 0 ||
+        ns_parserr(&handle, ns_s_qd, 0, &rr) < 0) {
+        return NS_T_INVALID;
+    }
+    return static_cast<NsType>(ns_rr_type(rr));
+}
+
+IpVersion ipFamilyToIPVersion(const int ipFamily) {
+    switch (ipFamily) {
+        case AF_INET:
+            return IV_IPV4;
+        case AF_INET6:
+            return IV_IPV6;
+        default:
+            return IV_UNKNOWN;
+    }
+}
+
+// BEGIN: Code copied from ISC eventlib
+// TODO: move away from this code
+#define BILLION 1000000000
+
+static struct timespec evConsTime(time_t sec, long nsec) {
+    struct timespec x;
+
+    x.tv_sec = sec;
+    x.tv_nsec = nsec;
+    return (x);
+}
+
+static struct timespec evAddTime(struct timespec addend1, struct timespec addend2) {
+    struct timespec x;
+
+    x.tv_sec = addend1.tv_sec + addend2.tv_sec;
+    x.tv_nsec = addend1.tv_nsec + addend2.tv_nsec;
+    if (x.tv_nsec >= BILLION) {
+        x.tv_sec++;
+        x.tv_nsec -= BILLION;
+    }
+    return (x);
+}
+
+static struct timespec evSubTime(struct timespec minuend, struct timespec subtrahend) {
+    struct timespec x;
+
+    x.tv_sec = minuend.tv_sec - subtrahend.tv_sec;
+    if (minuend.tv_nsec >= subtrahend.tv_nsec)
+        x.tv_nsec = minuend.tv_nsec - subtrahend.tv_nsec;
+    else {
+        x.tv_nsec = BILLION - subtrahend.tv_nsec + minuend.tv_nsec;
+        x.tv_sec--;
+    }
+    return (x);
+}
+
+static int evCmpTime(struct timespec a, struct timespec b) {
+#define SGN(x) ((x) < 0 ? (-1) : (x) > 0 ? (1) : (0));
+    time_t s = a.tv_sec - b.tv_sec;
+    long n;
+
+    if (s != 0) return SGN(s);
+
+    n = a.tv_nsec - b.tv_nsec;
+    return SGN(n);
+}
+
+static struct timespec evNowTime(void) {
+    struct timespec tsnow;
+    clock_gettime(CLOCK_REALTIME, &tsnow);
+    return tsnow;
+}
+
+static struct iovec evConsIovec(void* buf, size_t cnt) {
+    struct iovec ret;
+
+    memset(&ret, 0xf5, sizeof ret);
+    ret.iov_base = buf;
+    ret.iov_len = cnt;
+    return ret;
+}
+
+// END: Code copied from ISC eventlib
+
+/* BIONIC-BEGIN: implement source port randomization */
+static int random_bind(int s, int family) {
+    sockaddr_union u;
+    int j;
+    socklen_t slen;
+
+    /* clear all, this also sets the IP4/6 address to 'any' */
+    memset(&u, 0, sizeof u);
+
+    switch (family) {
+        case AF_INET:
+            u.sin.sin_family = family;
+            slen = sizeof u.sin;
+            break;
+        case AF_INET6:
+            u.sin6.sin6_family = family;
+            slen = sizeof u.sin6;
+            break;
+        default:
+            errno = EPROTO;
+            return -1;
+    }
+
+    /* first try to bind to a random source port a few times */
+    for (j = 0; j < 10; j++) {
+        /* find a random port between 1025 .. 65534 */
+        int port = 1025 + (arc4random_uniform(65535 - 1025));
+        if (family == AF_INET)
+            u.sin.sin_port = htons(port);
+        else
+            u.sin6.sin6_port = htons(port);
+
+        if (!bind(s, &u.sa, slen)) return 0;
+    }
+
+    // nothing after 10 attempts, our network table is probably busy
+    // let the system decide which port is best
+    if (family == AF_INET)
+        u.sin.sin_port = 0;
+    else
+        u.sin6.sin6_port = 0;
+
+    return bind(s, &u.sa, slen);
+}
+/* BIONIC-END */
+
+// Disables all nameservers other than selectedServer
+static void res_set_usable_server(int selectedServer, int nscount, bool usable_servers[]) {
+    int usableIndex = 0;
+    for (int ns = 0; ns < nscount; ns++) {
+        if (usable_servers[ns]) ++usableIndex;
+        if (usableIndex != selectedServer) usable_servers[ns] = false;
+    }
+}
+
+/* int
+ * res_isourserver(ina)
+ *	looks up "ina" in _res.ns_addr_list[]
+ * returns:
+ *	0  : not found
+ *	>0 : found
+ * author:
+ *	paul vixie, 29may94
+ */
+static int res_ourserver_p(const res_state statp, const sockaddr* sa) {
+    const sockaddr_in *inp, *srv;
+    const sockaddr_in6 *in6p, *srv6;
+    int ns;
+
+    switch (sa->sa_family) {
+        case AF_INET:
+            inp = (const struct sockaddr_in*) (const void*) sa;
+            for (ns = 0; ns < statp->nscount; ns++) {
+                srv = (struct sockaddr_in*) (void*) get_nsaddr(statp, (size_t) ns);
+                if (srv->sin_family == inp->sin_family && srv->sin_port == inp->sin_port &&
+                    (srv->sin_addr.s_addr == INADDR_ANY ||
+                     srv->sin_addr.s_addr == inp->sin_addr.s_addr))
+                    return 1;
+            }
+            break;
+        case AF_INET6:
+            if (statp->_u._ext.ext == NULL) break;
+            in6p = (const struct sockaddr_in6*) (const void*) sa;
+            for (ns = 0; ns < statp->nscount; ns++) {
+                srv6 = (struct sockaddr_in6*) (void*) get_nsaddr(statp, (size_t) ns);
+                if (srv6->sin6_family == in6p->sin6_family && srv6->sin6_port == in6p->sin6_port &&
+#ifdef HAVE_SIN6_SCOPE_ID
+                    (srv6->sin6_scope_id == 0 || srv6->sin6_scope_id == in6p->sin6_scope_id) &&
+#endif
+                    (IN6_IS_ADDR_UNSPECIFIED(&srv6->sin6_addr) ||
+                     IN6_ARE_ADDR_EQUAL(&srv6->sin6_addr, &in6p->sin6_addr)))
+                    return 1;
+            }
+            break;
+        default:
+            break;
+    }
+    return 0;
+}
+
+/* int
+ * res_nameinquery(name, type, cl, buf, eom)
+ *	look for (name, type, cl) in the query section of packet (buf, eom)
+ * requires:
+ *	buf + HFIXEDSZ <= eom
+ * returns:
+ *	-1 : format error
+ *	0  : not found
+ *	>0 : found
+ * author:
+ *	paul vixie, 29may94
+ */
+int res_nameinquery(const char* name, int type, int cl, const u_char* buf, const u_char* eom) {
+    const u_char* cp = buf + HFIXEDSZ;
+    int qdcount = ntohs(((const HEADER*) (const void*) buf)->qdcount);
+
+    while (qdcount-- > 0) {
+        char tname[MAXDNAME + 1];
+        int n = dn_expand(buf, eom, cp, tname, sizeof tname);
+        if (n < 0) return (-1);
+        cp += n;
+        if (cp + 2 * INT16SZ > eom) return (-1);
+        int ttype = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ;
+        int tclass = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ;
+        if (ttype == type && tclass == cl && ns_samename(tname, name) == 1) return (1);
+    }
+    return (0);
+}
+
+/* int
+ * res_queriesmatch(buf1, eom1, buf2, eom2)
+ *	is there a 1:1 mapping of (name,type,class)
+ *	in (buf1,eom1) and (buf2,eom2)?
+ * returns:
+ *	-1 : format error
+ *	0  : not a 1:1 mapping
+ *	>0 : is a 1:1 mapping
+ * author:
+ *	paul vixie, 29may94
+ */
+int res_queriesmatch(const u_char* buf1, const u_char* eom1, const u_char* buf2,
+                     const u_char* eom2) {
+    const u_char* cp = buf1 + HFIXEDSZ;
+    int qdcount = ntohs(((const HEADER*) (const void*) buf1)->qdcount);
+
+    if (buf1 + HFIXEDSZ > eom1 || buf2 + HFIXEDSZ > eom2) return (-1);
+
+    /*
+     * Only header section present in replies to
+     * dynamic update packets.
+     */
+    if ((((const HEADER*) (const void*) buf1)->opcode == ns_o_update) &&
+        (((const HEADER*) (const void*) buf2)->opcode == ns_o_update))
+        return (1);
+
+    if (qdcount != ntohs(((const HEADER*) (const void*) buf2)->qdcount)) return (0);
+    while (qdcount-- > 0) {
+        char tname[MAXDNAME + 1];
+        int n = dn_expand(buf1, eom1, cp, tname, sizeof tname);
+        if (n < 0) return (-1);
+        cp += n;
+        if (cp + 2 * INT16SZ > eom1) return (-1);
+        int ttype = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ;
+        int tclass = ntohs(*reinterpret_cast<const uint16_t*>(cp));
+        cp += INT16SZ;
+        if (!res_nameinquery(tname, ttype, tclass, buf2, eom2)) return (0);
+    }
+    return (1);
+}
+
+static DnsQueryEvent* addDnsQueryEvent(NetworkDnsEventReported* event) {
+    return event->mutable_dns_query_events()->add_dns_query_event();
+}
+
+int res_nsend(res_state statp, const u_char* buf, int buflen, u_char* ans, int anssiz, int* rcode,
+              uint32_t flags) {
+    int gotsomewhere, terrno, v_circuit, resplen, n;
+    ResolvCacheStatus cache_status = RESOLV_CACHE_UNSUPPORTED;
+
+    if (anssiz < HFIXEDSZ) {
+        // TODO: Remove errno once callers stop using it
+        errno = EINVAL;
+        return -EINVAL;
+    }
+    LOG(DEBUG) << __func__;
+    res_pquery(buf, buflen);
+
+    v_circuit = (statp->options & RES_USEVC) || buflen > PACKETSZ;
+    gotsomewhere = 0;
+    terrno = ETIMEDOUT;
+
+    int anslen = 0;
+    Stopwatch cache_stopwatch;
+    cache_status = _resolv_cache_lookup(statp->netid, buf, buflen, ans, anssiz, &anslen, flags);
+    const int32_t cacheLatencyUs = saturate_cast<int32_t>(cache_stopwatch.timeTakenUs());
+    if (cache_status == RESOLV_CACHE_FOUND) {
+        HEADER* hp = (HEADER*)(void*)ans;
+        *rcode = hp->rcode;
+        DnsQueryEvent* dnsQueryEvent = addDnsQueryEvent(statp->event);
+        dnsQueryEvent->set_latency_micros(cacheLatencyUs);
+        dnsQueryEvent->set_cache_hit(static_cast<CacheStatus>(cache_status));
+        return anslen;
+    } else if (cache_status != RESOLV_CACHE_UNSUPPORTED) {
+        // had a cache miss for a known network, so populate the thread private
+        // data so the normal resolve path can do its thing
+        _resolv_populate_res_for_net(statp);
+    }
+    if (statp->nscount == 0) {
+        // We have no nameservers configured, so there's no point trying.
+        // Tell the cache the query failed, or any retries and anyone else asking the same
+        // question will block for PENDING_REQUEST_TIMEOUT seconds instead of failing fast.
+        _resolv_cache_query_failed(statp->netid, buf, buflen, flags);
+
+        // TODO: Remove errno once callers stop using it
+        errno = ESRCH;
+        return -ESRCH;
+    }
+
+    /*
+     * If the ns_addr_list in the resolver context has changed, then
+     * invalidate our cached copy and the associated timing data.
+     */
+    if (statp->_u._ext.nscount != 0) {
+        int needclose = 0;
+        struct sockaddr_storage peer;
+        socklen_t peerlen;
+
+        if (statp->_u._ext.nscount != statp->nscount) {
+            needclose++;
+        } else {
+            for (int ns = 0; ns < statp->nscount; ns++) {
+                if (statp->nsaddr_list[ns].sin_family &&
+                    !sock_eq((struct sockaddr*) (void*) &statp->nsaddr_list[ns],
+                             (struct sockaddr*) (void*) &statp->_u._ext.ext->nsaddrs[ns])) {
+                    needclose++;
+                    break;
+                }
+
+                if (statp->_u._ext.nssocks[ns] == -1) continue;
+                peerlen = sizeof(peer);
+                if (getpeername(statp->_u._ext.nssocks[ns], (struct sockaddr*) (void*) &peer,
+                                &peerlen) < 0) {
+                    needclose++;
+                    break;
+                }
+                if (!sock_eq((struct sockaddr*) (void*) &peer, get_nsaddr(statp, (size_t) ns))) {
+                    needclose++;
+                    break;
+                }
+            }
+        }
+        if (needclose) {
+            res_nclose(statp);
+            statp->_u._ext.nscount = 0;
+        }
+    }
+
+    /*
+     * Maybe initialize our private copy of the ns_addr_list.
+     */
+    if (statp->_u._ext.nscount == 0) {
+        for (int ns = 0; ns < statp->nscount; ns++) {
+            statp->_u._ext.nstimes[ns] = RES_MAXTIME;
+            statp->_u._ext.nssocks[ns] = -1;
+            if (!statp->nsaddr_list[ns].sin_family) continue;
+            statp->_u._ext.ext->nsaddrs[ns].sin = statp->nsaddr_list[ns];
+        }
+        statp->_u._ext.nscount = statp->nscount;
+    }
+
+    /*
+     * Some resolvers want to even out the load on their nameservers.
+     * Note that RES_BLAST overrides RES_ROTATE.
+     */
+    if ((statp->options & RES_ROTATE) != 0U && (statp->options & RES_BLAST) == 0U) {
+        sockaddr_union inu;
+        struct sockaddr_in ina;
+        int lastns = statp->nscount - 1;
+        int fd;
+        u_int16_t nstime;
+
+        if (statp->_u._ext.ext != NULL) inu = statp->_u._ext.ext->nsaddrs[0];
+        ina = statp->nsaddr_list[0];
+        fd = statp->_u._ext.nssocks[0];
+        nstime = statp->_u._ext.nstimes[0];
+        for (int ns = 0; ns < lastns; ns++) {
+            if (statp->_u._ext.ext != NULL)
+                statp->_u._ext.ext->nsaddrs[ns] = statp->_u._ext.ext->nsaddrs[ns + 1];
+            statp->nsaddr_list[ns] = statp->nsaddr_list[ns + 1];
+            statp->_u._ext.nssocks[ns] = statp->_u._ext.nssocks[ns + 1];
+            statp->_u._ext.nstimes[ns] = statp->_u._ext.nstimes[ns + 1];
+        }
+        if (statp->_u._ext.ext != NULL) statp->_u._ext.ext->nsaddrs[lastns] = inu;
+        statp->nsaddr_list[lastns] = ina;
+        statp->_u._ext.nssocks[lastns] = fd;
+        statp->_u._ext.nstimes[lastns] = nstime;
+    }
+
+    res_stats stats[MAXNS];
+    res_params params;
+    int revision_id = resolv_cache_get_resolver_stats(statp->netid, &params, stats);
+    if (revision_id < 0) {
+        // TODO: Remove errno once callers stop using it
+        errno = ESRCH;
+        return -ESRCH;
+    }
+    bool usable_servers[MAXNS];
+    int usableServersCount = android_net_res_stats_get_usable_servers(
+            &params, stats, statp->nscount, usable_servers);
+
+    if ((flags & ANDROID_RESOLV_NO_RETRY) && usableServersCount > 1) {
+        auto hp = reinterpret_cast<const HEADER*>(buf);
+
+        // Select a random server based on the query id
+        int selectedServer = (hp->id % usableServersCount) + 1;
+        res_set_usable_server(selectedServer, statp->nscount, usable_servers);
+    }
+
+    /*
+     * Send request, RETRY times, or until successful.
+     */
+    int retryTimes = (flags & ANDROID_RESOLV_NO_RETRY) ? 1 : params.retry_count;
+
+    for (int attempt = 0; attempt < retryTimes; ++attempt) {
+
+        for (int ns = 0; ns < statp->nscount; ns++) {
+            if (!usable_servers[ns]) continue;
+            int nsaplen;
+            time_t now = 0;
+            int delay = 0;
+            *rcode = RCODE_INTERNAL_ERROR;
+            const sockaddr* nsap = get_nsaddr(statp, ns);
+            nsaplen = get_salen(nsap);
+
+        same_ns:
+            // TODO: Since we expect there is only one DNS server being queried here while this
+            // function tries to query all of private DNS servers. Consider moving it to other
+            // reasonable place. In addition, maybe add stats for private DNS.
+            if (!statp->use_local_nameserver) {
+                bool fallback = false;
+                resplen = res_tls_send(statp, Slice(const_cast<u_char*>(buf), buflen),
+                                       Slice(ans, anssiz), rcode, &fallback);
+                if (resplen > 0) {
+                    if (cache_status == RESOLV_CACHE_NOTFOUND) {
+                        _resolv_cache_add(statp->netid, buf, buflen, ans, resplen);
+                    }
+                    return resplen;
+                }
+                if (!fallback) {
+                    _resolv_cache_query_failed(statp->netid, buf, buflen, flags);
+                    res_nclose(statp);
+                    return -terrno;
+                }
+            }
+
+            static const int niflags = NI_NUMERICHOST | NI_NUMERICSERV;
+            char abuf[NI_MAXHOST];
+            DnsQueryEvent* dnsQueryEvent = addDnsQueryEvent(statp->event);
+            dnsQueryEvent->set_cache_hit(static_cast<CacheStatus>(cache_status));
+
+            if (getnameinfo(nsap, (socklen_t)nsaplen, abuf, sizeof(abuf), NULL, 0, niflags) == 0)
+                LOG(DEBUG) << __func__ << ": Querying server (# " << ns + 1
+                           << ") address = " << abuf;
+
+            Stopwatch query_stopwatch;
+            if (v_circuit) {
+                /* Use VC; at most one attempt per server. */
+                bool shouldRecordStats = (attempt == 0);
+                attempt = retryTimes;
+
+                n = send_vc(statp, &params, buf, buflen, ans, anssiz, &terrno, ns, &now, rcode,
+                            &delay);
+
+                dnsQueryEvent->set_latency_micros(
+                        saturate_cast<int32_t>(query_stopwatch.timeTakenUs()));
+                dnsQueryEvent->set_dns_server_index(ns);
+                dnsQueryEvent->set_ip_version(ipFamilyToIPVersion(nsap->sa_family));
+                dnsQueryEvent->set_retry_times(attempt);
+                dnsQueryEvent->set_rcode(static_cast<NsRcode>(*rcode));
+                dnsQueryEvent->set_protocol(PROTO_TCP);
+                dnsQueryEvent->set_type(getQueryType(buf, buflen));
+
+                /*
+                 * Only record stats the first time we try a query. This ensures that
+                 * queries that deterministically fail (e.g., a name that always returns
+                 * SERVFAIL or times out) do not unduly affect the stats.
+                 */
+                if (shouldRecordStats) {
+                    res_sample sample;
+                    _res_stats_set_sample(&sample, now, *rcode, delay);
+                    _resolv_cache_add_resolver_stats_sample(statp->netid, revision_id, ns, &sample,
+                                                            params.max_samples);
+                }
+
+                LOG(INFO) << __func__ << ": used send_vc " << n;
+
+                if (n < 0) {
+                    _resolv_cache_query_failed(statp->netid, buf, buflen, flags);
+                    res_nclose(statp);
+                    return -terrno;
+                };
+                if (n == 0) goto next_ns;
+                resplen = n;
+            } else {
+                /* Use datagrams. */
+                LOG(INFO) << __func__ << ": using send_dg";
+
+                n = send_dg(statp, &params, buf, buflen, ans, anssiz, &terrno, ns, &v_circuit,
+                            &gotsomewhere, &now, rcode, &delay);
+
+                dnsQueryEvent->set_latency_micros(
+                        saturate_cast<int32_t>(query_stopwatch.timeTakenUs()));
+                dnsQueryEvent->set_dns_server_index(ns);
+                dnsQueryEvent->set_ip_version(ipFamilyToIPVersion(nsap->sa_family));
+                dnsQueryEvent->set_retry_times(attempt);
+                dnsQueryEvent->set_rcode(static_cast<NsRcode>(*rcode));
+                dnsQueryEvent->set_protocol(PROTO_UDP);
+                dnsQueryEvent->set_type(getQueryType(buf, buflen));
+
+                /* Only record stats the first time we try a query. See above. */
+                if (attempt == 0) {
+                    res_sample sample;
+                    _res_stats_set_sample(&sample, now, *rcode, delay);
+                    _resolv_cache_add_resolver_stats_sample(statp->netid, revision_id, ns, &sample,
+                                                            params.max_samples);
+                }
+
+                LOG(INFO) << __func__ << ": used send_dg " << n;
+
+                if (n < 0) {
+                    _resolv_cache_query_failed(statp->netid, buf, buflen, flags);
+                    res_nclose(statp);
+                    return -terrno;
+                };
+                if (n == 0) goto next_ns;
+                if (v_circuit) goto same_ns;
+                resplen = n;
+            }
+
+            LOG(DEBUG) << __func__ << ": got answer:";
+            res_pquery(ans, (resplen > anssiz) ? anssiz : resplen);
+
+            if (cache_status == RESOLV_CACHE_NOTFOUND) {
+                _resolv_cache_add(statp->netid, buf, buflen, ans, resplen);
+            }
+            /*
+             * If we have temporarily opened a virtual circuit,
+             * or if we haven't been asked to keep a socket open,
+             * close the socket.
+             */
+            if ((v_circuit && (statp->options & RES_USEVC) == 0U) ||
+                (statp->options & RES_STAYOPEN) == 0U) {
+                res_nclose(statp);
+            }
+            return (resplen);
+        next_ns:;
+        }  // for each ns
+    }  // for each retry
+    res_nclose(statp);
+    if (!v_circuit) {
+        if (!gotsomewhere) {
+            // TODO: Remove errno once callers stop using it
+            errno = ECONNREFUSED; /* no nameservers found */
+            terrno = ECONNREFUSED;
+        } else {
+            // TODO: Remove errno once callers stop using it
+            errno = ETIMEDOUT; /* no answer obtained */
+            terrno = ETIMEDOUT;
+        }
+    } else {
+        errno = terrno;
+    }
+    _resolv_cache_query_failed(statp->netid, buf, buflen, flags);
+    return -terrno;
+}
+
+/* Private */
+
+static int get_salen(const struct sockaddr* sa) {
+    if (sa->sa_family == AF_INET)
+        return (sizeof(struct sockaddr_in));
+    else if (sa->sa_family == AF_INET6)
+        return (sizeof(struct sockaddr_in6));
+    else
+        return (0); /* unknown, die on connect */
+}
+
+/*
+ * pick appropriate nsaddr_list for use.  see res_init() for initialization.
+ */
+static struct sockaddr* get_nsaddr(res_state statp, size_t n) {
+    if (!statp->nsaddr_list[n].sin_family && statp->_u._ext.ext) {
+        /*
+         * - statp->_u._ext.ext->nsaddrs[n] holds an address that is larger
+         *   than struct sockaddr, and
+         * - user code did not update statp->nsaddr_list[n].
+         */
+        return (struct sockaddr*) (void*) &statp->_u._ext.ext->nsaddrs[n];
+    } else {
+        /*
+         * - user code updated statp->nsaddr_list[n], or
+         * - statp->nsaddr_list[n] has the same content as
+         *   statp->_u._ext.ext->nsaddrs[n].
+         */
+        return (struct sockaddr*) (void*) &statp->nsaddr_list[n];
+    }
+}
+
+static struct timespec get_timeout(const res_state statp, const res_params* params, const int ns) {
+    int msec;
+    // Legacy algorithm which scales the timeout by nameserver number.
+    // For instance, with 4 nameservers: 5s, 2.5s, 5s, 10s
+    // This has no effect with 1 or 2 nameservers
+    msec = params->base_timeout_msec << ns;
+    if (ns > 0) {
+        msec /= statp->nscount;
+    }
+    // For safety, don't allow OEMs and experiments to configure a timeout shorter than 1s.
+    if (msec < 1000) {
+        msec = 1000;  // Use at least 1000ms
+    }
+    LOG(INFO) << __func__ << ": using timeout of " << msec << " msec";
+
+    struct timespec result;
+    result.tv_sec = msec / 1000;
+    result.tv_nsec = (msec % 1000) * 1000000;
+    return result;
+}
+
+static int send_vc(res_state statp, res_params* params, const u_char* buf, int buflen, u_char* ans,
+                   int anssiz, int* terrno, int ns, time_t* at, int* rcode, int* delay) {
+    *at = time(NULL);
+    *delay = 0;
+    const HEADER* hp = (const HEADER*) (const void*) buf;
+    HEADER* anhp = (HEADER*) (void*) ans;
+    struct sockaddr* nsap;
+    int nsaplen;
+    int truncating, connreset, n;
+    struct iovec iov[2];
+    u_char* cp;
+
+    LOG(INFO) << __func__ << ": using send_vc";
+
+    nsap = get_nsaddr(statp, (size_t) ns);
+    nsaplen = get_salen(nsap);
+
+    connreset = 0;
+same_ns:
+    truncating = 0;
+
+    struct timespec now = evNowTime();
+
+    /* Are we still talking to whom we want to talk to? */
+    if (statp->_vcsock >= 0 && (statp->_flags & RES_F_VC) != 0) {
+        struct sockaddr_storage peer;
+        socklen_t size = sizeof peer;
+        unsigned old_mark;
+        socklen_t mark_size = sizeof(old_mark);
+        if (getpeername(statp->_vcsock, (struct sockaddr*) (void*) &peer, &size) < 0 ||
+            !sock_eq((struct sockaddr*) (void*) &peer, nsap) ||
+            getsockopt(statp->_vcsock, SOL_SOCKET, SO_MARK, &old_mark, &mark_size) < 0 ||
+            old_mark != statp->_mark) {
+            res_nclose(statp);
+            statp->_flags &= ~RES_F_VC;
+        }
+    }
+
+    if (statp->_vcsock < 0 || (statp->_flags & RES_F_VC) == 0) {
+        if (statp->_vcsock >= 0) res_nclose(statp);
+
+        statp->_vcsock = socket(nsap->sa_family, SOCK_STREAM | SOCK_CLOEXEC, 0);
+        if (statp->_vcsock < 0) {
+            switch (errno) {
+                case EPROTONOSUPPORT:
+                case EPFNOSUPPORT:
+                case EAFNOSUPPORT:
+                    Perror(statp, "socket(vc)", errno);
+                    return 0;
+                default:
+                    *terrno = errno;
+                    Perror(statp, "socket(vc)", errno);
+                    return -1;
+            }
+        }
+        fchown(statp->_vcsock, AID_DNS, -1);
+        if (statp->_mark != MARK_UNSET) {
+            if (setsockopt(statp->_vcsock, SOL_SOCKET, SO_MARK, &statp->_mark,
+                           sizeof(statp->_mark)) < 0) {
+                *terrno = errno;
+                Perror(statp, "setsockopt", errno);
+                return -1;
+            }
+        }
+        errno = 0;
+        if (random_bind(statp->_vcsock, nsap->sa_family) < 0) {
+            *terrno = errno;
+            Aerror(statp, "bind/vc", errno, nsap, nsaplen);
+            res_nclose(statp);
+            return (0);
+        }
+        if (connect_with_timeout(statp->_vcsock, nsap, (socklen_t) nsaplen,
+                                 get_timeout(statp, params, ns)) < 0) {
+            *terrno = errno;
+            Aerror(statp, "connect/vc", errno, nsap, nsaplen);
+            res_nclose(statp);
+            /*
+             * The way connect_with_timeout() is implemented prevents us from reliably
+             * determining whether this was really a timeout or e.g. ECONNREFUSED. Since
+             * currently both cases are handled in the same way, there is no need to
+             * change this (yet). If we ever need to reliably distinguish between these
+             * cases, both connect_with_timeout() and retrying_poll() need to be
+             * modified, though.
+             */
+            *rcode = RCODE_TIMEOUT;
+            return (0);
+        }
+        statp->_flags |= RES_F_VC;
+    }
+
+    /*
+     * Send length & message
+     */
+    uint16_t len = htons(static_cast<uint16_t>(buflen));
+    iov[0] = evConsIovec(&len, INT16SZ);
+    iov[1] = evConsIovec((void*) buf, (size_t) buflen);
+    if (writev(statp->_vcsock, iov, 2) != (INT16SZ + buflen)) {
+        *terrno = errno;
+        Perror(statp, "write failed", errno);
+        res_nclose(statp);
+        return (0);
+    }
+    /*
+     * Receive length & response
+     */
+read_len:
+    cp = ans;
+    len = INT16SZ;
+    while ((n = read(statp->_vcsock, (char*) cp, (size_t) len)) > 0) {
+        cp += n;
+        if ((len -= n) == 0) break;
+    }
+    if (n <= 0) {
+        *terrno = errno;
+        Perror(statp, "read failed", errno);
+        res_nclose(statp);
+        /*
+         * A long running process might get its TCP
+         * connection reset if the remote server was
+         * restarted.  Requery the server instead of
+         * trying a new one.  When there is only one
+         * server, this means that a query might work
+         * instead of failing.  We only allow one reset
+         * per query to prevent looping.
+         */
+        if (*terrno == ECONNRESET && !connreset) {
+            connreset = 1;
+            res_nclose(statp);
+            goto same_ns;
+        }
+        res_nclose(statp);
+        return (0);
+    }
+    uint16_t resplen = ntohs(*reinterpret_cast<const uint16_t*>(ans));
+    if (resplen > anssiz) {
+        LOG(DEBUG) << __func__ << ": response truncated";
+        truncating = 1;
+        len = anssiz;
+    } else
+        len = resplen;
+    if (len < HFIXEDSZ) {
+        /*
+         * Undersized message.
+         */
+        LOG(DEBUG) << __func__ << ": undersized: " << len;
+        *terrno = EMSGSIZE;
+        res_nclose(statp);
+        return (0);
+    }
+    cp = ans;
+    while (len != 0 && (n = read(statp->_vcsock, (char*) cp, (size_t) len)) > 0) {
+        cp += n;
+        len -= n;
+    }
+    if (n <= 0) {
+        *terrno = errno;
+        Perror(statp, "read(vc)", errno);
+        res_nclose(statp);
+        return (0);
+    }
+
+    if (truncating) {
+        /*
+         * Flush rest of answer so connection stays in synch.
+         */
+        anhp->tc = 1;
+        len = resplen - anssiz;
+        while (len != 0) {
+            char junk[PACKETSZ];
+
+            n = read(statp->_vcsock, junk, (len > sizeof junk) ? sizeof junk : len);
+            if (n > 0)
+                len -= n;
+            else
+                break;
+        }
+    }
+    /*
+     * If the calling application has bailed out of
+     * a previous call and failed to arrange to have
+     * the circuit closed or the server has got
+     * itself confused, then drop the packet and
+     * wait for the correct one.
+     */
+    if (hp->id != anhp->id) {
+        LOG(DEBUG) << __func__ << ": ld answer (unexpected):";
+        res_pquery(ans, (resplen > anssiz) ? anssiz : resplen);
+        goto read_len;
+    }
+
+    /*
+     * All is well, or the error is fatal.  Signal that the
+     * next nameserver ought not be tried.
+     */
+    if (resplen > 0) {
+        struct timespec done = evNowTime();
+        *delay = _res_stats_calculate_rtt(&done, &now);
+        *rcode = anhp->rcode;
+    }
+    return (resplen);
+}
+
+/* return -1 on error (errno set), 0 on success */
+static int connect_with_timeout(int sock, const struct sockaddr* nsap, socklen_t salen,
+                                const struct timespec timeout) {
+    int res, origflags;
+
+    origflags = fcntl(sock, F_GETFL, 0);
+    fcntl(sock, F_SETFL, origflags | O_NONBLOCK);
+
+    res = connect(sock, nsap, salen);
+    if (res < 0 && errno != EINPROGRESS) {
+        res = -1;
+        goto done;
+    }
+    if (res != 0) {
+        struct timespec now = evNowTime();
+        struct timespec finish = evAddTime(now, timeout);
+        LOG(INFO) << __func__ << ": " << sock << " send_vc";
+        res = retrying_poll(sock, POLLIN | POLLOUT, &finish);
+        if (res <= 0) {
+            res = -1;
+        }
+    }
+done:
+    fcntl(sock, F_SETFL, origflags);
+    LOG(INFO) << __func__ << ": " << sock << " connect_with_const timeout returning " << res;
+    return res;
+}
+
+static int retrying_poll(const int sock, const short events, const struct timespec* finish) {
+    struct timespec now, timeout;
+
+retry:
+    LOG(INFO) << __func__ << ": " << sock << " retrying_poll";
+
+    now = evNowTime();
+    if (evCmpTime(*finish, now) > 0)
+        timeout = evSubTime(*finish, now);
+    else
+        timeout = evConsTime(0L, 0L);
+    struct pollfd fds = {.fd = sock, .events = events};
+    int n = ppoll(&fds, 1, &timeout, /*sigmask=*/NULL);
+    if (n == 0) {
+        LOG(INFO) << __func__ << ": " << sock << "retrying_poll timeout";
+        errno = ETIMEDOUT;
+        return 0;
+    }
+    if (n < 0) {
+        if (errno == EINTR) goto retry;
+        PLOG(INFO) << __func__ << ": " << sock << " retrying_poll failed";
+        return n;
+    }
+    if (fds.revents & (POLLIN | POLLOUT | POLLERR)) {
+        int error;
+        socklen_t len = sizeof(error);
+        if (getsockopt(sock, SOL_SOCKET, SO_ERROR, &error, &len) < 0 || error) {
+            errno = error;
+            PLOG(INFO) << __func__ << ": " << sock << " retrying_poll getsockopt failed";
+            return -1;
+        }
+    }
+    LOG(INFO) << __func__ << ": " << sock << " retrying_poll returning " << n;
+    return n;
+}
+
+static int send_dg(res_state statp, res_params* params, const u_char* buf, int buflen, u_char* ans,
+                   int anssiz, int* terrno, int ns, int* v_circuit, int* gotsomewhere, time_t* at,
+                   int* rcode, int* delay) {
+    *at = time(NULL);
+    *delay = 0;
+    const HEADER* hp = (const HEADER*) (const void*) buf;
+    HEADER* anhp = (HEADER*) (void*) ans;
+    const struct sockaddr* nsap;
+    int nsaplen;
+    struct timespec now, timeout, finish, done;
+    struct sockaddr_storage from;
+    socklen_t fromlen;
+    int resplen, n, s;
+
+    nsap = get_nsaddr(statp, (size_t) ns);
+    nsaplen = get_salen(nsap);
+    if (statp->_u._ext.nssocks[ns] == -1) {
+        statp->_u._ext.nssocks[ns] = socket(nsap->sa_family, SOCK_DGRAM | SOCK_CLOEXEC, 0);
+        if (statp->_u._ext.nssocks[ns] < 0) {
+            switch (errno) {
+                case EPROTONOSUPPORT:
+                case EPFNOSUPPORT:
+                case EAFNOSUPPORT:
+                    Perror(statp, "socket(dg)", errno);
+                    return (0);
+                default:
+                    *terrno = errno;
+                    Perror(statp, "socket(dg)", errno);
+                    return (-1);
+            }
+        }
+
+        fchown(statp->_u._ext.nssocks[ns], AID_DNS, -1);
+        if (statp->_mark != MARK_UNSET) {
+            if (setsockopt(statp->_u._ext.nssocks[ns], SOL_SOCKET, SO_MARK, &(statp->_mark),
+                           sizeof(statp->_mark)) < 0) {
+                res_nclose(statp);
+                return -1;
+            }
+        }
+#ifndef CANNOT_CONNECT_DGRAM
+        /*
+         * On a 4.3BSD+ machine (client and server,
+         * actually), sending to a nameserver datagram
+         * port with no nameserver will cause an
+         * ICMP port unreachable message to be returned.
+         * If our datagram socket is "connected" to the
+         * server, we get an ECONNREFUSED error on the next
+         * socket operation, and select returns if the
+         * error message is received.  We can thus detect
+         * the absence of a nameserver without timing out.
+         */
+        if (random_bind(statp->_u._ext.nssocks[ns], nsap->sa_family) < 0) {
+            Aerror(statp, "bind(dg)", errno, nsap, nsaplen);
+            res_nclose(statp);
+            return (0);
+        }
+        if (connect(statp->_u._ext.nssocks[ns], nsap, (socklen_t) nsaplen) < 0) {
+            Aerror(statp, "connect(dg)", errno, nsap, nsaplen);
+            res_nclose(statp);
+            return (0);
+        }
+#endif /* !CANNOT_CONNECT_DGRAM */
+        LOG(DEBUG) << __func__ << ": new DG socket";
+    }
+    s = statp->_u._ext.nssocks[ns];
+#ifndef CANNOT_CONNECT_DGRAM
+    if (send(s, (const char*) buf, (size_t) buflen, 0) != buflen) {
+        Perror(statp, "send", errno);
+        res_nclose(statp);
+        return 0;
+    }
+#else  /* !CANNOT_CONNECT_DGRAM */
+    if (sendto(s, (const char*) buf, buflen, 0, nsap, nsaplen) != buflen) {
+        Aerror(statp, "sendto", errno, nsap, nsaplen);
+        res_nclose(statp);
+        return 0;
+    }
+#endif /* !CANNOT_CONNECT_DGRAM */
+
+    // Wait for reply.
+    timeout = get_timeout(statp, params, ns);
+    now = evNowTime();
+    finish = evAddTime(now, timeout);
+retry:
+    n = retrying_poll(s, POLLIN, &finish);
+
+    if (n == 0) {
+        *rcode = RCODE_TIMEOUT;
+        LOG(DEBUG) << __func__ << ": timeout";
+        *gotsomewhere = 1;
+        return 0;
+    }
+    if (n < 0) {
+        Perror(statp, "poll", errno);
+        res_nclose(statp);
+        return 0;
+    }
+    errno = 0;
+    fromlen = sizeof(from);
+    resplen = recvfrom(s, (char*) ans, (size_t) anssiz, 0, (struct sockaddr*) (void*) &from,
+                       &fromlen);
+    if (resplen <= 0) {
+        Perror(statp, "recvfrom", errno);
+        res_nclose(statp);
+        return 0;
+    }
+    *gotsomewhere = 1;
+    if (resplen < HFIXEDSZ) {
+        /*
+         * Undersized message.
+         */
+        LOG(DEBUG) << __func__ << ": undersized: " << resplen;
+        *terrno = EMSGSIZE;
+        res_nclose(statp);
+        return 0;
+    }
+    if (hp->id != anhp->id) {
+        /*
+         * response from old query, ignore it.
+         * XXX - potential security hazard could
+         *	 be detected here.
+         */
+        LOG(DEBUG) << __func__ << ": old answer:";
+        res_pquery(ans, (resplen > anssiz) ? anssiz : resplen);
+        goto retry;
+    }
+    if (!(statp->options & RES_INSECURE1) &&
+        !res_ourserver_p(statp, (struct sockaddr*) (void*) &from)) {
+        /*
+         * response from wrong server? ignore it.
+         * XXX - potential security hazard could
+         *	 be detected here.
+         */
+        LOG(DEBUG) << __func__ << ": not our server:";
+        res_pquery(ans, (resplen > anssiz) ? anssiz : resplen);
+        goto retry;
+    }
+    if (anhp->rcode == FORMERR && (statp->options & RES_USE_EDNS0) != 0U) {
+        /*
+         * Do not retry if the server do not understand EDNS0.
+         * The case has to be captured here, as FORMERR packet do not
+         * carry query section, hence res_queriesmatch() returns 0.
+         */
+        LOG(DEBUG) << __func__ << ": server rejected query with EDNS0:";
+        res_pquery(ans, (resplen > anssiz) ? anssiz : resplen);
+        /* record the error */
+        statp->_flags |= RES_F_EDNS0ERR;
+        res_nclose(statp);
+        return 0;
+    }
+    if (!(statp->options & RES_INSECURE2) &&
+        !res_queriesmatch(buf, buf + buflen, ans, ans + anssiz)) {
+        /*
+         * response contains wrong query? ignore it.
+         * XXX - potential security hazard could
+         *	 be detected here.
+         */
+        LOG(DEBUG) << __func__ << ": wrong query name:";
+        res_pquery(ans, (resplen > anssiz) ? anssiz : resplen);
+        goto retry;
+    }
+    done = evNowTime();
+    *delay = _res_stats_calculate_rtt(&done, &now);
+    if (anhp->rcode == SERVFAIL || anhp->rcode == NOTIMP || anhp->rcode == REFUSED) {
+        LOG(DEBUG) << __func__ << ": server rejected query:";
+        res_pquery(ans, (resplen > anssiz) ? anssiz : resplen);
+        res_nclose(statp);
+        *rcode = anhp->rcode;
+        return 0;
+    }
+    if (!(statp->options & RES_IGNTC) && anhp->tc) {
+        /*
+         * To get the rest of answer,
+         * use TCP with same server.
+         */
+        LOG(DEBUG) << __func__ << ": truncated answer";
+        *v_circuit = 1;
+        res_nclose(statp);
+        return 1;
+    }
+    /*
+     * All is well, or the error is fatal.  Signal that the
+     * next nameserver ought not be tried.
+     */
+    if (resplen > 0) {
+        *rcode = anhp->rcode;
+    }
+    return resplen;
+}
+
+static void Aerror(const res_state statp, const char* string, int error,
+                   const struct sockaddr* address, int alen) {
+    const int save = errno;
+    char hbuf[NI_MAXHOST];
+    char sbuf[NI_MAXSERV];
+    constexpr int niflags = NI_NUMERICHOST | NI_NUMERICSERV;
+
+    if ((statp->options & RES_DEBUG) != 0U) {
+        if (getnameinfo(address, (socklen_t) alen, hbuf, sizeof(hbuf), sbuf, sizeof(sbuf),
+                        niflags)) {
+            strncpy(hbuf, "?", sizeof(hbuf) - 1);
+            hbuf[sizeof(hbuf) - 1] = '\0';
+            strncpy(sbuf, "?", sizeof(sbuf) - 1);
+            sbuf[sizeof(sbuf) - 1] = '\0';
+        }
+        LOG(DEBUG) << __func__ << ": " << string << " ([" << hbuf << "]." << sbuf
+                   << "): " << strerror(error);
+    }
+    errno = save;
+}
+
+static void Perror(const res_state statp, const char* string, int error) {
+    if ((statp->options & RES_DEBUG) != 0U) {
+        LOG(DEBUG) << __func__ << ": " << string << ": " << strerror(error);
+    }
+}
+
+static int sock_eq(struct sockaddr* a, struct sockaddr* b) {
+    struct sockaddr_in *a4, *b4;
+    struct sockaddr_in6 *a6, *b6;
+
+    if (a->sa_family != b->sa_family) return 0;
+    switch (a->sa_family) {
+        case AF_INET:
+            a4 = (struct sockaddr_in*) (void*) a;
+            b4 = (struct sockaddr_in*) (void*) b;
+            return a4->sin_port == b4->sin_port && a4->sin_addr.s_addr == b4->sin_addr.s_addr;
+        case AF_INET6:
+            a6 = (struct sockaddr_in6*) (void*) a;
+            b6 = (struct sockaddr_in6*) (void*) b;
+            return a6->sin6_port == b6->sin6_port &&
+#ifdef HAVE_SIN6_SCOPE_ID
+                   a6->sin6_scope_id == b6->sin6_scope_id &&
+#endif
+                   IN6_ARE_ADDR_EQUAL(&a6->sin6_addr, &b6->sin6_addr);
+        default:
+            return 0;
+    }
+}
+
+PrivateDnsModes convertEnumType(PrivateDnsMode privateDnsmode) {
+    switch (privateDnsmode) {
+        case PrivateDnsMode::OFF:
+            return PrivateDnsModes::PDM_OFF;
+        case PrivateDnsMode::OPPORTUNISTIC:
+            return PrivateDnsModes::PDM_OPPORTUNISTIC;
+        case PrivateDnsMode::STRICT:
+            return PrivateDnsModes::PDM_STRICT;
+    }
+    return PrivateDnsModes::PDM_UNKNOWN;
+}
+
+static int res_tls_send(res_state statp, const Slice query, const Slice answer, int* rcode,
+                        bool* fallback) {
+    int resplen = 0;
+    const unsigned netId = statp->netid;
+
+    PrivateDnsStatus privateDnsStatus = gPrivateDnsConfiguration.getStatus(netId);
+    statp->event->set_private_dns_modes(convertEnumType(privateDnsStatus.mode));
+
+    if (privateDnsStatus.mode == PrivateDnsMode::OFF) {
+        *fallback = true;
+        return -1;
+    }
+
+    if (privateDnsStatus.validatedServers.empty()) {
+        if (privateDnsStatus.mode == PrivateDnsMode::OPPORTUNISTIC) {
+            *fallback = true;
+            return -1;
+        } else {
+            // Sleep and iterate some small number of times checking for the
+            // arrival of resolved and validated server IP addresses, instead
+            // of returning an immediate error.
+            // This is needed because as soon as a network becomes the default network, apps will
+            // send DNS queries on that network. If no servers have yet validated, and we do not
+            // block those queries, they would immediately fail, causing application-visible errors.
+            // Note that this can happen even before the network validates, since an unvalidated
+            // network can become the default network if no validated networks are available.
+            //
+            // TODO: see if there is a better way to address this problem, such as buffering the
+            // queries in a queue or only blocking queries for the first few seconds after a default
+            // network change.
+            for (int i = 0; i < 42; i++) {
+                std::this_thread::sleep_for(std::chrono::milliseconds(100));
+                if (!gPrivateDnsConfiguration.getStatus(netId).validatedServers.empty()) {
+                    privateDnsStatus = gPrivateDnsConfiguration.getStatus(netId);
+                    break;
+                }
+            }
+            if (privateDnsStatus.validatedServers.empty()) {
+                return -1;
+            }
+        }
+    }
+
+    LOG(INFO) << __func__ << ": performing query over TLS";
+
+    const auto response = sDnsTlsDispatcher.query(privateDnsStatus.validatedServers, statp, query,
+                                                  answer, &resplen);
+
+    LOG(INFO) << __func__ << ": TLS query result: " << static_cast<int>(response);
+
+    if (privateDnsStatus.mode == PrivateDnsMode::OPPORTUNISTIC) {
+        // In opportunistic mode, handle falling back to cleartext in some
+        // cases (DNS shouldn't fail if a validated opportunistic mode server
+        // becomes unreachable for some reason).
+        switch (response) {
+            case DnsTlsTransport::Response::success:
+                *rcode = reinterpret_cast<HEADER*>(answer.base())->rcode;
+                return resplen;
+            case DnsTlsTransport::Response::network_error:
+                // No need to set the error timeout here since it will fallback to UDP.
+            case DnsTlsTransport::Response::internal_error:
+                // Note: this will cause cleartext queries to be emitted, with
+                // all of the EDNS0 goodness enabled. Fingers crossed.  :-/
+                *fallback = true;
+                [[fallthrough]];
+            default:
+                return -1;
+        }
+    } else {
+        // Strict mode
+        switch (response) {
+            case DnsTlsTransport::Response::success:
+                *rcode = reinterpret_cast<HEADER*>(answer.base())->rcode;
+                return resplen;
+            case DnsTlsTransport::Response::network_error:
+                // This case happens when the query stored in DnsTlsTransport is expired since
+                // either 1) the query has been tried for 3 times but no response or 2) fail to
+                // establish the connection with the server.
+                *rcode = RCODE_TIMEOUT;
+                [[fallthrough]];
+            default:
+                return -1;
+        }
+    }
+}
+
+int resolv_res_nsend(const android_net_context* netContext, const uint8_t* msg, int msgLen,
+                     uint8_t* ans, int ansLen, int* rcode, uint32_t flags,
+                     NetworkDnsEventReported* event) {
+    assert(event != nullptr);
+    res_state res = res_get_state();
+    res_setnetcontext(res, netContext, event);
+    _resolv_populate_res_for_net(res);
+    *rcode = NOERROR;
+    return res_nsend(res, msg, msgLen, ans, ansLen, rcode, flags);
+}
diff --git a/resolv/res_send.h b/resolv/res_send.h
new file mode 100644
index 0000000..fb80160
--- /dev/null
+++ b/resolv/res_send.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "netd_resolv/resolv.h"  // struct android_net_context
+#include "stats.pb.h"
+
+// Query dns with raw msg
+int resolv_res_nsend(const android_net_context* netContext, const uint8_t* msg, int msgLen,
+                     uint8_t* ans, int ansLen, int* rcode, uint32_t flags,
+                     android::net::NetworkDnsEventReported* event);
diff --git a/resolv/res_state.cpp b/resolv/res_state.cpp
new file mode 100644
index 0000000..26febff
--- /dev/null
+++ b/resolv/res_state.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#define LOG_TAG "res_state"
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <netdb.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h> /* for gettid() */
+
+#include <android-base/logging.h>
+
+#include "resolv_cache.h"
+#include "resolv_private.h"
+
+typedef struct {
+    // TODO: Have one __res_state per network so we don't have to repopulate frequently.
+    struct __res_state _nres[1];
+    struct res_static _rstatic[1];
+} _res_thread;
+
+static _res_thread* res_thread_alloc(void) {
+    _res_thread* rt = (_res_thread*) calloc(1, sizeof(*rt));
+
+    if (rt) {
+        memset(rt->_rstatic, 0, sizeof rt->_rstatic);
+    }
+    return rt;
+}
+
+static void res_static_done(struct res_static* rs) {
+    /* fortunately, there is nothing to do here, since the
+     * points in h_addr_ptrs and host_aliases should all
+     * point to 'hostbuf'
+     */
+    if (rs->hostf) { /* should not happen in theory, but just be safe */
+        fclose(rs->hostf);
+        rs->hostf = NULL;
+    }
+    free(rs->servent.s_aliases);
+}
+
+static void res_thread_free(void* _rt) {
+    _res_thread* rt = (_res_thread*) _rt;
+
+    LOG(VERBOSE) << __func__ << ": rt=" << rt << " for thread=" << gettid();
+
+    res_static_done(rt->_rstatic);
+    res_ndestroy(rt->_nres);
+    free(rt);
+}
+
+static pthread_key_t _res_key;
+
+__attribute__((constructor)) static void __res_key_init() {
+    pthread_key_create(&_res_key, res_thread_free);
+}
+
+static _res_thread* res_thread_get(void) {
+    _res_thread* rt = (_res_thread*) pthread_getspecific(_res_key);
+    if (rt != NULL) {
+        return rt;
+    }
+
+    /* It is the first time this function is called in this thread,
+     * we need to create a new thread-specific DNS resolver state. */
+    rt = res_thread_alloc();
+    if (rt == NULL) {
+        return NULL;
+    }
+    pthread_setspecific(_res_key, rt);
+
+    /* Reset the state, note that res_ninit() can now properly reset
+     * an existing state without leaking memory.
+     */
+    LOG(VERBOSE) << __func__ << ": tid=" << gettid() << ", rt=" << rt
+                 << " setting DNS state (options=" << rt->_nres->options << ")";
+    if (res_ninit(rt->_nres) < 0) {
+        /* This should not happen */
+        LOG(VERBOSE) << __func__ << ": tid=" << gettid() << " rt=" << rt
+                     << ", res_ninit() returned < 0";
+        res_thread_free(rt);
+        pthread_setspecific(_res_key, NULL);
+        return NULL;
+    }
+    return rt;
+}
+
+struct __res_state _nres;
+
+res_state res_get_state(void) {
+    _res_thread* rt = res_thread_get();
+
+    return rt ? rt->_nres : NULL;
+}
+
+res_static* res_get_static(void) {
+    _res_thread* rt = res_thread_get();
+
+    return rt ? rt->_rstatic : NULL;
+}
diff --git a/resolv/res_state_ext.h b/resolv/res_state_ext.h
new file mode 100644
index 0000000..6ed3398
--- /dev/null
+++ b/resolv/res_state_ext.h
@@ -0,0 +1,22 @@
+/*	$NetBSD: res_private.h,v 1.1.1.1 2004/05/20 17:18:54 christos Exp $	*/
+
+#ifndef NETD_RES_STATE_EXT_H
+#define NETD_RES_STATE_EXT_H
+
+#include "resolv_private.h"
+
+// TODO: consider inlining into res_state
+struct res_state_ext {
+    sockaddr_union nsaddrs[MAXNS];
+    struct sort_list {
+        int af;
+        union {
+            struct in_addr ina;
+            struct in6_addr in6a;
+        } addr, mask;
+    } sort_list[MAXRESOLVSORT];
+    char nsuffix[64];
+    char nsuffix2[64];
+};
+
+#endif  // NETD_RES_STATE_EXT_H
diff --git a/resolv/res_stats.cpp b/resolv/res_stats.cpp
new file mode 100644
index 0000000..ed6f084
--- /dev/null
+++ b/resolv/res_stats.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "res_stats"
+
+#include <arpa/nameser.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include <android-base/logging.h>
+
+#include "netd_resolv/stats.h"
+
+
+// Calculate the round-trip-time from start time t0 and end time t1.
+int _res_stats_calculate_rtt(const timespec* t1, const timespec* t0) {
+    // Divide ns by one million to get ms, multiply s by thousand to get ms (obvious)
+    long ms0 = t0->tv_sec * 1000 + t0->tv_nsec / 1000000;
+    long ms1 = t1->tv_sec * 1000 + t1->tv_nsec / 1000000;
+    return (int) (ms1 - ms0);
+}
+
+// Create a sample for calculating server reachability statistics.
+void _res_stats_set_sample(res_sample* sample, time_t now, int rcode, int rtt) {
+    LOG(INFO) << __func__ << ": rcode = " << rcode << ", sec = " << rtt;
+    sample->at = now;
+    sample->rcode = rcode;
+    sample->rtt = rtt;
+}
+
+/* Clears all stored samples for the given server. */
+void _res_stats_clear_samples(res_stats* stats) {
+    stats->sample_count = stats->sample_next = 0;
+}
+
+/* Aggregates the reachability statistics for the given server based on on the stored samples. */
+void android_net_res_stats_aggregate(res_stats* stats, int* successes, int* errors, int* timeouts,
+                                     int* internal_errors, int* rtt_avg, time_t* last_sample_time) {
+    int s = 0;   // successes
+    int e = 0;   // errors
+    int t = 0;   // timouts
+    int ie = 0;  // internal errors
+    long rtt_sum = 0;
+    time_t last = 0;
+    int rtt_count = 0;
+    for (int i = 0; i < stats->sample_count; ++i) {
+        // Treat everything as an error that the code in send_dg() already considers a
+        // rejection by the server, i.e. SERVFAIL, NOTIMP and REFUSED. Assume that NXDOMAIN
+        // and NOTAUTH can actually occur for user queries. NOERROR with empty answer section
+        // is not treated as an error here either. FORMERR seems to sometimes be returned by
+        // some versions of BIND in response to DNSSEC or EDNS0. Whether to treat such responses
+        // as an indication of a broken server is unclear, though. For now treat such responses,
+        // as well as unknown codes as errors.
+        switch (stats->samples[i].rcode) {
+            case NOERROR:
+            case NOTAUTH:
+            case NXDOMAIN:
+                ++s;
+                rtt_sum += stats->samples[i].rtt;
+                ++rtt_count;
+                break;
+            case RCODE_TIMEOUT:
+                ++t;
+                break;
+            case RCODE_INTERNAL_ERROR:
+                ++ie;
+                break;
+            case SERVFAIL:
+            case NOTIMP:
+            case REFUSED:
+            default:
+                ++e;
+                break;
+        }
+    }
+    *successes = s;
+    *errors = e;
+    *timeouts = t;
+    *internal_errors = ie;
+    /* If there was at least one successful sample, calculate average RTT. */
+    if (rtt_count) {
+        *rtt_avg = rtt_sum / rtt_count;
+    } else {
+        *rtt_avg = -1;
+    }
+    /* If we had at least one sample, populate last sample time. */
+    if (stats->sample_count > 0) {
+        if (stats->sample_next > 0) {
+            last = stats->samples[stats->sample_next - 1].at;
+        } else {
+            last = stats->samples[stats->sample_count - 1].at;
+        }
+    }
+    *last_sample_time = last;
+}
+
+// Returns true if the server is considered usable, i.e. if the success rate is not lower than the
+// threshold for the stored stored samples. If not enough samples are stored, the server is
+// considered usable.
+static bool res_stats_usable_server(const res_params* params, res_stats* stats) {
+    int successes = -1;
+    int errors = -1;
+    int timeouts = -1;
+    int internal_errors = -1;
+    int rtt_avg = -1;
+    time_t last_sample_time = 0;
+    android_net_res_stats_aggregate(stats, &successes, &errors, &timeouts, &internal_errors,
+                                    &rtt_avg, &last_sample_time);
+    if (successes >= 0 && errors >= 0 && timeouts >= 0) {
+        int total = successes + errors + timeouts;
+        LOG(INFO) << __func__ << ": NS stats: S " << successes << " + E " << errors << " + T "
+                  << timeouts << " + I " << internal_errors << " = " << total
+                  << ", rtt = " << rtt_avg << ", min_samples = " << unsigned(params->min_samples);
+        if (total >= params->min_samples && (errors > 0 || timeouts > 0)) {
+            int success_rate = successes * 100 / total;
+            LOG(INFO) << __func__ << ": success rate " << success_rate;
+            if (success_rate < params->success_threshold) {
+                time_t now = time(NULL);
+                if (now - last_sample_time > params->sample_validity) {
+                    // Note: It might be worth considering to expire old servers after their expiry
+                    // date has been reached, however the code for returning the ring buffer to its
+                    // previous non-circular state would induce additional complexity.
+                    LOG(INFO) << __func__ << ": samples stale, retrying server";
+                    _res_stats_clear_samples(stats);
+                } else {
+                    LOG(INFO) << __func__ << ": too many resolution errors, ignoring server";
+                    return 0;
+                }
+            }
+        }
+    }
+    return 1;
+}
+
+int android_net_res_stats_get_usable_servers(const res_params* params, res_stats stats[],
+                                             int nscount, bool usable_servers[]) {
+    unsigned usable_servers_found = 0;
+    for (int ns = 0; ns < nscount; ns++) {
+        bool usable = res_stats_usable_server(params, &stats[ns]);
+        if (usable) {
+            ++usable_servers_found;
+        }
+        usable_servers[ns] = usable;
+    }
+    // If there are no usable servers, consider all of them usable.
+    // TODO: Explore other possibilities, such as enabling only the best N servers, etc.
+    if (usable_servers_found == 0) {
+        for (int ns = 0; ns < nscount; ns++) {
+            usable_servers[ns] = true;
+        }
+    }
+    return (usable_servers_found == 0) ? nscount : usable_servers_found;
+}
diff --git a/resolv/resolv_cache.h b/resolv/resolv_cache.h
new file mode 100644
index 0000000..df21fb3
--- /dev/null
+++ b/resolv/resolv_cache.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2008 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "netd_resolv/resolv.h"
+
+#include <stddef.h>
+
+#include <unordered_map>
+#include <vector>
+
+struct __res_state;
+
+constexpr int DNSEVENT_SUBSAMPLING_MAP_DEFAULT_KEY = -1;
+
+/* sets the name server addresses to the provided res_state structure. The
+ * name servers are retrieved from the cache which is associated
+ * with the network to which the res_state structure is associated */
+void _resolv_populate_res_for_net(struct __res_state* statp);
+
+std::vector<unsigned> resolv_list_caches();
+
+std::vector<std::string> resolv_cache_dump_subsampling_map(unsigned netid);
+uint32_t resolv_cache_get_subsampling_denom(unsigned netid, int return_code);
+
+typedef enum {
+    RESOLV_CACHE_UNSUPPORTED, /* the cache can't handle that kind of queries */
+                              /* or the answer buffer is too small */
+    RESOLV_CACHE_NOTFOUND,    /* the cache doesn't know about this query */
+    RESOLV_CACHE_FOUND,       /* the cache found the answer */
+    RESOLV_CACHE_SKIP         /* Don't do anything on cache */
+} ResolvCacheStatus;
+
+ResolvCacheStatus _resolv_cache_lookup(unsigned netid, const void* query, int querylen,
+                                       void* answer, int answersize, int* answerlen,
+                                       uint32_t flags);
+
+/* add a (query,answer) to the cache, only call if _resolv_cache_lookup
+ * did return RESOLV_CACHE_NOTFOUND
+ */
+void _resolv_cache_add(unsigned netid, const void* query, int querylen, const void* answer,
+                       int answerlen);
+
+/* Notify the cache a request failed */
+void _resolv_cache_query_failed(unsigned netid, const void* query, int querylen, uint32_t flags);
+
+// Sets name servers for a given network.
+int resolv_set_nameservers_for_net(unsigned netid, const char** servers, int numservers,
+                                   const char* domains, const res_params* params);
+
+// Creates the cache associated with the given network.
+int resolv_create_cache_for_net(unsigned netid);
+
+// Deletes the cache associated with the given network.
+void resolv_delete_cache_for_net(unsigned netid);
diff --git a/resolv/resolv_private.h b/resolv/resolv_private.h
new file mode 100644
index 0000000..3ecb6c1
--- /dev/null
+++ b/resolv/resolv_private.h
@@ -0,0 +1,255 @@
+/*	$NetBSD: resolv.h,v 1.31 2005/12/26 19:01:47 perry Exp $	*/
+
+/*
+ * Copyright (c) 1983, 1987, 1989
+ *    The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (c) 1996-1999 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ *	@(#)resolv.h	8.1 (Berkeley) 6/2/93
+ *	Id: resolv.h,v 1.7.2.11.4.2 2004/06/25 00:41:05 marka Exp
+ */
+
+#ifndef NETD_RESOLV_PRIVATE_H
+#define NETD_RESOLV_PRIVATE_H
+
+#include <android-base/logging.h>
+#include <net/if.h>
+#include <resolv.h>
+#include <time.h>
+#include <string>
+
+#include "netd_resolv/params.h"
+#include "netd_resolv/resolv.h"
+#include "netd_resolv/stats.h"
+#include "resolv_static.h"
+#include "stats.pb.h"
+
+// Linux defines MAXHOSTNAMELEN as 64, while the domain name limit in
+// RFC 1034 and RFC 1035 is 255 octets.
+#ifdef MAXHOSTNAMELEN
+#undef MAXHOSTNAMELEN
+#endif
+#define MAXHOSTNAMELEN 256
+
+/*
+ * Global defines and variables for resolver stub.
+ */
+#define MAXDFLSRCH 3       /* # default domain levels to try */
+#define LOCALDOMAINPARTS 2 /* min levels in name that is "local" */
+
+#define RES_TIMEOUT 5000 /* min. milliseconds between retries */
+#define MAXRESOLVSORT 10  /* number of net to sort on */
+#define RES_MAXNDOTS 15   /* should reflect bit field size */
+#define RES_DFLRETRY 2    /* Default #/tries. */
+#define RES_MAXTIME 65535 /* Infinity, in milliseconds. */
+
+struct res_state_ext;
+
+struct __res_state {
+    unsigned netid;                        /* NetId: cache key and socket mark */
+    u_long options;                        /* option flags - see below. */
+    int nscount;                           /* number of name srvers */
+    struct sockaddr_in nsaddr_list[MAXNS]; /* address of name server */
+#define nsaddr nsaddr_list[0]              /* for backward compatibility */
+    u_short id;                            /* current message id */
+    char* dnsrch[MAXDNSRCH + 1];           /* components of domain to search */
+    char defdname[256];                    /* default domain (deprecated) */
+    unsigned ndots : 4;                    /* threshold for initial abs. query */
+    unsigned nsort : 4;                    /* number of elements in sort_list[] */
+    char unused[3];
+    struct {
+        struct in_addr addr;
+        uint32_t mask;
+    } sort_list[MAXRESOLVSORT];
+    unsigned _mark;       /* If non-0 SET_MARK to _mark on all request sockets */
+    int _vcsock;          /* PRIVATE: for res_send VC i/o */
+    u_int _flags;         /* PRIVATE: see below */
+    u_int _pad;           /* make _u 64 bit aligned */
+    union {
+        /* On an 32-bit arch this means 512b total. */
+        char pad[72 - 4 * sizeof(int) - 2 * sizeof(void*)];
+        struct {
+            uint16_t nscount;
+            uint16_t nstimes[MAXNS]; /* ms. */
+            int nssocks[MAXNS];
+            struct res_state_ext* ext; /* extention for IPv6 */
+        } _ext;
+    } _u;
+    struct res_static rstatic[1];
+    bool use_local_nameserver; /* DNS-over-TLS bypass */
+    android::net::NetworkDnsEventReported* event;
+};
+
+typedef struct __res_state* res_state;
+
+/* Retrieve a local copy of the stats for the given netid. The buffer must have space for
+ * MAXNS __resolver_stats. Returns the revision id of the resolvers used.
+ */
+int resolv_cache_get_resolver_stats(unsigned netid, res_params* params, res_stats stats[MAXNS]);
+
+/* Add a sample to the shared struct for the given netid and server, provided that the
+ * revision_id of the stored servers has not changed.
+ */
+void _resolv_cache_add_resolver_stats_sample(unsigned netid, int revision_id, int ns,
+                                             const res_sample* sample, int max_samples);
+
+// Calculate the round-trip-time from start time t0 and end time t1.
+int _res_stats_calculate_rtt(const timespec* t1, const timespec* t0);
+
+// Create a sample for calculating server reachability statistics.
+void _res_stats_set_sample(res_sample* sample, time_t now, int rcode, int rtt);
+
+/* End of stats related definitions */
+
+// Flags for res_state->_flags
+#define RES_F_VC 0x00000001        // socket is TCP
+#define RES_F_EDNS0ERR 0x00000004  // EDNS0 caused errors
+
+/*
+ * Resolver options (keep these in synch with res_debug.c, please)
+ */
+#define RES_INIT 0x00000001           /* address initialized */
+#define RES_DEBUG 0x00000002          /* print debug messages */
+#define RES_AAONLY 0x00000004         /* authoritative answers only (!IMPL)*/
+#define RES_USEVC 0x00000008          /* use virtual circuit */
+#define RES_PRIMARY 0x00000010        /* query primary server only (!IMPL) */
+#define RES_IGNTC 0x00000020          /* ignore trucation errors */
+#define RES_RECURSE 0x00000040        /* recursion desired */
+#define RES_DEFNAMES 0x00000080       /* use default domain name */
+#define RES_STAYOPEN 0x00000100       /* Keep TCP socket open */
+#define RES_DNSRCH 0x00000200         /* search up local domain tree */
+#define RES_INSECURE1 0x00000400      /* type 1 security disabled */
+#define RES_INSECURE2 0x00000800      /* type 2 security disabled */
+#define RES_USE_INET6 0x00002000      /* use/map IPv6 in gethostbyname() */
+#define RES_ROTATE 0x00004000         /* rotate ns list after each query */
+#define RES_NOCHECKNAME 0x00008000    /* do not check names for sanity. */
+#define RES_KEEPTSIG 0x00010000       /* do not strip TSIG records */
+#define RES_BLAST 0x00020000          /* blast all recursive servers */
+#define RES_NOTLDQUERY 0x00100000     /* don't unqualified name as a tld */
+#define RES_USE_DNSSEC 0x00200000     /* use DNSSEC using OK bit in OPT */
+/* #define RES_DEBUG2	0x00400000 */ /* nslookup internal */
+/* KAME extensions: use higher bit to avoid conflict with ISC use */
+#define RES_USE_DNAME 0x10000000  /* use DNAME */
+#define RES_USE_EDNS0 0x40000000  /* use EDNS0 if configured */
+#define RES_NO_NIBBLE2 0x80000000 /* disable alternate nibble lookup */
+
+#define RES_DEFAULT (RES_RECURSE | RES_DEFNAMES | RES_DNSRCH | RES_NO_NIBBLE2)
+
+
+/*
+ * Error code extending h_errno codes defined in bionic/libc/include/netdb.h.
+ *
+ * This error code, including legacy h_errno, is returned from res_nquery(), res_nsearch(),
+ * res_nquerydomain(), res_queryN(), res_searchN() and res_querydomainN() for DNS metrics.
+ *
+ * TODO: Consider mapping legacy and extended h_errno into a unified resolver error code mapping.
+ */
+#define NETD_RESOLV_H_ERRNO_EXT_TIMEOUT RCODE_TIMEOUT
+
+extern const char* const _res_opcodes[];
+
+/* Things involving an internal (static) resolver context. */
+struct __res_state* res_get_state(void);
+
+int res_hnok(const char*);
+int res_ownok(const char*);
+int res_mailok(const char*);
+int res_dnok(const char*);
+int dn_skipname(const u_char*, const u_char*);
+void putlong(uint32_t, u_char*);
+void putshort(uint16_t, u_char*);
+
+// Thread-unsafe functions returning pointers to static buffers :-(
+// TODO: switch all res_debug to std::string
+const char* p_class(int);
+const char* p_type(int);
+const char* p_rcode(int);
+const char* p_section(int, int);
+
+int res_nameinquery(const char*, int, int, const u_char*, const u_char*);
+int res_queriesmatch(const u_char*, const u_char*, const u_char*, const u_char*);
+/* Things involving a resolver context. */
+int res_ninit(res_state);
+void res_pquery(const u_char*, int);
+
+int res_nquery(res_state, const char*, int, int, u_char*, int, int*);
+int res_nsearch(res_state, const char*, int, int, u_char*, int, int*);
+int res_nquerydomain(res_state, const char*, const char*, int, int, u_char*, int, int*);
+int res_nmkquery(res_state, int, const char*, int, int, const u_char*, int, const u_char*, u_char*,
+                 int);
+int res_nsend(res_state, const u_char*, int, u_char*, int, int*, uint32_t);
+void res_nclose(res_state);
+int res_nopt(res_state, int, u_char*, int, int);
+int res_vinit(res_state, int);
+void res_ndestroy(res_state);
+void res_setservers(res_state, const sockaddr_union*, int);
+int res_getservers(res_state, sockaddr_union*, int);
+
+struct android_net_context; /* forward */
+void res_setnetcontext(res_state, const struct android_net_context*,
+                       android::net::NetworkDnsEventReported* event);
+
+int getaddrinfo_numeric(const char* hostname, const char* servname, addrinfo hints,
+                        addrinfo** result);
+
+// Helper function for converting h_errno to the error codes visible to netd
+int herrnoToAiErrno(int herrno);
+
+// switch resolver log severity
+android::base::LogSeverity logSeverityStrToEnum(const std::string& logSeverityStr);
+
+template <typename Dest>
+Dest saturate_cast(int64_t x) {
+    using DestLimits = std::numeric_limits<Dest>;
+    if (x > DestLimits::max()) return DestLimits::max();
+    if (x < DestLimits::min()) return DestLimits::min();
+    return static_cast<Dest>(x);
+}
+
+android::net::NsType getQueryType(const uint8_t* msg, size_t msgLen);
+
+android::net::IpVersion ipFamilyToIPVersion(int ipFamily);
+
+#endif  // NETD_RESOLV_PRIVATE_H
diff --git a/resolv/resolv_static.h b/resolv/resolv_static.h
new file mode 100644
index 0000000..b250892
--- /dev/null
+++ b/resolv/resolv_static.h
@@ -0,0 +1,33 @@
+#ifndef NETD_RESOLV_STATIC_H
+#define NETD_RESOLV_STATIC_H
+
+#include <netdb.h>
+#include <stdio.h>
+
+/* this structure contains all the variables that were declared
+ * 'static' in the original NetBSD resolver code.
+ *
+ * this caused vast amounts of crashes and memory corruptions
+ * when the resolver was being used by multiple threads.
+ *
+ * (note: the OpenBSD/FreeBSD resolver has similar 'issues')
+ */
+
+#define MAXALIASES 35
+#define MAXADDRS 35
+
+struct res_static {
+    char* h_addr_ptrs[MAXADDRS + 1];
+    char* host_aliases[MAXALIASES];
+    char hostbuf[8 * 1024];
+    u_int32_t host_addr[16 / sizeof(u_int32_t)]; /* IPv4 or IPv6 */
+    FILE* hostf;
+    int stayopen;
+    const char* servent_ptr;
+    struct servent servent;
+    struct hostent host;
+};
+
+res_static* res_get_static();
+
+#endif  // NETD_RESOLV_STATIC_H
diff --git a/resolv/resolver_test.cpp b/resolv/resolver_test.cpp
new file mode 100644
index 0000000..b135b16
--- /dev/null
+++ b/resolv/resolver_test.cpp
@@ -0,0 +1,3489 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless requied by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#define LOG_TAG "resolv_integration_test"
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <poll.h> /* poll */
+#include <resolv.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <chrono>
+#include <iterator>
+#include <numeric>
+#include <thread>
+
+#include <android-base/parseint.h>
+#include <android-base/stringprintf.h>
+#include <android-base/unique_fd.h>
+#include <android/multinetwork.h>  // ResNsendFlags
+#include <cutils/sockets.h>
+#include <gmock/gmock-matchers.h>
+#include <gtest/gtest.h>
+#include <openssl/base64.h>
+#include <private/android_filesystem_config.h>
+#include <utils/Log.h>
+
+#include "NetdClient.h"
+#include "netid_client.h"  // NETID_UNSET
+#include "netd_resolv/params.h"  // MAX_NS
+
+#include "dns_responder/dns_responder.h"
+#include "dns_responder/dns_responder_client.h"
+#include "dns_responder/dns_tls_frontend.h"
+
+#include "NetdConstants.h"
+#include "ResolverStats.h"
+
+#include "android/net/IDnsResolver.h"
+#include "binder/IServiceManager.h"
+#include "netdutils/ResponseCode.h"
+#include "netdutils/SocketOption.h"
+
+// TODO: make this dynamic and stop depending on implementation details.
+constexpr int TEST_NETID = 30;
+// Valid VPN netId range is 100 ~ 65535
+constexpr int TEST_VPN_NETID = 65502;
+constexpr int MAXPACKET = (8 * 1024);
+
+// Semi-public Bionic hook used by the NDK (frameworks/base/native/android/net.c)
+// Tested here for convenience.
+extern "C" int android_getaddrinfofornet(const char* hostname, const char* servname,
+                                         const addrinfo* hints, unsigned netid, unsigned mark,
+                                         struct addrinfo** result);
+
+using android::base::ParseInt;
+using android::base::StringPrintf;
+using android::base::unique_fd;
+using android::net::ResolverStats;
+using android::netdutils::enableSockopt;
+using android::netdutils::ResponseCode;
+
+// TODO: move into libnetdutils?
+namespace {
+ScopedAddrinfo safe_getaddrinfo(const char* node, const char* service,
+                                const struct addrinfo* hints) {
+    addrinfo* result = nullptr;
+    if (getaddrinfo(node, service, hints, &result) != 0) {
+        result = nullptr;  // Should already be the case, but...
+    }
+    return ScopedAddrinfo(result);
+}
+}  // namespace
+
+class ResolverTest : public ::testing::Test {
+  protected:
+    struct DnsRecord {
+        std::string host_name;  // host name
+        ns_type type;           // record type
+        std::string addr;       // ipv4/v6 address
+    };
+
+    void SetUp() { mDnsClient.SetUp(); }
+    void TearDown() {
+        mDnsClient.TearDown();
+    }
+
+    bool GetResolverInfo(std::vector<std::string>* servers, std::vector<std::string>* domains,
+                         std::vector<std::string>* tlsServers, res_params* params,
+                         std::vector<ResolverStats>* stats,
+                         int* wait_for_pending_req_timeout_count) {
+        using android::net::IDnsResolver;
+        std::vector<int32_t> params32;
+        std::vector<int32_t> stats32;
+        std::vector<int32_t> wait_for_pending_req_timeout_count32{0};
+        auto rv = mDnsClient.resolvService()->getResolverInfo(
+                TEST_NETID, servers, domains, tlsServers, &params32, &stats32,
+                &wait_for_pending_req_timeout_count32);
+
+        if (!rv.isOk() ||
+            params32.size() != static_cast<size_t>(IDnsResolver::RESOLVER_PARAMS_COUNT)) {
+            return false;
+        }
+        *params = res_params{
+                .sample_validity = static_cast<uint16_t>(
+                        params32[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY]),
+                .success_threshold = static_cast<uint8_t>(
+                        params32[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD]),
+                .min_samples =
+                        static_cast<uint8_t>(params32[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES]),
+                .max_samples =
+                        static_cast<uint8_t>(params32[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES]),
+                .base_timeout_msec = params32[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC],
+                .retry_count = params32[IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT],
+        };
+        *wait_for_pending_req_timeout_count = wait_for_pending_req_timeout_count32[0];
+        return ResolverStats::decodeAll(stats32, stats);
+    }
+
+    static std::string ToString(const hostent* he) {
+        if (he == nullptr) return "<null>";
+        char buffer[INET6_ADDRSTRLEN];
+        if (!inet_ntop(he->h_addrtype, he->h_addr_list[0], buffer, sizeof(buffer))) {
+            return "<invalid>";
+        }
+        return buffer;
+    }
+
+    static std::string ToString(const addrinfo* ai) {
+        if (!ai)
+            return "<null>";
+        for (const auto* aip = ai ; aip != nullptr ; aip = aip->ai_next) {
+            char host[NI_MAXHOST];
+            int rv = getnameinfo(aip->ai_addr, aip->ai_addrlen, host, sizeof(host), nullptr, 0,
+                    NI_NUMERICHOST);
+            if (rv != 0)
+                return gai_strerror(rv);
+            return host;
+        }
+        return "<invalid>";
+    }
+
+    static std::string ToString(const ScopedAddrinfo& ai) { return ToString(ai.get()); }
+
+    static std::vector<std::string> ToStrings(const addrinfo* ai) {
+        std::vector<std::string> hosts;
+        if (!ai) {
+            hosts.push_back("<null>");
+            return hosts;
+        }
+        for (const auto* aip = ai; aip != nullptr; aip = aip->ai_next) {
+            char host[NI_MAXHOST];
+            int rv = getnameinfo(aip->ai_addr, aip->ai_addrlen, host, sizeof(host), nullptr, 0,
+                                 NI_NUMERICHOST);
+            if (rv != 0) {
+                hosts.clear();
+                hosts.push_back(gai_strerror(rv));
+                return hosts;
+            } else {
+                hosts.push_back(host);
+            }
+        }
+        if (hosts.empty()) hosts.push_back("<invalid>");
+        return hosts;
+    }
+
+    static std::vector<std::string> ToStrings(const ScopedAddrinfo& ai) {
+        return ToStrings(ai.get());
+    }
+
+    size_t GetNumQueries(const test::DNSResponder& dns, const char* name) const {
+        auto queries = dns.queries();
+        size_t found = 0;
+        for (const auto& p : queries) {
+            if (p.first == name) {
+                ++found;
+            }
+        }
+        return found;
+    }
+
+    size_t GetNumQueriesForType(const test::DNSResponder& dns, ns_type type,
+                                const char* name) const {
+        auto queries = dns.queries();
+        size_t found = 0;
+        for (const auto& p : queries) {
+            if (p.second == type && p.first == name) {
+                ++found;
+            }
+        }
+        return found;
+    }
+
+    bool WaitForPrefix64Detected(int netId, int timeoutMs) {
+        constexpr int intervalMs = 2;
+        const int limit = timeoutMs / intervalMs;
+        for (int count = 0; count <= limit; ++count) {
+            std::string prefix;
+            auto rv = mDnsClient.resolvService()->getPrefix64(netId, &prefix);
+            if (rv.isOk()) {
+                return true;
+            }
+            usleep(intervalMs * 1000);
+        }
+        return false;
+    }
+
+    void RunGetAddrInfoStressTest_Binder(unsigned num_hosts, unsigned num_threads,
+            unsigned num_queries) {
+        std::vector<std::string> domains = { "example.com" };
+        std::vector<std::unique_ptr<test::DNSResponder>> dns;
+        std::vector<std::string> servers;
+        std::vector<DnsResponderClient::DnsResponderClient::Mapping> mappings;
+        ASSERT_NO_FATAL_FAILURE(mDnsClient.SetupMappings(num_hosts, domains, &mappings));
+        ASSERT_NO_FATAL_FAILURE(mDnsClient.SetupDNSServers(MAXNS, mappings, &dns, &servers));
+
+        ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers, domains, kDefaultParams));
+
+        auto t0 = std::chrono::steady_clock::now();
+        std::vector<std::thread> threads(num_threads);
+        for (std::thread& thread : threads) {
+            thread = std::thread([&mappings, num_queries]() {
+                for (unsigned i = 0 ; i < num_queries ; ++i) {
+                    uint32_t ofs = arc4random_uniform(mappings.size());
+                    auto& mapping = mappings[ofs];
+                    addrinfo* result = nullptr;
+                    int rv = getaddrinfo(mapping.host.c_str(), nullptr, nullptr, &result);
+                    EXPECT_EQ(0, rv) << "error [" << rv << "] " << gai_strerror(rv);
+                    if (rv == 0) {
+                        std::string result_str = ToString(result);
+                        EXPECT_TRUE(result_str == mapping.ip4 || result_str == mapping.ip6)
+                            << "result='" << result_str << "', ip4='" << mapping.ip4
+                            << "', ip6='" << mapping.ip6;
+                    }
+                    if (result) {
+                        freeaddrinfo(result);
+                        result = nullptr;
+                    }
+                }
+            });
+        }
+
+        for (std::thread& thread : threads) {
+            thread.join();
+        }
+        auto t1 = std::chrono::steady_clock::now();
+        ALOGI("%u hosts, %u threads, %u queries, %Es", num_hosts, num_threads, num_queries,
+                std::chrono::duration<double>(t1 - t0).count());
+
+        std::vector<std::string> res_servers;
+        std::vector<std::string> res_domains;
+        std::vector<std::string> res_tls_servers;
+        res_params res_params;
+        std::vector<ResolverStats> res_stats;
+        int wait_for_pending_req_timeout_count;
+        ASSERT_TRUE(GetResolverInfo(&res_servers, &res_domains, &res_tls_servers, &res_params,
+                                    &res_stats, &wait_for_pending_req_timeout_count));
+        EXPECT_EQ(0, wait_for_pending_req_timeout_count);
+    }
+
+    void StartDns(test::DNSResponder& dns, const std::vector<DnsRecord>& records) {
+        for (const auto& r : records) {
+            dns.addMapping(r.host_name, r.type, r.addr);
+        }
+
+        ASSERT_TRUE(dns.startServer());
+        dns.clearQueries();
+    }
+
+    DnsResponderClient mDnsClient;
+
+    static constexpr char kLocalHost[] = "localhost";
+    static constexpr char kLocalHostAddr[] = "127.0.0.1";
+    static constexpr char kIp6LocalHost[] = "ip6-localhost";
+    static constexpr char kIp6LocalHostAddr[] = "::1";
+    static constexpr char kHelloExampleCom[] = "hello.example.com.";
+};
+
+TEST_F(ResolverTest, GetHostByName) {
+    constexpr char nonexistent_host_name[] = "nonexistent.example.com.";
+
+    test::DNSResponder dns;
+    StartDns(dns, {{kHelloExampleCom, ns_type::ns_t_a, "1.2.3.3"}});
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    const hostent* result;
+    result = gethostbyname("nonexistent");
+    EXPECT_EQ(1U, GetNumQueriesForType(dns, ns_type::ns_t_a, nonexistent_host_name));
+    ASSERT_TRUE(result == nullptr);
+    ASSERT_EQ(HOST_NOT_FOUND, h_errno);
+
+    dns.clearQueries();
+    result = gethostbyname("hello");
+    EXPECT_EQ(1U, GetNumQueriesForType(dns, ns_type::ns_t_a, kHelloExampleCom));
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(4, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ("1.2.3.3", ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+}
+
+TEST_F(ResolverTest, GetHostByName_cnames) {
+    constexpr char host_name[] = "host.example.com.";
+    size_t cnamecount = 0;
+    test::DNSResponder dns;
+
+    const std::vector<DnsRecord> records = {
+            {kHelloExampleCom, ns_type::ns_t_cname, "a.example.com."},
+            {"a.example.com.", ns_type::ns_t_cname, "b.example.com."},
+            {"b.example.com.", ns_type::ns_t_cname, "c.example.com."},
+            {"c.example.com.", ns_type::ns_t_cname, "d.example.com."},
+            {"d.example.com.", ns_type::ns_t_cname, "e.example.com."},
+            {"e.example.com.", ns_type::ns_t_cname, host_name},
+            {host_name, ns_type::ns_t_a, "1.2.3.3"},
+            {host_name, ns_type::ns_t_aaaa, "2001:db8::42"},
+    };
+    StartDns(dns, records);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    // using gethostbyname2() to resolve ipv4 hello.example.com. to 1.2.3.3
+    // Ensure the v4 address and cnames are correct
+    const hostent* result;
+    result = gethostbyname2("hello", AF_INET);
+    ASSERT_FALSE(result == nullptr);
+
+    for (int i = 0; result != nullptr && result->h_aliases[i] != nullptr; i++) {
+        std::string domain_name = records[i].host_name.substr(0, records[i].host_name.size() - 1);
+        EXPECT_EQ(result->h_aliases[i], domain_name);
+        cnamecount++;
+    }
+    // The size of "Non-cname type" record in DNS records is 2
+    ASSERT_EQ(cnamecount, records.size() - 2);
+    ASSERT_EQ(4, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ("1.2.3.3", ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+    EXPECT_EQ(1U, dns.queries().size()) << dns.dumpQueries();
+
+    // using gethostbyname2() to resolve ipv6 hello.example.com. to 2001:db8::42
+    // Ensure the v6 address and cnames are correct
+    cnamecount = 0;
+    dns.clearQueries();
+    result = gethostbyname2("hello", AF_INET6);
+    for (unsigned i = 0; result != nullptr && result->h_aliases[i] != nullptr; i++) {
+        std::string domain_name = records[i].host_name.substr(0, records[i].host_name.size() - 1);
+        EXPECT_EQ(result->h_aliases[i], domain_name);
+        cnamecount++;
+    }
+    // The size of "Non-cname type" DNS record in records is 2
+    ASSERT_EQ(cnamecount, records.size() - 2);
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(16, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ("2001:db8::42", ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+}
+
+TEST_F(ResolverTest, GetHostByName_cnamesInfiniteLoop) {
+    test::DNSResponder dns;
+    const std::vector<DnsRecord> records = {
+            {kHelloExampleCom, ns_type::ns_t_cname, "a.example.com."},
+            {"a.example.com.", ns_type::ns_t_cname, kHelloExampleCom},
+    };
+    StartDns(dns, records);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    const hostent* result;
+    result = gethostbyname2("hello", AF_INET);
+    ASSERT_TRUE(result == nullptr);
+
+    dns.clearQueries();
+    result = gethostbyname2("hello", AF_INET6);
+    ASSERT_TRUE(result == nullptr);
+}
+
+TEST_F(ResolverTest, GetHostByName_localhost) {
+    constexpr char name_camelcase[] = "LocalHost";
+    constexpr char name_ip6_dot[] = "ip6-localhost.";
+    constexpr char name_ip6_fqdn[] = "ip6-localhost.example.com.";
+
+    // Add a dummy nameserver which shouldn't receive any queries
+    test::DNSResponder dns;
+    StartDns(dns, {});
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    // Expect no DNS queries; localhost is resolved via /etc/hosts
+    const hostent* result = gethostbyname(kLocalHost);
+    EXPECT_TRUE(dns.queries().empty()) << dns.dumpQueries();
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(4, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ(kLocalHostAddr, ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+
+    // Ensure the hosts file resolver ignores case of hostnames
+    result = gethostbyname(name_camelcase);
+    EXPECT_TRUE(dns.queries().empty()) << dns.dumpQueries();
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(4, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ(kLocalHostAddr, ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+
+    // The hosts file also contains ip6-localhost, but gethostbyname() won't
+    // return it unless the RES_USE_INET6 option is set. This would be easy to
+    // change, but there's no point in changing the legacy behavior; new code
+    // should be calling getaddrinfo() anyway.
+    // So we check the legacy behavior, which results in amusing A-record
+    // lookups for ip6-localhost, with and without search domains appended.
+    dns.clearQueries();
+    result = gethostbyname(kIp6LocalHost);
+    EXPECT_EQ(2U, dns.queries().size()) << dns.dumpQueries();
+    EXPECT_EQ(1U, GetNumQueriesForType(dns, ns_type::ns_t_a, name_ip6_dot)) << dns.dumpQueries();
+    EXPECT_EQ(1U, GetNumQueriesForType(dns, ns_type::ns_t_a, name_ip6_fqdn)) << dns.dumpQueries();
+    ASSERT_TRUE(result == nullptr);
+
+    // Finally, use gethostbyname2() to resolve ip6-localhost to ::1 from
+    // the hosts file.
+    dns.clearQueries();
+    result = gethostbyname2(kIp6LocalHost, AF_INET6);
+    EXPECT_TRUE(dns.queries().empty()) << dns.dumpQueries();
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(16, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ(kIp6LocalHostAddr, ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+}
+
+TEST_F(ResolverTest, GetHostByName_numeric) {
+    // Add a dummy nameserver which shouldn't receive any queries
+    test::DNSResponder dns;
+    StartDns(dns, {});
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    // Numeric v4 address: expect no DNS queries
+    constexpr char numeric_v4[] = "192.168.0.1";
+    const hostent* result = gethostbyname(numeric_v4);
+    EXPECT_EQ(0U, dns.queries().size());
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(4, result->h_length);  // v4
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ(numeric_v4, ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+
+    // gethostbyname() recognizes a v6 address, and fails with no DNS queries
+    constexpr char numeric_v6[] = "2001:db8::42";
+    dns.clearQueries();
+    result = gethostbyname(numeric_v6);
+    EXPECT_EQ(0U, dns.queries().size());
+    EXPECT_TRUE(result == nullptr);
+
+    // Numeric v6 address with gethostbyname2(): succeeds with no DNS queries
+    dns.clearQueries();
+    result = gethostbyname2(numeric_v6, AF_INET6);
+    EXPECT_EQ(0U, dns.queries().size());
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(16, result->h_length);  // v6
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ(numeric_v6, ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+
+    // Numeric v6 address with scope work with getaddrinfo(),
+    // but gethostbyname2() does not understand them; it issues two dns
+    // queries, then fails. This hardly ever happens, there's no point
+    // in fixing this. This test simply verifies the current (bogus)
+    // behavior to avoid further regressions (like crashes, or leaks).
+    constexpr char numeric_v6_scope[] = "fe80::1%lo";
+    dns.clearQueries();
+    result = gethostbyname2(numeric_v6_scope, AF_INET6);
+    EXPECT_EQ(2U, dns.queries().size());  // OUCH!
+    ASSERT_TRUE(result == nullptr);
+}
+
+TEST_F(ResolverTest, BinderSerialization) {
+    using android::net::IDnsResolver;
+    std::vector<int> params_offsets = {
+            IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY,
+            IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD,
+            IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES,
+            IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES,
+            IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC,
+            IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT,
+    };
+    const int size = static_cast<int>(params_offsets.size());
+    EXPECT_EQ(size, IDnsResolver::RESOLVER_PARAMS_COUNT);
+    std::sort(params_offsets.begin(), params_offsets.end());
+    for (int i = 0; i < size; ++i) {
+        EXPECT_EQ(params_offsets[i], i);
+    }
+}
+
+TEST_F(ResolverTest, GetHostByName_Binder) {
+    using android::net::IDnsResolver;
+
+    std::vector<std::string> domains = { "example.com" };
+    std::vector<std::unique_ptr<test::DNSResponder>> dns;
+    std::vector<std::string> servers;
+    std::vector<DnsResponderClient::Mapping> mappings;
+    ASSERT_NO_FATAL_FAILURE(mDnsClient.SetupMappings(1, domains, &mappings));
+    ASSERT_NO_FATAL_FAILURE(mDnsClient.SetupDNSServers(4, mappings, &dns, &servers));
+    ASSERT_EQ(1U, mappings.size());
+    const DnsResponderClient::Mapping& mapping = mappings[0];
+
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers, domains, kDefaultParams));
+
+    const hostent* result = gethostbyname(mapping.host.c_str());
+    const size_t total_queries =
+            std::accumulate(dns.begin(), dns.end(), 0, [this, &mapping](size_t total, auto& d) {
+                return total + GetNumQueriesForType(*d, ns_type::ns_t_a, mapping.entry.c_str());
+            });
+
+    EXPECT_LE(1U, total_queries);
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(4, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ(mapping.ip4, ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+
+    std::vector<std::string> res_servers;
+    std::vector<std::string> res_domains;
+    std::vector<std::string> res_tls_servers;
+    res_params res_params;
+    std::vector<ResolverStats> res_stats;
+    int wait_for_pending_req_timeout_count;
+    ASSERT_TRUE(GetResolverInfo(&res_servers, &res_domains, &res_tls_servers, &res_params,
+                                &res_stats, &wait_for_pending_req_timeout_count));
+    EXPECT_EQ(servers.size(), res_servers.size());
+    EXPECT_EQ(domains.size(), res_domains.size());
+    EXPECT_EQ(0U, res_tls_servers.size());
+    ASSERT_EQ(static_cast<size_t>(IDnsResolver::RESOLVER_PARAMS_COUNT), kDefaultParams.size());
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY],
+              res_params.sample_validity);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD],
+              res_params.success_threshold);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES], res_params.min_samples);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES], res_params.max_samples);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC],
+              res_params.base_timeout_msec);
+    EXPECT_EQ(servers.size(), res_stats.size());
+
+    EXPECT_THAT(res_servers, testing::UnorderedElementsAreArray(servers));
+    EXPECT_THAT(res_domains, testing::UnorderedElementsAreArray(domains));
+}
+
+TEST_F(ResolverTest, GetAddrInfo) {
+    constexpr char listen_addr[] = "127.0.0.4";
+    constexpr char listen_addr2[] = "127.0.0.5";
+    constexpr char host_name[] = "howdy.example.com.";
+
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+    test::DNSResponder dns(listen_addr);
+    test::DNSResponder dns2(listen_addr2);
+    StartDns(dns, records);
+    StartDns(dns2, records);
+
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork({listen_addr}));
+    dns.clearQueries();
+    dns2.clearQueries();
+
+    ScopedAddrinfo result = safe_getaddrinfo("howdy", nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    size_t found = GetNumQueries(dns, host_name);
+    EXPECT_LE(1U, found);
+    // Could be A or AAAA
+    std::string result_str = ToString(result);
+    EXPECT_TRUE(result_str == "1.2.3.4" || result_str == "::1.2.3.4")
+        << ", result_str='" << result_str << "'";
+
+    // Verify that the name is cached.
+    size_t old_found = found;
+    result = safe_getaddrinfo("howdy", nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    found = GetNumQueries(dns, host_name);
+    EXPECT_LE(1U, found);
+    EXPECT_EQ(old_found, found);
+    result_str = ToString(result);
+    EXPECT_TRUE(result_str == "1.2.3.4" || result_str == "::1.2.3.4")
+        << result_str;
+
+    // Change the DNS resolver, ensure that queries are still cached.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork({listen_addr2}));
+    dns.clearQueries();
+    dns2.clearQueries();
+
+    result = safe_getaddrinfo("howdy", nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    found = GetNumQueries(dns, host_name);
+    size_t found2 = GetNumQueries(dns2, host_name);
+    EXPECT_EQ(0U, found);
+    EXPECT_LE(0U, found2);
+
+    // Could be A or AAAA
+    result_str = ToString(result);
+    EXPECT_TRUE(result_str == "1.2.3.4" || result_str == "::1.2.3.4")
+        << ", result_str='" << result_str << "'";
+}
+
+TEST_F(ResolverTest, GetAddrInfoV4) {
+    test::DNSResponder dns;
+    StartDns(dns, {{kHelloExampleCom, ns_type::ns_t_a, "1.2.3.5"}});
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    const addrinfo hints = {.ai_family = AF_INET};
+    ScopedAddrinfo result = safe_getaddrinfo("hello", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ(1U, GetNumQueries(dns, kHelloExampleCom));
+    EXPECT_EQ("1.2.3.5", ToString(result));
+}
+
+TEST_F(ResolverTest, GetAddrInfo_localhost) {
+    // Add a dummy nameserver which shouldn't receive any queries
+    test::DNSResponder dns;
+    StartDns(dns, {});
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    ScopedAddrinfo result = safe_getaddrinfo(kLocalHost, nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    // Expect no DNS queries; localhost is resolved via /etc/hosts
+    EXPECT_TRUE(dns.queries().empty()) << dns.dumpQueries();
+    EXPECT_EQ(kLocalHostAddr, ToString(result));
+
+    result = safe_getaddrinfo(kIp6LocalHost, nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    // Expect no DNS queries; ip6-localhost is resolved via /etc/hosts
+    EXPECT_TRUE(dns.queries().empty()) << dns.dumpQueries();
+    EXPECT_EQ(kIp6LocalHostAddr, ToString(result));
+}
+
+// Verify if the resolver correctly handle multiple queries simultaneously
+// step 1: set dns server#1 into deferred responding mode.
+// step 2: thread#1 query "hello.example.com." --> resolver send query to server#1.
+// step 3: thread#2 query "hello.example.com." --> resolver hold the request and wait for
+//           response of previous pending query sent by thread#1.
+// step 4: thread#3 query "konbanha.example.com." --> resolver send query to server#3. Server
+//           respond to resolver immediately.
+// step 5: check if server#1 get 1 query by thread#1, server#2 get 0 query, server#3 get 1 query.
+// step 6: resume dns server#1 to respond dns query in step#2.
+// step 7: thread#1 and #2 should get returned from DNS query after step#6. Also, check the
+//           number of queries in server#2 is 0 to ensure thread#2 does not wake up unexpectedly
+//           before signaled by thread#1.
+TEST_F(ResolverTest, GetAddrInfoV4_deferred_resp) {
+    const char* listen_addr1 = "127.0.0.9";
+    const char* listen_addr2 = "127.0.0.10";
+    const char* listen_addr3 = "127.0.0.11";
+    const char* listen_srv = "53";
+    const char* host_name_deferred = "hello.example.com.";
+    const char* host_name_normal = "konbanha.example.com.";
+    test::DNSResponder dns1(listen_addr1, listen_srv, 250, ns_rcode::ns_r_servfail);
+    test::DNSResponder dns2(listen_addr2, listen_srv, 250, ns_rcode::ns_r_servfail);
+    test::DNSResponder dns3(listen_addr3, listen_srv, 250, ns_rcode::ns_r_servfail);
+    dns1.addMapping(host_name_deferred, ns_type::ns_t_a, "1.2.3.4");
+    dns2.addMapping(host_name_deferred, ns_type::ns_t_a, "1.2.3.4");
+    dns3.addMapping(host_name_normal, ns_type::ns_t_a, "1.2.3.5");
+    ASSERT_TRUE(dns1.startServer());
+    ASSERT_TRUE(dns2.startServer());
+    ASSERT_TRUE(dns3.startServer());
+    const std::vector<std::string> servers_for_t1 = {listen_addr1};
+    const std::vector<std::string> servers_for_t2 = {listen_addr2};
+    const std::vector<std::string> servers_for_t3 = {listen_addr3};
+    addrinfo hints = {.ai_family = AF_INET};
+    const std::vector<int> params = {300, 25, 8, 8, 5000};
+    bool t3_task_done = false;
+
+    dns1.setDeferredResp(true);
+    std::thread t1([&, this]() {
+        ASSERT_TRUE(
+                mDnsClient.SetResolversForNetwork(servers_for_t1, kDefaultSearchDomains, params));
+        ScopedAddrinfo result = safe_getaddrinfo(host_name_deferred, nullptr, &hints);
+        // t3's dns query should got returned first
+        EXPECT_TRUE(t3_task_done);
+        EXPECT_EQ(1U, GetNumQueries(dns1, host_name_deferred));
+        EXPECT_TRUE(result != nullptr);
+        EXPECT_EQ("1.2.3.4", ToString(result));
+    });
+
+    // ensuring t1 and t2 handler functions are processed in order
+    usleep(100 * 1000);
+    std::thread t2([&, this]() {
+        ASSERT_TRUE(
+                mDnsClient.SetResolversForNetwork(servers_for_t2, kDefaultSearchDomains, params));
+        ScopedAddrinfo result = safe_getaddrinfo(host_name_deferred, nullptr, &hints);
+        EXPECT_TRUE(t3_task_done);
+        EXPECT_EQ(0U, GetNumQueries(dns2, host_name_deferred));
+        EXPECT_TRUE(result != nullptr);
+        EXPECT_EQ("1.2.3.4", ToString(result));
+
+        std::vector<std::string> res_servers;
+        std::vector<std::string> res_domains;
+        std::vector<std::string> res_tls_servers;
+        res_params res_params;
+        std::vector<ResolverStats> res_stats;
+        int wait_for_pending_req_timeout_count;
+        ASSERT_TRUE(GetResolverInfo(&res_servers, &res_domains, &res_tls_servers, &res_params,
+                                    &res_stats, &wait_for_pending_req_timeout_count));
+        EXPECT_EQ(0, wait_for_pending_req_timeout_count);
+    });
+
+    // ensuring t2 and t3 handler functions are processed in order
+    usleep(100 * 1000);
+    std::thread t3([&, this]() {
+        ASSERT_TRUE(
+                mDnsClient.SetResolversForNetwork(servers_for_t3, kDefaultSearchDomains, params));
+        ScopedAddrinfo result = safe_getaddrinfo(host_name_normal, nullptr, &hints);
+        EXPECT_EQ(1U, GetNumQueries(dns1, host_name_deferred));
+        EXPECT_EQ(0U, GetNumQueries(dns2, host_name_deferred));
+        EXPECT_EQ(1U, GetNumQueries(dns3, host_name_normal));
+        EXPECT_TRUE(result != nullptr);
+        EXPECT_EQ("1.2.3.5", ToString(result));
+
+        t3_task_done = true;
+        dns1.setDeferredResp(false);
+    });
+    t3.join();
+    t1.join();
+    t2.join();
+}
+
+TEST_F(ResolverTest, GetAddrInfo_cnames) {
+    constexpr char host_name[] = "host.example.com.";
+    test::DNSResponder dns;
+    const std::vector<DnsRecord> records = {
+            {kHelloExampleCom, ns_type::ns_t_cname, "a.example.com."},
+            {"a.example.com.", ns_type::ns_t_cname, "b.example.com."},
+            {"b.example.com.", ns_type::ns_t_cname, "c.example.com."},
+            {"c.example.com.", ns_type::ns_t_cname, "d.example.com."},
+            {"d.example.com.", ns_type::ns_t_cname, "e.example.com."},
+            {"e.example.com.", ns_type::ns_t_cname, host_name},
+            {host_name, ns_type::ns_t_a, "1.2.3.3"},
+            {host_name, ns_type::ns_t_aaaa, "2001:db8::42"},
+    };
+    StartDns(dns, records);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    addrinfo hints = {.ai_family = AF_INET};
+    ScopedAddrinfo result = safe_getaddrinfo("hello", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ("1.2.3.3", ToString(result));
+
+    dns.clearQueries();
+    hints = {.ai_family = AF_INET6};
+    result = safe_getaddrinfo("hello", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ("2001:db8::42", ToString(result));
+}
+
+TEST_F(ResolverTest, GetAddrInfo_cnamesNoIpAddress) {
+    test::DNSResponder dns;
+    const std::vector<DnsRecord> records = {
+            {kHelloExampleCom, ns_type::ns_t_cname, "a.example.com."},
+    };
+    StartDns(dns, records);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    addrinfo hints = {.ai_family = AF_INET};
+    ScopedAddrinfo result = safe_getaddrinfo("hello", nullptr, &hints);
+    EXPECT_TRUE(result == nullptr);
+
+    dns.clearQueries();
+    hints = {.ai_family = AF_INET6};
+    result = safe_getaddrinfo("hello", nullptr, &hints);
+    EXPECT_TRUE(result == nullptr);
+}
+
+TEST_F(ResolverTest, GetAddrInfo_cnamesIllegalRdata) {
+    test::DNSResponder dns;
+    const std::vector<DnsRecord> records = {
+            {kHelloExampleCom, ns_type::ns_t_cname, ".!#?"},
+    };
+    StartDns(dns, records);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    addrinfo hints = {.ai_family = AF_INET};
+    ScopedAddrinfo result = safe_getaddrinfo("hello", nullptr, &hints);
+    EXPECT_TRUE(result == nullptr);
+
+    dns.clearQueries();
+    hints = {.ai_family = AF_INET6};
+    result = safe_getaddrinfo("hello", nullptr, &hints);
+    EXPECT_TRUE(result == nullptr);
+}
+
+TEST_F(ResolverTest, MultidomainResolution) {
+    constexpr char host_name[] = "nihao.example2.com.";
+    std::vector<std::string> searchDomains = { "example1.com", "example2.com", "example3.com" };
+
+    test::DNSResponder dns("127.0.0.6");
+    StartDns(dns, {{host_name, ns_type::ns_t_a, "1.2.3.3"}});
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork({"127.0.0.6"}, searchDomains));
+
+    const hostent* result = gethostbyname("nihao");
+
+    EXPECT_EQ(1U, GetNumQueriesForType(dns, ns_type::ns_t_a, host_name));
+    ASSERT_FALSE(result == nullptr);
+    ASSERT_EQ(4, result->h_length);
+    ASSERT_FALSE(result->h_addr_list[0] == nullptr);
+    EXPECT_EQ("1.2.3.3", ToString(result));
+    EXPECT_TRUE(result->h_addr_list[1] == nullptr);
+}
+
+TEST_F(ResolverTest, GetAddrInfoV6_numeric) {
+    constexpr char host_name[] = "ohayou.example.com.";
+    constexpr char numeric_addr[] = "fe80::1%lo";
+
+    test::DNSResponder dns;
+    dns.setResponseProbability(0.0);
+    StartDns(dns, {{host_name, ns_type::ns_t_aaaa, "2001:db8::5"}});
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    addrinfo hints = {.ai_family = AF_INET6};
+    ScopedAddrinfo result = safe_getaddrinfo(numeric_addr, nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ(numeric_addr, ToString(result));
+    EXPECT_TRUE(dns.queries().empty());  // Ensure no DNS queries were sent out
+
+    // Now try a non-numeric hostname query with the AI_NUMERICHOST flag set.
+    // We should fail without sending out a DNS query.
+    hints.ai_flags |= AI_NUMERICHOST;
+    result = safe_getaddrinfo(host_name, nullptr, &hints);
+    EXPECT_TRUE(result == nullptr);
+    EXPECT_TRUE(dns.queries().empty());  // Ensure no DNS queries were sent out
+}
+
+TEST_F(ResolverTest, GetAddrInfoV6_failing) {
+    constexpr char listen_addr0[] = "127.0.0.7";
+    constexpr char listen_addr1[] = "127.0.0.8";
+    const char* host_name = "ohayou.example.com.";
+
+    test::DNSResponder dns0(listen_addr0);
+    test::DNSResponder dns1(listen_addr1);
+    dns0.setResponseProbability(0.0);
+    StartDns(dns0, {{host_name, ns_type::ns_t_aaaa, "2001:db8::5"}});
+    StartDns(dns1, {{host_name, ns_type::ns_t_aaaa, "2001:db8::6"}});
+
+    std::vector<std::string> servers = { listen_addr0, listen_addr1 };
+    // <sample validity in s> <success threshold in percent> <min samples> <max samples>
+    int sample_count = 8;
+    const std::vector<int> params = { 300, 25, sample_count, sample_count };
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers, kDefaultSearchDomains, params));
+
+    // Repeatedly perform resolutions for non-existing domains until MAXNSSAMPLES resolutions have
+    // reached the dns0, which is set to fail. No more requests should then arrive at that server
+    // for the next sample_lifetime seconds.
+    // TODO: This approach is implementation-dependent, change once metrics reporting is available.
+    const addrinfo hints = {.ai_family = AF_INET6};
+    for (int i = 0; i < sample_count; ++i) {
+        std::string domain = StringPrintf("nonexistent%d", i);
+        ScopedAddrinfo result = safe_getaddrinfo(domain.c_str(), nullptr, &hints);
+    }
+    // Due to 100% errors for all possible samples, the server should be ignored from now on and
+    // only the second one used for all following queries, until NSSAMPLE_VALIDITY is reached.
+    dns0.clearQueries();
+    dns1.clearQueries();
+    ScopedAddrinfo result = safe_getaddrinfo("ohayou", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ(0U, GetNumQueries(dns0, host_name));
+    EXPECT_EQ(1U, GetNumQueries(dns1, host_name));
+}
+
+TEST_F(ResolverTest, GetAddrInfoV6_nonresponsive) {
+    constexpr char listen_addr0[] = "127.0.0.7";
+    constexpr char listen_addr1[] = "127.0.0.8";
+    constexpr char listen_srv[] = "53";
+    constexpr char host_name1[] = "ohayou.example.com.";
+    constexpr char host_name2[] = "ciao.example.com.";
+    const std::vector<DnsRecord> records0 = {
+            {host_name1, ns_type::ns_t_aaaa, "2001:db8::5"},
+            {host_name2, ns_type::ns_t_aaaa, "2001:db8::5"},
+    };
+    const std::vector<DnsRecord> records1 = {
+            {host_name1, ns_type::ns_t_aaaa, "2001:db8::6"},
+            {host_name2, ns_type::ns_t_aaaa, "2001:db8::6"},
+    };
+
+    // dns0 does not respond with 100% probability, while
+    // dns1 responds normally, at least initially.
+    test::DNSResponder dns0(listen_addr0, listen_srv, 250, static_cast<ns_rcode>(-1));
+    test::DNSResponder dns1(listen_addr1, listen_srv, 250, static_cast<ns_rcode>(-1));
+    dns0.setResponseProbability(0.0);
+    StartDns(dns0, records0);
+    StartDns(dns1, records1);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork({listen_addr0, listen_addr1}));
+
+    const addrinfo hints = {.ai_family = AF_INET6};
+
+    // dns0 will ignore the request, and we'll fallback to dns1 after the first
+    // retry.
+    ScopedAddrinfo result = safe_getaddrinfo(host_name1, nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ(1U, GetNumQueries(dns0, host_name1));
+    EXPECT_EQ(1U, GetNumQueries(dns1, host_name1));
+
+    // Now make dns1 also ignore 100% requests... The resolve should alternate
+    // retries between the nameservers and fail after 4 attempts.
+    dns1.setResponseProbability(0.0);
+    addrinfo* result2 = nullptr;
+    EXPECT_EQ(EAI_NODATA, getaddrinfo(host_name2, nullptr, &hints, &result2));
+    EXPECT_EQ(nullptr, result2);
+    EXPECT_EQ(4U, GetNumQueries(dns0, host_name2));
+    EXPECT_EQ(4U, GetNumQueries(dns1, host_name2));
+}
+
+TEST_F(ResolverTest, GetAddrInfoV6_concurrent) {
+    constexpr char listen_addr0[] = "127.0.0.9";
+    constexpr char listen_addr1[] = "127.0.0.10";
+    constexpr char listen_addr2[] = "127.0.0.11";
+    constexpr char host_name[] = "konbanha.example.com.";
+
+    test::DNSResponder dns0(listen_addr0);
+    test::DNSResponder dns1(listen_addr1);
+    test::DNSResponder dns2(listen_addr2);
+    StartDns(dns0, {{host_name, ns_type::ns_t_aaaa, "2001:db8::5"}});
+    StartDns(dns1, {{host_name, ns_type::ns_t_aaaa, "2001:db8::6"}});
+    StartDns(dns2, {{host_name, ns_type::ns_t_aaaa, "2001:db8::7"}});
+
+    const std::vector<std::string> servers = { listen_addr0, listen_addr1, listen_addr2 };
+    std::vector<std::thread> threads(10);
+    for (std::thread& thread : threads) {
+       thread = std::thread([this, &servers]() {
+            unsigned delay = arc4random_uniform(1*1000*1000); // <= 1s
+            usleep(delay);
+            std::vector<std::string> serverSubset;
+            for (const auto& server : servers) {
+                if (arc4random_uniform(2)) {
+                    serverSubset.push_back(server);
+                }
+            }
+            if (serverSubset.empty()) serverSubset = servers;
+            ASSERT_TRUE(mDnsClient.SetResolversForNetwork(serverSubset));
+            const addrinfo hints = {.ai_family = AF_INET6};
+            addrinfo* result = nullptr;
+            int rv = getaddrinfo("konbanha", nullptr, &hints, &result);
+            EXPECT_EQ(0, rv) << "error [" << rv << "] " << gai_strerror(rv);
+            if (result) {
+                freeaddrinfo(result);
+                result = nullptr;
+            }
+        });
+    }
+    for (std::thread& thread : threads) {
+        thread.join();
+    }
+
+    std::vector<std::string> res_servers;
+    std::vector<std::string> res_domains;
+    std::vector<std::string> res_tls_servers;
+    res_params res_params;
+    std::vector<ResolverStats> res_stats;
+    int wait_for_pending_req_timeout_count;
+    ASSERT_TRUE(GetResolverInfo(&res_servers, &res_domains, &res_tls_servers, &res_params,
+                                &res_stats, &wait_for_pending_req_timeout_count));
+    EXPECT_EQ(0, wait_for_pending_req_timeout_count);
+}
+
+TEST_F(ResolverTest, GetAddrInfoStressTest_Binder_100) {
+    const unsigned num_hosts = 100;
+    const unsigned num_threads = 100;
+    const unsigned num_queries = 100;
+    ASSERT_NO_FATAL_FAILURE(RunGetAddrInfoStressTest_Binder(num_hosts, num_threads, num_queries));
+}
+
+TEST_F(ResolverTest, GetAddrInfoStressTest_Binder_100000) {
+    const unsigned num_hosts = 100000;
+    const unsigned num_threads = 100;
+    const unsigned num_queries = 100;
+    ASSERT_NO_FATAL_FAILURE(RunGetAddrInfoStressTest_Binder(num_hosts, num_threads, num_queries));
+}
+
+TEST_F(ResolverTest, EmptySetup) {
+    using android::net::IDnsResolver;
+    std::vector<std::string> servers;
+    std::vector<std::string> domains;
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers, domains));
+    std::vector<std::string> res_servers;
+    std::vector<std::string> res_domains;
+    std::vector<std::string> res_tls_servers;
+    res_params res_params;
+    std::vector<ResolverStats> res_stats;
+    int wait_for_pending_req_timeout_count;
+    ASSERT_TRUE(GetResolverInfo(&res_servers, &res_domains, &res_tls_servers, &res_params,
+                                &res_stats, &wait_for_pending_req_timeout_count));
+    EXPECT_EQ(0U, res_servers.size());
+    EXPECT_EQ(0U, res_domains.size());
+    EXPECT_EQ(0U, res_tls_servers.size());
+    ASSERT_EQ(static_cast<size_t>(IDnsResolver::RESOLVER_PARAMS_COUNT), kDefaultParams.size());
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY],
+              res_params.sample_validity);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD],
+              res_params.success_threshold);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES], res_params.min_samples);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES], res_params.max_samples);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC],
+              res_params.base_timeout_msec);
+    EXPECT_EQ(kDefaultParams[IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT], res_params.retry_count);
+}
+
+TEST_F(ResolverTest, SearchPathChange) {
+    constexpr char listen_addr[] = "127.0.0.13";
+    constexpr char host_name1[] = "test13.domain1.org.";
+    constexpr char host_name2[] = "test13.domain2.org.";
+    std::vector<std::string> servers = { listen_addr };
+    std::vector<std::string> domains = { "domain1.org" };
+
+    const std::vector<DnsRecord> records = {
+            {host_name1, ns_type::ns_t_aaaa, "2001:db8::13"},
+            {host_name2, ns_type::ns_t_aaaa, "2001:db8::1:13"},
+    };
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers, domains));
+
+    const addrinfo hints = {.ai_family = AF_INET6};
+    ScopedAddrinfo result = safe_getaddrinfo("test13", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ(1U, dns.queries().size());
+    EXPECT_EQ(1U, GetNumQueries(dns, host_name1));
+    EXPECT_EQ("2001:db8::13", ToString(result));
+
+    // Test that changing the domain search path on its own works.
+    domains = { "domain2.org" };
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers, domains));
+    dns.clearQueries();
+
+    result = safe_getaddrinfo("test13", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_EQ(1U, dns.queries().size());
+    EXPECT_EQ(1U, GetNumQueries(dns, host_name2));
+    EXPECT_EQ("2001:db8::1:13", ToString(result));
+}
+
+static std::string base64Encode(const std::vector<uint8_t>& input) {
+    size_t out_len;
+    EXPECT_EQ(1, EVP_EncodedLength(&out_len, input.size()));
+    // out_len includes the trailing NULL.
+    uint8_t output_bytes[out_len];
+    EXPECT_EQ(out_len - 1, EVP_EncodeBlock(output_bytes, input.data(), input.size()));
+    return std::string(reinterpret_cast<char*>(output_bytes));
+}
+
+// If we move this function to dns_responder_client, it will complicate the dependency need of
+// dns_tls_frontend.h.
+static void setupTlsServers(const std::vector<std::string>& servers,
+                            std::vector<std::unique_ptr<test::DnsTlsFrontend>>* tls,
+                            std::vector<std::string>* fingerprints) {
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+
+    for (const auto& server : servers) {
+        auto t = std::make_unique<test::DnsTlsFrontend>(server, listen_tls, server, listen_udp);
+        t = std::make_unique<test::DnsTlsFrontend>(server, listen_tls, server, listen_udp);
+        t->startServer();
+        fingerprints->push_back(base64Encode(t->fingerprint()));
+        tls->push_back(std::move(t));
+    }
+}
+
+TEST_F(ResolverTest, MaxServerPrune_Binder) {
+    std::vector<std::string> domains;
+    std::vector<std::unique_ptr<test::DNSResponder>> dns;
+    std::vector<std::unique_ptr<test::DnsTlsFrontend>> tls;
+    std::vector<std::string> servers;
+    std::vector<std::string> fingerprints;
+    std::vector<DnsResponderClient::Mapping> mappings;
+
+    for (unsigned i = 0; i < MAXDNSRCH + 1; i++) {
+        domains.push_back(StringPrintf("example%u.com", i));
+    }
+    ASSERT_NO_FATAL_FAILURE(mDnsClient.SetupMappings(1, domains, &mappings));
+    ASSERT_NO_FATAL_FAILURE(mDnsClient.SetupDNSServers(MAXNS + 1, mappings, &dns, &servers));
+    ASSERT_NO_FATAL_FAILURE(setupTlsServers(servers, &tls, &fingerprints));
+
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, domains, kDefaultParams, "", fingerprints));
+
+    // If the private DNS validation hasn't completed yet before backend DNS servers stop,
+    // TLS servers will get stuck in handleOneRequest(), which causes this test stuck in
+    // ~DnsTlsFrontend() because the TLS server loop threads can't be terminated.
+    // So, wait for private DNS validation done before stopping backend DNS servers.
+    for (int i = 0; i < MAXNS; i++) {
+        ALOGI("Waiting for private DNS validation on %s.", tls[i]->listen_address().c_str());
+        EXPECT_TRUE(tls[i]->waitForQueries(1, 5000));
+        ALOGI("private DNS validation on %s done.", tls[i]->listen_address().c_str());
+    }
+
+    std::vector<std::string> res_servers;
+    std::vector<std::string> res_domains;
+    std::vector<std::string> res_tls_servers;
+    res_params res_params;
+    std::vector<ResolverStats> res_stats;
+    int wait_for_pending_req_timeout_count;
+    ASSERT_TRUE(GetResolverInfo(&res_servers, &res_domains, &res_tls_servers, &res_params,
+                                &res_stats, &wait_for_pending_req_timeout_count));
+
+    // Check the size of the stats and its contents.
+    EXPECT_EQ(static_cast<size_t>(MAXNS), res_servers.size());
+    EXPECT_EQ(static_cast<size_t>(MAXNS), res_tls_servers.size());
+    EXPECT_EQ(static_cast<size_t>(MAXDNSRCH), res_domains.size());
+    EXPECT_TRUE(std::equal(servers.begin(), servers.begin() + MAXNS, res_servers.begin()));
+    EXPECT_TRUE(std::equal(servers.begin(), servers.begin() + MAXNS, res_tls_servers.begin()));
+    EXPECT_TRUE(std::equal(domains.begin(), domains.begin() + MAXDNSRCH, res_domains.begin()));
+}
+
+TEST_F(ResolverTest, ResolverStats) {
+    constexpr char listen_addr1[] = "127.0.0.4";
+    constexpr char listen_addr2[] = "127.0.0.5";
+    constexpr char listen_addr3[] = "127.0.0.6";
+
+    // Set server 1 timeout.
+    test::DNSResponder dns1(listen_addr1, "53", 250, static_cast<ns_rcode>(-1));
+    dns1.setResponseProbability(0.0);
+    ASSERT_TRUE(dns1.startServer());
+
+    // Set server 2 responding server failure.
+    test::DNSResponder dns2(listen_addr2);
+    dns2.setResponseProbability(0.0);
+    ASSERT_TRUE(dns2.startServer());
+
+    // Set server 3 workable.
+    test::DNSResponder dns3(listen_addr3);
+    dns3.addMapping(kHelloExampleCom, ns_type::ns_t_a, "1.2.3.4");
+    ASSERT_TRUE(dns3.startServer());
+
+    std::vector<std::string> servers = {listen_addr1, listen_addr2, listen_addr3};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    dns3.clearQueries();
+    const addrinfo hints = {.ai_family = AF_INET, .ai_socktype = SOCK_DGRAM};
+    ScopedAddrinfo result = safe_getaddrinfo("hello", nullptr, &hints);
+    size_t found = GetNumQueries(dns3, kHelloExampleCom);
+    EXPECT_LE(1U, found);
+    std::string result_str = ToString(result);
+    EXPECT_TRUE(result_str == "1.2.3.4") << ", result_str='" << result_str << "'";
+
+    std::vector<std::string> res_servers;
+    std::vector<std::string> res_domains;
+    std::vector<std::string> res_tls_servers;
+    res_params res_params;
+    std::vector<ResolverStats> res_stats;
+    int wait_for_pending_req_timeout_count;
+    ASSERT_TRUE(GetResolverInfo(&res_servers, &res_domains, &res_tls_servers, &res_params,
+                                &res_stats, &wait_for_pending_req_timeout_count));
+
+    EXPECT_EQ(1, res_stats[0].timeouts);
+    EXPECT_EQ(1, res_stats[1].errors);
+    EXPECT_EQ(1, res_stats[2].successes);
+}
+
+// Test what happens if the specified TLS server is nonexistent.
+TEST_F(ResolverTest, GetHostByName_TlsMissing) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char host_name[] = "tlsmissing.example.com.";
+
+    test::DNSResponder dns;
+    StartDns(dns, {{host_name, ns_type::ns_t_a, "1.2.3.3"}});
+    std::vector<std::string> servers = { listen_addr };
+
+    // There's nothing listening on this address, so validation will either fail or
+    /// hang.  Either way, queries will continue to flow to the DNSResponder.
+    ASSERT_TRUE(
+            mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "", {}));
+
+    const hostent* result;
+
+    result = gethostbyname("tlsmissing");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.3", ToString(result));
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+}
+
+// Test what happens if the specified TLS server replies with garbage.
+TEST_F(ResolverTest, GetHostByName_TlsBroken) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char host_name1[] = "tlsbroken1.example.com.";
+    constexpr char host_name2[] = "tlsbroken2.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name1, ns_type::ns_t_a, "1.2.3.1"},
+            {host_name2, ns_type::ns_t_a, "1.2.3.2"},
+    };
+
+    test::DNSResponder dns;
+    StartDns(dns, records);
+    std::vector<std::string> servers = { listen_addr };
+
+    // Bind the specified private DNS socket but don't respond to any client sockets yet.
+    int s = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP);
+    ASSERT_TRUE(s >= 0);
+    struct sockaddr_in tlsServer = {
+        .sin_family = AF_INET,
+        .sin_port = htons(853),
+    };
+    ASSERT_TRUE(inet_pton(AF_INET, listen_addr, &tlsServer.sin_addr));
+    ASSERT_TRUE(enableSockopt(s, SOL_SOCKET, SO_REUSEPORT).ok());
+    ASSERT_TRUE(enableSockopt(s, SOL_SOCKET, SO_REUSEADDR).ok());
+    ASSERT_FALSE(bind(s, reinterpret_cast<struct sockaddr*>(&tlsServer), sizeof(tlsServer)));
+    ASSERT_FALSE(listen(s, 1));
+
+    // Trigger TLS validation.
+    ASSERT_TRUE(
+            mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "", {}));
+
+    struct sockaddr_storage cliaddr;
+    socklen_t sin_size = sizeof(cliaddr);
+    int new_fd = accept4(s, reinterpret_cast<struct sockaddr *>(&cliaddr), &sin_size, SOCK_CLOEXEC);
+    ASSERT_TRUE(new_fd > 0);
+
+    // We've received the new file descriptor but not written to it or closed, so the
+    // validation is still pending.  Queries should still flow correctly because the
+    // server is not used until validation succeeds.
+    const hostent* result;
+    result = gethostbyname("tlsbroken1");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.1", ToString(result));
+
+    // Now we cause the validation to fail.
+    std::string garbage = "definitely not a valid TLS ServerHello";
+    write(new_fd, garbage.data(), garbage.size());
+    close(new_fd);
+
+    // Validation failure shouldn't interfere with lookups, because lookups won't be sent
+    // to the TLS server unless validation succeeds.
+    result = gethostbyname("tlsbroken2");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.2", ToString(result));
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+    close(s);
+}
+
+TEST_F(ResolverTest, GetHostByName_Tls) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    constexpr char host_name1[] = "tls1.example.com.";
+    constexpr char host_name2[] = "tls2.example.com.";
+    constexpr char host_name3[] = "tls3.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name1, ns_type::ns_t_a, "1.2.3.1"},
+            {host_name2, ns_type::ns_t_a, "1.2.3.2"},
+            {host_name3, ns_type::ns_t_a, "1.2.3.3"},
+    };
+
+    test::DNSResponder dns;
+    StartDns(dns, records);
+    std::vector<std::string> servers = { listen_addr };
+
+    test::DnsTlsFrontend tls(listen_addr, listen_tls, listen_addr, listen_udp);
+    ASSERT_TRUE(tls.startServer());
+    ASSERT_TRUE(
+            mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "", {}));
+
+    const hostent* result;
+
+    // Wait for validation to complete.
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+
+    result = gethostbyname("tls1");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.1", ToString(result));
+
+    // Wait for query to get counted.
+    EXPECT_TRUE(tls.waitForQueries(2, 5000));
+
+    // Stop the TLS server.  Since we're in opportunistic mode, queries will
+    // fall back to the locally-assigned (clear text) nameservers.
+    tls.stopServer();
+
+    dns.clearQueries();
+    result = gethostbyname("tls2");
+    EXPECT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.2", ToString(result));
+    const auto queries = dns.queries();
+    EXPECT_EQ(1U, queries.size());
+    EXPECT_EQ("tls2.example.com.", queries[0].first);
+    EXPECT_EQ(ns_t_a, queries[0].second);
+
+    // Reset the resolvers without enabling TLS.  Queries should still be routed
+    // to the UDP endpoint.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+
+    result = gethostbyname("tls3");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.3", ToString(result));
+}
+
+TEST_F(ResolverTest, GetHostByName_TlsFingerprint) {
+    // Certificate fingerprints are no longer supported by the module.
+    SKIP_IF_RESOLVER_VERSION_NEWER_THAN(mDnsClient.resolvService(), 2);
+
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    test::DNSResponder dns;
+    ASSERT_TRUE(dns.startServer());
+    for (int chain_length = 1; chain_length <= 3; ++chain_length) {
+        std::string host_name = StringPrintf("tlsfingerprint%d.example.com.", chain_length);
+        dns.addMapping(host_name, ns_type::ns_t_a, "1.2.3.1");
+        std::vector<std::string> servers = { listen_addr };
+
+        test::DnsTlsFrontend tls(listen_addr, listen_tls, listen_addr, listen_udp);
+        tls.set_chain_length(chain_length);
+        ASSERT_TRUE(tls.startServer());
+        ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams,
+                                                   "", {base64Encode(tls.fingerprint())}));
+
+        const hostent* result;
+
+        // Wait for validation to complete.
+        EXPECT_TRUE(tls.waitForQueries(1, 5000));
+
+        result = gethostbyname(StringPrintf("tlsfingerprint%d", chain_length).c_str());
+        EXPECT_FALSE(result == nullptr);
+        if (result) {
+            EXPECT_EQ("1.2.3.1", ToString(result));
+
+            // Wait for query to get counted.
+            EXPECT_TRUE(tls.waitForQueries(2, 5000));
+        }
+
+        // Clear TLS bit to ensure revalidation.
+        ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+        tls.stopServer();
+    }
+}
+
+TEST_F(ResolverTest, GetHostByName_BadTlsFingerprint) {
+    // Certificate fingerprints are no longer supported by the module.
+    SKIP_IF_RESOLVER_VERSION_NEWER_THAN(mDnsClient.resolvService(), 2);
+
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    constexpr char host_name[] = "badtlsfingerprint.example.com.";
+
+    test::DNSResponder dns;
+    StartDns(dns, {{host_name, ns_type::ns_t_a, "1.2.3.1"}});
+    std::vector<std::string> servers = { listen_addr };
+
+    test::DnsTlsFrontend tls(listen_addr, listen_tls, listen_addr, listen_udp);
+    ASSERT_TRUE(tls.startServer());
+    std::vector<uint8_t> bad_fingerprint = tls.fingerprint();
+    bad_fingerprint[5] += 1;  // Corrupt the fingerprint.
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "",
+                                               {base64Encode(bad_fingerprint)}));
+
+    // The initial validation should fail at the fingerprint check before
+    // issuing a query.
+    EXPECT_FALSE(tls.waitForQueries(1, 500));
+
+    // A fingerprint was provided and failed to match, so the query should fail.
+    EXPECT_EQ(nullptr, gethostbyname("badtlsfingerprint"));
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+}
+
+// Test that we can pass two different fingerprints, and connection succeeds as long as
+// at least one of them matches the server.
+TEST_F(ResolverTest, GetHostByName_TwoTlsFingerprints) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    constexpr char host_name[] = "twotlsfingerprints.example.com.";
+
+    test::DNSResponder dns;
+    StartDns(dns, {{host_name, ns_type::ns_t_a, "1.2.3.1"}});
+    std::vector<std::string> servers = { listen_addr };
+
+    test::DnsTlsFrontend tls(listen_addr, listen_tls, listen_addr, listen_udp);
+    ASSERT_TRUE(tls.startServer());
+    std::vector<uint8_t> bad_fingerprint = tls.fingerprint();
+    bad_fingerprint[5] += 1;  // Corrupt the fingerprint.
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(
+            servers, kDefaultSearchDomains, kDefaultParams, "",
+            {base64Encode(bad_fingerprint), base64Encode(tls.fingerprint())}));
+
+    const hostent* result;
+
+    // Wait for validation to complete.
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+
+    result = gethostbyname("twotlsfingerprints");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.1", ToString(result));
+
+    // Wait for query to get counted.
+    EXPECT_TRUE(tls.waitForQueries(2, 5000));
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+}
+
+TEST_F(ResolverTest, GetHostByName_TlsFingerprintGoesBad) {
+    // Certificate fingerprints are no longer supported by the module.
+    SKIP_IF_RESOLVER_VERSION_NEWER_THAN(mDnsClient.resolvService(), 2);
+
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    constexpr char host_name1[] = "tlsfingerprintgoesbad1.example.com.";
+    constexpr char host_name2[] = "tlsfingerprintgoesbad2.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name1, ns_type::ns_t_a, "1.2.3.1"},
+            {host_name2, ns_type::ns_t_a, "1.2.3.2"},
+    };
+
+    test::DNSResponder dns;
+    StartDns(dns, records);
+    std::vector<std::string> servers = { listen_addr };
+
+    test::DnsTlsFrontend tls(listen_addr, listen_tls, listen_addr, listen_udp);
+    ASSERT_TRUE(tls.startServer());
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "",
+                                               {base64Encode(tls.fingerprint())}));
+
+    const hostent* result;
+
+    // Wait for validation to complete.
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+
+    result = gethostbyname("tlsfingerprintgoesbad1");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.1", ToString(result));
+
+    // Wait for query to get counted.
+    EXPECT_TRUE(tls.waitForQueries(2, 5000));
+
+    // Restart the TLS server.  This will generate a new certificate whose fingerprint
+    // no longer matches the stored fingerprint.
+    tls.stopServer();
+    tls.startServer();
+
+    result = gethostbyname("tlsfingerprintgoesbad2");
+    ASSERT_TRUE(result == nullptr);
+    EXPECT_EQ(HOST_NOT_FOUND, h_errno);
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+}
+
+TEST_F(ResolverTest, GetHostByName_TlsFailover) {
+    constexpr char listen_addr1[] = "127.0.0.3";
+    constexpr char listen_addr2[] = "127.0.0.4";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    constexpr char host_name1[] = "tlsfailover1.example.com.";
+    constexpr char host_name2[] = "tlsfailover2.example.com.";
+    const std::vector<DnsRecord> records1 = {
+            {host_name1, ns_type::ns_t_a, "1.2.3.1"},
+            {host_name2, ns_type::ns_t_a, "1.2.3.2"},
+    };
+    const std::vector<DnsRecord> records2 = {
+            {host_name1, ns_type::ns_t_a, "1.2.3.3"},
+            {host_name2, ns_type::ns_t_a, "1.2.3.4"},
+    };
+
+    test::DNSResponder dns1(listen_addr1);
+    test::DNSResponder dns2(listen_addr2);
+    StartDns(dns1, records1);
+    StartDns(dns2, records2);
+
+    std::vector<std::string> servers = { listen_addr1, listen_addr2 };
+
+    test::DnsTlsFrontend tls1(listen_addr1, listen_tls, listen_addr1, listen_udp);
+    test::DnsTlsFrontend tls2(listen_addr2, listen_tls, listen_addr2, listen_udp);
+    ASSERT_TRUE(tls1.startServer());
+    ASSERT_TRUE(tls2.startServer());
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(
+            servers, kDefaultSearchDomains, kDefaultParams, "",
+            {base64Encode(tls1.fingerprint()), base64Encode(tls2.fingerprint())}));
+
+    const hostent* result;
+
+    // Wait for validation to complete.
+    EXPECT_TRUE(tls1.waitForQueries(1, 5000));
+    EXPECT_TRUE(tls2.waitForQueries(1, 5000));
+
+    result = gethostbyname("tlsfailover1");
+    ASSERT_FALSE(result == nullptr);
+    EXPECT_EQ("1.2.3.1", ToString(result));
+
+    // Wait for query to get counted.
+    EXPECT_TRUE(tls1.waitForQueries(2, 5000));
+    // No new queries should have reached tls2.
+    EXPECT_EQ(1, tls2.queries());
+
+    // Stop tls1.  Subsequent queries should attempt to reach tls1, fail, and retry to tls2.
+    tls1.stopServer();
+
+    result = gethostbyname("tlsfailover2");
+    EXPECT_EQ("1.2.3.4", ToString(result));
+
+    // Wait for query to get counted.
+    EXPECT_TRUE(tls2.waitForQueries(2, 5000));
+
+    // No additional queries should have reached the insecure servers.
+    EXPECT_EQ(2U, dns1.queries().size());
+    EXPECT_EQ(2U, dns2.queries().size());
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+}
+
+TEST_F(ResolverTest, GetHostByName_BadTlsName) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    constexpr char host_name[] = "badtlsname.example.com.";
+
+    test::DNSResponder dns;
+    StartDns(dns, {{host_name, ns_type::ns_t_a, "1.2.3.1"}});
+    std::vector<std::string> servers = { listen_addr };
+
+    test::DnsTlsFrontend tls(listen_addr, listen_tls, listen_addr, listen_udp);
+    ASSERT_TRUE(tls.startServer());
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams,
+                                               "www.example.com", {}));
+
+    // The TLS server's certificate doesn't chain to a known CA, and a nonempty name was specified,
+    // so the client should fail the TLS handshake before ever issuing a query.
+    EXPECT_FALSE(tls.waitForQueries(1, 500));
+
+    // The query should fail hard, because a name was specified.
+    EXPECT_EQ(nullptr, gethostbyname("badtlsname"));
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Tls) {
+    constexpr char listen_addr[] = "127.0.0.3";
+    constexpr char listen_udp[] = "53";
+    constexpr char listen_tls[] = "853";
+    constexpr char host_name[] = "addrinfotls.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns;
+    StartDns(dns, records);
+    std::vector<std::string> servers = { listen_addr };
+
+    test::DnsTlsFrontend tls(listen_addr, listen_tls, listen_addr, listen_udp);
+    ASSERT_TRUE(tls.startServer());
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "",
+                                               {base64Encode(tls.fingerprint())}));
+
+    // Wait for validation to complete.
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+
+    dns.clearQueries();
+    ScopedAddrinfo result = safe_getaddrinfo("addrinfotls", nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    size_t found = GetNumQueries(dns, host_name);
+    EXPECT_LE(1U, found);
+    // Could be A or AAAA
+    std::string result_str = ToString(result);
+    EXPECT_TRUE(result_str == "1.2.3.4" || result_str == "::1.2.3.4")
+        << ", result_str='" << result_str << "'";
+    // Wait for both A and AAAA queries to get counted.
+    EXPECT_TRUE(tls.waitForQueries(3, 5000));
+
+    // Clear TLS bit.
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork());
+}
+
+TEST_F(ResolverTest, TlsBypass) {
+    // Certificate fingerprints are no longer supported by the module.
+    SKIP_IF_RESOLVER_VERSION_NEWER_THAN(mDnsClient.resolvService(), 2);
+
+    const char OFF[] = "off";
+    const char OPPORTUNISTIC[] = "opportunistic";
+    const char STRICT[] = "strict";
+
+    const char GETHOSTBYNAME[] = "gethostbyname";
+    const char GETADDRINFO[] = "getaddrinfo";
+    const char GETADDRINFOFORNET[] = "getaddrinfofornet";
+
+    const unsigned BYPASS_NETID = NETID_USE_LOCAL_NAMESERVERS | TEST_NETID;
+
+    const std::vector<uint8_t> NOOP_FINGERPRINT(SHA256_SIZE, 0U);
+
+    const char ADDR4[] = "192.0.2.1";
+    const char ADDR6[] = "2001:db8::1";
+
+    const char cleartext_addr[] = "127.0.0.53";
+    const char cleartext_port[] = "53";
+    const char tls_port[] = "853";
+    const std::vector<std::string> servers = { cleartext_addr };
+
+    test::DNSResponder dns(cleartext_addr);
+    ASSERT_TRUE(dns.startServer());
+
+    test::DnsTlsFrontend tls(cleartext_addr, tls_port, cleartext_addr, cleartext_port);
+
+    struct TestConfig {
+        const std::string mode;
+        const bool withWorkingTLS;
+        const std::string method;
+
+        std::string asHostName() const {
+            return StringPrintf("%s.%s.%s.",
+                                mode.c_str(),
+                                withWorkingTLS ? "tlsOn" : "tlsOff",
+                                method.c_str());
+        }
+    } testConfigs[]{
+        {OFF,           false, GETHOSTBYNAME},
+        {OPPORTUNISTIC, false, GETHOSTBYNAME},
+        {STRICT,        false, GETHOSTBYNAME},
+        {OFF,           true,  GETHOSTBYNAME},
+        {OPPORTUNISTIC, true,  GETHOSTBYNAME},
+        {STRICT,        true,  GETHOSTBYNAME},
+        {OFF,           false, GETADDRINFO},
+        {OPPORTUNISTIC, false, GETADDRINFO},
+        {STRICT,        false, GETADDRINFO},
+        {OFF,           true,  GETADDRINFO},
+        {OPPORTUNISTIC, true,  GETADDRINFO},
+        {STRICT,        true,  GETADDRINFO},
+        {OFF,           false, GETADDRINFOFORNET},
+        {OPPORTUNISTIC, false, GETADDRINFOFORNET},
+        {STRICT,        false, GETADDRINFOFORNET},
+        {OFF,           true,  GETADDRINFOFORNET},
+        {OPPORTUNISTIC, true,  GETADDRINFOFORNET},
+        {STRICT,        true,  GETADDRINFOFORNET},
+    };
+
+    for (const auto& config : testConfigs) {
+        const std::string testHostName = config.asHostName();
+        SCOPED_TRACE(testHostName);
+
+        // Don't tempt test bugs due to caching.
+        const char* host_name = testHostName.c_str();
+        dns.addMapping(host_name, ns_type::ns_t_a, ADDR4);
+        dns.addMapping(host_name, ns_type::ns_t_aaaa, ADDR6);
+
+        if (config.withWorkingTLS) ASSERT_TRUE(tls.startServer());
+
+        if (config.mode == OFF) {
+            ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers, kDefaultSearchDomains,
+                                                          kDefaultParams));
+        } else if (config.mode == OPPORTUNISTIC) {
+            ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains,
+                                                       kDefaultParams, "", {}));
+            // Wait for validation to complete.
+            if (config.withWorkingTLS) EXPECT_TRUE(tls.waitForQueries(1, 5000));
+        } else if (config.mode == STRICT) {
+            // We use the existence of fingerprints to trigger strict mode,
+            // rather than hostname validation.
+            const auto& fingerprint =
+                    (config.withWorkingTLS) ? tls.fingerprint() : NOOP_FINGERPRINT;
+            ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains,
+                                                       kDefaultParams, "",
+                                                       {base64Encode(fingerprint)}));
+            // Wait for validation to complete.
+            if (config.withWorkingTLS) EXPECT_TRUE(tls.waitForQueries(1, 5000));
+        } else {
+            FAIL() << "Unsupported Private DNS mode: " << config.mode;
+        }
+
+        const int tlsQueriesBefore = tls.queries();
+
+        const hostent* h_result = nullptr;
+        ScopedAddrinfo ai_result;
+
+        if (config.method == GETHOSTBYNAME) {
+            ASSERT_EQ(0, setNetworkForResolv(BYPASS_NETID));
+            h_result = gethostbyname(host_name);
+
+            EXPECT_EQ(1U, GetNumQueriesForType(dns, ns_type::ns_t_a, host_name));
+            ASSERT_FALSE(h_result == nullptr);
+            ASSERT_EQ(4, h_result->h_length);
+            ASSERT_FALSE(h_result->h_addr_list[0] == nullptr);
+            EXPECT_EQ(ADDR4, ToString(h_result));
+            EXPECT_TRUE(h_result->h_addr_list[1] == nullptr);
+        } else if (config.method == GETADDRINFO) {
+            ASSERT_EQ(0, setNetworkForResolv(BYPASS_NETID));
+            ai_result = safe_getaddrinfo(host_name, nullptr, nullptr);
+            EXPECT_TRUE(ai_result != nullptr);
+
+            EXPECT_LE(1U, GetNumQueries(dns, host_name));
+            // Could be A or AAAA
+            const std::string result_str = ToString(ai_result);
+            EXPECT_TRUE(result_str == ADDR4 || result_str == ADDR6)
+                << ", result_str='" << result_str << "'";
+        } else if (config.method == GETADDRINFOFORNET) {
+            addrinfo* raw_ai_result = nullptr;
+            EXPECT_EQ(0, android_getaddrinfofornet(host_name, /*servname=*/nullptr,
+                                                   /*hints=*/nullptr, BYPASS_NETID, MARK_UNSET,
+                                                   &raw_ai_result));
+            ai_result.reset(raw_ai_result);
+
+            EXPECT_LE(1U, GetNumQueries(dns, host_name));
+            // Could be A or AAAA
+            const std::string result_str = ToString(ai_result);
+            EXPECT_TRUE(result_str == ADDR4 || result_str == ADDR6)
+                << ", result_str='" << result_str << "'";
+        } else {
+            FAIL() << "Unsupported query method: " << config.method;
+        }
+
+        const int tlsQueriesAfter = tls.queries();
+        EXPECT_EQ(0, tlsQueriesAfter - tlsQueriesBefore);
+
+        // Clear per-process resolv netid.
+        ASSERT_EQ(0, setNetworkForResolv(NETID_UNSET));
+        tls.stopServer();
+        dns.clearQueries();
+    }
+}
+
+TEST_F(ResolverTest, StrictMode_NoTlsServers) {
+    // Certificate fingerprints are no longer supported by the module.
+    SKIP_IF_RESOLVER_VERSION_NEWER_THAN(mDnsClient.resolvService(), 2);
+
+    const std::vector<uint8_t> NOOP_FINGERPRINT(SHA256_SIZE, 0U);
+    constexpr char cleartext_addr[] = "127.0.0.53";
+    const std::vector<std::string> servers = { cleartext_addr };
+    constexpr char host_name[] = "strictmode.notlsips.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(cleartext_addr);
+    StartDns(dns, records);
+
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, {},
+                                               "", {base64Encode(NOOP_FINGERPRINT)}));
+
+    addrinfo* ai_result = nullptr;
+    EXPECT_NE(0, getaddrinfo(host_name, nullptr, nullptr, &ai_result));
+    EXPECT_EQ(0U, GetNumQueries(dns, host_name));
+}
+
+namespace {
+
+int getAsyncResponse(int fd, int* rcode, uint8_t* buf, int bufLen) {
+    struct pollfd wait_fd[1];
+    wait_fd[0].fd = fd;
+    wait_fd[0].events = POLLIN;
+    short revents;
+    int ret;
+
+    ret = poll(wait_fd, 1, -1);
+    revents = wait_fd[0].revents;
+    if (revents & POLLIN) {
+        int n = resNetworkResult(fd, rcode, buf, bufLen);
+        // Verify that resNetworkResult() closed the fd
+        char dummy;
+        EXPECT_EQ(-1, read(fd, &dummy, sizeof dummy));
+        EXPECT_EQ(EBADF, errno);
+        return n;
+    }
+    return -1;
+}
+
+std::string toString(uint8_t* buf, int bufLen, int ipType) {
+    ns_msg handle;
+    int ancount, n = 0;
+    ns_rr rr;
+
+    if (ns_initparse((const uint8_t*) buf, bufLen, &handle) >= 0) {
+        ancount = ns_msg_count(handle, ns_s_an);
+        if (ns_parserr(&handle, ns_s_an, n, &rr) == 0) {
+            const uint8_t* rdata = ns_rr_rdata(rr);
+            char buffer[INET6_ADDRSTRLEN];
+            if (inet_ntop(ipType, (const char*) rdata, buffer, sizeof(buffer))) {
+                return buffer;
+            }
+        }
+    }
+    return "";
+}
+
+int dns_open_proxy() {
+    int s = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
+    if (s == -1) {
+        return -1;
+    }
+    const int one = 1;
+    setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+
+    static const struct sockaddr_un proxy_addr = {
+            .sun_family = AF_UNIX,
+            .sun_path = "/dev/socket/dnsproxyd",
+    };
+
+    if (TEMP_FAILURE_RETRY(connect(s, (const struct sockaddr*) &proxy_addr, sizeof(proxy_addr))) !=
+        0) {
+        close(s);
+        return -1;
+    }
+
+    return s;
+}
+
+void expectAnswersValid(int fd, int ipType, const std::string& expectedAnswer) {
+    int rcode = -1;
+    uint8_t buf[MAXPACKET] = {};
+
+    int res = getAsyncResponse(fd, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ(expectedAnswer, toString(buf, res, ipType));
+}
+
+void expectAnswersNotValid(int fd, int expectedErrno) {
+    int rcode = -1;
+    uint8_t buf[MAXPACKET] = {};
+
+    int res = getAsyncResponse(fd, &rcode, buf, MAXPACKET);
+    EXPECT_EQ(expectedErrno, res);
+}
+
+}  // namespace
+
+TEST_F(ResolverTest, Async_NormalQueryV4V6) {
+    constexpr char listen_addr[] = "127.0.0.4";
+    constexpr char host_name[] = "howdy.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    int fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a, 0);
+    int fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa, 0);
+    EXPECT_TRUE(fd1 != -1);
+    EXPECT_TRUE(fd2 != -1);
+
+    uint8_t buf[MAXPACKET] = {};
+    int rcode;
+    int res = getAsyncResponse(fd2, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("::1.2.3.4", toString(buf, res, AF_INET6));
+
+    res = getAsyncResponse(fd1, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("1.2.3.4", toString(buf, res, AF_INET));
+
+    EXPECT_EQ(2U, GetNumQueries(dns, host_name));
+
+    // Re-query verify cache works
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a, 0);
+    fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa, 0);
+
+    EXPECT_TRUE(fd1 != -1);
+    EXPECT_TRUE(fd2 != -1);
+
+    res = getAsyncResponse(fd2, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("::1.2.3.4", toString(buf, res, AF_INET6));
+
+    res = getAsyncResponse(fd1, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("1.2.3.4", toString(buf, res, AF_INET));
+
+    EXPECT_EQ(2U, GetNumQueries(dns, host_name));
+}
+
+TEST_F(ResolverTest, Async_BadQuery) {
+    constexpr char listen_addr[] = "127.0.0.4";
+    constexpr char host_name[] = "howdy.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    static struct {
+        int fd;
+        const char* dname;
+        const int queryType;
+        const int expectRcode;
+    } kTestData[] = {
+            {-1, "", ns_t_aaaa, 0},
+            {-1, "as65ass46", ns_t_aaaa, 0},
+            {-1, "454564564564", ns_t_aaaa, 0},
+            {-1, "h645235", ns_t_a, 0},
+            {-1, "www.google.com", ns_t_a, 0},
+    };
+
+    for (auto& td : kTestData) {
+        SCOPED_TRACE(td.dname);
+        td.fd = resNetworkQuery(TEST_NETID, td.dname, ns_c_in, td.queryType, 0);
+        EXPECT_TRUE(td.fd != -1);
+    }
+
+    // dns_responder return empty resp(packet only contains query part) with no error currently
+    for (const auto& td : kTestData) {
+        uint8_t buf[MAXPACKET] = {};
+        int rcode;
+        SCOPED_TRACE(td.dname);
+        int res = getAsyncResponse(td.fd, &rcode, buf, MAXPACKET);
+        EXPECT_GT(res, 0);
+        EXPECT_EQ(rcode, td.expectRcode);
+    }
+}
+
+TEST_F(ResolverTest, Async_EmptyAnswer) {
+    constexpr char listen_addr[] = "127.0.0.4";
+    constexpr char host_name[] = "howdy.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // TODO: Disable retry to make this test explicit.
+    auto& cv = dns.getCv();
+    auto& cvMutex = dns.getCvMutex();
+    int fd1;
+    // Wait on the condition variable to ensure that the DNS server has handled our first query.
+    {
+        std::unique_lock lk(cvMutex);
+        fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa, 0);
+        EXPECT_TRUE(fd1 != -1);
+        EXPECT_EQ(std::cv_status::no_timeout, cv.wait_for(lk, std::chrono::seconds(1)));
+    }
+
+    dns.setResponseProbability(0.0);
+
+    int fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a, 0);
+    EXPECT_TRUE(fd2 != -1);
+
+    int fd3 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a, 0);
+    EXPECT_TRUE(fd3 != -1);
+
+    uint8_t buf[MAXPACKET] = {};
+    int rcode;
+
+    // expect no response
+    int res = getAsyncResponse(fd3, &rcode, buf, MAXPACKET);
+    EXPECT_EQ(-ETIMEDOUT, res);
+
+    // expect no response
+    memset(buf, 0, MAXPACKET);
+    res = getAsyncResponse(fd2, &rcode, buf, MAXPACKET);
+    EXPECT_EQ(-ETIMEDOUT, res);
+
+    dns.setResponseProbability(1.0);
+
+    int fd4 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a, 0);
+    EXPECT_TRUE(fd4 != -1);
+
+    memset(buf, 0, MAXPACKET);
+    res = getAsyncResponse(fd4, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("1.2.3.4", toString(buf, res, AF_INET));
+
+    memset(buf, 0, MAXPACKET);
+    res = getAsyncResponse(fd1, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("::1.2.3.4", toString(buf, res, AF_INET6));
+}
+
+TEST_F(ResolverTest, Async_MalformedQuery) {
+    constexpr char listen_addr[] = "127.0.0.4";
+    constexpr char host_name[] = "howdy.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    int fd = dns_open_proxy();
+    EXPECT_TRUE(fd > 0);
+
+    const std::string badMsg = "16-52512#";
+    static const struct {
+        const std::string cmd;
+        const int expectErr;
+    } kTestData[] = {
+            // Too few arguments
+            {"resnsend " + badMsg + '\0', -EINVAL},
+            // Bad netId
+            {"resnsend badnetId 0 " + badMsg + '\0', -EINVAL},
+            // Bad raw data
+            {"resnsend " + std::to_string(TEST_NETID) + " 0 " + badMsg + '\0', -EILSEQ},
+    };
+
+    for (unsigned int i = 0; i < std::size(kTestData); i++) {
+        auto& td = kTestData[i];
+        SCOPED_TRACE(td.cmd);
+        ssize_t rc = TEMP_FAILURE_RETRY(write(fd, td.cmd.c_str(), td.cmd.size()));
+        EXPECT_EQ(rc, static_cast<ssize_t>(td.cmd.size()));
+
+        int32_t tmp;
+        rc = TEMP_FAILURE_RETRY(read(fd, &tmp, sizeof(tmp)));
+        EXPECT_TRUE(rc > 0);
+        EXPECT_EQ(static_cast<int>(ntohl(tmp)), td.expectErr);
+    }
+    // Normal query with answer buffer
+    // This is raw data of query "howdy.example.com" type 1 class 1
+    std::string query = "81sBAAABAAAAAAAABWhvd2R5B2V4YW1wbGUDY29tAAABAAE=";
+    std::string cmd = "resnsend " + std::to_string(TEST_NETID) + " 0 " + query + '\0';
+    ssize_t rc = TEMP_FAILURE_RETRY(write(fd, cmd.c_str(), cmd.size()));
+    EXPECT_EQ(rc, static_cast<ssize_t>(cmd.size()));
+
+    uint8_t smallBuf[1] = {};
+    int rcode;
+    rc = getAsyncResponse(fd, &rcode, smallBuf, 1);
+    EXPECT_EQ(-EMSGSIZE, rc);
+
+    // Do the normal test with large buffer again
+    fd = dns_open_proxy();
+    EXPECT_TRUE(fd > 0);
+    rc = TEMP_FAILURE_RETRY(write(fd, cmd.c_str(), cmd.size()));
+    EXPECT_EQ(rc, static_cast<ssize_t>(cmd.size()));
+    uint8_t buf[MAXPACKET] = {};
+    rc = getAsyncResponse(fd, &rcode, buf, MAXPACKET);
+    EXPECT_EQ("1.2.3.4", toString(buf, rc, AF_INET));
+}
+
+TEST_F(ResolverTest, Async_CacheFlags) {
+    constexpr char listen_addr[] = "127.0.0.4";
+    constexpr char host_name[] = "howdy.example.com.";
+    constexpr char another_host_name[] = "howdy.example2.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+            {another_host_name, ns_type::ns_t_a, "1.2.3.5"},
+            {another_host_name, ns_type::ns_t_aaaa, "::1.2.3.5"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // ANDROID_RESOLV_NO_CACHE_STORE
+    int fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a,
+                              ANDROID_RESOLV_NO_CACHE_STORE);
+    EXPECT_TRUE(fd1 != -1);
+    int fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a,
+                              ANDROID_RESOLV_NO_CACHE_STORE);
+    EXPECT_TRUE(fd2 != -1);
+    int fd3 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a,
+                              ANDROID_RESOLV_NO_CACHE_STORE);
+    EXPECT_TRUE(fd3 != -1);
+
+    expectAnswersValid(fd3, AF_INET, "1.2.3.4");
+    expectAnswersValid(fd2, AF_INET, "1.2.3.4");
+    expectAnswersValid(fd1, AF_INET, "1.2.3.4");
+
+    // No cache exists, expect 3 queries
+    EXPECT_EQ(3U, GetNumQueries(dns, host_name));
+
+    // Re-query and cache
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a, 0);
+
+    EXPECT_TRUE(fd1 != -1);
+
+    expectAnswersValid(fd1, AF_INET, "1.2.3.4");
+
+    // Now we have cache, expect 4 queries
+    EXPECT_EQ(4U, GetNumQueries(dns, host_name));
+
+    // ANDROID_RESOLV_NO_CACHE_LOOKUP
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a,
+                          ANDROID_RESOLV_NO_CACHE_LOOKUP);
+    fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a,
+                          ANDROID_RESOLV_NO_CACHE_LOOKUP);
+
+    EXPECT_TRUE(fd1 != -1);
+    EXPECT_TRUE(fd2 != -1);
+
+    expectAnswersValid(fd2, AF_INET, "1.2.3.4");
+    expectAnswersValid(fd1, AF_INET, "1.2.3.4");
+
+    // Skip cache, expect 6 queries
+    EXPECT_EQ(6U, GetNumQueries(dns, host_name));
+
+    // Re-query verify cache works
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a,
+                          ANDROID_RESOLV_NO_CACHE_STORE);
+    EXPECT_TRUE(fd1 != -1);
+    expectAnswersValid(fd1, AF_INET, "1.2.3.4");
+
+    // Cache hits,  expect still 6 queries
+    EXPECT_EQ(6U, GetNumQueries(dns, host_name));
+
+    // Start to verify if ANDROID_RESOLV_NO_CACHE_LOOKUP does write response into cache
+    dns.clearQueries();
+
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa,
+                          ANDROID_RESOLV_NO_CACHE_LOOKUP);
+    fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa,
+                          ANDROID_RESOLV_NO_CACHE_LOOKUP);
+
+    EXPECT_TRUE(fd1 != -1);
+    EXPECT_TRUE(fd2 != -1);
+
+    expectAnswersValid(fd2, AF_INET6, "::1.2.3.4");
+    expectAnswersValid(fd1, AF_INET6, "::1.2.3.4");
+
+    // Skip cache, expect 2 queries
+    EXPECT_EQ(2U, GetNumQueries(dns, host_name));
+
+    // Re-query without flags
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa, 0);
+    fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa, 0);
+
+    EXPECT_TRUE(fd1 != -1);
+    EXPECT_TRUE(fd2 != -1);
+
+    expectAnswersValid(fd2, AF_INET6, "::1.2.3.4");
+    expectAnswersValid(fd1, AF_INET6, "::1.2.3.4");
+
+    // Cache hits, expect still 2 queries
+    EXPECT_EQ(2U, GetNumQueries(dns, host_name));
+
+    // Test both ANDROID_RESOLV_NO_CACHE_STORE and ANDROID_RESOLV_NO_CACHE_LOOKUP are set
+    dns.clearQueries();
+
+    // Make sure that the cache of "howdy.example2.com" exists.
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example2.com", ns_c_in, ns_t_aaaa, 0);
+    EXPECT_TRUE(fd1 != -1);
+    expectAnswersValid(fd1, AF_INET6, "::1.2.3.5");
+    EXPECT_EQ(1U, GetNumQueries(dns, another_host_name));
+
+    // Re-query with testFlags
+    const int testFlag = ANDROID_RESOLV_NO_CACHE_STORE | ANDROID_RESOLV_NO_CACHE_LOOKUP;
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example2.com", ns_c_in, ns_t_aaaa, testFlag);
+    EXPECT_TRUE(fd1 != -1);
+    expectAnswersValid(fd1, AF_INET6, "::1.2.3.5");
+    // Expect cache lookup is skipped.
+    EXPECT_EQ(2U, GetNumQueries(dns, another_host_name));
+
+    // Do another query with testFlags
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example2.com", ns_c_in, ns_t_a, testFlag);
+    EXPECT_TRUE(fd1 != -1);
+    expectAnswersValid(fd1, AF_INET, "1.2.3.5");
+    // Expect cache lookup is skipped.
+    EXPECT_EQ(3U, GetNumQueries(dns, another_host_name));
+
+    // Re-query with no flags
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example2.com", ns_c_in, ns_t_a, 0);
+    EXPECT_TRUE(fd1 != -1);
+    expectAnswersValid(fd1, AF_INET, "1.2.3.5");
+    // Expect no cache hit because cache storing is also skipped in previous query.
+    EXPECT_EQ(4U, GetNumQueries(dns, another_host_name));
+}
+
+TEST_F(ResolverTest, Async_NoRetryFlag) {
+    constexpr char listen_addr0[] = "127.0.0.4";
+    constexpr char listen_addr1[] = "127.0.0.6";
+    constexpr char host_name[] = "howdy.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns0(listen_addr0);
+    test::DNSResponder dns1(listen_addr1);
+    StartDns(dns0, records);
+    StartDns(dns1, records);
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork({listen_addr0, listen_addr1}));
+
+    dns0.clearQueries();
+    dns1.clearQueries();
+
+    dns0.setResponseProbability(0.0);
+    dns1.setResponseProbability(0.0);
+
+    int fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a,
+                              ANDROID_RESOLV_NO_RETRY);
+    EXPECT_TRUE(fd1 != -1);
+
+    int fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa,
+                              ANDROID_RESOLV_NO_RETRY);
+    EXPECT_TRUE(fd2 != -1);
+
+    // expect no response
+    expectAnswersNotValid(fd1, -ETIMEDOUT);
+    expectAnswersNotValid(fd2, -ETIMEDOUT);
+
+    // No retry case, expect total 2 queries. The server is selected randomly.
+    EXPECT_EQ(2U, GetNumQueries(dns0, host_name) + GetNumQueries(dns1, host_name));
+
+    dns0.clearQueries();
+    dns1.clearQueries();
+
+    fd1 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_a, 0);
+    EXPECT_TRUE(fd1 != -1);
+
+    fd2 = resNetworkQuery(TEST_NETID, "howdy.example.com", ns_c_in, ns_t_aaaa, 0);
+    EXPECT_TRUE(fd2 != -1);
+
+    // expect no response
+    expectAnswersNotValid(fd1, -ETIMEDOUT);
+    expectAnswersNotValid(fd2, -ETIMEDOUT);
+
+    // Retry case, expect 4 queries
+    EXPECT_EQ(4U, GetNumQueries(dns0, host_name));
+    EXPECT_EQ(4U, GetNumQueries(dns1, host_name));
+}
+
+TEST_F(ResolverTest, Async_VerifyQueryID) {
+    constexpr char listen_addr[] = "127.0.0.4";
+    constexpr char host_name[] = "howdy.example.com.";
+    const std::vector<DnsRecord> records = {
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    const uint8_t queryBuf1[] = {
+            /* Header */
+            0x55, 0x66, /* Transaction ID */
+            0x01, 0x00, /* Flags */
+            0x00, 0x01, /* Questions */
+            0x00, 0x00, /* Answer RRs */
+            0x00, 0x00, /* Authority RRs */
+            0x00, 0x00, /* Additional RRs */
+            /* Queries */
+            0x05, 0x68, 0x6f, 0x77, 0x64, 0x79, 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65,
+            0x03, 0x63, 0x6f, 0x6d, 0x00, /* Name */
+            0x00, 0x01,                   /* Type */
+            0x00, 0x01                    /* Class */
+    };
+
+    int fd = resNetworkSend(TEST_NETID, queryBuf1, sizeof(queryBuf1), 0);
+    EXPECT_TRUE(fd != -1);
+
+    uint8_t buf[MAXPACKET] = {};
+    int rcode;
+
+    int res = getAsyncResponse(fd, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("1.2.3.4", toString(buf, res, AF_INET));
+
+    auto hp = reinterpret_cast<HEADER*>(buf);
+    EXPECT_EQ(21862U, htons(hp->id));
+
+    EXPECT_EQ(1U, GetNumQueries(dns, host_name));
+
+    const uint8_t queryBuf2[] = {
+            /* Header */
+            0x00, 0x53, /* Transaction ID */
+            0x01, 0x00, /* Flags */
+            0x00, 0x01, /* Questions */
+            0x00, 0x00, /* Answer RRs */
+            0x00, 0x00, /* Authority RRs */
+            0x00, 0x00, /* Additional RRs */
+            /* Queries */
+            0x05, 0x68, 0x6f, 0x77, 0x64, 0x79, 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65,
+            0x03, 0x63, 0x6f, 0x6d, 0x00, /* Name */
+            0x00, 0x01,                   /* Type */
+            0x00, 0x01                    /* Class */
+    };
+
+    // Re-query verify cache works and query id is correct
+    fd = resNetworkSend(TEST_NETID, queryBuf2, sizeof(queryBuf2), 0);
+
+    EXPECT_TRUE(fd != -1);
+
+    res = getAsyncResponse(fd, &rcode, buf, MAXPACKET);
+    EXPECT_GT(res, 0);
+    EXPECT_EQ("1.2.3.4", toString(buf, res, AF_INET));
+
+    EXPECT_EQ(0x0053U, htons(hp->id));
+
+    EXPECT_EQ(1U, GetNumQueries(dns, host_name));
+}
+
+// This test checks that the resolver should not generate the request containing OPT RR when using
+// cleartext DNS. If we query the DNS server not supporting EDNS0 and it reponds with
+// FORMERR_ON_EDNS, we will fallback to no EDNS0 and try again. If the server does no response, we
+// won't retry so that we get no answer.
+TEST_F(ResolverTest, BrokenEdns) {
+    // Certificate fingerprints are no longer supported by the module.
+    SKIP_IF_RESOLVER_VERSION_NEWER_THAN(mDnsClient.resolvService(), 2);
+
+    typedef test::DNSResponder::Edns Edns;
+    enum ExpectResult { EXPECT_FAILURE, EXPECT_SUCCESS };
+
+    const char OFF[] = "off";
+    const char OPPORTUNISTIC_UDP[] = "opportunistic_udp";
+    const char OPPORTUNISTIC_TLS[] = "opportunistic_tls";
+    const char STRICT[] = "strict";
+    const char GETHOSTBYNAME[] = "gethostbyname";
+    const char GETADDRINFO[] = "getaddrinfo";
+    const std::vector<uint8_t> NOOP_FINGERPRINT(SHA256_SIZE, 0U);
+    const char ADDR4[] = "192.0.2.1";
+    const char CLEARTEXT_ADDR[] = "127.0.0.53";
+    const char CLEARTEXT_PORT[] = "53";
+    const char TLS_PORT[] = "853";
+    const std::vector<std::string> servers = { CLEARTEXT_ADDR };
+
+    test::DNSResponder dns(CLEARTEXT_ADDR, CLEARTEXT_PORT, 250, ns_rcode::ns_r_servfail);
+    ASSERT_TRUE(dns.startServer());
+
+    test::DnsTlsFrontend tls(CLEARTEXT_ADDR, TLS_PORT, CLEARTEXT_ADDR, CLEARTEXT_PORT);
+
+    static const struct TestConfig {
+        std::string mode;
+        std::string method;
+        Edns edns;
+        ExpectResult expectResult;
+
+        std::string asHostName() const {
+            const char* ednsString;
+            switch (edns) {
+                case Edns::ON:
+                    ednsString = "ednsOn";
+                    break;
+                case Edns::FORMERR_ON_EDNS:
+                    ednsString = "ednsFormerr";
+                    break;
+                case Edns::DROP:
+                    ednsString = "ednsDrop";
+                    break;
+                default:
+                    ednsString = "";
+                    break;
+            }
+            return StringPrintf("%s.%s.%s.", mode.c_str(), method.c_str(), ednsString);
+        }
+    } testConfigs[] = {
+            // In OPPORTUNISTIC_TLS, we get no answer if the DNS server supports TLS but not EDNS0.
+            // Could such server exist? if so, we might need to fallback to query cleartext DNS.
+            // Another thing is that {OPPORTUNISTIC_TLS, Edns::DROP} and {STRICT, Edns::DROP} are
+            // commented out since TLS timeout is not configurable.
+            // TODO: Uncomment them after TLS timeout is configurable.
+            {OFF,               GETHOSTBYNAME, Edns::ON,      EXPECT_SUCCESS},
+            {OPPORTUNISTIC_UDP, GETHOSTBYNAME, Edns::ON,      EXPECT_SUCCESS},
+            {OPPORTUNISTIC_TLS, GETHOSTBYNAME, Edns::ON,      EXPECT_SUCCESS},
+            {STRICT,            GETHOSTBYNAME, Edns::ON,      EXPECT_SUCCESS},
+            {OFF,               GETHOSTBYNAME, Edns::FORMERR_ON_EDNS, EXPECT_SUCCESS},
+            {OPPORTUNISTIC_UDP, GETHOSTBYNAME, Edns::FORMERR_ON_EDNS, EXPECT_SUCCESS},
+            {OPPORTUNISTIC_TLS, GETHOSTBYNAME, Edns::FORMERR_ON_EDNS, EXPECT_FAILURE},
+            {STRICT,            GETHOSTBYNAME, Edns::FORMERR_ON_EDNS, EXPECT_FAILURE},
+            {OFF,               GETHOSTBYNAME, Edns::DROP,    EXPECT_SUCCESS},
+            {OPPORTUNISTIC_UDP, GETHOSTBYNAME, Edns::DROP,    EXPECT_SUCCESS},
+            //{OPPORTUNISTIC_TLS, GETHOSTBYNAME, Edns::DROP,    EXPECT_FAILURE},
+            //{STRICT,            GETHOSTBYNAME, Edns::DROP,    EXPECT_FAILURE},
+            {OFF,               GETADDRINFO,   Edns::ON,      EXPECT_SUCCESS},
+            {OPPORTUNISTIC_UDP, GETADDRINFO,   Edns::ON,      EXPECT_SUCCESS},
+            {OPPORTUNISTIC_TLS, GETADDRINFO,   Edns::ON,      EXPECT_SUCCESS},
+            {STRICT,            GETADDRINFO,   Edns::ON,      EXPECT_SUCCESS},
+            {OFF,               GETADDRINFO,   Edns::FORMERR_ON_EDNS, EXPECT_SUCCESS},
+            {OPPORTUNISTIC_UDP, GETADDRINFO,   Edns::FORMERR_ON_EDNS, EXPECT_SUCCESS},
+            {OPPORTUNISTIC_TLS, GETADDRINFO,   Edns::FORMERR_ON_EDNS, EXPECT_FAILURE},
+            {STRICT,            GETADDRINFO,   Edns::FORMERR_ON_EDNS, EXPECT_FAILURE},
+            {OFF,               GETADDRINFO,   Edns::DROP,    EXPECT_SUCCESS},
+            {OPPORTUNISTIC_UDP, GETADDRINFO,   Edns::DROP,    EXPECT_SUCCESS},
+            //{OPPORTUNISTIC_TLS, GETADDRINFO,   Edns::DROP,   EXPECT_FAILURE},
+            //{STRICT,            GETADDRINFO,   Edns::DROP,   EXPECT_FAILURE},
+    };
+
+    for (const auto& config : testConfigs) {
+        const std::string testHostName = config.asHostName();
+        SCOPED_TRACE(testHostName);
+
+        const char* host_name = testHostName.c_str();
+        dns.addMapping(host_name, ns_type::ns_t_a, ADDR4);
+        dns.setEdns(config.edns);
+
+        if (config.mode == OFF) {
+            ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+        } else if (config.mode == OPPORTUNISTIC_UDP) {
+            ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains,
+                                                       kDefaultParams, "", {}));
+        } else if (config.mode == OPPORTUNISTIC_TLS) {
+            ASSERT_TRUE(tls.startServer());
+            ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains,
+                                                       kDefaultParams, "", {}));
+            // Wait for validation to complete.
+            EXPECT_TRUE(tls.waitForQueries(1, 5000));
+        } else if (config.mode == STRICT) {
+            ASSERT_TRUE(tls.startServer());
+            ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains,
+                                                       kDefaultParams, "",
+                                                       {base64Encode(tls.fingerprint())}));
+            // Wait for validation to complete.
+            EXPECT_TRUE(tls.waitForQueries(1, 5000));
+        }
+
+        if (config.method == GETHOSTBYNAME) {
+            const hostent* h_result = gethostbyname(host_name);
+            if (config.expectResult == EXPECT_SUCCESS) {
+                EXPECT_LE(1U, GetNumQueries(dns, host_name));
+                ASSERT_TRUE(h_result != nullptr);
+                ASSERT_EQ(4, h_result->h_length);
+                ASSERT_FALSE(h_result->h_addr_list[0] == nullptr);
+                EXPECT_EQ(ADDR4, ToString(h_result));
+                EXPECT_TRUE(h_result->h_addr_list[1] == nullptr);
+            } else {
+                EXPECT_EQ(0U, GetNumQueriesForType(dns, ns_type::ns_t_a, host_name));
+                ASSERT_TRUE(h_result == nullptr);
+                ASSERT_EQ(HOST_NOT_FOUND, h_errno);
+            }
+        } else if (config.method == GETADDRINFO) {
+            ScopedAddrinfo ai_result;
+            addrinfo hints = {.ai_family = AF_INET, .ai_socktype = SOCK_DGRAM};
+            ai_result = safe_getaddrinfo(host_name, nullptr, &hints);
+            if (config.expectResult == EXPECT_SUCCESS) {
+                EXPECT_TRUE(ai_result != nullptr);
+                EXPECT_EQ(1U, GetNumQueries(dns, host_name));
+                const std::string result_str = ToString(ai_result);
+                EXPECT_EQ(ADDR4, result_str);
+            } else {
+                EXPECT_TRUE(ai_result == nullptr);
+                EXPECT_EQ(0U, GetNumQueries(dns, host_name));
+            }
+        } else {
+            FAIL() << "Unsupported query method: " << config.method;
+        }
+
+        tls.stopServer();
+        dns.clearQueries();
+    }
+}
+
+// DNS-over-TLS validation success, but server does not respond to TLS query after a while.
+// Resolver should have a reasonable number of retries instead of spinning forever. We don't have
+// an efficient way to know if resolver is stuck in an infinite loop. However, test case will be
+// failed due to timeout.
+TEST_F(ResolverTest, UnstableTls) {
+    const char CLEARTEXT_ADDR[] = "127.0.0.53";
+    const char CLEARTEXT_PORT[] = "53";
+    const char TLS_PORT[] = "853";
+    const char* host_name1 = "nonexistent1.example.com.";
+    const char* host_name2 = "nonexistent2.example.com.";
+    const std::vector<std::string> servers = {CLEARTEXT_ADDR};
+
+    test::DNSResponder dns(CLEARTEXT_ADDR, CLEARTEXT_PORT, 250, ns_rcode::ns_r_servfail);
+    ASSERT_TRUE(dns.startServer());
+    dns.setEdns(test::DNSResponder::Edns::FORMERR_ON_EDNS);
+    test::DnsTlsFrontend tls(CLEARTEXT_ADDR, TLS_PORT, CLEARTEXT_ADDR, CLEARTEXT_PORT);
+    ASSERT_TRUE(tls.startServer());
+    ASSERT_TRUE(
+            mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "", {}));
+    // Wait for validation complete.
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+    // Shutdown TLS server to get an error. It's similar to no response case but without waiting.
+    tls.stopServer();
+
+    const hostent* h_result = gethostbyname(host_name1);
+    EXPECT_EQ(1U, GetNumQueries(dns, host_name1));
+    ASSERT_TRUE(h_result == nullptr);
+    ASSERT_EQ(HOST_NOT_FOUND, h_errno);
+
+    addrinfo hints = {.ai_family = AF_INET, .ai_socktype = SOCK_DGRAM};
+    ScopedAddrinfo ai_result = safe_getaddrinfo(host_name2, nullptr, &hints);
+    EXPECT_TRUE(ai_result == nullptr);
+    EXPECT_EQ(1U, GetNumQueries(dns, host_name2));
+}
+
+// DNS-over-TLS validation success, but server does not respond to TLS query after a while.
+// Moreover, server responds RCODE=FORMERR even on non-EDNS query.
+TEST_F(ResolverTest, BogusDnsServer) {
+    const char CLEARTEXT_ADDR[] = "127.0.0.53";
+    const char CLEARTEXT_PORT[] = "53";
+    const char TLS_PORT[] = "853";
+    const char* host_name1 = "nonexistent1.example.com.";
+    const char* host_name2 = "nonexistent2.example.com.";
+    const std::vector<std::string> servers = {CLEARTEXT_ADDR};
+
+    test::DNSResponder dns(CLEARTEXT_ADDR, CLEARTEXT_PORT, 250, ns_rcode::ns_r_servfail);
+    ASSERT_TRUE(dns.startServer());
+    test::DnsTlsFrontend tls(CLEARTEXT_ADDR, TLS_PORT, CLEARTEXT_ADDR, CLEARTEXT_PORT);
+    ASSERT_TRUE(tls.startServer());
+    ASSERT_TRUE(
+            mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "", {}));
+    // Wait for validation complete.
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+    // Shutdown TLS server to get an error. It's similar to no response case but without waiting.
+    tls.stopServer();
+    dns.setEdns(test::DNSResponder::Edns::FORMERR_UNCOND);
+
+    const hostent* h_result = gethostbyname(host_name1);
+    EXPECT_EQ(0U, GetNumQueries(dns, host_name1));
+    ASSERT_TRUE(h_result == nullptr);
+    ASSERT_EQ(HOST_NOT_FOUND, h_errno);
+
+    addrinfo hints = {.ai_family = AF_INET, .ai_socktype = SOCK_DGRAM};
+    ScopedAddrinfo ai_result = safe_getaddrinfo(host_name2, nullptr, &hints);
+    EXPECT_TRUE(ai_result == nullptr);
+    EXPECT_EQ(0U, GetNumQueries(dns, host_name2));
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Dns64Synthesize) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "v4only.example.com.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+
+    std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // hints are necessary in order to let netd know which type of addresses the caller is
+    // interested in.
+    const addrinfo hints = {.ai_family = AF_UNSPEC};
+    ScopedAddrinfo result = safe_getaddrinfo("v4only", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    // TODO: BUG: there should only be two queries, one AAAA (which returns no records) and one A
+    // (which returns 1.2.3.4). But there is an extra AAAA.
+    EXPECT_EQ(3U, GetNumQueries(dns, host_name));
+
+    std::string result_str = ToString(result);
+    EXPECT_EQ(result_str, "64:ff9b::102:304");
+
+    // Stopping NAT64 prefix discovery disables synthesis.
+    EXPECT_TRUE(mDnsClient.resolvService()->stopPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_FALSE(WaitForPrefix64Detected(TEST_NETID, 300));
+
+    dns.clearQueries();
+
+    result = safe_getaddrinfo("v4only", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    // TODO: BUG: there should only be one query, an AAAA (which returns no records), because the
+    // A is already cached. But there is an extra AAAA.
+    EXPECT_EQ(2U, GetNumQueries(dns, host_name));
+
+    result_str = ToString(result);
+    EXPECT_EQ(result_str, "1.2.3.4");
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Dns64QuerySpecified) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "v4only.example.com.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Ensure to synthesize AAAA if AF_INET6 is specified, and not to synthesize AAAA
+    // in AF_INET case.
+    addrinfo hints;
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_INET6;
+    ScopedAddrinfo result = safe_getaddrinfo("v4only", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    std::string result_str = ToString(result);
+    EXPECT_EQ(result_str, "64:ff9b::102:304");
+
+    hints.ai_family = AF_INET;
+    result = safe_getaddrinfo("v4only", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_LE(2U, GetNumQueries(dns, host_name));
+    result_str = ToString(result);
+    EXPECT_EQ(result_str, "1.2.3.4");
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Dns64QueryUnspecifiedV6) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "v4v6.example.com.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "2001:db8::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    const addrinfo hints = {.ai_family = AF_UNSPEC};
+    ScopedAddrinfo result = safe_getaddrinfo("v4v6", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_LE(2U, GetNumQueries(dns, host_name));
+
+    // In AF_UNSPEC case, do not synthesize AAAA if there's at least one AAAA answer.
+    const std::vector<std::string> result_strs = ToStrings(result);
+    for (const auto& str : result_strs) {
+        EXPECT_TRUE(str == "1.2.3.4" || str == "2001:db8::102:304")
+                << ", result_str='" << str << "'";
+    }
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Dns64QueryUnspecifiedNoV6) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "v4v6.example.com.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    const addrinfo hints = {.ai_family = AF_UNSPEC};
+    ScopedAddrinfo result = safe_getaddrinfo("v4v6", nullptr, &hints);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_LE(2U, GetNumQueries(dns, host_name));
+
+    // In AF_UNSPEC case, synthesize AAAA if there's no AAAA answer.
+    std::string result_str = ToString(result);
+    EXPECT_EQ(result_str, "64:ff9b::102:304");
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Dns64QuerySpecialUseIPv4Addresses) {
+    constexpr char THIS_NETWORK[] = "this_network";
+    constexpr char LOOPBACK[] = "loopback";
+    constexpr char LINK_LOCAL[] = "link_local";
+    constexpr char MULTICAST[] = "multicast";
+    constexpr char LIMITED_BROADCAST[] = "limited_broadcast";
+
+    constexpr char ADDR_THIS_NETWORK[] = "0.0.0.1";
+    constexpr char ADDR_LOOPBACK[] = "127.0.0.1";
+    constexpr char ADDR_LINK_LOCAL[] = "169.254.0.1";
+    constexpr char ADDR_MULTICAST[] = "224.0.0.1";
+    constexpr char ADDR_LIMITED_BROADCAST[] = "255.255.255.255";
+
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, {{dns64_name, ns_type::ns_t_aaaa, "64:ff9b::"}});
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    static const struct TestConfig {
+        std::string name;
+        std::string addr;
+
+        std::string asHostName() const { return StringPrintf("%s.example.com.", name.c_str()); }
+    } testConfigs[]{
+        {THIS_NETWORK,      ADDR_THIS_NETWORK},
+        {LOOPBACK,          ADDR_LOOPBACK},
+        {LINK_LOCAL,        ADDR_LINK_LOCAL},
+        {MULTICAST,         ADDR_MULTICAST},
+        {LIMITED_BROADCAST, ADDR_LIMITED_BROADCAST}
+    };
+
+    for (const auto& config : testConfigs) {
+        const std::string testHostName = config.asHostName();
+        SCOPED_TRACE(testHostName);
+
+        const char* host_name = testHostName.c_str();
+        dns.addMapping(host_name, ns_type::ns_t_a, config.addr.c_str());
+
+        addrinfo hints;
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = AF_INET6;
+        ScopedAddrinfo result = safe_getaddrinfo(config.name.c_str(), nullptr, &hints);
+        // In AF_INET6 case, don't return IPv4 answers
+        EXPECT_TRUE(result == nullptr);
+        EXPECT_LE(2U, GetNumQueries(dns, host_name));
+        dns.clearQueries();
+
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = AF_UNSPEC;
+        result = safe_getaddrinfo(config.name.c_str(), nullptr, &hints);
+        EXPECT_TRUE(result != nullptr);
+        // Expect IPv6 query only. IPv4 answer has been cached in previous query.
+        EXPECT_LE(1U, GetNumQueries(dns, host_name));
+        // In AF_UNSPEC case, don't synthesize special use IPv4 address.
+        std::string result_str = ToString(result);
+        EXPECT_EQ(result_str, config.addr.c_str());
+        dns.clearQueries();
+    }
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Dns64QueryWithNullArgumentHints) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "v4only.example.com.";
+    constexpr char host_name2[] = "v4v6.example.com.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name2, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name2, ns_type::ns_t_aaaa, "2001:db8::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Assign argument hints of getaddrinfo() as null is equivalent to set ai_family AF_UNSPEC.
+    // In AF_UNSPEC case, synthesize AAAA if there has A answer only.
+    ScopedAddrinfo result = safe_getaddrinfo("v4only", nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_LE(2U, GetNumQueries(dns, host_name));
+    std::string result_str = ToString(result);
+    EXPECT_EQ(result_str, "64:ff9b::102:304");
+    dns.clearQueries();
+
+    // In AF_UNSPEC case, do not synthesize AAAA if there's at least one AAAA answer.
+    result = safe_getaddrinfo("v4v6", nullptr, nullptr);
+    EXPECT_TRUE(result != nullptr);
+    EXPECT_LE(2U, GetNumQueries(dns, host_name2));
+    std::vector<std::string> result_strs = ToStrings(result);
+    for (const auto& str : result_strs) {
+        EXPECT_TRUE(str == "1.2.3.4" || str == "2001:db8::102:304")
+                << ", result_str='" << str << "'";
+    }
+}
+
+TEST_F(ResolverTest, GetAddrInfo_Dns64QueryNullArgumentNode) {
+    constexpr char ADDR_ANYADDR_V4[] = "0.0.0.0";
+    constexpr char ADDR_ANYADDR_V6[] = "::";
+    constexpr char ADDR_LOCALHOST_V4[] = "127.0.0.1";
+    constexpr char ADDR_LOCALHOST_V6[] = "::1";
+
+    constexpr char PORT_NAME_HTTP[] = "http";
+    constexpr char PORT_NUMBER_HTTP[] = "80";
+
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, {{dns64_name, ns_type::ns_t_aaaa, "64:ff9b::"}});
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // If node is null, return address is listed by libc/getaddrinfo.c as follows.
+    // - passive socket -> anyaddr (0.0.0.0 or ::)
+    // - non-passive socket -> localhost (127.0.0.1 or ::1)
+    static const struct TestConfig {
+        int flag;
+        std::string addr_v4;
+        std::string addr_v6;
+
+        std::string asParameters() const {
+            return StringPrintf("flag=%d, addr_v4=%s, addr_v6=%s", flag, addr_v4.c_str(),
+                                addr_v6.c_str());
+        }
+    } testConfigs[]{
+        {0 /* non-passive */, ADDR_LOCALHOST_V4, ADDR_LOCALHOST_V6},
+        {AI_PASSIVE,          ADDR_ANYADDR_V4,   ADDR_ANYADDR_V6}
+    };
+
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(config.asParameters());
+
+        addrinfo hints = {
+                .ai_family = AF_UNSPEC,  // any address family
+                .ai_socktype = 0,        // any type
+                .ai_protocol = 0,        // any protocol
+                .ai_flags = config.flag,
+        };
+
+        // Assign hostname as null and service as port name.
+        ScopedAddrinfo result = safe_getaddrinfo(nullptr, PORT_NAME_HTTP, &hints);
+        ASSERT_TRUE(result != nullptr);
+
+        // Can't be synthesized because it should not get into Netd.
+        std::vector<std::string> result_strs = ToStrings(result);
+        for (const auto& str : result_strs) {
+            EXPECT_TRUE(str == config.addr_v4 || str == config.addr_v6)
+                    << ", result_str='" << str << "'";
+        }
+
+        // Assign hostname as null and service as numeric port number.
+        hints.ai_flags = config.flag | AI_NUMERICSERV;
+        result = safe_getaddrinfo(nullptr, PORT_NUMBER_HTTP, &hints);
+        ASSERT_TRUE(result != nullptr);
+
+        // Can't be synthesized because it should not get into Netd.
+        result_strs = ToStrings(result);
+        for (const auto& str : result_strs) {
+            EXPECT_TRUE(str == config.addr_v4 || str == config.addr_v6)
+                    << ", result_str='" << str << "'";
+        }
+    }
+}
+
+TEST_F(ResolverTest, GetHostByAddr_ReverseDnsQueryWithHavingNat64Prefix) {
+    struct hostent* result = nullptr;
+    struct in_addr v4addr;
+    struct in6_addr v6addr;
+
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char ptr_name[] = "v4v6.example.com.";
+    // PTR record for IPv4 address 1.2.3.4
+    constexpr char ptr_addr_v4[] = "4.3.2.1.in-addr.arpa.";
+    // PTR record for IPv6 address 2001:db8::102:304
+    constexpr char ptr_addr_v6[] =
+            "4.0.3.0.2.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {ptr_addr_v4, ns_type::ns_t_ptr, ptr_name},
+            {ptr_addr_v6, ns_type::ns_t_ptr, ptr_name},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Reverse IPv4 DNS query. Prefix should have no effect on it.
+    inet_pton(AF_INET, "1.2.3.4", &v4addr);
+    result = gethostbyaddr(&v4addr, sizeof(v4addr), AF_INET);
+    ASSERT_TRUE(result != nullptr);
+    std::string result_str = result->h_name ? result->h_name : "null";
+    EXPECT_EQ(result_str, "v4v6.example.com");
+
+    // Reverse IPv6 DNS query. Prefix should have no effect on it.
+    inet_pton(AF_INET6, "2001:db8::102:304", &v6addr);
+    result = gethostbyaddr(&v6addr, sizeof(v6addr), AF_INET6);
+    ASSERT_TRUE(result != nullptr);
+    result_str = result->h_name ? result->h_name : "null";
+    EXPECT_EQ(result_str, "v4v6.example.com");
+}
+
+TEST_F(ResolverTest, GetHostByAddr_ReverseDns64Query) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char ptr_name[] = "v4only.example.com.";
+    // PTR record for IPv4 address 1.2.3.4
+    constexpr char ptr_addr_v4[] = "4.3.2.1.in-addr.arpa.";
+    // PTR record for IPv6 address 64:ff9b::1.2.3.4
+    constexpr char ptr_addr_v6_nomapping[] =
+            "4.0.3.0.2.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa.";
+    constexpr char ptr_name_v6_synthesis[] = "v6synthesis.example.com.";
+    // PTR record for IPv6 address 64:ff9b::5.6.7.8
+    constexpr char ptr_addr_v6_synthesis[] =
+            "8.0.7.0.6.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {ptr_addr_v4, ns_type::ns_t_ptr, ptr_name},
+            {ptr_addr_v6_synthesis, ns_type::ns_t_ptr, ptr_name_v6_synthesis},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    // "ptr_addr_v6_nomapping" is not mapped in DNS server
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Synthesized PTR record doesn't exist on DNS server
+    // Reverse IPv6 DNS64 query while DNS server doesn't have an answer for synthesized address.
+    // After querying synthesized address failed, expect that prefix is removed from IPv6
+    // synthesized address and do reverse IPv4 query instead.
+    struct in6_addr v6addr;
+    inet_pton(AF_INET6, "64:ff9b::1.2.3.4", &v6addr);
+    struct hostent* result = gethostbyaddr(&v6addr, sizeof(v6addr), AF_INET6);
+    ASSERT_TRUE(result != nullptr);
+    EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v6_nomapping));  // PTR record not exist
+    EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v4));            // PTR record exist
+    std::string result_str = result->h_name ? result->h_name : "null";
+    EXPECT_EQ(result_str, "v4only.example.com");
+    // Check that return address has been mapped from IPv4 to IPv6 address because Netd
+    // removes NAT64 prefix and does IPv4 DNS reverse lookup in this case. Then, Netd
+    // fakes the return IPv4 address as original queried IPv6 address.
+    result_str = ToString(result);
+    EXPECT_EQ(result_str, "64:ff9b::102:304");
+    dns.clearQueries();
+
+    // Synthesized PTR record exists on DNS server
+    // Reverse IPv6 DNS64 query while DNS server has an answer for synthesized address.
+    // Expect to Netd pass through synthesized address for DNS queries.
+    inet_pton(AF_INET6, "64:ff9b::5.6.7.8", &v6addr);
+    result = gethostbyaddr(&v6addr, sizeof(v6addr), AF_INET6);
+    ASSERT_TRUE(result != nullptr);
+    EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v6_synthesis));
+    result_str = result->h_name ? result->h_name : "null";
+    EXPECT_EQ(result_str, "v6synthesis.example.com");
+}
+
+TEST_F(ResolverTest, GetHostByAddr_ReverseDns64QueryFromHostFile) {
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "localhost";
+    // The address is synthesized by prefix64:localhost.
+    constexpr char host_addr[] = "64:ff9b::7f00:1";
+    constexpr char listen_addr[] = "::1";
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, {{dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"}});
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Using synthesized "localhost" address to be a trick for resolving host name
+    // from host file /etc/hosts and "localhost" is the only name in /etc/hosts. Note that this is
+    // not realistic: the code never synthesizes AAAA records for addresses in 127.0.0.0/8.
+    struct in6_addr v6addr;
+    inet_pton(AF_INET6, host_addr, &v6addr);
+    struct hostent* result = gethostbyaddr(&v6addr, sizeof(v6addr), AF_INET6);
+    ASSERT_TRUE(result != nullptr);
+    // Expect no DNS queries; localhost is resolved via /etc/hosts.
+    EXPECT_EQ(0U, GetNumQueries(dns, host_name));
+
+    ASSERT_EQ(sizeof(in6_addr), (unsigned) result->h_length);
+    ASSERT_EQ(AF_INET6, result->h_addrtype);
+    std::string result_str = ToString(result);
+    EXPECT_EQ(result_str, host_addr);
+    result_str = result->h_name ? result->h_name : "null";
+    EXPECT_EQ(result_str, host_name);
+}
+
+TEST_F(ResolverTest, GetNameInfo_ReverseDnsQueryWithHavingNat64Prefix) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char ptr_name[] = "v4v6.example.com.";
+    // PTR record for IPv4 address 1.2.3.4
+    constexpr char ptr_addr_v4[] = "4.3.2.1.in-addr.arpa.";
+    // PTR record for IPv6 address 2001:db8::102:304
+    constexpr char ptr_addr_v6[] =
+            "4.0.3.0.2.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {ptr_addr_v4, ns_type::ns_t_ptr, ptr_name},
+            {ptr_addr_v6, ns_type::ns_t_ptr, ptr_name},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    static const struct TestConfig {
+        int flag;
+        int family;
+        std::string addr;
+        std::string host;
+
+        std::string asParameters() const {
+            return StringPrintf("flag=%d, family=%d, addr=%s, host=%s", flag, family, addr.c_str(),
+                                host.c_str());
+        }
+    } testConfigs[]{
+        {NI_NAMEREQD,    AF_INET,  "1.2.3.4",           "v4v6.example.com"},
+        {NI_NUMERICHOST, AF_INET,  "1.2.3.4",           "1.2.3.4"},
+        {0,              AF_INET,  "1.2.3.4",           "v4v6.example.com"},
+        {0,              AF_INET,  "5.6.7.8",           "5.6.7.8"},           // unmapped
+        {NI_NAMEREQD,    AF_INET6, "2001:db8::102:304", "v4v6.example.com"},
+        {NI_NUMERICHOST, AF_INET6, "2001:db8::102:304", "2001:db8::102:304"},
+        {0,              AF_INET6, "2001:db8::102:304", "v4v6.example.com"},
+        {0,              AF_INET6, "2001:db8::506:708", "2001:db8::506:708"}, // unmapped
+    };
+
+    // Reverse IPv4/IPv6 DNS query. Prefix should have no effect on it.
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(config.asParameters());
+
+        int rv;
+        char host[NI_MAXHOST];
+        struct sockaddr_in sin;
+        struct sockaddr_in6 sin6;
+        if (config.family == AF_INET) {
+            memset(&sin, 0, sizeof(sin));
+            sin.sin_family = AF_INET;
+            inet_pton(AF_INET, config.addr.c_str(), &sin.sin_addr);
+            rv = getnameinfo((const struct sockaddr*) &sin, sizeof(sin), host, sizeof(host),
+                             nullptr, 0, config.flag);
+            if (config.flag == NI_NAMEREQD) EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v4));
+        } else if (config.family == AF_INET6) {
+            memset(&sin6, 0, sizeof(sin6));
+            sin6.sin6_family = AF_INET6;
+            inet_pton(AF_INET6, config.addr.c_str(), &sin6.sin6_addr);
+            rv = getnameinfo((const struct sockaddr*) &sin6, sizeof(sin6), host, sizeof(host),
+                             nullptr, 0, config.flag);
+            if (config.flag == NI_NAMEREQD) EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v6));
+        }
+        ASSERT_EQ(0, rv);
+        std::string result_str = host;
+        EXPECT_EQ(result_str, config.host);
+        dns.clearQueries();
+    }
+}
+
+TEST_F(ResolverTest, GetNameInfo_ReverseDns64Query) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char ptr_name[] = "v4only.example.com.";
+    // PTR record for IPv4 address 1.2.3.4
+    constexpr char ptr_addr_v4[] = "4.3.2.1.in-addr.arpa.";
+    // PTR record for IPv6 address 64:ff9b::1.2.3.4
+    constexpr char ptr_addr_v6_nomapping[] =
+            "4.0.3.0.2.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa.";
+    constexpr char ptr_name_v6_synthesis[] = "v6synthesis.example.com.";
+    // PTR record for IPv6 address 64:ff9b::5.6.7.8
+    constexpr char ptr_addr_v6_synthesis[] =
+            "8.0.7.0.6.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.b.9.f.f.4.6.0.0.ip6.arpa.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {ptr_addr_v4, ns_type::ns_t_ptr, ptr_name},
+            {ptr_addr_v6_synthesis, ns_type::ns_t_ptr, ptr_name_v6_synthesis},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    static const struct TestConfig {
+        bool hasSynthesizedPtrRecord;
+        int flag;
+        std::string addr;
+        std::string host;
+
+        std::string asParameters() const {
+            return StringPrintf("hasSynthesizedPtrRecord=%d, flag=%d, addr=%s, host=%s",
+                                hasSynthesizedPtrRecord, flag, addr.c_str(), host.c_str());
+        }
+    } testConfigs[]{
+        {false, NI_NAMEREQD,    "64:ff9b::102:304", "v4only.example.com"},
+        {false, NI_NUMERICHOST, "64:ff9b::102:304", "64:ff9b::102:304"},
+        {false, 0,              "64:ff9b::102:304", "v4only.example.com"},
+        {true,  NI_NAMEREQD,    "64:ff9b::506:708", "v6synthesis.example.com"},
+        {true,  NI_NUMERICHOST, "64:ff9b::506:708", "64:ff9b::506:708"},
+        {true,  0,              "64:ff9b::506:708", "v6synthesis.example.com"}
+    };
+
+    // hasSynthesizedPtrRecord = false
+    //   Synthesized PTR record doesn't exist on DNS server
+    //   Reverse IPv6 DNS64 query while DNS server doesn't have an answer for synthesized address.
+    //   After querying synthesized address failed, expect that prefix is removed from IPv6
+    //   synthesized address and do reverse IPv4 query instead.
+    //
+    // hasSynthesizedPtrRecord = true
+    //   Synthesized PTR record exists on DNS server
+    //   Reverse IPv6 DNS64 query while DNS server has an answer for synthesized address.
+    //   Expect to just pass through synthesized address for DNS queries.
+    for (const auto& config : testConfigs) {
+        SCOPED_TRACE(config.asParameters());
+
+        char host[NI_MAXHOST];
+        struct sockaddr_in6 sin6;
+        memset(&sin6, 0, sizeof(sin6));
+        sin6.sin6_family = AF_INET6;
+        inet_pton(AF_INET6, config.addr.c_str(), &sin6.sin6_addr);
+        int rv = getnameinfo((const struct sockaddr*) &sin6, sizeof(sin6), host, sizeof(host),
+                             nullptr, 0, config.flag);
+        ASSERT_EQ(0, rv);
+        if (config.flag == NI_NAMEREQD) {
+            if (config.hasSynthesizedPtrRecord) {
+                EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v6_synthesis));
+            } else {
+                EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v6_nomapping));  // PTR record not exist.
+                EXPECT_LE(1U, GetNumQueries(dns, ptr_addr_v4));            // PTR record exist.
+            }
+        }
+        std::string result_str = host;
+        EXPECT_EQ(result_str, config.host);
+        dns.clearQueries();
+    }
+}
+
+TEST_F(ResolverTest, GetNameInfo_ReverseDns64QueryFromHostFile) {
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "localhost";
+    // The address is synthesized by prefix64:localhost.
+    constexpr char host_addr[] = "64:ff9b::7f00:1";
+    constexpr char listen_addr[] = "::1";
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, {{dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"}});
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Using synthesized "localhost" address to be a trick for resolving host name
+    // from host file /etc/hosts and "localhost" is the only name in /etc/hosts. Note that this is
+    // not realistic: the code never synthesizes AAAA records for addresses in 127.0.0.0/8.
+    char host[NI_MAXHOST];
+    struct sockaddr_in6 sin6 = {.sin6_family = AF_INET6};
+    inet_pton(AF_INET6, host_addr, &sin6.sin6_addr);
+    int rv = getnameinfo((const struct sockaddr*) &sin6, sizeof(sin6), host, sizeof(host), nullptr,
+                         0, NI_NAMEREQD);
+    ASSERT_EQ(0, rv);
+    // Expect no DNS queries; localhost is resolved via /etc/hosts.
+    EXPECT_EQ(0U, GetNumQueries(dns, host_name));
+
+    std::string result_str = host;
+    EXPECT_EQ(result_str, host_name);
+}
+
+TEST_F(ResolverTest, GetHostByName2_Dns64Synthesize) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "ipv4only.example.com.";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Query an IPv4-only hostname. Expect that gets a synthesized address.
+    struct hostent* result = gethostbyname2("ipv4only", AF_INET6);
+    ASSERT_TRUE(result != nullptr);
+    EXPECT_LE(1U, GetNumQueries(dns, host_name));
+    std::string result_str = ToString(result);
+    EXPECT_EQ(result_str, "64:ff9b::102:304");
+}
+
+TEST_F(ResolverTest, GetHostByName2_DnsQueryWithHavingNat64Prefix) {
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    constexpr char host_name[] = "v4v6.example.com.";
+    constexpr char listen_addr[] = "::1";
+    const std::vector<DnsRecord> records = {
+            {dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"},
+            {host_name, ns_type::ns_t_a, "1.2.3.4"},
+            {host_name, ns_type::ns_t_aaaa, "2001:db8::1.2.3.4"},
+    };
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, records);
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // IPv4 DNS query. Prefix should have no effect on it.
+    struct hostent* result = gethostbyname2("v4v6", AF_INET);
+    ASSERT_TRUE(result != nullptr);
+    EXPECT_LE(1U, GetNumQueries(dns, host_name));
+    std::string result_str = ToString(result);
+    EXPECT_EQ(result_str, "1.2.3.4");
+    dns.clearQueries();
+
+    // IPv6 DNS query. Prefix should have no effect on it.
+    result = gethostbyname2("v4v6", AF_INET6);
+    ASSERT_TRUE(result != nullptr);
+    EXPECT_LE(1U, GetNumQueries(dns, host_name));
+    result_str = ToString(result);
+    EXPECT_EQ(result_str, "2001:db8::102:304");
+}
+
+TEST_F(ResolverTest, GetHostByName2_Dns64QuerySpecialUseIPv4Addresses) {
+    constexpr char THIS_NETWORK[] = "this_network";
+    constexpr char LOOPBACK[] = "loopback";
+    constexpr char LINK_LOCAL[] = "link_local";
+    constexpr char MULTICAST[] = "multicast";
+    constexpr char LIMITED_BROADCAST[] = "limited_broadcast";
+
+    constexpr char ADDR_THIS_NETWORK[] = "0.0.0.1";
+    constexpr char ADDR_LOOPBACK[] = "127.0.0.1";
+    constexpr char ADDR_LINK_LOCAL[] = "169.254.0.1";
+    constexpr char ADDR_MULTICAST[] = "224.0.0.1";
+    constexpr char ADDR_LIMITED_BROADCAST[] = "255.255.255.255";
+
+    constexpr char listen_addr[] = "::1";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, {{dns64_name, ns_type::ns_t_aaaa, "64:ff9b::"}});
+    const std::vector<std::string> servers = {listen_addr};
+    ASSERT_TRUE(mDnsClient.SetResolversForNetwork(servers));
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    static const struct TestConfig {
+        std::string name;
+        std::string addr;
+
+        std::string asHostName() const {
+            return StringPrintf("%s.example.com.",
+                                name.c_str());
+        }
+    } testConfigs[]{
+        {THIS_NETWORK,      ADDR_THIS_NETWORK},
+        {LOOPBACK,          ADDR_LOOPBACK},
+        {LINK_LOCAL,        ADDR_LINK_LOCAL},
+        {MULTICAST,         ADDR_MULTICAST},
+        {LIMITED_BROADCAST, ADDR_LIMITED_BROADCAST}
+    };
+
+    for (const auto& config : testConfigs) {
+        const std::string testHostName = config.asHostName();
+        SCOPED_TRACE(testHostName);
+
+        const char* host_name = testHostName.c_str();
+        dns.addMapping(host_name, ns_type::ns_t_a, config.addr.c_str());
+
+        struct hostent* result = gethostbyname2(config.name.c_str(), AF_INET6);
+        EXPECT_LE(1U, GetNumQueries(dns, host_name));
+
+        // In AF_INET6 case, don't synthesize special use IPv4 address.
+        // Expect to have no answer
+        EXPECT_EQ(nullptr, result);
+
+        dns.clearQueries();
+    }
+}
+
+TEST_F(ResolverTest, PrefixDiscoveryBypassTls) {
+    constexpr char listen_addr[] = "::1";
+    constexpr char cleartext_port[] = "53";
+    constexpr char tls_port[] = "853";
+    constexpr char dns64_name[] = "ipv4only.arpa.";
+    const std::vector<std::string> servers = {listen_addr};
+
+    test::DNSResponder dns(listen_addr);
+    StartDns(dns, {{dns64_name, ns_type::ns_t_aaaa, "64:ff9b::192.0.0.170"}});
+    test::DnsTlsFrontend tls(listen_addr, tls_port, listen_addr, cleartext_port);
+    ASSERT_TRUE(tls.startServer());
+
+    // Setup OPPORTUNISTIC mode and wait for the validation complete.
+    ASSERT_TRUE(
+            mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "", {}));
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+    tls.clearQueries();
+
+    // Start NAT64 prefix discovery and wait for it complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Verify it bypassed TLS even though there's a TLS server available.
+    EXPECT_EQ(0, tls.queries());
+    EXPECT_EQ(1U, GetNumQueries(dns, dns64_name));
+
+    // Restart the testing network to reset the cache.
+    mDnsClient.TearDown();
+    mDnsClient.SetUp();
+    dns.clearQueries();
+
+    // Setup STRICT mode and wait for the validation complete.
+    ASSERT_TRUE(mDnsClient.SetResolversWithTls(servers, kDefaultSearchDomains, kDefaultParams, "",
+                                               {base64Encode(tls.fingerprint())}));
+    EXPECT_TRUE(tls.waitForQueries(1, 5000));
+    tls.clearQueries();
+
+    // Start NAT64 prefix discovery and wait for it to complete.
+    EXPECT_TRUE(mDnsClient.resolvService()->startPrefix64Discovery(TEST_NETID).isOk());
+    EXPECT_TRUE(WaitForPrefix64Detected(TEST_NETID, 1000));
+
+    // Verify it bypassed TLS despite STRICT mode.
+    EXPECT_EQ(0, tls.queries());
+    EXPECT_EQ(1U, GetNumQueries(dns, dns64_name));
+}
+
+namespace {
+
+class ScopedSetNetworkForProcess {
+  public:
+    explicit ScopedSetNetworkForProcess(unsigned netId) {
+        mStoredNetId = getNetworkForProcess();
+        if (netId == mStoredNetId) return;
+        EXPECT_EQ(0, setNetworkForProcess(netId));
+    }
+    ~ScopedSetNetworkForProcess() { EXPECT_EQ(0, setNetworkForProcess(mStoredNetId)); }
+
+  private:
+    unsigned mStoredNetId;
+};
+
+class ScopedSetNetworkForResolv {
+  public:
+    explicit ScopedSetNetworkForResolv(unsigned netId) { EXPECT_EQ(0, setNetworkForResolv(netId)); }
+    ~ScopedSetNetworkForResolv() { EXPECT_EQ(0, setNetworkForResolv(NETID_UNSET)); }
+};
+
+void sendCommand(int fd, const std::string& cmd) {
+    ssize_t rc = TEMP_FAILURE_RETRY(write(fd, cmd.c_str(), cmd.size() + 1));
+    EXPECT_EQ(rc, static_cast<ssize_t>(cmd.size() + 1));
+}
+
+int32_t readBE32(int fd) {
+    int32_t tmp;
+    int n = TEMP_FAILURE_RETRY(read(fd, &tmp, sizeof(tmp)));
+    EXPECT_TRUE(n > 0);
+    return ntohl(tmp);
+}
+
+int readResponseCode(int fd) {
+    char buf[4];
+    int n = TEMP_FAILURE_RETRY(read(fd, &buf, sizeof(buf)));
+    EXPECT_TRUE(n > 0);
+    // The format of response code is that 4 bytes for the code & null.
+    buf[3] = '\0';
+    int result;
+    EXPECT_TRUE(ParseInt(buf, &result));
+    return result;
+}
+
+bool checkAndClearUseLocalNameserversFlag(unsigned* netid) {
+    if (netid == nullptr || ((*netid) & NETID_USE_LOCAL_NAMESERVERS) == 0) {
+        return false;
+    }
+    *netid = (*netid) & ~NETID_USE_LOCAL_NAMESERVERS;
+    return true;
+}
+
+android::net::UidRangeParcel makeUidRangeParcel(int start, int stop) {
+    android::net::UidRangeParcel res;
+    res.start = start;
+    res.stop = stop;
+
+    return res;
+}
+
+void expectNetIdWithLocalNameserversFlag(unsigned netId) {
+    unsigned dnsNetId = 0;
+    EXPECT_EQ(0, getNetworkForDns(&dnsNetId));
+    EXPECT_TRUE(checkAndClearUseLocalNameserversFlag(&dnsNetId));
+    EXPECT_EQ(netId, static_cast<unsigned>(dnsNetId));
+}
+
+void expectDnsNetIdEquals(unsigned netId) {
+    unsigned dnsNetId = 0;
+    EXPECT_EQ(0, getNetworkForDns(&dnsNetId));
+    EXPECT_EQ(netId, static_cast<unsigned>(dnsNetId));
+}
+
+void expectDnsNetIdIsDefaultNetwork(android::net::INetd* netdService) {
+    int currentNetid;
+    EXPECT_TRUE(netdService->networkGetDefault(&currentNetid).isOk());
+    expectDnsNetIdEquals(currentNetid);
+}
+
+void expectDnsNetIdWithVpn(android::net::INetd* netdService, unsigned vpnNetId,
+                           unsigned expectedNetId) {
+    EXPECT_TRUE(netdService->networkCreateVpn(vpnNetId, false /* secure */).isOk());
+    uid_t uid = getuid();
+    // Add uid to VPN
+    EXPECT_TRUE(netdService->networkAddUidRanges(vpnNetId, {makeUidRangeParcel(uid, uid)}).isOk());
+    expectDnsNetIdEquals(expectedNetId);
+    EXPECT_TRUE(netdService->networkDestroy(vpnNetId).isOk());
+}
+
+}  // namespace
+
+TEST_F(ResolverTest, getDnsNetId) {
+    // We've called setNetworkForProcess in SetupOemNetwork, so reset to default first.
+    setNetworkForProcess(NETID_UNSET);
+
+    expectDnsNetIdIsDefaultNetwork(mDnsClient.netdService());
+    expectDnsNetIdWithVpn(mDnsClient.netdService(), TEST_VPN_NETID, TEST_VPN_NETID);
+
+    // Test with setNetworkForProcess
+    {
+        ScopedSetNetworkForProcess scopedSetNetworkForProcess(TEST_NETID);
+        expectDnsNetIdEquals(TEST_NETID);
+    }
+
+    // Test with setNetworkForProcess with NETID_USE_LOCAL_NAMESERVERS
+    {
+        ScopedSetNetworkForProcess scopedSetNetworkForProcess(TEST_NETID |
+                                                              NETID_USE_LOCAL_NAMESERVERS);
+        expectNetIdWithLocalNameserversFlag(TEST_NETID);
+    }
+
+    // Test with setNetworkForResolv
+    {
+        ScopedSetNetworkForResolv scopedSetNetworkForResolv(TEST_NETID);
+        expectDnsNetIdEquals(TEST_NETID);
+    }
+
+    // Test with setNetworkForResolv with NETID_USE_LOCAL_NAMESERVERS
+    {
+        ScopedSetNetworkForResolv scopedSetNetworkForResolv(TEST_NETID |
+                                                            NETID_USE_LOCAL_NAMESERVERS);
+        expectNetIdWithLocalNameserversFlag(TEST_NETID);
+    }
+
+    // Test with setNetworkForResolv under bypassable vpn
+    {
+        ScopedSetNetworkForResolv scopedSetNetworkForResolv(TEST_NETID);
+        expectDnsNetIdWithVpn(mDnsClient.netdService(), TEST_VPN_NETID, TEST_NETID);
+    }
+
+    // Create socket connected to DnsProxyListener
+    int fd = dns_open_proxy();
+    EXPECT_TRUE(fd > 0);
+    unique_fd ufd(fd);
+
+    // Test command with wrong netId
+    sendCommand(fd, "getdnsnetid abc");
+    EXPECT_EQ(ResponseCode::DnsProxyQueryResult, readResponseCode(fd));
+    EXPECT_EQ(-EINVAL, readBE32(fd));
+
+    // Test unsupported command
+    sendCommand(fd, "getdnsnetidNotSupported");
+    // Keep in sync with FrameworkListener.cpp (500, "Command not recognized")
+    EXPECT_EQ(500, readResponseCode(fd));
+}
diff --git a/resolv/sethostent.cpp b/resolv/sethostent.cpp
new file mode 100644
index 0000000..2885fbc
--- /dev/null
+++ b/resolv/sethostent.cpp
@@ -0,0 +1,204 @@
+/*	$NetBSD: sethostent.c,v 1.20 2014/03/17 13:24:23 christos Exp $	*/
+
+/*
+ * Copyright (c) 1985, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <assert.h>
+#include <errno.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <resolv.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/param.h>
+
+#include "hostent.h"
+#include "resolv_private.h"
+
+#define ALIGNBYTES (sizeof(uintptr_t) - 1)
+#define ALIGN(p) (((uintptr_t)(p) + ALIGNBYTES) & ~ALIGNBYTES)
+
+static void sethostent_r(FILE** hf) {
+    if (!*hf)
+        *hf = fopen(_PATH_HOSTS, "re");
+    else
+        rewind(*hf);
+}
+
+static void endhostent_r(FILE** hf) {
+    if (*hf) {
+        (void) fclose(*hf);
+        *hf = NULL;
+    }
+}
+
+// TODO: Consider returning a boolean result as files_getaddrinfo() does because the error code
+// does not currently return to netd.
+int _hf_gethtbyname2(const char* name, int af, getnamaddr* info) {
+    struct hostent *hp, hent;
+    char *buf, *ptr;
+    size_t len, num, i;
+    char* aliases[MAXALIASES];
+    char* addr_ptrs[MAXADDRS];
+
+    FILE* hf = NULL;
+    sethostent_r(&hf);
+    if (hf == NULL) {
+        // TODO: Consider converting to a private extended EAI_* error code.
+        // Currently, the EAI_* value has no corresponding error code for invalid argument socket
+        // length. In order to not rely on errno, convert the original error code pair, EAI_SYSTEM
+        // and EINVAL, to EAI_FAIL.
+        return EAI_FAIL;
+    }
+
+    if ((ptr = buf = (char*) malloc(len = info->buflen)) == NULL) {
+        return EAI_MEMORY;
+    }
+
+    hent.h_name = NULL;
+    hent.h_addrtype = 0;
+    hent.h_length = 0;
+
+    size_t anum = 0;
+    for (num = 0; num < MAXADDRS; /**/) {
+        info->hp->h_addrtype = af;
+        info->hp->h_length = 0;
+
+        int he;
+        hp = netbsd_gethostent_r(hf, info->hp, info->buf, info->buflen, &he);
+        if (hp == NULL) {
+            if (he == NETDB_INTERNAL && errno == ENOSPC) {
+                goto nospc;  // glibc compatibility.
+            }
+            break;
+        }
+
+        if (strcasecmp(hp->h_name, name) != 0) {
+            char** cp;
+            for (cp = hp->h_aliases; *cp != NULL; cp++)
+                if (strcasecmp(*cp, name) == 0) break;
+            // NOTE: does not increment num
+            if (*cp == NULL) continue;
+        }
+
+        if (num == 0) {
+            hent.h_addrtype = hp->h_addrtype;
+            hent.h_length = hp->h_length;
+
+            HENT_SCOPY(hent.h_name, hp->h_name, ptr, len);
+            for (anum = 0; hp->h_aliases[anum]; anum++) {
+                if (anum >= MAXALIASES) goto nospc;
+                HENT_SCOPY(aliases[anum], hp->h_aliases[anum], ptr, len);
+            }
+            ptr = (char*) ALIGN(ptr);
+            if ((size_t)(ptr - buf) >= info->buflen) goto nospc;
+        }
+
+        if (num >= MAXADDRS) goto nospc;
+        HENT_COPY(addr_ptrs[num], hp->h_addr_list[0], hp->h_length, ptr, len);
+
+        num++;
+    }
+    endhostent_r(&hf);
+
+    if (num == 0) {
+        free(buf);
+        // TODO: Perhaps convert HOST_NOT_FOUND to EAI_NONAME instead.
+        // The original return error number is h_errno HOST_NOT_FOUND which was converted to
+        // EAI_NODATA.
+        return EAI_NODATA;
+    }
+
+    hp = info->hp;
+    ptr = info->buf;
+    len = info->buflen;
+
+    hp->h_addrtype = hent.h_addrtype;
+    hp->h_length = hent.h_length;
+
+    HENT_ARRAY(hp->h_aliases, anum, ptr, len);
+    HENT_ARRAY(hp->h_addr_list, num, ptr, len);
+
+    for (i = 0; i < num; i++) {
+        HENT_COPY(hp->h_addr_list[i], addr_ptrs[i], hp->h_length, ptr, len);
+
+        // reserve space for mapping IPv4 address to IPv6 address in place
+        if (hp->h_addrtype == AF_INET) {
+            HENT_COPY(ptr, NAT64_PAD, sizeof(NAT64_PAD), ptr, len);
+        }
+    }
+    hp->h_addr_list[num] = NULL;
+
+    HENT_SCOPY(hp->h_name, hent.h_name, ptr, len);
+
+    for (i = 0; i < anum; i++) {
+        HENT_SCOPY(hp->h_aliases[i], aliases[i], ptr, len);
+    }
+    hp->h_aliases[anum] = NULL;
+
+    free(buf);
+    return 0;
+nospc:
+    free(buf);
+    return EAI_MEMORY;
+}
+
+// TODO: Consider returning a boolean result as files_getaddrinfo() does because the error code
+// does not currently return to netd.
+int _hf_gethtbyaddr(const unsigned char* uaddr, int len, int af, getnamaddr* info) {
+    info->hp->h_length = len;
+    info->hp->h_addrtype = af;
+
+    FILE* hf = NULL;
+    sethostent_r(&hf);
+    if (hf == NULL) {
+        // TODO: Consider converting to a private extended EAI_* error code.
+        // Currently, the EAI_* value has no corresponding error code for invalid argument socket
+        // length. In order to not rely on errno, convert the original error code pair, EAI_SYSTEM
+        // and EINVAL, to EAI_FAIL.
+        return EAI_FAIL;
+    }
+    struct hostent* hp;
+    int he;
+    while ((hp = netbsd_gethostent_r(hf, info->hp, info->buf, info->buflen, &he)) != NULL)
+        if (!memcmp(hp->h_addr_list[0], uaddr, (size_t) hp->h_length)) break;
+    endhostent_r(&hf);
+
+    if (hp == NULL) {
+        if (errno == ENOSPC) return EAI_MEMORY;  // glibc compatibility.
+        // TODO: Perhaps convert HOST_NOT_FOUND to EAI_NONAME instead.
+        // The original return error number is h_errno HOST_NOT_FOUND which was converted to
+        // EAI_NODATA.
+        return EAI_NODATA;
+    }
+    return 0;
+}
diff --git a/resolv/stats.proto b/resolv/stats.proto
new file mode 100644
index 0000000..60e2071
--- /dev/null
+++ b/resolv/stats.proto
@@ -0,0 +1,255 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+syntax = "proto2";
+option optimize_for = LITE_RUNTIME;
+package android.net;
+
+enum EventType {
+    EVENT_UNKNOWN = 0;
+    EVENT_GETADDRINFO = 1;
+    EVENT_GETHOSTBYNAME = 2;
+    EVENT_GETHOSTBYADDR = 3;
+    EVENT_RES_NSEND = 4;
+}
+
+// The return value of the DNS resolver for each DNS lookups.
+// bionic/libc/include/netdb.h
+// system/netd/resolv/include/netd_resolv/resolv.h
+enum ReturnCode {
+    RC_EAI_NO_ERROR = 0;
+    RC_EAI_ADDRFAMILY = 1;
+    RC_EAI_AGAIN = 2;
+    RC_EAI_BADFLAGS = 3;
+    RC_EAI_FAIL = 4;
+    RC_EAI_FAMILY = 5;
+    RC_EAI_MEMORY = 6;
+    RC_EAI_NODATA = 7;
+    RC_EAI_NONAME = 8;
+    RC_EAI_SERVICE = 9;
+    RC_EAI_SOCKTYPE = 10;
+    RC_EAI_SYSTEM = 11;
+    RC_EAI_BADHINTS = 12;
+    RC_EAI_PROTOCOL = 13;
+    RC_EAI_OVERFLOW = 14;
+    RC_RESOLV_TIMEOUT = 255;
+    RC_EAI_MAX = 256;
+}
+
+enum NsRcode {
+    NS_R_NO_ERROR = 0;  // No error occurred.
+    NS_R_FORMERR = 1;   // Format error.
+    NS_R_SERVFAIL = 2;  // Server failure.
+    NS_R_NXDOMAIN = 3;  // Name error.
+    NS_R_NOTIMPL = 4;   // Unimplemented.
+    NS_R_REFUSED = 5;   // Operation refused.
+    // these are for BIND_UPDATE
+    NS_R_YXDOMAIN = 6;  // Name exists
+    NS_R_YXRRSET = 7;   // RRset exists
+    NS_R_NXRRSET = 8;   // RRset does not exist
+    NS_R_NOTAUTH = 9;   // Not authoritative for zone
+    NS_R_NOTZONE = 10;  // Zone of record different from zone section
+    NS_R_MAX = 11;
+    // The following are EDNS extended rcodes
+    NS_R_BADVERS = 16;
+    // The following are TSIG errors
+    // NS_R_BADSIG  = 16,
+    NS_R_BADKEY = 17;
+    NS_R_BADTIME = 18;
+    NS_R_INTERNAL_ERROR = 254;
+    NS_R_TIMEOUT = 255;
+}
+
+// Currently defined type values for resources and queries.
+enum NsType {
+    NS_T_INVALID = 0;      // Cookie.
+    NS_T_A = 1;            // Host address.
+    NS_T_NS = 2;           // Authoritative server.
+    NS_T_MD = 3;           // Mail destination.
+    NS_T_MF = 4;           // Mail forwarder.
+    NS_T_CNAME = 5;        // Canonical name.
+    NS_T_SOA = 6;          // Start of authority zone.
+    NS_T_MB = 7;           // Mailbox domain name.
+    NS_T_MG = 8;           // Mail group member.
+    NS_T_MR = 9;           // Mail rename name.
+    NS_T_NULL = 10;        // Null resource record.
+    NS_T_WKS = 11;         // Well known service.
+    NS_T_PTR = 12;         // Domain name pointer.
+    NS_T_HINFO = 13;       // Host information.
+    NS_T_MINFO = 14;       // Mailbox information.
+    NS_T_MX = 15;          // Mail routing information.
+    NS_T_TXT = 16;         // Text strings.
+    NS_T_RP = 17;          // Responsible person.
+    NS_T_AFSDB = 18;       // AFS cell database.
+    NS_T_X25 = 19;         // X_25 calling address.
+    NS_T_ISDN = 20;        // ISDN calling address.
+    NS_T_RT = 21;          // Router.
+    NS_T_NSAP = 22;        // NSAP address.
+    NS_T_NSAP_PTR = 23;    // Reverse NSAP lookup (deprecated).
+    NS_T_SIG = 24;         // Security signature.
+    NS_T_KEY = 25;         // Security key.
+    NS_T_PX = 26;          // X.400 mail mapping.
+    NS_T_GPOS = 27;        // Geographical position (withdrawn).
+    NS_T_AAAA = 28;        // IPv6 Address.
+    NS_T_LOC = 29;         // Location Information.
+    NS_T_NXT = 30;         // Next domain (security).
+    NS_T_EID = 31;         // Endpoint identifier.
+    NS_T_NIMLOC = 32;      // Nimrod Locator.
+    NS_T_SRV = 33;         // Server Selection.
+    NS_T_ATMA = 34;        // ATM Address
+    NS_T_NAPTR = 35;       // Naming Authority PoinTeR
+    NS_T_KX = 36;          // Key Exchange
+    NS_T_CERT = 37;        // Certification record
+    NS_T_A6 = 38;          // IPv6 address (experimental)
+    NS_T_DNAME = 39;       // Non-terminal DNAME
+    NS_T_SINK = 40;        // Kitchen sink (experimentatl)
+    NS_T_OPT = 41;         // EDNS0 option (meta-RR)
+    NS_T_APL = 42;         // Address prefix list (RFC 3123)
+    NS_T_DS = 43;          // Delegation Signer
+    NS_T_SSHFP = 44;       // SSH Fingerprint
+    NS_T_IPSECKEY = 45;    // IPSEC Key
+    NS_T_RRSIG = 46;       // RRset Signature
+    NS_T_NSEC = 47;        // Negative security
+    NS_T_DNSKEY = 48;      // DNS Key
+    NS_T_DHCID = 49;       // Dynamic host configuratin identifier
+    NS_T_NSEC3 = 50;       // Negative security type 3
+    NS_T_NSEC3PARAM = 51;  // Negative security type 3 parameters
+    NS_T_HIP = 55;         // Host Identity Protocol
+    NS_T_SPF = 99;         // Sender Policy Framework
+    NS_T_TKEY = 249;       // Transaction key
+    NS_T_TSIG = 250;       // Transaction signature.
+    NS_T_IXFR = 251;       // Incremental zone transfer.
+    NS_T_AXFR = 252;       // Transfer zone of authority.
+    NS_T_MAILB = 253;      // Transfer mailbox records.
+    NS_T_MAILA = 254;      // Transfer mail agent records.
+    NS_T_ANY = 255;        // Wildcard match.
+    NS_T_ZXFR = 256;       // BIND-specific, nonstandard.
+    NS_T_DLV = 32769;      // DNSSEC look-aside validatation.
+    NS_T_MAX = 65536;
+}
+
+enum IpVersion {
+    IV_UNKNOWN = 0;
+    IV_IPV4 = 1;
+    IV_IPV6 = 2;
+}
+
+enum Protocol {
+    PROTO_UNKNOWN = 0;
+    PROTO_UDP = 1;
+    PROTO_TCP = 2;
+    PROTO_DOT = 3;
+}
+
+enum PrivateDnsModes {
+    PDM_UNKNOWN = 0;
+    PDM_OFF = 1;
+    PDM_OPPORTUNISTIC = 2;
+    PDM_STRICT = 3;
+}
+
+enum NetworkType {
+    NT_UNKNOWN = 0;
+    // Indicates this network uses a Cellular transport.
+    NT_CELLULAR = 1;
+    // Indicates this network uses a Wi-Fi transport.
+    NT_WIFI = 2;
+    // Indicates this network uses a Bluetooth transport.
+    NT_BLUETOOTH = 3;
+    // Indicates this network uses an Ethernet transport.
+    NT_ETHERNET = 4;
+    // Indicates this network uses a VPN transport.
+    NT_VPN = 5;
+    // Indicates this network uses a Wi-Fi Aware transport.
+    NT_WIFI_AWARE = 6;
+    // Indicates this network uses a LoWPAN transport.
+    NT_LOWPAN = 7;
+}
+
+enum CacheStatus{
+    // the cache can't handle that kind of queries.
+    // or the answer buffer is too small.
+    CS_UNSUPPORTED = 0;
+    // the cache doesn't know about this query.
+    CS_NOTFOUND = 1;
+    // the cache found the answer.
+    CS_FOUND = 2;
+    // Don't do anything on cache.
+    CS_SKIP = 3;
+}
+
+message DnsQueryEvent {
+    optional NsRcode rcode = 1;
+
+    optional NsType type = 2;
+
+    optional CacheStatus cache_hit = 3;
+
+    optional IpVersion ip_version = 4;
+
+    optional Protocol protocol = 5;
+
+    // Number of DNS query retry times
+    optional int32 retry_times = 6;
+
+    // Ordinal number of name server.
+    optional int32 dns_server_index = 7;
+
+    // Used only by TCP and DOT. True for new connections.
+    optional bool connected = 8;
+
+    optional int32 latency_micros = 9;
+}
+
+message DnsQueryEvents {
+    repeated DnsQueryEvent dns_query_event = 1;
+}
+
+/**
+ * Logs a DNS lookup operation initiated by the system resolver on behalf of an application
+ * invoking native APIs such as getaddrinfo() or Java APIs such as Network#getAllByName().
+ *
+ * The NetworkDnsEventReported message represents the entire lookup operation, which may
+ * result one or more queries to the recursive DNS resolvers. Those are individually logged
+ * in DnsQueryEvents to enable computing error rates and network latency and timeouts
+ * broken up by query type, transport, network interface, etc.
+ */
+message NetworkDnsEventReported {
+    optional EventType event_type = 1;
+
+    optional ReturnCode return_code = 2;
+
+    // The latency in microseconds of the entire DNS lookup operation.
+    optional int32 latency_micros = 3;
+
+    // Only valid for event_type = EVENT_GETADDRINFO.
+    optional int32 hints_ai_flags = 4;
+
+    // Flags passed to android_res_nsend() defined in multinetwork.h
+    // Only valid for event_type = EVENT_RESNSEND.
+    optional int32 res_nsend_flags = 5;
+
+    optional NetworkType network_type = 6;
+
+    // The DNS over TLS mode on a specific netId.
+    optional PrivateDnsModes private_dns_modes = 7;
+
+    // Additional pass-through fields opaque to statsd.
+    // The DNS resolver Mainline module can add new fields here without requiring an OS update.
+    optional DnsQueryEvents dns_query_events = 8;
+
+    // The sample rate of DNS stats (to statsd) is 1/sampling_rate_denom.
+    optional int32 sampling_rate_denom = 9;
+}
diff --git a/resolv/tests/BaseTestMetricsListener.cpp b/resolv/tests/BaseTestMetricsListener.cpp
new file mode 100644
index 0000000..414e383
--- /dev/null
+++ b/resolv/tests/BaseTestMetricsListener.cpp
@@ -0,0 +1,80 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "BaseTestMetricsListener.h"
+
+namespace android {
+namespace net {
+namespace metrics {
+
+void BaseTestMetricsListener::notify() {
+    std::lock_guard lock(mCvMutex);
+    mCv.notify_one();
+}
+
+void BaseTestMetricsListener::setVerified(EventFlag event) {
+    mVerified |= event;
+}
+
+android::binder::Status BaseTestMetricsListener::onDnsEvent(
+        int32_t /*netId*/, int32_t /*eventType*/, int32_t /*returnCode*/, int32_t /*latencyMs*/,
+        const std::string& /*hostname*/, const ::std::vector<std::string>& /*ipAddresses*/,
+        int32_t /*ipAddressesCount*/, int32_t /*uid*/) {
+    // default no-op
+    return android::binder::Status::ok();
+};
+
+android::binder::Status BaseTestMetricsListener::onPrivateDnsValidationEvent(
+        int32_t /*netId*/, const ::android::String16& /*ipAddress*/,
+        const ::android::String16& /*hostname*/, bool /*validated*/) {
+    // default no-op
+    return android::binder::Status::ok();
+};
+
+android::binder::Status BaseTestMetricsListener::onConnectEvent(
+        int32_t /*netId*/, int32_t /*error*/, int32_t /*latencyMs*/,
+        const ::android::String16& /*ipAddr*/, int32_t /*port*/, int32_t /*uid*/) {
+    // default no-op
+    return android::binder::Status::ok();
+};
+
+android::binder::Status BaseTestMetricsListener::onWakeupEvent(
+        const ::android::String16& /*prefix*/, int32_t /*uid*/, int32_t /*ethertype*/,
+        int32_t /*ipNextHeader*/, const ::std::vector<uint8_t>& /*dstHw*/,
+        const ::android::String16& /*srcIp*/, const ::android::String16& /*dstIp*/,
+        int32_t /*srcPort*/, int32_t /*dstPort*/, int64_t /*timestampNs*/) {
+    // default no-op
+    return android::binder::Status::ok();
+};
+
+android::binder::Status BaseTestMetricsListener::onTcpSocketStatsEvent(
+        const ::std::vector<int32_t>& /*networkIds*/, const ::std::vector<int32_t>& /*sentPackets*/,
+        const ::std::vector<int32_t>& /*lostPackets*/, const ::std::vector<int32_t>& /*rttUs*/,
+        const ::std::vector<int32_t>& /*sentAckDiffMs*/) {
+    // default no-op
+    return android::binder::Status::ok();
+};
+
+android::binder::Status BaseTestMetricsListener::onNat64PrefixEvent(
+        int32_t /*netId*/, bool /*added*/, const ::std::string& /*prefixString*/,
+        int32_t /*prefixLength*/) {
+    // default no-op
+    return android::binder::Status::ok();
+};
+
+}  // namespace metrics
+}  // namespace net
+}  // namespace android
\ No newline at end of file
diff --git a/resolv/tests/BaseTestMetricsListener.h b/resolv/tests/BaseTestMetricsListener.h
new file mode 100644
index 0000000..326647b
--- /dev/null
+++ b/resolv/tests/BaseTestMetricsListener.h
@@ -0,0 +1,104 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _BASE_TEST_METRICS_LISTENER_H_
+#define _BASE_TEST_METRICS_LISTENER_H_
+
+#include <string>
+#include <vector>
+
+#include <binder/BinderService.h>
+
+#include "android/net/metrics/BnNetdEventListener.h"
+
+enum EventFlag : uint32_t {
+    onDnsEvent = 1 << 0,
+    onPrivateDnsValidationEvent = 1 << 1,
+    onConnectEvent = 1 << 2,
+    onWakeupEvent = 1 << 3,
+    onTcpSocketStatsEvent = 1 << 4,
+    onNat64PrefixEvent = 1 << 5,
+};
+
+namespace android {
+namespace net {
+namespace metrics {
+
+class BaseTestMetricsListener : public BnNetdEventListener {
+  public:
+    BaseTestMetricsListener() = default;
+    ~BaseTestMetricsListener() = default;
+
+    // Returns TRUE if the verification was successful. Otherwise, returns FALSE.
+    virtual bool isVerified() = 0;
+
+    std::condition_variable& getCv() { return mCv; }
+    std::mutex& getCvMutex() { return mCvMutex; }
+
+    android::binder::Status onDnsEvent(int32_t /*netId*/, int32_t /*eventType*/,
+                                       int32_t /*returnCode*/, int32_t /*latencyMs*/,
+                                       const std::string& /*hostname*/,
+                                       const ::std::vector<std::string>& /*ipAddresses*/,
+                                       int32_t /*ipAddressesCount*/, int32_t /*uid*/) override;
+    android::binder::Status onPrivateDnsValidationEvent(int32_t /*netId*/,
+                                                        const ::android::String16& /*ipAddress*/,
+                                                        const ::android::String16& /*hostname*/,
+                                                        bool /*validated*/) override;
+    android::binder::Status onConnectEvent(int32_t /*netId*/, int32_t /*error*/,
+                                           int32_t /*latencyMs*/,
+                                           const ::android::String16& /*ipAddr*/, int32_t /*port*/,
+                                           int32_t /*uid*/) override;
+    android::binder::Status onWakeupEvent(const ::android::String16& /*prefix*/, int32_t /*uid*/,
+                                          int32_t /*ethertype*/, int32_t /*ipNextHeader*/,
+                                          const ::std::vector<uint8_t>& /*dstHw*/,
+                                          const ::android::String16& /*srcIp*/,
+                                          const ::android::String16& /*dstIp*/, int32_t /*srcPort*/,
+                                          int32_t /*dstPort*/, int64_t /*timestampNs*/) override;
+    android::binder::Status onTcpSocketStatsEvent(
+            const ::std::vector<int32_t>& /*networkIds*/,
+            const ::std::vector<int32_t>& /*sentPackets*/,
+            const ::std::vector<int32_t>& /*lostPackets*/, const ::std::vector<int32_t>& /*rttUs*/,
+            const ::std::vector<int32_t>& /*sentAckDiffMs*/) override;
+    android::binder::Status onNat64PrefixEvent(int32_t /*netId*/, bool /*added*/,
+                                               const ::std::string& /*prefixString*/,
+                                               int32_t /*prefixLength*/) override;
+
+  private:
+    // The verified event(s) as a bitwise-OR combination of enum EventFlag flags.
+    uint32_t mVerified{};
+
+    // This lock prevents racing condition between signaling thread(s) and waiting thread(s).
+    std::mutex mCvMutex;
+
+    // Condition variable signaled when notify() is called.
+    std::condition_variable mCv;
+
+  protected:
+    // Notify who is waiting for test results. See also mCvMutex and mCv.
+    void notify();
+
+    // Get current verified event(s).
+    uint32_t getVerified() const { return mVerified; }
+
+    // Set the specific event as verified if its verification was successful.
+    void setVerified(EventFlag event);
+};
+
+}  // namespace metrics
+}  // namespace net
+}  // namespace android
+
+#endif  // _BASE_TEST_METRICS_LISTENER_H_
diff --git a/resolv/tests/TestMetrics.cpp b/resolv/tests/TestMetrics.cpp
new file mode 100644
index 0000000..4c3d36a
--- /dev/null
+++ b/resolv/tests/TestMetrics.cpp
@@ -0,0 +1,74 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <netdb.h>
+
+#include "TestMetrics.h"
+
+namespace android {
+namespace net {
+namespace metrics {
+
+android::binder::Status TestOnDnsEvent::onDnsEvent(int32_t netId, int32_t eventType,
+                                                   int32_t returnCode, int32_t /*latencyMs*/,
+                                                   const std::string& hostname,
+                                                   const ::std::vector<std::string>& ipAddresses,
+                                                   int32_t ipAddressesCount, int32_t /*uid*/) {
+    // A bitwise-OR combination of all expected test cases.
+    // Currently, the maximum number of test case is 32 because a 32-bits bitwise-OR combination
+    // is used for checking and recording verified test cases.
+    static const uint32_t kExpectedTests = (1 << mResults.size()) - 1;
+
+    // A bitwise-OR combination for recording verified test cases.
+    static uint32_t verifiedTests = 0;
+
+    for (size_t i = 0; i < mResults.size(); ++i) {
+        // Generate bitwise flag to trace which testcase is running.
+        const uint32_t currentTestFlag = 1 << i;
+
+        // Ignore verified testcase.
+        if (verifiedTests & currentTestFlag) continue;
+
+        // Verify expected event content.
+        auto& result = mResults[i];
+        if (netId != result.netId) continue;
+        if (eventType != result.eventType) continue;
+        if (hostname != result.hostname) continue;
+        if (returnCode != result.returnCode) continue;
+        if (ipAddressesCount != result.ipAddressesCount) continue;
+        if (result.returnCode == 0 /*success*/) {
+            // Only verify first address.
+            // TODO: Check all addresses.
+            if (ipAddresses.empty() || ipAddresses.front() != result.ipAddress) continue;
+        }
+
+        // Record current testcase as verified.
+        verifiedTests |= currentTestFlag;
+        break;
+    }
+
+    // All testcases of onDnsEvent are verified. Notify who was waiting for test results.
+    if (verifiedTests == kExpectedTests) {
+        setVerified(EventFlag::onDnsEvent);
+        notify();
+    }
+
+    return android::binder::Status::ok();
+};
+
+}  // namespace metrics
+}  // namespace net
+}  // namespace android
\ No newline at end of file
diff --git a/resolv/tests/TestMetrics.h b/resolv/tests/TestMetrics.h
new file mode 100644
index 0000000..d3a4ad4
--- /dev/null
+++ b/resolv/tests/TestMetrics.h
@@ -0,0 +1,58 @@
+/**
+ * Copyright (c) 2019, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _TEST_METRICS_H_
+#define _TEST_METRICS_H_
+
+#include "BaseTestMetricsListener.h"
+
+namespace android {
+namespace net {
+namespace metrics {
+
+class TestOnDnsEvent : public BaseTestMetricsListener {
+  public:
+    // Both latencyMs and uid are not verified. No special reason.
+    struct TestResult {
+        int netId;
+        int eventType;
+        int returnCode;
+        int ipAddressesCount;
+        std::string hostname;
+        std::string ipAddress;  // Check first address only.
+    };
+
+    TestOnDnsEvent() = delete;
+    TestOnDnsEvent(const std::vector<TestResult>& results) : mResults(results){};
+
+    // BaseTestMetricsListener::isVerified() override.
+    bool isVerified() override { return (getVerified() & EventFlag::onDnsEvent) != 0; }
+
+    // Override for testing verification.
+    android::binder::Status onDnsEvent(int32_t netId, int32_t eventType, int32_t returnCode,
+                                       int32_t /*latencyMs*/, const std::string& hostname,
+                                       const std::vector<std::string>& ipAddresses,
+                                       int32_t ipAddressesCount, int32_t /*uid*/) override;
+
+  private:
+    const std::vector<TestResult>& mResults;  // Expected results for test verification.
+};
+
+}  // namespace metrics
+}  // namespace net
+}  // namespace android
+
+#endif  // _TEST_METRICS_H_
diff --git a/server/Android.bp b/server/Android.bp
index eba80bc..c7f2984 100644
--- a/server/Android.bp
+++ b/server/Android.bp
@@ -95,14 +95,15 @@
         "libbpf_android",
         "libbase",
         "libbinder",
+        "liblogwrap",
         "libnetdbpf",
         "libnetutils",
         "libnetdutils",
         "libpcap",
         "libqtaguid",
         "libssl",
-        "netd_aidl_interface-cpp",
-        "netd_event_listener_interface-cpp",
+        "netd_aidl_interface-V2-cpp",
+        "netd_event_listener_interface-V1-cpp",
     ],
     header_libs: [
         "libnetd_resolv_headers",
@@ -130,8 +131,10 @@
         "libcutils",
         "libdl",
         "libhidlbase",
+        "libhidltransport",
         "libjsoncpp",
         "liblog",
+        "liblogwrap",
         "libmdnssd",
         "libnetdbpf",
         "libnetdutils",
@@ -142,8 +145,8 @@
         "libselinux",
         "libsysutils",
         "libutils",
-        "netd_aidl_interface-unstable-cpp",
-        "netd_event_listener_interface-cpp",
+        "netd_aidl_interface-V2-cpp",
+        "netd_event_listener_interface-V1-cpp",
         "oemnetd_aidl_interface-cpp",
     ],
     static_libs: [
@@ -192,8 +195,8 @@
         "liblog",
         "libutils",
         "libbinder",
-        "dnsresolver_aidl_interface-cpp",
-        "netd_aidl_interface-cpp",
+        "dnsresolver_aidl_interface-V2-cpp",
+        "netd_aidl_interface-V2-cpp",
     ],
     srcs: [
         "ndc.cpp",
@@ -211,6 +214,7 @@
         "system/netd/include",
         "system/netd/server/binder",
         "system/netd/tests",
+        "system/core/logwrapper/include",
     ],
     srcs: [
         "BandwidthControllerTest.cpp",
@@ -235,9 +239,6 @@
         "libgmock",
         "libnetd_server",
         "libnetd_test_tun_interface",
-        "libqtaguid",
-        "netd_aidl_interface-cpp",
-        "netd_event_listener_interface-cpp",
     ],
     shared_libs: [
         "libbase",
@@ -249,7 +250,10 @@
         "libnetdbpf",
         "libnetdutils",
         "libnetutils",
+        "libqtaguid",
         "libsysutils",
         "libutils",
+        "netd_aidl_interface-V2-cpp",
+        "netd_event_listener_interface-V1-cpp",
     ],
 }
diff --git a/server/AndroidTest.xml b/server/AndroidTest.xml
new file mode 100644
index 0000000..2501d78
--- /dev/null
+++ b/server/AndroidTest.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for netd_unit_test">
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="netd_unit_test->/data/local/tmp/netd_unit_test" />
+    </target_preparer>
+    <option name="test-suite-tag" value="apct" />
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="netd_unit_test" />
+    </test>
+</configuration>
diff --git a/server/BandwidthController.cpp b/server/BandwidthController.cpp
index 3efc8a3..7e9bff7 100644
--- a/server/BandwidthController.cpp
+++ b/server/BandwidthController.cpp
@@ -48,6 +48,7 @@
 #define LOG_TAG "BandwidthController"
 #include <cutils/properties.h>
 #include <log/log.h>
+#include <logwrap/logwrap.h>
 
 #include <netdutils/Syscalls.h>
 #include "BandwidthController.h"
diff --git a/server/ClatdController.cpp b/server/ClatdController.cpp
index cf0ab96..5a5566b 100644
--- a/server/ClatdController.cpp
+++ b/server/ClatdController.cpp
@@ -33,7 +33,6 @@
 #include <log/log.h>
 
 #include "ClatdController.h"
-#include "InterfaceController.h"
 
 #include "android-base/properties.h"
 #include "android-base/scopeguard.h"
@@ -140,11 +139,7 @@
 
     // Attempt to connect to the address. If the connection succeeds and getsockname returns the
     // same then the address is already assigned to the system and we can't use it.
-    struct sockaddr_in sin = {
-            .sin_family = AF_INET,
-            .sin_port = htons(53),
-            .sin_addr = {addr},
-    };
+    struct sockaddr_in sin = {.sin_family = AF_INET, .sin_addr = {addr}, .sin_port = 53};
     socklen_t len = sizeof(sin);
     bool inuse = connect(s, (struct sockaddr*)&sin, sizeof(sin)) == 0 &&
                  getsockname(s, (struct sockaddr*)&sin, &len) == 0 && (size_t)len >= sizeof(sin) &&
@@ -457,10 +452,6 @@
         return -res;
     }
 
-    // disable IPv6 on it - failing to do so is not a critical error
-    res = InterfaceController::setEnableIPv6(v4interface.c_str(), 0);
-    if (res) ALOGE("setEnableIPv6 %s failed (%s)", v4interface.c_str(), strerror(res));
-
     // 5. initialize tracker object
     ClatdTracker tracker;
     int ret = tracker.init(networkId, interface, v4interface, nat64Prefix);
diff --git a/server/Controllers.cpp b/server/Controllers.cpp
index f844544..c941a80 100644
--- a/server/Controllers.cpp
+++ b/server/Controllers.cpp
@@ -14,7 +14,6 @@
  * limitations under the License.
  */
 
-#include <cinttypes>
 #include <regex>
 #include <set>
 #include <string>
@@ -240,39 +239,39 @@
 void Controllers::initIptablesRules() {
     Stopwatch s;
     initChildChains();
-    gLog.info("Creating child chains: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Creating child chains: %.1fms", s.getTimeAndReset());
 
     // Let each module setup their child chains
     setupOemIptablesHook();
-    gLog.info("Setting up OEM hooks: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Setting up OEM hooks: %.1fms", s.getTimeAndReset());
 
     /* When enabled, DROPs all packets except those matching rules. */
     firewallCtrl.setupIptablesHooks();
-    gLog.info("Setting up FirewallController hooks: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Setting up FirewallController hooks: %.1fms", s.getTimeAndReset());
 
     /* Does DROPs in FORWARD by default */
     tetherCtrl.setupIptablesHooks();
-    gLog.info("Setting up TetherController hooks: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Setting up TetherController hooks: %.1fms", s.getTimeAndReset());
 
     /*
      * Does REJECT in INPUT, OUTPUT. Does counting also.
      * No DROP/REJECT allowed later in netfilter-flow hook order.
      */
     bandwidthCtrl.setupIptablesHooks();
-    gLog.info("Setting up BandwidthController hooks: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Setting up BandwidthController hooks: %.1fms", s.getTimeAndReset());
 
     /*
      * Counts in nat: PREROUTING, POSTROUTING.
      * No DROP/REJECT allowed later in netfilter-flow hook order.
      */
     idletimerCtrl.setupIptablesHooks();
-    gLog.info("Setting up IdletimerController hooks: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Setting up IdletimerController hooks: %.1fms", s.getTimeAndReset());
 
     /*
      * Add rules for detecting IPv6/IPv4 TCP/UDP connections with TLS/DTLS header
      */
     strictCtrl.setupIptablesHooks();
-    gLog.info("Setting up StrictController hooks: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Setting up StrictController hooks: %.1fms", s.getTimeAndReset());
 }
 
 void Controllers::init() {
@@ -280,28 +279,28 @@
     Stopwatch s;
 
     clatdCtrl.init();
-    gLog.info("Initializing ClatdController: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Initializing ClatdController: %.1fms", s.getTimeAndReset());
 
     netdutils::Status tcStatus = trafficCtrl.start();
     if (!isOk(tcStatus)) {
         gLog.error("Failed to start trafficcontroller: (%s)", toString(tcStatus).c_str());
     }
-    gLog.info("Initializing traffic control: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Initializing traffic control: %.1fms", s.getTimeAndReset());
 
     bandwidthCtrl.setBpfEnabled(trafficCtrl.getBpfLevel() != android::bpf::BpfLevel::NONE);
     bandwidthCtrl.enableBandwidthControl();
-    gLog.info("Enabling bandwidth control: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Enabling bandwidth control: %.1fms", s.getTimeAndReset());
 
     if (int ret = RouteController::Init(NetworkController::LOCAL_NET_ID)) {
         gLog.error("Failed to initialize RouteController (%s)", strerror(-ret));
     }
-    gLog.info("Initializing RouteController: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Initializing RouteController: %.1fms", s.getTimeAndReset());
 
     netdutils::Status xStatus = XfrmController::Init();
     if (!isOk(xStatus)) {
         gLog.error("Failed to initialize XfrmController (%s)", netdutils::toString(xStatus).c_str());
     };
-    gLog.info("Initializing XfrmController: %" PRId64 "us", s.getTimeAndResetUs());
+    gLog.info("Initializing XfrmController: %.1fms", s.getTimeAndReset());
 }
 
 Controllers* gCtls = nullptr;
diff --git a/server/DummyNetwork.h b/server/DummyNetwork.h
index 5823ce5..32584aa 100644
--- a/server/DummyNetwork.h
+++ b/server/DummyNetwork.h
@@ -14,22 +14,27 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_DUMMY_NETWORK_H
+#define NETD_SERVER_DUMMY_NETWORK_H
 
 #include "Network.h"
 
-namespace android::net {
+namespace android {
+namespace net {
 
 class DummyNetwork : public Network {
-  public:
+public:
     static const char* INTERFACE_NAME;
     explicit DummyNetwork(unsigned netId);
     virtual ~DummyNetwork();
 
-  private:
+private:
     Type getType() const override;
-    [[nodiscard]] int addInterface(const std::string& interface) override;
-    [[nodiscard]] int removeInterface(const std::string& interface) override;
+    int addInterface(const std::string& interface) override WARN_UNUSED_RESULT;
+    int removeInterface(const std::string& interface) override WARN_UNUSED_RESULT;
 };
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_DUMMY_NETWORK_H
diff --git a/server/IdletimerController.cpp b/server/IdletimerController.cpp
index 103e7cd..acb8c6a 100644
--- a/server/IdletimerController.cpp
+++ b/server/IdletimerController.cpp
@@ -115,6 +115,7 @@
 
 #define LOG_TAG "IdletimerController"
 #include <log/log.h>
+#include <logwrap/logwrap.h>
 
 #include "IdletimerController.h"
 #include "NetdConstants.h"
diff --git a/server/InterfaceController.cpp b/server/InterfaceController.cpp
index 7504fb9..bad4ba2 100644
--- a/server/InterfaceController.cpp
+++ b/server/InterfaceController.cpp
@@ -30,6 +30,7 @@
 #include <android-base/strings.h>
 #include <linux/if_ether.h>
 #include <log/log.h>
+#include <logwrap/logwrap.h>
 #include <netutils/ifc.h>
 
 #include <android/net/INetd.h>
@@ -55,6 +56,13 @@
 using android::netdutils::toString;
 using android::netdutils::status::ok;
 
+#define RETURN_STATUS_IF_IFCERROR(exp)                           \
+    do {                                                         \
+        if ((exp) == -1) {                                       \
+            return statusFromErrno(errno, "Failed to add addr"); \
+        }                                                        \
+    } while (0);
+
 namespace {
 
 const char ipv4_proc_path[] = "/proc/sys/net/ipv4/conf";
@@ -282,9 +290,9 @@
 
     switch (mode) {
         case INetd::IPV6_ADDR_GEN_MODE_EUI64:
-            // Ignore return value. If /proc/.../addr_gen_mode is
+            // Ignore return value. If /proc/.../stable_secret is
             // missing we're probably in EUI64 mode already.
-            writeValueToPath(ipv6_proc_path, interface.c_str(), "addr_gen_mode", "0");
+            writeValueToPath(ipv6_proc_path, interface.c_str(), "stable_secret", "");
             break;
         case INetd::IPV6_ADDR_GEN_MODE_STABLE_PRIVACY: {
             return enableStablePrivacyAddresses(interface, getProperty, setProperty);
@@ -360,13 +368,11 @@
     return writeValueToPath(sys_net_path, interface, "mtu", mtu);
 }
 
-// Returns zero on success and negative errno on failure.
 int InterfaceController::addAddress(const char *interface,
         const char *addrString, int prefixLength) {
     return ifc_add_address(interface, addrString, prefixLength);
 }
 
-// Returns zero on success and negative errno on failure.
 int InterfaceController::delAddress(const char *interface,
         const char *addrString, int prefixLength) {
     return ifc_del_address(interface, addrString, prefixLength);
@@ -499,9 +505,8 @@
         }
     }
 
-    if (int ret = ifc_add_address(cfg.ifName.c_str(), cfg.ipv4Addr.c_str(), cfg.prefixLength)) {
-        return statusFromErrno(-ret, "Failed to add addr");
-    }
+    RETURN_STATUS_IF_IFCERROR(
+            ifc_add_address(cfg.ifName.c_str(), cfg.ipv4Addr.c_str(), cfg.prefixLength));
 
     return ok;
 }
diff --git a/server/IptablesRestoreControllerTest.cpp b/server/IptablesRestoreControllerTest.cpp
index 20f6183..d01d7ce 100644
--- a/server/IptablesRestoreControllerTest.cpp
+++ b/server/IptablesRestoreControllerTest.cpp
@@ -14,16 +14,14 @@
  * limitations under the License.
  */
 
+#include <string>
 #include <fcntl.h>
-#include <gmock/gmock.h>
-#include <gtest/gtest.h>
 #include <sys/file.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 
-#include <cinttypes>
-#include <iostream>
-#include <string>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
 
 #define LOG_TAG "IptablesRestoreControllerTest"
 #include <android-base/stringprintf.h>
@@ -55,7 +53,9 @@
   int mIptablesLock = -1;
   std::string mChainName;
 
-  static void SetUpTestSuite() { blockSigpipe(); }
+  static void SetUpTestCase() {
+      blockSigpipe();
+  }
 
   void SetUp() {
     ASSERT_EQ(0, createTestChain());
@@ -269,9 +269,9 @@
             EXPECT_EQ(0, con.execute(V4V6, IPTABLES_RESTORE_ADD, nullptr));
             EXPECT_EQ(0, con.execute(V4V6, IPTABLES_RESTORE_DEL, nullptr));
         }
-        int64_t timeTaken = s.getTimeAndResetUs();
-        std::cerr << "    Add/del " << iterations << " UID rules via restore: " << timeTaken
-                  << "us (" << (timeTaken / 2 / iterations) << "us per operation)" << std::endl;
+        float timeTaken = s.getTimeAndReset();
+        fprintf(stderr, "    Add/del %d UID rules via restore: %.1fms (%.2fms per operation)\n",
+                iterations, timeTaken, timeTaken / 2 / iterations);
     }
 }
 
diff --git a/server/LocalNetwork.h b/server/LocalNetwork.h
index 7a39a9d..2aa7900 100644
--- a/server/LocalNetwork.h
+++ b/server/LocalNetwork.h
@@ -14,11 +14,13 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_LOCAL_NETWORK_H
+#define NETD_SERVER_LOCAL_NETWORK_H
 
 #include "Network.h"
 
-namespace android::net {
+namespace android {
+namespace net {
 
 class LocalNetwork : public Network {
 public:
@@ -27,8 +29,11 @@
 
 private:
     Type getType() const override;
-    [[nodiscard]] int addInterface(const std::string& interface) override;
-    [[nodiscard]] int removeInterface(const std::string& interface) override;
+    int addInterface(const std::string& interface) override WARN_UNUSED_RESULT;
+    int removeInterface(const std::string& interface) override WARN_UNUSED_RESULT;
 };
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_LOCAL_NETWORK_H
diff --git a/server/MDnsSdListener.h b/server/MDnsSdListener.h
index 83cf23e..47ddc28 100644
--- a/server/MDnsSdListener.h
+++ b/server/MDnsSdListener.h
@@ -21,7 +21,6 @@
 #include <dns_sd.h>
 #include <sysutils/FrameworkListener.h>
 #include <mutex>
-#include <string>
 
 #include "NetdCommand.h"
 
@@ -80,7 +79,6 @@
         int stopService();
         void run();
         void deallocateServiceRef(DNSServiceRef* ref);
-        std::string threadName() { return std::string("MDnsSdMonitor"); }
 
       private:
         int rescan(); // returns the number of elements in the poll
diff --git a/server/NetdConstants.cpp b/server/NetdConstants.cpp
index 80282b3..40f78f6 100644
--- a/server/NetdConstants.cpp
+++ b/server/NetdConstants.cpp
@@ -29,6 +29,7 @@
 #include <android-base/stringprintf.h>
 #include <cutils/sockets.h>
 #include <log/log.h>
+#include <logwrap/logwrap.h>
 
 #include "Controllers.h"
 #include "NetdConstants.h"
diff --git a/server/NetdConstants.h b/server/NetdConstants.h
index c273e1b..97e75bd 100644
--- a/server/NetdConstants.h
+++ b/server/NetdConstants.h
@@ -14,7 +14,8 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef _NETD_CONSTANTS_H
+#define _NETD_CONSTANTS_H
 
 #include <ifaddrs.h>
 #include <netdb.h>
@@ -27,6 +28,9 @@
 #include <netdutils/UidConstants.h>
 #include <private/android_filesystem_config.h>
 
+// Referred from SHA256_DIGEST_LENGTH in boringssl
+constexpr size_t SHA256_SIZE = 32;
+
 enum IptablesTarget { V4, V6, V4V6 };
 
 int execIptablesRestore(IptablesTarget target, const std::string& commands);
@@ -49,11 +53,24 @@
 #define UINT32_HEX_STRLEN sizeof("0x12345678")
 #define IPSEC_IFACE_PREFIX "ipsec"
 
+#define WARN_UNUSED_RESULT __attribute__((__warn_unused_result__))
+
 const uid_t INVALID_UID = static_cast<uid_t>(-1);
 
 constexpr char TCP_RMEM_PROC_FILE[] = "/proc/sys/net/ipv4/tcp_rmem";
 constexpr char TCP_WMEM_PROC_FILE[] = "/proc/sys/net/ipv4/tcp_wmem";
 
+struct AddrinfoDeleter {
+    void operator()(struct addrinfo* p) const {
+        if (p != nullptr) {
+            freeaddrinfo(p);
+        }
+    }
+};
+
+typedef std::unique_ptr<struct addrinfo, struct AddrinfoDeleter> ScopedAddrinfo;
+
+
 struct IfaddrsDeleter {
     void operator()(struct ifaddrs *p) const {
         if (p != nullptr) {
@@ -64,7 +81,8 @@
 
 typedef std::unique_ptr<struct ifaddrs, struct IfaddrsDeleter> ScopedIfaddrs;
 
-namespace android::net {
+namespace android {
+namespace net {
 
 /**
  * This lock exists to make NetdNativeService RPCs (which come in on multiple Binder threads)
@@ -74,4 +92,7 @@
  */
 extern std::mutex gBigNetdLock;
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // _NETD_CONSTANTS_H
diff --git a/server/NetdNativeService.cpp b/server/NetdNativeService.cpp
index 9aec5e2..65d4727 100644
--- a/server/NetdNativeService.cpp
+++ b/server/NetdNativeService.cpp
@@ -30,6 +30,8 @@
 #include <binder/IServiceManager.h>
 #include <binder/Status.h>
 #include <cutils/properties.h>
+#include <json/value.h>
+#include <json/writer.h>
 #include <log/log.h>
 #include <netdutils/DumpWriter.h>
 #include <utils/Errors.h>
@@ -38,6 +40,7 @@
 #include "BinderUtil.h"
 #include "Controllers.h"
 #include "InterfaceController.h"
+#include "NetdConstants.h"  // SHA256_SIZE
 #include "NetdNativeService.h"
 #include "NetdPermissions.h"
 #include "OemNetdListener.h"
@@ -905,16 +908,11 @@
 }
 
 binder::Status NetdNativeService::tetherStart(const std::vector<std::string>& dhcpRanges) {
-    return tetherStartWithConfiguration(true, dhcpRanges);
-}
-
-binder::Status NetdNativeService::tetherStartWithConfiguration(
-        bool usingLegacyDnsProxy, const std::vector<std::string>& dhcpRanges) {
     NETD_LOCKING_RPC(gCtls->tetherCtrl.lock, PERM_NETWORK_STACK, PERM_MAINLINE_NETWORK_STACK);
     if (dhcpRanges.size() % 2 == 1) {
         return statusFromErrcode(-EINVAL);
     }
-    int res = gCtls->tetherCtrl.startTethering(usingLegacyDnsProxy, dhcpRanges);
+    int res = gCtls->tetherCtrl.startTethering(dhcpRanges);
     return statusFromErrcode(res);
 }
 
diff --git a/server/NetdNativeService.h b/server/NetdNativeService.h
index 8f9c40f..68c9886 100644
--- a/server/NetdNativeService.h
+++ b/server/NetdNativeService.h
@@ -121,8 +121,6 @@
     binder::Status tetherGetStats(
             std::vector<android::net::TetherStatsParcel>* tetherStatsVec) override;
     binder::Status tetherStart(const std::vector<std::string>& dhcpRanges) override;
-    binder::Status tetherStartWithConfiguration(
-            bool usingLegacyDnsProxy, const std::vector<std::string>& dhcpRanges) override;
     binder::Status tetherStop() override;
     binder::Status tetherIsEnabled(bool* enabled) override;
     binder::Status tetherInterfaceAdd(const std::string& ifName) override;
diff --git a/server/NetlinkCommands.cpp b/server/NetlinkCommands.cpp
index acefa8e..7af33fe 100644
--- a/server/NetlinkCommands.cpp
+++ b/server/NetlinkCommands.cpp
@@ -65,25 +65,17 @@
     return response.err.error;  // Netlink errors are negative errno.
 }
 
-// Disable optimizations in ASan build.
-// ASan reports an out-of-bounds 32-bit(!) access in the first loop of the function (over iov[]).
-// TODO: verify if this bug is still present.
-#ifdef __clang__
-#if __has_feature(address_sanitizer)
-#define OPTNONE [[clang::optnone]]
-#endif
-#endif
-
-#ifndef OPTNONE
-#define OPTNONE /* nop */
-#endif
-
 // Sends a netlink request and possibly expects an ack.
 // |iov| is an array of struct iovec that contains the netlink message payload.
 // The netlink header is generated by this function based on |action| and |flags|.
 // Returns -errno if there was an error or if the kernel reported an error.
-OPTNONE int sendNetlinkRequest(uint16_t action, uint16_t flags, iovec* iov, int iovlen,
-                               const NetlinkDumpCallback* callback) {
+#ifdef __clang__
+#if __has_feature(address_sanitizer)
+__attribute__((optnone))
+#endif
+#endif
+WARN_UNUSED_RESULT int sendNetlinkRequest(uint16_t action, uint16_t flags, iovec* iov, int iovlen,
+                                          const NetlinkDumpCallback *callback) {
     nlmsghdr nlmsg = {
         .nlmsg_type = action,
         .nlmsg_flags = flags,
@@ -154,8 +146,8 @@
     return 0;
 }
 
-int rtNetlinkFlush(uint16_t getAction, uint16_t deleteAction, const char* what,
-                   const NetlinkDumpFilter& shouldDelete) {
+WARN_UNUSED_RESULT int rtNetlinkFlush(uint16_t getAction, uint16_t deleteAction,
+                                     const char *what, const NetlinkDumpFilter& shouldDelete) {
     // RTM_GETxxx is always RTM_DELxxx + 1, see <linux/rtnetlink.h>.
     if (getAction != deleteAction + 1) {
         ALOGE("Unknown flush type getAction=%d deleteAction=%d", getAction, deleteAction);
@@ -209,7 +201,7 @@
     return ret;
 }
 
-uint32_t getRtmU32Attribute(const nlmsghdr* nlh, int attribute) {
+uint32_t getRtmU32Attribute(const nlmsghdr *nlh, int attribute) {
     uint32_t rta_len = RTM_PAYLOAD(nlh);
     rtmsg *msg = reinterpret_cast<rtmsg *>(NLMSG_DATA(nlh));
     rtattr *rta = reinterpret_cast<rtattr *> RTM_RTA(msg);
diff --git a/server/NetlinkCommands.h b/server/NetlinkCommands.h
index c07194d..ef1ff48 100644
--- a/server/NetlinkCommands.h
+++ b/server/NetlinkCommands.h
@@ -14,7 +14,8 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_NETLINK_UTIL_H
+#define NETD_SERVER_NETLINK_UTIL_H
 
 #include <functional>
 #include <linux/netlink.h>
@@ -22,7 +23,8 @@
 
 #include "NetdConstants.h"
 
-namespace android::net {
+namespace android {
+namespace net {
 
 const sockaddr_nl KERNEL_NLADDR = {AF_NETLINK, 0, 0, 0};
 
@@ -42,29 +44,41 @@
 typedef std::function<bool(nlmsghdr *)> NetlinkDumpFilter;
 
 // Opens an RTNetlink socket and connects it to the kernel.
-[[nodiscard]] int openNetlinkSocket(int protocol);
+WARN_UNUSED_RESULT int openNetlinkSocket(int protocol);
 
 // Receives a netlink ACK. Returns 0 if the command succeeded or negative errno if the command
 // failed or receiving the ACK failed.
-[[nodiscard]] int recvNetlinkAck(int sock);
+WARN_UNUSED_RESULT int recvNetlinkAck(int sock);
 
 // Sends a netlink request and possibly expects an ACK. The first element of iov should be null and
 // will be set to the netlink message headerheader. The subsequent elements are the contents of the
 // request.
-[[nodiscard]] int sendNetlinkRequest(uint16_t action, uint16_t flags, iovec* iov, int iovlen,
-                                     const NetlinkDumpCallback* callback);
+
+// Disable optimizations in ASan build.
+// ASan reports an out-of-bounds 32-bit(!) access in the first loop of the
+// function (over iov[]).
+#ifdef __clang__
+#if __has_feature(address_sanitizer)
+__attribute__((optnone))
+#endif
+#endif
+WARN_UNUSED_RESULT int sendNetlinkRequest(uint16_t action, uint16_t flags, iovec* iov, int iovlen,
+                                          const NetlinkDumpCallback *callback);
 
 // Processes a netlink dump, passing every message to the specified |callback|.
-[[nodiscard]] int processNetlinkDump(int sock, const NetlinkDumpCallback& callback);
+WARN_UNUSED_RESULT int processNetlinkDump(int sock, const NetlinkDumpCallback& callback);
 
 // Flushes netlink objects that take an rtmsg structure (FIB rules, routes...). |getAction| and
 // |deleteAction| specify the netlink message types, e.g., RTM_GETRULE and RTM_DELRULE.
 // |shouldDelete| specifies whether a given object should be deleted or not. |what| is a
 // human-readable name for the objects being flushed, e.g. "rules".
-[[nodiscard]] int rtNetlinkFlush(uint16_t getAction, uint16_t deleteAction, const char* what,
-                                 const NetlinkDumpFilter& shouldDelete);
+WARN_UNUSED_RESULT int rtNetlinkFlush(uint16_t getAction, uint16_t deleteAction,
+                                      const char *what, const NetlinkDumpFilter& shouldDelete);
 
 // Returns the value of the specific __u32 attribute, or 0 if the attribute was not present.
 uint32_t getRtmU32Attribute(const nlmsghdr *nlh, int attribute);
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_NETLINK_UTIL_H
diff --git a/server/Network.h b/server/Network.h
index 8417f34..69af3ff 100644
--- a/server/Network.h
+++ b/server/Network.h
@@ -14,14 +14,16 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_NETWORK_H
+#define NETD_SERVER_NETWORK_H
 
 #include "NetdConstants.h"
 
 #include <set>
 #include <string>
 
-namespace android::net {
+namespace android {
+namespace net {
 
 // A Network represents a collection of interfaces participating as a single administrative unit.
 class Network {
@@ -45,9 +47,9 @@
     const std::set<std::string>& getInterfaces() const;
 
     // These return 0 on success or negative errno on failure.
-    [[nodiscard]] virtual int addInterface(const std::string& interface) = 0;
-    [[nodiscard]] virtual int removeInterface(const std::string& interface) = 0;
-    [[nodiscard]] int clearInterfaces();
+    virtual int addInterface(const std::string& interface) WARN_UNUSED_RESULT = 0;
+    virtual int removeInterface(const std::string& interface) WARN_UNUSED_RESULT = 0;
+    int clearInterfaces() WARN_UNUSED_RESULT;
 
     std::string toString() const;
 
@@ -58,4 +60,7 @@
     std::set<std::string> mInterfaces;
 };
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_NETWORK_H
diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp
index e490a9f..1e4894f 100644
--- a/server/NetworkController.cpp
+++ b/server/NetworkController.cpp
@@ -47,7 +47,8 @@
 
 using android::netdutils::DumpWriter;
 
-namespace android::net {
+namespace android {
+namespace net {
 
 namespace {
 
@@ -66,21 +67,21 @@
 // setPermissionForNetworks).
 // TODO: use std::mutex and GUARDED_BY instead of manual inspection.
 class NetworkController::DelegateImpl : public PhysicalNetwork::Delegate {
-  public:
+public:
     explicit DelegateImpl(NetworkController* networkController);
     virtual ~DelegateImpl();
 
-    [[nodiscard]] int modifyFallthrough(unsigned vpnNetId, const std::string& physicalInterface,
-                                        Permission permission, bool add);
+    int modifyFallthrough(unsigned vpnNetId, const std::string& physicalInterface,
+                          Permission permission, bool add) WARN_UNUSED_RESULT;
 
-  private:
-    [[nodiscard]] int addFallthrough(const std::string& physicalInterface,
-                                     Permission permission) override;
-    [[nodiscard]] int removeFallthrough(const std::string& physicalInterface,
-                                        Permission permission) override;
+private:
+    int addFallthrough(const std::string& physicalInterface,
+                       Permission permission) override WARN_UNUSED_RESULT;
+    int removeFallthrough(const std::string& physicalInterface,
+                          Permission permission) override WARN_UNUSED_RESULT;
 
-    [[nodiscard]] int modifyFallthrough(const std::string& physicalInterface, Permission permission,
-                                        bool add);
+    int modifyFallthrough(const std::string& physicalInterface, Permission permission,
+                          bool add) WARN_UNUSED_RESULT;
 
     NetworkController* const mNetworkController;
 };
@@ -235,6 +236,11 @@
     return fwmark.intValue;
 }
 
+uint32_t NetworkController::getNetworkForDns(unsigned* netId, uid_t uid) const {
+    ScopedRLock lock(mRWLock);
+    return getNetworkForDnsLocked(netId, uid);
+}
+
 // Returns the NetId that a given UID would use if no network is explicitly selected. Specifically,
 // the VPN that applies to the UID if any; otherwise, the default network.
 unsigned NetworkController::getNetworkForUser(uid_t uid) const {
@@ -844,4 +850,5 @@
     }
 }
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
diff --git a/server/NetworkController.h b/server/NetworkController.h
index e0abde0..4a363b3 100644
--- a/server/NetworkController.h
+++ b/server/NetworkController.h
@@ -14,7 +14,8 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_NETWORK_CONTROLLER_H
+#define NETD_SERVER_NETWORK_CONTROLLER_H
 
 #include <android-base/thread_annotations.h>
 #include <android/multinetwork.h>
@@ -36,7 +37,8 @@
 
 struct android_net_context;
 
-namespace android::net {
+namespace android {
+namespace net {
 
 typedef std::shared_lock<std::shared_mutex> ScopedRLock;
 typedef std::lock_guard<std::shared_mutex> ScopedWLock;
@@ -91,40 +93,44 @@
     NetworkController();
 
     unsigned getDefaultNetwork() const;
-    [[nodiscard]] int setDefaultNetwork(unsigned netId);
+    int setDefaultNetwork(unsigned netId) WARN_UNUSED_RESULT;
 
+    // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId|
+    // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the
+    // fwmark value to set on the socket when performing the DNS request.
+    uint32_t getNetworkForDns(unsigned* netId, uid_t uid) const;
     unsigned getNetworkForUser(uid_t uid) const;
     unsigned getNetworkForConnect(uid_t uid) const;
     void getNetworkContext(unsigned netId, uid_t uid, struct android_net_context* netcontext) const;
     unsigned getNetworkForInterface(const char* interface) const;
     bool isVirtualNetwork(unsigned netId) const;
 
-    [[nodiscard]] int createPhysicalNetwork(unsigned netId, Permission permission);
-    [[nodiscard]] int createPhysicalOemNetwork(Permission permission, unsigned* netId);
-    [[nodiscard]] int createVirtualNetwork(unsigned netId, bool secure);
-    [[nodiscard]] int destroyNetwork(unsigned netId);
+    int createPhysicalNetwork(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
+    int createPhysicalOemNetwork(Permission permission, unsigned *netId) WARN_UNUSED_RESULT;
+    int createVirtualNetwork(unsigned netId, bool secure) WARN_UNUSED_RESULT;
+    int destroyNetwork(unsigned netId) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] int addInterfaceToNetwork(unsigned netId, const char* interface);
-    [[nodiscard]] int removeInterfaceFromNetwork(unsigned netId, const char* interface);
+    int addInterfaceToNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
+    int removeInterfaceFromNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
 
     Permission getPermissionForUser(uid_t uid) const;
     void setPermissionForUsers(Permission permission, const std::vector<uid_t>& uids);
     int checkUserNetworkAccess(uid_t uid, unsigned netId) const;
-    [[nodiscard]] int setPermissionForNetworks(Permission permission,
-                                               const std::vector<unsigned>& netIds);
+    int setPermissionForNetworks(Permission permission,
+                                 const std::vector<unsigned>& netIds) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges);
-    [[nodiscard]] int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges);
+    int addUsersToNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
+    int removeUsersFromNetwork(unsigned netId, const UidRanges& uidRanges) WARN_UNUSED_RESULT;
 
     // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
     // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
     //
     // Routes are added to tables determined by the interface, so only |interface| is actually used.
     // |netId| is given only to sanity check that the interface has the correct netId.
-    [[nodiscard]] int addRoute(unsigned netId, const char* interface, const char* destination,
-                               const char* nexthop, bool legacy, uid_t uid);
-    [[nodiscard]] int removeRoute(unsigned netId, const char* interface, const char* destination,
-                                  const char* nexthop, bool legacy, uid_t uid);
+    int addRoute(unsigned netId, const char* interface, const char* destination,
+                 const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
+    int removeRoute(unsigned netId, const char* interface, const char* destination,
+                    const char* nexthop, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
 
     // Notes that the specified address has appeared on the specified interface.
     void addInterfaceAddress(unsigned ifIndex, const char* address);
@@ -141,12 +147,7 @@
   private:
     bool isValidNetworkLocked(unsigned netId) const;
     Network* getNetworkLocked(unsigned netId) const;
-
-    // Sets |*netId| to an appropriate NetId to use for DNS for the given user. Call with |*netId|
-    // set to a non-NETID_UNSET value if the user already has indicated a preference. Returns the
-    // fwmark value to set on the socket when performing the DNS request.
     uint32_t getNetworkForDnsLocked(unsigned* netId, uid_t uid) const;
-
     unsigned getNetworkForUserLocked(uid_t uid) const;
     unsigned getNetworkForConnectLocked(uid_t uid) const;
     unsigned getNetworkForInterfaceLocked(const char* interface) const;
@@ -155,11 +156,11 @@
     VirtualNetwork* getVirtualNetworkForUserLocked(uid_t uid) const;
     Permission getPermissionForUserLocked(uid_t uid) const;
     int checkUserNetworkAccessLocked(uid_t uid, unsigned netId) const;
-    [[nodiscard]] int createPhysicalNetworkLocked(unsigned netId, Permission permission);
+    int createPhysicalNetworkLocked(unsigned netId, Permission permission) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] int modifyRoute(unsigned netId, const char* interface, const char* destination,
-                                  const char* nexthop, bool add, bool legacy, uid_t uid);
-    [[nodiscard]] int modifyFallthroughLocked(unsigned vpnNetId, bool add);
+    int modifyRoute(unsigned netId, const char* interface, const char* destination,
+                    const char* nexthop, bool add, bool legacy, uid_t uid) WARN_UNUSED_RESULT;
+    int modifyFallthroughLocked(unsigned vpnNetId, bool add) WARN_UNUSED_RESULT;
     void updateTcpSocketMonitorPolling();
 
     class DelegateImpl;
@@ -188,4 +189,7 @@
 
 };
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_NETWORK_CONTROLLER_H
diff --git a/server/PhysicalNetwork.cpp b/server/PhysicalNetwork.cpp
index 56f4ac3..7a1f305 100644
--- a/server/PhysicalNetwork.cpp
+++ b/server/PhysicalNetwork.cpp
@@ -23,12 +23,13 @@
 
 #include "log/log.h"
 
-namespace android::net {
+namespace android {
+namespace net {
 
 namespace {
 
-[[nodiscard]] int addToDefault(unsigned netId, const std::string& interface, Permission permission,
-                               PhysicalNetwork::Delegate* delegate) {
+WARN_UNUSED_RESULT int addToDefault(unsigned netId, const std::string& interface,
+                                    Permission permission, PhysicalNetwork::Delegate* delegate) {
     if (int ret = RouteController::addInterfaceToDefaultNetwork(interface.c_str(), permission)) {
         ALOGE("failed to add interface %s to default netId %u", interface.c_str(), netId);
         return ret;
@@ -39,8 +40,9 @@
     return 0;
 }
 
-[[nodiscard]] int removeFromDefault(unsigned netId, const std::string& interface,
-                                    Permission permission, PhysicalNetwork::Delegate* delegate) {
+WARN_UNUSED_RESULT int removeFromDefault(unsigned netId, const std::string& interface,
+                                         Permission permission,
+                                         PhysicalNetwork::Delegate* delegate) {
     if (int ret = RouteController::removeInterfaceFromDefaultNetwork(interface.c_str(),
                                                                      permission)) {
         ALOGE("failed to remove interface %s from default netId %u", interface.c_str(), netId);
@@ -54,13 +56,15 @@
 
 }  // namespace
 
-PhysicalNetwork::Delegate::~Delegate() {}
+PhysicalNetwork::Delegate::~Delegate() {
+}
 
 PhysicalNetwork::PhysicalNetwork(unsigned netId, PhysicalNetwork::Delegate* delegate) :
         Network(netId), mDelegate(delegate), mPermission(PERMISSION_NONE), mIsDefault(false) {
 }
 
-PhysicalNetwork::~PhysicalNetwork() {}
+PhysicalNetwork::~PhysicalNetwork() {
+}
 
 Permission PhysicalNetwork::getPermission() const {
     return mPermission;
@@ -202,4 +206,5 @@
     return 0;
 }
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
diff --git a/server/PhysicalNetwork.h b/server/PhysicalNetwork.h
index 0720824..89c9443 100644
--- a/server/PhysicalNetwork.h
+++ b/server/PhysicalNetwork.h
@@ -14,23 +14,25 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_PHYSICAL_NETWORK_H
+#define NETD_SERVER_PHYSICAL_NETWORK_H
 
 #include "Network.h"
 #include "Permission.h"
 
-namespace android::net {
+namespace android {
+namespace net {
 
 class PhysicalNetwork : public Network {
-  public:
+public:
     class Delegate {
-      public:
+    public:
         virtual ~Delegate();
 
-        [[nodiscard]] virtual int addFallthrough(const std::string& physicalInterface,
-                                                 Permission permission) = 0;
-        [[nodiscard]] virtual int removeFallthrough(const std::string& physicalInterface,
-                                                    Permission permission) = 0;
+        virtual int addFallthrough(const std::string& physicalInterface,
+                                   Permission permission) WARN_UNUSED_RESULT = 0;
+        virtual int removeFallthrough(const std::string& physicalInterface,
+                                      Permission permission) WARN_UNUSED_RESULT = 0;
     };
 
     PhysicalNetwork(unsigned netId, Delegate* delegate);
@@ -38,15 +40,15 @@
 
     // These refer to permissions that apps must have in order to use this network.
     Permission getPermission() const;
-    [[nodiscard]] int setPermission(Permission permission);
+    int setPermission(Permission permission) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] int addAsDefault();
-    [[nodiscard]] int removeAsDefault();
+    int addAsDefault() WARN_UNUSED_RESULT;
+    int removeAsDefault() WARN_UNUSED_RESULT;
 
-  private:
+private:
     Type getType() const override;
-    [[nodiscard]] int addInterface(const std::string& interface) override;
-    [[nodiscard]] int removeInterface(const std::string& interface) override;
+    int addInterface(const std::string& interface) override WARN_UNUSED_RESULT;
+    int removeInterface(const std::string& interface) override WARN_UNUSED_RESULT;
     int destroySocketsLackingPermission(Permission permission);
     void invalidateRouteCache(const std::string& interface);
 
@@ -55,4 +57,7 @@
     bool mIsDefault;
 };
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_PHYSICAL_NETWORK_H
diff --git a/server/ResolvStub.cpp b/server/ResolvStub.cpp
index 2fb6625..5928790 100644
--- a/server/ResolvStub.cpp
+++ b/server/ResolvStub.cpp
@@ -55,7 +55,7 @@
 }
 
 int resolv_stub_init() {
-    void* netdResolvHandle = nullptr;
+    void* netdResolvHandle;
 
     for (const auto& dir : {APEX_LIB64_DIR, APEX_LIB_DIR}) {
         std::string path = std::string(dir) + "/" + LIBNAME;
@@ -64,7 +64,7 @@
             ALOGI("Loaded resolver library from %s", path.c_str());
             break;
         }
-        ALOGW("dlopen(%s) failed: %s", path.c_str(), strerror(errno));
+        ALOGW("dlopen(%s) failed: %s", path.c_str(), dlerror());
     }
 
     if (netdResolvHandle == nullptr) {
@@ -76,7 +76,6 @@
 #define RESOLV_STUB_LOAD_SYMBOL(x) resolvStubInitFunction(netdResolvHandle, STR(x), &RESOLV_STUB.x)
     RESOLV_STUB_LOAD_SYMBOL(resolv_has_nameservers);
     RESOLV_STUB_LOAD_SYMBOL(resolv_init);
-    RESOLV_STUB_LOAD_SYMBOL(resolv_gethostbyaddr_from_cache);
 #undef RESOLV_STUB_LOAD_SYMBOL
 #undef STR
 
diff --git a/server/RouteController.cpp b/server/RouteController.cpp
index a62ed6b..6722372 100644
--- a/server/RouteController.cpp
+++ b/server/RouteController.cpp
@@ -38,6 +38,7 @@
 #include <android-base/file.h>
 #include <android-base/stringprintf.h>
 #include "log/log.h"
+#include "logwrap/logwrap.h"
 #include "netid_client.h"
 #include "netutils/ifc.h"
 
@@ -45,7 +46,8 @@
 using android::base::WriteStringToFile;
 using android::net::UidRangeParcel;
 
-namespace android::net {
+namespace android {
+namespace net {
 
 auto RouteController::iptablesRestoreCommandFunction = execIptablesRestoreCommand;
 
@@ -102,7 +104,7 @@
 
 // Avoids "non-constant-expression cannot be narrowed from type 'unsigned int' to 'unsigned short'"
 // warnings when using RTA_LENGTH(x) inside static initializers (even when x is already uint16_t).
-static constexpr uint16_t U16_RTA_LENGTH(uint16_t x) {
+constexpr uint16_t U16_RTA_LENGTH(uint16_t x) {
     return RTA_LENGTH(x);
 }
 
@@ -122,12 +124,12 @@
 
 // END CONSTANTS ----------------------------------------------------------------------------------
 
-static const char* actionName(uint16_t action) {
+const char *actionName(uint16_t action) {
     static const char *ops[4] = {"adding", "deleting", "getting", "???"};
     return ops[action % 4];
 }
 
-static const char* familyName(uint8_t family) {
+const char *familyName(uint8_t family) {
     switch (family) {
         case AF_INET: return "IPv4";
         case AF_INET6: return "IPv6";
@@ -137,28 +139,20 @@
 
 // Caller must hold sInterfaceToTableLock.
 uint32_t RouteController::getRouteTableForInterfaceLocked(const char* interface) {
-    // If we already know the routing table for this interface name, use it.
-    // This ensures we can remove rules and routes for an interface that has been removed,
-    // or has been removed and re-added with a different interface index.
-    //
-    // The caller is responsible for ensuring that an interface is never added to a network
-    // until it has been removed from any network it was previously in. This ensures that
-    // if the same interface disconnects and then reconnects with a different interface ID
-    // when the reconnect happens the interface will not be in the map, and the code will
-    // determine the new routing table from the interface ID, below.
-    auto iter = sInterfaceToTable.find(interface);
-    if (iter != sInterfaceToTable.end()) {
-        return iter->second;
-    }
-
     uint32_t index = if_nametoindex(interface);
-    if (index == 0) {
+    if (index) {
+        index += RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX;
+        sInterfaceToTable[interface] = index;
+        return index;
+    }
+    // If the interface goes away if_nametoindex() will return 0 but we still need to know
+    // the index so we can remove the rules and routes.
+    auto iter = sInterfaceToTable.find(interface);
+    if (iter == sInterfaceToTable.end()) {
         ALOGE("cannot find interface %s", interface);
         return RT_TABLE_UNSPEC;
     }
-    index += RouteController::ROUTE_TABLE_OFFSET_FROM_INDEX;
-    sInterfaceToTable[interface] = index;
-    return index;
+    return iter->second;
 }
 
 uint32_t RouteController::getIfIndex(const char* interface) {
@@ -237,10 +231,9 @@
 //   range (inclusive). Otherwise, the rule matches packets from all UIDs.
 //
 // Returns 0 on success or negative errno on failure.
-[[nodiscard]] static int modifyIpRule(uint16_t action, uint32_t priority, uint8_t ruleType,
-                                      uint32_t table, uint32_t fwmark, uint32_t mask,
-                                      const char* iif, const char* oif, uid_t uidStart,
-                                      uid_t uidEnd) {
+WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint8_t ruleType,
+                                    uint32_t table, uint32_t fwmark, uint32_t mask, const char* iif,
+                                    const char* oif, uid_t uidStart, uid_t uidEnd) {
     // Ensure that if you set a bit in the fwmark, it's not being ignored by the mask.
     if (fwmark & ~mask) {
         ALOGE("mask 0x%x does not select all the bits set in fwmark 0x%x", mask, fwmark);
@@ -324,23 +317,23 @@
     return 0;
 }
 
-[[nodiscard]] static int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table,
-                                      uint32_t fwmark, uint32_t mask, const char* iif,
-                                      const char* oif, uid_t uidStart, uid_t uidEnd) {
+WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table,
+                                    uint32_t fwmark, uint32_t mask, const char* iif,
+                                    const char* oif, uid_t uidStart, uid_t uidEnd) {
     return modifyIpRule(action, priority, FR_ACT_TO_TBL, table, fwmark, mask, iif, oif, uidStart,
                         uidEnd);
 }
 
-[[nodiscard]] static int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table,
-                                      uint32_t fwmark, uint32_t mask) {
+WARN_UNUSED_RESULT int modifyIpRule(uint16_t action, uint32_t priority, uint32_t table,
+                                    uint32_t fwmark, uint32_t mask) {
     return modifyIpRule(action, priority, table, fwmark, mask, IIF_NONE, OIF_NONE, INVALID_UID,
                         INVALID_UID);
 }
 
 // Adds or deletes an IPv4 or IPv6 route.
 // Returns 0 on success or negative errno on failure.
-int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, const char* destination,
-                  const char* nexthop) {
+WARN_UNUSED_RESULT int modifyIpRoute(uint16_t action, uint32_t table, const char* interface,
+                                     const char* destination, const char* nexthop) {
     // At least the destination must be non-null.
     if (!destination) {
         ALOGE("null destination");
@@ -399,11 +392,11 @@
 
     // Assemble a rtmsg and put it in an array of iovec structures.
     rtmsg route = {
-            .rtm_family = family,
-            .rtm_dst_len = prefixLength,
-            .rtm_protocol = RTPROT_STATIC,
-            .rtm_scope = static_cast<uint8_t>(nexthop ? RT_SCOPE_UNIVERSE : RT_SCOPE_LINK),
-            .rtm_type = type,
+        .rtm_protocol = RTPROT_STATIC,
+        .rtm_type = type,
+        .rtm_family = family,
+        .rtm_dst_len = prefixLength,
+        .rtm_scope = static_cast<uint8_t>(nexthop ? RT_SCOPE_UNIVERSE : RT_SCOPE_LINK),
     };
 
     rtattr rtaDst     = { U16_RTA_LENGTH(rawLength), RTA_DST };
@@ -447,8 +440,8 @@
 //   replies, SYN-ACKs, etc).
 // + Mark sockets that accept connections from this interface so that the connection stays on the
 //   same interface.
-int modifyIncomingPacketMark(unsigned netId, const char* interface, Permission permission,
-                             bool add) {
+WARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface,
+                                                Permission permission, bool add) {
     Fwmark fwmark;
 
     fwmark.netId = netId;
@@ -473,7 +466,7 @@
 //
 // When a VPN is in effect, packets from the local network to upstream networks are forwarded into
 // the VPN's tunnel interface. When the VPN forwards the responses, they emerge out of the tunnel.
-[[nodiscard]] static int modifyVpnOutputToLocalRule(const char* vpnInterface, bool add) {
+WARN_UNUSED_RESULT int modifyVpnOutputToLocalRule(const char* vpnInterface, bool add) {
     return modifyIpRule(add ? RTM_NEWRULE : RTM_DELRULE, RULE_PRIORITY_VPN_OUTPUT_TO_LOCAL,
                         ROUTE_TABLE_LOCAL_NETWORK, MARK_UNSET, MARK_UNSET, vpnInterface, OIF_NONE,
                         INVALID_UID, INVALID_UID);
@@ -484,8 +477,8 @@
 // Notice that this rule doesn't use the netId. I.e., no matter what netId the user's socket may
 // have, if they are subject to this VPN, their traffic has to go through it. Allows the traffic to
 // bypass the VPN if the protectedFromVpn bit is set.
-[[nodiscard]] static int modifyVpnUidRangeRule(uint32_t table, uid_t uidStart, uid_t uidEnd,
-                                               bool secure, bool add) {
+WARN_UNUSED_RESULT int modifyVpnUidRangeRule(uint32_t table, uid_t uidStart, uid_t uidEnd,
+                                             bool secure, bool add) {
     Fwmark fwmark;
     Fwmark mask;
 
@@ -512,8 +505,8 @@
 //
 // This is needed for DnsProxyListener to correctly resolve a request for a user who is in the
 // target set, but where the DnsProxyListener itself is not.
-[[nodiscard]] static int modifyVpnSystemPermissionRule(unsigned netId, uint32_t table, bool secure,
-                                                       bool add) {
+WARN_UNUSED_RESULT int modifyVpnSystemPermissionRule(unsigned netId, uint32_t table, bool secure,
+                                                     bool add) {
     Fwmark fwmark;
     Fwmark mask;
 
@@ -536,9 +529,9 @@
 // Even though we check permissions at the time we set a netId into the fwmark of a socket, we need
 // to check it again in the rules here, because a network's permissions may have been updated via
 // modifyNetworkPermission().
-[[nodiscard]] static int modifyExplicitNetworkRule(unsigned netId, uint32_t table,
-                                                   Permission permission, uid_t uidStart,
-                                                   uid_t uidEnd, bool add) {
+WARN_UNUSED_RESULT int modifyExplicitNetworkRule(unsigned netId, uint32_t table,
+                                                 Permission permission, uid_t uidStart,
+                                                 uid_t uidEnd, bool add) {
     Fwmark fwmark;
     Fwmark mask;
 
@@ -559,9 +552,9 @@
 //
 // Supports apps that use SO_BINDTODEVICE or IP_PKTINFO options and the kernel that already knows
 // the outgoing interface (typically for link-local communications).
-[[nodiscard]] static int modifyOutputInterfaceRules(const char* interface, uint32_t table,
-                                                    Permission permission, uid_t uidStart,
-                                                    uid_t uidEnd, bool add) {
+WARN_UNUSED_RESULT int modifyOutputInterfaceRules(const char* interface, uint32_t table,
+                                                  Permission permission, uid_t uidStart,
+                                                  uid_t uidEnd, bool add) {
     Fwmark fwmark;
     Fwmark mask;
 
@@ -588,7 +581,7 @@
 // This is for sockets that have not explicitly requested a particular network, but have been
 // bound to one when they called connect(). This ensures that sockets connected on a particular
 // network stay on that network even if the default network changes.
-[[nodiscard]] static int modifyImplicitNetworkRule(unsigned netId, uint32_t table, bool add) {
+WARN_UNUSED_RESULT int modifyImplicitNetworkRule(unsigned netId, uint32_t table, bool add) {
     Fwmark fwmark;
     Fwmark mask;
 
@@ -610,9 +603,9 @@
 //
 // If a packet with a VPN's netId doesn't find a route in the VPN's routing table, it's allowed to
 // go over the default network, provided it has the permissions required by the default network.
-int RouteController::modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId,
-                                              const char* physicalInterface,
-                                              Permission permission) {
+WARN_UNUSED_RESULT int RouteController::modifyVpnFallthroughRule(uint16_t action, unsigned vpnNetId,
+                                                                 const char* physicalInterface,
+                                                                 Permission permission) {
     uint32_t table = getRouteTableForInterface(physicalInterface);
     if (table == RT_TABLE_UNSPEC) {
         return -ESRCH;
@@ -632,7 +625,7 @@
 }
 
 // Add rules to allow legacy routes added through the requestRouteToHost() API.
-[[nodiscard]] static int addLegacyRouteRules() {
+WARN_UNUSED_RESULT int addLegacyRouteRules() {
     Fwmark fwmark;
     Fwmark mask;
 
@@ -658,7 +651,7 @@
 }
 
 // Add rules to lookup the local network when specified explicitly or otherwise.
-[[nodiscard]] static int addLocalNetworkRules(unsigned localNetId) {
+WARN_UNUSED_RESULT int addLocalNetworkRules(unsigned localNetId) {
     if (int ret = modifyExplicitNetworkRule(localNetId, ROUTE_TABLE_LOCAL_NETWORK, PERMISSION_NONE,
                                             INVALID_UID, INVALID_UID, ACTION_ADD)) {
         return ret;
@@ -712,12 +705,12 @@
 // relying on the kernel-default "from all lookup main" rule at priority 32766 is not intended
 // behaviour. We do flush the kernel-default rules at startup, but having an explicit unreachable
 // rule will hopefully make things even clearer.
-[[nodiscard]] static int addUnreachableRule() {
+WARN_UNUSED_RESULT int addUnreachableRule() {
     return modifyIpRule(RTM_NEWRULE, RULE_PRIORITY_UNREACHABLE, FR_ACT_UNREACHABLE, RT_TABLE_UNSPEC,
                         MARK_UNSET, MARK_UNSET, IIF_NONE, OIF_NONE, INVALID_UID, INVALID_UID);
 }
 
-[[nodiscard]] static int modifyLocalNetwork(unsigned netId, const char* interface, bool add) {
+WARN_UNUSED_RESULT int modifyLocalNetwork(unsigned netId, const char* interface, bool add) {
     if (int ret = modifyIncomingPacketMark(netId, interface, PERMISSION_NONE, add)) {
         return ret;
     }
@@ -726,8 +719,8 @@
 }
 
 /* static */
-int RouteController::modifyPhysicalNetwork(unsigned netId, const char* interface,
-                                           Permission permission, bool add) {
+WARN_UNUSED_RESULT int RouteController::modifyPhysicalNetwork(unsigned netId, const char* interface,
+                                                              Permission permission, bool add) {
     uint32_t table = getRouteTableForInterface(interface);
     if (table == RT_TABLE_UNSPEC) {
         return -ESRCH;
@@ -771,7 +764,7 @@
     return 0;
 }
 
-[[nodiscard]] static int modifyRejectNonSecureNetworkRule(const UidRanges& uidRanges, bool add) {
+WARN_UNUSED_RESULT int modifyRejectNonSecureNetworkRule(const UidRanges& uidRanges, bool add) {
     Fwmark fwmark;
     Fwmark mask;
     fwmark.protectedFromVpn = false;
@@ -788,9 +781,10 @@
     return 0;
 }
 
-int RouteController::modifyVirtualNetwork(unsigned netId, const char* interface,
-                                          const UidRanges& uidRanges, bool secure, bool add,
-                                          bool modifyNonUidBasedRules) {
+WARN_UNUSED_RESULT int RouteController::modifyVirtualNetwork(unsigned netId, const char* interface,
+                                                             const UidRanges& uidRanges,
+                                                             bool secure, bool add,
+                                                             bool modifyNonUidBasedRules) {
     uint32_t table = getRouteTableForInterface(interface);
     if (table == RT_TABLE_UNSPEC) {
         return -ESRCH;
@@ -826,8 +820,8 @@
     return 0;
 }
 
-int RouteController::modifyDefaultNetwork(uint16_t action, const char* interface,
-                                          Permission permission) {
+WARN_UNUSED_RESULT int RouteController::modifyDefaultNetwork(uint16_t action, const char* interface,
+                                                             Permission permission) {
     uint32_t table = getRouteTableForInterface(interface);
     if (table == RT_TABLE_UNSPEC) {
         return -ESRCH;
@@ -846,8 +840,9 @@
                         mask.intValue, IIF_LOOPBACK, OIF_NONE, INVALID_UID, INVALID_UID);
 }
 
-int RouteController::modifyTetheredNetwork(uint16_t action, const char* inputInterface,
-                                           const char* outputInterface) {
+WARN_UNUSED_RESULT int RouteController::modifyTetheredNetwork(uint16_t action,
+                                                              const char* inputInterface,
+                                                              const char* outputInterface) {
     uint32_t table = getRouteTableForInterface(outputInterface);
     if (table == RT_TABLE_UNSPEC) {
         return -ESRCH;
@@ -859,8 +854,9 @@
 
 // Adds or removes an IPv4 or IPv6 route to the specified table.
 // Returns 0 on success or negative errno on failure.
-int RouteController::modifyRoute(uint16_t action, const char* interface, const char* destination,
-                                 const char* nexthop, TableType tableType) {
+WARN_UNUSED_RESULT int RouteController::modifyRoute(uint16_t action, const char* interface,
+                                                    const char* destination, const char* nexthop,
+                                                    TableType tableType) {
     uint32_t table;
     switch (tableType) {
         case RouteController::INTERFACE: {
@@ -893,7 +889,7 @@
     return 0;
 }
 
-[[nodiscard]] static int clearTetheringRules(const char* inputInterface) {
+WARN_UNUSED_RESULT int clearTetheringRules(const char* inputInterface) {
     int ret = 0;
     while (ret == 0) {
         ret = modifyIpRule(RTM_DELRULE, RULE_PRIORITY_TETHERING, 0, MARK_UNSET, MARK_UNSET,
@@ -915,7 +911,7 @@
     return getRtmU32Attribute(nlh, RTA_TABLE);
 }
 
-[[nodiscard]] static int flushRules() {
+WARN_UNUSED_RESULT int flushRules() {
     NetlinkDumpFilter shouldDelete = [] (nlmsghdr *nlh) {
         // Don't touch rules at priority 0 because by default they are used for local input.
         return getRulePriority(nlh) != 0;
@@ -923,7 +919,7 @@
     return rtNetlinkFlush(RTM_GETRULE, RTM_DELRULE, "rules", shouldDelete);
 }
 
-int RouteController::flushRoutes(uint32_t table) {
+WARN_UNUSED_RESULT int RouteController::flushRoutes(uint32_t table) {
     NetlinkDumpFilter shouldDelete = [table] (nlmsghdr *nlh) {
         return getRouteTable(nlh) == table;
     };
@@ -932,7 +928,7 @@
 }
 
 // Returns 0 on success or negative errno on failure.
-int RouteController::flushRoutes(const char* interface) {
+WARN_UNUSED_RESULT int RouteController::flushRoutes(const char* interface) {
     std::lock_guard lock(sInterfaceToTableLock);
 
     uint32_t table = getRouteTableForInterfaceLocked(interface);
@@ -1098,4 +1094,6 @@
 std::mutex RouteController::sInterfaceToTableLock;
 std::map<std::string, uint32_t> RouteController::sInterfaceToTable;
 
-}  // namespace android::net
+
+}  // namespace net
+}  // namespace android
diff --git a/server/RouteController.h b/server/RouteController.h
index e36320f..d40288b 100644
--- a/server/RouteController.h
+++ b/server/RouteController.h
@@ -14,9 +14,10 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_ROUTE_CONTROLLER_H
+#define NETD_SERVER_ROUTE_CONTROLLER_H
 
-#include "NetdConstants.h"  // IptablesTarget
+#include "NetdConstants.h"
 #include "Permission.h"
 
 #include <android-base/thread_annotations.h>
@@ -26,7 +27,8 @@
 #include <map>
 #include <mutex>
 
-namespace android::net {
+namespace android {
+namespace net {
 
 class UidRanges;
 
@@ -44,7 +46,7 @@
 
     static const char* const LOCAL_MANGLE_INPUT;
 
-    [[nodiscard]] static int Init(unsigned localNetId);
+    static int Init(unsigned localNetId) WARN_UNUSED_RESULT;
 
     // Returns an ifindex given the interface name, by looking up in sInterfaceToTable.
     // This is currently only used by NetworkController::addInterfaceToNetwork
@@ -55,56 +57,55 @@
     // used to add them.
     static uint32_t getIfIndex(const char* interface) EXCLUDES(sInterfaceToTableLock);
 
-    [[nodiscard]] static int addInterfaceToLocalNetwork(unsigned netId, const char* interface);
-    [[nodiscard]] static int removeInterfaceFromLocalNetwork(unsigned netId, const char* interface);
+    static int addInterfaceToLocalNetwork(unsigned netId, const char* interface) WARN_UNUSED_RESULT;
+    static int removeInterfaceFromLocalNetwork(unsigned netId,
+                                               const char* interface) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int addInterfaceToPhysicalNetwork(unsigned netId, const char* interface,
-                                                           Permission permission);
-    [[nodiscard]] static int removeInterfaceFromPhysicalNetwork(unsigned netId,
-                                                                const char* interface,
-                                                                Permission permission);
+    static int addInterfaceToPhysicalNetwork(unsigned netId, const char* interface,
+                                             Permission permission) WARN_UNUSED_RESULT;
+    static int removeInterfaceFromPhysicalNetwork(unsigned netId, const char* interface,
+                                                  Permission permission) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int addInterfaceToVirtualNetwork(unsigned netId, const char* interface,
-                                                          bool secure, const UidRanges& uidRanges);
-    [[nodiscard]] static int removeInterfaceFromVirtualNetwork(unsigned netId,
-                                                               const char* interface, bool secure,
-                                                               const UidRanges& uidRanges);
+    static int addInterfaceToVirtualNetwork(unsigned netId, const char* interface, bool secure,
+                                            const UidRanges& uidRanges) WARN_UNUSED_RESULT;
+    static int removeInterfaceFromVirtualNetwork(unsigned netId, const char* interface, bool secure,
+                                                 const UidRanges& uidRanges) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int modifyPhysicalNetworkPermission(unsigned netId, const char* interface,
-                                                             Permission oldPermission,
-                                                             Permission newPermission);
+    static int modifyPhysicalNetworkPermission(unsigned netId, const char* interface,
+                                               Permission oldPermission,
+                                               Permission newPermission) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int addUsersToVirtualNetwork(unsigned netId, const char* interface,
-                                                      bool secure, const UidRanges& uidRanges);
-    [[nodiscard]] static int removeUsersFromVirtualNetwork(unsigned netId, const char* interface,
-                                                           bool secure, const UidRanges& uidRanges);
+    static int addUsersToVirtualNetwork(unsigned netId, const char* interface, bool secure,
+                                        const UidRanges& uidRanges) WARN_UNUSED_RESULT;
+    static int removeUsersFromVirtualNetwork(unsigned netId, const char* interface, bool secure,
+                                             const UidRanges& uidRanges) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges);
-    [[nodiscard]] static int removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges);
+    static int addUsersToRejectNonSecureNetworkRule(const UidRanges& uidRanges)
+                                                    WARN_UNUSED_RESULT;
+    static int removeUsersFromRejectNonSecureNetworkRule(const UidRanges& uidRanges)
+                                                         WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int addInterfaceToDefaultNetwork(const char* interface,
-                                                          Permission permission);
-    [[nodiscard]] static int removeInterfaceFromDefaultNetwork(const char* interface,
-                                                               Permission permission);
+    static int addInterfaceToDefaultNetwork(const char* interface,
+                                            Permission permission) WARN_UNUSED_RESULT;
+    static int removeInterfaceFromDefaultNetwork(const char* interface,
+                                                 Permission permission) WARN_UNUSED_RESULT;
 
     // |nexthop| can be NULL (to indicate a directly-connected route), "unreachable" (to indicate a
     // route that's blocked), "throw" (to indicate the lack of a match), or a regular IP address.
-    [[nodiscard]] static int addRoute(const char* interface, const char* destination,
-                                      const char* nexthop, TableType tableType);
-    [[nodiscard]] static int removeRoute(const char* interface, const char* destination,
-                                         const char* nexthop, TableType tableType);
+    static int addRoute(const char* interface, const char* destination, const char* nexthop,
+                        TableType tableType) WARN_UNUSED_RESULT;
+    static int removeRoute(const char* interface, const char* destination, const char* nexthop,
+                           TableType tableType) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int enableTethering(const char* inputInterface,
-                                             const char* outputInterface);
-    [[nodiscard]] static int disableTethering(const char* inputInterface,
-                                              const char* outputInterface);
+    static int enableTethering(const char* inputInterface,
+                               const char* outputInterface) WARN_UNUSED_RESULT;
+    static int disableTethering(const char* inputInterface,
+                                const char* outputInterface) WARN_UNUSED_RESULT;
 
-    [[nodiscard]] static int addVirtualNetworkFallthrough(unsigned vpnNetId,
-                                                          const char* physicalInterface,
-                                                          Permission permission);
-    [[nodiscard]] static int removeVirtualNetworkFallthrough(unsigned vpnNetId,
-                                                             const char* physicalInterface,
-                                                             Permission permission);
+    static int addVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface,
+                                            Permission permission) WARN_UNUSED_RESULT;
+    static int removeVirtualNetworkFallthrough(unsigned vpnNetId, const char* physicalInterface,
+                                               Permission permission) WARN_UNUSED_RESULT;
 
     // For testing.
     static int (*iptablesRestoreCommandFunction)(IptablesTarget, const std::string&,
@@ -117,9 +118,9 @@
     static std::map<std::string, uint32_t> sInterfaceToTable GUARDED_BY(sInterfaceToTableLock);
 
     static int configureDummyNetwork();
-    [[nodiscard]] static int flushRoutes(const char* interface) EXCLUDES(sInterfaceToTableLock);
-    [[nodiscard]] static int flushRoutes(uint32_t table);
-    static uint32_t getRouteTableForInterfaceLocked(const char* interface)
+    static int flushRoutes(const char* interface) EXCLUDES(sInterfaceToTableLock);
+    static int flushRoutes(uint32_t table);
+    static uint32_t getRouteTableForInterfaceLocked(const char *interface)
             REQUIRES(sInterfaceToTableLock);
     static uint32_t getRouteTableForInterface(const char *interface) EXCLUDES(sInterfaceToTableLock);
     static int modifyDefaultNetwork(uint16_t action, const char* interface, Permission permission);
@@ -140,10 +141,14 @@
 // Public because they are called by by RouteControllerTest.cpp.
 // TODO: come up with a scheme of unit testing this code that does not rely on making all its
 // functions public.
-[[nodiscard]] int modifyIpRoute(uint16_t action, uint32_t table, const char* interface,
-                                const char* destination, const char* nexthop);
+int modifyIpRoute(uint16_t action, uint32_t table, const char* interface, const char* destination,
+                  const char* nexthop) WARN_UNUSED_RESULT;
+int flushRoutes(uint32_t table) WARN_UNUSED_RESULT;
 uint32_t getRulePriority(const nlmsghdr *nlh);
-[[nodiscard]] int modifyIncomingPacketMark(unsigned netId, const char* interface,
-                                           Permission permission, bool add);
+WARN_UNUSED_RESULT int modifyIncomingPacketMark(unsigned netId, const char* interface,
+                                                Permission permission, bool add);
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_ROUTE_CONTROLLER_H
diff --git a/server/SockDiag.cpp b/server/SockDiag.cpp
index 3e1f384..33c523a 100644
--- a/server/SockDiag.cpp
+++ b/server/SockDiag.cpp
@@ -14,29 +14,27 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "Netd"
-
-#include "SockDiag.h"
-
 #include <errno.h>
-#include <linux/inet_diag.h>
-#include <linux/netlink.h>
-#include <linux/sock_diag.h>
 #include <netdb.h>
+#include <string.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
-#include <string.h>
 #include <sys/socket.h>
 #include <sys/uio.h>
 
-#include <cinttypes>
+#include <linux/netlink.h>
+#include <linux/sock_diag.h>
+#include <linux/inet_diag.h>
+
+#define LOG_TAG "Netd"
 
 #include <android-base/strings.h>
 #include <log/log.h>
-#include <netdutils/InternetAddresses.h>
 #include <netdutils/Stopwatch.h>
 
+#include "NetdConstants.h"
 #include "Permission.h"
+#include "SockDiag.h"
 
 #ifndef SOCK_DESTROY
 #define SOCK_DESTROY 21
@@ -46,7 +44,6 @@
 
 namespace android {
 
-using netdutils::ScopedAddrinfo;
 using netdutils::Stopwatch;
 
 namespace net {
@@ -326,8 +323,7 @@
     }
 
     if (mSocketsDestroyed > 0) {
-        ALOGI("Destroyed %d sockets on %s in %" PRId64 "us", mSocketsDestroyed, addrstr,
-              s.timeTakenUs());
+        ALOGI("Destroyed %d sockets on %s in %.1f ms", mSocketsDestroyed, addrstr, s.timeTaken());
     }
 
     return mSocketsDestroyed;
@@ -401,7 +397,7 @@
     }
 
     if (mSocketsDestroyed > 0) {
-        ALOGI("Destroyed %d sockets for UID in %" PRId64 "us", mSocketsDestroyed, s.timeTakenUs());
+        ALOGI("Destroyed %d sockets for UID in %.1f ms", mSocketsDestroyed, s.timeTaken());
     }
 
     return 0;
@@ -428,9 +424,9 @@
     }
 
     if (mSocketsDestroyed > 0) {
-        ALOGI("Destroyed %d sockets for %s skip={%s} in %" PRId64 "us", mSocketsDestroyed,
-              uidRanges.toString().c_str(), android::base::Join(skipUids, " ").c_str(),
-              s.timeTakenUs());
+        ALOGI("Destroyed %d sockets for %s skip={%s} in %.1f ms",
+              mSocketsDestroyed, uidRanges.toString().c_str(),
+              android::base::Join(skipUids, " ").c_str(), s.timeTaken());
     }
 
     return 0;
@@ -499,8 +495,8 @@
     };
 
     struct nlattr nla = {
-            .nla_len = sizeof(struct nlattr) + bytecodelen,
-            .nla_type = INET_DIAG_REQ_BYTECODE,
+        .nla_type = INET_DIAG_REQ_BYTECODE,
+        .nla_len = sizeof(struct nlattr) + bytecodelen,
     };
 
     iovec iov[] = {
@@ -521,8 +517,8 @@
     }
 
     if (mSocketsDestroyed > 0) {
-        ALOGI("Destroyed %d sockets for netId %d permission=%d in %" PRId64 "us", mSocketsDestroyed,
-              netId, permission, s.timeTakenUs());
+        ALOGI("Destroyed %d sockets for netId %d permission=%d in %.1f ms",
+              mSocketsDestroyed, netId, permission, s.timeTaken());
     }
 
     return 0;
diff --git a/server/SockDiagTest.cpp b/server/SockDiagTest.cpp
index b79471a..312f2c8 100644
--- a/server/SockDiagTest.cpp
+++ b/server/SockDiagTest.cpp
@@ -199,15 +199,14 @@
 
 inet_diag_msg makeDiagMessage(__u8 family,  const sockaddr *src, const sockaddr *dst) {
     inet_diag_msg msg = {
-            .idiag_family = family,
-            .idiag_state = TCP_ESTABLISHED,
-            .id =
-                    {
-                            .idiag_sport = 1234,
-                            .idiag_dport = 4321,
-                    },
-            .idiag_uid = AID_APP + 123,
-            .idiag_inode = 123456789,
+        .idiag_family = family,
+        .idiag_state = TCP_ESTABLISHED,
+        .idiag_uid = AID_APP + 123,
+        .idiag_inode = 123456789,
+        .id = {
+            .idiag_sport = 1234,
+            .idiag_dport = 4321,
+        }
     };
     EXPECT_TRUE(fillDiagAddr(msg.id.idiag_src, src));
     EXPECT_TRUE(fillDiagAddr(msg.id.idiag_dst, dst));
diff --git a/server/TetherController.cpp b/server/TetherController.cpp
index c987d63..0c5b6bf 100644
--- a/server/TetherController.cpp
+++ b/server/TetherController.cpp
@@ -36,7 +36,6 @@
 #include <vector>
 
 #define LOG_TAG "TetherController"
-#include <android-base/scopeguard.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
@@ -117,6 +116,22 @@
     return !strcmp(BP_TOOLS_MODE, bootmode);
 }
 
+int setPosixSpawnFileActionsAddDup2(posix_spawn_file_actions_t* fa, int fd, int new_fd) {
+    int res = posix_spawn_file_actions_init(fa);
+    if (res) {
+        return res;
+    }
+    return posix_spawn_file_actions_adddup2(fa, fd, new_fd);
+}
+
+int setPosixSpawnAttrFlags(posix_spawnattr_t* attr, short flags) {
+    int res = posix_spawnattr_init(attr);
+    if (res) {
+        return res;
+    }
+    return posix_spawnattr_setflags(attr, flags);
+}
+
 }  // namespace
 
 auto TetherController::iptablesRestoreFunction = execIptablesRestoreWithOutput;
@@ -190,15 +205,8 @@
     return mForwardingRequests;
 }
 
-int TetherController::startTethering(bool usingLegacyDnsProxy, int num_addrs, char** dhcp_ranges) {
-    if (!usingLegacyDnsProxy && num_addrs == 0) {
-        // Both DHCP and DnsProxy are disabled, we don't need to start dnsmasq
-        configureForTethering(true);
-        mIsTetheringStarted = true;
-        return 0;
-    }
-
-    if (mIsTetheringStarted) {
+int TetherController::startTethering(int num_addrs, char **dhcp_ranges) {
+    if (mDaemonPid != 0) {
         ALOGE("Tethering already started");
         errno = EBUSY;
         return -errno;
@@ -237,11 +245,8 @@
             kDnsmasqUsername,
     };
 
-    if (!usingLegacyDnsProxy) {
-        argVector.push_back("--port=0");
-    }
-
-    // DHCP server will be disabled if num_addrs == 0 and no --dhcp-range is passed.
+    // DHCP server will be disabled if num_addrs == 0 and no --dhcp-range is
+    // passed.
     for (int addrIndex = 0; addrIndex < num_addrs; addrIndex += 2) {
         argVector.push_back(StringPrintf("--dhcp-range=%s,%s,1h", dhcp_ranges[addrIndex],
                                          dhcp_ranges[addrIndex + 1]));
@@ -262,33 +267,23 @@
     // dup2 creates fd without CLOEXEC, dnsmasq will receive commands through the
     // duplicated fd.
     posix_spawn_file_actions_t fa;
-    int res = posix_spawn_file_actions_init(&fa);
+    int res = setPosixSpawnFileActionsAddDup2(&fa, pipeRead.get(), STDIN_FILENO);
     if (res) {
-        ALOGE("posix_spawn_file_actions_init failed (%s)", strerror(res));
-        return -res;
-    }
-    const android::base::ScopeGuard faGuard = [&] { posix_spawn_file_actions_destroy(&fa); };
-    res = posix_spawn_file_actions_adddup2(&fa, pipeRead.get(), STDIN_FILENO);
-    if (res) {
-        ALOGE("posix_spawn_file_actions_adddup2 failed (%s)", strerror(res));
+        ALOGE("posix_spawn set fa failed (%s)", strerror(res));
         return -res;
     }
 
     posix_spawnattr_t attr;
-    res = posix_spawnattr_init(&attr);
+    res = setPosixSpawnAttrFlags(&attr, POSIX_SPAWN_USEVFORK);
     if (res) {
-        ALOGE("posix_spawnattr_init failed (%s)", strerror(res));
-        return -res;
-    }
-    const android::base::ScopeGuard attrGuard = [&] { posix_spawnattr_destroy(&attr); };
-    res = posix_spawnattr_setflags(&attr, POSIX_SPAWN_USEVFORK);
-    if (res) {
-        ALOGE("posix_spawnattr_setflags failed (%s)", strerror(res));
+        ALOGE("posix_spawn set attr flag failed (%s)", strerror(res));
         return -res;
     }
 
     pid_t pid;
     res = posix_spawn(&pid, args[0], &fa, &attr, &args[0], nullptr);
+    posix_spawnattr_destroy(&attr);
+    posix_spawn_file_actions_destroy(&fa);
     if (res) {
         ALOGE("posix_spawn failed (%s)", strerror(res));
         return -res;
@@ -296,7 +291,6 @@
     mDaemonPid = pid;
     mDaemonFd = pipeWrite.release();
     configureForTethering(true);
-    mIsTetheringStarted = true;
     applyDnsInterfaces();
     ALOGD("Tethering services running");
 
@@ -312,8 +306,7 @@
     return addrsCstrVec;
 }
 
-int TetherController::startTethering(bool usingLegacyDnsProxy,
-                                     const std::vector<std::string>& dhcpRanges) {
+int TetherController::startTethering(const std::vector<std::string>& dhcpRanges) {
     struct in_addr v4_addr;
     for (const auto& dhcpRange : dhcpRanges) {
         if (!inet_aton(dhcpRange.c_str(), &v4_addr)) {
@@ -321,20 +314,14 @@
         }
     }
     auto dhcp_ranges = toCstrVec(dhcpRanges);
-    return startTethering(usingLegacyDnsProxy, dhcp_ranges.size(), dhcp_ranges.data());
+    return startTethering(dhcp_ranges.size(), dhcp_ranges.data());
 }
 
 int TetherController::stopTethering() {
     configureForTethering(false);
 
-    if (!mIsTetheringStarted) {
-        ALOGE("Tethering already stopped");
-        return 0;
-    }
-
-    mIsTetheringStarted = false;
-    // dnsmasq is not started
     if (mDaemonPid == 0) {
+        ALOGE("Tethering already stopped");
         return 0;
     }
 
@@ -351,7 +338,7 @@
 }
 
 bool TetherController::isTetheringStarted() {
-    return mIsTetheringStarted;
+    return (mDaemonPid == 0 ? false : true);
 }
 
 // dnsmasq can't parse commands larger than this due to the fixed-size buffer
diff --git a/server/TetherController.h b/server/TetherController.h
index 7f8ba06..0a04874 100644
--- a/server/TetherController.h
+++ b/server/TetherController.h
@@ -43,8 +43,6 @@
     // some point since the controller was initialized.
     std::multimap<std::string, ForwardingDownstream> mFwdIfaces;
 
-    bool mIsTetheringStarted = false;
-
     // NetId to use for forwarded DNS queries. This may not be the default
     // network, e.g., in the case where we are tethering to a DUN APN.
     unsigned               mDnsNetId = 0;
@@ -75,9 +73,8 @@
     bool disableForwarding(const char* requester);
     const std::set<std::string>& getIpfwdRequesterList() const;
 
-    //TODO: Clean up the overload function
-    int startTethering(bool isLegacyDnsProxy, int num_addrs, char** dhcp_ranges);
-    int startTethering(bool isLegacyDnsProxy, const std::vector<std::string>& dhcpRanges);
+    int startTethering(int num_addrs, char **dhcp_ranges);
+    int startTethering(const std::vector<std::string>& dhcpRanges);
     int stopTethering();
     bool isTetheringStarted();
 
diff --git a/server/TrafficController.cpp b/server/TrafficController.cpp
index 86f1f53..8dceb5b 100644
--- a/server/TrafficController.cpp
+++ b/server/TrafficController.cpp
@@ -38,6 +38,7 @@
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
+#include <logwrap/logwrap.h>
 #include <netdutils/StatusOr.h>
 
 #include <netdutils/Misc.h>
@@ -77,7 +78,6 @@
 // Otherwise, apps would be able to avoid data usage accounting entirely by filling up the
 // map with tagged traffic entries.
 constexpr int TOTAL_UID_STATS_ENTRIES_LIMIT = STATS_MAP_SIZE * 0.9;
-constexpr mode_t S_NONE = 0;
 
 static_assert(BPF_PERMISSION_INTERNET == INetd::PERMISSION_INTERNET,
               "Mismatch between BPF and AIDL permissions: PERMISSION_INTERNET");
@@ -116,7 +116,7 @@
             mPrivilegedUser.find(appId) != mPrivilegedUser.end());
 }
 
-const std::string UidPermissionTypeToString(int permission) {
+const std::string UidPermissionTypeToString(uint8_t permission) {
     if (permission == INetd::PERMISSION_NONE) {
         return "PERMISSION_NONE";
     }
@@ -167,16 +167,19 @@
     return listener;
 }
 
-Status changeOwnerAndMode(const char* path, gid_t group, const char* debugName, mode_t groupMode) {
+Status changeOwnerAndMode(const char* path, gid_t group, const char* debugName, bool netdOnly) {
     int ret = chown(path, AID_ROOT, group);
     if (ret != 0) return statusFromErrno(errno, StringPrintf("change %s group failed", debugName));
 
-    // Ensure groupMode only contains group bits.
-    groupMode &= S_IRGRP | S_IWGRP;
-
-    // chmod doesn't by itself grant permission to all processes in that group to
-    // read/write the bpf map. They still need correct sepolicy.
-    ret = chmod(path, S_IRUSR | S_IWUSR | groupMode);
+    if (netdOnly) {
+        ret = chmod(path, S_IRWXU);
+    } else {
+        // Allow both netd and system server to obtain map fd from the path.
+        // chmod doesn't grant permission to all processes in that group to
+        // read/write the bpf map. They still need correct sepolicy to
+        // read/write the map.
+        ret = chmod(path, S_IRWXU | S_IRGRP | S_IWGRP);
+    }
     if (ret != 0) return statusFromErrno(errno, StringPrintf("change %s mode failed", debugName));
     return netdutils::status::ok;
 }
@@ -194,56 +197,43 @@
 Status TrafficController::initMaps() {
     std::lock_guard guard(mMutex);
     RETURN_IF_NOT_OK(mCookieTagMap.init(COOKIE_TAG_MAP_PATH));
-    RETURN_IF_NOT_OK(
-            changeOwnerAndMode(COOKIE_TAG_MAP_PATH, AID_NET_BW_ACCT, "CookieTagMap", S_IRGRP));
+    RETURN_IF_NOT_OK(changeOwnerAndMode(COOKIE_TAG_MAP_PATH, AID_NET_BW_ACCT, "CookieTagMap",
+                                        false));
 
     RETURN_IF_NOT_OK(mUidCounterSetMap.init(UID_COUNTERSET_MAP_PATH));
     RETURN_IF_NOT_OK(changeOwnerAndMode(UID_COUNTERSET_MAP_PATH, AID_NET_BW_ACCT,
-                                        "UidCounterSetMap", S_IRGRP));
+                                        "UidCounterSetMap", false));
 
     RETURN_IF_NOT_OK(mAppUidStatsMap.init(APP_UID_STATS_MAP_PATH));
-    RETURN_IF_NOT_OK(changeOwnerAndMode(APP_UID_STATS_MAP_PATH, AID_NET_BW_STATS, "AppUidStatsMap",
-                                        S_IRGRP));
+    RETURN_IF_NOT_OK(
+        changeOwnerAndMode(APP_UID_STATS_MAP_PATH, AID_NET_BW_STATS, "AppUidStatsMap", false));
 
     RETURN_IF_NOT_OK(mStatsMapA.init(STATS_MAP_A_PATH));
-    RETURN_IF_NOT_OK(
-            changeOwnerAndMode(STATS_MAP_A_PATH, AID_NET_BW_STATS, "StatsMapA", S_IRGRP | S_IWGRP));
+    RETURN_IF_NOT_OK(changeOwnerAndMode(STATS_MAP_A_PATH, AID_NET_BW_STATS, "StatsMapA", false));
 
     RETURN_IF_NOT_OK(mStatsMapB.init(STATS_MAP_B_PATH));
-    RETURN_IF_NOT_OK(
-            changeOwnerAndMode(STATS_MAP_B_PATH, AID_NET_BW_STATS, "StatsMapB", S_IRGRP | S_IWGRP));
+    RETURN_IF_NOT_OK(changeOwnerAndMode(STATS_MAP_B_PATH, AID_NET_BW_STATS, "StatsMapB", false));
 
     RETURN_IF_NOT_OK(mIfaceIndexNameMap.init(IFACE_INDEX_NAME_MAP_PATH));
     RETURN_IF_NOT_OK(changeOwnerAndMode(IFACE_INDEX_NAME_MAP_PATH, AID_NET_BW_STATS,
-                                        "IfaceIndexNameMap", S_IRGRP));
+                                        "IfaceIndexNameMap", false));
 
     RETURN_IF_NOT_OK(mIfaceStatsMap.init(IFACE_STATS_MAP_PATH));
-    RETURN_IF_NOT_OK(
-            changeOwnerAndMode(IFACE_STATS_MAP_PATH, AID_NET_BW_STATS, "IfaceStatsMap", S_IRGRP));
+    RETURN_IF_NOT_OK(changeOwnerAndMode(IFACE_STATS_MAP_PATH, AID_NET_BW_STATS, "IfaceStatsMap",
+                                        false));
 
     RETURN_IF_NOT_OK(mConfigurationMap.init(CONFIGURATION_MAP_PATH));
     RETURN_IF_NOT_OK(changeOwnerAndMode(CONFIGURATION_MAP_PATH, AID_NET_BW_STATS,
-                                        "ConfigurationMap", S_IRGRP));
+                                        "ConfigurationMap", false));
     RETURN_IF_NOT_OK(
             mConfigurationMap.writeValue(UID_RULES_CONFIGURATION_KEY, DEFAULT_CONFIG, BPF_ANY));
     RETURN_IF_NOT_OK(mConfigurationMap.writeValue(CURRENT_STATS_MAP_CONFIGURATION_KEY, SELECT_MAP_A,
                                                   BPF_ANY));
 
     RETURN_IF_NOT_OK(mUidOwnerMap.init(UID_OWNER_MAP_PATH));
-    RETURN_IF_NOT_OK(changeOwnerAndMode(UID_OWNER_MAP_PATH, AID_ROOT, "UidOwnerMap", S_NONE));
+    RETURN_IF_NOT_OK(changeOwnerAndMode(UID_OWNER_MAP_PATH, AID_ROOT, "UidOwnerMap", true));
     RETURN_IF_NOT_OK(mUidOwnerMap.clear());
     RETURN_IF_NOT_OK(mUidPermissionMap.init(UID_PERMISSION_MAP_PATH));
-
-    // The programs must be readable to process that modify iptables rules
-    RETURN_IF_NOT_OK(changeOwnerAndMode(XT_BPF_EGRESS_PROG_PATH, AID_NET_ADMIN,
-                                        "XtFilterEgressProgram", S_IRGRP));
-    RETURN_IF_NOT_OK(changeOwnerAndMode(XT_BPF_INGRESS_PROG_PATH, AID_NET_ADMIN,
-                                        "XtFilterIngressProgram", S_IRGRP));
-    RETURN_IF_NOT_OK(changeOwnerAndMode(XT_BPF_WHITELIST_PROG_PATH, AID_NET_ADMIN,
-                                        "XtWhitelistProgram", S_IRGRP));
-    RETURN_IF_NOT_OK(changeOwnerAndMode(XT_BPF_BLACKLIST_PROG_PATH, AID_NET_ADMIN,
-                                        "XtBlacklistProgram", S_IRGRP));
-
     return netdutils::status::ok;
 }
 
@@ -588,10 +578,8 @@
                                      UidOwnerMatchType match) {
     auto oldMatch = map.readValue(uid);
     if (isOk(oldMatch)) {
-        UidOwnerValue newMatch = {
-                .iif = (match == IIF_MATCH) ? 0 : oldMatch.value().iif,
-                .rule = static_cast<uint8_t>(oldMatch.value().rule & ~match),
-        };
+        UidOwnerValue newMatch = {.rule = static_cast<uint8_t>(oldMatch.value().rule & ~match),
+                                  .iif = (match == IIF_MATCH) ? 0 : oldMatch.value().iif};
         if (newMatch.rule == 0) {
             RETURN_IF_NOT_OK(map.deleteValue(uid));
         } else {
@@ -613,16 +601,11 @@
     }
     auto oldMatch = map.readValue(uid);
     if (isOk(oldMatch)) {
-        UidOwnerValue newMatch = {
-                .iif = iif ? iif : oldMatch.value().iif,
-                .rule = static_cast<uint8_t>(oldMatch.value().rule | match),
-        };
+        UidOwnerValue newMatch = {.rule = static_cast<uint8_t>(oldMatch.value().rule | match),
+                                  .iif = iif ? iif : oldMatch.value().iif};
         RETURN_IF_NOT_OK(map.writeValue(uid, newMatch, BPF_ANY));
     } else {
-        UidOwnerValue newMatch = {
-                .iif = iif,
-                .rule = static_cast<uint8_t>(match),
-        };
+        UidOwnerValue newMatch = {.rule = static_cast<uint8_t>(match), .iif = iif};
         RETURN_IF_NOT_OK(map.writeValue(uid, newMatch, BPF_ANY));
     }
     return netdutils::status::ok;
@@ -864,7 +847,7 @@
             mPrivilegedUser.erase(uid);
             if (mBpfLevel > BpfLevel::NONE) {
                 Status ret = mUidPermissionMap.deleteValue(uid);
-                if (!isOk(ret) && ret.code() != ENOENT) {
+                if (!isOk(ret) && ret.code() != ENONET) {
                     ALOGE("Failed to clean up the permission for %u: %s", uid,
                           strerror(ret.code()));
                 }
@@ -1092,28 +1075,15 @@
     uint32_t key = UID_RULES_CONFIGURATION_KEY;
     auto configuration = mConfigurationMap.readValue(key);
     if (isOk(configuration)) {
-        dw.println("current ownerMatch configuration: %d%s", configuration.value(),
-                   uidMatchTypeToString(configuration.value()).c_str());
+        dw.println("current ownerMatch configuration: %d", configuration.value());
     } else {
         dw.println("mConfigurationMap read ownerMatch configure failed with error: %s",
                    configuration.status().msg().c_str());
     }
-
     key = CURRENT_STATS_MAP_CONFIGURATION_KEY;
     configuration = mConfigurationMap.readValue(key);
     if (isOk(configuration)) {
-        const char* statsMapDescription = "???";
-        switch (configuration.value()) {
-            case SELECT_MAP_A:
-                statsMapDescription = "SELECT_MAP_A";
-                break;
-            case SELECT_MAP_B:
-                statsMapDescription = "SELECT_MAP_B";
-                break;
-                // No default clause, so if we ever add a third map, this code will fail to build.
-        }
-        dw.println("current statsMap configuration: %d %s", configuration.value(),
-                   statsMapDescription);
+        dw.println("current statsMap configuration: %d", configuration.value());
     } else {
         dw.println("mConfigurationMap read stats map configure failed with error: %s",
                    configuration.status().msg().c_str());
@@ -1139,7 +1109,7 @@
         dw.println("mUidOwnerMap print end with error: %s", res.msg().c_str());
     }
     dumpBpfMap("mUidPermissionMap", dw, "");
-    const auto printUidPermissionInfo = [&dw](const uint32_t& key, const int& value,
+    const auto printUidPermissionInfo = [&dw](const uint32_t& key, const uint8_t& value,
                                               const BpfMap<uint32_t, uint8_t>&) {
         dw.println("%u %s", key, UidPermissionTypeToString(value).c_str());
         return netdutils::status::ok;
diff --git a/server/VirtualNetwork.h b/server/VirtualNetwork.h
index 20c8dee..69b14d8 100644
--- a/server/VirtualNetwork.h
+++ b/server/VirtualNetwork.h
@@ -14,14 +14,16 @@
  * limitations under the License.
  */
 
-#pragma once
+#ifndef NETD_SERVER_VIRTUAL_NETWORK_H
+#define NETD_SERVER_VIRTUAL_NETWORK_H
 
 #include <set>
 
 #include "Network.h"
 #include "UidRanges.h"
 
-namespace android::net {
+namespace android {
+namespace net {
 
 // A VirtualNetwork may be "secure" or not.
 //
@@ -38,14 +40,15 @@
     bool isSecure() const;
     bool appliesToUser(uid_t uid) const;
 
-    [[nodiscard]] int addUsers(const UidRanges& uidRanges, const std::set<uid_t>& protectableUsers);
-    [[nodiscard]] int removeUsers(const UidRanges& uidRanges,
-                                  const std::set<uid_t>& protectableUsers);
+    int addUsers(const UidRanges& uidRanges,
+                 const std::set<uid_t>& protectableUsers) WARN_UNUSED_RESULT;
+    int removeUsers(const UidRanges& uidRanges,
+                    const std::set<uid_t>& protectableUsers) WARN_UNUSED_RESULT;
 
-  private:
+private:
     Type getType() const override;
-    [[nodiscard]] int addInterface(const std::string& interface) override;
-    [[nodiscard]] int removeInterface(const std::string& interface) override;
+    int addInterface(const std::string& interface) override WARN_UNUSED_RESULT;
+    int removeInterface(const std::string& interface) override WARN_UNUSED_RESULT;
     int maybeCloseSockets(bool add, const UidRanges& uidRanges,
                           const std::set<uid_t>& protectableUsers);
 
@@ -53,4 +56,7 @@
     UidRanges mUidRanges;
 };
 
-}  // namespace android::net
+}  // namespace net
+}  // namespace android
+
+#endif  // NETD_SERVER_VIRTUAL_NETWORK_H
diff --git a/server/XfrmController.cpp b/server/XfrmController.cpp
index 199638c..a57b492 100644
--- a/server/XfrmController.cpp
+++ b/server/XfrmController.cpp
@@ -53,6 +53,7 @@
 #include <cutils/properties.h>
 #include <log/log.h>
 #include <log/log_properties.h>
+#include <logwrap/logwrap.h>
 #include "Fwmark.h"
 #include "InterfaceController.h"
 #include "NetdConstants.h"
diff --git a/server/XfrmControllerTest.cpp b/server/XfrmControllerTest.cpp
index e7f5cfc..36af67a 100644
--- a/server/XfrmControllerTest.cpp
+++ b/server/XfrmControllerTest.cpp
@@ -19,6 +19,7 @@
 #include <cerrno>
 #include <cinttypes>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <set>
 #include <vector>
diff --git a/server/binder/android/net/INetd.aidl b/server/binder/android/net/INetd.aidl
index fdea52e..ec9bbc3 100644
--- a/server/binder/android/net/INetd.aidl
+++ b/server/binder/android/net/INetd.aidl
@@ -1194,18 +1194,4 @@
     * @return a IBinder object, it could be casted to oem specific interface.
     */
     IBinder getOemNetd();
-
-   /**
-    * Start tethering with given configuration
-    *
-    * @param usingLegacyDnsProxy, whether to enable or disable legacy DNS proxy server.
-    * @param dhcpRanges dhcp ranges to set.
-    *                   dhcpRanges might contain many addresss {addr1, addr2, aadr3, addr4...}
-    *                   Netd splits them into ranges: addr1-addr2, addr3-addr4, etc.
-    *                   An odd number of addrs will fail.
-    * @throws ServiceSpecificException in case of failure, with an error code indicating the
-    *         cause of the failure.
-    */
-    void tetherStartWithConfiguration(
-            boolean usingLegacyDnsProxy, in @utf8InCpp String[] dhcpRanges);
 }
diff --git a/server/main.cpp b/server/main.cpp
index d8ed96f..b783ce5 100644
--- a/server/main.cpp
+++ b/server/main.cpp
@@ -14,19 +14,19 @@
  * limitations under the License.
  */
 
-#include <dirent.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <signal.h>
+#include <chrono>
 #include <stdio.h>
 #include <stdlib.h>
+#include <signal.h>
+#include <errno.h>
 #include <string.h>
+#include <mutex>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>
-#include <chrono>
-#include <cinttypes>
-#include <mutex>
+
+#include <fcntl.h>
+#include <dirent.h>
 
 #define LOG_TAG "Netd"
 
@@ -82,21 +82,11 @@
     gLog.info(std::string(msg));
 }
 
-int tagSocketCallback(int sockFd, uint32_t tag, uid_t uid, pid_t) {
-    return gCtls->trafficCtrl.tagSocket(sockFd, tag, uid, geteuid());
-}
-
-bool evaluateDomainNameCallback(const android_net_context&, const char* /*name*/) {
-    return true;
-}
-
 bool initDnsResolver() {
     ResolverNetdCallbacks callbacks = {
-            .check_calling_permission = &checkCallingPermissionCallback,
             .get_network_context = &getNetworkContextCallback,
             .log = &logCallback,
-            .tagSocket = &tagSocketCallback,
-            .evaluate_domain_name = &evaluateDomainNameCallback,
+            .check_calling_permission = &checkCallingPermissionCallback,
     };
     return RESOLV_STUB.resolv_init(callbacks);
 }
@@ -185,7 +175,7 @@
         ALOGE("Unable to start NetdNativeService: %d", ret);
         exit(1);
     }
-    gLog.info("Registering NetdNativeService: %" PRId64 "us", subTime.getTimeAndResetUs());
+    gLog.info("Registering NetdNativeService: %.1fms", subTime.getTimeAndReset());
 
     android::net::process::ScopedPidFile pidFile(PID_FILE_PATH);
 
@@ -196,8 +186,9 @@
         ALOGE("Unable to start NetdHwService: %d", ret);
         exit(1);
     }
-    gLog.info("Registering NetdHwService: %" PRId64 "us", subTime.getTimeAndResetUs());
-    gLog.info("Netd started in %" PRId64 "us", s.timeTakenUs());
+    gLog.info("Registering NetdHwService: %.1fms", subTime.getTimeAndReset());
+
+    gLog.info("Netd started in %dms", static_cast<int>(s.timeTaken()));
 
     IPCThreadState::self()->joinThreadPool();
 
diff --git a/server/oem_iptables_hook.cpp b/server/oem_iptables_hook.cpp
index 39a6285..c7f8dbf 100644
--- a/server/oem_iptables_hook.cpp
+++ b/server/oem_iptables_hook.cpp
@@ -26,6 +26,7 @@
 
 #define LOG_TAG "OemIptablesHook"
 #include <log/log.h>
+#include <logwrap/logwrap.h>
 #include "NetdConstants.h"
 
 namespace {
diff --git a/tests/Android.bp b/tests/Android.bp
index 1ac413f..4237b25 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -47,23 +47,11 @@
     ],
 }
 
-cc_test_library {
-    name: "libnetd_test_utils",
-    srcs: [
-        "test_utils.cpp"
-    ],
-    export_include_dirs: ["."],
-    shared_libs: [
-        "libbase",
-    ],
-}
-
 cc_test {
     name: "netd_integration_test",
     test_suites: ["device-tests"],
     require_root: true,
     defaults: ["netd_defaults"],
-    tidy: false,  // cuts test build time by almost 1 minute
     srcs: [
         ":netd_integration_test_shared",
         "binder_test.cpp",
@@ -88,12 +76,12 @@
         "libcap",
         "libnetd_test_tun_interface",
         "libnetd_test_unsol_service",
-        "libnetd_test_utils",
         "libbpf_android",
+        "liblogwrap",
         "libnetdbpf",
         "libnetdutils",
         "libqtaguid",
-        "netd_aidl_interface-unstable-cpp",
+        "netd_aidl_interface-cpp",
         "netd_event_listener_interface-cpp",
         "oemnetd_aidl_interface-cpp",
     ],
diff --git a/tests/AndroidTest.xml b/tests/AndroidTest.xml
new file mode 100644
index 0000000..7b18f9f
--- /dev/null
+++ b/tests/AndroidTest.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<!--
+    To run test manually:
+        make -j netd_integration_test && \
+        tradefed.sh run template/local_min -\-template:map test=netd_integration_test
+
+    For a list of options, see:
+        tools/tradefederation/core/src/com/android/tradefed/testtype/GTest.java
+-->
+<configuration description="Config for netd_integration_test">
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="netd_integration_test->/data/local/tmp/netd_integration_test" />
+    </target_preparer>
+    <option name="test-suite-tag" value="apct" />
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="netd_integration_test" />
+    </test>
+</configuration>
diff --git a/tests/benchmarks/Android.bp b/tests/benchmarks/Android.bp
index 59cac96..c14253d 100644
--- a/tests/benchmarks/Android.bp
+++ b/tests/benchmarks/Android.bp
@@ -9,10 +9,10 @@
         "liblog",
         "libnetd_client",
         "libnetdutils",
-        "libutils",
     ],
     static_libs: [
         "libnetd_test_dnsresponder",
+        "libutils",
         "dnsresolver_aidl_interface-cpp",
         "netd_aidl_interface-cpp",
         "netd_event_listener_interface-cpp",
@@ -23,11 +23,10 @@
     include_dirs: [
         "system/netd/include",
         "system/netd/client",
+        "system/netd/resolv/include",
         "system/netd/server",
         "system/netd/server/binder",
-    ],
-    header_libs: [
-        "libnetd_resolv_headers",
+        "system/netd/resolv/dns_responder",
     ],
     srcs: [
         "main.cpp",
@@ -44,6 +43,9 @@
         "libbpf_android",
         "libnetdutils",
     ],
+    static_libs: [
+        "libutils",
+    ],
     srcs: [
         "bpf_benchmark.cpp",
     ],
diff --git a/tests/benchmarks/AndroidTest.xml b/tests/benchmarks/AndroidTest.xml
new file mode 100644
index 0000000..7756cc2
--- /dev/null
+++ b/tests/benchmarks/AndroidTest.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for netd_benchmark">
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="netd_benchmark->/data/local/tmp/netd_benchmark" />
+    </target_preparer>
+    <option name="test-suite-tag" value="apct" />
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="netd_benchmark" />
+    </test>
+</configuration>
diff --git a/tests/benchmarks/connect_benchmark.cpp b/tests/benchmarks/connect_benchmark.cpp
index ed90538..e08fb01 100644
--- a/tests/benchmarks/connect_benchmark.cpp
+++ b/tests/benchmarks/connect_benchmark.cpp
@@ -125,8 +125,8 @@
         }
 
         if (waitBetweenRuns) {
-            latencies[iterations] = stopwatch.timeTakenUs();
-            state.SetIterationTime(static_cast<double>(latencies[iterations]) / 1.0e6L);
+            latencies[iterations] = stopwatch.timeTaken() * 1e6L;
+            state.SetIterationTime(latencies[iterations] / 1e9L);
             std::this_thread::sleep_for(std::chrono::milliseconds(10));
             ++iterations;
         }
@@ -182,8 +182,8 @@
         }
 
         if (waitBetweenRuns) {
-            latencies[iterations] = stopwatch.timeTakenUs();
-            state.SetIterationTime(static_cast<double>(latencies[iterations]) / 1.0e6L);
+            latencies[iterations] = stopwatch.timeTaken() * 1e6L;
+            state.SetIterationTime(latencies[iterations] / 1e9L);
             std::this_thread::sleep_for(std::chrono::milliseconds(10));
             ++iterations;
         }
diff --git a/tests/binder_test.cpp b/tests/binder_test.cpp
index 7be8e55..917bf5d 100644
--- a/tests/binder_test.cpp
+++ b/tests/binder_test.cpp
@@ -21,8 +21,8 @@
 #include <cinttypes>
 #include <condition_variable>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
-#include <iostream>
 #include <mutex>
 #include <set>
 #include <vector>
@@ -50,6 +50,7 @@
 #include <com/android/internal/net/IOemNetd.h>
 #include <cutils/multiuser.h>
 #include <gtest/gtest.h>
+#include <logwrap/logwrap.h>
 #include <netdbpf/bpf_shared.h>
 #include <netutils/ifc.h>
 #include "Fwmark.h"
@@ -60,13 +61,12 @@
 #include "XfrmController.h"
 #include "android/net/INetd.h"
 #include "binder/IServiceManager.h"
-#include "netdutils/InternetAddresses.h"
 #include "netdutils/Stopwatch.h"
 #include "netdutils/Syscalls.h"
 #include "netid_client.h"  // NETID_UNSET
-#include "test_utils.h"
 #include "tun_interface.h"
 
+#define IP_PATH "/system/bin/ip"
 #define IP6TABLES_PATH "/system/bin/ip6tables"
 #define IPTABLES_PATH "/system/bin/iptables"
 #define TUN_DEV "/dev/tun"
@@ -87,14 +87,12 @@
 using android::base::StartsWith;
 using android::base::StringPrintf;
 using android::base::Trim;
-using android::base::unique_fd;
 using android::net::INetd;
 using android::net::InterfaceConfigurationParcel;
 using android::net::InterfaceController;
 using android::net::TetherStatsParcel;
 using android::net::TunInterface;
 using android::net::UidRangeParcel;
-using android::netdutils::ScopedAddrinfo;
 using android::netdutils::sSyscalls;
 using android::netdutils::Stopwatch;
 
@@ -151,8 +149,7 @@
         sTun2.destroy();
     }
 
-    static void fakeRemoteSocketPair(unique_fd* clientSocket, unique_fd* serverSocket,
-                                     unique_fd* acceptedSocket);
+    static void fakeRemoteSocketPair(int *clientSocket, int *serverSocket, int *acceptedSocket);
 
     void createVpnNetworkWithUid(bool secure, uid_t uid, int vpnNetId = TEST_NETID2,
                                  int fallthroughNetId = TEST_NETID1);
@@ -173,7 +170,7 @@
   public:
     explicit TimedOperation(const std::string &name): mName(name) {}
     virtual ~TimedOperation() {
-        std::cerr << "    " << mName << ": " << timeTakenUs() << "us" << std::endl;
+        fprintf(stderr, "    %s: %6.1f ms\n", mName.c_str(), timeTaken());
     }
 
   private:
@@ -187,6 +184,57 @@
     ASSERT_TRUE(isAlive);
 }
 
+static int randomUid() {
+    return 100000 * arc4random_uniform(7) + 10000 + arc4random_uniform(5000);
+}
+
+static std::vector<std::string> runCommand(const std::string& command) {
+    std::vector<std::string> lines;
+    FILE *f = popen(command.c_str(), "r");  // NOLINT(cert-env33-c)
+    if (f == nullptr) {
+        perror("popen");
+        return lines;
+    }
+
+    char *line = nullptr;
+    size_t bufsize = 0;
+    ssize_t linelen = 0;
+    while ((linelen = getline(&line, &bufsize, f)) >= 0) {
+        lines.push_back(std::string(line, linelen));
+        free(line);
+        line = nullptr;
+    }
+
+    pclose(f);
+    return lines;
+}
+
+static std::vector<std::string> listIpRules(const char *ipVersion) {
+    std::string command = StringPrintf("%s %s rule list", IP_PATH, ipVersion);
+    return runCommand(command);
+}
+
+static std::vector<std::string> listIptablesRule(const char *binary, const char *chainName) {
+    std::string command = StringPrintf("%s -w -n -L %s", binary, chainName);
+    return runCommand(command);
+}
+
+static int iptablesRuleLineLength(const char *binary, const char *chainName) {
+    return listIptablesRule(binary, chainName).size();
+}
+
+static bool iptablesRuleExists(const char *binary,
+                               const char *chainName,
+                               const std::string& expectedRule) {
+    std::vector<std::string> rules = listIptablesRule(binary, chainName);
+    for (const auto& rule : rules) {
+        if(rule.find(expectedRule) != std::string::npos) {
+            return true;
+        }
+    }
+    return false;
+}
+
 static bool iptablesNoSocketAllowRuleExists(const char *chainName){
     return iptablesRuleExists(IPTABLES_PATH, chainName, NO_SOCKET_ALLOW_RULE) &&
            iptablesRuleExists(IP6TABLES_PATH, chainName, NO_SOCKET_ALLOW_RULE);
@@ -293,7 +341,7 @@
 }
 
 TEST_F(BinderTest, IpSecSetEncapSocketOwner) {
-    unique_fd uniqueFd(socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0));
+    android::base::unique_fd uniqueFd(socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0));
     android::os::ParcelFileDescriptor sockFd(std::move(uniqueFd));
 
     int sockOptVal = UDP_ENCAP_ESPINUDP;
@@ -580,18 +628,22 @@
 
     std::vector<UidRangeParcel> uidRanges = {makeUidRangeParcel(BASE_UID + 150, BASE_UID + 224),
                                              makeUidRangeParcel(BASE_UID + 226, BASE_UID + 300)};
-    // Make sure no rules existed before calling commands.
-    for (auto const& range : uidRanges) {
-        EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY, range, "prohibit"));
-    }
+
+    const std::vector<std::string> initialRulesV4 = listIpRules(IP_RULE_V4);
+    const std::vector<std::string> initialRulesV6 = listIpRules(IP_RULE_V6);
+
     // Create two valid rules.
     ASSERT_TRUE(mNetd->networkRejectNonSecureVpn(true, uidRanges).isOk());
+    EXPECT_EQ(initialRulesV4.size() + 2, listIpRules(IP_RULE_V4).size());
+    EXPECT_EQ(initialRulesV6.size() + 2, listIpRules(IP_RULE_V6).size());
     for (auto const& range : uidRanges) {
         EXPECT_TRUE(ipRuleExistsForRange(RULE_PRIORITY, range, "prohibit"));
     }
 
     // Remove the rules.
     ASSERT_TRUE(mNetd->networkRejectNonSecureVpn(false, uidRanges).isOk());
+    EXPECT_EQ(initialRulesV4.size(), listIpRules(IP_RULE_V4).size());
+    EXPECT_EQ(initialRulesV6.size(), listIpRules(IP_RULE_V6).size());
     for (auto const& range : uidRanges) {
         EXPECT_FALSE(ipRuleExistsForRange(RULE_PRIORITY, range, "prohibit"));
     }
@@ -600,12 +652,15 @@
     binder::Status status = mNetd->networkRejectNonSecureVpn(false, uidRanges);
     ASSERT_EQ(binder::Status::EX_SERVICE_SPECIFIC, status.exceptionCode());
     EXPECT_EQ(ENOENT, status.serviceSpecificErrorCode());
+
+    // All rules should be the same as before.
+    EXPECT_EQ(initialRulesV4, listIpRules(IP_RULE_V4));
+    EXPECT_EQ(initialRulesV6, listIpRules(IP_RULE_V6));
 }
 
 // Create a socket pair that isLoopbackSocket won't think is local.
-void BinderTest::fakeRemoteSocketPair(unique_fd* clientSocket, unique_fd* serverSocket,
-                                      unique_fd* acceptedSocket) {
-    serverSocket->reset(socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0));
+void BinderTest::fakeRemoteSocketPair(int *clientSocket, int *serverSocket, int *acceptedSocket) {
+    *serverSocket = socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0);
     struct sockaddr_in6 server6 = { .sin6_family = AF_INET6, .sin6_addr = sTun.dstAddr() };
     ASSERT_EQ(0, bind(*serverSocket, (struct sockaddr *) &server6, sizeof(server6)));
 
@@ -613,14 +668,13 @@
     ASSERT_EQ(0, getsockname(*serverSocket, (struct sockaddr *) &server6, &addrlen));
     ASSERT_EQ(0, listen(*serverSocket, 10));
 
-    clientSocket->reset(socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0));
+    *clientSocket = socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, 0);
     struct sockaddr_in6 client6 = { .sin6_family = AF_INET6, .sin6_addr = sTun.srcAddr() };
     ASSERT_EQ(0, bind(*clientSocket, (struct sockaddr *) &client6, sizeof(client6)));
     ASSERT_EQ(0, connect(*clientSocket, (struct sockaddr *) &server6, sizeof(server6)));
     ASSERT_EQ(0, getsockname(*clientSocket, (struct sockaddr *) &client6, &addrlen));
 
-    acceptedSocket->reset(
-            accept4(*serverSocket, (struct sockaddr*)&server6, &addrlen, SOCK_CLOEXEC));
+    *acceptedSocket = accept4(*serverSocket, (struct sockaddr *) &server6, &addrlen, SOCK_CLOEXEC);
     ASSERT_NE(-1, *acceptedSocket);
 
     ASSERT_EQ(0, memcmp(&client6, &server6, sizeof(client6)));
@@ -648,7 +702,7 @@
 }
 
 TEST_F(BinderTest, SocketDestroy) {
-    unique_fd clientSocket, serverSocket, acceptedSocket;
+    int clientSocket, serverSocket, acceptedSocket;
     ASSERT_NO_FATAL_FAILURE(fakeRemoteSocketPair(&clientSocket, &serverSocket, &acceptedSocket));
 
     // Pick a random UID in the system UID range.
@@ -688,6 +742,10 @@
     skipUids.resize(skipUids.size() - 1);
     EXPECT_TRUE(mNetd->socketDestroy(uidRanges, skipUids).isOk());
     checkSocketpairClosed(clientSocket, acceptedSocket);
+
+    close(clientSocket);
+    close(serverSocket);
+    close(acceptedSocket);
 }
 
 namespace {
@@ -989,11 +1047,8 @@
     std::string intIface1 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
     std::string intIface2 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
     std::string intIface3 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
-
-    // Ensure we won't use the same interface name, otherwise the test will fail.
-    u_int32_t rNumber = arc4random_uniform(10000);
-    std::string extIface1 = StringPrintf("netdtest_%u", rNumber);
-    std::string extIface2 = StringPrintf("netdtest_%u", rNumber + 1);
+    std::string extIface1 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
+    std::string extIface2 = StringPrintf("netdtest_%u", arc4random_uniform(10000));
 
     addTetherCounterValues(IPTABLES_PATH,  intIface1, extIface1, 123, 111);
     addTetherCounterValues(IP6TABLES_PATH, intIface1, extIface1, 456,  10);
@@ -1566,13 +1621,13 @@
 }
 
 TEST_F(BinderTest, BandwidthSetGlobalAlert) {
-    int64_t testAlertBytes = 2097200;
+    long testAlertBytes = 2097149;
 
     binder::Status status = mNetd->bandwidthSetGlobalAlert(testAlertBytes);
     EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
     expectBandwidthGlobalAlertRuleExists(testAlertBytes);
 
-    testAlertBytes = 2098230;
+    testAlertBytes = 2097152;
     status = mNetd->bandwidthSetGlobalAlert(testAlertBytes);
     EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
     expectBandwidthGlobalAlertRuleExists(testAlertBytes);
@@ -1608,6 +1663,21 @@
 
 namespace {
 
+std::vector<std::string> listIpRoutes(const char* ipVersion, const char* table) {
+    std::string command = StringPrintf("%s %s route ls table %s", IP_PATH, ipVersion, table);
+    return runCommand(command);
+}
+
+bool ipRouteExists(const char* ipVersion, const char* table, const std::string& ipRoute) {
+    std::vector<std::string> routes = listIpRoutes(ipVersion, table);
+    for (const auto& route : routes) {
+        if (route.find(ipRoute) != std::string::npos) {
+            return true;
+        }
+    }
+    return false;
+}
+
 std::string ipRouteString(const std::string& ifName, const std::string& dst,
                           const std::string& nextHop) {
     std::string dstString = (dst == "0.0.0.0/0" || dst == "::/0") ? "default" : dst;
@@ -1902,20 +1972,16 @@
 }
 
 TEST_F(BinderTest, NetworkSetProtectAllowDeny) {
-    binder::Status status = mNetd->networkSetProtectAllow(TEST_UID1);
+    const int testUid = randomUid();
+    binder::Status status = mNetd->networkSetProtectAllow(testUid);
     EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
     bool ret = false;
-    status = mNetd->networkCanProtect(TEST_UID1, &ret);
+    status = mNetd->networkCanProtect(testUid, &ret);
     EXPECT_TRUE(ret);
 
-    status = mNetd->networkSetProtectDeny(TEST_UID1);
+    status = mNetd->networkSetProtectDeny(testUid);
     EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
-
-    // Clear uid permission before calling networkCanProtect to ensure
-    // the call won't be affected by uid permission.
-    EXPECT_TRUE(mNetd->networkClearPermissionForUser({TEST_UID1}).isOk());
-
-    status = mNetd->networkCanProtect(TEST_UID1, &ret);
+    status = mNetd->networkCanProtect(testUid, &ret);
     EXPECT_FALSE(ret);
 }
 
@@ -1992,30 +2058,22 @@
     std::vector<std::string> noDhcpRange = {};
     static const char dnsdName[] = "dnsmasq";
 
-    for (bool usingLegacyDnsProxy : {true, false}) {
-        binder::Status status =
-                mNetd->tetherStartWithConfiguration(usingLegacyDnsProxy, noDhcpRange);
-        EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
-        SCOPED_TRACE(StringPrintf("usingLegacyDnsProxy: %d", usingLegacyDnsProxy));
-        if (usingLegacyDnsProxy == true) {
-            expectProcessExists(dnsdName);
-        } else {
-            expectProcessDoesNotExist(dnsdName);
-        }
+    binder::Status status = mNetd->tetherStart(noDhcpRange);
+    EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
+    expectProcessExists(dnsdName);
 
-        bool tetherEnabled;
-        status = mNetd->tetherIsEnabled(&tetherEnabled);
-        EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
-        EXPECT_TRUE(tetherEnabled);
+    bool tetherEnabled;
+    status = mNetd->tetherIsEnabled(&tetherEnabled);
+    EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
+    EXPECT_TRUE(tetherEnabled);
 
-        status = mNetd->tetherStop();
-        EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
-        expectProcessDoesNotExist(dnsdName);
+    status = mNetd->tetherStop();
+    EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
+    expectProcessDoesNotExist(dnsdName);
 
-        status = mNetd->tetherIsEnabled(&tetherEnabled);
-        EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
-        EXPECT_FALSE(tetherEnabled);
-    }
+    status = mNetd->tetherIsEnabled(&tetherEnabled);
+    EXPECT_TRUE(status.isOk()) << status.exceptionMessage();
+    EXPECT_FALSE(tetherEnabled);
 }
 
 TEST_F(BinderTest, TetherInterfaceAddRemoveList) {
@@ -3108,14 +3166,10 @@
 
 bool sendIPv6PacketFromUid(uid_t uid, const in6_addr& dstAddr, Fwmark* fwmark, int tunFd) {
     ScopedUidChange scopedUidChange(uid);
-    unique_fd testSocket(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
+    android::base::unique_fd testSocket(socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0));
     if (testSocket < 0) return false;
 
-    const sockaddr_in6 dst6 = {
-            .sin6_family = AF_INET6,
-            .sin6_port = 42,
-            .sin6_addr = dstAddr,
-    };
+    const sockaddr_in6 dst6 = {.sin6_family = AF_INET6, .sin6_addr = dstAddr, .sin6_port = 42};
     int res = connect(testSocket, (sockaddr*)&dst6, sizeof(dst6));
     socklen_t fwmarkLen = sizeof(fwmark->intValue);
     EXPECT_NE(-1, getsockopt(testSocket, SOL_SOCKET, SO_MARK, &(fwmark->intValue), &fwmarkLen));
@@ -3228,4 +3282,4 @@
     // Get current default network NetId
     ASSERT_TRUE(mNetd->networkGetDefault(&mStoredDefaultNetwork).isOk());
     expectVpnFallthroughWorks(mNetd.get(), true /* bypassable */, TEST_UID1, sTun, sTun2);
-}
+}
\ No newline at end of file
diff --git a/tests/netd_test.cpp b/tests/netd_test.cpp
index 9a6e69c..7e14b01 100644
--- a/tests/netd_test.cpp
+++ b/tests/netd_test.cpp
@@ -7,7 +7,7 @@
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
- * Unless required by applicable law or agreed to in writing, software
+ * Unless requied by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
diff --git a/tests/netlink_listener_test.cpp b/tests/netlink_listener_test.cpp
index 8c9b622..b39182c 100644
--- a/tests/netlink_listener_test.cpp
+++ b/tests/netlink_listener_test.cpp
@@ -150,11 +150,8 @@
     checkMassiveSocketDestroy(100, false);
 }
 
-// Disabled because flaky on blueline-userdebug; this test relies on the main thread
-// winning a race against the NetlinkListener::run() thread. There's no way to ensure
-// things will be scheduled the same way across all architectures and test environments.
-TEST_F(NetlinkListenerTest, DISABLED_TestSkDestroyError) {
+TEST_F(NetlinkListenerTest, TestSkDestroyError) {
     SKIP_IF_BPF_NOT_SUPPORTED;
 
-    checkMassiveSocketDestroy(50000, true);
+    checkMassiveSocketDestroy(20000, true);
 }
diff --git a/tests/runtests.sh b/tests/runtests.sh
new file mode 100755
index 0000000..6f828fc
--- /dev/null
+++ b/tests/runtests.sh
@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+
+set -e
+set -u
+
+readonly DEFAULT_TESTS="
+    netdutils_test
+    netd_unit_test
+    netd_integration_test
+    resolv_integration_test
+    resolv_unit_test
+"
+
+readonly EXTENDED_TESTS="
+    netd_benchmark
+"
+
+readonly TEST_DEVICE_PATH="/data/local/tmp"
+
+REPO_TOP=""
+SOONG_BIN=""
+DEBUG=""
+
+function logToStdErr() {
+    echo "$1" >&2
+}
+
+function testAndSetRepoTop() {
+    if [[ -n "$1" && -d "$1/.repo" ]]; then
+        REPO_TOP="$1"
+        SOONG_BIN="$REPO_TOP/build/soong/soong_ui.bash"
+        return 0
+    fi
+    return 1
+}
+
+function gotoRepoTop() {
+    if testAndSetRepoTop "$ANDROID_BUILD_TOP"; then
+        return
+    fi
+
+    while ! testAndSetRepoTop "$PWD"; do
+        if [[ "$PWD" == "/" ]]; then
+            break
+        fi
+        cd ..
+    done
+}
+
+function runCmd() {
+    local cmd="$@"
+    echo "#"
+    echo "# $cmd"
+    $DEBUG $cmd
+    return $?
+}
+
+function runOneTest() {
+    local test="$1"
+    echo
+    echo "###"
+    echo "# $test"
+    echo "###"
+
+    local prefix="$ANDROID_TARGET_OUT_TESTCASES/$test/$TARGET_ARCH/$test"
+    for bits in '' 32 64; do
+            local testbin="${prefix}${bits}"
+            if [ -f "$testbin" ]; then
+                runCmd adb push "$testbin" "$TEST_DEVICE_PATH/$test" &&
+                    runCmd adb shell "$TEST_DEVICE_PATH/$test" &&
+                    runCmd adb shell "rm $TEST_DEVICE_PATH/$test"
+                return $?
+            fi
+    done
+
+    logToStdErr "Couldn't find test binary '$prefix'"
+    return 1
+}
+
+function main() {
+    if [ ! -v ANDROID_BUILD_TOP ]; then
+        logToStdErr "You need to source and lunch before you can use this script"
+        return 1
+    fi
+    gotoRepoTop
+    if ! testAndSetRepoTop "$REPO_TOP"; then
+        logToStdErr "Could not find useful top of repo directory"
+        return 1
+    fi
+    logToStdErr "Using REPO_TOP=$REPO_TOP"
+
+    TARGET_ARCH=$("$SOONG_BIN" --dumpvar-mode TARGET_ARCH)
+    if [ -z "$TARGET_ARCH" ]; then
+        logToStdErr "Could not determine TARGET_ARCH"
+        return 1
+    fi
+
+    local test_regex=""
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            "-n")
+                DEBUG=echo
+                shift
+                ;;
+            *)
+                # Allow us to do things like "runtests.sh integration", etc.
+                test_regex="$1"
+                shift
+                ;;
+        esac
+    done
+
+    # Try becoming root, in case the tests will be run on a device
+    # with a userdebug build. Failure to become root is not fatal
+    # for all (in fact, not even most) tests so don't exit on error.
+    runCmd adb root || logToStdErr "WARNING: unable to 'adb root'"
+
+    local failures=0
+    local skipped=0
+
+    # Find out which tests to run.
+    local tests=""
+    for testName in $DEFAULT_TESTS; do
+        if [[ -z "$test_regex" || "$testName" =~ "$test_regex" ]]; then
+            tests="$tests $testName"
+        else
+            logToStdErr "Skipping $testName"
+            skipped=$((skipped + 1))
+        fi
+    done
+
+    # If something has been specified, also check the extended tests for
+    # a possible match (i.e. in order to run benchmarks, etc).
+    if [[ -n "$test_regex" ]]; then
+        for testName in $EXTENDED_TESTS; do
+            if [[ "$testName" =~ "$test_regex" ]]; then
+                tests="$tests $testName"
+            fi
+        done
+    fi
+
+    if [[ -z "$tests" ]]; then
+        logToStdErr "No tests matched"
+        return 1
+    fi
+
+    # Build all the specified tests.
+    runCmd "$SOONG_BIN" --make-mode "$tests" || return $?
+
+    # Run all the specified tests.
+    for testName in $tests; do
+        runOneTest "$testName" || failures=$((failures + 1))
+    done
+
+    echo "Number of tests failing: $failures"
+    [[ $skipped -gt 0 ]] && echo "Number of tests skipped: $skipped"
+    return $failures
+}
+
+
+main "$@"
+exit $?
diff --git a/tests/test_utils.cpp b/tests/test_utils.cpp
deleted file mode 100644
index 27b17c5..0000000
--- a/tests/test_utils.cpp
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright 2019 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * test_utils.cpp - miscellaneous unit test utilities.
- */
-
-#include <cstdio>
-#include <string>
-#include <vector>
-
-#include <android-base/stringprintf.h>
-
-#include "test_utils.h"
-
-#define IP_PATH "/system/bin/ip"
-
-using android::base::StringPrintf;
-
-int randomUid() {
-    // Pick a random UID consisting of:
-    // - Random user profile (0 - 6)
-    // - Random app ID starting from 12000 (FIRST_APPLICATION_UID + 2000). This ensures no conflicts
-    //   with existing app UIDs unless the user has installed more than 2000 apps, and is still less
-    //   than LAST_APPLICATION_UID (19999).
-    return 100000 * arc4random_uniform(7) + 12000 + arc4random_uniform(3000);
-}
-
-std::vector<std::string> runCommand(const std::string& command) {
-    std::vector<std::string> lines;
-    FILE* f = popen(command.c_str(), "r");  // NOLINT(cert-env33-c)
-    if (f == nullptr) {
-        perror("popen");
-        return lines;
-    }
-
-    char* line = nullptr;
-    size_t bufsize = 0;
-    ssize_t linelen = 0;
-    while ((linelen = getline(&line, &bufsize, f)) >= 0) {
-        lines.push_back(std::string(line, linelen));
-        free(line);
-        line = nullptr;
-    }
-
-    pclose(f);
-    return lines;
-}
-
-std::vector<std::string> listIpRules(const char* ipVersion) {
-    std::string command = StringPrintf("%s %s rule list", IP_PATH, ipVersion);
-    return runCommand(command);
-}
-
-std::vector<std::string> listIptablesRule(const char* binary, const char* chainName) {
-    std::string command = StringPrintf("%s -w -n -L %s", binary, chainName);
-    return runCommand(command);
-}
-
-int iptablesRuleLineLength(const char* binary, const char* chainName) {
-    return listIptablesRule(binary, chainName).size();
-}
-
-bool iptablesRuleExists(const char* binary, const char* chainName,
-                        const std::string& expectedRule) {
-    std::vector<std::string> rules = listIptablesRule(binary, chainName);
-    for (const auto& rule : rules) {
-        if (rule.find(expectedRule) != std::string::npos) {
-            return true;
-        }
-    }
-    return false;
-}
-
-std::vector<std::string> listIpRoutes(const char* ipVersion, const char* table) {
-    std::string command = StringPrintf("%s %s route ls table %s", IP_PATH, ipVersion, table);
-    return runCommand(command);
-}
-
-bool ipRouteExists(const char* ipVersion, const char* table, const std::string& ipRoute) {
-    std::vector<std::string> routes = listIpRoutes(ipVersion, table);
-    for (const auto& route : routes) {
-        if (route.find(ipRoute) != std::string::npos) {
-            return true;
-        }
-    }
-    return false;
-}
diff --git a/tests/test_utils.h b/tests/test_utils.h
deleted file mode 100644
index c8cd6ce..0000000
--- a/tests/test_utils.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright 2019 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * test_utils.h - miscellaneous unit test utilities.
- */
-
-#pragma once
-
-#include <string>
-#include <vector>
-
-int randomUid();
-
-std::vector<std::string> runCommand(const std::string& command);
-
-std::vector<std::string> listIpRules(const char* ipVersion);
-
-std::vector<std::string> listIptablesRule(const char* binary, const char* chainName);
-
-int iptablesRuleLineLength(const char* binary, const char* chainName);
-
-bool iptablesRuleExists(const char* binary, const char* chainName, const std::string& expectedRule);
-
-std::vector<std::string> listIpRoutes(const char* ipVersion, const char* table);
-
-bool ipRouteExists(const char* ipVersion, const char* table, const std::string& ipRoute);
diff --git a/tests/tun_interface.cpp b/tests/tun_interface.cpp
index e412ffd..65f1528 100644
--- a/tests/tun_interface.cpp
+++ b/tests/tun_interface.cpp
@@ -137,7 +137,7 @@
     timeval timeout = {.tv_usec = 200 * 1000};
     if (setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) == -1) return -errno;
 
-    if (int ret = ifc_add_address(mIfName.c_str(), addr.c_str(), prefixlen)) return ret;
+    if (ifc_add_address(mIfName.c_str(), addr.c_str(), prefixlen)) return -errno;
 
     int family;
     size_t addrlen;