handler.go

package main

import (
	"context"
	"fmt"
	"math/rand"
	"strings"
	"sync/atomic"
	"time"

	"github.com/kkkgo/mini-ppdns/mlog"
	"github.com/kkkgo/mini-ppdns/pkg/cache"
	"github.com/kkkgo/mini-ppdns/pkg/pool"
	"github.com/kkkgo/mini-ppdns/pkg/query_context"
	"github.com/kkkgo/mini-ppdns/pkg/server"
	"github.com/kkkgo/mini-ppdns/pkg/upstream"
	"github.com/kkkgo/mini-ppdns/pplog"
	"codeberg.org/miekg/dns"
	"codeberg.org/miekg/dns/dnsutil"
	"codeberg.org/miekg/dns/rdata"
)

const (
	defaultConcurrentQueries = 3  // number of concurrent upstream queries per request
	maxUpstreams             = 16 // max upstream count for stack-allocated shuffle
	dnsTypeSVCB              = 64 // SVCB query type
	dnsTypeHTTPS             = 65 // HTTPS query type
	fallbackTTL              = 1  // TTL for fallback DNS responses (short to allow fast switch back to main DNS)
)

type CacheKey struct {
	Name   string
	Qtype  uint16
	Qclass uint16
}

func (k CacheKey) Sum() uint64 {
	// FNV-1a hash
	var hash uint64 = 14695981039346656037
	for i := 0; i < len(k.Name); i++ {
		hash ^= uint64(k.Name[i])
		hash *= 1099511628211
	}
	hash ^= uint64(k.Qtype)
	hash *= 1099511628211
	hash ^= uint64(k.Qclass)
	hash *= 1099511628211
	return hash
}

type miniHandler struct {
	logger *mlog.Logger

	localForward *miniForwarder
	cnForward    *miniForwarder
	dnsCache     *cache.Cache[CacheKey, *dns.Msg]

	forceFallMatcher *forceFallMatcher
	aaaaMode         string // "no", "yes", or "noerror"
	trustRcodes      map[int]bool
	lite             bool
	bogusPriv        bool         // return NXDOMAIN for private PTR not found locally
	ptrResolver      *ptrResolver // nil if no lease/hosts files configured

	pplogReporter *pplog.Reporter
	pplogLevel    int

	hookFailed *atomic.Bool // nil if hook not configured
}

type miniForwarder struct {
	upstreams []upstream.Upstream
	addresses []string
	qtime     time.Duration
	logger    *mlog.Logger
}

func (f *miniForwarder) Exec(ctx context.Context, qCtx *query_context.Context) (*dns.Msg, string, time.Duration, error) {
	if len(f.upstreams) == 0 {
		return nil, "", 0, fmt.Errorf("no upstreams available")
	}

	queryPayload, err := pool.PackBuffer(qCtx.Q())
	if err != nil {
		return nil, "", 0, err
	}
	defer pool.ReleaseBuf(queryPayload)

	type res struct {
		r        *dns.Msg
		err      error
		upstream string
		duration time.Duration
	}

	concurrent := defaultConcurrentQueries
	if len(f.upstreams) < concurrent {
		concurrent = len(f.upstreams)
	}

	resChan := make(chan res)
	done := make(chan struct{})
	defer close(done)

	start := time.Now()

	// Pick concurrent distinct upstreams via partial Fisher-Yates shuffle (no heap allocation)
	n := len(f.upstreams)
	var indices [maxUpstreams]int
	for i := 0; i < n && i < maxUpstreams; i++ {
		indices[i] = i
	}
	for i := 0; i < concurrent; i++ {
		j := i + rand.Intn(n-i)
		indices[i], indices[j] = indices[j], indices[i]
	}
	for c := 0; c < concurrent; c++ {
		idx := indices[c]
		u := f.upstreams[idx]
		addr := ""
		if idx < len(f.addresses) {
			addr = f.addresses[idx]
		}
		qc := func(b *[]byte) *[]byte {
			c := pool.GetBuf(cap(*b))
			*c = (*c)[:len(*b)]
			copy(*c, *b)
			return c
		}(queryPayload)

		go func(up upstream.Upstream, upAddr string) {
			defer pool.ReleaseBuf(qc)
			upstreamCtx, cancel := context.WithTimeout(ctx, f.qtime)
			defer cancel()

			var r *dns.Msg
			respPayload, err := up.ExchangeContext(upstreamCtx, *qc)
			dur := time.Since(start)
			if err == nil {
				r = new(dns.Msg)
				r.Data = *respPayload
				err = r.Unpack()
				pool.ReleaseBuf(respPayload)
				if err != nil {
					r = nil
				}
			}
			select {
			case resChan <- res{r: r, err: err, upstream: upAddr, duration: dur}:
			case <-done:
			}
		}(u, addr)
	}

	var fallbackRes res
	var firstErr error
	for i := 0; i < concurrent; i++ {
		select {
		case r := <-resChan:
			if r.err != nil {
				if firstErr == nil {
					firstErr = r.err
				}
				continue
			}
			if r.r.Rcode == dns.RcodeSuccess {
				return r.r, r.upstream, r.duration, nil
			}
			if fallbackRes.r == nil {
				fallbackRes = r
			}
		case <-ctx.Done():
			return nil, "", time.Since(start), ctx.Err()
		}
	}
	if fallbackRes.r != nil {
		return fallbackRes.r, fallbackRes.upstream, fallbackRes.duration, nil
	}
	return nil, "", time.Since(start), firstErr
}

func (h *miniHandler) Handle(ctx context.Context, q *dns.Msg, meta server.QueryMeta, packMsgPayload func(m *dns.Msg) (*[]byte, error)) *[]byte {
	qCtx := query_context.NewContext(q)
	qCtx.ServerMeta = meta

	err := h.process(ctx, qCtx)
	if err != nil {
		h.logger.Debugw("query failed", mlog.Err(err))
		if qCtx.R() == nil {
			r := new(dns.Msg)
			dnsutil.SetReply(r, q)
			r.Rcode = dns.RcodeServerFailure
			qCtx.SetResponse(r)
		}
	} else if qCtx.R() == nil {
		// Empty response
		r := new(dns.Msg)
		dnsutil.SetReply(r, q)
		r.Rcode = dns.RcodeServerFailure
		qCtx.SetResponse(r)
	}
	if qCtx.R() != nil {
		if len(qCtx.R().Answer) > 1 && len(q.Question) > 0 {
			shuffleAnswers(dns.RRToType(q.Question[0]), qCtx.R().Answer)
		}
	}

	payload, err := packMsgPayload(qCtx.R())
	if err != nil {
		h.logger.Warnw("failed to pack response", mlog.Err(err))
		return nil
	}
	return payload
}

func shuffleAnswers(qtype uint16, answers []dns.RR) {
	if len(answers) <= 1 {
		return
	}
	// In-place three-tier partition per RFC 1034 (zero heap allocations):
	//   1. CNAME records (must precede the records they resolve to)
	//   2. Records matching the queried qtype (shuffled for load balancing)
	//   3. Everything else
	cnameEnd := stablePartitionRR(answers, func(rr dns.RR) bool {
		return dns.RRToType(rr) == dns.TypeCNAME
	})
	rest := answers[cnameEnd:]
	qtypeEnd := stablePartitionRR(rest, func(rr dns.RR) bool {
		return dns.RRToType(rr) == qtype
	})
	qtypeSlice := rest[:qtypeEnd]
	rand.Shuffle(len(qtypeSlice), func(i, j int) {
		qtypeSlice[i], qtypeSlice[j] = qtypeSlice[j], qtypeSlice[i]
	})
}

// stablePartitionRR moves elements satisfying pred to the front of s,
// preserving relative order. Returns the count of matching elements.
func stablePartitionRR(s []dns.RR, pred func(dns.RR) bool) int {
	j := 0
	for i := 0; i < len(s); i++ {
		if pred(s[i]) {
			if i != j {
				tmp := s[i]
				copy(s[j+1:i+1], s[j:i])
				s[j] = tmp
			}
			j++
		}
	}
	return j
}

// pplogReport sends a query log entry if pplog is enabled.
func (h *miniHandler) pplogReport(qCtx *query_context.Context, route byte, rcode byte, durMs uint16, upstream string, resp *dns.Msg) {
	if h.pplogReporter == nil {
		return
	}
	q := qCtx.QQuestion()
	entry := &pplog.QueryEntry{
		ClientIP:  qCtx.ServerMeta.ClientAddr,
		QType:     q.Qtype,
		Rcode:     rcode,
		Route:     route,
		Duration:  durMs,
		QueryName: q.Name,
		Upstream:  upstream,
	}
	if resp != nil && h.pplogLevel >= 3 {
		entry.AnswerRRs = resp.Answer
	}
	if resp != nil && h.pplogLevel >= 4 {
		entry.ExtraRRs = resp.Extra
	}
	h.pplogReporter.Report(entry)
}

// resolveCNAMEChain follows the CNAME chain in answers starting from startName.
// Returns the final resolved name (the last CNAME target, or startName if no chain).
// The returned name is always lower-cased for comparison.
func resolveCNAMEChain(answers []dns.RR, startName string) string {
	current := strings.ToLower(startName)
	for range answers { // max iterations = len(answers), prevents infinite loops
		found := false
		for _, rr := range answers {
			if dns.RRToType(rr) == dns.TypeCNAME &&
				strings.EqualFold(rr.Header().Name, current) {
				current = strings.ToLower(rr.(*dns.CNAME).Target)
				found = true
				break
			}
		}
		if !found {
			break
		}
	}
	return current
}

func (h *miniHandler) applyLiteMode(r *dns.Msg, qtype uint16, qname string) {
	if r == nil {
		return
	}

	// If qtype is CNAME, no chain rewriting needed -- just filter normally
	if qtype == dns.TypeCNAME {
		// Keep only CNAME records (matching qtype)
		filteredAns := make([]dns.RR, 0, len(r.Answer))
		for _, rr := range r.Answer {
			if dns.RRToType(rr) == qtype {
				filteredAns = append(filteredAns, rr)
			}
		}
		r.Answer = filteredAns
		r.Ns = nil
		filteredExtra := make([]dns.RR, 0, len(r.Extra))
		for _, rr := range r.Extra {
			if dns.RRToType(rr) == dns.TypeOPT {
				filteredExtra = append(filteredExtra, rr)
			}
		}
		r.Extra = filteredExtra
		return
	}

	// Follow CNAME chain to find the final resolved name
	finalName := resolveCNAMEChain(r.Answer, qname)
	qnameLower := strings.ToLower(qname)

	// Check if chain actually resolved (finalName differs from qname means CNAMEs exist)
	// and that there are matching qtype records at the chain's end
	hasChain := finalName != qnameLower
	if hasChain {
		hasMatchingRecords := false
		for _, rr := range r.Answer {
			if dns.RRToType(rr) == qtype && strings.EqualFold(rr.Header().Name, finalName) {
				hasMatchingRecords = true
				break
			}
		}
		if !hasMatchingRecords {
			// Can't validate the chain end -- fall back to no filtering for compatibility
			return
		}
	}

	filteredAns := make([]dns.RR, 0, len(r.Answer))
	for _, rr := range r.Answer {
		if dns.RRToType(rr) == qtype {
			if hasChain {
				// Only keep records belonging to the CNAME chain's final target
				if !strings.EqualFold(rr.Header().Name, finalName) {
					continue // skip records not in the chain
				}
				rr.Header().Name = qname
			}
			filteredAns = append(filteredAns, rr)
		}
	}
	r.Answer = filteredAns
	r.Ns = nil
	filteredExtra := make([]dns.RR, 0, len(r.Extra))
	for _, rr := range r.Extra {
		if dns.RRToType(rr) == dns.TypeOPT {
			filteredExtra = append(filteredExtra, rr)
		}
	}
	r.Extra = filteredExtra
}

func (h *miniHandler) process(ctx context.Context, qCtx *query_context.Context) error {
	q := qCtx.QQuestion()

	// Reject AAAA, SVCB, HTTPS queries
	if q.Qtype == dnsTypeSVCB || q.Qtype == dnsTypeHTTPS || (h.aaaaMode == "no" && q.Qtype == dns.TypeAAAA) {
		if h.aaaaMode == "no" && q.Qtype == dns.TypeAAAA {
			h.logger.Debugw("block aaaa record",
				mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
				mlog.String("qtype", dns.TypeToString[q.Qtype]),
				mlog.String("domain", q.Name))
		}
		r := new(dns.Msg)
		dnsutil.SetReply(r, qCtx.Q())
		r.Rcode = dns.RcodeSuccess
		qCtx.SetResponse(r)
		return nil
	}

	// Local PTR resolution from lease/hosts files
	if q.Qtype == dns.TypePTR && h.ptrResolver != nil {
		if hostname := h.ptrResolver.Lookup(q.Name); hostname != "" {
			r := new(dns.Msg)
			dnsutil.SetReply(r, qCtx.Q())
			r.Rcode = dns.RcodeSuccess
			ptrRR := &dns.PTR{
				Hdr: dns.Header{
					Name:  q.Name,
					Class: dns.ClassINET,
					TTL:   300,
				},
				PTR: rdata.PTR{Ptr: dnsutil.Fqdn(hostname)},
			}
			r.Answer = []dns.RR{ptrRR}
			qCtx.SetResponse(r)
			h.logger.Debugw("local-ptr",
				mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
				mlog.String("qtype", dns.TypeToString[q.Qtype]),
				mlog.String("domain", q.Name),
				mlog.String("rcode", "NOERROR"),
				mlog.String("ptr", hostname))
			h.pplogReport(qCtx, pplog.RouteLocal, byte(dns.RcodeSuccess), 0, "local-ptr", r)
			return nil
		}
		// bogus-priv: private PTR not found locally -> NXDOMAIN, don't forward upstream
		if h.bogusPriv && isPrivatePTR(q.Name) {
			r := new(dns.Msg)
			dnsutil.SetReply(r, qCtx.Q())
			r.Rcode = dns.RcodeNameError
			qCtx.SetResponse(r)
			h.logger.Debugw("bogus-priv",
				mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
				mlog.String("qtype", dns.TypeToString[q.Qtype]),
				mlog.String("domain", q.Name),
				mlog.String("rcode", "NXDOMAIN"))
			h.pplogReport(qCtx, pplog.RouteLocal, byte(dns.RcodeNameError), 0, "bogus-priv", r)
			return nil
		}
	}
	// bogus-priv without ptrResolver: still block private PTR from going upstream
	if q.Qtype == dns.TypePTR && h.bogusPriv && h.ptrResolver == nil && isPrivatePTR(q.Name) {
		r := new(dns.Msg)
		dnsutil.SetReply(r, qCtx.Q())
		r.Rcode = dns.RcodeNameError
		qCtx.SetResponse(r)
		h.logger.Debugw("bogus-priv",
			mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
			mlog.String("qtype", dns.TypeToString[q.Qtype]),
			mlog.String("domain", q.Name),
			mlog.String("rcode", "NXDOMAIN"))
		h.pplogReport(qCtx, pplog.RouteLocal, byte(dns.RcodeNameError), 0, "bogus-priv", r)
		return nil
	}

	// Determine route for logging
	forceFall := false
	if h.forceFallMatcher != nil {
		forceFall = h.forceFallMatcher.Match(qCtx.ServerMeta.ClientAddr)
	}

	hookDown := false
	if h.hookFailed != nil && h.hookFailed.Load() {
		hookDown = true
		forceFall = true
	}

	var note string
	if hookDown {
		note = "hook_fall"
	} else if forceFall {
		note = "force_fall"
	}

	// 2. Cache
	cacheKey := CacheKey{Name: q.Name, Qtype: q.Qtype, Qclass: q.Qclass}
	if cachedMsg, expTime, ok := h.dnsCache.Get(cacheKey); ok && cachedMsg != nil {
		resp := cachedMsg.Copy() // Copy() already deep-copies all RRs
		resp.ID = qCtx.Q().ID

		ttlLeft := uint32(time.Until(expTime).Seconds())
		if ttlLeft == 0 {
			ttlLeft = 1
		}
		for _, ans := range resp.Answer {
			ans.Header().TTL = ttlLeft
		}
		for _, ns := range resp.Ns {
			ns.Header().TTL = ttlLeft
		}
		for _, ext := range resp.Extra {
			if dns.RRToType(ext) != dns.TypeOPT {
				ext.Header().TTL = ttlLeft
			}
		}

		qCtx.SetResponse(resp)
		h.logger.Debugw("cache",
			mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
			mlog.String("qtype", dns.TypeToString[q.Qtype]),
			mlog.String("domain", q.Name),
			mlog.String("rcode", "NOERROR"),
			mlog.String("note", note))
		h.pplogReport(qCtx, pplog.RouteCache, byte(resp.Rcode), 0, "", resp)
		return nil
	}

	var r *dns.Msg
	var upstreamUsed string
	var queryDur time.Duration
	var execErr error
	var localNoData *dns.Msg // saved localForward NODATA result

	// 3. Main sequence
	if !forceFall {
		r, upstreamUsed, queryDur, execErr = h.localForward.Exec(ctx, qCtx)
		if upstreamUsed == "" {
			upstreamUsed = "timeout/err"
		}
		if execErr == nil && r != nil {
			if h.lite {
				h.applyLiteMode(r, q.Qtype, q.Name)
			}
			// trust_rcode: if the main DNS rcode is in the trusted set, accept the
			// response directly (even without answer records) and skip fallback.
			if len(h.trustRcodes) > 0 && h.trustRcodes[int(r.Rcode)] {
				qCtx.SetResponse(r)
				ttl := getMsgTTL(r)
				if ttl == 0 {
					ttl = 1
				}
				h.dnsCache.Store(cacheKey, r.Copy(), time.Now().Add(time.Duration(ttl)*time.Second))
				rcodeLabel := dns.RcodeToString[r.Rcode]
				if len(r.Answer) == 0 {
					rcodeLabel += "(trusted)"
				}
				h.logger.Debugw("local query",
					mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
					mlog.String("upstream", upstreamUsed),
					mlog.String("qtype", dns.TypeToString[q.Qtype]),
					mlog.String("domain", q.Name),
					mlog.String("rcode", rcodeLabel),
					mlog.Duration("dur", queryDur),
					mlog.String("note", note))
				rcodeByte := byte(r.Rcode)
				if r.Rcode == dns.RcodeSuccess && len(r.Answer) == 0 {
					rcodeByte = pplog.RcodeNoData
				}
				h.pplogReport(qCtx, pplog.RouteLocal, rcodeByte, uint16(queryDur.Milliseconds()), upstreamUsed, r)
				return nil
			}
			if r.Rcode == dns.RcodeSuccess && len(r.Answer) > 0 {
				qCtx.SetResponse(r)
				ttl := getMsgTTL(r)
				if ttl > 0 {
					h.dnsCache.Store(cacheKey, r.Copy(), time.Now().Add(time.Duration(ttl)*time.Second))
				}
				h.logger.Debugw("local query",
					mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
					mlog.String("upstream", upstreamUsed),
					mlog.String("qtype", dns.TypeToString[q.Qtype]),
					mlog.String("domain", q.Name),
					mlog.String("rcode", "NOERROR"),
					mlog.Duration("dur", queryDur),
					mlog.String("note", note))
				h.pplogReport(qCtx, pplog.RouteLocal, byte(r.Rcode), uint16(queryDur.Milliseconds()), upstreamUsed, r)
				return nil
			} else if r.Rcode == dns.RcodeSuccess && len(r.Answer) == 0 {
				// aaaa=noerror: trust the NOERROR+empty answer from main DNS directly,
				// skip fallback. Cache with original TTL (or TTL=1 if no NS record TTL).
				if h.aaaaMode == "noerror" && q.Qtype == dns.TypeAAAA {
					qCtx.SetResponse(r)
					ttl := getMsgTTL(r)
					if ttl == 0 {
						ttl = 1
					}
					h.dnsCache.Store(cacheKey, r.Copy(), time.Now().Add(time.Duration(ttl)*time.Second))
					h.logger.Debugw("local query",
						mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
						mlog.String("upstream", upstreamUsed),
						mlog.String("qtype", dns.TypeToString[q.Qtype]),
						mlog.String("domain", q.Name),
						mlog.String("rcode", "NODATA(trusted)"),
						mlog.Duration("dur", queryDur),
						mlog.String("note", note))
					h.pplogReport(qCtx, pplog.RouteLocal, pplog.RcodeNoData, uint16(queryDur.Milliseconds()), upstreamUsed, r)
					return nil
				}
				h.logger.Debugw("local query",
					mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
					mlog.String("upstream", upstreamUsed),
					mlog.String("qtype", dns.TypeToString[q.Qtype]),
					mlog.String("domain", q.Name),
					mlog.String("rcode", "NODATA"),
					mlog.Duration("dur", queryDur),
					mlog.String("note", note))
				h.pplogReport(qCtx, pplog.RouteLocal, pplog.RcodeNoData, uint16(queryDur.Milliseconds()), upstreamUsed, r)
				localNoData = r // save NODATA result for possible later use
			} else {
				h.logger.Debugw("local query",
					mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
					mlog.String("upstream", upstreamUsed),
					mlog.String("qtype", dns.TypeToString[q.Qtype]),
					mlog.String("domain", q.Name),
					mlog.String("rcode", dns.RcodeToString[r.Rcode]),
					mlog.Duration("dur", queryDur),
					mlog.String("note", note))
				h.pplogReport(qCtx, pplog.RouteLocal, byte(r.Rcode), uint16(queryDur.Milliseconds()), upstreamUsed, r)
			}
		} else {
			h.logger.Debugw("local query",
				mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
				mlog.String("upstream", upstreamUsed),
				mlog.String("qtype", dns.TypeToString[q.Qtype]),
				mlog.String("domain", q.Name),
				mlog.String("rcode", "timeout/error"),
				mlog.Duration("dur", queryDur),
				mlog.Err(execErr),
				mlog.String("note", note))
			h.pplogReport(qCtx, pplog.RouteLocal, pplog.RcodeTimeout, uint16(queryDur.Milliseconds()), upstreamUsed, nil)
		}
	}

	// 4. Fallback execution
	rFall, upFall, durFall, errFall := h.cnForward.Exec(ctx, qCtx)
	if upFall == "" {
		upFall = "timeout/err"
	}

	fallIsNoData := rFall != nil && rFall.Rcode == dns.RcodeSuccess && len(rFall.Answer) == 0

	// If both local and fall returned NODATA, prefer localForward result
	// (it may contain useful SOA/CNAME records with original TTL)
	if localNoData != nil && (fallIsNoData || rFall == nil) {
		qCtx.SetResponse(localNoData)
		ttl := getMsgTTL(localNoData)
		if ttl > 0 {
			h.dnsCache.Store(cacheKey, localNoData.Copy(), time.Now().Add(time.Duration(ttl)*time.Second))
		}
	} else if rFall != nil {
		if h.lite {
			h.applyLiteMode(rFall, q.Qtype, q.Name)
		}
		qCtx.SetResponse(rFall)
		// TTL=1: fallback results are short-lived to allow fast switch back
		// to main DNS once the hook monitor detects recovery.
		for _, ans := range qCtx.R().Answer {
			ans.Header().TTL = fallbackTTL
		}
		for _, ns := range qCtx.R().Ns {
			ns.Header().TTL = fallbackTTL
		}
		for _, ext := range qCtx.R().Extra {
			if dns.RRToType(ext) != dns.TypeOPT {
				ext.Header().TTL = fallbackTTL
			}
		}
		ttl := getMsgTTL(qCtx.R())
		if ttl > 0 {
			h.dnsCache.Store(cacheKey, qCtx.R().Copy(), time.Now().Add(time.Duration(ttl)*time.Second))
		}
	} else if errFall != nil {
		// Log error
	}

	if localNoData != nil && (fallIsNoData || rFall == nil) {
		h.logger.Debugw("fall query",
			mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
			mlog.String("upstream", upFall),
			mlog.String("qtype", dns.TypeToString[q.Qtype]),
			mlog.String("domain", q.Name),
			mlog.String("rcode", "NODATA"),
			mlog.Duration("dur", durFall),
			mlog.String("prefer", "local NODATA"),
			mlog.String("note", note))
	} else {
		rcodeStr := "NXDOMAIN or timeout"
		if rFall != nil {
			rcodeStr = dns.RcodeToString[rFall.Rcode]
		}
		if errFall != nil && rFall == nil {
			rcodeStr = errFall.Error()
		}
		h.logger.Debugw("fall query",
			mlog.Stringer("client", qCtx.ServerMeta.ClientAddr),
			mlog.String("upstream", upFall),
			mlog.String("qtype", dns.TypeToString[q.Qtype]),
			mlog.String("domain", q.Name),
			mlog.String("rcode", rcodeStr),
			mlog.Duration("dur", durFall),
			mlog.String("note", note))
	}
	if rFall != nil {
		rcodeByteFall := byte(rFall.Rcode)
		if fallIsNoData {
			rcodeByteFall = pplog.RcodeNoData
		}
		h.pplogReport(qCtx, pplog.RouteFall, rcodeByteFall, uint16(durFall.Milliseconds()), upFall, rFall)
	} else {
		h.pplogReport(qCtx, pplog.RouteFall, pplog.RcodeTimeout, uint16(durFall.Milliseconds()), upFall, nil)
	}

	return nil
}

func getMsgTTL(m *dns.Msg) uint32 {
	var minTTL uint32
	found := false
	for _, a := range m.Answer {
		if !found || a.Header().TTL < minTTL {
			minTTL = a.Header().TTL
			found = true
		}
	}
	for _, a := range m.Ns {
		if !found || a.Header().TTL < minTTL {
			minTTL = a.Header().TTL
			found = true
		}
	}
	for _, a := range m.Extra {
		if dns.RRToType(a) != dns.TypeOPT && (!found || a.Header().TTL < minTTL) {
			minTTL = a.Header().TTL
			found = true
		}
	}
	if !found {
		return 0
	}
	return minTTL
}