dns: cherry-pick 21444, 21468 from master

Type: refactor
Ticket: VPP-1752

Signed-off-by: Dave Barach <dave@barachs.net>
Change-Id: Ieaec721056531ba0c70538c9bf97769a0e80aefd

12 files changed, 5143 insertions, 0 deletions

diff --git a/src/plugins/dns/CMakeLists.txt b/src/plugins/dns/CMakeLists.txt
new file mode 100644
index 00000000000..5d1ac8628db
--- /dev/null
+++ b/src/plugins/dns/CMakeLists.txt
@@ -0,0 +1,33 @@
+
+# Copyright (c) <current-year> <your-organization>
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_vpp_plugin(dns
+  SOURCES
+  dns.c
+  dns.h
+  request_node.c
+  reply_node.c
+  resolver_process.c
+
+  API_FILES
+  dns.api
+
+  INSTALL_HEADERS
+  dns_all_api_h.h
+  dns_msg_enum.h
+  dns_packet.h
+
+  API_TEST_SOURCES
+  dns_test.c
+)
diff --git a/src/plugins/dns/dns.api b/src/plugins/dns/dns.api
new file mode 100644
index 00000000000..a4faec6bbb5
--- /dev/null
+++ b/src/plugins/dns/dns.api
@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+option version = "1.0.0";
+
+/** \brief enable/disable name resolution
+
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_enable - 1 = enable, 0 = disable
+*/
+autoreply manual_print define dns_enable_disable {
+    u32 client_index;
+    u32 context;
+    u8 enable;
+};
+
+/** \brief add or delete an upstream name server
+
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_ip6 - an ip6 name server
+    @param is_add - add = 1, delete = 0
+    @param server_address - server ip address
+*/
+autoreply manual_print define dns_name_server_add_del {
+    u32 client_index;
+    u32 context;
+    u8 is_ip6;
+    u8 is_add;
+    u8 server_address[16];
+};
+
+/** \brief DNS name resolution request
+
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param name - the name to resolve
+*/
+manual_print define dns_resolve_name {
+    u32 client_index;
+    u32 context;
+    u8 name[256];
+ };
+
+/** \brief DNS name resolution reply
+
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param retval - return value, 0 => success
+    @param ip4_set - indicates that the ip4 address is valid
+    @param ip6_set - indicates that the ip6 address is valid
+    @param ip4_address - the ip4 name resolution reply
+    @param ip6_address - the ip6 name resolution reply
+*/
+define dns_resolve_name_reply {
+    u32 context;
+    i32 retval;
+    u8 ip4_set;
+    u8 ip6_set;
+    u8 ip4_address[4];
+    u8 ip6_address[16];
+};
+
+/** \brief DNS IP -> name resolution request
+
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_ip6 - set if the reverse-DNS request is an ip6 address
+    @param address - the address to map to a name
+*/
+manual_print define dns_resolve_ip {
+    u32 client_index;
+    u32 context;
+    u8 is_ip6;
+    u8 address[16];
+ };
+
+/** \brief DNS ip->name resolution reply
+
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param retval - return value, 0 => success
+    @param name - canonical name for the indicated IP address
+*/
+define dns_resolve_ip_reply {
+    u32 context;
+    i32 retval;
+    u8 name[256];
+};
diff --git a/src/plugins/dns/dns.c b/src/plugins/dns/dns.c
new file mode 100644
index 00000000000..5c51a446d98
--- /dev/null
+++ b/src/plugins/dns/dns.c
@@ -0,0 +1,3161 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <vnet/vnet.h>
+#include <vnet/udp/udp.h>
+#include <vnet/plugin/plugin.h>
+#include <vnet/fib/fib_table.h>
+#include <dns/dns.h>
+
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+#include <vpp/app/version.h>
+#include <stdbool.h>
+
+/* define message IDs */
+#include <dns/dns_msg_enum.h>
+
+/* define message structures */
+#define vl_typedefs
+#include <dns/dns_all_api_h.h>
+#undef vl_typedefs
+
+/* define generated endian-swappers */
+#define vl_endianfun
+#include <dns/dns_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
+#define vl_printfun
+#include <dns/dns_all_api_h.h>
+#undef vl_printfun
+
+/* Get the API version number */
+#define vl_api_version(n,v) static u32 api_version=(v);
+#include <dns/dns_all_api_h.h>
+#undef vl_api_version
+
+#define REPLY_MSG_ID_BASE dm->msg_id_base
+#include <vlibapi/api_helper_macros.h>
+
+/* Macro to finish up custom dump fns */
+#define FINISH                                  \
+    vec_add1 (s, 0);                            \
+    vl_print (handle, (char *)s);               \
+    vec_free (s);                               \
+    return handle;
+
+dns_main_t dns_main;
+
+static int
+dns_cache_clear (dns_main_t * dm)
+{
+  dns_cache_entry_t *ep;
+
+  if (dm->is_enabled == 0)
+    return VNET_API_ERROR_NAME_RESOLUTION_NOT_ENABLED;
+
+  dns_cache_lock (dm, 1);
+
+  /* *INDENT-OFF* */
+  pool_foreach (ep, dm->entries,
+  ({
+    vec_free (ep->name);
+    vec_free (ep->pending_requests);
+  }));
+  /* *INDENT-ON* */
+
+  pool_free (dm->entries);
+  hash_free (dm->cache_entry_by_name);
+  dm->cache_entry_by_name = hash_create_string (0, sizeof (uword));
+  vec_free (dm->unresolved_entries);
+  dns_cache_unlock (dm);
+  return 0;
+}
+
+static int
+dns_enable_disable (dns_main_t * dm, int is_enable)
+{
+  vlib_thread_main_t *tm = &vlib_thread_main;
+  u32 n_vlib_mains = tm->n_vlib_mains;
+  vlib_main_t *vm = dm->vlib_main;
+
+  /* Create the resolver process if not done already */
+  vnet_dns_create_resolver_process (dm);
+
+  if (is_enable)
+    {
+      if (vec_len (dm->ip4_name_servers) == 0
+	  && (vec_len (dm->ip6_name_servers) == 0))
+	return VNET_API_ERROR_NO_NAME_SERVERS;
+
+      if (dm->udp_ports_registered == 0)
+	{
+	  udp_register_dst_port (vm, UDP_DST_PORT_dns_reply,
+				 dns46_reply_node.index, 1 /* is_ip4 */ );
+
+	  udp_register_dst_port (vm, UDP_DST_PORT_dns_reply6,
+				 dns46_reply_node.index, 0 /* is_ip4 */ );
+
+	  udp_register_dst_port (vm, UDP_DST_PORT_dns,
+				 dns4_request_node.index, 1 /* is_ip4 */ );
+
+	  udp_register_dst_port (vm, UDP_DST_PORT_dns6,
+				 dns6_request_node.index, 0 /* is_ip4 */ );
+
+	  dm->udp_ports_registered = 1;
+	}
+
+      if (dm->cache_entry_by_name == 0)
+	{
+	  if (n_vlib_mains > 1)
+	    clib_spinlock_init (&dm->cache_lock);
+
+	  dm->cache_entry_by_name = hash_create_string (0, sizeof (uword));
+	}
+
+      dm->is_enabled = 1;
+    }
+  else
+    {
+      dns_cache_clear (dm);
+      dm->is_enabled = 0;
+    }
+  return 0;
+}
+
+static void vl_api_dns_enable_disable_t_handler
+  (vl_api_dns_enable_disable_t * mp)
+{
+  vl_api_dns_enable_disable_reply_t *rmp;
+  dns_main_t *dm = &dns_main;
+  int rv;
+
+  rv = dns_enable_disable (dm, mp->enable);
+
+  REPLY_MACRO (VL_API_DNS_ENABLE_DISABLE_REPLY);
+}
+
+static int
+dns6_name_server_add_del (dns_main_t * dm,
+			  u8 * server_address_as_u8, int is_add)
+{
+  int i;
+  ip6_address_t *ap;
+
+  if (is_add)
+    {
+      /* Already there? done... */
+      for (i = 0; i < vec_len (dm->ip6_name_servers); i++)
+	{
+	  if (!memcmp (dm->ip6_name_servers + i, server_address_as_u8,
+		       sizeof (ip6_address_t)))
+	    return 0;
+	}
+
+      vec_add2 (dm->ip6_name_servers, ap, 1);
+      clib_memcpy (ap, server_address_as_u8, sizeof (*ap));
+    }
+  else
+    {
+      for (i = 0; i < vec_len (dm->ip6_name_servers); i++)
+	{
+	  if (!memcmp (dm->ip6_name_servers + i, server_address_as_u8,
+		       sizeof (ip6_address_t)))
+	    {
+	      vec_delete (dm->ip6_name_servers, 1, i);
+	      return 0;
+	    }
+	}
+      return VNET_API_ERROR_NAME_SERVER_NOT_FOUND;
+    }
+  return 0;
+}
+
+static int
+dns4_name_server_add_del (dns_main_t * dm,
+			  u8 * server_address_as_u8, int is_add)
+{
+  int i;
+  ip4_address_t *ap;
+
+  if (is_add)
+    {
+      /* Already there? done... */
+      for (i = 0; i < vec_len (dm->ip4_name_servers); i++)
+	{
+	  if (!memcmp (dm->ip4_name_servers + i, server_address_as_u8,
+		       sizeof (ip4_address_t)))
+	    return 0;
+	}
+
+      vec_add2 (dm->ip4_name_servers, ap, 1);
+      clib_memcpy (ap, server_address_as_u8, sizeof (*ap));
+    }
+  else
+    {
+      for (i = 0; i < vec_len (dm->ip4_name_servers); i++)
+	{
+	  if (!memcmp (dm->ip4_name_servers + i, server_address_as_u8,
+		       sizeof (ip4_address_t)))
+	    {
+	      vec_delete (dm->ip4_name_servers, 1, i);
+	      return 0;
+	    }
+	}
+      return VNET_API_ERROR_NAME_SERVER_NOT_FOUND;
+    }
+  return 0;
+}
+
+static void vl_api_dns_name_server_add_del_t_handler
+  (vl_api_dns_name_server_add_del_t * mp)
+{
+  dns_main_t *dm = &dns_main;
+  vl_api_dns_name_server_add_del_reply_t *rmp;
+  int rv;
+
+  if (mp->is_ip6)
+    rv = dns6_name_server_add_del (dm, mp->server_address, mp->is_add);
+  else
+    rv = dns4_name_server_add_del (dm, mp->server_address, mp->is_add);
+
+  REPLY_MACRO (VL_API_DNS_NAME_SERVER_ADD_DEL_REPLY);
+}
+
+void
+vnet_dns_send_dns4_request (dns_main_t * dm,
+			    dns_cache_entry_t * ep, ip4_address_t * server)
+{
+  vlib_main_t *vm = dm->vlib_main;
+  f64 now = vlib_time_now (vm);
+  u32 bi;
+  vlib_buffer_t *b;
+  ip4_header_t *ip;
+  fib_prefix_t prefix;
+  fib_node_index_t fei;
+  u32 sw_if_index, fib_index;
+  udp_header_t *udp;
+  ip4_main_t *im4 = &ip4_main;
+  ip_lookup_main_t *lm4 = &im4->lookup_main;
+  ip_interface_address_t *ia = 0;
+  ip4_address_t *src_address;
+  u8 *dns_request;
+  vlib_frame_t *f;
+  u32 *to_next;
+
+  ASSERT (ep->dns_request);
+
+  /* Find a FIB path to the server */
+  clib_memcpy (&prefix.fp_addr.ip4, server, sizeof (*server));
+  prefix.fp_proto = FIB_PROTOCOL_IP4;
+  prefix.fp_len = 32;
+
+  fib_index = fib_table_find (prefix.fp_proto, 0 /* default VRF for now */ );
+  if (fib_index == (u32) ~ 0)
+    {
+      if (0)
+	clib_warning ("no fib table");
+      return;
+    }
+
+  fei = fib_table_lookup (fib_index, &prefix);
+
+  /* Couldn't find route to destination. Bail out. */
+  if (fei == FIB_NODE_INDEX_INVALID)
+    {
+      if (0)
+	clib_warning ("no route to DNS server");
+      return;
+    }
+
+  sw_if_index = fib_entry_get_resolving_interface (fei);
+
+  if (sw_if_index == ~0)
+    {
+      if (0)
+	clib_warning
+	  ("route to %U exists, fei %d, get_resolving_interface returned"
+	   " ~0", format_ip4_address, &prefix.fp_addr, fei);
+      return;
+    }
+
+  /* *INDENT-OFF* */
+  foreach_ip_interface_address(lm4, ia, sw_if_index, 1 /* honor unnumbered */,
+  ({
+    src_address = ip_interface_address_get_address (lm4, ia);
+    goto found_src_address;
+  }));
+  /* *INDENT-ON* */
+
+  clib_warning ("FIB BUG");
+  return;
+
+found_src_address:
+
+  /* Go get a buffer */
+  if (vlib_buffer_alloc (dm->vlib_main, &bi, 1) != 1)
+    return;
+
+  b = vlib_get_buffer (vm, bi);
+  b->current_length = sizeof (ip4_header_t) + sizeof (udp_header_t) +
+    vec_len (ep->dns_request);
+  b->total_length_not_including_first_buffer = 0;
+  b->flags =
+    VLIB_BUFFER_TOTAL_LENGTH_VALID | VNET_BUFFER_F_LOCALLY_ORIGINATED;
+  vnet_buffer (b)->sw_if_index[VLIB_RX] = 0;	/* "local0" */
+  vnet_buffer (b)->sw_if_index[VLIB_TX] = 0;	/* default VRF for now */
+
+  ip = vlib_buffer_get_current (b);
+  clib_memset (ip, 0, sizeof (*ip));
+  udp = (udp_header_t *) (ip + 1);
+  clib_memset (udp, 0, sizeof (*udp));
+
+  dns_request = (u8 *) (udp + 1);
+
+  /* IP header */
+  ip->ip_version_and_header_length = 0x45;
+  ip->length = clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b));
+  ip->ttl = 255;
+  ip->protocol = IP_PROTOCOL_UDP;
+  ip->src_address.as_u32 = src_address->as_u32;
+  ip->dst_address.as_u32 = server->as_u32;
+  ip->checksum = ip4_header_checksum (ip);
+
+  /* UDP header */
+  udp->src_port = clib_host_to_net_u16 (UDP_DST_PORT_dns_reply);
+  udp->dst_port = clib_host_to_net_u16 (UDP_DST_PORT_dns);
+  udp->length = clib_host_to_net_u16 (sizeof (udp_header_t) +
+				      vec_len (ep->dns_request));
+  udp->checksum = 0;
+
+  /* The actual DNS request */
+  clib_memcpy (dns_request, ep->dns_request, vec_len (ep->dns_request));
+
+  /* Ship it to ip4_lookup */
+  f = vlib_get_frame_to_node (vm, ip4_lookup_node.index);
+  to_next = vlib_frame_vector_args (f);
+  to_next[0] = bi;
+  f->n_vectors = 1;
+  vlib_put_frame_to_node (vm, ip4_lookup_node.index, f);
+
+  ep->retry_timer = now + 2.0;
+}
+
+void
+vnet_dns_send_dns6_request (dns_main_t * dm,
+			    dns_cache_entry_t * ep, ip6_address_t * server)
+{
+  vlib_main_t *vm = dm->vlib_main;
+  f64 now = vlib_time_now (vm);
+  u32 bi;
+  vlib_buffer_t *b;
+  ip6_header_t *ip;
+  fib_prefix_t prefix;
+  fib_node_index_t fei;
+  u32 sw_if_index, fib_index;
+  udp_header_t *udp;
+  ip6_main_t *im6 = &ip6_main;
+  ip_lookup_main_t *lm6 = &im6->lookup_main;
+  ip_interface_address_t *ia = 0;
+  ip6_address_t *src_address;
+  u8 *dns_request;
+  vlib_frame_t *f;
+  u32 *to_next;
+  int junk __attribute__ ((unused));
+
+  ASSERT (ep->dns_request);
+
+  /* Find a FIB path to the server */
+  clib_memcpy (&prefix.fp_addr, server, sizeof (*server));
+  prefix.fp_proto = FIB_PROTOCOL_IP6;
+  prefix.fp_len = 32;
+
+  fib_index = fib_table_find (prefix.fp_proto, 0 /* default VRF for now */ );
+  if (fib_index == (u32) ~ 0)
+    {
+      if (0)
+	clib_warning ("no fib table");
+      return;
+    }
+
+  fei = fib_table_lookup (fib_index, &prefix);
+
+  /* Couldn't find route to destination. Bail out. */
+  if (fei == FIB_NODE_INDEX_INVALID)
+    {
+      clib_warning ("no route to DNS server");
+    }
+
+  sw_if_index = fib_entry_get_resolving_interface (fei);
+
+  /* *INDENT-OFF* */
+  foreach_ip_interface_address(lm6, ia, sw_if_index, 1 /* honor unnumbered */,
+  ({
+    src_address = ip_interface_address_get_address (lm6, ia);
+    goto found_src_address;
+  }));
+  /* *INDENT-ON* */
+
+  clib_warning ("FIB BUG");
+  return;
+
+found_src_address:
+
+  /* Go get a buffer */
+  if (vlib_buffer_alloc (dm->vlib_main, &bi, 1) != 1)
+    return;
+
+  b = vlib_get_buffer (vm, bi);
+  b->current_length = sizeof (ip6_header_t) + sizeof (udp_header_t) +
+    vec_len (ep->dns_request);
+  b->total_length_not_including_first_buffer = 0;
+  b->flags =
+    VLIB_BUFFER_TOTAL_LENGTH_VALID | VNET_BUFFER_F_LOCALLY_ORIGINATED;
+
+  ip = vlib_buffer_get_current (b);
+  clib_memset (ip, 0, sizeof (*ip));
+  udp = (udp_header_t *) (ip + 1);
+  clib_memset (udp, 0, sizeof (*udp));
+
+  dns_request = (u8 *) (udp + 1);
+
+  /* IP header */
+  ip->ip_version_traffic_class_and_flow_label =
+    clib_host_to_net_u32 (0x6 << 28);
+
+  ip->payload_length =
+    clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b)
+			  - sizeof (ip6_header_t));
+  ip->hop_limit = 255;
+  ip->protocol = IP_PROTOCOL_UDP;
+  clib_memcpy (&ip->src_address, src_address, sizeof (ip6_address_t));
+  clib_memcpy (&ip->dst_address, server, sizeof (ip6_address_t));
+
+  /* UDP header */
+  udp->src_port = clib_host_to_net_u16 (UDP_DST_PORT_dns_reply);
+  udp->dst_port = clib_host_to_net_u16 (UDP_DST_PORT_dns);
+  udp->length = clib_host_to_net_u16 (sizeof (udp_header_t) +
+				      vec_len (ep->dns_request));
+  udp->checksum = 0;
+  udp->checksum = ip6_tcp_udp_icmp_compute_checksum (vm, b, ip, &junk);
+
+  /* The actual DNS request */
+  clib_memcpy (dns_request, ep->dns_request, vec_len (ep->dns_request));
+
+  /* Ship it to ip6_lookup */
+  f = vlib_get_frame_to_node (vm, ip6_lookup_node.index);
+  to_next = vlib_frame_vector_args (f);
+  to_next[0] = bi;
+  f->n_vectors = 1;
+
+  ep->retry_timer = now + 2.0;
+}
+
+/**
+ * Translate "foo.com" into "0x3 f o o 0x3 c o m 0x0"
+ * A historical / hysterical micro-TLV scheme. DGMS.
+ */
+u8 *
+name_to_labels (u8 * name)
+{
+  int i;
+  int last_label_index;
+  u8 *rv;
+
+  rv = vec_dup (name);
+
+  /* punch in space for the first length */
+  vec_insert (rv, 1, 0);
+  last_label_index = 0;
+  i = 1;
+
+  while (i < vec_len (rv))
+    {
+      if (rv[i] == '.')
+	{
+	  rv[last_label_index] = (i - last_label_index) - 1;
+	  if ((i - last_label_index) > 63)
+	    clib_warning ("stupid name, label length %d",
+			  i - last_label_index);
+	  last_label_index = i;
+	  rv[i] = 0;
+	}
+      i++;
+    }
+  /* Set the last real label length */
+  rv[last_label_index] = (i - last_label_index) - 1;
+
+  /*
+   * Add a [sic] NULL root label. Otherwise, the name parser can't figure out
+   * where to stop.
+   */
+  vec_add1 (rv, 0);
+  return rv;
+}
+
+/**
+ * arc-function for the above.
+ * Translate "0x3 f o o 0x3 c o m 0x0" into "foo.com"
+ * Produces a non-NULL-terminated u8 *vector. %v format is your friend.
+ */
+u8 *
+vnet_dns_labels_to_name (u8 * label, u8 * full_text, u8 ** parse_from_here)
+{
+  u8 *reply = 0;
+  u16 offset;
+  u8 len;
+  int i;
+
+  *parse_from_here = 0;
+
+  /* chase initial pointer? */
+  if ((label[0] & 0xC0) == 0xC0)
+    {
+      *parse_from_here = label + 2;
+      offset = ((label[0] & 0x3f) << 8) + label[1];
+      label = full_text + offset;
+    }
+
+  len = *label++;
+
+  while (len)
+    {
+      for (i = 0; i < len; i++)
+	vec_add1 (reply, *label++);
+
+      /* chase pointer? */
+      if ((label[0] & 0xC0) == 0xC0)
+	{
+	  *parse_from_here = label + 2;
+	  offset = ((label[0] & 0x3f) << 8) + label[1];
+	  label = full_text + offset;
+	}
+
+      len = *label++;
+      if (len)
+	vec_add1 (reply, '.');
+    }
+  if (*parse_from_here == 0)
+    *parse_from_here = label;
+  return reply;
+}
+
+void
+vnet_send_dns_request (dns_main_t * dm, dns_cache_entry_t * ep)
+{
+  dns_header_t *h;
+  dns_query_t *qp;
+  u16 tmp;
+  u8 *request, *name_copy;
+  u32 qp_offset;
+
+  /* This can easily happen if sitting in GDB, etc. */
+  if (ep->flags & DNS_CACHE_ENTRY_FLAG_VALID || ep->server_fails > 1)
+    return;
+
+  /* Construct the dns request, if we haven't been here already */
+  if (vec_len (ep->dns_request) == 0)
+    {
+      /*
+       * Start with the variadic portion of the exercise.
+       * Turn the name into a set of DNS "labels". Max length
+       * per label is 63, enforce that.
+       */
+      request = name_to_labels (ep->name);
+      name_copy = vec_dup (request);
+      qp_offset = vec_len (request);
+
+      /*
+       * At least when testing against "known good" DNS servers:
+       * it turns out that sending 2x requests - one for an A-record
+       * and another for a AAAA-record - seems to work better than
+       * sending a DNS_TYPE_ALL request.
+       */
+
+      /* Add space for the query header */
+      vec_validate (request, 2 * qp_offset + 2 * sizeof (dns_query_t) - 1);
+
+      qp = (dns_query_t *) (request + qp_offset);
+
+      qp->type = clib_host_to_net_u16 (DNS_TYPE_A);
+      qp->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+      qp++;
+      clib_memcpy (qp, name_copy, vec_len (name_copy));
+      qp = (dns_query_t *) (((u8 *) qp) + vec_len (name_copy));
+      vec_free (name_copy);
+
+      qp->type = clib_host_to_net_u16 (DNS_TYPE_AAAA);
+      qp->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+
+      /* Punch in space for the dns_header_t */
+      vec_insert (request, sizeof (dns_header_t), 0);
+
+      h = (dns_header_t *) request;
+
+      /* Transaction ID = pool index */
+      h->id = clib_host_to_net_u16 (ep - dm->entries);
+
+      /* Ask for a recursive lookup */
+      tmp = DNS_RD | DNS_OPCODE_QUERY;
+      h->flags = clib_host_to_net_u16 (tmp);
+      h->qdcount = clib_host_to_net_u16 (2);
+      h->nscount = 0;
+      h->arcount = 0;
+
+      ep->dns_request = request;
+    }
+
+  /* Work out which server / address family we're going to use */
+
+  /* Retry using current server */
+  if (ep->retry_count++ < DNS_RETRIES_PER_SERVER)
+    {
+      if (ep->server_af == 1 /* ip6 */ )
+	{
+	  if (vec_len (dm->ip6_name_servers))
+	    {
+	      vnet_dns_send_dns6_request
+		(dm, ep, dm->ip6_name_servers + ep->server_rotor);
+	      goto out;
+	    }
+	  else
+	    ep->server_af = 0;
+	}
+      if (vec_len (dm->ip4_name_servers))
+	{
+	  vnet_dns_send_dns4_request
+	    (dm, ep, dm->ip4_name_servers + ep->server_rotor);
+	  goto out;
+	}
+    }
+  else				/* switch to a new server */
+    {
+      ep->retry_count = 1;
+      ep->server_rotor++;
+      if (ep->server_af == 1 /* ip6 */ )
+	{
+	  if (ep->server_rotor >= vec_len (dm->ip6_name_servers))
+	    {
+	      ep->server_rotor = 0;
+	      ep->server_af = vec_len (dm->ip4_name_servers) > 0 ? 0 : 1;
+	    }
+	}
+      else
+	{
+	  if (ep->server_rotor >= vec_len (dm->ip4_name_servers))
+	    {
+	      ep->server_rotor = 0;
+	      ep->server_af = vec_len (dm->ip6_name_servers) > 0 ? 1 : 0;
+	    }
+	}
+    }
+
+  if (ep->server_af == 1 /* ip6 */ )
+    vnet_dns_send_dns6_request
+      (dm, ep, dm->ip6_name_servers + ep->server_rotor);
+  else
+    vnet_dns_send_dns4_request
+      (dm, ep, dm->ip4_name_servers + ep->server_rotor);
+
+out:
+
+  vlib_process_signal_event_mt (dm->vlib_main,
+				dm->resolver_process_node_index,
+				DNS_RESOLVER_EVENT_PENDING, 0);
+}
+
+int
+vnet_dns_delete_entry_by_index_nolock (dns_main_t * dm, u32 index)
+{
+  dns_cache_entry_t *ep;
+  int i;
+
+  if (dm->is_enabled == 0)
+    return VNET_API_ERROR_NAME_RESOLUTION_NOT_ENABLED;
+
+  if (pool_is_free_index (dm->entries, index))
+    return VNET_API_ERROR_NO_SUCH_ENTRY;
+
+  ep = pool_elt_at_index (dm->entries, index);
+  if (!(ep->flags & DNS_CACHE_ENTRY_FLAG_VALID))
+    {
+      for (i = 0; i < vec_len (dm->unresolved_entries); i++)
+	if (index == dm->unresolved_entries[i])
+	  {
+	    vec_delete (dm->unresolved_entries, 1, i);
+	    goto found;
+	  }
+      clib_warning ("pool elt %d supposedly pending, but not found...",
+		    index);
+    }
+
+found:
+  hash_unset_mem (dm->cache_entry_by_name, ep->name);
+  vec_free (ep->name);
+  vec_free (ep->pending_requests);
+  pool_put (dm->entries, ep);
+
+  return 0;
+}
+
+static int
+dns_delete_by_name (dns_main_t * dm, u8 * name)
+{
+  int rv;
+  uword *p;
+
+  if (dm->is_enabled == 0)
+    return VNET_API_ERROR_NAME_RESOLUTION_NOT_ENABLED;
+
+  dns_cache_lock (dm, 2);
+  p = hash_get_mem (dm->cache_entry_by_name, name);
+  if (!p)
+    {
+      dns_cache_unlock (dm);
+      return VNET_API_ERROR_NO_SUCH_ENTRY;
+    }
+  rv = vnet_dns_delete_entry_by_index_nolock (dm, p[0]);
+
+  dns_cache_unlock (dm);
+
+  return rv;
+}
+
+static int
+delete_random_entry (dns_main_t * dm)
+{
+  int rv;
+  u32 victim_index, start_index, i;
+  u32 limit;
+  dns_cache_entry_t *ep;
+
+  if (dm->is_enabled == 0)
+    return VNET_API_ERROR_NAME_RESOLUTION_NOT_ENABLED;
+
+  /*
+   * Silence spurious coverity warning. We know pool_elts >> 0, or
+   * we wouldn't be here...
+   */
+#ifdef __COVERITY__
+  if (pool_elts (dm->entries) == 0)
+    return VNET_API_ERROR_UNSPECIFIED;
+#endif
+
+  dns_cache_lock (dm, 3);
+  limit = pool_elts (dm->entries);
+  start_index = random_u32 (&dm->random_seed) % limit;
+
+  for (i = 0; i < limit; i++)
+    {
+      victim_index = (start_index + i) % limit;
+
+      if (!pool_is_free_index (dm->entries, victim_index))
+	{
+	  ep = pool_elt_at_index (dm->entries, victim_index);
+	  /* Delete only valid, non-static entries */
+	  if ((ep->flags & DNS_CACHE_ENTRY_FLAG_VALID)
+	      && ((ep->flags & DNS_CACHE_ENTRY_FLAG_STATIC) == 0))
+	    {
+	      rv = vnet_dns_delete_entry_by_index_nolock (dm, victim_index);
+	      dns_cache_unlock (dm);
+	      return rv;
+	    }
+	}
+    }
+  dns_cache_unlock (dm);
+
+  clib_warning ("Couldn't find an entry to delete?");
+  return VNET_API_ERROR_UNSPECIFIED;
+}
+
+static int
+dns_add_static_entry (dns_main_t * dm, u8 * name, u8 * dns_reply_data)
+{
+  dns_cache_entry_t *ep;
+  uword *p;
+  int rv;
+
+  if (dm->is_enabled == 0)
+    return VNET_API_ERROR_NAME_RESOLUTION_NOT_ENABLED;
+
+  dns_cache_lock (dm, 4);
+  p = hash_get_mem (dm->cache_entry_by_name, name);
+  if (p)
+    {
+      dns_cache_unlock (dm);
+      return VNET_API_ERROR_ENTRY_ALREADY_EXISTS;
+    }
+
+  if (pool_elts (dm->entries) == dm->name_cache_size)
+    {
+      /* Will only fail if the cache is totally filled w/ static entries... */
+      rv = delete_random_entry (dm);
+      if (rv)
+	{
+	  dns_cache_unlock (dm);
+	  return rv;
+	}
+    }
+
+  pool_get (dm->entries, ep);
+  clib_memset (ep, 0, sizeof (*ep));
+
+  /* Note: consumes the name vector */
+  ep->name = name;
+  hash_set_mem (dm->cache_entry_by_name, ep->name, ep - dm->entries);
+  ep->flags = DNS_CACHE_ENTRY_FLAG_VALID | DNS_CACHE_ENTRY_FLAG_STATIC;
+  ep->dns_response = dns_reply_data;
+
+  dns_cache_unlock (dm);
+  return 0;
+}
+
+int
+vnet_dns_resolve_name (dns_main_t * dm, u8 * name, dns_pending_request_t * t,
+		       dns_cache_entry_t ** retp)
+{
+  dns_cache_entry_t *ep;
+  int rv;
+  f64 now;
+  uword *p;
+  dns_pending_request_t *pr;
+  int count;
+
+  now = vlib_time_now (dm->vlib_main);
+
+  /* In case we can't actually answer the question right now... */
+  *retp = 0;
+
+  /* binary API caller might forget to set the name. Guess how we know. */
+  if (name[0] == 0)
+    return VNET_API_ERROR_INVALID_VALUE;
+
+  dns_cache_lock (dm, 5);
+search_again:
+  p = hash_get_mem (dm->cache_entry_by_name, name);
+  if (p)
+    {
+      ep = pool_elt_at_index (dm->entries, p[0]);
+      if (ep->flags & DNS_CACHE_ENTRY_FLAG_VALID)
+	{
+	  /* Has the entry expired? */
+	  if (((ep->flags & DNS_CACHE_ENTRY_FLAG_STATIC) == 0)
+	      && (now > ep->expiration_time))
+	    {
+	      int i;
+	      u32 *indices_to_delete = 0;
+
+	      /*
+	       * Take out the rest of the resolution chain
+	       * This isn't optimal, but it won't happen very often.
+	       */
+	      while (ep)
+		{
+		  if ((ep->flags & DNS_CACHE_ENTRY_FLAG_CNAME))
+		    {
+		      vec_add1 (indices_to_delete, ep - dm->entries);
+
+		      p = hash_get_mem (dm->cache_entry_by_name, ep->cname);
+		      if (!p)
+			break;
+		      ep = pool_elt_at_index (dm->entries, p[0]);
+		    }
+		  else
+		    {
+		      vec_add1 (indices_to_delete, ep - dm->entries);
+		      break;
+		    }
+		}
+	      for (i = 0; i < vec_len (indices_to_delete); i++)
+		{
+		  /* Reenable to watch re-resolutions */
+		  if (0)
+		    {
+		      ep = pool_elt_at_index (dm->entries,
+					      indices_to_delete[i]);
+		      clib_warning ("Re-resolve %s", ep->name);
+		    }
+
+		  vnet_dns_delete_entry_by_index_nolock
+		    (dm, indices_to_delete[i]);
+		}
+	      vec_free (indices_to_delete);
+	      /* Yes, kill it... */
+	      goto re_resolve;
+	    }
+
+	  if (ep->flags & DNS_CACHE_ENTRY_FLAG_CNAME)
+	    {
+	      name = ep->cname;
+	      goto search_again;
+	    }
+	  *retp = ep;
+	  dns_cache_unlock (dm);
+	  return (0);
+	}
+      else
+	{
+	  /*
+	   * Resolution pending. Add request to the pending vector
+	   * by copying the template request
+	   */
+	  vec_add2 (ep->pending_requests, pr, 1);
+	  memcpy (pr, t, sizeof (*pr));
+	  dns_cache_unlock (dm);
+	  return (0);
+	}
+    }
+
+re_resolve:
+  if (pool_elts (dm->entries) == dm->name_cache_size)
+    {
+      /* Will only fail if the cache is totally filled w/ static entries... */
+      rv = delete_random_entry (dm);
+      if (rv)
+	{
+	  dns_cache_unlock (dm);
+	  return rv;
+	}
+    }
+
+  /* add new hash table entry */
+  pool_get (dm->entries, ep);
+  clib_memset (ep, 0, sizeof (*ep));
+
+  ep->name = format (0, "%s%c", name, 0);
+  _vec_len (ep->name) = vec_len (ep->name) - 1;
+
+  hash_set_mem (dm->cache_entry_by_name, ep->name, ep - dm->entries);
+
+  vec_add1 (dm->unresolved_entries, ep - dm->entries);
+  vec_add2 (ep->pending_requests, pr, 1);
+
+  pr->request_type = t->request_type;
+
+  /* Remember details so we can reply later... */
+  if (t->request_type == DNS_API_PENDING_NAME_TO_IP ||
+      t->request_type == DNS_API_PENDING_IP_TO_NAME)
+    {
+      pr->client_index = t->client_index;
+      pr->client_context = t->client_context;
+    }
+  else
+    {
+      pr->client_index = ~0;
+      pr->is_ip6 = t->is_ip6;
+      pr->dst_port = t->dst_port;
+      pr->id = t->id;
+      pr->name = t->name;
+      if (t->is_ip6)
+	count = 16;
+      else
+	count = 4;
+      clib_memcpy (pr->dst_address, t->dst_address, count);
+    }
+
+  vnet_send_dns_request (dm, ep);
+  dns_cache_unlock (dm);
+  return 0;
+}
+
+#define foreach_notification_to_move            \
+_(pending_requests)
+
+/**
+ * Handle cname indirection. JFC. Called with the cache locked.
+ * returns 0 if the reply is not a CNAME.
+ */
+
+int
+vnet_dns_cname_indirection_nolock (dns_main_t * dm, u32 ep_index, u8 * reply)
+{
+  dns_header_t *h;
+  dns_query_t *qp;
+  dns_rr_t *rr;
+  u8 *curpos;
+  u8 *pos, *pos2;
+  u8 *cname_pos = 0;
+  int len, i;
+  u8 *cname = 0;
+  u8 *request = 0;
+  u8 *name_copy;
+  u32 qp_offset;
+  u16 flags;
+  u16 rcode;
+  dns_cache_entry_t *ep, *next_ep;
+  f64 now;
+
+  h = (dns_header_t *) reply;
+  flags = clib_net_to_host_u16 (h->flags);
+  rcode = flags & DNS_RCODE_MASK;
+
+  /* See if the response is OK */
+  switch (rcode)
+    {
+    case DNS_RCODE_NO_ERROR:
+      break;
+
+    case DNS_RCODE_NAME_ERROR:
+    case DNS_RCODE_FORMAT_ERROR:
+    case DNS_RCODE_SERVER_FAILURE:
+    case DNS_RCODE_NOT_IMPLEMENTED:
+    case DNS_RCODE_REFUSED:
+      return -1;
+    }
+
+  curpos = (u8 *) (h + 1);
+  pos = curpos;
+  len = *pos++;
+
+  /* Skip the questions */
+  for (i = 0; i < clib_net_to_host_u16 (h->qdcount); i++)
+    {
+      while (len)
+	{
+	  pos += len;
+	  len = *pos++;
+	}
+      pos += sizeof (dns_query_t);
+    }
+  pos2 = pos;
+  /* expect a pointer chase here for a CNAME record */
+  if ((pos2[0] & 0xC0) == 0xC0)
+    pos += 2;
+  else
+    return 0;
+
+  /* Walk the answer(s) to see what to do next */
+  for (i = 0; i < clib_net_to_host_u16 (h->anscount); i++)
+    {
+      rr = (dns_rr_t *) pos;
+      switch (clib_net_to_host_u16 (rr->type))
+	{
+	  /* Real address record? Done.. */
+	case DNS_TYPE_A:
+	case DNS_TYPE_AAAA:
+	  return 0;
+	  /*
+	   * Maybe chase a CNAME pointer?
+	   * It's not unheard-of for name-servers to return
+	   * both CNAME and A/AAAA records...
+	   */
+	case DNS_TYPE_CNAME:
+	  cname_pos = pos;
+	  break;
+
+	  /* Some other junk, e.g. a nameserver... */
+	default:
+	  break;
+	}
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      /* Skip name... */
+      if ((pos2[0] & 0xc0) == 0xc0)
+	pos += 2;
+    }
+
+  /* Neither a CNAME nor a real address. Try another server */
+  if (cname_pos == 0)
+    {
+      flags &= ~DNS_RCODE_MASK;
+      flags |= DNS_RCODE_NAME_ERROR;
+      h->flags = clib_host_to_net_u16 (flags);
+      return -1;
+    }
+
+  /* This is a CNAME record, chase the name chain. */
+  pos = cname_pos;
+
+  /* The last request is no longer pending.. */
+  for (i = 0; i < vec_len (dm->unresolved_entries); i++)
+    if (ep_index == dm->unresolved_entries[i])
+      {
+	vec_delete (dm->unresolved_entries, 1, i);
+	goto found_last_request;
+      }
+  clib_warning ("pool elt %d supposedly pending, but not found...", ep_index);
+  return -1;
+
+found_last_request:
+
+  now = vlib_time_now (dm->vlib_main);
+  cname = vnet_dns_labels_to_name (rr->rdata, reply, &pos2);
+  /* Save the cname */
+  vec_add1 (cname, 0);
+  _vec_len (cname) -= 1;
+  ep = pool_elt_at_index (dm->entries, ep_index);
+  ep->cname = cname;
+  ep->flags |= (DNS_CACHE_ENTRY_FLAG_CNAME | DNS_CACHE_ENTRY_FLAG_VALID);
+  /* Save the response */
+  if (ep->dns_response)
+    vec_free (ep->dns_response);
+  ep->dns_response = reply;
+  /* Set up expiration time */
+  ep->expiration_time = now + clib_net_to_host_u32 (rr->ttl);
+
+  pool_get (dm->entries, next_ep);
+
+  /* Need to recompute ep post pool-get */
+  ep = pool_elt_at_index (dm->entries, ep_index);
+
+  clib_memset (next_ep, 0, sizeof (*next_ep));
+  next_ep->name = vec_dup (cname);
+  vec_add1 (next_ep->name, 0);
+  _vec_len (next_ep->name) -= 1;
+
+  hash_set_mem (dm->cache_entry_by_name, next_ep->name,
+		next_ep - dm->entries);
+
+  /* Use the same server */
+  next_ep->server_rotor = ep->server_rotor;
+  next_ep->server_af = ep->server_af;
+
+  /* Move notification data to the next name in the chain */
+#define _(a) next_ep->a = ep->a; ep->a = 0;
+  foreach_notification_to_move;
+#undef _
+
+  request = name_to_labels (cname);
+  name_copy = vec_dup (request);
+
+  qp_offset = vec_len (request);
+
+  /* Add space for the query header */
+  vec_validate (request, 2 * qp_offset + 2 * sizeof (dns_query_t) - 1);
+
+  qp = (dns_query_t *) (request + qp_offset);
+
+  qp->type = clib_host_to_net_u16 (DNS_TYPE_A);
+  qp->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+  clib_memcpy (qp, name_copy, vec_len (name_copy));
+  qp = (dns_query_t *) (((u8 *) qp) + vec_len (name_copy));
+  vec_free (name_copy);
+
+  qp->type = clib_host_to_net_u16 (DNS_TYPE_AAAA);
+  qp->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+
+  /* Punch in space for the dns_header_t */
+  vec_insert (request, sizeof (dns_header_t), 0);
+
+  h = (dns_header_t *) request;
+
+  /* Transaction ID = pool index */
+  h->id = clib_host_to_net_u16 (next_ep - dm->entries);
+
+  /* Ask for a recursive lookup */
+  h->flags = clib_host_to_net_u16 (DNS_RD | DNS_OPCODE_QUERY);
+  h->qdcount = clib_host_to_net_u16 (2);
+  h->nscount = 0;
+  h->arcount = 0;
+
+  next_ep->dns_request = request;
+  next_ep->retry_timer = now + 2.0;
+  next_ep->retry_count = 0;
+
+  /*
+   * Enable this to watch recursive resolution happen...
+   * fformat (stdout, "%U", format_dns_reply, request, 2);
+   */
+
+  vec_add1 (dm->unresolved_entries, next_ep - dm->entries);
+  vnet_send_dns_request (dm, next_ep);
+  return (1);
+}
+
+int
+vnet_dns_response_to_reply (u8 * response,
+			    vl_api_dns_resolve_name_reply_t * rmp,
+			    u32 * min_ttlp)
+{
+  dns_header_t *h;
+  dns_query_t *qp;
+  dns_rr_t *rr;
+  int i, limit;
+  u8 len;
+  u8 *curpos, *pos, *pos2;
+  u16 flags;
+  u16 rcode;
+  u32 ttl;
+  int pointer_chase;
+
+  h = (dns_header_t *) response;
+  flags = clib_net_to_host_u16 (h->flags);
+  rcode = flags & DNS_RCODE_MASK;
+
+  /* See if the response is OK, etc. */
+  switch (rcode)
+    {
+    default:
+    case DNS_RCODE_NO_ERROR:
+      break;
+
+    case DNS_RCODE_NAME_ERROR:
+    case DNS_RCODE_FORMAT_ERROR:
+      return VNET_API_ERROR_NAME_SERVER_NO_SUCH_NAME;
+
+    case DNS_RCODE_SERVER_FAILURE:
+    case DNS_RCODE_NOT_IMPLEMENTED:
+    case DNS_RCODE_REFUSED:
+      return VNET_API_ERROR_NAME_SERVER_NEXT_SERVER;
+    }
+
+  /* No answers? Loser... */
+  if (clib_net_to_host_u16 (h->anscount) < 1)
+    return VNET_API_ERROR_NAME_SERVER_NO_ADDRESSES;
+
+  curpos = (u8 *) (h + 1);
+
+  /* Skip the name we asked about */
+  pos = curpos;
+  len = *pos++;
+  /* Should never happen, but stil... */
+  if ((len & 0xC0) == 0xC0)
+    curpos += 2;
+  else
+    {
+      /* skip the name / label-set */
+      while (len)
+	{
+	  pos += len;
+	  len = *pos++;
+	}
+      curpos = pos;
+    }
+  /* Skip queries */
+  limit = clib_net_to_host_u16 (h->qdcount);
+  qp = (dns_query_t *) curpos;
+  qp += limit;
+  curpos = (u8 *) qp;
+
+  /* Parse answers */
+  limit = clib_net_to_host_u16 (h->anscount);
+
+  for (i = 0; i < limit; i++)
+    {
+      pos = pos2 = curpos;
+      pointer_chase = 0;
+
+      /* Expect pointer chases in the answer section... */
+      if ((pos2[0] & 0xC0) == 0xC0)
+	{
+	  pos = pos2 + 2;
+	  pos2 = response + ((pos2[0] & 0x3f) << 8) + pos2[1];
+	  pointer_chase = 1;
+	}
+
+      len = *pos2++;
+
+      while (len)
+	{
+	  pos2 += len;
+	  if ((pos2[0] & 0xc0) == 0xc0)
+	    {
+	      /*
+	       * If we've already done one pointer chase,
+	       * do not move the pos pointer.
+	       */
+	      if (pointer_chase == 0)
+		pos = pos2 + 2;
+	      pos2 = response + ((pos2[0] & 0x3f) << 8) + pos2[1];
+	      len = *pos2++;
+	      pointer_chase = 1;
+	    }
+	  else
+	    len = *pos2++;
+	}
+
+      if (pointer_chase == 0)
+	pos = pos2;
+
+      rr = (dns_rr_t *) pos;
+
+      switch (clib_net_to_host_u16 (rr->type))
+	{
+	case DNS_TYPE_A:
+	  /* Collect an ip4 address. Do not pass go. Do not collect $200 */
+	  memcpy (rmp->ip4_address, rr->rdata, sizeof (ip4_address_t));
+	  rmp->ip4_set = 1;
+	  ttl = clib_net_to_host_u32 (rr->ttl);
+	  if (min_ttlp && *min_ttlp > ttl)
+	    *min_ttlp = ttl;
+	  break;
+	case DNS_TYPE_AAAA:
+	  /* Collect an ip6 address. Do not pass go. Do not collect $200 */
+	  memcpy (rmp->ip6_address, rr->rdata, sizeof (ip6_address_t));
+	  ttl = clib_net_to_host_u32 (rr->ttl);
+	  if (min_ttlp && *min_ttlp > ttl)
+	    *min_ttlp = ttl;
+	  rmp->ip6_set = 1;
+	  break;
+
+	default:
+	  break;
+	}
+      /* Might as well stop ASAP */
+      if (rmp->ip4_set && rmp->ip6_set)
+	break;
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      curpos = pos;
+    }
+
+  if ((rmp->ip4_set + rmp->ip6_set) == 0)
+    return VNET_API_ERROR_NAME_SERVER_NO_ADDRESSES;
+  return 0;
+}
+
+int
+vnet_dns_response_to_name (u8 * response,
+			   vl_api_dns_resolve_ip_reply_t * rmp,
+			   u32 * min_ttlp)
+{
+  dns_header_t *h;
+  dns_query_t *qp;
+  dns_rr_t *rr;
+  int i, limit;
+  u8 len;
+  u8 *curpos, *pos, *pos2;
+  u16 flags;
+  u16 rcode;
+  u8 *name;
+  u32 ttl;
+  u8 *junk __attribute__ ((unused));
+  int name_set = 0;
+  int pointer_chase;
+
+  h = (dns_header_t *) response;
+  flags = clib_net_to_host_u16 (h->flags);
+  rcode = flags & DNS_RCODE_MASK;
+
+  /* See if the response is OK, etc. */
+  switch (rcode)
+    {
+    default:
+    case DNS_RCODE_NO_ERROR:
+      break;
+
+    case DNS_RCODE_NAME_ERROR:
+    case DNS_RCODE_FORMAT_ERROR:
+      return VNET_API_ERROR_NAME_SERVER_NO_SUCH_NAME;
+
+    case DNS_RCODE_SERVER_FAILURE:
+    case DNS_RCODE_NOT_IMPLEMENTED:
+    case DNS_RCODE_REFUSED:
+      return VNET_API_ERROR_NAME_SERVER_NEXT_SERVER;
+    }
+
+  /* No answers? Loser... */
+  if (clib_net_to_host_u16 (h->anscount) < 1)
+    return VNET_API_ERROR_NAME_SERVER_NO_ADDRESSES;
+
+  curpos = (u8 *) (h + 1);
+
+  /* Skip the name we asked about */
+  pos = curpos;
+  len = *pos++;
+  /* Should never happen, but stil... */
+  if ((len & 0xC0) == 0xC0)
+    curpos += 2;
+  else
+    {
+      /* skip the name / label-set */
+      while (len)
+	{
+	  pos += len;
+	  len = *pos++;
+	}
+      curpos = pos;
+    }
+  /* Skip queries */
+  limit = clib_net_to_host_u16 (h->qdcount);
+  qp = (dns_query_t *) curpos;
+  qp += limit;
+  curpos = (u8 *) qp;
+
+  /* Parse answers */
+  limit = clib_net_to_host_u16 (h->anscount);
+
+  for (i = 0; i < limit; i++)
+    {
+      pos = pos2 = curpos;
+      pointer_chase = 0;
+
+      /* Expect pointer chases in the answer section... */
+      if ((pos2[0] & 0xC0) == 0xC0)
+	{
+	  pos = pos2 + 2;
+	  pos2 = response + ((pos2[0] & 0x3f) << 8) + pos2[1];
+	  pointer_chase = 1;
+	}
+
+      len = *pos2++;
+
+      while (len)
+	{
+	  pos2 += len;
+	  if ((pos2[0] & 0xc0) == 0xc0)
+	    {
+	      /*
+	       * If we've already done one pointer chase,
+	       * do not move the pos pointer.
+	       */
+	      if (pointer_chase == 0)
+		pos = pos2 + 2;
+	      pos2 = response + ((pos2[0] & 0x3f) << 8) + pos2[1];
+	      len = *pos2++;
+	      pointer_chase = 1;
+	    }
+	  else
+	    len = *pos2++;
+	}
+
+      if (pointer_chase == 0)
+	pos = pos2;
+
+      rr = (dns_rr_t *) pos;
+
+      switch (clib_net_to_host_u16 (rr->type))
+	{
+	case DNS_TYPE_PTR:
+	  name = vnet_dns_labels_to_name (rr->rdata, response, &junk);
+	  memcpy (rmp->name, name, vec_len (name));
+	  ttl = clib_net_to_host_u32 (rr->ttl);
+	  if (min_ttlp)
+	    *min_ttlp = ttl;
+	  rmp->name[vec_len (name)] = 0;
+	  name_set = 1;
+	  break;
+	default:
+	  break;
+	}
+      /* Might as well stop ASAP */
+      if (name_set == 1)
+	break;
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      curpos = pos;
+    }
+
+  if (name_set == 0)
+    return VNET_API_ERROR_NAME_SERVER_NO_SUCH_NAME;
+  return 0;
+}
+
+static void
+vl_api_dns_resolve_name_t_handler (vl_api_dns_resolve_name_t * mp)
+{
+  dns_main_t *dm = &dns_main;
+  vl_api_dns_resolve_name_reply_t *rmp;
+  dns_cache_entry_t *ep;
+  dns_pending_request_t _t0, *t0 = &_t0;
+  int rv;
+
+  /* Sanitize the name slightly */
+  mp->name[ARRAY_LEN (mp->name) - 1] = 0;
+
+  t0->request_type = DNS_API_PENDING_NAME_TO_IP;
+  t0->client_index = mp->client_index;
+  t0->client_context = mp->context;
+
+  rv = vnet_dns_resolve_name (dm, mp->name, t0, &ep);
+
+  /* Error, e.g. not enabled? Tell the user */
+  if (rv < 0)
+    {
+      REPLY_MACRO (VL_API_DNS_RESOLVE_NAME_REPLY);
+      return;
+    }
+
+  /* Resolution pending? Don't reply... */
+  if (ep == 0)
+    return;
+
+  /* *INDENT-OFF* */
+  REPLY_MACRO2(VL_API_DNS_RESOLVE_NAME_REPLY,
+  ({
+    rv = vnet_dns_response_to_reply (ep->dns_response, rmp, 0 /* ttl-ptr */);
+    rmp->retval = clib_host_to_net_u32 (rv);
+  }));
+  /* *INDENT-ON* */
+
+  /*
+   * dns_resolve_name leaves the cache locked when it returns
+   * a cached result, so unlock it here.
+   */
+  dns_cache_unlock (dm);
+}
+
+static void
+vl_api_dns_resolve_ip_t_handler (vl_api_dns_resolve_ip_t * mp)
+{
+  dns_main_t *dm = &dns_main;
+  vl_api_dns_resolve_ip_reply_t *rmp;
+  dns_cache_entry_t *ep;
+  int rv;
+  int i, len;
+  u8 *lookup_name = 0;
+  u8 digit, nybble;
+  dns_pending_request_t _t0, *t0 = &_t0;
+
+  if (mp->is_ip6)
+    {
+      for (i = 15; i >= 0; i--)
+	{
+	  digit = mp->address[i];
+	  nybble = (digit & 0x0F);
+	  if (nybble > 9)
+	    vec_add1 (lookup_name, (nybble - 10) + 'a');
+	  else
+	    vec_add1 (lookup_name, nybble + '0');
+	  vec_add1 (lookup_name, '.');
+	  nybble = (digit & 0xF0) >> 4;
+	  if (nybble > 9)
+	    vec_add1 (lookup_name, (nybble - 10) + 'a');
+	  else
+	    vec_add1 (lookup_name, nybble + '0');
+	  vec_add1 (lookup_name, '.');
+	}
+      len = vec_len (lookup_name);
+      vec_validate (lookup_name, len + 8);
+      memcpy (lookup_name + len, "ip6.arpa", 8);
+    }
+  else
+    {
+      for (i = 3; i >= 0; i--)
+	{
+	  digit = mp->address[i];
+	  lookup_name = format (lookup_name, "%d.", digit);
+	}
+      lookup_name = format (lookup_name, "in-addr.arpa");
+    }
+
+  vec_add1 (lookup_name, 0);
+
+  t0->request_type = DNS_API_PENDING_IP_TO_NAME;
+  t0->client_index = mp->client_index;
+  t0->client_context = mp->context;
+
+  rv = vnet_dns_resolve_name (dm, lookup_name, t0, &ep);
+
+  vec_free (lookup_name);
+
+  /* Error, e.g. not enabled? Tell the user */
+  if (rv < 0)
+    {
+      REPLY_MACRO (VL_API_DNS_RESOLVE_IP_REPLY);
+      return;
+    }
+
+  /* Resolution pending? Don't reply... */
+  if (ep == 0)
+    return;
+
+  /* *INDENT-OFF* */
+  REPLY_MACRO2(VL_API_DNS_RESOLVE_IP_REPLY,
+  ({
+    rv = vnet_dns_response_to_name (ep->dns_response, rmp, 0 /* ttl-ptr */);
+    rmp->retval = clib_host_to_net_u32 (rv);
+  }));
+  /* *INDENT-ON* */
+
+  /*
+   * vnet_dns_resolve_name leaves the cache locked when it returns
+   * a cached result, so unlock it here.
+   */
+  dns_cache_unlock (dm);
+}
+
+#define vl_msg_name_crc_list
+#include <dns/dns_all_api_h.h>
+#undef vl_msg_name_crc_list
+
+static void
+setup_message_id_table (dns_main_t * dm)
+{
+#define _(id,n,crc) \
+  vl_msg_api_add_msg_name_crc (dm->api_main, #n "_" #crc, dm->msg_id_base + id);
+  foreach_vl_msg_name_crc_dns;
+#undef _
+}
+
+#define foreach_dns_plugin_api_msg                      \
+_(DNS_ENABLE_DISABLE, dns_enable_disable)               \
+_(DNS_NAME_SERVER_ADD_DEL, dns_name_server_add_del)     \
+_(DNS_RESOLVE_NAME, dns_resolve_name)			\
+_(DNS_RESOLVE_IP, dns_resolve_ip)
+
+static clib_error_t *
+dns_config_fn (vlib_main_t * vm, unformat_input_t * input)
+{
+  dns_main_t *dm = &dns_main;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "max-cache-size %u", &dm->name_cache_size))
+	;
+      else if (unformat (input, "max-ttl %u", &dm->max_ttl_in_seconds))
+	;
+      else
+	return clib_error_return (0, "unknown input `%U'",
+				  format_unformat_error, input);
+    }
+  return 0;
+}
+
+VLIB_CONFIG_FUNCTION (dns_config_fn, "dns");
+
+uword
+unformat_dns_reply (unformat_input_t * input, va_list * args)
+{
+  u8 **result = va_arg (*args, u8 **);
+  u8 **namep = va_arg (*args, u8 **);
+  ip4_address_t a4;
+  ip6_address_t a6;
+  int a4_set = 0;
+  int a6_set = 0;
+  u8 *name;
+  int name_set = 0;
+  u8 *ce;
+  u32 qp_offset;
+  dns_header_t *h;
+  dns_query_t *qp;
+  dns_rr_t *rr;
+  u8 *rru8;
+
+  if (unformat (input, "%v", &name))
+    name_set = 1;
+
+  if (unformat (input, "%U", unformat_ip4_address, &a4))
+    {
+      a4_set = 1;
+      if (unformat (input, "%U", unformat_ip6_address, &a6))
+	a6_set = 1;
+    }
+
+  if (unformat (input, "%U", unformat_ip6_address, &a6))
+    {
+      a6_set = 1;
+      if (unformat (input, "%U", unformat_ip4_address, &a6))
+	a4_set = 1;
+    }
+
+  /* Must have a name */
+  if (!name_set)
+    return 0;
+
+  /* Must have at least one address */
+  if (!(a4_set + a6_set))
+    return 0;
+
+  /* Build a fake DNS cache entry string, one hemorrhoid at a time */
+  ce = name_to_labels (name);
+  qp_offset = vec_len (ce);
+
+  /* Add space for the query header */
+  vec_validate (ce, qp_offset + sizeof (dns_query_t) - 1);
+  qp = (dns_query_t *) (ce + qp_offset);
+
+  qp->type = clib_host_to_net_u16 (DNS_TYPE_ALL);
+  qp->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+
+  /* Punch in space for the dns_header_t */
+  vec_insert (ce, sizeof (dns_header_t), 0);
+
+  h = (dns_header_t *) ce;
+
+  /* Fake Transaction ID */
+  h->id = 0xFFFF;
+
+  h->flags = clib_host_to_net_u16 (DNS_RD | DNS_RA);
+  h->qdcount = clib_host_to_net_u16 (1);
+  h->anscount = clib_host_to_net_u16 (a4_set + a6_set);
+  h->nscount = 0;
+  h->arcount = 0;
+
+  /* Now append one or two A/AAAA RR's... */
+  if (a4_set)
+    {
+      /* Pointer to the name (DGMS) */
+      vec_add1 (ce, 0xC0);
+      vec_add1 (ce, 0x0C);
+      vec_add2 (ce, rru8, sizeof (*rr) + 4);
+      rr = (void *) rru8;
+      rr->type = clib_host_to_net_u16 (DNS_TYPE_A);
+      rr->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+      rr->ttl = clib_host_to_net_u32 (86400);
+      rr->rdlength = clib_host_to_net_u16 (4);
+      memcpy (rr->rdata, &a4, sizeof (a4));
+    }
+  if (a6_set)
+    {
+      /* Pointer to the name (DGMS) */
+      vec_add1 (ce, 0xC0);
+      vec_add1 (ce, 0x0C);
+      vec_add2 (ce, rru8, sizeof (*rr) + 16);
+      rr = (void *) rru8;
+      rr->type = clib_host_to_net_u16 (DNS_TYPE_AAAA);
+      rr->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+      rr->ttl = clib_host_to_net_u32 (86400);
+      rr->rdlength = clib_host_to_net_u16 (16);
+      memcpy (rr->rdata, &a6, sizeof (a6));
+    }
+  *result = ce;
+  if (namep)
+    *namep = name;
+  else
+    vec_free (name);
+
+  return 1;
+}
+
+u8 *
+format_dns_query (u8 * s, va_list * args)
+{
+  u8 **curpos = va_arg (*args, u8 **);
+  int verbose = va_arg (*args, int);
+  u8 *pos;
+  dns_query_t *qp;
+  int len, i;
+  if (verbose > 1)
+    s = format (s, "    Name: ");
+
+  /* Unwind execrated counted-label sheit */
+  pos = *curpos;
+  len = *pos++;
+
+  while (len)
+    {
+      for (i = 0; i < len; i++)
+	vec_add1 (s, *pos++);
+
+      len = *pos++;
+      if (len)
+	vec_add1 (s, '.');
+      else
+	{
+	  vec_add1 (s, ':');
+	  vec_add1 (s, ' ');
+	}
+    }
+
+  qp = (dns_query_t *) pos;
+  if (verbose > 1)
+    {
+      switch (clib_net_to_host_u16 (qp->type))
+	{
+	case DNS_TYPE_A:
+	  s = format (s, "type A\n");
+	  break;
+	case DNS_TYPE_AAAA:
+	  s = format (s, "type AAAA\n");
+	  break;
+	case DNS_TYPE_ALL:
+	  s = format (s, "type ALL\n");
+	  break;
+
+	default:
+	  s = format (s, "type %d\n", clib_net_to_host_u16 (qp->type));
+	  break;
+	}
+    }
+
+  pos += sizeof (*qp);
+
+  *curpos = pos;
+  return s;
+}
+
+/**
+ * format dns reply data
+ * verbose > 1, dump everything
+ * verbose == 1, dump all A and AAAA records
+ * verbose == 0, dump one A record, and one AAAA record
+ */
+
+u8 *
+format_dns_reply_data (u8 * s, va_list * args)
+{
+  u8 *reply = va_arg (*args, u8 *);
+  u8 **curpos = va_arg (*args, u8 **);
+  int verbose = va_arg (*args, int);
+  int *print_ip4 = va_arg (*args, int *);
+  int *print_ip6 = va_arg (*args, int *);
+  int len;
+  u8 *pos, *pos2;
+  dns_rr_t *rr;
+  int i;
+  int pointer_chase = 0;
+  u16 *tp;
+  u16 rrtype_host_byte_order;
+
+  pos = pos2 = *curpos;
+
+  if (verbose > 1)
+    s = format (s, "    ");
+
+  /* chase pointer? almost always yes here... */
+  if ((pos2[0] & 0xc0) == 0xc0)
+    {
+      pos = pos2 + 2;
+      pos2 = reply + ((pos2[0] & 0x3f) << 8) + pos2[1];
+      pointer_chase = 1;
+    }
+
+  len = *pos2++;
+
+  while (len)
+    {
+      for (i = 0; i < len; i++)
+	{
+	  if (verbose > 1)
+	    vec_add1 (s, *pos2);
+	  pos2++;
+	}
+      if ((pos2[0] & 0xc0) == 0xc0)
+	{
+	  /*
+	   * If we've already done one pointer chase,
+	   * do not move the pos pointer.
+	   */
+	  if (pointer_chase == 0)
+	    pos = pos2 + 2;
+	  pos2 = reply + ((pos2[0] & 0x3f) << 8) + pos2[1];
+	  len = *pos2++;
+	  pointer_chase = 1;
+	}
+      else
+	len = *pos2++;
+      if (len)
+	{
+	  if (verbose > 1)
+	    vec_add1 (s, '.');
+	}
+      else
+	{
+	  if (verbose > 1)
+	    vec_add1 (s, ' ');
+	}
+    }
+
+  if (pointer_chase == 0)
+    pos = pos2;
+
+  rr = (dns_rr_t *) pos;
+  rrtype_host_byte_order = clib_net_to_host_u16 (rr->type);
+
+  switch (rrtype_host_byte_order)
+    {
+    case DNS_TYPE_A:
+      if (verbose > 1)
+	{
+	  s = format (s, "A: ttl %d %U\n", clib_net_to_host_u32 (rr->ttl),
+		      format_ip4_address, rr->rdata);
+	}
+      else
+	{
+	  if (*print_ip4)
+	    s = format (s, "%U [%u] ", format_ip4_address, rr->rdata,
+			clib_net_to_host_u32 (rr->ttl));
+	  if (verbose == 0)
+	    *print_ip4 = 0;
+
+	}
+      pos += sizeof (*rr) + 4;
+      break;
+
+    case DNS_TYPE_AAAA:
+      if (verbose > 1)
+	{
+	  s = format (s, "AAAA: ttl %d %U\n", clib_net_to_host_u32 (rr->ttl),
+		      format_ip6_address, rr->rdata);
+	}
+      else
+	{
+	  if (*print_ip6)
+	    s = format (s, "%U [%u] ", format_ip6_address, rr->rdata,
+			clib_net_to_host_u32 (rr->ttl));
+	  if (verbose == 0)
+	    *print_ip6 = 0;
+	}
+      pos += sizeof (*rr) + 16;
+      break;
+
+    case DNS_TYPE_TEXT:
+      if (verbose > 1)
+	{
+	  s = format (s, "TEXT: ");
+	  for (i = 0; i < clib_net_to_host_u16 (rr->rdlength); i++)
+	    vec_add1 (s, rr->rdata[i]);
+	  vec_add1 (s, '\n');
+	}
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      break;
+
+    case DNS_TYPE_HINFO:
+      {
+	/* Two counted strings. DGMS */
+	u8 *len;
+	u8 *curpos;
+	int i;
+	if (verbose > 1)
+	  {
+	    s = format (s, "HINFO: ");
+	    len = rr->rdata;
+	    curpos = len + 1;
+	    for (i = 0; i < *len; i++)
+	      vec_add1 (s, *curpos++);
+
+	    vec_add1 (s, ' ');
+	    len = curpos++;
+	    for (i = 0; i < *len; i++)
+	      vec_add1 (s, *curpos++);
+
+	    vec_add1 (s, '\n');
+	  }
+      }
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      break;
+
+    case DNS_TYPE_NAMESERVER:
+      if (verbose > 1)
+	{
+	  s = format (s, "Nameserver: ");
+	  pos2 = rr->rdata;
+
+	  /* chase pointer? */
+	  if ((pos2[0] & 0xc0) == 0xc0)
+	    {
+	      pos = pos2 + 2;
+	      pos2 = reply + ((pos2[0] & 0x3f) << 8) + pos2[1];
+	    }
+
+	  len = *pos2++;
+
+	  while (len)
+	    {
+	      for (i = 0; i < len; i++)
+		vec_add1 (s, *pos2++);
+
+	      /* chase pointer, typically to offset 12... */
+	      if (pos2[0] == 0xC0)
+		pos2 = reply + pos2[1];
+
+	      len = *pos2++;
+	      if (len)
+		vec_add1 (s, '.');
+	      else
+		vec_add1 (s, '\n');
+	    }
+	}
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      break;
+
+    case DNS_TYPE_MAIL_EXCHANGE:
+      if (verbose > 1)
+	{
+	  tp = (u16 *) rr->rdata;
+
+	  s = format (s, "Mail Exchange: Preference %d ", (u32)
+		      clib_net_to_host_u16 (*tp));
+
+	  pos2 = rr->rdata + 2;
+
+	  /* chase pointer? */
+	  if (pos2[0] == 0xc0)
+	    pos2 = reply + pos2[1];
+
+	  len = *pos2++;
+
+	  while (len)
+	    {
+	      for (i = 0; i < len; i++)
+		vec_add1 (s, *pos2++);
+
+	      /* chase pointer */
+	      if (pos2[0] == 0xC0)
+		pos2 = reply + pos2[1];
+
+	      len = *pos2++;
+	      if (len)
+		vec_add1 (s, '.');
+	      else
+		vec_add1 (s, '\n');
+	    }
+	}
+
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      break;
+
+    case DNS_TYPE_PTR:
+    case DNS_TYPE_CNAME:
+      if (verbose > 1)
+	{
+	  tp = (u16 *) rr->rdata;
+
+	  if (rrtype_host_byte_order == DNS_TYPE_CNAME)
+	    s = format (s, "CNAME: ");
+	  else
+	    s = format (s, "PTR: ");
+
+	  pos2 = rr->rdata;
+
+	  /* chase pointer? */
+	  if (pos2[0] == 0xc0)
+	    pos2 = reply + pos2[1];
+
+	  len = *pos2++;
+
+	  while (len)
+	    {
+	      for (i = 0; i < len; i++)
+		vec_add1 (s, *pos2++);
+
+	      /* chase pointer */
+	      if (pos2[0] == 0xC0)
+		pos2 = reply + pos2[1];
+
+	      len = *pos2++;
+	      if (len)
+		vec_add1 (s, '.');
+	      else
+		vec_add1 (s, '\n');
+	    }
+	}
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      break;
+
+    default:
+      if (verbose > 1)
+	s = format (s, "type %d: len %d\n",
+		    (int) clib_net_to_host_u16 (rr->type),
+		    sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength));
+      pos += sizeof (*rr) + clib_net_to_host_u16 (rr->rdlength);
+      break;
+    }
+
+  *curpos = pos;
+
+  return s;
+}
+
+u8 *
+format_dns_reply (u8 * s, va_list * args)
+{
+  u8 *reply_as_u8 = va_arg (*args, u8 *);
+  int verbose = va_arg (*args, int);
+  dns_header_t *h;
+  u16 id, flags;
+  u8 *curpos;
+  int i;
+  int print_ip4 = 1;
+  int print_ip6 = 1;
+
+  h = (dns_header_t *) reply_as_u8;
+  id = clib_net_to_host_u16 (h->id);
+  flags = clib_net_to_host_u16 (h->flags);
+
+  if (verbose > 1)
+    {
+      s = format (s, "DNS %s: id %d\n", (flags & DNS_QR) ? "reply" : "query",
+		  id);
+      s = format (s, "  %s %s %s %s\n",
+		  (flags & DNS_RA) ? "recur" : "no-recur",
+		  (flags & DNS_RD) ? "recur-des" : "no-recur-des",
+		  (flags & DNS_TC) ? "trunc" : "no-trunc",
+		  (flags & DNS_AA) ? "auth" : "non-auth");
+      s = format (s, "  %d queries, %d answers, %d name-servers,"
+		  " %d add'l recs\n",
+		  clib_net_to_host_u16 (h->qdcount),
+		  clib_net_to_host_u16 (h->anscount),
+		  clib_net_to_host_u16 (h->nscount),
+		  clib_net_to_host_u16 (h->arcount));
+    }
+
+  curpos = (u8 *) (h + 1);
+
+  if (h->qdcount)
+    {
+      if (verbose > 1)
+	s = format (s, "  Queries:\n");
+      for (i = 0; i < clib_net_to_host_u16 (h->qdcount); i++)
+	{
+	  /* The query is variable-length, so curpos is a value-result parm */
+	  s = format (s, "%U", format_dns_query, &curpos, verbose);
+	}
+    }
+  if (h->anscount)
+    {
+      if (verbose > 1)
+	s = format (s, "  Replies:\n");
+
+      for (i = 0; i < clib_net_to_host_u16 (h->anscount); i++)
+	{
+	  /* curpos is a value-result parm */
+	  s = format (s, "%U", format_dns_reply_data, reply_as_u8, &curpos,
+		      verbose, &print_ip4, &print_ip6);
+	}
+    }
+  return s;
+}
+
+u8 *
+format_dns_cache (u8 * s, va_list * args)
+{
+  dns_main_t *dm = va_arg (*args, dns_main_t *);
+  f64 now = va_arg (*args, f64);
+  int verbose = va_arg (*args, int);
+  u8 *name = va_arg (*args, u8 *);
+  dns_cache_entry_t *ep;
+  char *ss;
+  uword *p;
+
+  if (dm->is_enabled == 0)
+    {
+      s = format (s, "The DNS cache is disabled...");
+      return s;
+    }
+
+  if (pool_elts (dm->entries) == 0)
+    {
+      s = format (s, "The DNS cache is empty...");
+      return s;
+    }
+
+  dns_cache_lock (dm, 6);
+
+  if (name)
+    {
+      p = hash_get_mem (dm->cache_entry_by_name, name);
+      if (!p)
+	{
+	  s = format (s, "%s is not in the cache...", name);
+	  dns_cache_unlock (dm);
+	  return (s);
+	}
+
+      ep = pool_elt_at_index (dm->entries, p[0]);
+      /* Magic to spit out a C-initializer to research hemorrhoids... */
+      if (verbose == 3)
+	{
+	  int i, j;
+	  s = format (s, "static u8 dns_reply_data_initializer[] =\n");
+	  s = format (s, "{\n");
+	  j = 0;
+	  for (i = 0; i < vec_len (ep->dns_response); i++)
+	    {
+	      if (j++ == 8)
+		{
+		  j = 0;
+		  vec_add1 (s, '\n');
+		}
+	      s = format (s, "0x%02x, ", ep->dns_response[i]);
+	    }
+	  s = format (s, "};\n");
+	}
+      else
+	{
+	  if (ep->flags & DNS_CACHE_ENTRY_FLAG_VALID)
+	    {
+	      ASSERT (ep->dns_response);
+	      if (ep->flags & DNS_CACHE_ENTRY_FLAG_STATIC)
+		ss = "[S] ";
+	      else
+		ss = "    ";
+
+	      if (verbose < 2 && ep->flags & DNS_CACHE_ENTRY_FLAG_CNAME)
+		s = format (s, "%s%s -> %s", ss, ep->name, ep->cname);
+	      else
+		s = format (s, "%s%s -> %U", ss, ep->name,
+			    format_dns_reply, ep->dns_response, verbose);
+	      if (!(ep->flags & DNS_CACHE_ENTRY_FLAG_STATIC))
+		{
+		  f64 time_left = ep->expiration_time - now;
+		  if (time_left > 0.0)
+		    s = format (s, "  TTL left %.1f", time_left);
+		  else
+		    s = format (s, "  EXPIRED");
+		}
+	    }
+	  else
+	    {
+	      ASSERT (ep->dns_request);
+	      s = format (s, "[P] %U", format_dns_reply, ep->dns_request,
+			  verbose);
+	    }
+	  vec_add1 (s, '\n');
+	}
+      return s;
+    }
+
+  s = format (s, "DNS cache contains %d entries\n", pool_elts (dm->entries));
+
+  if (verbose > 0)
+    {
+      /* *INDENT-OFF* */
+      pool_foreach (ep, dm->entries,
+      ({
+        if (ep->flags & DNS_CACHE_ENTRY_FLAG_VALID)
+          {
+            ASSERT (ep->dns_response);
+            if (ep->flags & DNS_CACHE_ENTRY_FLAG_STATIC)
+              ss = "[S] ";
+            else
+              ss = "    ";
+
+            if (verbose < 2 && ep->flags & DNS_CACHE_ENTRY_FLAG_CNAME)
+              s = format (s, "%s%s -> %s", ss, ep->name, ep->cname);
+            else
+              s = format (s, "%s%s -> %U", ss, ep->name,
+                          format_dns_reply,
+                          ep->dns_response,
+                          verbose);
+            if (!(ep->flags & DNS_CACHE_ENTRY_FLAG_STATIC))
+              {
+                f64 time_left = ep->expiration_time - now;
+                if (time_left > 0.0)
+                  s = format (s, "  TTL left %.1f", time_left);
+                else
+                  s = format (s, "  EXPIRED");
+
+                if (verbose > 2)
+                  s = format (s, "    %d client notifications pending\n",
+                              vec_len(ep->pending_requests));
+              }
+          }
+        else
+          {
+            ASSERT (ep->dns_request);
+            s = format (s, "[P] %U", format_dns_reply, ep->dns_request,
+                        verbose);
+          }
+        vec_add1 (s, '\n');
+      }));
+      /* *INDENT-ON* */
+    }
+
+  dns_cache_unlock (dm);
+
+  return s;
+}
+
+static clib_error_t *
+show_dns_cache_command_fn (vlib_main_t * vm,
+			   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  dns_main_t *dm = &dns_main;
+  int verbose = 0;
+  u8 *name = 0;
+  f64 now = vlib_time_now (vm);
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "verbose %d", &verbose))
+	;
+      else if (unformat (input, "verbose"))
+	verbose = 1;
+      else if (unformat (input, "name %s", &name))
+	;
+      else
+	return clib_error_return (0, "unknown input `%U'",
+				  format_unformat_error, input);
+    }
+
+  vlib_cli_output (vm, "%U", format_dns_cache, dm, now, verbose, name);
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_dns_cache_command) =
+{
+  .path = "show dns cache",
+  .short_help = "show dns cache [verbose [nn]]",
+  .function = show_dns_cache_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+show_dns_servers_command_fn (vlib_main_t * vm,
+			     unformat_input_t * input,
+			     vlib_cli_command_t * cmd)
+{
+  dns_main_t *dm = &dns_main;
+  int i;
+
+  if ((vec_len (dm->ip4_name_servers) + vec_len (dm->ip6_name_servers)) == 0)
+    return clib_error_return (0, "No name servers configured...");
+
+  if (vec_len (dm->ip4_name_servers))
+    {
+      vlib_cli_output (vm, "ip4 name servers:");
+      for (i = 0; i < vec_len (dm->ip4_name_servers); i++)
+	vlib_cli_output (vm, "%U", format_ip4_address,
+			 dm->ip4_name_servers + i);
+    }
+  if (vec_len (dm->ip6_name_servers))
+    {
+      vlib_cli_output (vm, "ip6 name servers:");
+      for (i = 0; i < vec_len (dm->ip6_name_servers); i++)
+	vlib_cli_output (vm, "%U", format_ip6_address,
+			 dm->ip4_name_servers + i);
+    }
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (show_dns_server_command) =
+{
+  .path = "show dns servers",
+  .short_help = "show dns servers",
+  .function = show_dns_servers_command_fn,
+};
+/* *INDENT-ON* */
+
+
+static clib_error_t *
+dns_cache_add_del_command_fn (vlib_main_t * vm,
+			      unformat_input_t * input,
+			      vlib_cli_command_t * cmd)
+{
+  dns_main_t *dm = &dns_main;
+  u8 *dns_reply_data;
+  u8 *name;
+  int is_add = -1;
+  int is_clear = -1;
+  int rv;
+  clib_error_t *error;
+
+  if (unformat (input, "add"))
+    is_add = 1;
+  if (unformat (input, "del"))
+    is_add = 0;
+  if (unformat (input, "clear"))
+    is_clear = 1;
+
+  if (is_add == -1 && is_clear == -1)
+    return clib_error_return (0, "add / del / clear required...");
+
+  if (is_clear == 1)
+    {
+      rv = dns_cache_clear (dm);
+      switch (rv)
+	{
+	case 0:
+	  return 0;
+
+	case VNET_API_ERROR_NAME_RESOLUTION_NOT_ENABLED:
+	  error = clib_error_return (0, "Name resolution not enabled");
+	  return error;
+	}
+    }
+
+  /* Delete (by name)? */
+  if (is_add == 0)
+    {
+      if (unformat (input, "%v", &name))
+	{
+	  rv = dns_delete_by_name (dm, name);
+	  switch (rv)
+	    {
+	    case VNET_API_ERROR_NO_SUCH_ENTRY:
+	      error = clib_error_return (0, "%v not in the cache...", name);
+	      vec_free (name);
+	      return error;
+
+	    case VNET_API_ERROR_NAME_RESOLUTION_NOT_ENABLED:
+	      error = clib_error_return (0, "Name resolution not enabled");
+	      vec_free (name);
+	      return error;
+
+	    case 0:
+	      vec_free (name);
+	      return 0;
+
+	    default:
+	      error = clib_error_return (0, "dns_delete_by_name returned %d",
+					 rv);
+	      vec_free (name);
+	      return error;
+	    }
+	}
+      return clib_error_return (0, "unknown input `%U'",
+				format_unformat_error, input);
+    }
+
+  /* Note: dns_add_static_entry consumes the name vector if OK... */
+  if (unformat (input, "%U", unformat_dns_reply, &dns_reply_data, &name))
+    {
+      rv = dns_add_static_entry (dm, name, dns_reply_data);
+      switch (rv)
+	{
+	case VNET_API_ERROR_ENTRY_ALREADY_EXISTS:
+	  vec_free (name);
+	  vec_free (dns_reply_data);
+	  return clib_error_return (0, "%v already in the cache...", name);
+	case 0:
+	  return 0;
+
+	default:
+	  return clib_error_return (0, "dns_add_static_entry returned %d",
+				    rv);
+	}
+    }
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (dns_cache_add_del_command) =
+{
+  .path = "dns cache",
+  .short_help = "dns cache [add|del|clear] <name> [ip4][ip6]",
+  .function = dns_cache_add_del_command_fn,
+};
+/* *INDENT-ON* */
+
+#define DNS_FORMAT_TEST 1
+
+#if DNS_FORMAT_TEST > 0
+#if 0
+/* yahoo.com */
+static u8 dns_reply_data_initializer[] =
+  { 0x0, 0x0, 0x81, 0x80, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5,
+  0x79, 0x61, 0x68, 0x6f, 0x6f, 0x3, 0x63, 0x6f, 0x6d,
+  0x0,				/* null lbl */
+  0x0, 0xff,			/* type ALL */
+  0x0, 0x1,			/* class IN */
+  0xc0, 0xc,			/* pointer to yahoo.com name */
+  0x0, 0x10, 0x0, 0x1, 0x0, 0x0, 0x6, 0x5c, 0x0, 0x24, 0x23,
+  0x76, 0x3d, 0x73, 0x70, 0x66, 0x31, 0x20, 0x72, 0x65, 0x64, 0x69, 0x72,
+  0x65, 0x63, 0x74, 0x3d, 0x5f, 0x73, 0x70, 0x66, 0x2e, 0x6d, 0x61, 0x69,
+  0x6c, 0x2e, 0x79, 0x61, 0x68, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0xc0,
+  0xc, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x50, 0xd4, 0x0, 0x6, 0x3, 0x6e, 0x73,
+  0x35, 0xc0, 0xc, 0xc0, 0xc, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x50, 0xd4, 0x0,
+  0x6, 0x3, 0x6e, 0x73, 0x34, 0xc0, 0xc, 0xc0, 0xc, 0x0, 0x2, 0x0, 0x1, 0x0,
+  0x1, 0x50, 0xd4, 0x0, 0x6, 0x3, 0x6e, 0x73, 0x31, 0xc0, 0xc, 0xc0, 0xc,
+  0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x50, 0xd4, 0x0, 0x6, 0x3, 0x6e, 0x73, 0x32,
+  0xc0, 0xc, 0xc0, 0xc, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x50, 0xd4, 0x0, 0x6,
+  0x3, 0x6e, 0x73, 0x33, 0xc0, 0xc, 0xc0, 0xc, 0x0, 0xf, 0x0, 0x1, 0x0, 0x0,
+  0x6, 0x5c, 0x0, 0x19, 0x0, 0x1, 0x4, 0x6d, 0x74, 0x61, 0x36, 0x3, 0x61,
+  0x6d, 0x30, 0x8, 0x79, 0x61, 0x68, 0x6f, 0x6f, 0x64, 0x6e, 0x73, 0x3,
+  0x6e,
+  0x65, 0x74, 0x0, 0xc0, 0xc, 0x0, 0xf, 0x0, 0x1, 0x0, 0x0, 0x6, 0x5c, 0x0,
+  0x9, 0x0, 0x1, 0x4, 0x6d, 0x74, 0x61, 0x37, 0xc0, 0xb8, 0xc0, 0xc, 0x0,
+  0xf, 0x0, 0x1, 0x0, 0x0, 0x6, 0x5c, 0x0, 0x9, 0x0, 0x1, 0x4, 0x6d, 0x74,
+  0x61, 0x35, 0xc0, 0xb8, 0xc0, 0xc, 0x0, 0x1c, 0x0, 0x1, 0x0, 0x0, 0x6,
+  0x5c, 0x0, 0x10, 0x20, 0x1, 0x49, 0x98, 0x0, 0x44, 0x2, 0x4, 0x0, 0x0,
+  0x0,
+  0x0, 0x0, 0x0, 0x0, 0xa7, 0xc0, 0xc, 0x0, 0x1c, 0x0, 0x1, 0x0, 0x0, 0x6,
+  0x5c, 0x0, 0x10, 0x20, 0x1, 0x49, 0x98, 0x0, 0xc, 0xa, 0x6, 0x0, 0x0, 0x0,
+  0x0, 0x0, 0x2, 0x40, 0x8, 0xc0, 0xc, 0x0, 0x1c, 0x0, 0x1, 0x0, 0x0, 0x6,
+  0x5c, 0x0, 0x10, 0x20, 0x1, 0x49, 0x98, 0x0, 0x58, 0xc, 0x2, 0x0, 0x0,
+  0x0,
+  0x0, 0x0, 0x0, 0x0, 0xa9, 0xc0, 0xc, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x6,
+  0x5c, 0x0, 0x4, 0x62, 0x8a, 0xfd, 0x6d, 0xc0, 0xc, 0x0, 0x1, 0x0, 0x1,
+  0x0,
+  0x0, 0x6, 0x5c, 0x0, 0x4, 0xce, 0xbe, 0x24, 0x2d, 0xc0, 0xc, 0x0, 0x1,
+  0x0,
+  0x1, 0x0, 0x0, 0x6, 0x5c, 0x0, 0x4, 0x62, 0x8b, 0xb4, 0x95, 0xc0, 0xc,
+  0x0,
+  0x6, 0x0, 0x1, 0x0, 0x0, 0x6, 0x5c, 0x0, 0x2d, 0xc0, 0x7b, 0xa, 0x68,
+  0x6f,
+  0x73, 0x74, 0x6d, 0x61, 0x73, 0x74, 0x65, 0x72, 0x9, 0x79, 0x61, 0x68,
+  0x6f, 0x6f, 0x2d, 0x69, 0x6e, 0x63, 0xc0, 0x12, 0x78, 0x3a, 0x85, 0x44,
+  0x0, 0x0, 0xe, 0x10, 0x0, 0x0, 0x1, 0x2c, 0x0, 0x1b, 0xaf, 0x80, 0x0, 0x0,
+  0x2, 0x58
+};
+
+/* www.cisco.com, has no addresses in reply */
+static u8 dns_reply_data_initializer[] = {
+  0x00, 0x01, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01,
+  0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x05,
+  0x63, 0x69, 0x73, 0x63, 0x6f, 0x03, 0x63, 0x6f, 0x6d,
+
+  0x00, 0x00, 0xff, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05,
+  0x00, 0x01, 0x00, 0x00, 0x0b, 0xd3, 0x00, 0x1a, 0x03,
+  0x77, 0x77, 0x77, 0x05, 0x63, 0x69, 0x73, 0x63, 0x6f,
+  0x03, 0x63, 0x6f, 0x6d, 0x06, 0x61, 0x6b, 0x61, 0x64,
+  0x6e, 0x73, 0x03, 0x6e, 0x65, 0x74, 0x00,
+};
+
+/* bind8 (linux widget, w/ nasty double pointer chasees */
+static u8 dns_reply_data_initializer[] = {
+  /* 0 */
+  0x00, 0x01, 0x81, 0x80, 0x00, 0x01, 0x00, 0x08,
+  /* 8 */
+  0x00, 0x06, 0x00, 0x06, 0x0a, 0x6f, 0x72, 0x69,
+  /* 16 */
+  0x67, 0x69, 0x6e, 0x2d, 0x77, 0x77, 0x77, 0x05,
+  /* 24 */
+  0x63, 0x69, 0x73, 0x63, 0x6f, 0x03, 0x63, 0x6f,
+  /* 32 */
+  0x6d, 0x00, 0x00, 0xff, 0x00, 0x01, 0x0a, 0x6f,
+  /* 40 */
+  0x72, 0x69, 0x67, 0x69, 0x6e, 0x2d, 0x77, 0x77,
+  /* 48 */
+  0x77, 0x05, 0x43, 0x49, 0x53, 0x43, 0x4f, 0xc0,
+
+  /* 56 */
+  0x1d, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x05,
+
+  /* 64 */
+  0x9a, 0x00, 0x18, 0x15, 0x72, 0x63, 0x64,
+  0x6e, 0x39, 0x2d, 0x31, 0x34, 0x70, 0x2d, 0x64, 0x63,
+  0x7a, 0x30, 0x35, 0x6e, 0x2d, 0x67, 0x73, 0x73, 0x31,
+  0xc0, 0x17, 0xc0, 0x26, 0x00, 0x02, 0x00, 0x01, 0x00,
+  0x00, 0x05, 0x9a, 0x00, 0x1a, 0x17, 0x61, 0x6c, 0x6c,
+  0x6e, 0x30, 0x31, 0x2d, 0x61, 0x67, 0x30, 0x39, 0x2d,
+  0x64, 0x63, 0x7a, 0x30, 0x33, 0x6e, 0x2d, 0x67, 0x73,
+  0x73, 0x31, 0xc0, 0x17, 0xc0, 0x26, 0x00, 0x02, 0x00,
+  0x01, 0x00, 0x00, 0x05, 0x9a, 0x00, 0x10, 0x0d, 0x72,
+  0x74, 0x70, 0x35, 0x2d, 0x64, 0x6d, 0x7a, 0x2d, 0x67,
+  0x73, 0x73, 0x31, 0xc0, 0x17, 0xc0, 0x26, 0x00, 0x02,
+  0x00, 0x01, 0x00, 0x00, 0x05, 0x9a, 0x00, 0x18, 0x15,
+  0x6d, 0x74, 0x76, 0x35, 0x2d, 0x61, 0x70, 0x31, 0x30,
+  0x2d, 0x64, 0x63, 0x7a, 0x30, 0x36, 0x6e, 0x2d, 0x67,
+  0x73, 0x73, 0x31, 0xc0, 0x17, 0xc0, 0x26, 0x00, 0x02,
+  0x00, 0x01, 0x00, 0x00, 0x05, 0x9a, 0x00, 0x1b, 0x18,
+  0x73, 0x6e, 0x67, 0x64, 0x63, 0x30, 0x31, 0x2d, 0x61,
+  0x62, 0x30, 0x37, 0x2d, 0x64, 0x63, 0x7a, 0x30, 0x31,
+  0x6e, 0x2d, 0x67, 0x73, 0x73, 0x31, 0xc0, 0x17, 0xc0,
+  0x26, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x05, 0x9a,
+  0x00, 0x1a, 0x17, 0x61, 0x65, 0x72, 0x30, 0x31, 0x2d,
+  0x72, 0x34, 0x63, 0x32, 0x35, 0x2d, 0x64, 0x63, 0x7a,
+  0x30, 0x31, 0x6e, 0x2d, 0x67, 0x73, 0x73, 0x31, 0xc0,
+  0x17, 0xc0, 0x26, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+  0x00, 0x81, 0x00, 0x04, 0x48, 0xa3, 0x04, 0xa1, 0xc0,
+  0x26, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x00, 0x82,
+  0x00, 0x10, 0x20, 0x01, 0x04, 0x20, 0x12, 0x01, 0x00,
+  0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a,
+  0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x05,
+  0x9a, 0x00, 0x02, 0xc0, 0xf4, 0xc0, 0x0c, 0x00, 0x02,
+  0x00, 0x01, 0x00, 0x00, 0x05, 0x9a, 0x00, 0x02, 0xc0,
+  0xcd, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00,
+  0x05, 0x9a, 0x00, 0x02, 0xc0, 0x8d, 0xc0, 0x0c, 0x00,
+  0x02, 0x00, 0x01, 0x00, 0x00, 0x05, 0x9a, 0x00, 0x02,
+  0xc0, 0x43, 0xc0, 0x0c, 0x00, 0x02, 0x00, 0x01, 0x00,
+  0x00, 0x05, 0x9a, 0x00, 0x02, 0xc0, 0xa9, 0xc0, 0x0c,
+  0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x05, 0x9a, 0x00,
+  0x02, 0xc0, 0x67, 0xc0, 0x8d, 0x00, 0x01, 0x00, 0x01,
+  0x00, 0x00, 0x07, 0x08, 0x00, 0x04, 0x40, 0x66, 0xf6,
+  0x05, 0xc0, 0xa9, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00,
+  0x07, 0x08, 0x00, 0x04, 0xad, 0x24, 0xe0, 0x64, 0xc0,
+  0x43, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x07, 0x08,
+  0x00, 0x04, 0x48, 0xa3, 0x04, 0x1c, 0xc0, 0xf4, 0x00,
+  0x01, 0x00, 0x01, 0x00, 0x00, 0x07, 0x08, 0x00, 0x04,
+  0xad, 0x26, 0xd4, 0x6c, 0xc0, 0x67, 0x00, 0x01, 0x00,
+  0x01, 0x00, 0x00, 0x07, 0x08, 0x00, 0x04, 0xad, 0x25,
+  0x90, 0x64, 0xc0, 0xcd, 0x00, 0x01, 0x00, 0x01, 0x00,
+  0x00, 0x07, 0x08, 0x00, 0x04, 0xad, 0x27, 0x70, 0x44,
+};
+
+/* google.com */
+static u8 dns_reply_data_initializer[] =
+  { 0x0, 0x0, 0x81, 0x80, 0x0, 0x1, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x6,
+  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x3, 0x63, 0x6f, 0x6d, 0x0, 0x0, 0xff,
+  0x0, 0x1, 0xc0, 0xc, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x2b, 0x0, 0x4,
+  0xac, 0xd9, 0x3, 0x2e, 0xc0, 0xc, 0x0, 0x1c, 0x0, 0x1, 0x0, 0x0, 0x1,
+  0x2b,
+  0x0, 0x10, 0x26, 0x7, 0xf8, 0xb0, 0x40, 0x4, 0x8, 0xf, 0x0, 0x0, 0x0, 0x0,
+  0x0, 0x0, 0x20, 0xe, 0xc0, 0xc, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x51, 0x7f,
+  0x0, 0x6, 0x3, 0x6e, 0x73, 0x31, 0xc0, 0xc, 0xc0, 0xc, 0x0, 0x6, 0x0, 0x1,
+  0x0, 0x0, 0x0, 0x3b, 0x0, 0x22, 0xc0, 0x54, 0x9, 0x64, 0x6e, 0x73, 0x2d,
+  0x61, 0x64, 0x6d, 0x69, 0x6e, 0xc0, 0xc, 0xa, 0x3d, 0xc7, 0x30, 0x0, 0x0,
+  0x3, 0x84, 0x0, 0x0, 0x3, 0x84, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x3c,
+  0xc0, 0xc, 0x0, 0xf, 0x0, 0x1, 0x0, 0x0, 0x2, 0x57, 0x0, 0x11, 0x0, 0x1e,
+  0x4, 0x61, 0x6c, 0x74, 0x32, 0x5, 0x61, 0x73, 0x70, 0x6d, 0x78, 0x1, 0x6c,
+  0xc0, 0xc, 0xc0, 0xc, 0x0, 0xf, 0x0, 0x1, 0x0, 0x0, 0x2, 0x57, 0x0, 0x4,
+  0x0, 0xa, 0xc0, 0x9b, 0xc0, 0xc, 0x0, 0x10, 0x0, 0x1, 0x0, 0x0, 0xe, 0xf,
+  0x0, 0x24, 0x23, 0x76, 0x3d, 0x73, 0x70, 0x66, 0x31, 0x20, 0x69, 0x6e,
+  0x63, 0x6c, 0x75, 0x64, 0x65, 0x3a, 0x5f, 0x73, 0x70, 0x66, 0x2e, 0x67,
+  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x7e, 0x61,
+  0x6c, 0x6c, 0xc0, 0xc, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1, 0x51, 0x7f, 0x0, 0x6,
+  0x3, 0x6e, 0x73, 0x32, 0xc0, 0xc, 0xc0, 0xc, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1,
+  0x51, 0x7f, 0x0, 0xf, 0x0, 0x5, 0x69, 0x73, 0x73, 0x75, 0x65, 0x70, 0x6b,
+  0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0xc0, 0xc, 0x0, 0x2, 0x0, 0x1, 0x0,
+  0x1, 0x51, 0x7f, 0x0, 0x6, 0x3, 0x6e, 0x73, 0x34, 0xc0, 0xc, 0xc0, 0xc,
+  0x0, 0xf, 0x0, 0x1, 0x0, 0x0, 0x2, 0x57, 0x0, 0x9, 0x0, 0x28, 0x4, 0x61,
+  0x6c, 0x74, 0x33, 0xc0, 0x9b, 0xc0, 0xc, 0x0, 0x2, 0x0, 0x1, 0x0, 0x1,
+  0x51, 0x7f, 0x0, 0x6, 0x3, 0x6e, 0x73, 0x33, 0xc0, 0xc, 0xc0, 0xc, 0x0,
+  0xf, 0x0, 0x1, 0x0, 0x0, 0x2, 0x57, 0x0, 0x9, 0x0, 0x32, 0x4, 0x61, 0x6c,
+  0x74, 0x34, 0xc0, 0x9b, 0xc0, 0xc, 0x0, 0xf, 0x0, 0x1, 0x0, 0x0, 0x2,
+  0x57,
+  0x0, 0x9, 0x0, 0x14, 0x4, 0x61, 0x6c, 0x74, 0x31, 0xc0, 0x9b
+};
+
+#else
+/* www.weatherlink.com */
+static u8 dns_reply_data_initializer[] = {
+  0x00, 0x00, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01,
+  0x00, 0x00, 0x00, 0x00, 0x03, 0x77, 0x77, 0x77, 0x0b,
+  0x77, 0x65, 0x61, 0x74, 0x68, 0x65, 0x72, 0x6c, 0x69,
+  0x6e, 0x6b, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0xff,
+  0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00,
+  0x00, 0x0c, 0x9e, 0x00, 0x1f, 0x0e, 0x64, 0x33, 0x6b,
+  0x72, 0x30, 0x67, 0x75, 0x62, 0x61, 0x31, 0x64, 0x76,
+  0x77, 0x66, 0x0a, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x66,
+  0x72, 0x6f, 0x6e, 0x74, 0x03, 0x6e, 0x65, 0x74, 0x00,
+};
+
+#endif
+
+static clib_error_t *
+test_dns_fmt_command_fn (vlib_main_t * vm,
+			 unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  u8 *dns_reply_data = 0;
+  int verbose = 0;
+  int rv;
+  vl_api_dns_resolve_name_reply_t _rm, *rmp = &_rm;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "verbose %d", &verbose))
+	;
+      else if (unformat (input, "verbose"))
+	verbose = 1;
+      else
+	return clib_error_return (0, "unknown input `%U'",
+				  format_unformat_error, input);
+    }
+
+  vec_validate (dns_reply_data, ARRAY_LEN (dns_reply_data_initializer) - 1);
+
+  memcpy (dns_reply_data, dns_reply_data_initializer,
+	  ARRAY_LEN (dns_reply_data_initializer));
+
+  vlib_cli_output (vm, "%U", format_dns_reply, dns_reply_data, verbose);
+
+  clib_memset (rmp, 0, sizeof (*rmp));
+
+  rv = vnet_dns_response_to_reply (dns_reply_data, rmp, 0 /* ttl-ptr */ );
+
+  switch (rv)
+    {
+    case VNET_API_ERROR_NAME_SERVER_NO_ADDRESSES:
+      vlib_cli_output (vm, "no addresses found...");
+      break;
+
+    default:
+      vlib_cli_output (vm, "response to reply returned %d", rv);
+      break;
+
+    case 0:
+      if (rmp->ip4_set)
+	vlib_cli_output (vm, "ip4 address: %U", format_ip4_address,
+			 (ip4_address_t *) rmp->ip4_address);
+      if (rmp->ip6_set)
+	vlib_cli_output (vm, "ip6 address: %U", format_ip6_address,
+			 (ip6_address_t *) rmp->ip6_address);
+      break;
+    }
+
+  vec_free (dns_reply_data);
+
+  return 0;
+}
+
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (test_dns_fmt_command) =
+{
+  .path = "test dns format",
+  .short_help = "test dns format",
+  .function = test_dns_fmt_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+test_dns_unfmt_command_fn (vlib_main_t * vm,
+			   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  u8 *dns_reply_data = 0;
+  int verbose = 0;
+  int reply_set = 0;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "verbose %d", &verbose))
+	;
+      else if (unformat (input, "verbose"))
+	verbose = 1;
+      else if (unformat (input, "%U", unformat_dns_reply, &dns_reply_data))
+	reply_set = 1;
+      else
+	return clib_error_return (0, "unknown input `%U'",
+				  format_unformat_error, input);
+    }
+
+  if (reply_set == 0)
+    return clib_error_return (0, "dns data not set...");
+
+  vlib_cli_output (vm, "%U", format_dns_reply, dns_reply_data, verbose);
+
+  vec_free (dns_reply_data);
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (test_dns_unfmt_command) =
+{
+  .path = "test dns unformat",
+  .short_help = "test dns unformat <name> [ip4][ip6]",
+  .function = test_dns_unfmt_command_fn,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+test_dns_expire_command_fn (vlib_main_t * vm,
+			    unformat_input_t * input,
+			    vlib_cli_command_t * cmd)
+{
+  dns_main_t *dm = &dns_main;
+  u8 *name = 0;
+  uword *p;
+  clib_error_t *e;
+  dns_cache_entry_t *ep;
+
+  if (unformat (input, "%v", &name))
+    {
+      vec_add1 (name, 0);
+      _vec_len (name) -= 1;
+    }
+  else
+    return clib_error_return (0, "no name provided");
+
+  dns_cache_lock (dm, 7);
+
+  p = hash_get_mem (dm->cache_entry_by_name, name);
+  if (!p)
+    {
+      dns_cache_unlock (dm);
+      e = clib_error_return (0, "%s is not in the cache...", name);
+      vec_free (name);
+      return e;
+    }
+
+  ep = pool_elt_at_index (dm->entries, p[0]);
+
+  ep->expiration_time = 0;
+
+  return 0;
+}
+
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (test_dns_expire_command) =
+{
+  .path = "test dns expire",
+  .short_help = "test dns expire <name>",
+  .function = test_dns_expire_command_fn,
+};
+/* *INDENT-ON* */
+#endif
+
+void
+vnet_send_dns6_reply (dns_main_t * dm, dns_pending_request_t * pr,
+		      dns_cache_entry_t * ep, vlib_buffer_t * b0)
+{
+  clib_warning ("Unimplemented...");
+}
+
+
+void
+vnet_send_dns4_reply (dns_main_t * dm, dns_pending_request_t * pr,
+		      dns_cache_entry_t * ep, vlib_buffer_t * b0)
+{
+  vlib_main_t *vm = dm->vlib_main;
+  u32 bi = 0;
+  fib_prefix_t prefix;
+  fib_node_index_t fei;
+  u32 sw_if_index, fib_index;
+  ip4_main_t *im4 = &ip4_main;
+  ip_lookup_main_t *lm4 = &im4->lookup_main;
+  ip_interface_address_t *ia = 0;
+  ip4_address_t *src_address;
+  ip4_header_t *ip;
+  udp_header_t *udp;
+  dns_header_t *dh;
+  vlib_frame_t *f;
+  u32 *to_next;
+  u8 *dns_response;
+  u8 *reply;
+  vl_api_dns_resolve_name_reply_t _rnr, *rnr = &_rnr;
+  vl_api_dns_resolve_ip_reply_t _rir, *rir = &_rir;
+  u32 ttl, tmp;
+  u32 qp_offset;
+  dns_query_t *qp;
+  dns_rr_t *rr;
+  u8 *rrptr;
+  int is_fail = 0;
+  int is_recycle = (b0 != 0);
+
+  ASSERT (ep && ep->dns_response);
+
+  if (pr->request_type == DNS_PEER_PENDING_NAME_TO_IP)
+    {
+      /* Quick and dirty way to dig up the A-record address. $$ FIXME */
+      clib_memset (rnr, 0, sizeof (*rnr));
+      if (vnet_dns_response_to_reply (ep->dns_response, rnr, &ttl))
+	{
+	  /* clib_warning ("response_to_reply failed..."); */
+	  is_fail = 1;
+	}
+      if (rnr->ip4_set == 0)
+	{
+	  /* clib_warning ("No A-record..."); */
+	  is_fail = 1;
+	}
+    }
+  else if (pr->request_type == DNS_PEER_PENDING_IP_TO_NAME)
+    {
+      clib_memset (rir, 0, sizeof (*rir));
+      if (vnet_dns_response_to_name (ep->dns_response, rir, &ttl))
+	{
+	  /* clib_warning ("response_to_name failed..."); */
+	  is_fail = 1;
+	}
+    }
+  else
+    {
+      clib_warning ("Unknown request type %d", pr->request_type);
+      return;
+    }
+
+  /* Initialize a buffer */
+  if (b0 == 0)
+    {
+      if (vlib_buffer_alloc (vm, &bi, 1) != 1)
+	return;
+      b0 = vlib_get_buffer (vm, bi);
+    }
+  else
+    {
+      /* Use the buffer we were handed. Reinitialize it... */
+      vlib_buffer_t bt = { };
+      /* push/pop the reference count */
+      u8 save_ref_count = b0->ref_count;
+      vlib_buffer_copy_template (b0, &bt);
+      b0->ref_count = save_ref_count;
+      bi = vlib_get_buffer_index (vm, b0);
+    }
+
+  if (b0->flags & VLIB_BUFFER_NEXT_PRESENT)
+    vlib_buffer_free_one (vm, b0->next_buffer);
+
+  /*
+   * Reset the buffer. We recycle the DNS request packet in the cache
+   * hit case, and reply immediately from the request node.
+   *
+   * In the resolution-required / deferred case, resetting a freshly-allocated
+   * buffer won't hurt. We hope.
+   */
+  b0->flags |= (VNET_BUFFER_F_LOCALLY_ORIGINATED
+		| VLIB_BUFFER_TOTAL_LENGTH_VALID);
+  vnet_buffer (b0)->sw_if_index[VLIB_RX] = 0;	/* "local0" */
+  vnet_buffer (b0)->sw_if_index[VLIB_TX] = 0;	/* default VRF for now */
+
+  /* Find a FIB path to the peer we're trying to answer */
+  clib_memcpy (&prefix.fp_addr.ip4, pr->dst_address, sizeof (ip4_address_t));
+  prefix.fp_proto = FIB_PROTOCOL_IP4;
+  prefix.fp_len = 32;
+
+  fib_index = fib_table_find (prefix.fp_proto, 0 /* default VRF for now */ );
+  if (fib_index == (u32) ~ 0)
+    {
+      clib_warning ("no fib table");
+      return;
+    }
+
+  fei = fib_table_lookup (fib_index, &prefix);
+
+  /* Couldn't find route to destination. Bail out. */
+  if (fei == FIB_NODE_INDEX_INVALID)
+    {
+      clib_warning ("no route to DNS server");
+      return;
+    }
+
+  sw_if_index = fib_entry_get_resolving_interface (fei);
+
+  if (sw_if_index == ~0)
+    {
+      clib_warning
+	("route to %U exists, fei %d, get_resolving_interface returned"
+	 " ~0", fei, format_ip4_address, &prefix.fp_addr);
+      return;
+    }
+
+  /* *INDENT-OFF* */
+  foreach_ip_interface_address(lm4, ia, sw_if_index, 1 /* honor unnumbered */,
+  ({
+    src_address = ip_interface_address_get_address (lm4, ia);
+    goto found_src_address;
+  }));
+  /* *INDENT-ON* */
+
+  clib_warning ("FIB BUG");
+  return;
+
+found_src_address:
+
+  ip = vlib_buffer_get_current (b0);
+  udp = (udp_header_t *) (ip + 1);
+  dns_response = (u8 *) (udp + 1);
+  clib_memset (ip, 0, sizeof (*ip) + sizeof (*udp));
+
+  /*
+   * Start with the variadic portion of the exercise.
+   * Turn the name into a set of DNS "labels". Max length
+   * per label is 63, enforce that.
+   */
+  reply = name_to_labels (pr->name);
+  vec_free (pr->name);
+
+  qp_offset = vec_len (reply);
+
+  /* Add space for the query header */
+  vec_validate (reply, qp_offset + sizeof (dns_query_t) - 1);
+
+  qp = (dns_query_t *) (reply + qp_offset);
+
+  if (pr->request_type == DNS_PEER_PENDING_NAME_TO_IP)
+    qp->type = clib_host_to_net_u16 (DNS_TYPE_A);
+  else
+    qp->type = clib_host_to_net_u16 (DNS_TYPE_PTR);
+
+  qp->class = clib_host_to_net_u16 (DNS_CLASS_IN);
+
+  /* Punch in space for the dns_header_t */
+  vec_insert (reply, sizeof (dns_header_t), 0);
+
+  dh = (dns_header_t *) reply;
+
+  /* Transaction ID = pool index */
+  dh->id = pr->id;
+
+  /* Announce that we did a recursive lookup */
+  tmp = DNS_AA | DNS_RA | DNS_RD | DNS_OPCODE_QUERY | DNS_QR;
+  if (is_fail)
+    tmp |= DNS_RCODE_NAME_ERROR;
+  dh->flags = clib_host_to_net_u16 (tmp);
+  dh->qdcount = clib_host_to_net_u16 (1);
+  dh->anscount = (is_fail == 0) ? clib_host_to_net_u16 (1) : 0;
+  dh->nscount = 0;
+  dh->arcount = 0;
+
+  /* If the name resolution worked, cough up an appropriate RR */
+  if (is_fail == 0)
+    {
+      /* Add the answer. First, a name pointer (0xC00C) */
+      vec_add1 (reply, 0xC0);
+      vec_add1 (reply, 0x0C);
+
+      /* Now, add single A-rec RR */
+      if (pr->request_type == DNS_PEER_PENDING_NAME_TO_IP)
+	{
+	  vec_add2 (reply, rrptr, sizeof (dns_rr_t) + sizeof (ip4_address_t));
+	  rr = (dns_rr_t *) rrptr;
+
+	  rr->type = clib_host_to_net_u16 (DNS_TYPE_A);
+	  rr->class = clib_host_to_net_u16 (1 /* internet */ );
+	  rr->ttl = clib_host_to_net_u32 (ttl);
+	  rr->rdlength = clib_host_to_net_u16 (sizeof (ip4_address_t));
+	  clib_memcpy (rr->rdata, rnr->ip4_address, sizeof (ip4_address_t));
+	}
+      else
+	{
+	  /* Or a single PTR RR */
+	  u8 *vecname = format (0, "%s", rir->name);
+	  u8 *label_vec = name_to_labels (vecname);
+	  vec_free (vecname);
+
+	  vec_add2 (reply, rrptr, sizeof (dns_rr_t) + vec_len (label_vec));
+	  rr = (dns_rr_t *) rrptr;
+	  rr->type = clib_host_to_net_u16 (DNS_TYPE_PTR);
+	  rr->class = clib_host_to_net_u16 (1 /* internet */ );
+	  rr->ttl = clib_host_to_net_u32 (ttl);
+	  rr->rdlength = clib_host_to_net_u16 (vec_len (label_vec));
+	  clib_memcpy (rr->rdata, label_vec, vec_len (label_vec));
+	  vec_free (label_vec);
+	}
+    }
+  clib_memcpy (dns_response, reply, vec_len (reply));
+
+  /* Set the packet length */
+  b0->current_length = sizeof (*ip) + sizeof (*udp) + vec_len (reply);
+
+  /* IP header */
+  ip->ip_version_and_header_length = 0x45;
+  ip->length = clib_host_to_net_u16 (vlib_buffer_length_in_chain (vm, b0));
+  ip->ttl = 255;
+  ip->protocol = IP_PROTOCOL_UDP;
+  ip->src_address.as_u32 = src_address->as_u32;
+  clib_memcpy (ip->dst_address.as_u8, pr->dst_address,
+	       sizeof (ip4_address_t));
+  ip->checksum = ip4_header_checksum (ip);
+
+  /* UDP header */
+  udp->src_port = clib_host_to_net_u16 (UDP_DST_PORT_dns);
+  udp->dst_port = pr->dst_port;
+  udp->length = clib_host_to_net_u16 (sizeof (udp_header_t) +
+				      vec_len (reply));
+  udp->checksum = 0;
+  vec_free (reply);
+
+  /*
+   * Ship pkts made out of whole cloth to ip4_lookup
+   * Caller will ship recycled dns reply packets to ip4_lookup
+   */
+  if (is_recycle == 0)
+    {
+      f = vlib_get_frame_to_node (vm, ip4_lookup_node.index);
+      to_next = vlib_frame_vector_args (f);
+      to_next[0] = bi;
+      f->n_vectors = 1;
+      vlib_put_frame_to_node (vm, ip4_lookup_node.index, f);
+    }
+}
+
+static void *vl_api_dns_enable_disable_t_print
+  (vl_api_dns_enable_disable_t * mp, void *handle)
+{
+  u8 *s;
+
+  s = format (0, "SCRIPT: dns_enable_disable ");
+  s = format (s, "%s ", mp->enable ? "enable" : "disable");
+
+  FINISH;
+}
+
+static void *vl_api_dns_name_server_add_del_t_print
+  (vl_api_dns_name_server_add_del_t * mp, void *handle)
+{
+  u8 *s;
+
+  s = format (0, "SCRIPT: dns_name_server_add_del ");
+  if (mp->is_ip6)
+    s = format (s, "%U ", format_ip6_address,
+		(ip6_address_t *) mp->server_address);
+  else
+    s = format (s, "%U ", format_ip4_address,
+		(ip4_address_t *) mp->server_address);
+
+  if (mp->is_add == 0)
+    s = format (s, "del ");
+
+  FINISH;
+}
+
+static void *vl_api_dns_resolve_name_t_print
+  (vl_api_dns_resolve_name_t * mp, void *handle)
+{
+  u8 *s;
+
+  s = format (0, "SCRIPT: dns_resolve_name ");
+  s = format (s, "%s ", mp->name);
+  FINISH;
+}
+
+static void *vl_api_dns_resolve_ip_t_print
+  (vl_api_dns_resolve_ip_t * mp, void *handle)
+{
+  u8 *s;
+
+  s = format (0, "SCRIPT: dns_resolve_ip ");
+  if (mp->is_ip6)
+    s = format (s, "%U ", format_ip6_address, mp->address);
+  else
+    s = format (s, "%U ", format_ip4_address, mp->address);
+  FINISH;
+}
+
+static void
+dns_custom_dump_configure (dns_main_t * dm)
+{
+#define _(n,f) dm->api_main->msg_print_handlers \
+  [VL_API_##n + dm->msg_id_base]                \
+    = (void *) vl_api_##f##_t_print;
+  foreach_dns_plugin_api_msg;
+#undef _
+}
+
+/* Set up the API message handling tables */
+static clib_error_t *
+dns_plugin_api_hookup (vlib_main_t * vm)
+{
+  dns_main_t *dmp = &dns_main;
+#define _(N,n)                                                  \
+    vl_msg_api_set_handlers((VL_API_##N + dmp->msg_id_base),    \
+                           #n,					\
+                           vl_api_##n##_t_handler,              \
+                           vl_noop_handler,                     \
+                           vl_api_##n##_t_endian,               \
+                           vl_api_##n##_t_print,                \
+                           sizeof(vl_api_##n##_t), 1);
+  foreach_dns_plugin_api_msg;
+#undef _
+
+  return 0;
+}
+
+static clib_error_t *
+dns_init (vlib_main_t * vm)
+{
+  dns_main_t *dm = &dns_main;
+  u8 *name;
+
+  dm->vlib_main = vm;
+  dm->vnet_main = vnet_get_main ();
+  dm->name_cache_size = 1000;
+  dm->max_ttl_in_seconds = 86400;
+  dm->random_seed = 0xDEADDABE;
+  dm->api_main = &api_main;
+
+  name = format (0, "dns_%08x%c", api_version, 0);
+
+  /* Ask for a correctly-sized block of API message decode slots */
+  dm->msg_id_base = vl_msg_api_get_msg_ids
+    ((char *) name, VL_MSG_FIRST_AVAILABLE);
+
+  (void) dns_plugin_api_hookup (vm);
+
+  /* Add our API messages to the global name_crc hash table */
+  setup_message_id_table (dm);
+
+  dns_custom_dump_configure (dm);
+
+  vec_free (name);
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (dns_init);
+
+/* *INDENT-OFF* */
+VLIB_PLUGIN_REGISTER () =
+{
+  .version = VPP_BUILD_VER,
+  .description = "Simple DNS name resolver",
+};
+/* *INDENT-ON* */
+
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/dns/dns.h b/src/plugins/dns/dns.h
new file mode 100644
index 00000000000..499c71567d6
--- /dev/null
+++ b/src/plugins/dns/dns.h
@@ -0,0 +1,232 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef included_dns_h
+#define included_dns_h
+
+#include <vppinfra/time.h>
+#include <vppinfra/cache.h>
+#include <vppinfra/error.h>
+
+#include <vppinfra/hash.h>
+#include <dns/dns_packet.h>
+#include <vnet/ip/ip.h>
+#include <vppinfra/lock.h>
+#include <vlibapi/api_common.h>
+
+typedef struct
+{
+  u32 request_type;
+  u32 client_index;
+  u32 client_context;
+  u8 is_ip6;
+  u16 dst_port;
+  u16 id;
+  u16 pad;
+  u8 dst_address[16];
+  u8 *name;
+} dns_pending_request_t;
+
+typedef enum
+{
+  DNS_API_PENDING_NAME_TO_IP = 1,
+  DNS_API_PENDING_IP_TO_NAME,
+  DNS_PEER_PENDING_NAME_TO_IP,
+  DNS_PEER_PENDING_IP_TO_NAME,
+} dns_pending_request_type_t;
+
+typedef struct
+{
+  /** flags */
+  volatile u8 flags;
+
+  /** The name in "normal human being" notation, e.g. www.foobar.com */
+  u8 *name;
+
+  /** For CNAME records, the "next name" to resolve */
+  u8 *cname;
+
+  /** Expiration time */
+  f64 expiration_time;
+
+  /** Cached dns request, for sending retries */
+  u8 *dns_request;
+
+  /** Retry parameters */
+  int retry_count;
+  int server_rotor;
+  int server_af;
+  int server_fails;
+  f64 retry_timer;
+
+  /** Cached dns response */
+  u8 *dns_response;
+
+  /** Clients / peers awaiting responses */
+  dns_pending_request_t *pending_requests;
+} dns_cache_entry_t;
+
+#define DNS_CACHE_ENTRY_FLAG_VALID	(1<<0) /**< we have Actual Data */
+#define DNS_CACHE_ENTRY_FLAG_STATIC	(1<<1) /**< static entry */
+#define DNS_CACHE_ENTRY_FLAG_CNAME	(1<<2) /**< CNAME (indirect) entry */
+
+#define DNS_RETRIES_PER_SERVER 3
+
+#define DNS_RESOLVER_EVENT_RESOLVED	1
+#define DNS_RESOLVER_EVENT_PENDING	2
+
+
+typedef struct
+{
+  /** Pool of cache entries */
+  dns_cache_entry_t *entries;
+
+  /** Pool indices of unresolved entries */
+  u32 *unresolved_entries;
+
+  /** Find cached record by name */
+  uword *cache_entry_by_name;
+  clib_spinlock_t cache_lock;
+  int cache_lock_tag;
+
+  /** enable / disable flag */
+  int is_enabled;
+
+  /** udp port registration complete */
+  int udp_ports_registered;
+
+  /** upstream name servers, e.g. 8.8.8.8 */
+  ip4_address_t *ip4_name_servers;
+  ip6_address_t *ip6_name_servers;
+
+  /** resolver process node index */
+  u32 resolver_process_node_index;
+
+  /** config parameters */
+  u32 name_cache_size;
+  u32 max_ttl_in_seconds;
+  u32 random_seed;
+
+  /** message-ID base */
+  u16 msg_id_base;
+
+  /* convenience */
+  vlib_main_t *vlib_main;
+  vnet_main_t *vnet_main;
+  api_main_t *api_main;
+} dns_main_t;
+
+extern dns_main_t dns_main;
+
+extern vlib_node_registration_t dns46_reply_node;
+extern vlib_node_registration_t dns4_request_node;
+extern vlib_node_registration_t dns6_request_node;
+
+#define foreach_dns46_request_error                                     \
+_(NONE, "No error")							\
+_(UNIMPLEMENTED, "Unimplemented")                                       \
+_(PROCESSED, "DNS request pkts processed")                              \
+_(IP_OPTIONS, "DNS pkts with ip options (dropped)")                     \
+_(BAD_REQUEST, "DNS pkts with serious discrepanices (dropped)")         \
+_(TOO_MANY_REQUESTS, "DNS pkts asking too many questions")              \
+_(RESOLUTION_REQUIRED, "DNS pkts pending upstream name resolution")
+
+typedef enum
+{
+#define _(sym,str) DNS46_REQUEST_ERROR_##sym,
+  foreach_dns46_request_error
+#undef _
+    DNS46_REQUEST_N_ERROR,
+} dns46_request_error_t;
+
+#define foreach_dns46_reply_error                       \
+_(DISABLED, "DNS pkts punted (feature disabled)")       \
+_(PROCESSED, "DNS reply pkts processed")                \
+_(NO_ELT, "No DNS pool element")                        \
+_(FORMAT_ERROR, "DNS format errors")                    \
+_(TEST_DROP, "DNS reply pkt dropped for test purposes") \
+_(MULTIPLE_REPLY, "DNS multiple reply packets")	        \
+_(NO_UNRESOLVED_ENTRY, "No unresolved entry for pkt")
+
+typedef enum
+{
+#define _(sym,str) DNS46_REPLY_ERROR_##sym,
+  foreach_dns46_reply_error
+#undef _
+    DNS46_REPLY_N_ERROR,
+} dns46_reply_error_t;
+
+void vnet_send_dns_request (dns_main_t * dm, dns_cache_entry_t * ep);
+int
+vnet_dns_cname_indirection_nolock (dns_main_t * dm, u32 ep_index, u8 * reply);
+
+int vnet_dns_delete_entry_by_index_nolock (dns_main_t * dm, u32 index);
+
+int
+vnet_dns_resolve_name (dns_main_t * dm, u8 * name, dns_pending_request_t * t,
+		       dns_cache_entry_t ** retp);
+
+void
+vnet_dns_send_dns6_request (dns_main_t * dm,
+			    dns_cache_entry_t * ep, ip6_address_t * server);
+void
+vnet_dns_send_dns4_request (dns_main_t * dm,
+			    dns_cache_entry_t * ep, ip4_address_t * server);
+
+void vnet_send_dns4_reply (dns_main_t * dm, dns_pending_request_t * t,
+			   dns_cache_entry_t * ep, vlib_buffer_t * b0);
+
+void vnet_send_dns6_reply (dns_main_t * dm, dns_pending_request_t * t,
+			   dns_cache_entry_t * ep, vlib_buffer_t * b0);
+
+u8 *vnet_dns_labels_to_name (u8 * label, u8 * full_text,
+			     u8 ** parse_from_here);
+
+void vnet_dns_create_resolver_process (dns_main_t * dm);
+
+format_function_t format_dns_reply;
+
+static inline void
+dns_cache_lock (dns_main_t * dm, int tag)
+{
+  if (dm->cache_lock)
+    {
+      ASSERT (tag);
+      ASSERT (dm->cache_lock_tag == 0);
+      clib_spinlock_lock (&dm->cache_lock);
+      dm->cache_lock_tag = tag;
+    }
+}
+
+static inline void
+dns_cache_unlock (dns_main_t * dm)
+{
+  if (dm->cache_lock)
+    {
+      ASSERT (dm->cache_lock_tag);
+      dm->cache_lock_tag = 0;
+      clib_spinlock_unlock (&dm->cache_lock);
+    }
+}
+
+#endif /* included_dns_h */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/dns/dns_all_api_h.h b/src/plugins/dns/dns_all_api_h.h
new file mode 100644
index 00000000000..c226bcf18a4
--- /dev/null
+++ b/src/plugins/dns/dns_all_api_h.h
@@ -0,0 +1,19 @@
+
+/*
+ * dns_all_api_h.h - skeleton vpp engine plug-in api #include file
+ *
+ * Copyright (c) <current-year> <your-organization>
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/* Include the generated file, see BUILT_SOURCES in Makefile.am */
+#include <dns/dns.api.h>
diff --git a/src/plugins/dns/dns_msg_enum.h b/src/plugins/dns/dns_msg_enum.h
new file mode 100644
index 00000000000..bad374f7969
--- /dev/null
+++ b/src/plugins/dns/dns_msg_enum.h
@@ -0,0 +1,31 @@
+
+/*
+ * dns_msg_enum.h - skeleton vpp engine plug-in message enumeration
+ *
+ * Copyright (c) <current-year> <your-organization>
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef included_dns_msg_enum_h
+#define included_dns_msg_enum_h
+
+#include <vppinfra/byte_order.h>
+
+#define vl_msg_id(n,h) n,
+typedef enum {
+#include <dns/dns_all_api_h.h>
+    /* We'll want to know how many messages IDs we need... */
+    VL_MSG_FIRST_AVAILABLE,
+} vl_msg_id_t;
+#undef vl_msg_id
+
+#endif /* included_dns_msg_enum_h */
diff --git a/src/plugins/dns/dns_packet.h b/src/plugins/dns/dns_packet.h
new file mode 100644
index 00000000000..da5ddfa64fe
--- /dev/null
+++ b/src/plugins/dns/dns_packet.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (c) 2015 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef included_dns_packet_h
+#define included_dns_packet_h
+
+/**
+ * DNS packet header format
+ */
+
+/* *INDENT-OFF* */
+typedef CLIB_PACKED (struct {
+  u16 id;                       /**< transaction ID */
+  u16 flags;                    /**< flags  */
+  u16 qdcount;                  /**< number of questions */
+  u16 anscount;                 /**< number of answers */
+  u16 nscount;                  /**< number of name servers */
+  u16 arcount;                  /**< number of additional records */
+}) dns_header_t;
+/* *INDENT-ON* */
+
+#define DNS_RCODE_MASK (0xf)
+#define DNS_RCODE_NO_ERROR 0
+#define DNS_RCODE_FORMAT_ERROR 1
+#define DNS_RCODE_SERVER_FAILURE 2
+#define DNS_RCODE_NAME_ERROR 3
+#define DNS_RCODE_NOT_IMPLEMENTED 4
+#define DNS_RCODE_REFUSED 5
+
+#define DNS_RA (1<<7)		/**< recursion available */
+#define DNS_RD (1<<8)		/**< recursion desired */
+#define DNS_TC (1<<9)	       /**< truncation  */
+#define DNS_AA (1<<10)		/**< authoritative answer  */
+#define DNS_OPCODE_MASK (0xf<<11) /**< opcode mask */
+#define DNS_OPCODE_QUERY (0<<11)  /**< standard query */
+#define DNS_OPCODE_IQUERY (1<<11) /**< inverse query (deprecated) */
+#define DNS_OPCODE_STATUS (2<<11) /**< server status  */
+#define DNS_QR (1<<15)		/**< query=0, response=1  */
+
+
+/*
+ * Note: in DNS-land, www.foobar.com is encoded as three "labels,"
+ * each of which amount to a 1 octet length followed by up to 63
+ * octets of name. Don't forget to add a "null root label" after the last
+ * real one, or the poor slob trying to parse the name will have
+ * no chance whatsoever.
+ *
+ * All RRs have the same top level format shown below:
+ *
+ *                                    1  1  1  1  1  1
+ *      0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+ *    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *    |                                               |
+ *    /                                               /
+ *    /                      NAME                     /
+ *    |                                               |
+ *    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *    |                      TYPE                     |
+ *    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *    |                     CLASS                     |
+ *    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *    |                      TTL                      |
+ *    |                                               |
+ *    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *    |                   RDLENGTH                    |
+ *    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--|
+ *    /                     RDATA                     /
+ *    /                                               /
+ *    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *
+ *
+ *  DNS "questions" have the following format:
+ *
+ *                                     1  1  1  1  1  1
+ *       0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+ *     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *     |                                               |
+ *     /                     QNAME                     /
+ *     /                                               /
+ *     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *     |                     QTYPE                     |
+ *     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *     |                     QCLASS                    |
+ *     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ */
+
+/**
+ * DNS "question" fixed header.
+ */
+/* *INDENT-OFF* */
+typedef CLIB_PACKED (struct {
+  u16 type;	/**< record type requested */
+  u16 class;	/**< class, 1 = internet */
+}) dns_query_t;
+/* *INDENT-ON* */
+
+/**
+ * DNS RR fixed header.
+ */
+/* *INDENT-OFF* */
+typedef CLIB_PACKED (struct {
+  u16 type;	/**< record type */
+  u16 class;	/**< class, 1 = internet */
+  u32 ttl;	/**< time to live, in seconds */
+  u16 rdlength;
+  /**< length of r */
+  u8 rdata[0];
+}) dns_rr_t;
+/* *INDENT-ON* */
+
+/*
+ * There are quite a number of DNS record types
+ * Feel free to add as needed
+ */
+#define foreach_dns_type                        \
+_(A, 1) 	/**< ip4 host address */        \
+_(AAAA, 28)     /**< ip6 host address */        \
+_(ALL, 255)     /**< all available data */      \
+_(TEXT, 16)     /**< a text string */           \
+_(NAMESERVER, 2) /**< a nameserver */           \
+_(CNAME, 5)      /**< a CNAME (alias) */	\
+_(MAIL_EXCHANGE, 15) /**< a mail exchange  */	\
+_(PTR, 12)      /**< a PTR (pointer) record */	\
+_(HINFO, 13)	/**< Host info */
+
+typedef enum
+{
+#define _(name,value) DNS_TYPE_##name = value,
+  foreach_dns_type
+#undef _
+} dns_type_t;
+
+#define DNS_CLASS_IN	1	/**< The Internet */
+
+
+#endif /* included_dns_packet_h */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/dns/dns_test.c b/src/plugins/dns/dns_test.c
new file mode 100644
index 00000000000..6b0b371dca1
--- /dev/null
+++ b/src/plugins/dns/dns_test.c
@@ -0,0 +1,346 @@
+/*
+ * dns.c - skeleton vpp-api-test plug-in
+ *
+ * Copyright (c) <current-year> <your-organization>
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <vat/vat.h>
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+#include <vppinfra/error.h>
+#include <stdbool.h>
+#include <vnet/ip/ip.h>
+
+uword unformat_sw_if_index (unformat_input_t * input, va_list * args);
+
+/* Declare message IDs */
+#include <dns/dns_msg_enum.h>
+
+/* define message structures */
+#define vl_typedefs
+#include <dns/dns_all_api_h.h>
+#undef vl_typedefs
+
+/* declare message handlers for each api */
+
+#define vl_endianfun		/* define message structures */
+#include <dns/dns_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...)
+#define vl_printfun
+#include <dns/dns_all_api_h.h>
+#undef vl_printfun
+
+/* Get the API version number. */
+#define vl_api_version(n,v) static u32 api_version=(v);
+#include <dns/dns_all_api_h.h>
+#undef vl_api_version
+
+typedef struct
+{
+  /* API message ID base */
+  u16 msg_id_base;
+  vat_main_t *vat_main;
+} dns_test_main_t;
+
+dns_test_main_t dns_test_main;
+
+#define __plugin_msg_base dns_test_main.msg_id_base
+#include <vlibapi/vat_helper_macros.h>
+
+#define foreach_standard_reply_retval_handler   \
+_(dns_enable_disable_reply)                     \
+_(dns_name_server_add_del_reply)
+
+#define _(n)                                                    \
+    static void vl_api_##n##_t_handler                          \
+    (vl_api_##n##_t * mp)                                       \
+    {                                                           \
+        vat_main_t * vam = dns_test_main.vat_main;              \
+        i32 retval = (i32) clib_net_to_host_u32(mp->retval);    \
+        if (vam->async_mode) {                                  \
+            vam->async_errors += (retval < 0);                  \
+        } else {                                                \
+            vam->retval = retval;                               \
+            vam->result_ready = 1;                              \
+        }                                                       \
+    }
+foreach_standard_reply_retval_handler;
+#undef _
+
+static void vl_api_dns_resolve_name_reply_t_handler
+  (vl_api_dns_resolve_name_reply_t * mp)
+{
+  vat_main_t *vam = dns_test_main.vat_main;
+  i32 retval = (i32) clib_net_to_host_u32 (mp->retval);
+  if (retval == 0)
+    {
+      if (mp->ip4_set)
+	clib_warning ("resolved: %U", format_ip4_address, mp->ip4_address);
+      if (mp->ip6_set)
+	clib_warning ("resolved: %U", format_ip6_address, mp->ip6_address);
+    }
+  if (vam->async_mode)
+    vam->async_errors += (retval < 0);
+  else
+    {
+      vam->retval = retval;
+      vam->result_ready = 1;
+    }
+}
+
+static void vl_api_dns_resolve_ip_reply_t_handler
+  (vl_api_dns_resolve_ip_reply_t * mp)
+{
+  vat_main_t *vam = dns_test_main.vat_main;
+  i32 retval = (i32) clib_net_to_host_u32 (mp->retval);
+  if (retval == 0)
+    clib_warning ("resolved: %s", mp->name);
+  if (vam->async_mode)
+    vam->async_errors += (retval < 0);
+  else
+    {
+      vam->retval = retval;
+      vam->result_ready = 1;
+    }
+}
+
+/*
+ * Table of message reply handlers, must include boilerplate handlers
+ * we just generated
+ */
+#define foreach_vpe_api_reply_msg                               \
+_(DNS_ENABLE_DISABLE_REPLY, dns_enable_disable_reply)           \
+_(DNS_NAME_SERVER_ADD_DEL_REPLY, dns_name_server_add_del_reply) \
+_(DNS_RESOLVE_NAME_REPLY, dns_resolve_name_reply)               \
+_(DNS_RESOLVE_IP_REPLY, dns_resolve_ip_reply)
+
+static int
+api_dns_enable_disable (vat_main_t * vam)
+{
+  vl_api_dns_enable_disable_t *mp;
+  unformat_input_t *i = vam->input;
+  int enable = 1;
+  int ret;
+
+  /* Parse args required to build the message */
+  while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (i, "disable"))
+	enable = 0;
+      else if (unformat (i, "enable"))
+	enable = 1;
+      else
+	break;
+    }
+
+  /* Construct the API message */
+  M (DNS_ENABLE_DISABLE, mp);
+  mp->enable = enable;
+
+  /* send it... */
+  S (mp);
+
+  /* Wait for a reply... */
+  W (ret);
+  return ret;
+}
+
+/*
+ * List of messages that the api test plugin sends,
+ * and that the data plane plugin processes
+ */
+#define foreach_vpe_api_msg \
+_(dns_enable_disable, "[enable][disable]")				\
+_(dns_name_server_add_del, "<ip-address> [del]")			\
+_(dns_resolve_name, "<hostname>")					\
+_(dns_resolve_ip, "<ip4|ip6>")						\
+_(dns_name_server_add_del, "<ip-address> [del]")			\
+_(dns_resolve_name, "<hostname>")
+
+static int
+api_dns_resolve_name (vat_main_t * vam)
+{
+  unformat_input_t *line_input = vam->input;
+  vl_api_dns_resolve_name_t *mp;
+  u8 *name = 0;
+  int ret;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "%s", &name))
+	;
+      else
+	break;
+    }
+
+  if (vec_len (name) > 127)
+    {
+      errmsg ("name too long");
+      return -99;
+    }
+
+  /* Construct the API message */
+  M (DNS_RESOLVE_NAME, mp);
+  memcpy (mp->name, name, vec_len (name));
+  vec_free (name);
+
+  /* send it... */
+  S (mp);
+  /* Wait for the reply */
+  W (ret);
+  return ret;
+}
+
+static int
+api_dns_resolve_ip (vat_main_t * vam)
+{
+  unformat_input_t *line_input = vam->input;
+  vl_api_dns_resolve_ip_t *mp;
+  int is_ip6 = -1;
+  ip4_address_t addr4;
+  ip6_address_t addr6;
+  int ret;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "%U", unformat_ip6_address, &addr6))
+	is_ip6 = 1;
+      else if (unformat (line_input, "%U", unformat_ip4_address, &addr4))
+	is_ip6 = 0;
+      else
+	break;
+    }
+
+  if (is_ip6 == -1)
+    {
+      errmsg ("missing address");
+      return -99;
+    }
+
+  /* Construct the API message */
+  M (DNS_RESOLVE_IP, mp);
+  mp->is_ip6 = is_ip6;
+  if (is_ip6)
+    memcpy (mp->address, &addr6, sizeof (addr6));
+  else
+    memcpy (mp->address, &addr4, sizeof (addr4));
+
+  /* send it... */
+  S (mp);
+  /* Wait for the reply */
+  W (ret);
+  return ret;
+}
+
+static int
+api_dns_name_server_add_del (vat_main_t * vam)
+{
+  unformat_input_t *i = vam->input;
+  vl_api_dns_name_server_add_del_t *mp;
+  u8 is_add = 1;
+  ip6_address_t ip6_server;
+  ip4_address_t ip4_server;
+  int ip6_set = 0;
+  int ip4_set = 0;
+  int ret = 0;
+
+  while (unformat_check_input (i) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (i, "%U", unformat_ip6_address, &ip6_server))
+	ip6_set = 1;
+      else if (unformat (i, "%U", unformat_ip4_address, &ip4_server))
+	ip4_set = 1;
+      else if (unformat (i, "del"))
+	is_add = 0;
+      else
+	{
+	  clib_warning ("parse error '%U'", format_unformat_error, i);
+	  return -99;
+	}
+    }
+
+  if (ip4_set && ip6_set)
+    {
+      errmsg ("Only one server address allowed per message");
+      return -99;
+    }
+  if ((ip4_set + ip6_set) == 0)
+    {
+      errmsg ("Server address required");
+      return -99;
+    }
+
+  /* Construct the API message */
+  M (DNS_NAME_SERVER_ADD_DEL, mp);
+
+  if (ip6_set)
+    {
+      memcpy (mp->server_address, &ip6_server, sizeof (ip6_address_t));
+      mp->is_ip6 = 1;
+    }
+  else
+    {
+      memcpy (mp->server_address, &ip4_server, sizeof (ip4_address_t));
+      mp->is_ip6 = 0;
+    }
+
+  mp->is_add = is_add;
+
+  /* send it... */
+  S (mp);
+
+  /* Wait for a reply, return good/bad news  */
+  W (ret);
+  return ret;
+}
+
+static void
+dns_api_hookup (vat_main_t * vam)
+{
+  dns_test_main_t *dtmp = &dns_test_main;
+  /* Hook up handlers for replies from the data plane plug-in */
+#define _(N,n)                                                  \
+    vl_msg_api_set_handlers((VL_API_##N + dtmp->msg_id_base),   \
+                           #n,                                  \
+                           vl_api_##n##_t_handler,              \
+                           vl_noop_handler,                     \
+                           vl_api_##n##_t_endian,               \
+                           vl_api_##n##_t_print,                \
+                           sizeof(vl_api_##n##_t), 1);
+  foreach_vpe_api_reply_msg;
+#undef _
+
+  /* API messages we can send */
+#define _(n,h) hash_set_mem (vam->function_by_name, #n, api_##n);
+  foreach_vpe_api_msg;
+#undef _
+
+  /* Help strings */
+#define _(n,h) hash_set_mem (vam->help_by_name, #n, h);
+  foreach_vpe_api_msg;
+#undef _
+}
+
+VAT_PLUGIN_REGISTER (dns);
+
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/dns/reply_node.c b/src/plugins/dns/reply_node.c
new file mode 100644
index 00000000000..5d7e735e885
--- /dev/null
+++ b/src/plugins/dns/reply_node.c
@@ -0,0 +1,227 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dns/dns.h>
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+
+vlib_node_registration_t dns46_reply_node;
+
+typedef struct
+{
+  u32 pool_index;
+  u32 disposition;
+} dns46_reply_trace_t;
+
+/* packet trace format function */
+static u8 *
+format_dns46_reply_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  dns46_reply_trace_t *t = va_arg (*args, dns46_reply_trace_t *);
+
+  s = format (s, "DNS46_REPLY: pool index %d, disposition  %d",
+	      t->pool_index, t->disposition);
+  return s;
+}
+
+vlib_node_registration_t dns46_reply_node;
+
+static char *dns46_reply_error_strings[] = {
+#define _(sym,string) string,
+  foreach_dns46_reply_error
+#undef _
+};
+
+typedef enum
+{
+  DNS46_REPLY_NEXT_DROP,
+  DNS46_REPLY_NEXT_PUNT,
+  DNS46_REPLY_N_NEXT,
+} dns46_reply_next_t;
+
+static uword
+dns46_reply_node_fn (vlib_main_t * vm,
+		     vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  u32 n_left_from, *from, *to_next;
+  dns46_reply_next_t next_index;
+  dns_main_t *dm = &dns_main;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  next_index = node->cached_next_index;
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+#if 0
+      while (n_left_from >= 4 && n_left_to_next >= 2)
+	{
+	  u32 next0 = DNS46_REPLY_NEXT_INTERFACE_OUTPUT;
+	  u32 next1 = DNS46_REPLY_NEXT_INTERFACE_OUTPUT;
+	  u32 sw_if_index0, sw_if_index1;
+	  u8 tmp0[6], tmp1[6];
+	  ethernet_header_t *en0, *en1;
+	  u32 bi0, bi1;
+	  vlib_buffer_t *b0, *b1;
+
+	  /* Prefetch next iteration. */
+	  {
+	    vlib_buffer_t *p2, *p3;
+
+	    p2 = vlib_get_buffer (vm, from[2]);
+	    p3 = vlib_get_buffer (vm, from[3]);
+
+	    vlib_prefetch_buffer_header (p2, LOAD);
+	    vlib_prefetch_buffer_header (p3, LOAD);
+
+	    CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, STORE);
+	    CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, STORE);
+	  }
+
+	  /* speculatively enqueue b0 and b1 to the current next frame */
+	  to_next[0] = bi0 = from[0];
+	  to_next[1] = bi1 = from[1];
+	  from += 2;
+	  to_next += 2;
+	  n_left_from -= 2;
+	  n_left_to_next -= 2;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  b1 = vlib_get_buffer (vm, bi1);
+
+	  /* $$$$$ End of processing 2 x packets $$$$$ */
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
+	    {
+	      if (b0->flags & VLIB_BUFFER_IS_TRACED)
+		{
+		  dns46_reply_trace_t *t =
+		    vlib_add_trace (vm, node, b0, sizeof (*t));
+		  t->sw_if_index = sw_if_index0;
+		  t->next_index = next0;
+		}
+	      if (b1->flags & VLIB_BUFFER_IS_TRACED)
+		{
+		  dns46_reply_trace_t *t =
+		    vlib_add_trace (vm, node, b1, sizeof (*t));
+		  t->sw_if_index = sw_if_index1;
+		  t->next_index = next1;
+		}
+	    }
+
+	  /* verify speculative enqueues, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, bi1, next0, next1);
+	}
+#endif
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 bi0;
+	  vlib_buffer_t *b0;
+	  u32 next0 = DNS46_REPLY_NEXT_DROP;
+	  dns_header_t *d0;
+	  u32 pool_index0 = ~0;
+	  u32 error0 = 0;
+	  u8 *resp0 = 0;
+
+	  /* speculatively enqueue b0 to the current next frame */
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  d0 = vlib_buffer_get_current (b0);
+	  if (PREDICT_FALSE (dm->is_enabled == 0))
+	    {
+	      next0 = DNS46_REPLY_NEXT_PUNT;
+	      error0 = DNS46_REPLY_ERROR_DISABLED;
+	      goto done0;
+	    }
+
+	  pool_index0 = clib_host_to_net_u16 (d0->id);
+
+	  /* Save the reply */
+	  vec_validate (resp0, vlib_buffer_length_in_chain (vm, b0) - 1);
+	  clib_memcpy_fast (resp0, d0, vlib_buffer_length_in_chain (vm, b0));
+
+	  /*
+	   * Deal with everything in process ctx on the main thread
+	   */
+	  vlib_process_signal_event_mt (vm, dm->resolver_process_node_index,
+					DNS_RESOLVER_EVENT_RESOLVED,
+					(uword) resp0);
+	  error0 = DNS46_REPLY_ERROR_PROCESSED;
+
+	done0:
+	  b0->error = node->errors[error0];
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      dns46_reply_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->disposition = error0;
+	      t->pool_index = pool_index0;
+	    }
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (dns46_reply_node) =
+{
+  .function = dns46_reply_node_fn,
+  .name = "dns46_reply",
+  .vector_size = sizeof (u32),
+  .format_trace = format_dns46_reply_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .n_errors = ARRAY_LEN (dns46_reply_error_strings),
+  .error_strings = dns46_reply_error_strings,
+  .n_next_nodes = DNS46_REPLY_N_NEXT,
+  .next_nodes = {
+    [DNS46_REPLY_NEXT_DROP] = "error-drop",
+    [DNS46_REPLY_NEXT_PUNT] = "error-punt",
+  },
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/dns/request_node.c b/src/plugins/dns/request_node.c
new file mode 100644
index 00000000000..d26e579cf47
--- /dev/null
+++ b/src/plugins/dns/request_node.c
@@ -0,0 +1,344 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dns/dns.h>
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+
+vlib_node_registration_t dns46_request_node;
+
+typedef struct
+{
+  u32 pool_index;
+  u32 disposition;
+} dns46_request_trace_t;
+
+/* packet trace format function */
+static u8 *
+format_dns46_request_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  dns46_request_trace_t *t = va_arg (*args, dns46_request_trace_t *);
+
+  s = format (s, "DNS46_REPLY: pool index %d, disposition  %d",
+	      t->pool_index, t->disposition);
+  return s;
+}
+
+vlib_node_registration_t dns46_request_node;
+
+static char *dns46_request_error_strings[] = {
+#define _(sym,string) string,
+  foreach_dns46_request_error
+#undef _
+};
+
+typedef enum
+{
+  DNS46_REQUEST_NEXT_DROP,
+  DNS46_REQUEST_NEXT_IP_LOOKUP,
+  DNS46_REQUEST_NEXT_PUNT,
+  DNS46_REQUEST_N_NEXT,
+} dns46_request_next_t;
+
+static uword
+dns46_request_inline (vlib_main_t * vm,
+		      vlib_node_runtime_t * node, vlib_frame_t * frame,
+		      int is_ip6)
+{
+  u32 n_left_from, *from, *to_next;
+  dns46_request_next_t next_index;
+  dns_main_t *dm = &dns_main;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  next_index = node->cached_next_index;
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+#if 0
+      while (n_left_from >= 4 && n_left_to_next >= 2)
+	{
+	  u32 next0 = DNS46_REQUEST_NEXT_INTERFACE_OUTPUT;
+	  u32 next1 = DNS46_REQUEST_NEXT_INTERFACE_OUTPUT;
+	  u32 sw_if_index0, sw_if_index1;
+	  u8 tmp0[6], tmp1[6];
+	  ethernet_header_t *en0, *en1;
+	  u32 bi0, bi1;
+	  vlib_buffer_t *b0, *b1;
+
+	  /* Prefetch next iteration. */
+	  {
+	    vlib_buffer_t *p2, *p3;
+
+	    p2 = vlib_get_buffer (vm, from[2]);
+	    p3 = vlib_get_buffer (vm, from[3]);
+
+	    vlib_prefetch_buffer_header (p2, LOAD);
+	    vlib_prefetch_buffer_header (p3, LOAD);
+
+	    CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, STORE);
+	    CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, STORE);
+	  }
+
+	  /* speculatively enqueue b0 and b1 to the current next frame */
+	  to_next[0] = bi0 = from[0];
+	  to_next[1] = bi1 = from[1];
+	  from += 2;
+	  to_next += 2;
+	  n_left_from -= 2;
+	  n_left_to_next -= 2;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  b1 = vlib_get_buffer (vm, bi1);
+
+	  /* $$$$$ End of processing 2 x packets $$$$$ */
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)))
+	    {
+	      if (b0->flags & VLIB_BUFFER_IS_TRACED)
+		{
+		  dns46_request_trace_t *t =
+		    vlib_add_trace (vm, node, b0, sizeof (*t));
+		  t->sw_if_index = sw_if_index0;
+		  t->next_index = next0;
+		}
+	      if (b1->flags & VLIB_BUFFER_IS_TRACED)
+		{
+		  dns46_request_trace_t *t =
+		    vlib_add_trace (vm, node, b1, sizeof (*t));
+		  t->sw_if_index = sw_if_index1;
+		  t->next_index = next1;
+		}
+	    }
+
+	  /* verify speculative enqueues, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, bi1, next0, next1);
+	}
+#endif
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 bi0;
+	  vlib_buffer_t *b0;
+	  u32 next0 = DNS46_REQUEST_NEXT_DROP;
+	  u32 error0 = DNS46_REQUEST_ERROR_NONE;
+	  udp_header_t *u0;
+	  dns_header_t *d0;
+	  dns_query_t *q0;
+	  ip4_header_t *ip40 = 0;
+	  ip6_header_t *ip60 = 0;
+	  dns_cache_entry_t *ep0;
+	  dns_pending_request_t _t0, *t0 = &_t0;
+	  u16 flags0;
+	  u32 pool_index0 = ~0;
+	  u8 *name0;
+	  u8 *label0;
+
+	  /* speculatively enqueue b0 to the current next frame */
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  d0 = vlib_buffer_get_current (b0);
+	  u0 = (udp_header_t *) ((u8 *) d0 - sizeof (*u0));
+
+	  if (PREDICT_FALSE (dm->is_enabled == 0))
+	    {
+	      next0 = DNS46_REQUEST_NEXT_PUNT;
+	      goto done0;
+	    }
+
+	  if (is_ip6)
+	    {
+	      ip60 = (ip6_header_t *) (((u8 *) u0) - sizeof (ip6_header_t));
+	      next0 = DNS46_REQUEST_NEXT_DROP;
+	      error0 = DNS46_REQUEST_ERROR_UNIMPLEMENTED;
+	      goto done0;
+	    }
+	  else
+	    {
+	      ip40 = (ip4_header_t *) (((u8 *) u0) - sizeof (ip4_header_t));
+	      if (ip40->ip_version_and_header_length != 0x45)
+		{
+		  error0 = DNS46_REQUEST_ERROR_IP_OPTIONS;
+		  goto done0;
+		}
+	    }
+	  /* Parse through the DNS request */
+	  flags0 = clib_net_to_host_u16 (d0->flags);
+
+	  /* Requests only */
+	  if (flags0 & DNS_QR)
+	    {
+	      next0 = DNS46_REQUEST_NEXT_DROP;
+	      error0 = DNS46_REQUEST_ERROR_BAD_REQUEST;
+	      goto done0;
+	    }
+	  if (clib_net_to_host_u16 (d0->qdcount) != 1)
+	    {
+	      next0 = DNS46_REQUEST_NEXT_DROP;
+	      error0 = DNS46_REQUEST_ERROR_TOO_MANY_REQUESTS;
+	      goto done0;
+	    }
+
+	  label0 = (u8 *) (d0 + 1);
+
+	  /*
+	   * vnet_dns_labels_to_name produces a non NULL terminated vector
+	   * vnet_dns_resolve_name expects a C-string.
+	   */
+	  name0 = vnet_dns_labels_to_name (label0, (u8 *) d0, (u8 **) & q0);
+	  vec_add1 (name0, 0);
+	  _vec_len (name0) -= 1;
+
+	  t0->request_type = DNS_PEER_PENDING_NAME_TO_IP;
+
+	  /*
+	   * See if this is a reverse lookup. Both ip4 and ip6 reverse
+	   * requests end with ".arpa"
+	   */
+	  if (PREDICT_TRUE (vec_len (name0) > 5))
+	    {
+	      u8 *aptr0 = name0 + vec_len (name0) - 5;
+
+	      if (!memcmp (aptr0, ".arpa", 5))
+		t0->request_type = DNS_PEER_PENDING_IP_TO_NAME;
+	    }
+
+	  t0->client_index = ~0;
+	  t0->is_ip6 = is_ip6;
+	  t0->dst_port = u0->src_port;
+	  t0->id = d0->id;
+	  t0->name = name0;
+	  if (is_ip6)
+	    clib_memcpy_fast (t0->dst_address, ip60->src_address.as_u8,
+			      sizeof (ip6_address_t));
+	  else
+	    clib_memcpy_fast (t0->dst_address, ip40->src_address.as_u8,
+			      sizeof (ip4_address_t));
+
+	  vnet_dns_resolve_name (dm, name0, t0, &ep0);
+
+	  if (ep0)
+	    {
+	      if (is_ip6)
+		vnet_send_dns6_reply (dm, t0, ep0, b0);
+	      else
+		vnet_send_dns4_reply (dm, t0, ep0, b0);
+	      next0 = DNS46_REQUEST_NEXT_IP_LOOKUP;
+	    }
+	  else
+	    {
+	      error0 = DNS46_REQUEST_ERROR_RESOLUTION_REQUIRED;
+	    }
+
+	done0:
+	  b0->error = node->errors[error0];
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      dns46_request_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->disposition = error0;
+	      t->pool_index = pool_index0;
+	    }
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+static uword
+dns4_request_node_fn (vlib_main_t * vm,
+		      vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+
+  return dns46_request_inline (vm, node, frame, 0 /* is_ip6 */ );
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (dns4_request_node) =
+{
+  .function = dns4_request_node_fn,
+  .name = "dns4-request",
+  .vector_size = sizeof (u32),
+  .format_trace = format_dns46_request_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .n_errors = ARRAY_LEN (dns46_request_error_strings),
+  .error_strings = dns46_request_error_strings,
+  .n_next_nodes = DNS46_REQUEST_N_NEXT,
+  .next_nodes = {
+    [DNS46_REQUEST_NEXT_DROP] = "error-drop",
+    [DNS46_REQUEST_NEXT_PUNT] = "error-punt",
+    [DNS46_REQUEST_NEXT_IP_LOOKUP] = "ip4-lookup",
+  },
+};
+/* *INDENT-ON* */
+
+static uword
+dns6_request_node_fn (vlib_main_t * vm,
+		      vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+
+  return dns46_request_inline (vm, node, frame, 1 /* is_ip6 */ );
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (dns6_request_node) =
+{
+  .function = dns6_request_node_fn,
+  .name = "dns6-request",
+  .vector_size = sizeof (u32),
+  .format_trace = format_dns46_request_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .n_errors = ARRAY_LEN (dns46_request_error_strings),
+  .error_strings = dns46_request_error_strings,
+  .n_next_nodes = DNS46_REQUEST_N_NEXT,
+  .next_nodes = {
+    [DNS46_REQUEST_NEXT_DROP] = "error-drop",
+    [DNS46_REQUEST_NEXT_PUNT] = "error-punt",
+    [DNS46_REQUEST_NEXT_IP_LOOKUP] = "ip6-lookup",
+  },
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/dns/resolver_process.c b/src/plugins/dns/resolver_process.c
new file mode 100644
index 00000000000..51fe9d76a08
--- /dev/null
+++ b/src/plugins/dns/resolver_process.c
@@ -0,0 +1,381 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dns/dns.h>
+#include <vlibapi/api.h>
+#include <vlibmemory/api.h>
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+
+/* define message IDs */
+#include <dns/dns_msg_enum.h>
+
+#define vl_typedefs		/* define message structures */
+#include <dns/dns_all_api_h.h>
+#undef vl_typedefs
+
+#define vl_endianfun		/* define message structures */
+#include <dns/dns_all_api_h.h>
+#undef vl_endianfun
+
+/* instantiate all the print functions we know about */
+#define vl_print(handle, ...) vlib_cli_output (handle, __VA_ARGS__)
+#define vl_printfun
+#include <dns/dns_all_api_h.h>
+#undef vl_printfun
+
+#include <vlibapi/api_helper_macros.h>
+
+int
+vnet_dns_response_to_reply (u8 * response,
+			    vl_api_dns_resolve_name_reply_t * rmp,
+			    u32 * min_ttlp);
+int
+vnet_dns_response_to_name (u8 * response,
+			   vl_api_dns_resolve_ip_reply_t * rmp,
+			   u32 * min_ttlp);
+
+static void
+resolve_event (dns_main_t * dm, f64 now, u8 * reply)
+{
+  vlib_main_t *vm = dm->vlib_main;
+  dns_pending_request_t *pr;
+  dns_header_t *d;
+  u32 pool_index;
+  dns_cache_entry_t *ep;
+  u32 min_ttl;
+  u16 flags;
+  u16 rcode;
+  int i;
+  int entry_was_valid;
+  int remove_count;
+  int rv = 0;
+
+  d = (dns_header_t *) reply;
+  flags = clib_net_to_host_u16 (d->flags);
+  rcode = flags & DNS_RCODE_MASK;
+
+  /* $$$ u16 limits cache to 65K entries, fix later multiple dst ports */
+  pool_index = clib_net_to_host_u16 (d->id);
+  dns_cache_lock (dm, 10);
+
+  if (pool_is_free_index (dm->entries, pool_index))
+    {
+      vec_free (reply);
+      if (0)
+	clib_warning ("pool index %d is free", pool_index);
+      vlib_node_increment_counter (vm, dns46_reply_node.index,
+				   DNS46_REPLY_ERROR_NO_ELT, 1);
+      dns_cache_unlock (dm);
+      return;
+    }
+
+  ep = pool_elt_at_index (dm->entries, pool_index);
+
+  if (ep->dns_response)
+    vec_free (ep->dns_response);
+
+  /* Handle [sic] recursion AKA CNAME indirection */
+  rv = vnet_dns_cname_indirection_nolock (dm, pool_index, reply);
+
+  /* CNAME found, further resolution pending, we're done here */
+  if (rv > 0)
+    {
+      dns_cache_unlock (dm);
+      return;
+    }
+  /* Server backfire: refused to answer, or sent zero replies */
+  if (rv < 0)
+    {
+      /* Try a different server */
+      if (ep->server_af /* ip6 */ )
+	{
+	  if (0)
+	    clib_warning ("Server %U failed to resolve '%s'",
+			  format_ip6_address,
+			  dm->ip6_name_servers + ep->server_rotor, ep->name);
+	  /* Any more servers to try? */
+	  if (ep->server_fails > 1 || vec_len (dm->ip6_name_servers) <= 1)
+	    {
+	      /* No, tell the client to go away */
+	      goto reply;
+	    }
+	  ep->retry_count = 0;
+	  ep->server_rotor++;
+	  ep->server_fails++;
+	  if (ep->server_rotor >= vec_len (dm->ip6_name_servers))
+	    ep->server_rotor = 0;
+	  if (0)
+	    clib_warning ("Try server %U", format_ip6_address,
+			  dm->ip6_name_servers + ep->server_rotor);
+	  vnet_dns_send_dns6_request
+	    (dm, ep, dm->ip6_name_servers + ep->server_rotor);
+	}
+      else
+	{
+	  if (0)
+	    clib_warning ("Server %U failed to resolve '%s'",
+			  format_ip4_address,
+			  dm->ip4_name_servers + ep->server_rotor, ep->name);
+
+	  if (ep->server_fails > 1 || vec_len (dm->ip4_name_servers) <= 1)
+	    {
+	      /* No, tell the client to go away */
+	      goto reply;
+	    }
+	  ep->retry_count = 0;
+	  ep->server_rotor++;
+	  ep->server_fails++;
+	  if (ep->server_rotor >= vec_len (dm->ip4_name_servers))
+	    ep->server_rotor = 0;
+	  if (0)
+	    clib_warning ("Try server %U", format_ip4_address,
+			  dm->ip4_name_servers + ep->server_rotor);
+	  vnet_dns_send_dns4_request
+	    (dm, ep, dm->ip4_name_servers + ep->server_rotor);
+	}
+      dns_cache_unlock (dm);
+      return;
+    }
+
+reply:
+  /* Save the response */
+  ep->dns_response = reply;
+
+  /*
+   * Pick a sensible default cache entry expiration time.
+   * We don't play the 10-second timeout game.
+   */
+  ep->expiration_time = now + 600.0;
+
+  if (0)
+    clib_warning ("resolving '%s', was %s valid",
+		  ep->name, (ep->flags & DNS_CACHE_ENTRY_FLAG_VALID) ?
+		  "already" : "not");
+  /*
+   * The world is a mess. A single DNS request sent to e.g. 8.8.8.8
+   * may yield multiple, subtly different responses - all with the same
+   * DNS protocol-level ID.
+   *
+   * Last response wins in terms of what ends up in the cache.
+   * First response wins in terms of the response sent to the client.
+   */
+
+  /* Strong hint that we may not find a pending resolution entry */
+  entry_was_valid = (ep->flags & DNS_CACHE_ENTRY_FLAG_VALID) ? 1 : 0;
+
+  if (vec_len (ep->dns_response))
+    ep->flags |= DNS_CACHE_ENTRY_FLAG_VALID;
+
+  /* Most likely, send 1 message */
+  for (i = 0; i < vec_len (ep->pending_requests); i++)
+    {
+      vl_api_registration_t *regp;
+
+      pr = vec_elt_at_index (ep->pending_requests, i);
+
+      switch (pr->request_type)
+	{
+	case DNS_API_PENDING_NAME_TO_IP:
+	  {
+	    vl_api_dns_resolve_name_reply_t *rmp;
+	    regp = vl_api_client_index_to_registration (pr->client_index);
+	    if (regp == 0)
+	      continue;
+
+	    rmp = vl_msg_api_alloc (sizeof (*rmp));
+	    rmp->_vl_msg_id =
+	      clib_host_to_net_u16 (VL_API_DNS_RESOLVE_NAME_REPLY
+				    + dm->msg_id_base);
+	    rmp->context = pr->client_context;
+	    min_ttl = ~0;
+	    rv = vnet_dns_response_to_reply (ep->dns_response, rmp, &min_ttl);
+	    if (min_ttl != ~0)
+	      ep->expiration_time = now + min_ttl;
+	    rmp->retval = clib_host_to_net_u32 (rv);
+	    vl_api_send_msg (regp, (u8 *) rmp);
+	  }
+	  break;
+
+	case DNS_API_PENDING_IP_TO_NAME:
+	  {
+	    vl_api_dns_resolve_ip_reply_t *rmp;
+
+	    regp = vl_api_client_index_to_registration (pr->client_index);
+	    if (regp == 0)
+	      continue;
+
+	    rmp = vl_msg_api_alloc (sizeof (*rmp));
+	    rmp->_vl_msg_id =
+	      clib_host_to_net_u16 (VL_API_DNS_RESOLVE_IP_REPLY
+				    + dm->msg_id_base);
+	    rmp->context = pr->client_context;
+	    min_ttl = ~0;
+	    rv = vnet_dns_response_to_name (ep->dns_response, rmp, &min_ttl);
+	    if (min_ttl != ~0)
+	      ep->expiration_time = now + min_ttl;
+	    rmp->retval = clib_host_to_net_u32 (rv);
+	    vl_api_send_msg (regp, (u8 *) rmp);
+	  }
+	  break;
+
+	case DNS_PEER_PENDING_IP_TO_NAME:
+	case DNS_PEER_PENDING_NAME_TO_IP:
+	  if (pr->is_ip6)
+	    vnet_send_dns6_reply (dm, pr, ep, 0 /* allocate a buffer */ );
+	  else
+	    vnet_send_dns4_reply (dm, pr, ep, 0 /* allocate a buffer */ );
+	  break;
+	default:
+	  clib_warning ("request type %d unknown", pr->request_type);
+	  break;
+	}
+    }
+  vec_free (ep->pending_requests);
+
+  remove_count = 0;
+  for (i = 0; i < vec_len (dm->unresolved_entries); i++)
+    {
+      if (dm->unresolved_entries[i] == pool_index)
+	{
+	  vec_delete (dm->unresolved_entries, 1, i);
+	  remove_count++;
+	  i--;
+	}
+    }
+  /* See multiple response comment above... */
+  if (remove_count == 0)
+    {
+      u32 error_code = entry_was_valid ? DNS46_REPLY_ERROR_MULTIPLE_REPLY :
+	DNS46_REPLY_ERROR_NO_UNRESOLVED_ENTRY;
+
+      vlib_node_increment_counter (vm, dns46_reply_node.index, error_code, 1);
+      dns_cache_unlock (dm);
+      return;
+    }
+
+  /* Deal with bogus names, server issues, etc. */
+  switch (rcode)
+    {
+    default:
+    case DNS_RCODE_NO_ERROR:
+      break;
+
+    case DNS_RCODE_SERVER_FAILURE:
+    case DNS_RCODE_NOT_IMPLEMENTED:
+    case DNS_RCODE_REFUSED:
+      if (ep->server_af == 0)
+	clib_warning ("name server %U can't resolve '%s'",
+		      format_ip4_address,
+		      dm->ip4_name_servers + ep->server_rotor, ep->name);
+      else
+	clib_warning ("name server %U can't resolve '%s'",
+		      format_ip6_address,
+		      dm->ip6_name_servers + ep->server_rotor, ep->name);
+      /* FALLTHROUGH */
+    case DNS_RCODE_NAME_ERROR:
+    case DNS_RCODE_FORMAT_ERROR:
+      /* remove trash from the cache... */
+      vnet_dns_delete_entry_by_index_nolock (dm, ep - dm->entries);
+      break;
+    }
+
+
+  dns_cache_unlock (dm);
+  return;
+}
+
+static void
+retry_scan (dns_main_t * dm, f64 now)
+{
+  int i;
+  dns_cache_entry_t *ep;
+
+  for (i = 0; i < vec_len (dm->unresolved_entries); i++)
+    {
+      dns_cache_lock (dm, 11);
+      ep = pool_elt_at_index (dm->entries, dm->unresolved_entries[i]);
+
+      ASSERT ((ep->flags & DNS_CACHE_ENTRY_FLAG_VALID) == 0);
+      vnet_send_dns_request (dm, ep);
+      dns_cache_unlock (dm);
+    }
+}
+
+static uword
+dns_resolver_process (vlib_main_t * vm,
+		      vlib_node_runtime_t * rt, vlib_frame_t * f)
+{
+  dns_main_t *dm = &dns_main;
+  f64 now;
+  f64 timeout = 1000.0;
+  uword *event_data = 0;
+  uword event_type;
+  int i;
+
+  while (1)
+    {
+      vlib_process_wait_for_event_or_clock (vm, timeout);
+
+      now = vlib_time_now (vm);
+
+      event_type = vlib_process_get_events (vm, (uword **) & event_data);
+
+      switch (event_type)
+	{
+	  /* Send one of these when a resolution is pending */
+	case DNS_RESOLVER_EVENT_PENDING:
+	  timeout = 2.0;
+	  break;
+
+	case DNS_RESOLVER_EVENT_RESOLVED:
+	  for (i = 0; i < vec_len (event_data); i++)
+	    resolve_event (dm, now, (u8 *) event_data[i]);
+	  break;
+
+	case ~0:		/* timeout */
+	  retry_scan (dm, now);
+	  break;
+	}
+      vec_reset_length (event_data);
+
+      /* No work? Back to slow timeout mode... */
+      if (vec_len (dm->unresolved_entries) == 0)
+	timeout = 1000.0;
+    }
+  return 0;			/* or not */
+}
+
+void
+vnet_dns_create_resolver_process (dns_main_t * dm)
+{
+  /* Already created the resolver process? */
+  if (dm->resolver_process_node_index > 0)
+    return;
+
+  /* No, create it now and make a note of the node index */
+  dm->resolver_process_node_index = vlib_process_create
+    (dm->vlib_main, "dns-resolver-process",
+     dns_resolver_process, 16 /* log2_n_stack_bytes */ );
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/dns/test/test_dns.py b/src/plugins/dns/test/test_dns.py
new file mode 100644
index 00000000000..703f0d5caec
--- /dev/null
+++ b/src/plugins/dns/test/test_dns.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python
+
+import unittest
+import socket
+
+from framework import VppTestCase, VppTestRunner
+from ipaddress import *
+
+import scapy.compat
+from scapy.contrib.mpls import MPLS
+from scapy.layers.inet import IP, UDP, TCP, ICMP, icmptypes, icmpcodes
+from scapy.layers.l2 import Ether
+from scapy.packet import Raw
+from scapy.layers.dns import DNSRR, DNS, DNSQR
+
+
+class TestDns(VppTestCase):
+    """ Dns Test Cases """
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestDns, cls).setUpClass()
+
+    @classmethod
+    def tearDownClass(cls):
+        super(TestDns, cls).tearDownClass()
+
+    def setUp(self):
+        super(TestDns, self).setUp()
+
+        self.create_pg_interfaces(range(1))
+
+        for i in self.pg_interfaces:
+            i.admin_up()
+            i.config_ip4()
+            i.resolve_arp()
+
+    def tearDown(self):
+        super(TestDns, self).tearDown()
+
+    def create_stream(self, src_if):
+        """Create input packet stream for defined interface.
+
+        :param VppInterface src_if: Interface to create packet stream for.
+        """
+        good_request = (Ether(dst=src_if.local_mac, src=src_if.remote_mac) /
+                        IP(src=src_if.remote_ip4) /
+                        UDP(sport=1234, dport=53) /
+                        DNS(rd=1, qd=DNSQR(qname="bozo.clown.org")))
+
+        bad_request = (Ether(dst=src_if.local_mac, src=src_if.remote_mac) /
+                       IP(src=src_if.remote_ip4) /
+                       UDP(sport=1234, dport=53) /
+                       DNS(rd=1, qd=DNSQR(qname="no.clown.org")))
+        pkts = [good_request, bad_request]
+        return pkts
+
+    def verify_capture(self, dst_if, capture):
+        """Verify captured input packet stream for defined interface.
+
+        :param VppInterface dst_if: Interface to verify captured packet stream
+            for.
+        :param list capture: Captured packet stream.
+        """
+        self.logger.info("Verifying capture on interface %s" % dst_if.name)
+        for packet in capture:
+            dns = packet[DNS]
+            self.assertEqual(dns.an[0].rdata, '1.2.3.4')
+
+    def test_dns_unittest(self):
+        """ DNS Name Resolver Basic Functional Test """
+
+        # Set up an upstream name resolver. We won't actually go there
+        self.vapi.dns_name_server_add_del(
+            is_ip6=0, is_add=1, server_address=IPv4Address(u'8.8.8.8').packed)
+
+        # Enable name resolution
+        self.vapi.dns_enable_disable(enable=1)
+
+        # Manually add a static dns cache entry
+        self.logger.info(self.vapi.cli("dns cache add bozo.clown.org 1.2.3.4"))
+
+        # Test the binary API
+        rv = self.vapi.dns_resolve_name(name='bozo.clown.org')
+        self.assertEqual(rv.ip4_address, IPv4Address(u'1.2.3.4').packed)
+
+        # Configure 127.0.0.1/8 on the pg interface
+        ip_addr_n = socket.inet_pton(socket.AF_INET, "127.0.0.1")
+
+        self.vapi.sw_interface_add_del_address(
+            sw_if_index=self.pg0.sw_if_index,
+            address=ip_addr_n, address_length=8)
+
+        # Send a couple of DNS request packets, one for bozo.clown.org
+        # and one for no.clown.org which won't resolve
+
+        pkts = self.create_stream(self.pg0)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+
+        self.pg_start()
+        pkts = self.pg0.get_capture(1)
+        self.verify_capture(self.pg0, pkts)
+
+        # Make sure that the cache contents are correct
+        str = self.vapi.cli("show dns cache verbose")
+        self.assertIn('1.2.3.4', str)
+        self.assertIn('[P] no.clown.org:', str)
+
+if __name__ == '__main__':
+    unittest.main(testRunner=VppTestRunner)