Adding upstream version 0.2.0.upstream/0.2.0

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

79 files changed, 7127 insertions, 0 deletions

diff --git a/.clang-format b/.clang-format
new file mode 100644
index 0000000..1bd4430
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1,6 @@
+BasedOnStyle: webkit
+IndentWidth: 4
+AlignConsecutiveAssignments: true
+AlignConsecutiveDeclarations: true
+AlignOperands: true
+SortIncludes: false
diff --git a/.copr/Makefile b/.copr/Makefile
new file mode 100644
index 0000000..29ed0bc
--- /dev/null
+++ b/.copr/Makefile
@@ -0,0 +1,23 @@
+top=..
+
+all: srpm
+
+prereq: $(top)/rpmbuild
+	rpm -q git rpm-build >/dev/null || dnf -y install git rpm-build
+
+update-dist-tools: $(top)/dist-tools
+	( cd "$(top)/dist-tools" && git pull )
+
+$(top)/dist-tools:
+	git clone https://github.com/jelu/dist-tools.git "$(top)/dist-tools"
+
+$(top)/rpmbuild:
+	mkdir -p "$(top)"/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
+
+srpm: prereq update-dist-tools
+	test -f .gitmodules && git submodule update --init || true
+	echo "$(spec)" | grep -q "develop.spec" && auto_build_number=`date --utc +%s` message="Auto build `date --utc --iso-8601=seconds`" "$(top)/dist-tools/spec-new-changelog-entry" || true
+	overwrite=yes nosign=yes "$(top)/dist-tools/create-source-packages" rpm
+	cp ../*.orig.tar.gz "$(top)/rpmbuild/SOURCES/"
+	echo "$(spec)" | grep -q "develop.spec" && rpmbuild -bs --define "%_topdir $(top)/rpmbuild" --undefine=dist rpm/*.spec || rpmbuild -bs --define "%_topdir $(top)/rpmbuild" --undefine=dist "$(spec)"
+	cp "$(top)"/rpmbuild/SRPMS/*.src.rpm "$(outdir)"
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 0000000..38cc1c4
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1 @@
+custom: https://www.dns-oarc.net/donate
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..6d24ba0
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,33 @@
+*.o
+*.lo
+*.la
+config.log
+config.status
+stamp-h1
+ar-lib
+config.guess
+config.sub
+libtool
+ltmain.sh
+.deps
+.libs
+Makefile
+Makefile.in
+autom4te.cache
+Makefile.old
+aclocal.m4
+compile
+configure
+depcomp
+install-sh
+missing
+test-driver
+config.h
+config.h.in~
+m4/libtool.m4
+m4/ltoptions.m4
+m4/ltsugar.m4
+m4/ltversion.m4
+m4/lt~obsolete.m4
+build/
+config.h.in
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..d1a8524
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "src/dnstap.pb"]
+	path = src/dnstap.pb
+	url = https://github.com/dnstap/dnstap.pb.git
diff --git a/.lgtm.yml b/.lgtm.yml
new file mode 100644
index 0000000..f1f1830
--- /dev/null
+++ b/.lgtm.yml
@@ -0,0 +1,24 @@
+extraction:
+  cpp:
+    prepare:
+      packages:
+        - build-essential
+        - automake
+        - autoconf
+        - libtool
+        - pkg-config
+        - protobuf-c-compiler
+        - libprotobuf-c-dev
+    after_prepare:
+      - git clone https://github.com/DNS-OARC/tinyframe.git
+      - cd tinyframe
+      - ./autogen.sh
+      - ./configure --prefix="$PWD/../root"
+      - make
+      - make install
+      - cd ..
+      - export PKG_CONFIG_PATH="$PWD/root/lib/pkgconfig"
+    configure:
+      command:
+        - ./autogen.sh
+        - ./configure --disable-examples
diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 0000000..ab8d004
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,27 @@
+dist: xenial
+addons:
+  apt:
+    sources:
+    - sourceline: 'ppa:dns-oarc/dsc-pr'
+    update: true
+    packages:
+    - protobuf-c-compiler
+    - libprotobuf-c-dev
+    - libuv1-dev
+    - libtinyframe-dev
+language: c
+compiler:
+  - clang
+  - gcc
+install: ./autogen.sh
+script:
+  - ./configure --enable-warn-all
+  - make dist
+  - tar zxvf *.tar.gz
+  - cd dnswire-[0-9]*
+  - mkdir build
+  - cd build
+  - ../configure --enable-warn-all
+  - make
+  - make test
+  - cat src/test/test*.sh.log
diff --git a/CHANGES b/CHANGES
new file mode 100644
index 0000000..b00209b
--- /dev/null
+++ b/CHANGES
@@ -0,0 +1,35 @@
+2020-10-23 Jerry Lundström
+
+    Release 0.2.0
+
+    This release fixes various issues and bugs in the API, fix typos and
+    adds coverage tests.
+
+    Fixes:
+    - `dnstap_decode_protobuf()`: Fix setting of unknown socket family and protocol, was setting DNSTAP_MESSAGE_TYPE_ enums.
+    - `enum dnstap_message_type`: Fix typo in unknown enum, now correct `DNSTAP_SOCKET_FAMILY_UNKNOWN`
+    - `dnswire_encoder_encode()`: Remove setting state when to the same state it was
+    - `dnswire_writer_set_bufsize()`: Fix bug with changing buffer size while having something in the buffer
+
+    3bfd7e2 Travis, configure
+    27f69ab Coverage
+    d04b810 Coverage
+    ee153d7 Badges
+    a381843 Travis
+    f3a3e43 COPR
+    4b6640f Compile warnings
+    bc1b2e2 Funding
+    ae537a9 Examples, tests
+    c139dd7 LGTM
+
+2020-03-20 Jerry Lundström
+
+    Release v0.1.1
+
+    - Fix RPM devel package dependencies
+
+    b451169 package
+
+2020-03-19 Jerry Lundström
+
+    First release v0.1.0
diff --git a/COPYING b/COPYING
new file mode 100644
index 0000000..94a9ed0
--- /dev/null
+++ b/COPYING
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/COPYING.LESSER b/COPYING.LESSER
new file mode 100644
index 0000000..65c5ca8
--- /dev/null
+++ b/COPYING.LESSER
@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.
diff --git a/Makefile.am b/Makefile.am
new file mode 100644
index 0000000..7564c1f
--- /dev/null
+++ b/Makefile.am
@@ -0,0 +1,15 @@
+ACLOCAL_AMFLAGS = -I m4
+
+MAINTAINERCLEANFILES = $(srcdir)/Makefile.in \
+  $(srcdir)/src/config.h.in~ \
+  $(srcdir)/configure
+
+SUBDIRS = src examples
+
+pkgconfig_DATA = libdnswire.pc
+
+dist_doc_DATA = README.md
+
+EXTRA_DIST = m4
+
+test: check
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..16d1ea0
--- /dev/null
+++ b/README.md
@@ -0,0 +1,14 @@
+# library for DNS encapsulations and transporting of them
+
+[![Build Status](https://travis-ci.com/DNS-OARC/dnswire.svg?branch=develop)](https://travis-ci.com/DNS-OARC/dnswire) [![Total alerts](https://img.shields.io/lgtm/alerts/g/DNS-OARC/dnswire.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/DNS-OARC/dnswire/alerts/) [![Bugs](https://sonarcloud.io/api/project_badges/measure?project=dns-oarc%3Adnswire&metric=bugs)](https://sonarcloud.io/dashboard?id=dns-oarc%3Adnswire) [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=dns-oarc%3Adnswire&metric=security_rating)](https://sonarcloud.io/dashboard?id=dns-oarc%3Adnswire)
+
+**Currently Work in Progress!**
+
+A C library for encoding/decoding different DNS encapsulations and
+transporting them over different protocols.
+
+Supported encapsulations:
+- [DNSTAP](http://dnstap.info) using Protobuf
+
+Currently supports:
+- Frame Streams using [tinyframe](https://github.com/DNS-OARC/tinyframe)
diff --git a/autogen.sh b/autogen.sh
new file mode 100755
index 0000000..6cd344f
--- /dev/null
+++ b/autogen.sh
@@ -0,0 +1,3 @@
+#!/bin/sh -e
+
+autoreconf --force --install --no-recursive --include=m4
diff --git a/configure.ac b/configure.ac
new file mode 100644
index 0000000..87971aa
--- /dev/null
+++ b/configure.ac
@@ -0,0 +1,100 @@
+AC_PREREQ(2.61)
+AC_INIT([dnswire], [0.2.0], [admin@dns-oarc.net], [dnswire], [https://github.com/DNS-OARC/dnswire/issues])
+AC_SUBST([DNSWIRE_VERSION_MAJOR], [0000])
+AC_SUBST([DNSWIRE_VERSION_MINOR], [0001])
+AC_SUBST([DNSWIRE_VERSION_PATCH], [0000])
+AC_SUBST([DNSWIRE_LIBRARY_VERSION], [0:1:0])
+AM_INIT_AUTOMAKE([-Wall -Werror foreign subdir-objects])
+AC_CONFIG_SRCDIR([src/dnstap.c])
+AC_CONFIG_HEADER([src/config.h])
+AC_CONFIG_MACRO_DIR([m4])
+
+# Checks for programs.
+AC_PROG_CC
+AC_PROG_CXX
+AM_PROG_CC_C_O
+AC_CANONICAL_HOST
+m4_ifdef([AM_PROG_AR], [AM_PROG_AR])
+LT_INIT
+PKG_PROG_PKG_CONFIG
+AC_PATH_PROG([PROTOC_C], [protoc-c])
+AS_IF([test -z "$PROTOC_C"], [
+  AC_MSG_ERROR([The protoc-c program was not found. Please install the protobuf-c compiler!])
+])
+
+# Check --enable-warn-all
+AC_ARG_ENABLE([warn-all], [AS_HELP_STRING([--enable-warn-all], [Enable all compiler warnings])], [AX_CFLAGS_WARN_ALL()])
+
+# Check --with-extra-cflags
+AC_ARG_WITH([extra-cflags], [AS_HELP_STRING([--with-extra-cflags=CFLAGS], [Add extra CFLAGS])], [
+  AC_MSG_NOTICE([appending extra CFLAGS... $withval])
+  AS_VAR_APPEND(CFLAGS, [" $withval"])
+])
+
+# Check --with-extra-ldflags
+AC_ARG_WITH([extra-ldflags], [AS_HELP_STRING([--with-extra-ldflags=LDFLAGS], [Add extra LDFLAGS])], [
+  AC_MSG_NOTICE([appending extra LDFLAGS... $withval])
+  AS_VAR_APPEND(LDFLAGS, [" $withval"])
+])
+
+# Check --enable-trace
+#AH_TEMPLATE([DNSWIRE_TRACE], [Defined if tracing processing is enabled])
+AC_SUBST([DNSWIRE_TRACE], [0])
+AC_ARG_ENABLE([trace],
+[AS_HELP_STRING([--enable-trace], [Enable trace output of processing])],
+[
+  AC_MSG_NOTICE([WARNING: tracing of library enabled, expect excessive output to STDERR!])
+  AC_SUBST([DNSWIRE_TRACE], [1])
+])
+
+# Check --disable-examples
+AC_ARG_ENABLE([examples], [AS_HELP_STRING([--disable-examples], [do not build examples])], [
+case "${enableval}" in
+  yes)
+    build_examples=true
+    AC_MSG_NOTICE([Building examples])
+    ;;
+  no)
+    build_examples=false
+    AC_MSG_NOTICE([Not building examples])
+    ;;
+  *) AC_MSG_ERROR([bad value ${enableval} for --enable-examples]) ;;
+esac], [build_examples=true])
+AM_CONDITIONAL([BUILD_EXAMPLES], [test x$build_examples = xtrue])
+
+# Check --enable-gcov
+AC_ARG_ENABLE([gcov], [AS_HELP_STRING([--enable-gcov], [Enable coverage testing])], [
+  coverage_cflags="--coverage -g -O0 -fno-inline -fno-inline-small-functions -fno-default-inline"
+  AC_MSG_NOTICE([enabling coverage testing... $coverage_cflags])
+  AS_VAR_APPEND(CFLAGS, [" $coverage_cflags"])
+])
+AM_CONDITIONAL([ENABLE_GCOV], [test "x$enable_gcov" != "xno"])
+AM_EXTRA_RECURSIVE_TARGETS([gcov])
+
+# pkg-config
+PKG_INSTALLDIR
+
+# Checks for libraries.
+PKG_CHECK_MODULES([tinyframe], [libtinyframe >= 0.1.0])
+PKG_CHECK_MODULES([protobuf_c], [libprotobuf-c >= 1.0.1])
+have_libuv=false
+AS_IF([test x$build_examples = xtrue], [
+  PKG_CHECK_MODULES([uv], [libuv], [have_libuv=true], [])
+])
+AM_CONDITIONAL([HAVE_LIBUV], [test x$have_libuv = xtrue])
+
+# Checks for header files.
+
+# Checks for library functions.
+
+# Output Makefiles
+AC_CONFIG_FILES([
+  Makefile
+  libdnswire.pc
+  src/Makefile
+  src/test/Makefile
+  examples/Makefile
+  src/dnswire/version.h
+  src/dnswire/trace.h
+])
+AC_OUTPUT
diff --git a/examples/Makefile.am b/examples/Makefile.am
new file mode 100644
index 0000000..06dd2a7
--- /dev/null
+++ b/examples/Makefile.am
@@ -0,0 +1,48 @@
+MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
+
+CLEANFILES =
+
+AM_CFLAGS = -I$(top_srcdir)/src \
+  $(tinyframe_CFLAGS) \
+  $(protobuf_c_CFLAGS)
+
+AM_LDFLAGS = $(protobuf_c_LIBS) \
+  $(tinyframe_LIBS) -static
+
+EXTRA_DIST = print_dnstap.c create_dnstap.c
+
+if BUILD_EXAMPLES
+
+noinst_PROGRAMS = reader writer sender receiver reader_sender
+
+reader_SOURCES = reader.c
+reader_LDADD = ../src/libdnswire.la
+
+writer_SOURCES = writer.c
+writer_LDADD = ../src/libdnswire.la
+
+sender_SOURCES = sender.c
+sender_LDADD = ../src/libdnswire.la
+
+receiver_SOURCES = receiver.c
+receiver_LDADD = ../src/libdnswire.la
+
+reader_sender_SOURCES = reader_sender.c
+reader_sender_LDADD = ../src/libdnswire.la
+
+if HAVE_LIBUV
+
+AM_CFLAGS += -I$(uv_CFLAGS)
+AM_LDFLAGS += $(uv_LIBS)
+
+noinst_PROGRAMS += daemon_sender_uv client_receiver_uv
+
+daemon_sender_uv_SOURCES = daemon_sender_uv.c
+daemon_sender_uv_LDADD = ../src/libdnswire.la
+
+client_receiver_uv_SOURCES = client_receiver_uv.c
+client_receiver_uv_LDADD = ../src/libdnswire.la
+
+endif
+
+endif
diff --git a/examples/README.md b/examples/README.md
new file mode 100644
index 0000000..33d5309
--- /dev/null
+++ b/examples/README.md
@@ -0,0 +1,114 @@
+# Examples
+
+- `reader`: Example of reading DNSTAP from a file and printing it's content, using `dnswire_reader` (unidirectional mode)
+- `writer`: Example of constructing a DNSTAP message and writing it to a file, using `dnswire_writer` (unidirectional mode)
+- `receiver`: Example of receiving a DNSTAP message over a TCP connection and printing it's content, using `dnswire_reader` (bidirectional mode)
+- `sender`: Example of constructing a DNSTAP message and sending it over a TCP connection, using `dnswire_writer` (bidirectional mode)
+- `daemon_sender_uv`: Example of a daemon that will continuously send DNSTAP messages to connected clients (unidirectional mode), using the event engine `libuv` and `dnstap_encode_protobuf` along with `tinyframe` to encode once and send to many
+- `client_receiver_uv`: Example of a client that will receive DNSTAP message from the daemon (unidirectional mode), using the event engine `libuv` and `dnswire_reader` with the buffer push interface
+- `reader_sender`: Example of a reader that read DNSTAP from a file (unidirectional mode) and then sends the DNSTAP messages over a TCP connection (bidirectional mode)
+
+## receiver and sender
+
+These examples uses the way of connecting as implemented in the `fstrm`
+library, the receiver listens for connections by the sender and the sender
+connects to the receiver.
+
+```
+$ ./receiver 127.0.0.1 5353
+socket
+bind
+listen
+accept
+receiving...
+---- dnstap
+identity: sender
+version: 0.1.0
+message:
+  type: MESSAGE
+  query_time: 1574765731.199945162
+  response_time: 1574765731.199945362
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
+stopped
+```
+
+```
+$ ./sender 127.0.0.1 5353
+socket
+connect
+sending...
+sent, stopping...
+stopped
+```
+
+## daemon_sender_uv and client_receiver_uv
+
+These examples works in the reverse way compared to `receiver` and `sender`,
+and maybe a more traditional way, the daemon listens and accepts connections
+from new clients, and will continuously send messages to established clients
+that are ready to receive them.
+
+```
+$ ./daemon_sender_uv 127.0.0.1 5353
+client 1 connected
+client 1: sending control start and content type
+client 1: sending DNSTAP
+client 1: sending DNSTAP
+client 1 disconnected
+```
+
+```
+$ ./client_receiver_uv 127.0.0.1 5353
+received 42 bytes
+got control start
+got content type DNSTAP
+received 133 bytes
+---- dnstap
+identity: daemon_sender_uv
+version: 0.1.0
+message:
+  type: MESSAGE
+  query_time: 1574257180.95619354
+  response_time: 1574257180.95619490
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
+received 133 bytes
+---- dnstap
+identity: daemon_sender_uv
+version: 0.1.0
+message:
+  type: MESSAGE
+  query_time: 1574257181.96381443
+  response_time: 1574257181.96381557
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
+^C
+```
diff --git a/examples/client_receiver_uv.c b/examples/client_receiver_uv.c
new file mode 100644
index 0000000..0454ba2
--- /dev/null
+++ b/examples/client_receiver_uv.c
@@ -0,0 +1,134 @@
+#include <dnswire/reader.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <uv.h>
+#include <arpa/inet.h>
+#include <time.h>
+#include <errno.h>
+#include <stdbool.h>
+
+#include "print_dnstap.c"
+
+#define BUF_SIZE 4096
+
+uv_loop_t*   loop;
+uv_tcp_t     sock;
+uv_connect_t conn;
+char         rbuf[BUF_SIZE];
+
+struct dnswire_reader reader;
+
+void client_alloc_buffer(uv_handle_t* handle, size_t suggested_size, uv_buf_t* buf)
+{
+    buf->base = rbuf;
+    buf->len  = sizeof(rbuf);
+}
+
+void client_read(uv_stream_t* handle, ssize_t nread, const uv_buf_t* buf)
+{
+    if (nread > 0) {
+        /*
+         * We now push all the data we got to the reader.
+         */
+        size_t pushed = 0;
+
+        while (pushed < nread) {
+            enum dnswire_result res = dnswire_reader_push(&reader, (uint8_t*)&buf->base[pushed], nread - pushed, 0, 0);
+
+            pushed += dnswire_reader_pushed(reader);
+
+            switch (res) {
+            case dnswire_have_dnstap:
+                /*
+                 * We got a DNSTAP message, lets print it!
+                 */
+                print_dnstap(dnswire_reader_dnstap(reader));
+                break;
+            case dnswire_again:
+            case dnswire_need_more:
+                break;
+            case dnswire_endofdata:
+                /*
+                 * The remote end sent a control stop or finish.
+                 */
+                uv_close((uv_handle_t*)handle, 0);
+                return;
+            default:
+                fprintf(stderr, "dnswire_reader_fread() error\n");
+                uv_close((uv_handle_t*)handle, 0);
+                return;
+            }
+        }
+    }
+    if (nread < 0) {
+        if (nread != UV_EOF) {
+            fprintf(stderr, "client_read() error: %s\n", uv_err_name(nread));
+        } else {
+            printf("disconnected\n");
+        }
+        uv_close((uv_handle_t*)handle, 0);
+    }
+}
+
+void on_connect(uv_connect_t* req, int status)
+{
+    /*
+     * We have connected to the sender, check that there was no errors
+     * and start receiving incoming frames.
+     */
+
+    if (status < 0) {
+        fprintf(stderr, "on_connect() error: %s\n", uv_strerror(status));
+        return;
+    }
+
+    uv_read_start((uv_stream_t*)&sock, client_alloc_buffer, client_read);
+}
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 3) {
+        fprintf(stderr, "usage: client_receiver_uv <IP> <port>\n");
+        return 1;
+    }
+
+    /*
+     * We first initialize the reader and check that it can allocate the
+     * buffers it needs.
+     */
+
+    if (dnswire_reader_init(&reader) != dnswire_ok) {
+        fprintf(stderr, "Unable to initialize dnswire reader\n");
+        return 1;
+    }
+
+    /*
+     * We set this reader to reject bidirectional communication.
+     */
+    if (dnswire_reader_allow_bidirectional(&reader, false) != dnswire_ok) {
+        fprintf(stderr, "Unable to deny bidirectional communication\n");
+        return 1;
+    }
+
+    /*
+     * We setup a TCP client using libuv and connect to the given server.
+     */
+
+    struct sockaddr_storage addr;
+    int                     port = atoi(argv[2]);
+
+    if (strchr(argv[1], ':')) {
+        uv_ip6_addr(argv[1], port, (struct sockaddr_in6*)&addr);
+    } else {
+        uv_ip4_addr(argv[1], port, (struct sockaddr_in*)&addr);
+    }
+
+    loop = uv_default_loop();
+
+    uv_tcp_init(loop, &sock);
+    uv_tcp_connect(&conn, &sock, (const struct sockaddr*)&addr, on_connect);
+
+    return uv_run(loop, UV_RUN_DEFAULT);
+}
diff --git a/examples/create_dnstap.c b/examples/create_dnstap.c
new file mode 100644
index 0000000..9a03d1b
--- /dev/null
+++ b/examples/create_dnstap.c
@@ -0,0 +1,99 @@
+#include <dnswire/version.h>
+#include <dnswire/dnstap.h>
+
+#include <errno.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <time.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+static char dns_wire_format_placeholder[] = "dns_wire_format_placeholder";
+
+static inline struct dnstap create_dnstap(const char* identity)
+{
+    /*
+     * Now we initialize a DNSTAP message.
+     */
+
+    struct dnstap d = DNSTAP_INITIALIZER;
+
+    /*
+     * DNSTAP has a header with information about who constructed the
+     * message.
+     */
+
+    dnstap_set_identity_string(d, identity);
+    dnstap_set_version_string(d, DNSWIRE_VERSION_STRING);
+
+    /*
+     * Now we specify that this is a DNSTAP message, this is the one that
+     * holds the DNS.
+     */
+
+    dnstap_set_type(d, DNSTAP_TYPE_MESSAGE);
+
+    /*
+     * The message can have different types, we specify this is a query
+     * made by a tool.
+     */
+
+    dnstap_message_set_type(d, DNSTAP_MESSAGE_TYPE_TOOL_QUERY);
+
+    /*
+     * As most DNS comes over the network we can specify over what protocol,
+     * where from, to whom it came to and when it happened.
+     *
+     * Even if all fields are optional and there is no restriction on how
+     * many or how few you set, there is a recommended way of filling in
+     * the messages based on the message type.
+     *
+     * Please see the description of this at the bottom of
+     * `src/dnstap.pb/dnstap.proto` or
+     * <https://github.com/dnstap/dnstap.pb/blob/master/dnstap.proto>.
+     */
+
+    dnstap_message_set_socket_family(d, DNSTAP_SOCKET_FAMILY_INET);
+    dnstap_message_set_socket_protocol(d, DNSTAP_SOCKET_PROTOCOL_UDP);
+
+    unsigned char query_address[sizeof(struct in_addr)];
+    if (inet_pton(AF_INET, "127.0.0.1", query_address) != 1) {
+        fprintf(stderr, "inet_pton(127.0.0.1) failed: %s\n", strerror(errno));
+    } else {
+        dnstap_message_set_query_address(d, query_address, sizeof(query_address));
+    }
+    dnstap_message_set_query_port(d, 12345);
+
+    struct timespec query_time = { 0, 0 };
+    clock_gettime(CLOCK_REALTIME, &query_time);
+    dnstap_message_set_query_time_sec(d, query_time.tv_sec);
+    dnstap_message_set_query_time_nsec(d, query_time.tv_nsec);
+
+    unsigned char response_address[sizeof(struct in_addr)];
+    if (inet_pton(AF_INET, "127.0.0.1", response_address) != 1) {
+        fprintf(stderr, "inet_pton(127.0.0.1) failed: %s\n", strerror(errno));
+    } else {
+        dnstap_message_set_response_address(d, response_address, sizeof(response_address));
+    }
+    dnstap_message_set_response_port(d, 53);
+
+    struct timespec response_time = { 0, 0 };
+    clock_gettime(CLOCK_REALTIME, &response_time);
+    dnstap_message_set_response_time_sec(d, response_time.tv_sec);
+    dnstap_message_set_response_time_nsec(d, response_time.tv_nsec);
+
+    /*
+     * If we also had the DNS wire format we could use it, now we fill it
+     * with a placeholder text.
+     *
+     * NOTE: This will be invalid DNS if the output file is used with a
+     *       tool that uses the DNS messages.
+     */
+
+    dnstap_message_set_query_message(d, dns_wire_format_placeholder, sizeof(dns_wire_format_placeholder) - 1);
+
+    dnstap_message_set_response_message(d, dns_wire_format_placeholder, sizeof(dns_wire_format_placeholder) - 1);
+
+    return d;
+}
diff --git a/examples/daemon_sender_uv.c b/examples/daemon_sender_uv.c
new file mode 100644
index 0000000..cfa2be8
--- /dev/null
+++ b/examples/daemon_sender_uv.c
@@ -0,0 +1,254 @@
+#include <tinyframe/tinyframe.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <uv.h>
+#include <errno.h>
+#include <stdbool.h>
+
+#include "create_dnstap.c"
+
+#define BUF_SIZE 4096
+
+enum client_state {
+    no_state,
+    writing_start,
+    started,
+    writing_frame,
+};
+
+struct client;
+struct client {
+    struct client*    next;
+    size_t            id;
+    enum client_state state;
+    uv_tcp_t          conn;
+    char              rbuf[BUF_SIZE];
+    uv_write_t        wreq;
+    uv_buf_t          wbuf;
+    uint8_t           buf[BUF_SIZE];
+};
+
+struct client* clients   = 0;
+size_t         client_id = 1;
+
+static char content_type[] = "protobuf:dnstap.Dnstap";
+
+uv_loop_t* loop;
+
+struct client* client_new()
+{
+    struct client* c = malloc(sizeof(struct client));
+    if (c) {
+        c->conn.data = c;
+        c->next      = clients;
+        c->id        = client_id++;
+        c->state     = no_state;
+        c->wbuf.base = (void*)c->buf;
+        clients      = c;
+    }
+    return c;
+}
+
+void client_close(uv_handle_t* handle)
+{
+    struct client* c = handle->data;
+
+    if (clients == c) {
+        clients = c->next;
+    } else {
+        struct client* prev = clients;
+
+        while (prev) {
+            if (prev->next == c) {
+                prev->next = c->next;
+                break;
+            }
+            prev = prev->next;
+        }
+    }
+
+    free(c);
+}
+
+void client_alloc_buffer(uv_handle_t* handle, size_t suggested_size, uv_buf_t* buf)
+{
+    buf->base = ((struct client*)handle->data)->rbuf;
+    buf->len  = BUF_SIZE;
+}
+
+void client_read(uv_stream_t* client, ssize_t nread, const uv_buf_t* buf)
+{
+    /*
+     * We discard any input from the client and only check for errors or
+     * if the connection was closed.
+     */
+
+    if (nread < 0) {
+        if (nread != UV_EOF) {
+            fprintf(stderr, "client_read() error: %s\n", uv_err_name(nread));
+        } else {
+            printf("client %zu disconnected\n", ((struct client*)client->data)->id);
+        }
+        uv_close((uv_handle_t*)client, client_close);
+    }
+}
+
+void client_write(uv_write_t* req, int status)
+{
+    /*
+     * After a write we check that there was no errors and then set the
+     * client in a state that allows `tick()` to send DNSTAP messages to it.
+     */
+
+    if (status) {
+        fprintf(stderr, "client_write() error: %s\n", uv_strerror(status));
+        uv_close((uv_handle_t*)req->handle, client_close);
+        return;
+    }
+
+    ((struct client*)req->handle->data)->state = started;
+}
+
+void on_new_connection(uv_stream_t* server, int status)
+{
+    if (status < 0) {
+        fprintf(stderr, "on_new_connection() error: %s\n", uv_strerror(status));
+        return;
+    }
+
+    /*
+     * We have a new client connecting, create a client struct to hold the
+     * connection, accept it and send the control start frame.
+     */
+
+    struct client* client = client_new();
+    if (!client) {
+        fprintf(stderr, "on_new_connection() out of memory\n");
+        return;
+    }
+
+    uv_tcp_init(loop, &client->conn);
+    if (uv_accept(server, (uv_stream_t*)&client->conn) == 0) {
+        printf("client %zu connected\n", client->id);
+
+        uv_read_start((uv_stream_t*)&client->conn, client_alloc_buffer, client_read);
+
+        struct tinyframe_writer writer = TINYFRAME_WRITER_INITIALIZER;
+
+        /*
+         * First we write, to the buffer, a control start with a content type
+         * control field for the DNSTAP protobuf content type.
+         *
+         * Then we send it.
+         */
+
+        if (tinyframe_write_control_start(&writer, client->buf, BUF_SIZE, content_type, sizeof(content_type) - 1) != tinyframe_ok) {
+            fprintf(stderr, "tinyframe_write_control_start() failed\n");
+            uv_close((uv_handle_t*)&client->conn, client_close);
+            return;
+        }
+        printf("client %zu: sending control start and content type\n", client->id);
+
+        client->wbuf.len = writer.bytes_wrote;
+        uv_write((uv_write_t*)&client->wreq, (uv_stream_t*)&client->conn, &client->wbuf, 1, client_write);
+        client->state = writing_start;
+    } else {
+        uv_close((uv_handle_t*)&client->conn, client_close);
+    }
+}
+
+/*
+ * This function is called every second and will create a DNSTAP message
+ * and send it to all available clients.
+ */
+
+void tick(uv_timer_t* handle)
+{
+    /*
+     * Now we create a DNSTAP message.
+     */
+
+    struct dnstap d = create_dnstap("daemon_sender_uv");
+
+    /*
+     * Now that the message is prepared we can begin encapsulating it in
+     * protobuf and Frame Streams.
+     *
+     * First we ask what the encoded size of the protobuf message would be
+     * and then we allocate a buffer with of that size plus the size of
+     * a Frame Streams frame header.
+     *
+     * Then we encode the DNSTAP message and put it after the frame header
+     * and call `tinyframe_set_header()` to set the header.
+     */
+
+    size_t  frame_len = dnstap_encode_protobuf_size(&d);
+    uint8_t frame[TINYFRAME_HEADER_SIZE + frame_len];
+    dnstap_encode_protobuf(&d, &frame[TINYFRAME_HEADER_SIZE]);
+    tinyframe_set_header(frame, frame_len);
+
+    if (sizeof(frame) > BUF_SIZE) {
+        fprintf(stderr, "frame larger the client's buffers\n");
+        exit(1);
+    }
+
+    /*
+     * We now loop over all the connected clients and send the message
+     * to those that are currently not busy.
+     */
+
+    struct client* c = clients;
+    while (c) {
+        if (c->state == started) {
+            c->wbuf.len = sizeof(frame);
+            memcpy(c->buf, frame, sizeof(frame));
+            uv_write((uv_write_t*)&c->wreq, (uv_stream_t*)&c->conn, &c->wbuf, 1, client_write);
+            c->state = writing_frame;
+
+            printf("client %zu: sending DNSTAP\n", c->id);
+        }
+        c = c->next;
+    }
+}
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 3) {
+        fprintf(stderr, "usage: daemon_sender_uv <IP> <port>\n");
+        return 1;
+    }
+
+    /*
+     * We setup a TCP server using libuv and listen for connections,
+     * along with a timer that calls the function to send DNSTAP messages
+     * to all clients.
+     */
+
+    struct sockaddr_storage addr;
+    int                     port = atoi(argv[2]);
+
+    if (strchr(argv[1], ':')) {
+        uv_ip6_addr(argv[1], port, (struct sockaddr_in6*)&addr);
+    } else {
+        uv_ip4_addr(argv[1], port, (struct sockaddr_in*)&addr);
+    }
+
+    loop = uv_default_loop();
+
+    uv_tcp_t server;
+    uv_tcp_init(loop, &server);
+    uv_tcp_bind(&server, (const struct sockaddr*)&addr, 0);
+    int r = uv_listen((uv_stream_t*)&server, 128, on_new_connection);
+    if (r) {
+        fprintf(stderr, "uv_listen() failed: %s\n", uv_strerror(r));
+        return 1;
+    }
+
+    uv_timer_t ticker;
+    uv_timer_init(loop, &ticker);
+    uv_timer_start(&ticker, tick, 1000, 1000);
+
+    return uv_run(loop, UV_RUN_DEFAULT);
+}
diff --git a/examples/print_dnstap.c b/examples/print_dnstap.c
new file mode 100644
index 0000000..3a0adb0
--- /dev/null
+++ b/examples/print_dnstap.c
@@ -0,0 +1,122 @@
+#include <dnswire/dnstap.h>
+
+#include <stdio.h>
+#include <inttypes.h>
+#include <arpa/inet.h>
+#include <ctype.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+static const char* printable_string(const uint8_t* data, size_t len)
+{
+    static char buf[512], hex;
+    size_t      r = 0, w = 0;
+
+    while (r < len && w < sizeof(buf) - 1) {
+        if (isprint(data[r])) {
+            buf[w++] = data[r++];
+        } else {
+            if (w + 4 >= sizeof(buf) - 1) {
+                break;
+            }
+
+            buf[w++] = '\\';
+            buf[w++] = 'x';
+            hex      = (data[r] & 0xf0) >> 4;
+            if (hex > 9) {
+                buf[w++] = 'a' + (hex - 10);
+            } else {
+                buf[w++] = '0' + hex;
+            }
+            hex = data[r++] & 0xf;
+            if (hex > 9) {
+                buf[w++] = 'a' + (hex - 10);
+            } else {
+                buf[w++] = '0' + hex;
+            }
+        }
+    }
+    if (w >= sizeof(buf)) {
+        buf[sizeof(buf) - 1] = 0;
+    } else {
+        buf[w] = 0;
+    }
+
+    return buf;
+}
+
+static const char* printable_ip_address(const uint8_t* data, size_t len)
+{
+    static char buf[INET6_ADDRSTRLEN];
+
+    buf[0] = 0;
+    if (len == 4) {
+        inet_ntop(AF_INET, data, buf, sizeof(buf));
+    } else if (len == 16) {
+        inet_ntop(AF_INET6, data, buf, sizeof(buf));
+    }
+
+    return buf;
+}
+
+static void print_dnstap(const struct dnstap* d)
+{
+    printf("---- dnstap\n");
+
+    /*
+     * Now we can print the available information in the message.
+     */
+
+    if (dnstap_has_identity(*d)) {
+        printf("identity: %s\n", printable_string(dnstap_identity(*d), dnstap_identity_length(*d)));
+    }
+    if (dnstap_has_version(*d)) {
+        printf("version: %s\n", printable_string(dnstap_version(*d), dnstap_version_length(*d)));
+    }
+    if (dnstap_has_extra(*d)) {
+        printf("extra: %s\n", printable_string(dnstap_extra(*d), dnstap_extra_length(*d)));
+    }
+
+    if (dnstap_type(*d) == DNSTAP_TYPE_MESSAGE && dnstap_has_message(*d)) {
+        printf("message:\n  type: %s\n", DNSTAP_MESSAGE_TYPE_STRING[dnstap_message_type(*d)]);
+
+        if (dnstap_message_has_query_time_sec(*d) && dnstap_message_has_query_time_nsec(*d)) {
+            printf("  query_time: %" PRIu64 ".%" PRIu32 "\n", dnstap_message_query_time_sec(*d), dnstap_message_query_time_nsec(*d));
+        }
+        if (dnstap_message_has_response_time_sec(*d) && dnstap_message_has_response_time_nsec(*d)) {
+            printf("  response_time: %" PRIu64 ".%" PRIu32 "\n", dnstap_message_response_time_sec(*d), dnstap_message_response_time_nsec(*d));
+        }
+        if (dnstap_message_has_socket_family(*d)) {
+            printf("  socket_family: %s\n", DNSTAP_SOCKET_FAMILY_STRING[dnstap_message_socket_family(*d)]);
+        }
+        if (dnstap_message_has_socket_protocol(*d)) {
+            printf("  socket_protocol: %s\n", DNSTAP_SOCKET_PROTOCOL_STRING[dnstap_message_socket_protocol(*d)]);
+        }
+        if (dnstap_message_has_query_address(*d)) {
+            printf("  query_address: %s\n", printable_ip_address(dnstap_message_query_address(*d), dnstap_message_query_address_length(*d)));
+        }
+        if (dnstap_message_has_query_port(*d)) {
+            printf("  query_port: %u\n", dnstap_message_query_port(*d));
+        }
+        if (dnstap_message_has_response_address(*d)) {
+            printf("  response_address: %s\n", printable_ip_address(dnstap_message_response_address(*d), dnstap_message_response_address_length(*d)));
+        }
+        if (dnstap_message_has_response_port(*d)) {
+            printf("  response_port: %u\n", dnstap_message_response_port(*d));
+        }
+        if (dnstap_message_has_query_zone(*d)) {
+            printf("  query_zone: %s\n", printable_string(dnstap_message_query_zone(*d), dnstap_message_query_zone_length(*d)));
+        }
+        if (dnstap_message_has_query_message(*d)) {
+            printf("  query_message_length: %lu\n", dnstap_message_query_message_length(*d));
+            printf("  query_message: %s\n", printable_string(dnstap_message_query_message(*d), dnstap_message_query_message_length(*d)));
+        }
+        if (dnstap_message_has_response_message(*d)) {
+            printf("  response_message_length: %lu\n", dnstap_message_response_message_length(*d));
+            printf("  response_message: %s\n", printable_string(dnstap_message_response_message(*d), dnstap_message_response_message_length(*d)));
+        }
+    }
+
+    printf("----\n");
+}
diff --git a/examples/reader.c b/examples/reader.c
new file mode 100644
index 0000000..593e9bc
--- /dev/null
+++ b/examples/reader.c
@@ -0,0 +1,65 @@
+#include <dnswire/reader.h>
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+
+#include "print_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        fprintf(stderr, "usage: reader <file>\n");
+        return 1;
+    }
+
+    /*
+     * First we open the given file and read all of the content.
+     */
+
+    FILE* fp = fopen(argv[1], "r");
+    if (!fp) {
+        fprintf(stderr, "Unable to open %s: %s\n", argv[1], strerror(errno));
+        return 1;
+    }
+
+    /*
+     * We now initialize the reader and check that it can allocate the
+     * buffers it needs.
+     */
+
+    struct dnswire_reader reader;
+    int                   done = 0;
+
+    if (dnswire_reader_init(&reader) != dnswire_ok) {
+        fprintf(stderr, "Unable to initialize dnswire reader\n");
+        return 1;
+    }
+
+    /*
+     * We now loop until we have a DNSTAP message, the stream was stopped
+     * or we got an error.
+     */
+
+    while (!done) {
+        switch (dnswire_reader_fread(&reader, fp)) {
+        case dnswire_have_dnstap:
+            print_dnstap(dnswire_reader_dnstap(reader));
+            break;
+        case dnswire_again:
+        case dnswire_need_more:
+            break;
+        case dnswire_endofdata:
+            done = 1;
+            break;
+        default:
+            fprintf(stderr, "dnswire_reader_fread() error\n");
+            done = 1;
+        }
+    }
+
+    dnswire_reader_destroy(reader);
+    fclose(fp);
+
+    return 0;
+}
diff --git a/examples/reader_sender.c b/examples/reader_sender.c
new file mode 100644
index 0000000..3498f77
--- /dev/null
+++ b/examples/reader_sender.c
@@ -0,0 +1,225 @@
+#include <dnswire/reader.h>
+#include <dnswire/writer.h>
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <sys/un.h>
+
+/*
+ * This is a combination of reader and simpler_sender, comments may
+ * be a bit off since they haven't been updated for this.
+ */
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 3) {
+        fprintf(stderr, "usage: reader_sender <file> [ <IP> <port> | <unix socket path> ]\n");
+        return 1;
+    }
+
+    /*
+     * First we open the given file and read all of the content.
+     */
+
+    FILE* fp = fopen(argv[1], "r");
+    if (!fp) {
+        fprintf(stderr, "Unable to open %s: %s\n", argv[1], strerror(errno));
+        return 1;
+    }
+
+    /*
+     * We now initialize the reader and check that it can allocate the
+     * buffers it needs.
+     */
+
+    struct dnswire_reader reader;
+    int                   done = 0;
+
+    if (dnswire_reader_init(&reader) != dnswire_ok) {
+        fprintf(stderr, "Unable to initialize dnswire reader\n");
+        return 1;
+    }
+
+    /*
+     * We first initialize the writer and check that it can allocate the
+     * buffers it needs.
+     */
+
+    struct dnswire_writer writer;
+
+    if (dnswire_writer_init(&writer) != dnswire_ok) {
+        fprintf(stderr, "Unable to initialize dnswire writer\n");
+        return 1;
+    }
+
+    /*
+     * Use bidirectional communication over the TCP or UNIX socket.
+     */
+    if (dnswire_writer_set_bidirectional(&writer, true) != dnswire_ok) {
+        fprintf(stderr, "Unable to set dnswire writer to bidirectional mode\n");
+        return 1;
+    }
+
+    int sockfd;
+
+    if (argc == 3) {
+        /*
+         * We setup and connect to a unix socket at the given path on command line.
+         */
+
+        struct sockaddr_un path;
+
+        memset(&path, 0, sizeof(struct sockaddr_un));
+        path.sun_family = AF_UNIX;
+        strncpy(path.sun_path, argv[2], sizeof(path.sun_path) - 1);
+
+        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (sockfd == -1) {
+            fprintf(stderr, "socket() failed: %s\n", strerror(errno));
+            return 1;
+        }
+        printf("socket\n");
+
+        if (connect(sockfd, (struct sockaddr*)&path, sizeof(struct sockaddr_un))) {
+            fprintf(stderr, "connect() failed: %s\n", strerror(errno));
+            close(sockfd);
+            return 1;
+        }
+        printf("connect\n");
+    } else {
+        /*
+         * We setup and connect to the IP and port given on command line.
+         */
+
+        struct sockaddr_storage addr_store;
+        struct sockaddr_in*     addr = (struct sockaddr_in*)&addr_store;
+        socklen_t               addrlen;
+
+        if (strchr(argv[2], ':')) {
+            addr->sin_family = AF_INET6;
+            addrlen          = sizeof(struct sockaddr_in6);
+        } else {
+            addr->sin_family = AF_INET;
+            addrlen          = sizeof(struct sockaddr_in);
+        }
+
+        if (inet_pton(addr->sin_family, argv[2], &addr->sin_addr) != 1) {
+            fprintf(stderr, "inet_pton(%s) failed: %s\n", argv[2], strerror(errno));
+            return 1;
+        }
+
+        addr->sin_port = ntohs(atoi(argv[3]));
+
+        sockfd = socket(addr->sin_family, SOCK_STREAM, IPPROTO_TCP);
+        if (sockfd == -1) {
+            fprintf(stderr, "socket() failed: %s\n", strerror(errno));
+            return 1;
+        }
+        printf("socket\n");
+
+        if (connect(sockfd, (struct sockaddr*)addr, addrlen)) {
+            fprintf(stderr, "connect() failed: %s\n", strerror(errno));
+            close(sockfd);
+            return 1;
+        }
+        printf("connect\n");
+    }
+
+    /*
+     * We now loop until we have a DNSTAP message, the stream was stopped
+     * or we got an error.
+     */
+
+    int done2 = 0;
+
+    while (!done) {
+        switch (dnswire_reader_fread(&reader, fp)) {
+        case dnswire_have_dnstap:
+            dnswire_writer_set_dnstap(writer, dnswire_reader_dnstap(reader));
+
+            printf("sending...\n");
+            done2 = 0;
+            while (!done2) {
+                switch (dnswire_writer_write(&writer, sockfd)) {
+                case dnswire_ok:
+                    /*
+                     * The DNSTAP message was written successfully, we can now set
+                     * a new DNSTAP message for the writer or stop the stream.
+                     */
+                    printf("sent\n");
+                    done2 = 1;
+                    break;
+                case dnswire_again:
+                    break;
+                case dnswire_endofdata:
+                    /*
+                     * The stream is stopped...
+                     */
+                    printf("prematurely stopped\n");
+                    done  = 1;
+                    done2 = 2;
+                    break;
+                default:
+                    fprintf(stderr, "dnswire_writer_write() error\n");
+                    done  = 1;
+                    done2 = 2;
+                }
+            }
+            break;
+        case dnswire_again:
+        case dnswire_need_more:
+            break;
+        case dnswire_endofdata:
+            done = 1;
+            break;
+        default:
+            fprintf(stderr, "dnswire_reader_fread() error\n");
+            done = 1;
+        }
+    }
+
+    if (done != 2) {
+        /*
+         * This stops the stream, loop again until it's stopped.
+         */
+        printf("stopping...\n");
+        dnswire_writer_stop(&writer);
+        done2 = 0;
+        while (!done2) {
+            switch (dnswire_writer_write(&writer, sockfd)) {
+            case dnswire_again:
+                break;
+            case dnswire_endofdata:
+                /*
+                 * The stream is stopped, we're done!
+                 */
+                printf("stopped\n");
+                done2 = 1;
+                break;
+            default:
+                fprintf(stderr, "dnswire_writer_write() error\n");
+                done2 = 1;
+            }
+        }
+    }
+
+    dnswire_writer_destroy(writer);
+
+    /*
+     * Time to exit, let's shutdown and close the sockets.
+     */
+
+    shutdown(sockfd, SHUT_RDWR);
+    close(sockfd);
+
+    dnswire_reader_destroy(reader);
+    fclose(fp);
+
+    return 0;
+}
diff --git a/examples/receiver.c b/examples/receiver.c
new file mode 100644
index 0000000..316e1ec
--- /dev/null
+++ b/examples/receiver.c
@@ -0,0 +1,169 @@
+#include <dnswire/reader.h>
+
+#include <stdio.h>
+#include <errno.h>
+#include <arpa/inet.h>
+#include <stdlib.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <sys/un.h>
+
+#include "print_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        fprintf(stderr, "usage: receiver [ <IP> <port> | <unix socket path> ]\n");
+        return 1;
+    }
+
+    /*
+     * We first initialize the reader and check that it can allocate the
+     * buffers it needs.
+     */
+
+    struct dnswire_reader reader;
+
+    if (dnswire_reader_init(&reader) != dnswire_ok) {
+        fprintf(stderr, "Unable to initialize dnswire reader\n");
+        return 1;
+    }
+
+    /*
+     * Allow bidirectional communication over the TCP or UNIX socket.
+     */
+    if (dnswire_reader_allow_bidirectional(&reader, true) != dnswire_ok) {
+        fprintf(stderr, "Unable to set dnswire reader to bidirectional mode\n");
+        return 1;
+    }
+
+    int sockfd;
+
+    if (argc == 2) {
+        /*
+         * We setup a unix socket at the given path on command line.
+         */
+
+        struct sockaddr_un path;
+
+        memset(&path, 0, sizeof(struct sockaddr_un));
+        path.sun_family = AF_UNIX;
+        strncpy(path.sun_path, argv[1], sizeof(path.sun_path) - 1);
+
+        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (sockfd == -1) {
+            fprintf(stderr, "socket() failed: %s\n", strerror(errno));
+            return 1;
+        }
+        printf("socket\n");
+
+        if (bind(sockfd, (struct sockaddr*)&path, sizeof(struct sockaddr_un))) {
+            fprintf(stderr, "bind() failed: %s\n", strerror(errno));
+            close(sockfd);
+            return 1;
+        }
+        printf("bind\n");
+    } else {
+        /*
+         * We setup and listen on the IP and port given on command line.
+         */
+
+        struct sockaddr_storage addr_store;
+        struct sockaddr_in*     addr = (struct sockaddr_in*)&addr_store;
+        socklen_t               addrlen;
+
+        if (strchr(argv[1], ':')) {
+            addr->sin_family = AF_INET6;
+            addrlen          = sizeof(struct sockaddr_in6);
+        } else {
+            addr->sin_family = AF_INET;
+            addrlen          = sizeof(struct sockaddr_in);
+        }
+
+        if (inet_pton(addr->sin_family, argv[1], &addr->sin_addr) != 1) {
+            fprintf(stderr, "inet_pton(%s) failed: %s\n", argv[1], strerror(errno));
+            return 1;
+        }
+
+        addr->sin_port = ntohs(atoi(argv[2]));
+
+        sockfd = socket(addr->sin_family, SOCK_STREAM, IPPROTO_TCP);
+        if (sockfd == -1) {
+            fprintf(stderr, "socket() failed: %s\n", strerror(errno));
+            return 1;
+        }
+        printf("socket\n");
+
+        if (bind(sockfd, (struct sockaddr*)addr, addrlen)) {
+            fprintf(stderr, "bind() failed: %s\n", strerror(errno));
+            close(sockfd);
+            return 1;
+        }
+        printf("bind\n");
+    }
+
+    if (listen(sockfd, 1)) {
+        fprintf(stderr, "listen() failed: %s\n", strerror(errno));
+        close(sockfd);
+        return 1;
+    }
+    printf("listen\n");
+
+    int clifd = accept(sockfd, 0, 0);
+    if (clifd < 0) {
+        fprintf(stderr, "accept() failed: %s\n", strerror(errno));
+        close(sockfd);
+        return 1;
+    }
+    printf("accept\n");
+
+    /*
+     * We have accepted connection from the sender!
+     *
+     * We now loop until we have a DNSTAP message, the stream was stopped
+     * or we got an error.
+     */
+
+    int done = 0;
+
+    printf("receiving...\n");
+    while (!done) {
+        switch (dnswire_reader_read(&reader, clifd)) {
+        case dnswire_have_dnstap:
+            /*
+             * We received a DNSTAP message, let's print it.
+             */
+            print_dnstap(dnswire_reader_dnstap(reader));
+            break;
+        case dnswire_again:
+        case dnswire_need_more:
+            /*
+             * This indicates that we need to call the reader again as it
+             * will only do one pass in a non-blocking fasion.
+             */
+            break;
+        case dnswire_endofdata:
+            /*
+             * The stream was stopped from the sender side, we're done!
+             */
+            printf("stopped\n");
+            done = 1;
+            break;
+        default:
+            fprintf(stderr, "dnswire_reader_read() error\n");
+            done = 1;
+        }
+    }
+
+    dnswire_reader_destroy(reader);
+
+    /*
+     * Time to exit, let's shutdown and close the sockets.
+     */
+
+    shutdown(clifd, SHUT_RDWR);
+    close(clifd);
+    close(sockfd);
+
+    return 0;
+}
diff --git a/examples/sender.c b/examples/sender.c
new file mode 100644
index 0000000..c150415
--- /dev/null
+++ b/examples/sender.c
@@ -0,0 +1,169 @@
+#include <dnswire/writer.h>
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include "create_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        fprintf(stderr, "usage: sender [ <IP> <port> | <unix socket path> ]\n");
+        return 1;
+    }
+
+    /*
+     * We first initialize the writer and check that it can allocate the
+     * buffers it needs.
+     */
+
+    struct dnswire_writer writer;
+
+    if (dnswire_writer_init(&writer) != dnswire_ok) {
+        fprintf(stderr, "Unable to initialize dnswire writer\n");
+        return 1;
+    }
+
+    /*
+     * Use bidirectional communication over the TCP or UNIX socket.
+     */
+    if (dnswire_writer_set_bidirectional(&writer, true) != dnswire_ok) {
+        fprintf(stderr, "Unable to set dnswire writer to bidirectional mode\n");
+        return 1;
+    }
+
+    int sockfd;
+
+    if (argc == 2) {
+        /*
+         * We setup and connect to a unix socket at the given path on command line.
+         */
+
+        struct sockaddr_un path;
+
+        memset(&path, 0, sizeof(struct sockaddr_un));
+        path.sun_family = AF_UNIX;
+        strncpy(path.sun_path, argv[1], sizeof(path.sun_path) - 1);
+
+        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (sockfd == -1) {
+            fprintf(stderr, "socket() failed: %s\n", strerror(errno));
+            return 1;
+        }
+        printf("socket\n");
+
+        if (connect(sockfd, (struct sockaddr*)&path, sizeof(struct sockaddr_un))) {
+            fprintf(stderr, "connect() failed: %s\n", strerror(errno));
+            close(sockfd);
+            return 1;
+        }
+        printf("connect\n");
+    } else {
+        /*
+         * We setup and connect to the IP and port given on command line.
+         */
+
+        struct sockaddr_storage addr_store;
+        struct sockaddr_in*     addr = (struct sockaddr_in*)&addr_store;
+        socklen_t               addrlen;
+
+        if (strchr(argv[1], ':')) {
+            addr->sin_family = AF_INET6;
+            addrlen          = sizeof(struct sockaddr_in6);
+        } else {
+            addr->sin_family = AF_INET;
+            addrlen          = sizeof(struct sockaddr_in);
+        }
+
+        if (inet_pton(addr->sin_family, argv[1], &addr->sin_addr) != 1) {
+            fprintf(stderr, "inet_pton(%s) failed: %s\n", argv[1], strerror(errno));
+            return 1;
+        }
+
+        addr->sin_port = ntohs(atoi(argv[2]));
+
+        sockfd = socket(addr->sin_family, SOCK_STREAM, IPPROTO_TCP);
+        if (sockfd == -1) {
+            fprintf(stderr, "socket() failed: %s\n", strerror(errno));
+            return 1;
+        }
+        printf("socket\n");
+
+        if (connect(sockfd, (struct sockaddr*)addr, addrlen)) {
+            fprintf(stderr, "connect() failed: %s\n", strerror(errno));
+            close(sockfd);
+            return 1;
+        }
+        printf("connect\n");
+    }
+
+    /*
+     * We are now connected!
+     *
+     * Now we create a DNSTAP message.
+     */
+
+    struct dnstap d = create_dnstap("sender");
+
+    /*
+     * We set the DNSTAP message the writer should write.
+     */
+
+    dnswire_writer_set_dnstap(writer, &d);
+
+    /*
+     * We now loop and wait for the DNSTAP message to be written.
+     */
+
+    int done = 0;
+
+    printf("sending...\n");
+    while (!done) {
+        switch (dnswire_writer_write(&writer, sockfd)) {
+        case dnswire_ok:
+            /*
+             * The DNSTAP message was written successfully, we can now set
+             * a new DNSTAP message for the writer or stop the stream.
+             *
+             * This stops the stream, loop again until it's stopped.
+             */
+            if (dnswire_writer_stop(&writer) != dnswire_ok) {
+                printf("stopping failed!\n");
+                done = 1;
+            }
+            break;
+        case dnswire_again:
+            /*
+             * This indicates that we need to call the writer again as it
+             * will only do one pass in a non-blocking fasion.
+             */
+            break;
+        case dnswire_endofdata:
+            /*
+             * The stream is stopped, we're done!
+             */
+            printf("stopped\n");
+            done = 1;
+            break;
+        default:
+            fprintf(stderr, "dnswire_writer_write() error\n");
+            done = 1;
+        }
+    }
+
+    dnswire_writer_destroy(writer);
+
+    /*
+     * Time to exit, let's shutdown and close the sockets.
+     */
+
+    shutdown(sockfd, SHUT_RDWR);
+    close(sockfd);
+
+    return 0;
+}
diff --git a/examples/writer.c b/examples/writer.c
new file mode 100644
index 0000000..d9088b8
--- /dev/null
+++ b/examples/writer.c
@@ -0,0 +1,84 @@
+#include <dnswire/writer.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "create_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        fprintf(stderr, "usage: writer <file>\n");
+        return 1;
+    }
+
+    /*
+     * We start by opening the output file for writing.
+     */
+
+    FILE* fp = fopen(argv[1], "w");
+    if (!fp) {
+        fprintf(stderr, "Unable to open %s: %s\n", argv[1], strerror(errno));
+        return 1;
+    }
+
+    /*
+     * We first initialize the writer and check that it can allocate the
+     * buffers it needs.
+     */
+
+    struct dnswire_writer writer;
+
+    if (dnswire_writer_init(&writer) != dnswire_ok) {
+        fprintf(stderr, "Unable to initialize dnswire writer\n");
+        return 1;
+    }
+
+    /*
+     * Now we create a DNSTAP message.
+     */
+
+    struct dnstap d = create_dnstap("writer");
+
+    /*
+     * We set the DNSTAP message the writer should write.
+     */
+
+    dnswire_writer_set_dnstap(writer, &d);
+
+    /*
+     * We now loop and wait for the DNSTAP message to be written.
+     */
+
+    int done = 0;
+
+    while (!done) {
+        switch (dnswire_writer_fwrite(&writer, fp)) {
+        case dnswire_ok:
+            /*
+             * The DNSTAP message was written successfully, we can now set
+             * a new DNSTAP message for the writer or stop the stream.
+             *
+             * This stops the stream, loop again until it's stopped.
+             */
+            dnswire_writer_stop(&writer);
+            break;
+        case dnswire_again:
+            break;
+        case dnswire_endofdata:
+            /*
+             * The stream is stopped, we're done!
+             */
+            done = 1;
+            break;
+        default:
+            fprintf(stderr, "dnswire_writer_fwrite() error\n");
+            done = 1;
+        }
+    }
+
+    dnswire_writer_destroy(writer);
+    fclose(fp);
+    return 0;
+}
diff --git a/fmt.sh b/fmt.sh
new file mode 100755
index 0000000..b39dcc1
--- /dev/null
+++ b/fmt.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+clang-format \
+    -style=file \
+    -i \
+    src/*.c \
+    src/dnswire/*.h \
+    src/test/*.c \
+    examples/*.c
diff --git a/libdnswire.pc.in b/libdnswire.pc.in
new file mode 100644
index 0000000..8534147
--- /dev/null
+++ b/libdnswire.pc.in
@@ -0,0 +1,13 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: libdnswire
+Description: dnswire library
+Version: @VERSION@
+URL: https://github.com/DNS-OARC/dnswire
+Requires: libtinyframe >= 0.1.0
+Libs: -L${libdir} -ldnswire
+Libs.private:
+Cflags: -I${includedir}
diff --git a/m4/ax_append_flag.m4 b/m4/ax_append_flag.m4
new file mode 100644
index 0000000..dd6d8b6
--- /dev/null
+++ b/m4/ax_append_flag.m4
@@ -0,0 +1,50 @@
+# ===========================================================================
+#      https://www.gnu.org/software/autoconf-archive/ax_append_flag.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_APPEND_FLAG(FLAG, [FLAGS-VARIABLE])
+#
+# DESCRIPTION
+#
+#   FLAG is appended to the FLAGS-VARIABLE shell variable, with a space
+#   added in between.
+#
+#   If FLAGS-VARIABLE is not specified, the current language's flags (e.g.
+#   CFLAGS) is used.  FLAGS-VARIABLE is not changed if it already contains
+#   FLAG.  If FLAGS-VARIABLE is unset in the shell, it is set to exactly
+#   FLAG.
+#
+#   NOTE: Implementation based on AX_CFLAGS_GCC_OPTION.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
+#   Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.  This file is offered as-is, without any
+#   warranty.
+
+#serial 8
+
+AC_DEFUN([AX_APPEND_FLAG],
+[dnl
+AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_SET_IF
+AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])
+AS_VAR_SET_IF(FLAGS,[
+  AS_CASE([" AS_VAR_GET(FLAGS) "],
+    [*" $1 "*], [AC_RUN_LOG([: FLAGS already contains $1])],
+    [
+     AS_VAR_APPEND(FLAGS,[" $1"])
+     AC_RUN_LOG([: FLAGS="$FLAGS"])
+    ])
+  ],
+  [
+  AS_VAR_SET(FLAGS,[$1])
+  AC_RUN_LOG([: FLAGS="$FLAGS"])
+  ])
+AS_VAR_POPDEF([FLAGS])dnl
+])dnl AX_APPEND_FLAG
diff --git a/m4/ax_cflags_warn_all.m4 b/m4/ax_cflags_warn_all.m4
new file mode 100644
index 0000000..9235a18
--- /dev/null
+++ b/m4/ax_cflags_warn_all.m4
@@ -0,0 +1,158 @@
+# ===========================================================================
+#    https://www.gnu.org/software/autoconf-archive/ax_cflags_warn_all.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_CFLAGS_WARN_ALL   [(shellvar[, default[, action-if-found[, action-if-not-found]]])]
+#   AX_CXXFLAGS_WARN_ALL [(shellvar[, default[, action-if-found[, action-if-not-found]]])]
+#   AX_FCFLAGS_WARN_ALL  [(shellvar[, default[, action-if-found[, action-if-not-found]]])]
+#
+# DESCRIPTION
+#
+#   Specify compiler options that enable most reasonable warnings.  For the
+#   GNU Compiler Collection (GCC), for example, it will be "-Wall".  The
+#   result is added to shellvar, one of CFLAGS, CXXFLAGS or FCFLAGS if the
+#   first parameter is not specified.
+#
+#   Each of these macros accepts the following optional arguments:
+#
+#     - $1 - shellvar
+#         shell variable to use (CFLAGS, CXXFLAGS or FCFLAGS if not
+#         specified, depending on macro)
+#
+#     - $2 - default
+#         value to use for flags if compiler vendor cannot be determined (by
+#         default, "")
+#
+#     - $3 - action-if-found
+#         action to take if the compiler vendor has been successfully
+#         determined (by default, add the appropriate compiler flags to
+#         shellvar)
+#
+#     - $4 - action-if-not-found
+#         action to take if the compiler vendor has not been determined or
+#         is unknown (by default, add the default flags, or "" if not
+#         specified, to shellvar)
+#
+#   These macros use AX_COMPILER_VENDOR to determine which flags should be
+#   returned for a given compiler.  Not all compilers currently have flags
+#   defined for them; patches are welcome.  If need be, compiler flags may
+#   be made language-dependent: use a construct like the following:
+#
+#     [vendor_name], [m4_if(_AC_LANG_PREFIX,[C],   VAR="--relevant-c-flags",dnl
+#                     m4_if(_AC_LANG_PREFIX,[CXX], VAR="--relevant-c++-flags",dnl
+#                     m4_if(_AC_LANG_PREFIX,[FC],  VAR="--relevant-fortran-flags",dnl
+#                     VAR="$2"; FOUND="no")))],
+#
+#   Note: These macros also depend on AX_PREPEND_FLAG.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
+#   Copyright (c) 2010 Rhys Ulerich <rhys.ulerich@gmail.com>
+#   Copyright (c) 2018 John Zaitseff <J.Zaitseff@zap.org.au>
+#
+#   This program is free software; you can redistribute it and/or modify it
+#   under the terms of the GNU General Public License as published by the
+#   Free Software Foundation; either version 3 of the License, or (at your
+#   option) any later version.
+#
+#   This program is distributed in the hope that it will be useful, but
+#   WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+#   Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License along
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
+#
+#   As a special exception, the respective Autoconf Macro's copyright owner
+#   gives unlimited permission to copy, distribute and modify the configure
+#   scripts that are the output of Autoconf when processing the Macro. You
+#   need not follow the terms of the GNU General Public License when using
+#   or distributing such scripts, even though portions of the text of the
+#   Macro appear in them. The GNU General Public License (GPL) does govern
+#   all other use of the material that constitutes the Autoconf Macro.
+#
+#   This special exception to the GPL applies to versions of the Autoconf
+#   Macro released by the Autoconf Archive. When you make and distribute a
+#   modified version of the Autoconf Macro, you may extend this special
+#   exception to the GPL to apply to your modified version as well.
+
+#serial 25
+
+AC_DEFUN([AX_FLAGS_WARN_ALL], [
+    AX_REQUIRE_DEFINED([AX_PREPEND_FLAG])dnl
+    AC_REQUIRE([AX_COMPILER_VENDOR])dnl
+
+    AS_VAR_PUSHDEF([FLAGS], [m4_default($1,_AC_LANG_PREFIX[]FLAGS)])dnl
+    AS_VAR_PUSHDEF([VAR],   [ac_cv_[]_AC_LANG_ABBREV[]flags_warn_all])dnl
+    AS_VAR_PUSHDEF([FOUND], [ac_save_[]_AC_LANG_ABBREV[]flags_warn_all_found])dnl
+
+    AC_CACHE_CHECK([FLAGS for most reasonable warnings], VAR, [
+	VAR=""
+	FOUND="yes"
+	dnl  Cases are listed in the order found in ax_compiler_vendor.m4
+	AS_CASE("$ax_cv_[]_AC_LANG_ABBREV[]_compiler_vendor",
+	    [intel],		[VAR="-w2"],
+	    [ibm],		[VAR="-qsrcmsg -qinfo=all:noppt:noppc:noobs:nocnd"],
+	    [pathscale],	[],
+	    [clang],		[VAR="-Wall"],
+	    [cray],		[VAR="-h msglevel 2"],
+	    [fujitsu],		[],
+	    [sdcc],		[],
+	    [sx],		[VAR="-pvctl[,]fullmsg"],
+	    [portland],		[],
+	    [gnu],		[VAR="-Wall"],
+	    [sun],		[VAR="-v"],
+	    [hp],		[VAR="+w1"],
+	    [dec],		[VAR="-verbose -w0 -warnprotos"],
+	    [borland],		[],
+	    [comeau],		[],
+	    [kai],		[],
+	    [lcc],		[],
+	    [sgi],		[VAR="-fullwarn"],
+	    [microsoft],	[],
+	    [metrowerks],	[],
+	    [watcom],		[],
+	    [tcc],		[],
+	    [unknown],		[
+				    VAR="$2"
+				    FOUND="no"
+				],
+				[
+				    AC_MSG_WARN([Unknown compiler vendor returned by [AX_COMPILER_VENDOR]])
+				    VAR="$2"
+				    FOUND="no"
+				]
+	)
+
+	AS_IF([test "x$FOUND" = "xyes"], [dnl
+	    m4_default($3, [AS_IF([test "x$VAR" != "x"], [AX_PREPEND_FLAG([$VAR], [FLAGS])])])
+	], [dnl
+	    m4_default($4, [m4_ifval($2, [AX_PREPEND_FLAG([$VAR], [FLAGS])], [true])])
+	])dnl
+    ])dnl
+
+    AS_VAR_POPDEF([FOUND])dnl
+    AS_VAR_POPDEF([VAR])dnl
+    AS_VAR_POPDEF([FLAGS])dnl
+])dnl AX_FLAGS_WARN_ALL
+
+AC_DEFUN([AX_CFLAGS_WARN_ALL], [dnl
+    AC_LANG_PUSH([C])
+    AX_FLAGS_WARN_ALL([$1], [$2], [$3], [$4])
+    AC_LANG_POP([C])
+])dnl
+
+AC_DEFUN([AX_CXXFLAGS_WARN_ALL], [dnl
+    AC_LANG_PUSH([C++])
+    AX_FLAGS_WARN_ALL([$1], [$2], [$3], [$4])
+    AC_LANG_POP([C++])
+])dnl
+
+AC_DEFUN([AX_FCFLAGS_WARN_ALL], [dnl
+    AC_LANG_PUSH([Fortran])
+    AX_FLAGS_WARN_ALL([$1], [$2], [$3], [$4])
+    AC_LANG_POP([Fortran])
+])dnl
diff --git a/m4/ax_compiler_vendor.m4 b/m4/ax_compiler_vendor.m4
new file mode 100644
index 0000000..f06e865
--- /dev/null
+++ b/m4/ax_compiler_vendor.m4
@@ -0,0 +1,117 @@
+# ===========================================================================
+#    https://www.gnu.org/software/autoconf-archive/ax_compiler_vendor.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_COMPILER_VENDOR
+#
+# DESCRIPTION
+#
+#   Determine the vendor of the C, C++ or Fortran compiler.  The vendor is
+#   returned in the cache variable $ax_cv_c_compiler_vendor for C,
+#   $ax_cv_cxx_compiler_vendor for C++ or $ax_cv_fc_compiler_vendor for
+#   (modern) Fortran.  The value is one of "intel", "ibm", "pathscale",
+#   "clang" (LLVM), "cray", "fujitsu", "sdcc", "sx", "portland" (PGI), "gnu"
+#   (GCC), "sun" (Oracle Developer Studio), "hp", "dec", "borland",
+#   "comeau", "kai", "lcc", "sgi", "microsoft", "metrowerks", "watcom",
+#   "tcc" (Tiny CC) or "unknown" (if the compiler cannot be determined).
+#
+#   To check for a Fortran compiler, you must first call AC_FC_PP_SRCEXT
+#   with an appropriate preprocessor-enabled extension.  For example:
+#
+#     AC_LANG_PUSH([Fortran])
+#     AC_PROG_FC
+#     AC_FC_PP_SRCEXT([F])
+#     AX_COMPILER_VENDOR
+#     AC_LANG_POP([Fortran])
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Steven G. Johnson <stevenj@alum.mit.edu>
+#   Copyright (c) 2008 Matteo Frigo
+#   Copyright (c) 2018-19 John Zaitseff <J.Zaitseff@zap.org.au>
+#
+#   This program is free software: you can redistribute it and/or modify it
+#   under the terms of the GNU General Public License as published by the
+#   Free Software Foundation, either version 3 of the License, or (at your
+#   option) any later version.
+#
+#   This program is distributed in the hope that it will be useful, but
+#   WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+#   Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License along
+#   with this program. If not, see <https://www.gnu.org/licenses/>.
+#
+#   As a special exception, the respective Autoconf Macro's copyright owner
+#   gives unlimited permission to copy, distribute and modify the configure
+#   scripts that are the output of Autoconf when processing the Macro. You
+#   need not follow the terms of the GNU General Public License when using
+#   or distributing such scripts, even though portions of the text of the
+#   Macro appear in them. The GNU General Public License (GPL) does govern
+#   all other use of the material that constitutes the Autoconf Macro.
+#
+#   This special exception to the GPL applies to versions of the Autoconf
+#   Macro released by the Autoconf Archive. When you make and distribute a
+#   modified version of the Autoconf Macro, you may extend this special
+#   exception to the GPL to apply to your modified version as well.
+
+#serial 30
+
+AC_DEFUN([AX_COMPILER_VENDOR], [dnl
+    AC_CACHE_CHECK([for _AC_LANG compiler vendor], ax_cv_[]_AC_LANG_ABBREV[]_compiler_vendor, [dnl
+	dnl  If you modify this list of vendors, please add similar support
+	dnl  to ax_compiler_version.m4 if at all possible.
+	dnl
+	dnl  Note: Do NOT check for GCC first since some other compilers
+	dnl  define __GNUC__ to remain compatible with it.  Compilers that
+	dnl  are very slow to start (such as Intel) are listed first.
+
+	vendors="
+		intel:		__ICC,__ECC,__INTEL_COMPILER
+		ibm:		__xlc__,__xlC__,__IBMC__,__IBMCPP__,__ibmxl__
+		pathscale:	__PATHCC__,__PATHSCALE__
+		clang:		__clang__
+		cray:		_CRAYC
+		fujitsu:	__FUJITSU
+		sdcc:		SDCC,__SDCC
+		sx:		_SX
+		portland:	__PGI
+		gnu:		__GNUC__
+		sun:		__SUNPRO_C,__SUNPRO_CC,__SUNPRO_F90,__SUNPRO_F95
+		hp:		__HP_cc,__HP_aCC
+		dec:		__DECC,__DECCXX,__DECC_VER,__DECCXX_VER
+		borland:	__BORLANDC__,__CODEGEARC__,__TURBOC__
+		comeau:		__COMO__
+		kai:		__KCC
+		lcc:		__LCC__
+		sgi:		__sgi,sgi
+		microsoft:	_MSC_VER
+		metrowerks:	__MWERKS__
+		watcom:		__WATCOMC__
+		tcc:		__TINYC__
+		unknown:	UNKNOWN
+	"
+	for ventest in $vendors; do
+	    case $ventest in
+		*:)
+		    vendor=$ventest
+		    continue
+		    ;;
+		*)
+		    vencpp="defined("`echo $ventest | sed 's/,/) || defined(/g'`")"
+		    ;;
+	    esac
+
+	    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[
+#if !($vencpp)
+      thisisanerror;
+#endif
+	    ]])], [break])
+	done
+
+	ax_cv_[]_AC_LANG_ABBREV[]_compiler_vendor=`echo $vendor | cut -d: -f1`
+    ])
+])dnl
diff --git a/m4/ax_prepend_flag.m4 b/m4/ax_prepend_flag.m4
new file mode 100644
index 0000000..adac8c5
--- /dev/null
+++ b/m4/ax_prepend_flag.m4
@@ -0,0 +1,51 @@
+# ===========================================================================
+#     https://www.gnu.org/software/autoconf-archive/ax_prepend_flag.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_PREPEND_FLAG(FLAG, [FLAGS-VARIABLE])
+#
+# DESCRIPTION
+#
+#   FLAG is added to the front of the FLAGS-VARIABLE shell variable, with a
+#   space added in between.
+#
+#   If FLAGS-VARIABLE is not specified, the current language's flags (e.g.
+#   CFLAGS) is used.  FLAGS-VARIABLE is not changed if it already contains
+#   FLAG.  If FLAGS-VARIABLE is unset in the shell, it is set to exactly
+#   FLAG.
+#
+#   NOTE: Implementation based on AX_APPEND_FLAG.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
+#   Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
+#   Copyright (c) 2018 John Zaitseff <J.Zaitseff@zap.org.au>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.  This file is offered as-is, without any
+#   warranty.
+
+#serial 2
+
+AC_DEFUN([AX_PREPEND_FLAG],
+[dnl
+AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_SET_IF
+AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])
+AS_VAR_SET_IF(FLAGS,[
+  AS_CASE([" AS_VAR_GET(FLAGS) "],
+    [*" $1 "*], [AC_RUN_LOG([: FLAGS already contains $1])],
+    [
+     FLAGS="$1 $FLAGS"
+     AC_RUN_LOG([: FLAGS="$FLAGS"])
+    ])
+  ],
+  [
+  AS_VAR_SET(FLAGS,[$1])
+  AC_RUN_LOG([: FLAGS="$FLAGS"])
+  ])
+AS_VAR_POPDEF([FLAGS])dnl
+])dnl AX_PREPEND_FLAG
diff --git a/m4/ax_require_defined.m4 b/m4/ax_require_defined.m4
new file mode 100644
index 0000000..17c3eab
--- /dev/null
+++ b/m4/ax_require_defined.m4
@@ -0,0 +1,37 @@
+# ===========================================================================
+#    https://www.gnu.org/software/autoconf-archive/ax_require_defined.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_REQUIRE_DEFINED(MACRO)
+#
+# DESCRIPTION
+#
+#   AX_REQUIRE_DEFINED is a simple helper for making sure other macros have
+#   been defined and thus are available for use.  This avoids random issues
+#   where a macro isn't expanded.  Instead the configure script emits a
+#   non-fatal:
+#
+#     ./configure: line 1673: AX_CFLAGS_WARN_ALL: command not found
+#
+#   It's like AC_REQUIRE except it doesn't expand the required macro.
+#
+#   Here's an example:
+#
+#     AX_REQUIRE_DEFINED([AX_CHECK_LINK_FLAG])
+#
+# LICENSE
+#
+#   Copyright (c) 2014 Mike Frysinger <vapier@gentoo.org>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 2
+
+AC_DEFUN([AX_REQUIRE_DEFINED], [dnl
+  m4_ifndef([$1], [m4_fatal([macro ]$1[ is not defined; is a m4 file missing?])])
+])dnl AX_REQUIRE_DEFINED
diff --git a/m4/dl.sh b/m4/dl.sh
new file mode 100755
index 0000000..1d8d9f7
--- /dev/null
+++ b/m4/dl.sh
@@ -0,0 +1,9 @@
+#!/bin/sh -e
+
+m4_files="ax_prepend_flag.m4 ax_append_flag.m4 ax_cflags_warn_all.m4
+ ax_require_defined.m4 ax_compiler_vendor.m4"
+
+for ax in $m4_files; do
+  rm -f "$ax"
+  wget -O "$ax" "http://git.savannah.gnu.org/gitweb/?p=autoconf-archive.git;a=blob_plain;f=m4/$ax"
+done
diff --git a/rpm/dnswire.spec b/rpm/dnswire.spec
new file mode 100644
index 0000000..d1135b7
--- /dev/null
+++ b/rpm/dnswire.spec
@@ -0,0 +1,126 @@
+%define sover   0
+%define libname libdnswire%{sover}
+Name:           dnswire
+Version:        0.2.0
+Release:        1%{?dist}
+Summary:        library for DNS encapsulations and transporting of them
+Group:          Development/Libraries/C and C++
+
+License:        LGPL-3.0-or-later
+URL:            https://github.com/DNS-OARC/dnswire
+# Source needs to be generated by dist-tools/create-source-packages, see
+# https://github.com/jelu/dist-tools
+Source0:        %{name}_%{version}.orig.tar.gz
+
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  libtool
+BuildRequires:  pkgconfig
+BuildRequires:  tinyframe-devel
+%if 0%{?suse_version} || 0%{?sle_version}
+BuildRequires:  protobuf-c
+BuildRequires:  libprotobuf-c-devel
+%else
+BuildRequires:  protobuf-c-compiler
+BuildRequires:  protobuf-c-devel
+%endif
+
+%description
+A C library for encoding/decoding different DNS encapsulations and
+transporting them over different protocols.
+
+%package -n %{libname}
+Summary:        library for DNS encapsulations and transporting of them
+Group:          System/Libraries
+
+%description -n %{libname}
+A C library for encoding/decoding different DNS encapsulations and
+transporting them over different protocols.
+
+%package devel
+Summary:        library for DNS encapsulations and transporting of them - development files
+Group:          Development/Libraries/C and C++
+Requires:       %{libname} = %{version}
+Requires:       tinyframe-devel
+%if 0%{?suse_version} || 0%{?sle_version}
+Requires:       libprotobuf-c-devel
+%else
+Requires:       protobuf-c-devel
+%endif
+
+%description devel
+A C library for encoding/decoding different DNS encapsulations and
+transporting them over different protocols.
+
+
+%prep
+%setup -q -n %{name}_%{version}
+
+
+%build
+sh autogen.sh
+%configure --disable-examples
+make %{?_smp_mflags}
+
+
+%install
+rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT
+
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+
+%post -n %{libname}
+/sbin/ldconfig
+
+
+%postun -n %{libname}
+/sbin/ldconfig
+
+
+%files -n %{libname}
+%defattr(-,root,root,-)
+%{_libdir}/libdnswire.so.%{sover}*
+
+
+%files devel
+%defattr(-,root,root,-)
+%{_includedir}/*
+# %{_mandir}/man3/*
+%{_libdir}/libdnswire.so
+%{_libdir}/pkgconfig/libdnswire.pc
+%exclude %{_libdir}/libdnswire.a
+%exclude %{_libdir}/libdnswire.la
+%{_datadir}/doc/*
+
+
+%changelog
+* Fri Oct 23 2020 Jerry Lundström <lundstrom.jerry@gmail.com> 0.2.0-1
+- Release 0.2.0
+  * This release fixes various issues and bugs in the API, fix typos and
+    adds coverage tests.
+  * Fixes:
+    - `dnstap_decode_protobuf()`: Fix setting of unknown socket family and protocol, was setting DNSTAP_MESSAGE_TYPE_ enums.
+    - `enum dnstap_message_type`: Fix typo in unknown enum, now correct `DNSTAP_SOCKET_FAMILY_UNKNOWN`
+    - `dnswire_encoder_encode()`: Remove setting state when to the same state it was
+    - `dnswire_writer_set_bufsize()`: Fix bug with changing buffer size while having something in the buffer
+  * Commits:
+    3bfd7e2 Travis, configure
+    27f69ab Coverage
+    d04b810 Coverage
+    ee153d7 Badges
+    a381843 Travis
+    f3a3e43 COPR
+    4b6640f Compile warnings
+    bc1b2e2 Funding
+    ae537a9 Examples, tests
+    c139dd7 LGTM
+* Fri Mar 20 2020 Jerry Lundström <lundstrom.jerry@gmail.com> 0.1.1-1
+- Release v0.1.1
+  * Fix RPM devel package dependencies
+  * Commits:
+    b451169 package
+* Thu Mar 19 2020 Jerry Lundström <lundstrom.jerry@gmail.com> 0.1.0-1
+- Release 0.1.0
diff --git a/sonar-project.properties.local b/sonar-project.properties.local
new file mode 100644
index 0000000..0f8d208
--- /dev/null
+++ b/sonar-project.properties.local
@@ -0,0 +1 @@
+sonar.coverage.exclusions=src/test/**, src/*.pb-c.*, src/**/*.pb-c.*
diff --git a/src/Makefile.am b/src/Makefile.am
new file mode 100644
index 0000000..07a49dd
--- /dev/null
+++ b/src/Makefile.am
@@ -0,0 +1,48 @@
+MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
+BUILT_SOURCES =
+CLEANFILES = *.gcda *.gcno *.gcov
+EXTRA_DIST =
+
+SUBDIRS = test
+
+AM_CFLAGS = $(tinyframe_CFLAGS) \
+  $(protobuf_c_CFLAGS)
+
+lib_LTLIBRARIES = libdnswire.la
+
+libdnswire_la_SOURCES = decoder.c dnstap.c dnswire.c encoder.c reader.c \
+  writer.c trace.c
+nodist_libdnswire_la_SOURCES = dnstap.pb-c.c
+BUILT_SOURCES += dnswire/dnstap.pb-c.h
+nobase_include_HEADERS = dnswire/decoder.h dnswire/dnstap.h \
+  dnswire/dnswire.h dnswire/encoder.h dnswire/reader.h dnswire/writer.h
+nobase_nodist_include_HEADERS = dnswire/version.h dnswire/dnstap.pb-c.h \
+  dnswire/dnstap-macros.h dnswire/trace.h
+libdnswire_la_LDFLAGS = -version-info $(DNSWIRE_LIBRARY_VERSION) \
+  $(protobuf_c_LIBS) \
+  $(tinyframe_LIBS)
+
+CLEANFILES += $(nodist_libdnswire_la_SOURCES)
+EXTRA_DIST += dnstap.pb/dnstap.proto dnstap.pb/LICENSE dnstap.pb/README.md
+
+dnswire/dnstap.pb-c.h: dnstap.pb-c.c
+	mkdir -p dnswire/
+	cp dnstap.pb-c.h dnswire/
+
+dnstap.pb-c.c: dnstap.pb/dnstap.proto
+	$(AM_V_GEN)@PROTOC_C@ "--c_out=." -I$(srcdir)/dnstap.pb "$(srcdir)/dnstap.pb/dnstap.proto"
+
+BUILT_SOURCES += dnswire/dnstap-macros.h
+EXTRA_DIST += gen-macros.sh dnstap.fields
+
+dnswire/dnstap-macros.h: dnstap.fields gen-macros.sh
+	$(AM_V_GEN)"$(srcdir)/gen-macros.sh" "$(srcdir)/dnstap.fields" >dnswire/dnstap-macros.h
+
+CLEANFILES += $(BUILT_SOURCES)
+
+if ENABLE_GCOV
+gcov-local:
+	for src in $(libdnswire_la_SOURCES); do \
+	  gcov -l -r -s "$(srcdir)" "$$src"; \
+	done
+endif
diff --git a/src/decoder.c b/src/decoder.c
new file mode 100644
index 0000000..821b14e
--- /dev/null
+++ b/src/decoder.c
@@ -0,0 +1,203 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+
+#include "dnswire/decoder.h"
+#include "dnswire/trace.h"
+
+#include <assert.h>
+
+const char* const dnswire_decoder_state_string[] = {
+    "reading_control",
+    "checking_ready",
+    "checking_accept",
+    "reading_start",
+    "checking_start",
+    "reading_frames",
+    "checking_finish",
+    "done",
+};
+
+#define __state(h, s)                                                                                     \
+    __trace("state %s => %s", dnswire_decoder_state_string[(h)->state], dnswire_decoder_state_string[s]); \
+    (h)->state = s;
+
+enum dnswire_result dnswire_decoder_decode(struct dnswire_decoder* handle, const uint8_t* data, size_t len)
+{
+    assert(handle);
+    assert(data);
+    assert(len);
+
+    switch (handle->state) {
+    case dnswire_decoder_reading_control:
+        switch (tinyframe_read(&handle->reader, data, len)) {
+        case tinyframe_have_control:
+            switch (handle->reader.control.type) {
+            case TINYFRAME_CONTROL_READY:
+                // indicate that we have bidirectional communications
+                __state(handle, dnswire_decoder_checking_ready);
+                return dnswire_again;
+
+            case TINYFRAME_CONTROL_ACCEPT:
+                // indicate that we have bidirectional communications
+                __state(handle, dnswire_decoder_checking_accept);
+                return dnswire_again;
+
+            case TINYFRAME_CONTROL_START:
+                __state(handle, dnswire_decoder_checking_start);
+                return dnswire_again;
+
+            default:
+                break;
+            }
+            break;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_decoder_checking_ready:
+        switch (tinyframe_read(&handle->reader, data, len)) {
+        case tinyframe_have_control_field:
+            if (handle->reader.control_field.type != TINYFRAME_CONTROL_FIELD_CONTENT_TYPE) {
+                return dnswire_error;
+            }
+            if (!strncmp(DNSTAP_PROTOBUF_CONTENT_TYPE, (const char*)handle->reader.control_field.data, handle->reader.control_field.length)) {
+                handle->ready_support_dnstap_protobuf = 1;
+            }
+            if (!handle->reader.control_length_left) {
+                __state(handle, dnswire_decoder_reading_start);
+                return dnswire_bidirectional;
+            }
+            return dnswire_again;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_decoder_checking_accept:
+        switch (tinyframe_read(&handle->reader, data, len)) {
+        case tinyframe_have_control_field:
+            if (handle->reader.control_field.type != TINYFRAME_CONTROL_FIELD_CONTENT_TYPE) {
+                return dnswire_error;
+            }
+            if (!strncmp(DNSTAP_PROTOBUF_CONTENT_TYPE, (const char*)handle->reader.control_field.data, handle->reader.control_field.length)) {
+                handle->accept_support_dnstap_protobuf = 1;
+            }
+            if (!handle->reader.control_length_left) {
+                __state(handle, dnswire_decoder_checking_finish);
+                return dnswire_bidirectional;
+            }
+            return dnswire_again;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_decoder_reading_start:
+        switch (tinyframe_read(&handle->reader, data, len)) {
+        case tinyframe_have_control:
+            switch (handle->reader.control.type) {
+            case TINYFRAME_CONTROL_START:
+                __state(handle, dnswire_decoder_checking_start);
+                return dnswire_again;
+
+            default:
+                break;
+            }
+            return dnswire_error;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_decoder_checking_start:
+        switch (tinyframe_read(&handle->reader, data, len)) {
+        case tinyframe_have_control_field:
+            if (handle->reader.control_field.type != TINYFRAME_CONTROL_FIELD_CONTENT_TYPE) {
+                return dnswire_error;
+            }
+            if (strncmp(DNSTAP_PROTOBUF_CONTENT_TYPE, (const char*)handle->reader.control_field.data, handle->reader.control_field.length)) {
+                return dnswire_error;
+            }
+            __state(handle, dnswire_decoder_reading_frames);
+            return dnswire_again;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_decoder_reading_frames:
+        switch (tinyframe_read(&handle->reader, data, len)) {
+        case tinyframe_have_frame:
+            dnstap_cleanup(&handle->dnstap);
+            if (dnstap_decode_protobuf(&handle->dnstap, handle->reader.frame.data, handle->reader.frame.length)) {
+                return dnswire_error;
+            }
+            return dnswire_have_dnstap;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        case tinyframe_stopped:
+            __state(handle, dnswire_decoder_done);
+            return dnswire_endofdata;
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_decoder_checking_finish:
+        switch (tinyframe_read(&handle->reader, data, len)) {
+        case tinyframe_finished:
+            __state(handle, dnswire_decoder_done);
+            return dnswire_endofdata;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_decoder_done:
+        break;
+    }
+
+    return dnswire_error;
+}
diff --git a/src/dnstap.c b/src/dnstap.c
new file mode 100644
index 0000000..c5275b7
--- /dev/null
+++ b/src/dnstap.c
@@ -0,0 +1,141 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+
+#include "dnswire/dnstap.h"
+
+const char* const DNSTAP_TYPE_STRING[] = {
+    "UNKNOWN",
+    "MESSAGE",
+};
+const char* const DNSTAP_MESSAGE_TYPE_STRING[] = {
+    "UNKNOWN",
+    "AUTH_QUERY",
+    "AUTH_RESPONSE",
+    "RESOLVER_QUERY",
+    "RESOLVER_RESPONSE",
+    "CLIENT_QUERY",
+    "CLIENT_RESPONSE",
+    "FORWARDER_QUERY",
+    "FORWARDER_RESPONSE",
+    "STUB_QUERY",
+    "STUB_RESPONSE",
+    "TOOL_QUERY",
+    "TOOL_RESPONSE",
+};
+const char* const DNSTAP_SOCKET_FAMILY_STRING[] = {
+    "UNKNOWN",
+    "INET",
+    "INET6",
+};
+const char* const DNSTAP_SOCKET_PROTOCOL_STRING[] = {
+    "UNKNOWN",
+    "UDP",
+    "TCP",
+};
+
+int dnstap_decode_protobuf(struct dnstap* dnstap, const uint8_t* data, size_t len)
+{
+    assert(dnstap);
+    assert(data);
+    assert(!dnstap->unpacked_dnstap);
+
+    if (!(dnstap->unpacked_dnstap = dnstap__dnstap__unpack(NULL, len, data))) {
+        return 1;
+    }
+
+    dnstap->dnstap = *dnstap->unpacked_dnstap;
+
+    switch (dnstap->dnstap.type) {
+    case DNSTAP_TYPE_MESSAGE:
+        break;
+    default:
+        dnstap->dnstap.type = (enum _Dnstap__Dnstap__Type)DNSTAP_TYPE_UNKNOWN;
+    }
+
+    if (dnstap->dnstap.message) {
+        dnstap->message = *dnstap->dnstap.message;
+
+        switch (dnstap->message.type) {
+        case DNSTAP_MESSAGE_TYPE_AUTH_QUERY:
+        case DNSTAP_MESSAGE_TYPE_AUTH_RESPONSE:
+        case DNSTAP_MESSAGE_TYPE_RESOLVER_QUERY:
+        case DNSTAP_MESSAGE_TYPE_RESOLVER_RESPONSE:
+        case DNSTAP_MESSAGE_TYPE_CLIENT_QUERY:
+        case DNSTAP_MESSAGE_TYPE_CLIENT_RESPONSE:
+        case DNSTAP_MESSAGE_TYPE_FORWARDER_QUERY:
+        case DNSTAP_MESSAGE_TYPE_FORWARDER_RESPONSE:
+        case DNSTAP_MESSAGE_TYPE_STUB_QUERY:
+        case DNSTAP_MESSAGE_TYPE_STUB_RESPONSE:
+        case DNSTAP_MESSAGE_TYPE_TOOL_QUERY:
+        case DNSTAP_MESSAGE_TYPE_TOOL_RESPONSE:
+            break;
+        default:
+            dnstap->message.type = (enum _Dnstap__Message__Type)DNSTAP_MESSAGE_TYPE_UNKNOWN;
+        }
+
+        switch (dnstap->message.socket_family) {
+        case DNSTAP_SOCKET_FAMILY_INET:
+        case DNSTAP_SOCKET_FAMILY_INET6:
+            break;
+        default:
+            dnstap->message.has_socket_family = false;
+            dnstap->message.socket_family     = (enum _Dnstap__SocketFamily)DNSTAP_SOCKET_FAMILY_UNKNOWN;
+        }
+
+        switch (dnstap->message.socket_protocol) {
+        case DNSTAP_SOCKET_PROTOCOL_UDP:
+        case DNSTAP_SOCKET_PROTOCOL_TCP:
+            break;
+        default:
+            dnstap->message.has_socket_protocol = false;
+            dnstap->message.socket_protocol     = (enum _Dnstap__SocketProtocol)DNSTAP_SOCKET_PROTOCOL_UNKNOWN;
+        }
+    }
+
+    return 0;
+}
+
+void dnstap_cleanup(struct dnstap* dnstap)
+{
+    assert(dnstap);
+
+    if (dnstap->unpacked_dnstap) {
+        dnstap__dnstap__free_unpacked(dnstap->unpacked_dnstap, NULL);
+        dnstap->unpacked_dnstap = 0;
+    }
+}
+
+size_t dnstap_encode_protobuf_size(const struct dnstap* dnstap)
+{
+    assert(dnstap);
+
+    return dnstap__dnstap__get_packed_size(&dnstap->dnstap);
+}
+
+size_t dnstap_encode_protobuf(const struct dnstap* dnstap, uint8_t* data)
+{
+    assert(dnstap);
+    assert(data);
+
+    return dnstap__dnstap__pack(&dnstap->dnstap, data);
+}
diff --git a/src/dnstap.fields b/src/dnstap.fields
new file mode 100644
index 0000000..e38b6e5
--- /dev/null
+++ b/src/dnstap.fields
@@ -0,0 +1,16 @@
+dnstap dnstap identity string
+dnstap dnstap version string
+dnstap dnstap extra bytes
+dnstap_message message socket_family enum dnstap_socket_family
+dnstap_message message socket_protocol enum dnstap_socket_protocol
+dnstap_message message query_address bytes
+dnstap_message message response_address bytes
+dnstap_message message query_port value uint32_t
+dnstap_message message response_port value uint32_t
+dnstap_message message query_time_sec value uint64_t
+dnstap_message message query_time_nsec value uint32_t
+dnstap_message message query_message bytes
+dnstap_message message query_zone bytes
+dnstap_message message response_time_sec value uint64_t
+dnstap_message message response_time_nsec value uint32_t
+dnstap_message message response_message bytes
diff --git a/src/dnswire.c b/src/dnswire.c
new file mode 100644
index 0000000..5468434
--- /dev/null
+++ b/src/dnswire.c
@@ -0,0 +1,34 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+
+#include "dnswire/dnswire.h"
+
+const char* const dnswire_result_string[] = {
+    "ok",
+    "error",
+    "again",
+    "need_more",
+    "have_dnstap",
+    "endofdata",
+    "bidirectional",
+};
diff --git a/src/dnswire/decoder.h b/src/dnswire/decoder.h
new file mode 100644
index 0000000..60ab44e
--- /dev/null
+++ b/src/dnswire/decoder.h
@@ -0,0 +1,64 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dnswire/dnswire.h>
+#include <dnswire/dnstap.h>
+
+#include <tinyframe/tinyframe.h>
+
+#ifndef __dnswire_h_decoder
+#define __dnswire_h_decoder 1
+
+enum dnswire_decoder_state {
+    dnswire_decoder_reading_control = 0,
+    dnswire_decoder_checking_ready  = 1,
+    dnswire_decoder_checking_accept = 2,
+    dnswire_decoder_reading_start   = 3,
+    dnswire_decoder_checking_start  = 4,
+    dnswire_decoder_reading_frames  = 5,
+    dnswire_decoder_checking_finish = 6,
+    dnswire_decoder_done            = 7,
+};
+extern const char* const dnswire_decoder_state_string[];
+
+struct dnswire_decoder {
+    enum dnswire_decoder_state state;
+    struct tinyframe_reader    reader;
+    struct dnstap              dnstap;
+
+    unsigned ready_support_dnstap_protobuf : 1;
+    unsigned accept_support_dnstap_protobuf : 1;
+};
+
+#define DNSWIRE_DECODER_INITIALIZER                \
+    {                                              \
+        .state  = dnswire_decoder_reading_control, \
+        .reader = TINYFRAME_READER_INITIALIZER,    \
+        .dnstap = DNSTAP_INITIALIZER,              \
+    }
+
+#define dnswire_decoder_decoded(d) (d).reader.bytes_read
+#define dnswire_decoder_dnstap(d) (&(d).dnstap)
+#define dnswire_decoder_cleanup(d) dnstap_cleanup(&(d).dnstap)
+
+enum dnswire_result dnswire_decoder_decode(struct dnswire_decoder*, const uint8_t*, size_t);
+
+#endif
diff --git a/src/dnswire/dnstap.h b/src/dnswire/dnstap.h
new file mode 100644
index 0000000..97da495
--- /dev/null
+++ b/src/dnswire/dnstap.h
@@ -0,0 +1,151 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dnswire/dnstap.pb-c.h>
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include <string.h>
+
+#ifndef __dnswire_h_dnstap
+#define __dnswire_h_dnstap 1
+
+#define DNSTAP_PROTOBUF_CONTENT_TYPE "protobuf:dnstap.Dnstap"
+#define DNSTAP_PROTOBUF_CONTENT_TYPE_LENGTH 22
+
+enum dnstap_type {
+    DNSTAP_TYPE_UNKNOWN = 0,
+    DNSTAP_TYPE_MESSAGE = 1,
+};
+extern const char* const DNSTAP_TYPE_STRING[];
+
+enum dnstap_message_type {
+    DNSTAP_MESSAGE_TYPE_UNKNOWN            = 0,
+    DNSTAP_MESSAGE_TYPE_AUTH_QUERY         = 1,
+    DNSTAP_MESSAGE_TYPE_AUTH_RESPONSE      = 2,
+    DNSTAP_MESSAGE_TYPE_RESOLVER_QUERY     = 3,
+    DNSTAP_MESSAGE_TYPE_RESOLVER_RESPONSE  = 4,
+    DNSTAP_MESSAGE_TYPE_CLIENT_QUERY       = 5,
+    DNSTAP_MESSAGE_TYPE_CLIENT_RESPONSE    = 6,
+    DNSTAP_MESSAGE_TYPE_FORWARDER_QUERY    = 7,
+    DNSTAP_MESSAGE_TYPE_FORWARDER_RESPONSE = 8,
+    DNSTAP_MESSAGE_TYPE_STUB_QUERY         = 9,
+    DNSTAP_MESSAGE_TYPE_STUB_RESPONSE      = 10,
+    DNSTAP_MESSAGE_TYPE_TOOL_QUERY         = 11,
+    DNSTAP_MESSAGE_TYPE_TOOL_RESPONSE      = 12,
+};
+extern const char* const DNSTAP_MESSAGE_TYPE_STRING[];
+
+enum dnstap_socket_family {
+    DNSTAP_SOCKET_FAMILY_UNKNOWN = 0,
+    DNSTAP_SOCKET_FAMILY_INET    = 1,
+    DNSTAP_SOCKET_FAMILY_INET6   = 2,
+};
+extern const char* const DNSTAP_SOCKET_FAMILY_STRING[];
+
+enum dnstap_socket_protocol {
+    DNSTAP_SOCKET_PROTOCOL_UNKNOWN = 0,
+    DNSTAP_SOCKET_PROTOCOL_UDP     = 1,
+    DNSTAP_SOCKET_PROTOCOL_TCP     = 2,
+};
+extern const char* const DNSTAP_SOCKET_PROTOCOL_STRING[];
+
+struct dnstap {
+    Dnstap__Dnstap  dnstap;
+    Dnstap__Message message;
+
+    Dnstap__Dnstap* unpacked_dnstap;
+};
+
+#define DNSTAP_INITIALIZER                        \
+    {                                             \
+        .dnstap          = DNSTAP__DNSTAP__INIT,  \
+        .message         = DNSTAP__MESSAGE__INIT, \
+        .unpacked_dnstap = 0,                     \
+    }
+
+#include <dnswire/dnstap-macros.h>
+#define dnstap_type(d) (enum dnstap_type)((d).dnstap.type)
+#define dnstap_set_type(d, v)                                                 \
+    switch (v) {                                                              \
+    case DNSTAP_TYPE_MESSAGE:                                                 \
+        (d).dnstap.type    = (enum _Dnstap__Dnstap__Type)v;                   \
+        (d).dnstap.message = &(d).message;                                    \
+        break;                                                                \
+    default:                                                                  \
+        (d).dnstap.type    = (enum _Dnstap__Dnstap__Type)DNSTAP_TYPE_UNKNOWN; \
+        (d).dnstap.message = 0;                                               \
+    }
+#define dnstap_has_message(d) ((d).dnstap.message != 0)
+
+#define dnstap_message_type(d) (enum dnstap_message_type)((d).message.type)
+#define dnstap_message_set_type(d, v)                                                \
+    switch (v) {                                                                     \
+    case DNSTAP_MESSAGE_TYPE_AUTH_QUERY:                                             \
+    case DNSTAP_MESSAGE_TYPE_AUTH_RESPONSE:                                          \
+    case DNSTAP_MESSAGE_TYPE_RESOLVER_QUERY:                                         \
+    case DNSTAP_MESSAGE_TYPE_RESOLVER_RESPONSE:                                      \
+    case DNSTAP_MESSAGE_TYPE_CLIENT_QUERY:                                           \
+    case DNSTAP_MESSAGE_TYPE_CLIENT_RESPONSE:                                        \
+    case DNSTAP_MESSAGE_TYPE_FORWARDER_QUERY:                                        \
+    case DNSTAP_MESSAGE_TYPE_FORWARDER_RESPONSE:                                     \
+    case DNSTAP_MESSAGE_TYPE_STUB_QUERY:                                             \
+    case DNSTAP_MESSAGE_TYPE_STUB_RESPONSE:                                          \
+    case DNSTAP_MESSAGE_TYPE_TOOL_QUERY:                                             \
+    case DNSTAP_MESSAGE_TYPE_TOOL_RESPONSE:                                          \
+        (d).message.type = (enum _Dnstap__Message__Type)v;                           \
+        break;                                                                       \
+    default:                                                                         \
+        (d).message.type = (enum _Dnstap__Message__Type)DNSTAP_MESSAGE_TYPE_UNKNOWN; \
+    }
+#define dnstap_message_set_socket_family(d, v)                                                   \
+    switch (v) {                                                                                 \
+    case DNSTAP_SOCKET_FAMILY_INET:                                                              \
+    case DNSTAP_SOCKET_FAMILY_INET6:                                                             \
+        (d).message.has_socket_family = true;                                                    \
+        (d).message.socket_family     = (enum _Dnstap__SocketFamily)v;                           \
+        break;                                                                                   \
+    default:                                                                                     \
+        (d).message.has_socket_family = false;                                                   \
+        (d).message.socket_family     = (enum _Dnstap__SocketFamily)DNSTAP_MESSAGE_TYPE_UNKNOWN; \
+    }
+#define dnstap_message_set_socket_protocol(d, v)                                                     \
+    switch (v) {                                                                                     \
+    case DNSTAP_SOCKET_PROTOCOL_UDP:                                                                 \
+    case DNSTAP_SOCKET_PROTOCOL_TCP:                                                                 \
+        (d).message.has_socket_protocol = true;                                                      \
+        (d).message.socket_protocol     = (enum _Dnstap__SocketProtocol)v;                           \
+        break;                                                                                       \
+    default:                                                                                         \
+        (d).message.has_socket_protocol = false;                                                     \
+        (d).message.socket_protocol     = (enum _Dnstap__SocketProtocol)DNSTAP_MESSAGE_TYPE_UNKNOWN; \
+    }
+
+int dnstap_decode_protobuf(struct dnstap*, const uint8_t*, size_t);
+// int dnstap_decode_cbor(struct dnstap*, const uint8_t*, size_t);
+
+size_t dnstap_encode_protobuf_size(const struct dnstap*);
+size_t dnstap_encode_protobuf(const struct dnstap*, uint8_t*);
+
+void dnstap_cleanup(struct dnstap*);
+
+#endif
diff --git a/src/dnswire/dnswire.h b/src/dnswire/dnswire.h
new file mode 100644
index 0000000..f113b22
--- /dev/null
+++ b/src/dnswire/dnswire.h
@@ -0,0 +1,39 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __dnswire_h_dnswire
+#define __dnswire_h_dnswire 1
+
+#define DNSWIRE_DEFAULT_BUF_SIZE (4 * 1024)
+#define DNSWIRE_MAXIMUM_BUF_SIZE (64 * 1024)
+
+enum dnswire_result {
+    dnswire_ok            = 0,
+    dnswire_error         = 1,
+    dnswire_again         = 2,
+    dnswire_need_more     = 3,
+    dnswire_have_dnstap   = 4,
+    dnswire_endofdata     = 5,
+    dnswire_bidirectional = 6,
+};
+extern const char* const dnswire_result_string[];
+
+#endif
diff --git a/src/dnswire/encoder.h b/src/dnswire/encoder.h
new file mode 100644
index 0000000..c5fbc6a
--- /dev/null
+++ b/src/dnswire/encoder.h
@@ -0,0 +1,60 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dnswire/dnswire.h>
+#include <dnswire/dnstap.h>
+
+#include <tinyframe/tinyframe.h>
+
+#ifndef __dnswire_h_encoder
+#define __dnswire_h_encoder 1
+
+enum dnswire_encoder_state {
+    dnswire_encoder_control_ready  = 0,
+    dnswire_encoder_control_start  = 1,
+    dnswire_encoder_control_accept = 2,
+    dnswire_encoder_control_finish = 3,
+    dnswire_encoder_frames         = 4,
+    dnswire_encoder_control_stop   = 5,
+    dnswire_encoder_done           = 6,
+};
+extern const char* const dnswire_encoder_state_string[];
+
+struct dnswire_encoder {
+    enum dnswire_encoder_state state;
+    struct tinyframe_writer    writer;
+    const struct dnstap*       dnstap;
+};
+
+#define DNSWIRE_ENCODER_INITIALIZER              \
+    {                                            \
+        .state  = dnswire_encoder_control_start, \
+        .writer = TINYFRAME_WRITER_INITIALIZER,  \
+        .dnstap = 0,                             \
+    }
+
+#define dnswire_encoder_set_dnstap(e, d) (e).dnstap = d
+#define dnswire_encoder_encoded(e) (e).writer.bytes_wrote
+
+enum dnswire_result dnswire_encoder_encode(struct dnswire_encoder*, uint8_t*, size_t);
+enum dnswire_result dnswire_encoder_stop(struct dnswire_encoder*);
+
+#endif
diff --git a/src/dnswire/reader.h b/src/dnswire/reader.h
new file mode 100644
index 0000000..5fdfad5
--- /dev/null
+++ b/src/dnswire/reader.h
@@ -0,0 +1,91 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dnswire/dnswire.h>
+#include <dnswire/decoder.h>
+#include <dnswire/encoder.h>
+
+#include <stdlib.h>
+
+#ifndef __dnswire_h_reader
+#define __dnswire_h_reader 1
+
+enum dnswire_reader_state {
+    dnswire_reader_reading_control  = 0,
+    dnswire_reader_decoding_control = 1,
+    dnswire_reader_encoding_accept  = 2,
+    dnswire_reader_writing_accept   = 3,
+    dnswire_reader_reading          = 4,
+    dnswire_reader_decoding         = 5,
+    dnswire_reader_encoding_finish  = 6,
+    dnswire_reader_writing_finish   = 7,
+    dnswire_reader_done             = 8,
+};
+extern const char* const dnswire_reader_state_string[];
+
+/*
+ * Attributes:
+ * - size: The current size of the buffer
+ * - inc: How much the buffer will be increased by if more spare is needed
+ * - max: The maximum size the buffer is allowed to have
+ * - at: Where in the buffer we are decoding (start of data)
+ * - left: How much data that is still left in the buffer from `at`
+ * - pushed: How much data that was pushed to the buffer by `dnswire_reader_push()`
+ */
+struct dnswire_reader {
+    enum dnswire_reader_state state;
+
+    struct dnswire_decoder decoder;
+    uint8_t*               buf;
+    size_t                 size, inc, max, at, left, pushed;
+
+    struct dnswire_encoder encoder;
+    uint8_t*               write_buf;
+    size_t                 write_size, write_inc, write_max, write_at, write_left;
+
+    bool allow_bidirectional, is_bidirectional;
+};
+
+enum dnswire_result dnswire_reader_init(struct dnswire_reader*);
+
+#define dnswire_reader_pushed(r) (r).pushed
+#define dnswire_reader_dnstap(r) (&(r).decoder.dnstap)
+#define dnswire_reader_cleanup(r) \
+    dnswire_decoder_cleanup((r).decoder)
+#define dnswire_reader_destroy(r) \
+    free((r).buf);                \
+    free((r).write_buf);          \
+    dnswire_decoder_cleanup((r).decoder)
+#define dnswire_reader_is_bidirectional(r) (r).is_bidirectional
+
+enum dnswire_result dnswire_reader_allow_bidirectional(struct dnswire_reader*, bool);
+enum dnswire_result dnswire_reader_set_bufsize(struct dnswire_reader*, size_t);
+enum dnswire_result dnswire_reader_set_bufinc(struct dnswire_reader*, size_t);
+enum dnswire_result dnswire_reader_set_bufmax(struct dnswire_reader*, size_t);
+
+enum dnswire_result               dnswire_reader_push(struct dnswire_reader*, const uint8_t*, size_t, uint8_t*, size_t*);
+enum dnswire_result               dnswire_reader_read(struct dnswire_reader*, int);
+static inline enum dnswire_result dnswire_reader_fread(struct dnswire_reader* handle, FILE* fp)
+{
+    return dnswire_reader_read(handle, fileno(fp));
+}
+
+#endif
diff --git a/src/dnswire/trace.h.in b/src/dnswire/trace.h.in
new file mode 100644
index 0000000..7b8e038
--- /dev/null
+++ b/src/dnswire/trace.h.in
@@ -0,0 +1,41 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __dnswire_h_trace
+#define __dnswire_h_trace 1
+
+#if @DNSWIRE_TRACE@
+#define DNSWIRE_TRACE 1
+#include <stdio.h>
+#include <ctype.h>
+#include <stdint.h>
+const char* __printable_string(const uint8_t* data, size_t len);
+#define __trace(x...)                                \
+    fprintf(stderr, "dnswire %s(): ", __func__); \
+    fprintf(stderr, x);                            \
+    fprintf(stderr, "\n"); \
+    fflush(stderr);
+#else
+#define __trace(x...)
+#define __printable_string(x...)
+#endif
+
+#endif
diff --git a/src/dnswire/version.h.in b/src/dnswire/version.h.in
new file mode 100644
index 0000000..1a4f96f
--- /dev/null
+++ b/src/dnswire/version.h.in
@@ -0,0 +1,33 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dnswire/dnswire.h>
+
+#ifndef __dnswire_h_version
+#define __dnswire_h_version 1
+
+#define DNSWIRE_VERSION @DNSWIRE_VERSION_MAJOR@@DNSWIRE_VERSION_MINOR@@DNSWIRE_VERSION_PATCH@
+#define DNSWIRE_VERSION_MAJOR @DNSWIRE_VERSION_MAJOR@
+#define DNSWIRE_VERSION_MINOR @DNSWIRE_VERSION_MINOR@
+#define DNSWIRE_VERSION_PATCH @DNSWIRE_VERSION_PATCH@
+#define DNSWIRE_VERSION_STRING "@PACKAGE_VERSION@"
+
+#endif
diff --git a/src/dnswire/writer.h b/src/dnswire/writer.h
new file mode 100644
index 0000000..99bae1a
--- /dev/null
+++ b/src/dnswire/writer.h
@@ -0,0 +1,90 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dnswire/dnswire.h>
+#include <dnswire/encoder.h>
+#include <dnswire/decoder.h>
+
+#include <stdlib.h>
+
+#ifndef __dnswire_h_writer
+#define __dnswire_h_writer 1
+
+enum dnswire_writer_state {
+    dnswire_writer_encoding_ready  = 0,
+    dnswire_writer_writing_ready   = 1,
+    dnswire_writer_reading_accept  = 2,
+    dnswire_writer_decoding_accept = 3,
+    dnswire_writer_encoding        = 4,
+    dnswire_writer_writing         = 5,
+    dnswire_writer_stopping        = 6,
+    dnswire_writer_encoding_stop   = 7,
+    dnswire_writer_writing_stop    = 8,
+    dnswire_writer_reading_finish  = 9,
+    dnswire_writer_decoding_finish = 10,
+    dnswire_writer_done            = 11,
+};
+extern const char* const dnswire_writer_state_string[];
+
+/*
+ * Attributes:
+ * - size: The current size of the buffer
+ * - inc: How much the buffer will be increased by if more spare is needed
+ * - max: The maximum size the buffer is allowed to have
+ * - at: Where in the buffer we are encoding to (end of data)
+ * - left: How much data that is still left in the buffer before `at`
+ */
+struct dnswire_writer {
+    enum dnswire_writer_state state;
+
+    struct dnswire_encoder encoder;
+    uint8_t*               buf;
+    size_t                 size, inc, max, at, left, popped;
+
+    struct dnswire_decoder decoder;
+    uint8_t*               read_buf;
+    size_t                 read_size, read_inc, read_max, read_at, read_left, read_pushed;
+
+    bool bidirectional;
+};
+
+enum dnswire_result dnswire_writer_init(struct dnswire_writer*);
+
+#define dnswire_writer_popped(w) (w).popped
+#define dnswire_writer_set_dnstap(w, d) (w).encoder.dnstap = d
+#define dnswire_writer_destroy(w) \
+    free((w).buf);                \
+    free((w).read_buf)
+
+enum dnswire_result dnswire_writer_set_bidirectional(struct dnswire_writer*, bool);
+enum dnswire_result dnswire_writer_set_bufsize(struct dnswire_writer*, size_t);
+enum dnswire_result dnswire_writer_set_bufinc(struct dnswire_writer*, size_t);
+enum dnswire_result dnswire_writer_set_bufmax(struct dnswire_writer*, size_t);
+
+enum dnswire_result               dnswire_writer_pop(struct dnswire_writer*, uint8_t*, size_t, uint8_t*, size_t*);
+enum dnswire_result               dnswire_writer_write(struct dnswire_writer*, int);
+static inline enum dnswire_result dnswire_writer_fwrite(struct dnswire_writer* handle, FILE* fp)
+{
+    return dnswire_writer_write(handle, fileno(fp));
+}
+enum dnswire_result dnswire_writer_stop(struct dnswire_writer*);
+
+#endif
diff --git a/src/encoder.c b/src/encoder.c
new file mode 100644
index 0000000..4b7ad27
--- /dev/null
+++ b/src/encoder.c
@@ -0,0 +1,172 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+
+#include "dnswire/encoder.h"
+#include "dnswire/trace.h"
+
+#include <assert.h>
+
+const char* const dnswire_encoder_state_string[] = {
+    "control_ready",
+    "control_start",
+    "control_accept",
+    "control_finish",
+    "frames",
+    "control_stop",
+    "done",
+};
+
+#define __state(h, s)                                                                                     \
+    __trace("state %s => %s", dnswire_encoder_state_string[(h)->state], dnswire_encoder_state_string[s]); \
+    (h)->state = s;
+
+static struct tinyframe_control_field _content_type = {
+    TINYFRAME_CONTROL_FIELD_CONTENT_TYPE,
+    DNSTAP_PROTOBUF_CONTENT_TYPE_LENGTH,
+    (uint8_t*)DNSTAP_PROTOBUF_CONTENT_TYPE,
+};
+
+enum dnswire_result dnswire_encoder_encode(struct dnswire_encoder* handle, uint8_t* out, size_t len)
+{
+    assert(handle);
+    assert(out);
+    assert(len);
+
+    switch (handle->state) {
+    case dnswire_encoder_control_ready:
+        switch (tinyframe_write_control(&handle->writer, out, len, TINYFRAME_CONTROL_READY, &_content_type, 1)) {
+        case tinyframe_ok:
+            __state(handle, dnswire_encoder_control_start);
+            return dnswire_again;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_encoder_control_start:
+        switch (tinyframe_write_control_start(&handle->writer, out, len, DNSTAP_PROTOBUF_CONTENT_TYPE, DNSTAP_PROTOBUF_CONTENT_TYPE_LENGTH)) {
+        case tinyframe_ok:
+            __state(handle, dnswire_encoder_frames);
+            return dnswire_again;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_encoder_control_accept:
+        switch (tinyframe_write_control(&handle->writer, out, len, TINYFRAME_CONTROL_ACCEPT, &_content_type, 1)) {
+        case tinyframe_ok:
+            __state(handle, dnswire_encoder_control_finish);
+            return dnswire_again;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_encoder_control_finish:
+        switch (tinyframe_write_control(&handle->writer, out, len, TINYFRAME_CONTROL_FINISH, 0, 0)) {
+        case tinyframe_ok:
+            __state(handle, dnswire_encoder_done);
+            return dnswire_endofdata;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_encoder_frames: {
+        if (!handle->dnstap) {
+            return dnswire_error;
+        }
+
+        size_t frame_len = dnstap_encode_protobuf_size(handle->dnstap);
+        if (len < tinyframe_frame_size(frame_len)) {
+            return dnswire_need_more;
+        }
+        uint8_t frame[frame_len];
+        dnstap_encode_protobuf(handle->dnstap, frame);
+
+        switch (tinyframe_write_frame(&handle->writer, out, len, frame, sizeof(frame))) {
+        case tinyframe_ok:
+            return dnswire_ok;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+    }
+
+    case dnswire_encoder_control_stop:
+        switch (tinyframe_write_control_stop(&handle->writer, out, len)) {
+        case tinyframe_ok:
+            __state(handle, dnswire_encoder_done);
+            return dnswire_endofdata;
+
+        case tinyframe_need_more:
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_encoder_done:
+        break;
+    }
+
+    return dnswire_error;
+}
+
+enum dnswire_result dnswire_encoder_stop(struct dnswire_encoder* handle)
+{
+    assert(handle);
+
+    switch (handle->state) {
+    case dnswire_encoder_frames:
+        __state(handle, dnswire_encoder_control_stop);
+        return dnswire_ok;
+
+    default:
+        break;
+    }
+
+    return dnswire_error;
+}
diff --git a/src/gen-macros.sh b/src/gen-macros.sh
new file mode 100755
index 0000000..190d74a
--- /dev/null
+++ b/src/gen-macros.sh
@@ -0,0 +1,34 @@
+#!/bin/sh -e
+
+echo "/* autogenerated, don't edit */"
+
+while read prefix base name type typedef; do
+    echo "// $base.$name ($type)"
+    case "$type" in
+        string )
+            echo "#define ${prefix}_has_${name}(d) (bool)((d).${base}.has_${name})
+#define ${prefix}_${name}(d) (const uint8_t*)((d).${base}.${name}.data)
+#define ${prefix}_${name}_length(d) (size_t)((d).${base}.${name}.len)
+#define ${prefix}_set_${name}(d, v, l) (d).${base}.has_${name} = true; (d).${base}.${name}.data = v; (d).${base}.${name}.len = l
+#define ${prefix}_set_${name}_string(d, v) (d).${base}.has_${name} = true; (d).${base}.${name}.data = (uint8_t*)v; (d).${base}.${name}.len = strlen(v)"
+            ;;
+        bytes )
+            echo "#define ${prefix}_has_${name}(d) (bool)((d).${base}.has_${name})
+#define ${prefix}_${name}(d) (const uint8_t*)((d).${base}.${name}.data)
+#define ${prefix}_${name}_length(d) (size_t)((d).${base}.${name}.len)
+#define ${prefix}_set_${name}(d, v, l) (d).${base}.has_${name} = true; (d).${base}.${name}.data = (uint8_t*)v; (d).${base}.${name}.len = l"
+            ;;
+        enum )
+            echo "#define ${prefix}_has_${name}(d) (bool)((d).${base}.has_${name})
+#define ${prefix}_${name}(d) (enum ${typedef})((d).${base}.${name})"
+            ;;
+        value )
+            echo "#define ${prefix}_has_${name}(d) (bool)((d).${base}.has_${name})
+#define ${prefix}_${name}(d) (${typedef})((d).${base}.${name})
+#define ${prefix}_set_${name}(d, v) (d).${base}.has_${name} = true; (d).${base}.${name} = v"
+            ;;
+        * )
+            echo "#error \"invalid type $type for $base.$name\""
+            ;;
+    esac
+done < "$1"
diff --git a/src/reader.c b/src/reader.c
new file mode 100644
index 0000000..ba04284
--- /dev/null
+++ b/src/reader.c
@@ -0,0 +1,700 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+
+#include "dnswire/reader.h"
+#include "dnswire/trace.h"
+
+#include <assert.h>
+#include <stdlib.h>
+
+const char* const dnswire_reader_state_string[] = {
+    "reading_control",
+    "decoding_control",
+    "encoding_accept",
+    "writing_accept",
+    "reading",
+    "decoding",
+    "encoding_finish",
+    "writing_finish",
+    "done",
+};
+
+#define __state(h, s)                                                                                   \
+    __trace("state %s => %s", dnswire_reader_state_string[(h)->state], dnswire_reader_state_string[s]); \
+    (h)->state = s;
+
+static struct dnswire_reader _defaults = {
+    .state = dnswire_reader_reading_control,
+
+    .decoder = DNSWIRE_DECODER_INITIALIZER,
+    .buf     = 0,
+    .size    = DNSWIRE_DEFAULT_BUF_SIZE,
+    .inc     = DNSWIRE_DEFAULT_BUF_SIZE,
+    .max     = DNSWIRE_MAXIMUM_BUF_SIZE,
+    .at      = 0,
+    .left    = 0,
+    .pushed  = 0,
+
+    .encoder    = DNSWIRE_ENCODER_INITIALIZER,
+    .write_buf  = 0,
+    .write_size = DNSWIRE_DEFAULT_BUF_SIZE,
+    .write_inc  = DNSWIRE_DEFAULT_BUF_SIZE,
+    .write_max  = DNSWIRE_MAXIMUM_BUF_SIZE,
+    .write_at   = 0,
+    .write_left = 0,
+
+    .allow_bidirectional = false,
+    .is_bidirectional    = false,
+};
+
+enum dnswire_result dnswire_reader_init(struct dnswire_reader* handle)
+{
+    assert(handle);
+
+    *handle = _defaults;
+
+    if (!(handle->buf = malloc(handle->size))) {
+        return dnswire_error;
+    }
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_reader_allow_bidirectional(struct dnswire_reader* handle, bool allow_bidirectional)
+{
+    assert(handle);
+
+    if (allow_bidirectional) {
+        if (!handle->write_buf) {
+            if (!(handle->write_buf = malloc(handle->write_size))) {
+                return dnswire_error;
+            }
+        }
+
+        handle->encoder.state = dnswire_encoder_control_accept;
+    } else {
+        handle->encoder.state = dnswire_encoder_control_start;
+    }
+
+    handle->allow_bidirectional = allow_bidirectional;
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_reader_set_bufsize(struct dnswire_reader* handle, size_t size)
+{
+    assert(handle);
+    assert(size);
+    assert(handle->buf);
+
+    if (handle->left > size) {
+        // we got data and it doesn't fit in the new size
+        return dnswire_error;
+    }
+    if (size > handle->max) {
+        // don't expand over max
+        return dnswire_error;
+    }
+
+    if (handle->at + handle->left > size) {
+        // move what's left to the start
+        if (handle->left) {
+            memmove(handle->buf, &handle->buf[handle->at], handle->left);
+        }
+        handle->at = 0;
+    }
+
+    uint8_t* buf = realloc(handle->buf, size);
+    if (!buf) {
+        return dnswire_error;
+    }
+
+    handle->buf  = buf;
+    handle->size = size;
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_reader_set_bufinc(struct dnswire_reader* handle, size_t inc)
+{
+    assert(handle);
+    assert(inc);
+
+    handle->inc = inc;
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_reader_set_bufmax(struct dnswire_reader* handle, size_t max)
+{
+    assert(handle);
+    assert(max);
+
+    if (max < handle->size) {
+        return dnswire_error;
+    }
+
+    handle->max = max;
+
+    return dnswire_ok;
+}
+
+static enum dnswire_result _encoding(struct dnswire_reader* handle)
+{
+    enum dnswire_result res;
+
+    while (1) {
+        res = dnswire_encoder_encode(&handle->encoder, &handle->write_buf[handle->write_at], handle->write_size - handle->write_at);
+        __trace("encode %s", dnswire_result_string[res]);
+
+        switch (res) {
+        case dnswire_ok:
+        case dnswire_again:
+        case dnswire_endofdata:
+            handle->write_at += dnswire_encoder_encoded(handle->encoder);
+            handle->write_left += dnswire_encoder_encoded(handle->encoder);
+            break;
+
+        case dnswire_need_more: {
+            if (handle->write_size >= handle->write_max) {
+                // already at max size and it's not enough
+                return dnswire_error;
+            }
+
+            // no space left, expand
+            size_t   size = handle->write_size + handle->write_inc > handle->write_max ? handle->write_max : handle->write_size + handle->write_inc;
+            uint8_t* buf  = realloc(handle->write_buf, size);
+            if (!buf) {
+                return dnswire_error;
+            }
+            handle->write_buf  = buf;
+            handle->write_size = size;
+            continue;
+        }
+        default:
+            break;
+        }
+        break;
+    }
+    return res;
+}
+
+enum dnswire_result dnswire_reader_push(struct dnswire_reader* handle, const uint8_t* data, size_t len, uint8_t* out_data, size_t* out_len)
+{
+    assert(handle);
+    assert(data);
+    assert(handle->buf);
+    assert(!handle->allow_bidirectional || out_data);
+    assert(!handle->allow_bidirectional || out_len);
+
+    handle->pushed      = 0;
+    size_t out_len_orig = 0;
+    if (out_len) {
+        out_len_orig = *out_len;
+        *out_len     = 0;
+    }
+
+    switch (handle->state) {
+    case dnswire_reader_reading_control:
+        if (!len) {
+            return dnswire_need_more;
+        }
+        // if the space we have left is less then len we only move that amount
+        handle->pushed = handle->size - handle->at - handle->left < len ? handle->size - handle->at - handle->left : len;
+        // if we can't add more we fallthrough and let it decode some or expand the buffer
+        if (handle->pushed) {
+            memcpy(&handle->buf[handle->at + handle->left], data, handle->pushed);
+            __trace("%s", __printable_string(&handle->buf[handle->at + handle->left], handle->pushed));
+            handle->left += handle->pushed;
+        }
+        __state(handle, dnswire_reader_decoding_control);
+        // fallthrough
+
+    case dnswire_reader_decoding_control:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->buf[handle->at], handle->left)) {
+        case dnswire_bidirectional:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading_control);
+            }
+
+            if (!handle->allow_bidirectional) {
+                return dnswire_error;
+            }
+
+            handle->is_bidirectional = true;
+
+            if (!handle->decoder.ready_support_dnstap_protobuf) {
+                return dnswire_error;
+            }
+
+            __state(handle, dnswire_reader_encoding_accept);
+            return dnswire_again;
+
+        case dnswire_again:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading_control);
+            }
+            return dnswire_again;
+
+        case dnswire_need_more:
+            if (handle->left < handle->size) {
+                // still space left to fill
+                if (handle->at) {
+                    // move what's left to the start
+                    if (handle->left) {
+                        memmove(handle->buf, &handle->buf[handle->at], handle->left);
+                    }
+                    handle->at = 0;
+                }
+            } else if (handle->size < handle->max) {
+                // no space left, expand
+                size_t   size = handle->size + handle->inc > handle->max ? handle->max : handle->size + handle->inc;
+                uint8_t* buf  = realloc(handle->buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->buf  = buf;
+                handle->size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_reader_reading_control);
+            if (len && handle->pushed < len) {
+                // we had more to push but won't loop, call again please
+                return dnswire_again;
+            }
+            return dnswire_need_more;
+
+        case dnswire_have_dnstap:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (handle->left) {
+                __state(handle, dnswire_reader_decoding);
+            } else {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading);
+            }
+            return dnswire_have_dnstap;
+
+        case dnswire_endofdata:
+            if (handle->is_bidirectional) {
+                __state(handle, dnswire_reader_encoding_finish);
+                return dnswire_again;
+            }
+            __state(handle, dnswire_reader_done);
+            return dnswire_endofdata;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_reader_encoding_accept:
+        switch (_encoding(handle)) {
+        case dnswire_again:
+            __state(handle, dnswire_reader_writing_accept);
+            break;
+            // fallthrough
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_reader_writing_accept:
+        // if what we have left to write is less then the space available, we write it all
+        assert(out_len);
+        *out_len = handle->write_left < out_len_orig ? handle->write_left : out_len_orig;
+        memcpy(out_data, &handle->write_buf[handle->write_at - handle->write_left], *out_len);
+        __trace("pushed %zu", *out_len);
+        handle->write_left -= *out_len;
+        __trace("left %zu", handle->write_left);
+        if (!handle->write_left) {
+            handle->write_at = 0;
+            __state(handle, dnswire_reader_reading_control);
+        }
+        return dnswire_again;
+
+    case dnswire_reader_reading:
+        if (!len) {
+            return dnswire_need_more;
+        }
+        // if the space we have left is less then len we only move that amount
+        handle->pushed = handle->size - handle->at - handle->left < len ? handle->size - handle->at - handle->left : len;
+        // if we can't add more we fallthrough and let it decode some or expand the buffer
+        if (handle->pushed) {
+            memcpy(&handle->buf[handle->at + handle->left], data, handle->pushed);
+            __trace("%s", __printable_string(&handle->buf[handle->at + handle->left], handle->pushed));
+            handle->left += handle->pushed;
+        }
+        __state(handle, dnswire_reader_decoding);
+        // fallthrough
+
+    case dnswire_reader_decoding:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->buf[handle->at], handle->left)) {
+        case dnswire_again:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading);
+            }
+            return dnswire_again;
+
+        case dnswire_need_more:
+            if (handle->left < handle->size) {
+                // still space left to fill
+                if (handle->at) {
+                    // move what's left to the start
+                    if (handle->left) {
+                        memmove(handle->buf, &handle->buf[handle->at], handle->left);
+                    }
+                    handle->at = 0;
+                }
+            } else if (handle->size < handle->max) {
+                // no space left, expand
+                size_t   size = handle->size + handle->inc > handle->max ? handle->max : handle->size + handle->inc;
+                uint8_t* buf  = realloc(handle->buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->buf  = buf;
+                handle->size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_reader_reading);
+            if (len && handle->pushed < len) {
+                // we had more to push but won't loop, call again please
+                return dnswire_again;
+            }
+            return dnswire_need_more;
+
+        case dnswire_have_dnstap:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading);
+            }
+            return dnswire_have_dnstap;
+
+        case dnswire_endofdata:
+            if (handle->is_bidirectional) {
+                __state(handle, dnswire_reader_encoding_finish);
+                return dnswire_again;
+            }
+            __state(handle, dnswire_reader_done);
+            return dnswire_endofdata;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_reader_encoding_finish:
+        switch (_encoding(handle)) {
+        case dnswire_endofdata:
+            __state(handle, dnswire_reader_writing_finish);
+            break;
+            // fallthrough
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_reader_writing_finish:
+        // if what we have left to write is less then the space available, we write it all
+        assert(out_len);
+        *out_len = handle->write_left < out_len_orig ? handle->write_left : out_len_orig;
+        memcpy(out_data, &handle->write_buf[handle->write_at - handle->write_left], *out_len);
+        __trace("pushed %zu", *out_len);
+        handle->write_left -= *out_len;
+        __trace("left %zu", handle->write_left);
+        if (!handle->write_left) {
+            handle->write_at = 0;
+            __state(handle, dnswire_reader_done);
+            return dnswire_endofdata;
+        }
+        return dnswire_again;
+
+    case dnswire_reader_done:
+        break;
+    }
+
+    return dnswire_error;
+}
+
+enum dnswire_result dnswire_reader_read(struct dnswire_reader* handle, int fd)
+{
+    assert(handle);
+    assert(handle->buf);
+
+    switch (handle->state) {
+    case dnswire_reader_reading_control: {
+        ssize_t nread = read(fd, &handle->buf[handle->at + handle->left], handle->size - handle->at - handle->left);
+        if (nread < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nread) {
+            // TODO
+            return dnswire_error;
+        }
+        __trace("%s", __printable_string(&handle->buf[handle->at + handle->left], nread));
+        handle->left += nread;
+        __state(handle, dnswire_reader_decoding_control);
+        // fallthrough
+    }
+
+    case dnswire_reader_decoding_control:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->buf[handle->at], handle->left)) {
+        case dnswire_bidirectional:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading_control);
+            }
+
+            if (!handle->allow_bidirectional) {
+                return dnswire_error;
+            }
+
+            handle->is_bidirectional = true;
+
+            if (!handle->decoder.ready_support_dnstap_protobuf) {
+                return dnswire_error;
+            }
+
+            __state(handle, dnswire_reader_encoding_accept);
+            return dnswire_again;
+
+        case dnswire_again:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading_control);
+            }
+            return dnswire_again;
+
+        case dnswire_need_more:
+            if (handle->left < handle->size) {
+                // still space left to fill
+                if (handle->at) {
+                    // move what's left to the start
+                    if (handle->left) {
+                        memmove(handle->buf, &handle->buf[handle->at], handle->left);
+                    }
+                    handle->at = 0;
+                }
+            } else if (handle->size < handle->max) {
+                // no space left, expand
+                size_t   size = handle->size + handle->inc > handle->max ? handle->max : handle->size + handle->inc;
+                uint8_t* buf  = realloc(handle->buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->buf  = buf;
+                handle->size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_reader_reading_control);
+            return dnswire_need_more;
+
+        case dnswire_have_dnstap:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (handle->left) {
+                __state(handle, dnswire_reader_decoding);
+            } else {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading);
+            }
+            return dnswire_have_dnstap;
+
+        case dnswire_endofdata:
+            if (handle->is_bidirectional) {
+                __state(handle, dnswire_reader_encoding_finish);
+                return dnswire_again;
+            }
+            __state(handle, dnswire_reader_done);
+            return dnswire_endofdata;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_reader_encoding_accept:
+        switch (_encoding(handle)) {
+        case dnswire_again:
+            __state(handle, dnswire_reader_writing_accept);
+            break;
+            // fallthrough
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_reader_writing_accept: {
+        ssize_t nwrote = write(fd, &handle->write_buf[handle->write_at - handle->write_left], handle->write_left);
+        __trace("wrote %zd", nwrote);
+        if (nwrote < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nwrote) {
+            // TODO
+            return dnswire_error;
+        }
+
+        handle->write_left -= nwrote;
+        __trace("left %zu", handle->write_left);
+        if (!handle->write_left) {
+            handle->write_at = 0;
+            __state(handle, dnswire_reader_reading_control);
+        }
+        return dnswire_again;
+    }
+
+    case dnswire_reader_reading: {
+        ssize_t nread = read(fd, &handle->buf[handle->at + handle->left], handle->size - handle->at - handle->left);
+        if (nread < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nread) {
+            // TODO
+            return dnswire_error;
+        }
+        __trace("%s", __printable_string(&handle->buf[handle->at + handle->left], nread));
+        handle->left += nread;
+        __state(handle, dnswire_reader_decoding);
+        // fallthrough
+    }
+
+    case dnswire_reader_decoding:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->buf[handle->at], handle->left)) {
+        case dnswire_again:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading);
+            }
+            return dnswire_again;
+
+        case dnswire_need_more:
+            if (handle->left < handle->size) {
+                // still space left to fill
+                if (handle->at) {
+                    // move what's left to the start
+                    if (handle->left) {
+                        memmove(handle->buf, &handle->buf[handle->at], handle->left);
+                    }
+                    handle->at = 0;
+                }
+            } else if (handle->size < handle->max) {
+                // no space left, expand
+                size_t   size = handle->size + handle->inc > handle->max ? handle->max : handle->size + handle->inc;
+                uint8_t* buf  = realloc(handle->buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->buf  = buf;
+                handle->size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_reader_reading);
+            return dnswire_need_more;
+
+        case dnswire_have_dnstap:
+            handle->at += dnswire_decoder_decoded(handle->decoder);
+            handle->left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->left) {
+                handle->at = 0;
+                __state(handle, dnswire_reader_reading);
+            }
+            return dnswire_have_dnstap;
+
+        case dnswire_endofdata:
+            if (handle->is_bidirectional) {
+                __state(handle, dnswire_reader_encoding_finish);
+                return dnswire_again;
+            }
+            __state(handle, dnswire_reader_done);
+            return dnswire_endofdata;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_reader_encoding_finish:
+        switch (_encoding(handle)) {
+        case dnswire_endofdata:
+            __state(handle, dnswire_reader_writing_finish);
+            break;
+            // fallthrough
+
+        default:
+            return dnswire_error;
+        }
+
+    case dnswire_reader_writing_finish: {
+        ssize_t nwrote = write(fd, &handle->write_buf[handle->write_at - handle->write_left], handle->write_left);
+        __trace("wrote %zd", nwrote);
+        if (nwrote < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nwrote) {
+            // TODO
+            return dnswire_error;
+        }
+
+        handle->write_left -= nwrote;
+        __trace("left %zu", handle->write_left);
+        if (!handle->write_left) {
+            handle->write_at = 0;
+            __state(handle, dnswire_reader_done);
+            return dnswire_endofdata;
+        }
+        return dnswire_again;
+    }
+
+    case dnswire_reader_done:
+        break;
+    }
+
+    return dnswire_error;
+}
diff --git a/src/test/Makefile.am b/src/test/Makefile.am
new file mode 100644
index 0000000..f7bb5cf
--- /dev/null
+++ b/src/test/Makefile.am
@@ -0,0 +1,70 @@
+4MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
+
+CLEANFILES = test*.log test*.trs \
+  test1.out test2.out test3.out test3.dnstap test4.out test4.dnstap \
+  test5.out test5.sock *.gcda *.gcno *.gcov
+
+AM_CFLAGS = -I$(top_srcdir)/src \
+  $(tinyframe_CFLAGS) \
+  $(protobuf_c_CFLAGS)
+
+check_PROGRAMS = reader_read reader_push writer_write writer_pop \
+  reader_unixsock writer_unixsock test_dnstap test_encoder test_decoder \
+  test_reader test_writer
+TESTS = test1.sh test2.sh test3.sh test4.sh test5.sh test6.sh
+EXTRA_DIST = create_dnstap.c print_dnstap.c $(TESTS) test.dnstap \
+  test1.gold test2.gold test3.gold test4.gold test5.gold
+
+reader_read_SOURCES = reader_read.c
+reader_read_LDADD = ../libdnswire.la
+reader_read_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+reader_push_SOURCES = reader_push.c
+reader_push_LDADD = ../libdnswire.la
+reader_push_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+writer_write_SOURCES = writer_write.c
+writer_write_LDADD = ../libdnswire.la
+writer_write_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+writer_pop_SOURCES = writer_pop.c
+writer_pop_LDADD = ../libdnswire.la
+writer_pop_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+reader_unixsock_SOURCES = reader_unixsock.c
+reader_unixsock_LDADD = ../libdnswire.la
+reader_unixsock_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+writer_unixsock_SOURCES = writer_unixsock.c
+writer_unixsock_LDADD = ../libdnswire.la
+writer_unixsock_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+test_dnstap_SOURCES = test_dnstap.c
+test_dnstap_LDADD = ../libdnswire.la
+test_dnstap_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+test_encoder_SOURCES = test_encoder.c
+test_encoder_LDADD = ../libdnswire.la
+test_encoder_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+test_decoder_SOURCES = test_decoder.c
+test_decoder_LDADD = ../libdnswire.la
+test_decoder_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+test_reader_SOURCES = test_reader.c
+test_reader_LDADD = ../libdnswire.la
+test_reader_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+test_writer_SOURCES = test_writer.c
+test_writer_LDADD = ../libdnswire.la
+test_writer_LDFLAGS = $(protobuf_c_LIBS) $(tinyframe_LIBS) -static
+
+if ENABLE_GCOV
+gcov-local:
+	for src in $(reader_read_SOURCES) $(reader_push_SOURCES) \
+$(writer_write_SOURCES) $(writer_pop_SOURCES) $(reader_unixsock_SOURCES) \
+$(writer_unixsock_SOURCES) $(test_dnstap_SOURCES) $(test_encoder_SOURCES) \
+$(test_decoder_SOURCES) $(test_reader_SOURCES) $(test_writer_SOURCES); do \
+	  gcov -l -r -s "$(srcdir)" "$$src"; \
+	done
+endif
diff --git a/src/test/create_dnstap.c b/src/test/create_dnstap.c
new file mode 100644
index 0000000..9fbd4a8
--- /dev/null
+++ b/src/test/create_dnstap.c
@@ -0,0 +1,51 @@
+#include <dnswire/version.h>
+#include <dnswire/dnstap.h>
+
+#include <errno.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <time.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+static char          dns_wire_format_placeholder[] = "dns_wire_format_placeholder";
+static unsigned char query_address[sizeof(struct in_addr)];
+static unsigned char response_address[sizeof(struct in_addr)];
+
+static inline void create_dnstap(struct dnstap* d, const char* identity)
+{
+    dnstap_set_identity_string(*d, identity);
+    dnstap_set_version_string(*d, DNSWIRE_VERSION_STRING);
+    dnstap_set_type(*d, DNSTAP_TYPE_MESSAGE);
+    dnstap_message_set_type(*d, DNSTAP_MESSAGE_TYPE_TOOL_QUERY);
+    dnstap_message_set_socket_family(*d, DNSTAP_SOCKET_FAMILY_INET);
+    dnstap_message_set_socket_protocol(*d, DNSTAP_SOCKET_PROTOCOL_UDP);
+
+    if (inet_pton(AF_INET, "127.0.0.1", query_address) != 1) {
+        fprintf(stderr, "inet_pton(127.0.0.1) failed: %s\n", strerror(errno));
+    } else {
+        dnstap_message_set_query_address(*d, query_address, sizeof(query_address));
+    }
+    dnstap_message_set_query_port(*d, 12345);
+
+    struct timespec query_time = { 0, 0 };
+    clock_gettime(CLOCK_REALTIME, &query_time);
+    dnstap_message_set_query_time_sec(*d, query_time.tv_sec);
+    dnstap_message_set_query_time_nsec(*d, query_time.tv_nsec);
+
+    if (inet_pton(AF_INET, "127.0.0.1", response_address) != 1) {
+        fprintf(stderr, "inet_pton(127.0.0.1) failed: %s\n", strerror(errno));
+    } else {
+        dnstap_message_set_response_address(*d, response_address, sizeof(response_address));
+    }
+    dnstap_message_set_response_port(*d, 53);
+
+    struct timespec response_time = { 0, 0 };
+    clock_gettime(CLOCK_REALTIME, &response_time);
+    dnstap_message_set_response_time_sec(*d, response_time.tv_sec);
+    dnstap_message_set_response_time_nsec(*d, response_time.tv_nsec);
+
+    dnstap_message_set_query_message(*d, dns_wire_format_placeholder, sizeof(dns_wire_format_placeholder) - 1);
+    dnstap_message_set_response_message(*d, dns_wire_format_placeholder, sizeof(dns_wire_format_placeholder) - 1);
+}
diff --git a/src/test/print_dnstap.c b/src/test/print_dnstap.c
new file mode 100644
index 0000000..b758119
--- /dev/null
+++ b/src/test/print_dnstap.c
@@ -0,0 +1,117 @@
+#include <dnswire/dnstap.h>
+
+#include <stdio.h>
+#include <inttypes.h>
+#include <arpa/inet.h>
+#include <ctype.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+static const char* printable_string(const uint8_t* data, size_t len)
+{
+    static char buf[512], hex;
+    size_t      r = 0, w = 0;
+
+    while (r < len && w < sizeof(buf) - 1) {
+        if (isprint(data[r])) {
+            buf[w++] = data[r++];
+        } else {
+            if (w + 4 >= sizeof(buf) - 1) {
+                break;
+            }
+
+            buf[w++] = '\\';
+            buf[w++] = 'x';
+            hex      = (data[r] & 0xf0) >> 4;
+            if (hex > 9) {
+                buf[w++] = 'a' + (hex - 10);
+            } else {
+                buf[w++] = '0' + hex;
+            }
+            hex = data[r++] & 0xf;
+            if (hex > 9) {
+                buf[w++] = 'a' + (hex - 10);
+            } else {
+                buf[w++] = '0' + hex;
+            }
+        }
+    }
+    if (w >= sizeof(buf)) {
+        buf[sizeof(buf) - 1] = 0;
+    } else {
+        buf[w] = 0;
+    }
+
+    return buf;
+}
+
+static const char* printable_ip_address(const uint8_t* data, size_t len)
+{
+    static char buf[INET6_ADDRSTRLEN];
+
+    buf[0] = 0;
+    if (len == 4) {
+        inet_ntop(AF_INET, data, buf, sizeof(buf));
+    } else if (len == 16) {
+        inet_ntop(AF_INET6, data, buf, sizeof(buf));
+    }
+
+    return buf;
+}
+
+static void print_dnstap(const struct dnstap* d)
+{
+    printf("---- dnstap\n");
+    if (dnstap_has_identity(*d)) {
+        printf("identity: %s\n", printable_string(dnstap_identity(*d), dnstap_identity_length(*d)));
+    }
+    if (dnstap_has_version(*d)) {
+        printf("version: %s\n", printable_string(dnstap_version(*d), dnstap_version_length(*d)));
+    }
+    if (dnstap_has_extra(*d)) {
+        printf("extra: %s\n", printable_string(dnstap_extra(*d), dnstap_extra_length(*d)));
+    }
+
+    if (dnstap_type(*d) == DNSTAP_TYPE_MESSAGE && dnstap_has_message(*d)) {
+        printf("message:\n  type: %s\n", DNSTAP_MESSAGE_TYPE_STRING[dnstap_message_type(*d)]);
+
+        if (dnstap_message_has_query_time_sec(*d) && dnstap_message_has_query_time_nsec(*d)) {
+            printf("  query_time: %" PRIu64 ".%" PRIu32 "\n", dnstap_message_query_time_sec(*d), dnstap_message_query_time_nsec(*d));
+        }
+        if (dnstap_message_has_response_time_sec(*d) && dnstap_message_has_response_time_nsec(*d)) {
+            printf("  response_time: %" PRIu64 ".%" PRIu32 "\n", dnstap_message_response_time_sec(*d), dnstap_message_response_time_nsec(*d));
+        }
+        if (dnstap_message_has_socket_family(*d)) {
+            printf("  socket_family: %s\n", DNSTAP_SOCKET_FAMILY_STRING[dnstap_message_socket_family(*d)]);
+        }
+        if (dnstap_message_has_socket_protocol(*d)) {
+            printf("  socket_protocol: %s\n", DNSTAP_SOCKET_PROTOCOL_STRING[dnstap_message_socket_protocol(*d)]);
+        }
+        if (dnstap_message_has_query_address(*d)) {
+            printf("  query_address: %s\n", printable_ip_address(dnstap_message_query_address(*d), dnstap_message_query_address_length(*d)));
+        }
+        if (dnstap_message_has_query_port(*d)) {
+            printf("  query_port: %u\n", dnstap_message_query_port(*d));
+        }
+        if (dnstap_message_has_response_address(*d)) {
+            printf("  response_address: %s\n", printable_ip_address(dnstap_message_response_address(*d), dnstap_message_response_address_length(*d)));
+        }
+        if (dnstap_message_has_response_port(*d)) {
+            printf("  response_port: %u\n", dnstap_message_response_port(*d));
+        }
+        if (dnstap_message_has_query_zone(*d)) {
+            printf("  query_zone: %s\n", printable_string(dnstap_message_query_zone(*d), dnstap_message_query_zone_length(*d)));
+        }
+        if (dnstap_message_has_query_message(*d)) {
+            printf("  query_message_length: %zu\n", dnstap_message_query_message_length(*d));
+            printf("  query_message: %s\n", printable_string(dnstap_message_query_message(*d), dnstap_message_query_message_length(*d)));
+        }
+        if (dnstap_message_has_response_message(*d)) {
+            printf("  response_message_length: %zu\n", dnstap_message_response_message_length(*d));
+            printf("  response_message: %s\n", printable_string(dnstap_message_response_message(*d), dnstap_message_response_message_length(*d)));
+        }
+    }
+
+    printf("----\n");
+}
diff --git a/src/test/reader_push.c b/src/test/reader_push.c
new file mode 100644
index 0000000..e077609
--- /dev/null
+++ b/src/test/reader_push.c
@@ -0,0 +1,66 @@
+#include <dnswire/reader.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "print_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 3) {
+        return 1;
+    }
+
+    FILE* fp = fopen(argv[1], "r");
+    if (!fp) {
+        return 1;
+    }
+
+    int rbuf_len = atoi(argv[2]);
+
+    struct dnswire_reader reader;
+    if (dnswire_reader_init(&reader) != dnswire_ok) {
+        return 1;
+    }
+    dnswire_reader_allow_bidirectional(&reader, false);
+
+    size_t  have = 0, at = 0;
+    uint8_t rbuf[rbuf_len];
+    int     done = 0;
+
+    enum dnswire_result res = dnswire_need_more;
+
+    while (!done) {
+        switch (res) {
+        case dnswire_have_dnstap:
+            print_dnstap(dnswire_reader_dnstap(reader));
+        // fallthrough
+        case dnswire_again:
+            res = dnswire_reader_push(&reader, &rbuf[at], have, 0, 0);
+            have -= dnswire_reader_pushed(reader);
+            at += dnswire_reader_pushed(reader);
+            break;
+        case dnswire_need_more:
+            if (!have) {
+                have = fread(rbuf, 1, sizeof(rbuf), fp);
+                printf("read %zu\n", have);
+                at = 0;
+            }
+            res = dnswire_reader_push(&reader, &rbuf[at], have, 0, 0);
+            have -= dnswire_reader_pushed(reader);
+            at += dnswire_reader_pushed(reader);
+            break;
+        case dnswire_endofdata:
+            done = 1;
+            break;
+        default:
+            fprintf(stderr, "dnswire_reader_push() error\n");
+            return 1;
+        }
+    }
+
+    dnswire_reader_destroy(reader);
+    fclose(fp);
+    return 0;
+}
diff --git a/src/test/reader_read.c b/src/test/reader_read.c
new file mode 100644
index 0000000..833d2ac
--- /dev/null
+++ b/src/test/reader_read.c
@@ -0,0 +1,48 @@
+#include <dnswire/reader.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "print_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        return 1;
+    }
+
+    FILE* fp = fopen(argv[1], "r");
+    if (!fp) {
+        return 1;
+    }
+
+    struct dnswire_reader reader;
+    if (dnswire_reader_init(&reader) != dnswire_ok) {
+        return 1;
+    }
+    dnswire_reader_allow_bidirectional(&reader, false);
+
+    int done = 0;
+
+    while (!done) {
+        switch (dnswire_reader_fread(&reader, fp)) {
+        case dnswire_have_dnstap:
+            print_dnstap(dnswire_reader_dnstap(reader));
+            break;
+        case dnswire_again:
+        case dnswire_need_more:
+            break;
+        case dnswire_endofdata:
+            done = 1;
+            break;
+        default:
+            fprintf(stderr, "dnswire_reader_read() error\n");
+            return 1;
+        }
+    }
+
+    dnswire_reader_destroy(reader);
+    fclose(fp);
+    return 0;
+}
diff --git a/src/test/reader_unixsock.c b/src/test/reader_unixsock.c
new file mode 100644
index 0000000..f9f0f56
--- /dev/null
+++ b/src/test/reader_unixsock.c
@@ -0,0 +1,86 @@
+#include <dnswire/writer.h>
+#include <dnswire/reader.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <sys/types.h>
+#include <signal.h>
+#include <sys/wait.h>
+
+#include "print_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        return 1;
+    }
+
+    struct sockaddr_un path;
+    memset(&path, 0, sizeof(struct sockaddr_un));
+    path.sun_family = AF_UNIX;
+    strncpy(path.sun_path, argv[1], sizeof(path.sun_path) - 1);
+
+    int readfd = socket(AF_UNIX, SOCK_STREAM, 0);
+    if (readfd == -1
+        || bind(readfd, (struct sockaddr*)&path, sizeof(struct sockaddr_un))
+        || listen(readfd, 1)) {
+        close(readfd);
+        return 1;
+    }
+    fprintf(stderr, "bind & listen\n");
+
+    int fd, ret = 1;
+    alarm(5);
+    if ((fd = accept(readfd, 0, 0))) {
+        fprintf(stderr, "accept\n");
+
+        struct dnswire_reader reader;
+        if (dnswire_reader_init(&reader) != dnswire_ok) {
+            return 1;
+        }
+        dnswire_reader_allow_bidirectional(&reader, true);
+
+        // force small buffers to trigger buf resizing
+        reader.write_size = 4;
+        reader.write_inc  = 4;
+        if (dnswire_reader_set_bufsize(&reader, 4) != dnswire_ok) {
+            return 1;
+        }
+        if (dnswire_reader_set_bufinc(&reader, 4) != dnswire_ok) {
+            return 1;
+        }
+
+        int done = 0;
+
+        while (!done) {
+            switch (dnswire_reader_read(&reader, fd)) {
+            case dnswire_have_dnstap:
+                print_dnstap(dnswire_reader_dnstap(reader));
+                fflush(stdout);
+                break;
+            case dnswire_again:
+            case dnswire_need_more:
+                break;
+            case dnswire_endofdata:
+                done = 1;
+                break;
+            default:
+                fprintf(stderr, "dnswire_reader_read() error\n");
+                shutdown(fd, SHUT_RDWR);
+                close(fd);
+                close(readfd);
+                return 1;
+            }
+        }
+
+        dnswire_reader_destroy(reader);
+        shutdown(fd, SHUT_RDWR);
+        close(fd);
+    }
+    close(readfd);
+    return ret;
+}
diff --git a/src/test/test.dnstap b/src/test/test.dnstap
new file mode 100644
index 0000000..e5d8f66
--- /dev/null
+++ b/src/test/test.dnstap
diff --git a/src/test/test1.gold b/src/test/test1.gold
new file mode 100644
index 0000000..c1c799e
--- /dev/null
+++ b/src/test/test1.gold
@@ -0,0 +1,28 @@
+---- dnstap
+version: kdig 2.6.5
+message:
+  type: TOOL_QUERY
+  query_time: 1573730567.83350
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 0.0.0.0
+  query_port: 60417
+  response_address: 172.17.0.1
+  response_port: 53
+  query_message_length: 28
+  query_message: \x85 \x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01
+----
+---- dnstap
+version: kdig 2.6.5
+message:
+  type: TOOL_RESPONSE
+  response_time: 1573730567.65816434
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 0.0.0.0
+  query_port: 60417
+  response_address: 172.17.0.1
+  response_port: 53
+  response_message_length: 44
+  response_message: \x85 \x81\x80\x00\x01\x00\x01\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01\xc0\x0c\x00\x01\x00\x01\x00\x00\x01,\x00\x04\xd8:\xd3\x0e
+----
diff --git a/src/test/test1.sh b/src/test/test1.sh
new file mode 100755
index 0000000..f54886f
--- /dev/null
+++ b/src/test/test1.sh
@@ -0,0 +1,4 @@
+#!/bin/sh -xe
+
+./reader_read "$srcdir/test.dnstap" > test1.out
+diff -u "$srcdir/test1.gold" test1.out
diff --git a/src/test/test2.gold b/src/test/test2.gold
new file mode 100644
index 0000000..25a3bc6
--- /dev/null
+++ b/src/test/test2.gold
@@ -0,0 +1,29 @@
+read 240
+---- dnstap
+version: kdig 2.6.5
+message:
+  type: TOOL_QUERY
+  query_time: 1573730567.83350
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 0.0.0.0
+  query_port: 60417
+  response_address: 172.17.0.1
+  response_port: 53
+  query_message_length: 28
+  query_message: \x85 \x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01
+----
+---- dnstap
+version: kdig 2.6.5
+message:
+  type: TOOL_RESPONSE
+  response_time: 1573730567.65816434
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 0.0.0.0
+  query_port: 60417
+  response_address: 172.17.0.1
+  response_port: 53
+  response_message_length: 44
+  response_message: \x85 \x81\x80\x00\x01\x00\x01\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01\xc0\x0c\x00\x01\x00\x01\x00\x00\x01,\x00\x04\xd8:\xd3\x0e
+----
diff --git a/src/test/test2.sh b/src/test/test2.sh
new file mode 100755
index 0000000..2b8e381
--- /dev/null
+++ b/src/test/test2.sh
@@ -0,0 +1,9 @@
+#!/bin/sh -xe
+
+./reader_push "$srcdir/test.dnstap" 10
+./reader_push "$srcdir/test.dnstap" 18
+./reader_push "$srcdir/test.dnstap" 32
+./reader_push "$srcdir/test.dnstap" 64
+
+./reader_push "$srcdir/test.dnstap" 4096 > test2.out
+diff -u "$srcdir/test2.gold" test2.out
diff --git a/src/test/test3.gold b/src/test/test3.gold
new file mode 100644
index 0000000..a6e5c22
--- /dev/null
+++ b/src/test/test3.gold
@@ -0,0 +1,31 @@
+read 322
+---- dnstap
+identity: writer_write-1
+message:
+  type: TOOL_QUERY
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
+---- dnstap
+identity: writer_write-2
+message:
+  type: TOOL_QUERY
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
diff --git a/src/test/test3.sh b/src/test/test3.sh
new file mode 100755
index 0000000..a19eeb0
--- /dev/null
+++ b/src/test/test3.sh
@@ -0,0 +1,6 @@
+#!/bin/sh -xe
+
+rm -f test3.dnstap
+./writer_write test3.dnstap > test3.out
+./reader_push test3.dnstap 4096 | grep -v _time | grep -v ^version: >> test3.out
+diff -u "$srcdir/test3.gold" test3.out
diff --git a/src/test/test4.gold b/src/test/test4.gold
new file mode 100644
index 0000000..f6c9f7f
--- /dev/null
+++ b/src/test/test4.gold
@@ -0,0 +1,30 @@
+---- dnstap
+identity: writer_pop-1
+message:
+  type: TOOL_QUERY
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
+---- dnstap
+identity: writer_pop-2
+message:
+  type: TOOL_QUERY
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
diff --git a/src/test/test4.sh b/src/test/test4.sh
new file mode 100755
index 0000000..e1e9f2e
--- /dev/null
+++ b/src/test/test4.sh
@@ -0,0 +1,6 @@
+#!/bin/sh -xe
+
+rm -f test4.dnstap
+./writer_pop test4.dnstap > test4.out
+./reader_read test4.dnstap | grep -v _time | grep -v ^version: >> test4.out
+diff -u "$srcdir/test4.gold" test4.out
diff --git a/src/test/test5.gold b/src/test/test5.gold
new file mode 100644
index 0000000..86404aa
--- /dev/null
+++ b/src/test/test5.gold
@@ -0,0 +1,30 @@
+---- dnstap
+identity: writer_reader_unixsock-1
+message:
+  type: TOOL_QUERY
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
+---- dnstap
+identity: writer_reader_unixsock-2
+message:
+  type: TOOL_QUERY
+  socket_family: INET
+  socket_protocol: UDP
+  query_address: 127.0.0.1
+  query_port: 12345
+  response_address: 127.0.0.1
+  response_port: 53
+  query_message_length: 27
+  query_message: dns_wire_format_placeholder
+  response_message_length: 27
+  response_message: dns_wire_format_placeholder
+----
diff --git a/src/test/test5.sh b/src/test/test5.sh
new file mode 100755
index 0000000..0b75dff
--- /dev/null
+++ b/src/test/test5.sh
@@ -0,0 +1,7 @@
+#!/bin/sh -xe
+
+rm -f test5.sock
+./writer_unixsock test5.sock &
+./reader_unixsock test5.sock | grep -v _time | grep -v ^version: > test5.out
+rm -f test5.sock
+diff -u "$srcdir/test5.gold" test5.out
diff --git a/src/test/test6.sh b/src/test/test6.sh
new file mode 100755
index 0000000..834137c
--- /dev/null
+++ b/src/test/test6.sh
@@ -0,0 +1,7 @@
+#!/bin/sh -xe
+
+./test_dnstap
+./test_encoder
+./test_decoder
+./test_reader
+./test_writer
diff --git a/src/test/test_decoder.c b/src/test/test_decoder.c
new file mode 100644
index 0000000..2229512
--- /dev/null
+++ b/src/test/test_decoder.c
@@ -0,0 +1,33 @@
+#include <dnswire/decoder.h>
+
+#include <assert.h>
+
+#include "create_dnstap.c"
+
+int main(void)
+{
+    uint8_t                buf[1];
+    struct dnswire_decoder d = DNSWIRE_DECODER_INITIALIZER;
+
+    // decoder * need more
+    d.state = dnswire_decoder_reading_control;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_need_more);
+    d.state = dnswire_decoder_checking_ready;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_need_more);
+    d.state = dnswire_decoder_checking_accept;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_need_more);
+    d.state = dnswire_decoder_reading_start;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_need_more);
+    d.state = dnswire_decoder_checking_start;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_need_more);
+    d.state = dnswire_decoder_reading_frames;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_need_more);
+    d.state = dnswire_decoder_checking_finish;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_need_more);
+
+    // decoder done
+    d.state = dnswire_decoder_done;
+    assert(dnswire_decoder_decode(&d, buf, 1) == dnswire_error);
+
+    return 0;
+}
diff --git a/src/test/test_dnstap.c b/src/test/test_dnstap.c
new file mode 100644
index 0000000..fd199f8
--- /dev/null
+++ b/src/test/test_dnstap.c
@@ -0,0 +1,60 @@
+#include <dnswire/dnstap.h>
+
+#include <assert.h>
+
+#include "create_dnstap.c"
+
+int main(void)
+{
+    uint8_t       buf[256 * 1024];
+    size_t        s;
+    struct dnstap d = DNSTAP_INITIALIZER;
+    struct dnstap u = DNSTAP_INITIALIZER;
+
+    create_dnstap(&d, "test_dnstap");
+
+    // failed unpack
+    assert(dnstap_decode_protobuf(&u, buf, 1) == 1);
+
+    // invalid dnstap.type
+    d.dnstap.type = (enum _Dnstap__Dnstap__Type)(DNSTAP_TYPE_MESSAGE + 1);
+    s             = dnstap_encode_protobuf_size(&d);
+    assert(s < sizeof(buf));
+    assert(dnstap_encode_protobuf(&d, buf) == s);
+    assert(dnstap_decode_protobuf(&u, buf, s) == 0);
+    assert(u.dnstap.type == (enum _Dnstap__Dnstap__Type)DNSTAP_TYPE_UNKNOWN);
+    dnstap_cleanup(&u);
+    d.dnstap.type = (enum _Dnstap__Dnstap__Type)DNSTAP_TYPE_MESSAGE;
+
+    // invalid message.type
+    d.message.type = (enum _Dnstap__Message__Type)(DNSTAP_MESSAGE_TYPE_TOOL_RESPONSE + 1);
+    s              = dnstap_encode_protobuf_size(&d);
+    assert(s < sizeof(buf));
+    assert(dnstap_encode_protobuf(&d, buf) == s);
+    assert(dnstap_decode_protobuf(&u, buf, s) == 0);
+    assert(u.message.type == (enum _Dnstap__Message__Type)DNSTAP_MESSAGE_TYPE_UNKNOWN);
+    dnstap_cleanup(&u);
+    d.message.type = (enum _Dnstap__Message__Type)DNSTAP_MESSAGE_TYPE_TOOL_QUERY;
+
+    // invalid message.socket_family
+    d.message.socket_family = (enum _Dnstap__SocketFamily)(DNSTAP_SOCKET_FAMILY_INET6 + 1);
+    s                       = dnstap_encode_protobuf_size(&d);
+    assert(s < sizeof(buf));
+    assert(dnstap_encode_protobuf(&d, buf) == s);
+    assert(dnstap_decode_protobuf(&u, buf, s) == 0);
+    assert(u.message.socket_family == (enum _Dnstap__SocketFamily)DNSTAP_SOCKET_FAMILY_UNKNOWN);
+    dnstap_cleanup(&u);
+    d.message.socket_family = (enum _Dnstap__SocketFamily)DNSTAP_SOCKET_FAMILY_INET;
+
+    // invalid message.socket_protocol
+    d.message.socket_protocol = (enum _Dnstap__SocketProtocol)(DNSTAP_SOCKET_PROTOCOL_TCP + 1);
+    s                         = dnstap_encode_protobuf_size(&d);
+    assert(s < sizeof(buf));
+    assert(dnstap_encode_protobuf(&d, buf) == s);
+    assert(dnstap_decode_protobuf(&u, buf, s) == 0);
+    assert(u.message.socket_protocol == (enum _Dnstap__SocketProtocol)DNSTAP_SOCKET_PROTOCOL_UNKNOWN);
+    dnstap_cleanup(&u);
+    d.message.socket_protocol = (enum _Dnstap__SocketProtocol)DNSTAP_SOCKET_PROTOCOL_UDP;
+
+    return 0;
+}
diff --git a/src/test/test_encoder.c b/src/test/test_encoder.c
new file mode 100644
index 0000000..65161f1
--- /dev/null
+++ b/src/test/test_encoder.c
@@ -0,0 +1,41 @@
+#include <dnswire/encoder.h>
+
+#include <assert.h>
+
+#include "create_dnstap.c"
+
+int main(void)
+{
+    uint8_t                buf[1];
+    struct dnswire_encoder e = DNSWIRE_ENCODER_INITIALIZER;
+    struct dnstap          d = DNSTAP_INITIALIZER;
+
+    create_dnstap(&d, "test_encoder");
+
+    // encoder stop at wrong state
+    assert(dnswire_encoder_stop(&e) == dnswire_error);
+
+    // encoder * need more
+    e.state = dnswire_encoder_control_ready;
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_need_more);
+    e.state = dnswire_encoder_control_start;
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_need_more);
+    e.state = dnswire_encoder_control_accept;
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_need_more);
+    e.state = dnswire_encoder_control_finish;
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_need_more);
+    e.state = dnswire_encoder_control_stop;
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_need_more);
+
+    // encoder frame
+    e.state = dnswire_encoder_frames;
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_error);
+    dnswire_encoder_set_dnstap(e, &d);
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_need_more);
+
+    // encoder done
+    e.state = dnswire_encoder_done;
+    assert(dnswire_encoder_encode(&e, buf, 1) == dnswire_error);
+
+    return 0;
+}
diff --git a/src/test/test_reader.c b/src/test/test_reader.c
new file mode 100644
index 0000000..7c64450
--- /dev/null
+++ b/src/test/test_reader.c
@@ -0,0 +1,73 @@
+#include <dnswire/reader.h>
+
+#include <assert.h>
+
+int main(void)
+{
+    uint8_t               buf[1], buf2[1];
+    size_t                s;
+    struct dnswire_reader r;
+    assert(dnswire_reader_init(&r) == dnswire_ok);
+    assert(dnswire_reader_allow_bidirectional(&r, true) == dnswire_ok);
+
+    // set bufsize
+    r.left = 2;
+    assert(dnswire_reader_set_bufsize(&r, 1) == dnswire_error);
+    r.left = 1;
+    r.at   = 1;
+    assert(dnswire_reader_set_bufsize(&r, 1) == dnswire_ok);
+    r.left = 0;
+    assert(dnswire_reader_set_bufsize(&r, DNSWIRE_MAXIMUM_BUF_SIZE + 1) == dnswire_error);
+    assert(dnswire_reader_set_bufsize(&r, DNSWIRE_DEFAULT_BUF_SIZE) == dnswire_ok);
+
+    // set bufinc
+    assert(dnswire_reader_set_bufinc(&r, DNSWIRE_DEFAULT_BUF_SIZE) == dnswire_ok);
+
+    // set bufmax
+    assert(dnswire_reader_set_bufmax(&r, DNSWIRE_DEFAULT_BUF_SIZE - 1) == dnswire_error);
+    assert(dnswire_reader_set_bufmax(&r, DNSWIRE_MAXIMUM_BUF_SIZE) == dnswire_ok);
+
+    // reader push
+    r.state = dnswire_reader_reading_control;
+    assert(dnswire_reader_push(&r, buf, 0, buf2, &s) == dnswire_need_more);
+    r.state = dnswire_reader_encoding_accept;
+    s       = sizeof(buf2);
+    assert(dnswire_reader_push(&r, buf, 0, buf2, &s) == dnswire_again);
+    r.state = dnswire_reader_reading;
+    assert(dnswire_reader_push(&r, buf, 0, buf2, &s) == dnswire_need_more);
+    r.state = dnswire_reader_encoding_finish;
+    assert(dnswire_reader_push(&r, buf, 0, buf2, &s) == dnswire_again);
+    r.decoder.state = dnswire_decoder_done;
+    r.left          = 1;
+    r.state         = dnswire_reader_decoding_control;
+    assert(dnswire_reader_push(&r, buf, 0, buf2, &s) == dnswire_error);
+    r.state = dnswire_reader_decoding;
+    assert(dnswire_reader_push(&r, buf, 0, buf2, &s) == dnswire_error);
+    r.state = dnswire_reader_done;
+    assert(dnswire_reader_push(&r, buf, 0, buf2, &s) == dnswire_error);
+
+    // reset reader
+    dnswire_reader_destroy(r);
+    assert(dnswire_reader_init(&r) == dnswire_ok);
+    assert(dnswire_reader_allow_bidirectional(&r, true) == dnswire_ok);
+
+    // reader read
+    r.state = dnswire_reader_reading_control;
+    assert(dnswire_reader_read(&r, -1) == dnswire_error);
+    r.state = dnswire_reader_writing_accept;
+    assert(dnswire_reader_read(&r, -1) == dnswire_error);
+    r.state = dnswire_reader_reading;
+    assert(dnswire_reader_read(&r, -1) == dnswire_error);
+    r.state = dnswire_reader_writing_finish;
+    assert(dnswire_reader_read(&r, -1) == dnswire_error);
+    r.decoder.state = dnswire_decoder_done;
+    r.left          = 1;
+    r.state         = dnswire_reader_decoding_control;
+    assert(dnswire_reader_read(&r, -1) == dnswire_error);
+    r.state = dnswire_reader_decoding;
+    assert(dnswire_reader_read(&r, -1) == dnswire_error);
+    r.state = dnswire_reader_done;
+    assert(dnswire_reader_read(&r, -1) == dnswire_error);
+
+    return 0;
+}
diff --git a/src/test/test_writer.c b/src/test/test_writer.c
new file mode 100644
index 0000000..74453b5
--- /dev/null
+++ b/src/test/test_writer.c
@@ -0,0 +1,94 @@
+#include <dnswire/writer.h>
+
+#include <assert.h>
+
+int main(void)
+{
+    uint8_t               buf[1], buf2[1];
+    size_t                s;
+    struct dnswire_writer w;
+    assert(dnswire_writer_init(&w) == dnswire_ok);
+
+    // set bidirectional
+    assert(dnswire_writer_set_bidirectional(&w, true) == dnswire_ok);
+    assert(dnswire_writer_set_bidirectional(&w, false) == dnswire_ok);
+
+    // set bufsize
+    w.left = 2;
+    assert(dnswire_writer_set_bufsize(&w, 1) == dnswire_error);
+    w.left = 1;
+    w.at   = 1;
+    assert(dnswire_writer_set_bufsize(&w, 1) == dnswire_ok);
+    w.left = 0;
+    assert(dnswire_writer_set_bufsize(&w, DNSWIRE_MAXIMUM_BUF_SIZE + 1) == dnswire_error);
+    assert(dnswire_writer_set_bufsize(&w, DNSWIRE_DEFAULT_BUF_SIZE) == dnswire_ok);
+
+    // set bufinc
+    assert(dnswire_writer_set_bufinc(&w, DNSWIRE_DEFAULT_BUF_SIZE) == dnswire_ok);
+
+    // set bufmax
+    assert(dnswire_writer_set_bufmax(&w, DNSWIRE_DEFAULT_BUF_SIZE - 1) == dnswire_error);
+    assert(dnswire_writer_set_bufmax(&w, DNSWIRE_MAXIMUM_BUF_SIZE) == dnswire_ok);
+
+    // writer pop
+    w.state = dnswire_writer_encoding_ready;
+    s       = sizeof(buf2);
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_again);
+    w.state = dnswire_writer_reading_accept;
+    s       = 0;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_need_more);
+    s           = sizeof(buf2);
+    w.read_left = 1;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_need_more);
+    w.state     = dnswire_writer_stopping;
+    w.read_left = 1;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_again);
+    w.read_left = 0;
+    w.state     = dnswire_writer_reading_finish;
+    s           = 0;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_need_more);
+    s           = sizeof(buf2);
+    w.read_left = 1;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_need_more);
+    w.decoder.state = dnswire_decoder_done;
+    w.state         = dnswire_writer_decoding_accept;
+    w.read_left     = 1;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_error);
+    w.state     = dnswire_writer_decoding_finish;
+    w.read_left = 1;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_error);
+    w.state = dnswire_writer_done;
+    assert(dnswire_writer_pop(&w, buf, 1, buf2, &s) == dnswire_error);
+
+    // reset writer
+    dnswire_writer_destroy(w);
+    assert(dnswire_writer_init(&w) == dnswire_ok);
+    assert(dnswire_writer_set_bidirectional(&w, true) == dnswire_ok);
+
+    // writer write
+    w.state = dnswire_writer_writing_ready;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.state = dnswire_writer_reading_accept;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.state = dnswire_writer_writing;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.state = dnswire_writer_stopping;
+    w.left  = 1;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.state = dnswire_writer_writing_stop;
+    w.left  = 1;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.left  = 0;
+    w.state = dnswire_writer_reading_finish;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.read_left     = 1;
+    w.decoder.state = dnswire_decoder_done;
+    w.state         = dnswire_writer_decoding_accept;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.state = dnswire_writer_decoding_finish;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+    w.state = dnswire_writer_done;
+    assert(dnswire_writer_write(&w, -1) == dnswire_error);
+
+    return 0;
+}
diff --git a/src/test/writer_pop.c b/src/test/writer_pop.c
new file mode 100644
index 0000000..69070b3
--- /dev/null
+++ b/src/test/writer_pop.c
@@ -0,0 +1,119 @@
+#include <dnswire/writer.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "create_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        return 1;
+    }
+
+    FILE* fp = fopen(argv[1], "w");
+    if (!fp) {
+        return 1;
+    }
+
+    struct dnswire_writer writer;
+    if (dnswire_writer_init(&writer) != dnswire_ok) {
+        return 1;
+    }
+
+    uint8_t buf[4096];
+
+    struct dnstap d = DNSTAP_INITIALIZER;
+    create_dnstap(&d, "writer_pop-1");
+
+    dnswire_writer_set_dnstap(writer, &d);
+
+    while (1) {
+        if (dnswire_writer_popped(writer)) {
+            if (fwrite(buf, 1, dnswire_writer_popped(writer), fp) != dnswire_writer_popped(writer)) {
+                fprintf(stderr, "fwrite() failed\n");
+                return 1;
+            }
+        }
+        enum dnswire_result res = dnswire_writer_pop(&writer, buf, sizeof(buf), 0, 0);
+        switch (res) {
+        case dnswire_ok:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_writer_pop() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    create_dnstap(&d, "writer_pop-2");
+
+    while (1) {
+        if (dnswire_writer_popped(writer)) {
+            if (fwrite(buf, 1, dnswire_writer_popped(writer), fp) != dnswire_writer_popped(writer)) {
+                fprintf(stderr, "fwrite() failed\n");
+                return 1;
+            }
+        }
+        enum dnswire_result res = dnswire_writer_pop(&writer, buf, sizeof(buf), 0, 0);
+        switch (res) {
+        case dnswire_ok:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_writer_pop() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    if (dnswire_writer_stop(&writer) != dnswire_ok) {
+        fprintf(stderr, "dnswire_writer_stop() failed\n");
+        return 1;
+    }
+
+    while (1) {
+        if (dnswire_writer_popped(writer)) {
+            if (fwrite(buf, 1, dnswire_writer_popped(writer), fp) != dnswire_writer_popped(writer)) {
+                fprintf(stderr, "fwrite() failed\n");
+                return 1;
+            }
+        }
+        enum dnswire_result res = dnswire_writer_pop(&writer, buf, sizeof(buf), 0, 0);
+        switch (res) {
+        case dnswire_ok:
+        case dnswire_endofdata:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_reader_add() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    if (dnswire_writer_popped(writer)) {
+        if (fwrite(buf, 1, dnswire_writer_popped(writer), fp) != dnswire_writer_popped(writer)) {
+            fprintf(stderr, "fwrite() failed\n");
+            return 1;
+        }
+    }
+
+    dnswire_writer_destroy(writer);
+    fclose(fp);
+    return 0;
+}
diff --git a/src/test/writer_unixsock.c b/src/test/writer_unixsock.c
new file mode 100644
index 0000000..3290c9b
--- /dev/null
+++ b/src/test/writer_unixsock.c
@@ -0,0 +1,134 @@
+#include <dnswire/writer.h>
+#include <dnswire/reader.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <sys/types.h>
+#include <signal.h>
+#include <sys/wait.h>
+
+#include "create_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        return 1;
+    }
+
+    struct sockaddr_un path;
+    memset(&path, 0, sizeof(struct sockaddr_un));
+    path.sun_family = AF_UNIX;
+    strncpy(path.sun_path, argv[1], sizeof(path.sun_path) - 1);
+
+    int fd = socket(AF_UNIX, SOCK_STREAM, 0);
+    if (fd == -1) {
+        return 1;
+    }
+
+    int ret = 1, attempts = 5;
+    while (attempts--) {
+        if (!(ret = connect(fd, (struct sockaddr*)&path, sizeof(struct sockaddr_un)))) {
+            break;
+        } else {
+            fprintf(stderr, "sleep\n");
+            sleep(1);
+        }
+    }
+    if (ret) {
+        close(fd);
+        return ret;
+    }
+
+    struct dnswire_writer writer;
+    if (dnswire_writer_init(&writer) != dnswire_ok) {
+        return 1;
+    }
+    if (dnswire_writer_set_bidirectional(&writer, true) != dnswire_ok) {
+        return 1;
+    }
+
+    // force small buffers to trigger buf resizing
+    writer.read_size = 4;
+    writer.read_inc  = 4;
+    if (dnswire_writer_set_bufsize(&writer, 4) != dnswire_ok) {
+        return 1;
+    }
+    if (dnswire_writer_set_bufinc(&writer, 4) != dnswire_ok) {
+        return 1;
+    }
+
+    struct dnstap d = DNSTAP_INITIALIZER;
+    create_dnstap(&d, "writer_reader_unixsock-1");
+
+    dnswire_writer_set_dnstap(writer, &d);
+
+    while (1) {
+        enum dnswire_result res = dnswire_writer_write(&writer, fd);
+        switch (res) {
+        case dnswire_ok:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_writer_write() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    create_dnstap(&d, "writer_reader_unixsock-2");
+
+    while (1) {
+        enum dnswire_result res = dnswire_writer_write(&writer, fd);
+        switch (res) {
+        case dnswire_ok:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_writer_write() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    if (dnswire_writer_stop(&writer) != dnswire_ok) {
+        fprintf(stderr, "dnswire_writer_stop() failed\n");
+        return 1;
+    }
+
+    while (1) {
+        enum dnswire_result res = dnswire_writer_write(&writer, fd);
+        switch (res) {
+        case dnswire_ok:
+        case dnswire_endofdata:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_writer_write() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    dnswire_writer_destroy(writer);
+
+    shutdown(fd, SHUT_RDWR);
+    close(fd);
+
+    return ret;
+}
diff --git a/src/test/writer_write.c b/src/test/writer_write.c
new file mode 100644
index 0000000..c003895
--- /dev/null
+++ b/src/test/writer_write.c
@@ -0,0 +1,92 @@
+#include <dnswire/writer.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "create_dnstap.c"
+
+int main(int argc, const char* argv[])
+{
+    if (argc < 2) {
+        return 1;
+    }
+
+    FILE* fp = fopen(argv[1], "w");
+    if (!fp) {
+        return 1;
+    }
+
+    struct dnswire_writer writer;
+    if (dnswire_writer_init(&writer) != dnswire_ok) {
+        return 1;
+    }
+
+    struct dnstap d = DNSTAP_INITIALIZER;
+    create_dnstap(&d, "writer_write-1");
+
+    dnswire_writer_set_dnstap(writer, &d);
+
+    while (1) {
+        enum dnswire_result res = dnswire_writer_fwrite(&writer, fp);
+        switch (res) {
+        case dnswire_ok:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_writer_fwrite() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    create_dnstap(&d, "writer_write-2");
+
+    while (1) {
+        enum dnswire_result res = dnswire_writer_fwrite(&writer, fp);
+        switch (res) {
+        case dnswire_ok:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_writer_fwrite() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    if (dnswire_writer_stop(&writer) != dnswire_ok) {
+        fprintf(stderr, "dnswire_writer_stop() failed\n");
+        return 1;
+    }
+
+    while (1) {
+        enum dnswire_result res = dnswire_writer_fwrite(&writer, fp);
+        switch (res) {
+        case dnswire_ok:
+        case dnswire_endofdata:
+            break;
+
+        case dnswire_again:
+        case dnswire_need_more:
+            continue;
+
+        default:
+            fprintf(stderr, "dnswire_reader_add() error\n");
+            return 1;
+        }
+        break;
+    }
+
+    dnswire_writer_destroy(writer);
+    fclose(fp);
+    return 0;
+}
diff --git a/src/trace.c b/src/trace.c
new file mode 100644
index 0000000..742f819
--- /dev/null
+++ b/src/trace.c
@@ -0,0 +1,52 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+
+#include "dnswire/trace.h"
+
+#if DNSWIRE_TRACE
+const char* __printable_string(const uint8_t* data, size_t len)
+{
+    static char buf[512];
+    size_t      r = 0, w = 0;
+
+    while (r < len && w < sizeof(buf) - 1) {
+        if (isprint(data[r])) {
+            buf[w++] = data[r++];
+        } else {
+            if (w + 4 >= sizeof(buf) - 1) {
+                break;
+            }
+
+            sprintf(&buf[w], "\\x%02x", data[r++]);
+            w += 4;
+        }
+    }
+    if (w >= sizeof(buf)) {
+        buf[sizeof(buf) - 1] = 0;
+    } else {
+        buf[w] = 0;
+    }
+
+    return buf;
+}
+#endif
diff --git a/src/writer.c b/src/writer.c
new file mode 100644
index 0000000..885ff91
--- /dev/null
+++ b/src/writer.c
@@ -0,0 +1,710 @@
+/*
+ * Author Jerry Lundström <jerry@dns-oarc.net>
+ * Copyright (c) 2019, OARC, Inc.
+ * All rights reserved.
+ *
+ * This file is part of the dnswire library.
+ *
+ * dnswire library is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * dnswire library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with dnswire library.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+
+#include "dnswire/writer.h"
+#include "dnswire/trace.h"
+#include "dnswire/dnswire.h"
+
+#include <assert.h>
+#include <stdlib.h>
+
+const char* const dnswire_writer_state_string[] = {
+    "encoding_ready",
+    "writing_ready",
+    "reading_accept",
+    "decoding_accept",
+    "encoding",
+    "writing",
+    "stopping",
+    "encoding_stop",
+    "writing_stop",
+    "reading_finish",
+    "decoding_finish",
+    "done",
+};
+
+#define __state(h, s)                                                                                   \
+    __trace("state %s => %s", dnswire_writer_state_string[(h)->state], dnswire_writer_state_string[s]); \
+    (h)->state = s;
+
+static struct dnswire_writer _defaults = {
+    .state = dnswire_writer_encoding,
+
+    .encoder = DNSWIRE_ENCODER_INITIALIZER,
+    .buf     = 0,
+    .size    = DNSWIRE_DEFAULT_BUF_SIZE,
+    .inc     = DNSWIRE_DEFAULT_BUF_SIZE,
+    .max     = DNSWIRE_MAXIMUM_BUF_SIZE,
+    .at      = 0,
+    .left    = 0,
+    .popped  = 0,
+
+    .decoder     = DNSWIRE_DECODER_INITIALIZER,
+    .read_buf    = 0,
+    .read_size   = DNSWIRE_DEFAULT_BUF_SIZE,
+    .read_inc    = DNSWIRE_DEFAULT_BUF_SIZE,
+    .read_max    = DNSWIRE_MAXIMUM_BUF_SIZE,
+    .read_at     = 0,
+    .read_left   = 0,
+    .read_pushed = 0,
+
+    .bidirectional = false,
+};
+
+enum dnswire_result dnswire_writer_init(struct dnswire_writer* handle)
+{
+    assert(handle);
+
+    *handle = _defaults;
+
+    if (!(handle->buf = malloc(handle->size))) {
+        return dnswire_error;
+    }
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_writer_set_bidirectional(struct dnswire_writer* handle, bool bidirectional)
+{
+    assert(handle);
+
+    if (bidirectional) {
+        if (!handle->read_buf) {
+            if (!(handle->read_buf = malloc(handle->read_size))) {
+                return dnswire_error;
+            }
+        }
+
+        handle->encoder.state = dnswire_encoder_control_ready;
+        __state(handle, dnswire_writer_encoding_ready);
+    } else {
+        handle->encoder.state = dnswire_encoder_control_start;
+        __state(handle, dnswire_writer_encoding);
+    }
+
+    handle->bidirectional = bidirectional;
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_writer_set_bufsize(struct dnswire_writer* handle, size_t size)
+{
+    assert(handle);
+    assert(size);
+    assert(handle->buf);
+
+    if (handle->left > size) {
+        // we got data and it doesn't fit in the new size
+        return dnswire_error;
+    }
+    if (size > handle->max) {
+        // don't expand over max
+        return dnswire_error;
+    }
+
+    if (handle->at + handle->left > size) {
+        // move what's left to the start
+        if (handle->left) {
+            memmove(handle->buf, &handle->buf[handle->at], handle->left);
+        }
+        handle->at = 0;
+    }
+
+    uint8_t* buf = realloc(handle->buf, size);
+    if (!buf) {
+        return dnswire_error;
+    }
+
+    handle->buf  = buf;
+    handle->size = size;
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_writer_set_bufinc(struct dnswire_writer* handle, size_t inc)
+{
+    assert(handle);
+    assert(inc);
+
+    handle->inc = inc;
+
+    return dnswire_ok;
+}
+
+enum dnswire_result dnswire_writer_set_bufmax(struct dnswire_writer* handle, size_t max)
+{
+    assert(handle);
+    assert(max);
+
+    if (max < handle->size) {
+        return dnswire_error;
+    }
+
+    handle->max = max;
+
+    return dnswire_ok;
+}
+
+static enum dnswire_result _encoding(struct dnswire_writer* handle)
+{
+    enum dnswire_result res;
+
+    while (1) {
+        res = dnswire_encoder_encode(&handle->encoder, &handle->buf[handle->at], handle->size - handle->at);
+        __trace("encode %s", dnswire_result_string[res]);
+
+        switch (res) {
+        case dnswire_ok:
+        case dnswire_again:
+        case dnswire_endofdata:
+            handle->at += dnswire_encoder_encoded(handle->encoder);
+            handle->left += dnswire_encoder_encoded(handle->encoder);
+            break;
+
+        case dnswire_need_more: {
+            if (handle->size >= handle->max) {
+                // already at max size and it's not enough
+                return dnswire_error;
+            }
+
+            // no space left, expand
+            size_t   size = handle->size + handle->inc > handle->max ? handle->max : handle->size + handle->inc;
+            uint8_t* buf  = realloc(handle->buf, size);
+            if (!buf) {
+                return dnswire_error;
+            }
+            handle->buf  = buf;
+            handle->size = size;
+            continue;
+        }
+        default:
+            break;
+        }
+        break;
+    }
+    return res;
+}
+
+enum dnswire_result dnswire_writer_pop(struct dnswire_writer* handle, uint8_t* data, size_t len, uint8_t* in_data, size_t* in_len)
+{
+    assert(handle);
+    assert(data);
+    assert(len);
+    assert(handle->buf);
+    assert(!handle->bidirectional || in_data);
+
+    handle->popped     = 0;
+    size_t in_len_orig = 0;
+    if (in_len) {
+        in_len_orig = *in_len;
+        *in_len     = 0;
+    }
+
+    enum dnswire_result res = dnswire_again;
+
+    __trace("state %s", dnswire_writer_state_string[handle->state]);
+
+    switch (handle->state) {
+    case dnswire_writer_encoding_ready:
+        res = _encoding(handle);
+        __trace("left %zu", handle->left);
+        if (res != dnswire_error && handle->left) {
+            __state(handle, dnswire_writer_writing);
+            // fallthrough
+        } else {
+            break;
+        }
+
+    case dnswire_writer_writing_ready:
+        handle->popped = len < handle->left ? len : handle->left;
+        memcpy(data, &handle->buf[handle->at - handle->left], handle->popped);
+        __trace("wrote %zd", handle->popped);
+        handle->left -= handle->popped;
+        __trace("left %zu", handle->left);
+        if (handle->left) {
+            break;
+        }
+        handle->at = 0;
+        __state(handle, dnswire_writer_reading_accept);
+
+    case dnswire_writer_reading_accept:
+        if (!in_len_orig) {
+            return dnswire_need_more;
+        }
+        *in_len = handle->read_size - handle->read_at - handle->read_left < in_len_orig ? handle->read_size - handle->read_at - handle->read_left : in_len_orig;
+        if (*in_len) {
+            memcpy(&handle->read_buf[handle->read_at + handle->read_left], in_data, *in_len);
+            __trace("%s", __printable_string(&handle->read_buf[handle->read_at + handle->read_left], *in_len));
+            handle->left += *in_len;
+        }
+        __state(handle, dnswire_writer_decoding_accept);
+        // fallthrough
+
+    case dnswire_writer_decoding_accept:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->read_buf[handle->read_at], handle->read_left)) {
+        case dnswire_bidirectional:
+            handle->read_at += dnswire_decoder_decoded(handle->decoder);
+            handle->read_left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->read_left) {
+                handle->read_at = 0;
+            }
+
+            if (!handle->decoder.accept_support_dnstap_protobuf) {
+                return dnswire_error;
+            }
+
+            __state(handle, dnswire_writer_encoding);
+            return dnswire_again;
+
+        case dnswire_again:
+            handle->read_at += dnswire_decoder_decoded(handle->decoder);
+            handle->read_left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->read_left) {
+                handle->read_at = 0;
+                __state(handle, dnswire_writer_reading_accept);
+            }
+            return dnswire_again;
+
+        case dnswire_need_more:
+            if (handle->read_left < handle->read_size) {
+                // still space left to fill
+                if (handle->read_at) {
+                    // move what's left to the start
+                    if (handle->read_left) {
+                        memmove(handle->read_buf, &handle->read_buf[handle->read_at], handle->read_left);
+                    }
+                    handle->read_at = 0;
+                }
+            } else if (handle->read_size < handle->read_max) {
+                // no space left, expand
+                size_t   size = handle->read_size + handle->read_inc > handle->read_max ? handle->read_max : handle->read_size + handle->read_inc;
+                uint8_t* buf  = realloc(handle->read_buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->read_buf  = buf;
+                handle->read_size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_writer_reading_accept);
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_writer_encoding:
+        res = _encoding(handle);
+        __trace("left %zu", handle->left);
+        if (res != dnswire_error && handle->left) {
+            __state(handle, dnswire_writer_writing);
+            // fallthrough
+        } else {
+            break;
+        }
+
+    case dnswire_writer_writing:
+        handle->popped = len < handle->left ? len : handle->left;
+        memcpy(data, &handle->buf[handle->at - handle->left], handle->popped);
+        __trace("wrote %zd", handle->popped);
+        handle->left -= handle->popped;
+        __trace("left %zu", handle->left);
+        if (!handle->left) {
+            handle->at = 0;
+            __state(handle, dnswire_writer_encoding);
+        }
+        break;
+
+    case dnswire_writer_stopping:
+        if (handle->left) {
+            handle->popped = len < handle->left ? len : handle->left;
+            memcpy(data, &handle->buf[handle->at - handle->left], handle->popped);
+            __trace("wrote %zd", handle->popped);
+            handle->left -= handle->popped;
+            if (handle->left) {
+                __trace("left %zu", handle->left);
+                return dnswire_again;
+            }
+            handle->at = 0;
+        }
+        __state(handle, dnswire_writer_encoding_stop);
+        // fallthrough
+
+    case dnswire_writer_encoding_stop:
+        res = _encoding(handle);
+        if (res == dnswire_endofdata) {
+            __state(handle, dnswire_writer_writing_stop);
+            // fallthrough
+        } else {
+            break;
+        }
+
+    case dnswire_writer_writing_stop:
+        if (handle->left) {
+            handle->popped = len < handle->left ? len : handle->left;
+            memcpy(data, &handle->buf[handle->at - handle->left], handle->popped);
+            __trace("wrote %zd", handle->popped);
+            handle->left -= handle->popped;
+            if (handle->left) {
+                __trace("left %zu", handle->left);
+                return dnswire_again;
+            }
+            handle->at = 0;
+        }
+        if (handle->bidirectional) {
+            __state(handle, dnswire_writer_reading_finish);
+            return dnswire_again;
+        }
+        __state(handle, dnswire_writer_done);
+        return dnswire_endofdata;
+
+    case dnswire_writer_reading_finish:
+        if (!in_len_orig) {
+            return dnswire_need_more;
+        }
+        *in_len = handle->read_size - handle->read_at - handle->read_left < in_len_orig ? handle->read_size - handle->read_at - handle->read_left : in_len_orig;
+        if (*in_len) {
+            memcpy(&handle->read_buf[handle->read_at + handle->read_left], in_data, *in_len);
+            __trace("%s", __printable_string(&handle->read_buf[handle->read_at + handle->read_left], *in_len));
+            handle->left += *in_len;
+        }
+        __state(handle, dnswire_writer_decoding_finish);
+        // fallthrough
+
+    case dnswire_writer_decoding_finish:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->read_buf[handle->read_at], handle->read_left)) {
+        case dnswire_endofdata:
+            __state(handle, dnswire_writer_done);
+            return dnswire_endofdata;
+
+        case dnswire_need_more:
+            if (handle->read_left < handle->read_size) {
+                // still space left to fill
+                if (handle->read_at) {
+                    // move what's left to the start
+                    if (handle->read_left) {
+                        memmove(handle->read_buf, &handle->read_buf[handle->read_at], handle->read_left);
+                    }
+                    handle->read_at = 0;
+                }
+            } else if (handle->read_size < handle->read_max) {
+                // no space left, expand
+                size_t   size = handle->read_size + handle->read_inc > handle->read_max ? handle->read_max : handle->read_size + handle->read_inc;
+                uint8_t* buf  = realloc(handle->read_buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->read_buf  = buf;
+                handle->read_size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_writer_reading_accept);
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_writer_done:
+        return dnswire_error;
+    }
+
+    return res;
+}
+
+enum dnswire_result dnswire_writer_write(struct dnswire_writer* handle, int fd)
+{
+    assert(handle);
+    assert(handle->buf);
+
+    enum dnswire_result res = dnswire_again;
+
+    __trace("state %s", dnswire_writer_state_string[handle->state]);
+
+    switch (handle->state) {
+    case dnswire_writer_encoding_ready:
+        res = _encoding(handle);
+        __trace("left %zu", handle->left);
+        if (res != dnswire_error && handle->left) {
+            __state(handle, dnswire_writer_writing);
+            // fallthrough
+        } else {
+            break;
+        }
+
+    case dnswire_writer_writing_ready: {
+        ssize_t nwrote = write(fd, &handle->buf[handle->at - handle->left], handle->left);
+        __trace("wrote %zd", nwrote);
+        if (nwrote < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nwrote) {
+            // TODO
+            return dnswire_error;
+        }
+
+        handle->left -= nwrote;
+        __trace("left %zu", handle->left);
+        if (handle->left) {
+            break;
+        }
+        handle->at = 0;
+        __state(handle, dnswire_writer_reading_accept);
+        // fallthrough
+    }
+
+    case dnswire_writer_reading_accept: {
+        ssize_t nread = read(fd, &handle->read_buf[handle->read_at + handle->read_left], handle->read_size - handle->read_at - handle->read_left);
+        if (nread < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nread) {
+            // TODO
+            return dnswire_error;
+        }
+        __trace("%s", __printable_string(&handle->read_buf[handle->read_at + handle->read_left], nread));
+        handle->read_left += nread;
+        __state(handle, dnswire_writer_decoding_accept);
+        // fallthrough
+    }
+
+    case dnswire_writer_decoding_accept:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->read_buf[handle->read_at], handle->read_left)) {
+        case dnswire_bidirectional:
+            handle->read_at += dnswire_decoder_decoded(handle->decoder);
+            handle->read_left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->read_left) {
+                handle->read_at = 0;
+            }
+
+            if (!handle->decoder.accept_support_dnstap_protobuf) {
+                return dnswire_error;
+            }
+
+            __state(handle, dnswire_writer_encoding);
+            return dnswire_again;
+
+        case dnswire_again:
+            handle->read_at += dnswire_decoder_decoded(handle->decoder);
+            handle->read_left -= dnswire_decoder_decoded(handle->decoder);
+            if (!handle->read_left) {
+                handle->read_at = 0;
+                __state(handle, dnswire_writer_reading_accept);
+            }
+            return dnswire_again;
+
+        case dnswire_need_more:
+            if (handle->read_left < handle->read_size) {
+                // still space left to fill
+                if (handle->read_at) {
+                    // move what's left to the start
+                    if (handle->read_left) {
+                        memmove(handle->read_buf, &handle->read_buf[handle->read_at], handle->read_left);
+                    }
+                    handle->read_at = 0;
+                }
+            } else if (handle->read_size < handle->read_max) {
+                // no space left, expand
+                size_t   size = handle->read_size + handle->read_inc > handle->read_max ? handle->read_max : handle->read_size + handle->read_inc;
+                uint8_t* buf  = realloc(handle->read_buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->read_buf  = buf;
+                handle->read_size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_writer_reading_accept);
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_writer_encoding:
+        res = _encoding(handle);
+        __trace("left %zu", handle->left);
+        if (res != dnswire_error && handle->left) {
+            __state(handle, dnswire_writer_writing);
+            // fallthrough
+        } else {
+            break;
+        }
+
+    case dnswire_writer_writing: {
+        ssize_t nwrote = write(fd, &handle->buf[handle->at - handle->left], handle->left);
+        __trace("wrote %zd", nwrote);
+        if (nwrote < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nwrote) {
+            // TODO
+            return dnswire_error;
+        }
+
+        handle->left -= nwrote;
+        __trace("left %zu", handle->left);
+        if (!handle->left) {
+            handle->at = 0;
+            __state(handle, dnswire_writer_encoding);
+        }
+        break;
+    }
+
+    case dnswire_writer_stopping:
+        if (handle->left) {
+            ssize_t nwrote = write(fd, &handle->buf[handle->at - handle->left], handle->left);
+            __trace("wrote %zd", nwrote);
+            if (nwrote < 0) {
+                // TODO
+                return dnswire_error;
+            } else if (!nwrote) {
+                // TODO
+                return dnswire_error;
+            }
+
+            handle->left -= nwrote;
+            if (handle->left) {
+                __trace("left %zu", handle->left);
+                return dnswire_again;
+            }
+            handle->at = 0;
+        }
+        __state(handle, dnswire_writer_encoding_stop);
+        // fallthrough
+
+    case dnswire_writer_encoding_stop:
+        res = _encoding(handle);
+        if (res == dnswire_endofdata) {
+            __state(handle, dnswire_writer_writing_stop);
+            // fallthrough
+        } else {
+            break;
+        }
+
+    case dnswire_writer_writing_stop:
+        if (handle->left) {
+            ssize_t nwrote = write(fd, &handle->buf[handle->at - handle->left], handle->left);
+            __trace("wrote %zd", nwrote);
+            if (nwrote < 0) {
+                // TODO
+                return dnswire_error;
+            } else if (!nwrote) {
+                // TODO
+                return dnswire_error;
+            }
+
+            handle->left -= nwrote;
+            if (handle->left) {
+                __trace("left %zu", handle->left);
+                return dnswire_again;
+            }
+            handle->at = 0;
+        }
+        if (handle->bidirectional) {
+            __state(handle, dnswire_writer_reading_finish);
+            return dnswire_again;
+        }
+        __state(handle, dnswire_writer_done);
+        return dnswire_endofdata;
+
+    case dnswire_writer_reading_finish: {
+        ssize_t nread = read(fd, &handle->read_buf[handle->read_at + handle->read_left], handle->read_size - handle->read_at - handle->read_left);
+        if (nread < 0) {
+            // TODO
+            return dnswire_error;
+        } else if (!nread) {
+            // TODO
+            return dnswire_error;
+        }
+        __trace("%s", __printable_string(&handle->read_buf[handle->read_at + handle->read_left], nread));
+        handle->read_left += nread;
+        __state(handle, dnswire_writer_decoding_finish);
+        // fallthrough
+    }
+
+    case dnswire_writer_decoding_finish:
+        switch (dnswire_decoder_decode(&handle->decoder, &handle->read_buf[handle->read_at], handle->read_left)) {
+        case dnswire_endofdata:
+            __state(handle, dnswire_writer_done);
+            return dnswire_endofdata;
+
+        case dnswire_need_more:
+            if (handle->read_left < handle->read_size) {
+                // still space left to fill
+                if (handle->read_at) {
+                    // move what's left to the start
+                    if (handle->read_left) {
+                        memmove(handle->read_buf, &handle->read_buf[handle->read_at], handle->read_left);
+                    }
+                    handle->read_at = 0;
+                }
+            } else if (handle->read_size < handle->read_max) {
+                // no space left, expand
+                size_t   size = handle->read_size + handle->read_inc > handle->read_max ? handle->read_max : handle->read_size + handle->read_inc;
+                uint8_t* buf  = realloc(handle->read_buf, size);
+                if (!buf) {
+                    return dnswire_error;
+                }
+                handle->read_buf  = buf;
+                handle->read_size = size;
+            } else {
+                // already at max size, and full
+                return dnswire_error;
+            }
+            __state(handle, dnswire_writer_reading_accept);
+            return dnswire_need_more;
+
+        default:
+            break;
+        }
+        return dnswire_error;
+
+    case dnswire_writer_done:
+        return dnswire_error;
+    }
+
+    return res;
+}
+
+enum dnswire_result dnswire_writer_stop(struct dnswire_writer* handle)
+{
+    assert(handle);
+
+    enum dnswire_result res = dnswire_encoder_stop(&handle->encoder);
+
+    if (res == dnswire_ok) {
+        __state(handle, dnswire_writer_stopping);
+    }
+
+    return res;
+}