Same strategy used for other DNS transports. Convince the real Go
resolver that we're an UDP con...

With DoT and DNS-over-TCP, we cannot guarantee that we will really
see full messages, even thoug...

We create a net.PacketConn like connection and let the Go DNS
client do the encoding and decodin...

Since append is a built-in function, a different name may be
helpful. For example, the append me...

After the previous patch, which paved the way, the only remaining
bit is to use a *tls.Config wi...

There is code in net/http that casts a net.Conn to *tls.Conn to
inspect the ALPN for upgrading t...

Basically, make sure using this code is pleasant and it
does not require one to do too much work.

I think logx is possibly a better name because it does not
conflict with the log package name in...

That is the more logical place to do tls because doing tls there
allows to wrap tls.Con in a way...

This is key to (1) avoid reading the whole request in a single
memory buffer and (2) bind HTTP t...

Do not use anything larger than log.DebugLevel because we want to
give ooni/prob-cli freedom to ...