Nick Khyl eaf3fc8daf net/dns: don't make quad-100 the primary resolver on Windows when hosts are unrouted ...

In #20775 (and the follow-up in #21471), we started installing quad-100
as the OS's primary resolver whenever cfg has hosts not covered by a split
DNS route, so that sandboxed macOS clients could still answer them.

However, that check was added to the generic split DNS gate rather than
to the Apple-specific one, so it also applies on Windows, where dcfg.Hosts
always carries every node's records and MagicDNSHostsUnrouted is set
whenever MagicDNS is disabled. As a result, a Windows node with MagicDNS
off and at least one split DNS route (or with MagicDNS on and a peer shared
in from another tailnet) gets a catch-all NRPT rule pointing at quad-100,
and all DNS traffic on the device is proxied through it instead of only
the configured suffixes.

The check is redundant for Apple platforms: iOS never takes the scoped
path there, and sandboxed macOS only does so via scopeApple, which already
requires !cfg.requiresPrimaryResolver(). This removes it from the generic
gate, restoring the pre-1.104 behavior on Windows, and adds tests.

Updates tailscale/corp#45534
Fixes #21863

Signed-off-by: Nick Khyl <nickk@tailscale.com>

2026-10-20 09:21:11 -04:00

..

publicdns

…

resolvconffile

…

resolver

…

config.go

…

dbus.go

…

debian_resolvconf.go

…

direct_linux_test.go

…

direct_test.go

…

direct_unix_test.go

…

direct.go

…

dns_clone.go

…

dns_view.go

…

flush_default.go

…

flush_windows.go

…

hosts_option_windows_test.go

…

ini_test.go

…

ini.go

…

manager_apple_test.go

…

manager_apple.go

…

manager_darwin_test.go

…

manager_darwin.go

…

manager_default.go

…

manager_freebsd.go

…

manager_linux_test.go

…

manager_linux.go

…

manager_nonapple.go

…

manager_openbsd.go

…

manager_plan9_test.go

…

manager_plan9.go

…

manager_solaris.go

…

manager_tcp_test.go

…

manager_test.go

…

manager_windows_test.go

…

manager_windows.go

…

manager.go

…

negative_cache_test.go

…

nm.go

…

noop.go

…

nrpt_windows.go

…

openresolv_test.go

…

openresolv.go

…

osconfig_test.go

…

osconfig.go

…

resolvconf-workaround.sh

…

resolvconf.go

…

resolvconfpath_default.go

…

resolvconfpath_gokrazy.go

…

resolvd.go

…

resolved_test.go

…

resolved.go

…

utf_test.go

…

utf.go

…

wsl_windows.go

…