mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-09 11:52:00 -04:00
James Tucker
f5f326030b
When quad-100 must be installed as the OS primary resolver (Apple Mode B), its catch-all forwarders were blended from base-config nameserver IPs alone: non-standard ports, search domains, and DoH/DoT endpoints were lost, and a base read that returned no resolvers silently installed a catch-all with no forwarders at all, breaking all public DNS while reporting a healthy DNS configuration. Introduce OSConfig.Resolvers, which OSConfigurators able to recover the underlying resolver configuration at full fidelity populate for the DNS manager only: it never reaches the OS, and Equal ignores it so configuration application is unaffected. Blend it into the catch-all route verbatim, falling back to plain IP:53 resolvers derived from Nameservers. Teach the forwarder to dial arbitrary https:// resolvers instead of only well-known public providers: at their BootstrapResolution addresses when present, or at the URL's own host when that is an IP literal, so enterprise DoH endpoints recovered from the OS can be forwarded to over DoH rather than plaintext DNS. Reject an empty base config on Apple Mode B: keep the previous configuration, use the upstream empty-base health warning and medium severity, and let an extension-triggered recompile retry instead of installing a catch-all that cannot forward. Expose the same missing- resolver error to OS configurators so bridge-reported absence uses this warning too, while genuine configuration-read failures remain distinct. Extend the Apple mode tests with empty-base and full-fidelity blend coverage, and update the iOS primary-mode cases to model the real NetworkExtension base read (LAN resolvers and search domains) rather than the silently empty catch-all. RELNOTE: Fix silent public DNS breakage when Tailscale must be the system DNS resolver on Apple clients. Updates #20341 Updates tailscale/corp#45534 Updates tailscale/corp#48693 Change-Id: Ie7e277b0fd39d2b91b1e770f8f01d688e02b4d49 Signed-off-by: James Tucker <james@tailscale.com>