mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-09 11:52:00 -04:00
Brendan Creane
2d4379386a
On backends that can't do OS-level split DNS, Tailscale forwards the default route to the system's own resolvers, which it reads out of the OS config. At boot that config may not be populated yet, because NetworkManager or systemd-resolved haven't run, and Tailscale took over regardless: it pointed the OS at 100.100.100.100 but compiled an empty "." route, so every non-Tailscale name failed to resolve for the rest of the process's life. Fail compileConfig instead, which leaves the OS resolvers in place, and retry the last config with a bounded backoff until resolvers appear. A health warning explains why MagicDNS is inactive in the meantime. Sandboxed macOS and iOS are exempt. There the network extension reapplies the config itself when the OS nameservers change, and quad-100 as the primary resolver is what keeps tailnet names resolving while the base config is still empty. Dropping the exemption is tracked in tailscale/corp#48962. This also changes the outcome on an openresolv host with no snippets registered. Since the fix for #20825, openresolv reports an empty base config there and tailscaled took over with no upstream, so every public name got SERVFAIL. Such a host now keeps its resolv.conf and shows the health warning instead. TestOpenresolvDNS checks that outcome. TestSplitDNSEmptyBaseConfig covers the boot race end to end in natlab: it empties resolv.conf on a guest using the "direct" backend, checks that tailscaled leaves it alone, then adds a resolver and checks that both tailnet and public names resolve. Fixes #20341 Signed-off-by: Brendan Creane <bcreane@gmail.com>