natpt,dnsx,tcp,udp: 4 via 6

Author: ignoramous

intra/backend/netstat.go

@@ -155,8 +155,6 @@ type RDNSInfo struct {
 	NewWireGuard            string
 	Transparency            bool
 	HappyEyeballs           bool
-	PanicTest               bool
-	FatalTest               bool
 	SystemDNSForUndelegated bool
 	DefaultDNSAsFallback    bool
 	SetUserAgent            bool

intra/common.go

@@ -700,8 +700,17 @@ func (h *baseHandler) undoAlg(algip netip.Addr, uid string) (undidAlg bool, real
 func filterFamilyForDialingWithFailSafe(ipcsv string) (included []netip.Addr, excluded []netip.Addr, excludedIsIncluded bool) {
 	included, excluded, excludedIsIncluded = filterFamilyForDialing(ipcsv)
 	if !excludedIsIncluded && len(excluded) > 0 && len(included) > 0 {
-		// if not falling back, then include one excluded ip as a fail-safe
-		included = append(included, core.ChooseOne(excluded))
+		ptmode := settings.PtMode.Load()
+		if ptmode == settings.PtModeForce || ptmode == settings.PtModeForce46 {
+			// when PtMode forces protocol translation, include up to len(included)
+			// excluded IPs so that both families are available for Happy Eyeballs
+			n := min(len(included), len(excluded))
+			included = append(included, excluded[:n]...)
+			excluded = nil
+		} else {
+			// if not falling back, then include one excluded ip as a fail-safe
+			included = append(included, core.ChooseOne(excluded))
+		}
 	}
 	return included, excluded, excludedIsIncluded
 }

intra/dnsx/transport.go

@@ -367,7 +367,7 @@ func (r *resolver) Add(dt x.DNSTransport) (ok bool) {
 			caching = true
 		}
 		r.Unlock()
-		core.Go("r.onAdd", func() { r.listener.OnDNSAdded(tid) })
+		core.Go("r.onAdd."+tid, func() { r.listener.OnDNSAdded(tid) })
 		ok = true
 	case DNS53, DOH, DOT, ODOH:
 		r.Lock()
@@ -391,10 +391,10 @@ func (r *resolver) Add(dt x.DNSTransport) (ok bool) {
 		if tid == System || tid == Goos {
 			// TODO: add other resolvers?
 			// always add64 after having added the system transport
-			core.Gx("r.Add64", func() { r.Add64(tid) })
+			core.Gx("r.Add64."+tid, func() { r.Add64(tid) })
 		}
 
-		core.Go("r.onAdd", func() { r.listener.OnDNSAdded(tid) })
+		core.Go("r.onAdd."+tid, func() { r.listener.OnDNSAdded(tid) })
 		ok = true
 	default:
 		log.E("dns: unknown transport(%s) type: %s", t.ID(), t.Type())
@@ -478,7 +478,7 @@ func (r *resolver) Remove(tid string) (ok bool) {
 
 	if hasTransport {
 		if id == System || id == Goos {
-			core.Gx("r.Remove64", func() { r.Remove64(id) })
+			core.Gx("r.Remove64."+tid, func() { r.Remove64(id) })
 		}
 		r.Lock()
 		r.stopIfExistsLocked(id)
@@ -499,7 +499,7 @@ func (r *resolver) Remove(tid string) (ok bool) {
 	}
 
 	if hasTransport {
-		core.Go("r.onRemove", func() { r.listener.OnDNSRemoved(id) })
+		core.Go("r.onRemove."+tid, func() { r.listener.OnDNSRemoved(id) })
 	}
 
 	return hasTransport
@@ -616,7 +616,34 @@ func (r *resolver) forward(q []byte, who, fid, uid string, chosenids ...string)
 		return nil, NoDNS, errMissingQueryName
 	}
 
-	pref, oqcompleted := core.Grx("r.onQuery", func(_ context.Context) (*x.DNSOpts, error) {
+	// when PtMode forces protocol translation, resolve AAAA in parallel
+	// so that dns64/nat64 caches are warm for subsequent translations.
+	pt := settings.PtMode.Load()
+	if who == OriginTunnel && xdns.IsAQType(uint16(qtyp)) && ptmodeIsForce(pt) {
+		msg6 := xdns.Request6FromRequest4(msg)
+		smm6 := copySummary(ogsmm)
+		smm6.QType = int(dns.TypeAAAA)
+		fid6 := core.Rand64()
+
+		if log.Verbose {
+			log.V("dns: fwd: for %s; force6 for %s:%s:%d; ptmode=%s", uid, fid6, qname, qtyp, pt)
+		}
+
+		core.Gx("r.fwd.aaaa."+fid6+"."+qname, func() {
+			_, _, _ = r.forwardInner(msg6, smm6, who, fid6, uid, chosenids...)
+		})
+	}
+
+	return r.forwardInner(msg, ogsmm, who, fid, uid, chosenids...)
+}
+
+func (r *resolver) forwardInner(msg *dns.Msg, ogsmm *x.DNSSummary, who, fid, uid string, chosenids ...string) ([]byte, string, error) {
+	starttime := time.Now()
+
+	qname := ogsmm.QName
+	qtyp := ogsmm.QType
+
+	pref, oqcompleted := core.Grx("r.onQuery."+fid+"."+qname, func(_ context.Context) (*x.DNSOpts, error) {
 		return r.listener.OnQuery(who, uid, qname, qtyp), nil
 	}, listenerTimeout)
 	if !oqcompleted || pref == nil {
@@ -799,7 +826,7 @@ runagain:
 	}
 
 	if run == 1 {
-		pref2, ouacompleted := core.Grx("r.onUA."+qname, func(_ context.Context) (*x.DNSOpts, error) {
+		pref2, ouacompleted := core.Grx("r.onUA."+fid+"."+qname, func(_ context.Context) (*x.DNSOpts, error) {
 			return r.listener.OnUpstreamAnswer(who, smm, pref.Copy(), realips), nil
 		}, answerTimeout)
 		if !ouacompleted {
@@ -1086,7 +1113,7 @@ func (r *resolver) accept(c io.ReadWriteCloser, uid, fid string) (rx, tx int64,
 		frees := free
 		cnts := cnt
 		wg.Add(1)
-		core.Gx("r.accept.do", func() {
+		core.Gx("r.accept.do."+fid, func() {
 			defer wg.Done()
 			defer frees()
 			m, err := r.dnstcp(qs, c, uid, fid)
@@ -1917,3 +1944,7 @@ func GetIPCsv(t Transport) string {
 	}
 	return sb.String()
 }
+
+func ptmodeIsForce(pt int32) bool {
+	return pt == settings.PtModeForce || pt == settings.PtModeForce46 || pt == settings.PtModeForce64
+}

intra/ipn/proxies.go

@@ -1379,8 +1379,13 @@ func accStats(a, b *x.RouterStats) (c *x.RouterStats) {
 	c.LastGoodRx = max(a.LastGoodRx, b.LastGoodRx)
 	c.LastGoodTx = max(a.LastGoodTx, b.LastGoodTx)
 	c.LastRefresh = max(a.LastRefresh, b.LastRefresh)
-	// todo: a.Since or b.Since may be zero
-	c.Since = min(a.Since, b.Since)
+	if a.Since > 0 && b.Since > 0 {
+		c.Since = min(a.Since, b.Since)
+	} else if a.Since > 0 {
+		c.Since = a.Since
+	} else {
+		c.Since = b.Since
+	}
 	c.Status = strings.Join([]string{a.Status, b.Status}, ";")
 	c.StatusReason = strings.Join([]string{a.StatusReason, b.StatusReason}, ";")
 	return c

intra/ipn/wgproxy.go

@@ -1293,9 +1293,9 @@ func (w *wgproxy) Stat() (out *x.RouterStats) {
 		out.LastOK = stat.LatestRecentHandshake()
 	}
 
-	if settings.Debug {
-		out.Extra = w.remote.Load().String() + "\n" + w.dns.Load().String() + "\nallowed:" + fmt.Sprintf("%v", *w.allowed.Load())
+	out.Extra = w.remote.Load().String() + "\n" + w.dns.Load().String() + "\nallowed:" + fmt.Sprintf("%v", *w.allowed.Load())
 
+	if log.Verbose {
 		log.VV("proxy: wg: %s stats: rx: %d, tx: %d, r: %s (rlastok: %s), w: %s (wlastok: %s), lastok: %s",
 			w.tag(), out.Rx, out.Tx,
 			core.FmtUnixMillisAsPeriod(out.LastRx), core.FmtUnixMillisAsPeriod(out.LastGoodRx),

intra/settings/tunopts.go

@@ -44,6 +44,10 @@ const (
 	PtModeForce64 int32 = 1
 	// Android implements 464Xlat out-of-the-box, so this zero userspace impl
 	PtModeNo46 int32 = 2
+	// PtModeForce46 enforces 4 via 6 protocol translation.
+	PtModeForce46 int32 = 3
+	// PtModeForce enforces both PtModeForce64 or PtModeForce46.
+	PtModeForce int32 = 4
 )
 
 // Converts a given DNS/Block/Pt mode to its string representation.
@@ -77,6 +81,10 @@ func Mode2String(typ string, mode int32) string {
 				return "auto"
 			case PtModeForce64:
 				return "force64"
+			case PtModeForce46:
+				return "force46"
+			case PtModeForce:
+				return "force"
 			case PtModeNo46:
 				return "no46"
 			}
@@ -93,7 +101,7 @@ var DNSMode atomic.Int32
 var BlockMode atomic.Int32
 
 // PtMode determines 6to4 translation heuristics.
-var PtMode = core.NewForeverFlow[int32](PtModeAuto)
+var PtMode = core.NewForeverFlow(PtModeAuto)
 
 // SetMode re-assigns d to DNSMode, b to BlockMode, pt to PtMode.
 func SetTunMode(d, b, pt int32) {

intra/udp.go

@@ -218,7 +218,7 @@ func (h *udpHandler) Connect(gconn *netstack.GUDPConn, src, target netip.AddrPor
 	// doesn't exist outside of firestack's tunnel).
 	targetIsLocalNat64 := h.resolver.IsNat64(dnsx.Local464Resolver, target.Addr())
 
-	filtered, _, fallingback := filterFamilyForDialingWithFailSafe(realips)
+	filtered, excluded, fallingback := filterFamilyForDialingWithFailSafe(realips)
 	actualTargets := makeIPPorts(filtered, target, !undidAlg && !targetIsLocalNat64, 0)
 	cid, uid, fid, pids := h.judge(res, domains, target.String())
 
@@ -304,8 +304,8 @@ func (h *udpHandler) Connect(gconn *netstack.GUDPConn, src, target netip.AddrPor
 	}
 
 	if log.Verbose {
-		log.V("udp: connect: %s [%s] proxying %s => %s [%v]; pids: %s, mux? %t / fwd? %t / localnat64? %t",
-			cid, uid, src, target, actualTargets, pids, mux, canportfwd, targetIsLocalNat64)
+		log.V("udp: connect: %s [%s] proxying %s => %s [%v]; pids: %s, mux? %t / fwd? %t / localnat64? %t / excluded? %v",
+			cid, uid, src, target, actualTargets, pids, mux, canportfwd, targetIsLocalNat64, excluded)
 	}
 
 	// note: fake-dns-ips shouldn't be un-nated / un-alg'd

intra/x64/dns64.go

@@ -94,6 +94,8 @@ func (d *dns64) pauseOrResume() {
 			log.I("dns64: flow: disabled; pausing...")
 		}
 	} else if pt == settings.PtModeAuto && !has6 {
+		// in auto mode, but no v6; pause 6to4 translations
+		// in force 4 via 6 mode; 6to4 does not make sense
 		if d.paused.CompareAndSwap(false, true) {
 			log.I("dns64: flow: auto; no ipv6; pausing...")
 		}
@@ -358,7 +360,6 @@ func (d *dns64) ofLocal464() error {
 
 // add adds the nat64 prefixes to the dns64 map; thread-safe.
 func (d *dns64) add(serverid string, nat64 []net.IP) error {
-
 	if len(nat64) <= 0 {
 		log.W("dns64: no nat64 ips for %s", serverid)
 		return errEmpty

intra/x64/natpt.go

@@ -64,10 +64,10 @@ func NewNatPt2(ctx context.Context) *natPt {
 }
 
 // D64 Implements DNS64.
-func (pt *natPt) D64(network, id, uid string, ans6 *dns.Msg) *dns.Msg {
+func (pt *natPt) D64(network, id, uid string, ans6 *dns.Msg) (ans4 *dns.Msg) {
 	ptmode := settings.PtMode.Load()
 	if ptmode != settings.PtModeNo46 { // do64
-		force64 := ptmode == settings.PtModeForce64
+		force64 := ptmode == settings.PtModeForce64 || ptmode == settings.PtModeForce
 		return pt.dns64.eval(network, force64, ans6, id, uid)
 	}
 	return nil

intra/xdns/dnsutil.go

@@ -94,6 +94,15 @@ func Request4FromRequest6(msg6 *dns.Msg) *dns.Msg {
 	return msg4
 }
 
+func Request6FromRequest4(msg4 *dns.Msg) *dns.Msg {
+	if !HasAnyQuestion(msg4) {
+		return nil
+	}
+	msg6 := msg4.Copy()
+	msg6.SetQuestion(QName(msg4), dns.TypeAAAA)
+	return msg6
+}
+
 func EmptyResponseFromMessage(srcMsg *dns.Msg) *dns.Msg {
 	if !HasAnyQuestion(srcMsg) {
 		return nil