Compare commits
19 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
78711f516e | ||
|
|
64d85ce770 | ||
|
|
8791198d10 | ||
|
|
f9b503ab96 | ||
|
|
2b99b39bcc | ||
|
|
7ab97f4cdc | ||
|
|
65dcd9a9c5 | ||
|
|
32cd8624b4 | ||
|
|
bea0affdde | ||
|
|
bad4f25d7d | ||
|
|
5f45e23f55 | ||
|
|
882508297e | ||
|
|
2b241c5755 | ||
|
|
7510c8e068 | ||
|
|
87c321f3d4 | ||
|
|
edfccaa2b7 | ||
|
|
0c43240c01 | ||
|
|
b615a56586 | ||
|
|
7056766a84 |
2
Cargo.lock
generated
2
Cargo.lock
generated
@@ -1143,7 +1143,7 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "numa"
|
||||
version = "0.6.0"
|
||||
version = "0.8.0"
|
||||
dependencies = [
|
||||
"arc-swap",
|
||||
"axum",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "numa"
|
||||
version = "0.6.0"
|
||||
version = "0.8.0"
|
||||
authors = ["razvandimescu <razvan@dimescu.com>"]
|
||||
edition = "2021"
|
||||
description = "Portable DNS resolver in Rust — .numa local domains, ad blocking, developer overrides, DNS-over-HTTPS"
|
||||
@@ -10,7 +10,7 @@ keywords = ["dns", "dns-server", "ad-blocking", "reverse-proxy", "developer-tool
|
||||
categories = ["network-programming", "development-tools"]
|
||||
|
||||
[dependencies]
|
||||
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time"] }
|
||||
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time", "sync"] }
|
||||
axum = "0.8"
|
||||
serde = { version = "1", features = ["derive"] }
|
||||
serde_json = "1"
|
||||
|
||||
8
Makefile
8
Makefile
@@ -1,4 +1,4 @@
|
||||
.PHONY: all build lint fmt check audit test coverage bench clean deploy blog
|
||||
.PHONY: all build lint fmt check audit test coverage bench clean deploy blog release
|
||||
|
||||
all: lint build test
|
||||
|
||||
@@ -33,6 +33,12 @@ blog:
|
||||
echo " $$f → site/blog/posts/$$name.html"; \
|
||||
done
|
||||
|
||||
release:
|
||||
ifndef VERSION
|
||||
$(error Usage: make release VERSION=0.8.0)
|
||||
endif
|
||||
./scripts/release.sh $(VERSION)
|
||||
|
||||
clean:
|
||||
cargo clean
|
||||
|
||||
|
||||
166
README.md
166
README.md
@@ -8,166 +8,96 @@
|
||||
|
||||
A portable DNS resolver in a single binary. Block ads on any network, name your local services (`frontend.numa`), and override any hostname with auto-revert — all from your laptop, no cloud account or Raspberry Pi required.
|
||||
|
||||
Built from scratch in Rust. Zero DNS libraries. RFC 1035 wire protocol parsed by hand. Recursive resolution from root nameservers with full DNSSEC validation (chain-of-trust + NSEC/NSEC3 denial proofs). One ~8MB binary, no PHP, no web server, no database — everything is embedded.
|
||||
Built from scratch in Rust. Zero DNS libraries. RFC 1035 wire protocol parsed by hand. Caching, ad blocking, and local service domains out of the box. Optional recursive resolution from root nameservers with full DNSSEC chain-of-trust validation. One ~8MB binary, everything embedded.
|
||||
|
||||
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Install (pick one)
|
||||
brew install razvandimescu/tap/numa
|
||||
cargo install numa
|
||||
curl -fsSL https://raw.githubusercontent.com/razvandimescu/numa/main/install.sh | sh
|
||||
# or: cargo install numa
|
||||
# or: curl -fsSL https://raw.githubusercontent.com/razvandimescu/numa/main/install.sh | sh
|
||||
|
||||
# Run (port 53 requires root)
|
||||
sudo numa
|
||||
|
||||
# Try it
|
||||
dig @127.0.0.1 google.com # ✓ resolves normally
|
||||
dig @127.0.0.1 ads.google.com # ✗ blocked → 0.0.0.0
|
||||
sudo numa # port 53 requires root
|
||||
```
|
||||
|
||||
Open the dashboard: **http://numa.numa** (or `http://localhost:5380`)
|
||||
|
||||
Or build from source:
|
||||
```bash
|
||||
git clone https://github.com/razvandimescu/numa.git && cd numa
|
||||
cargo build --release
|
||||
sudo ./target/release/numa
|
||||
```
|
||||
Set as system DNS: `sudo numa install`
|
||||
|
||||
## Why Numa
|
||||
## Local Services
|
||||
|
||||
- **Local service proxy** — `https://frontend.numa` instead of `localhost:5173`. Auto-generated TLS certs, WebSocket support for HMR. Like `/etc/hosts` but with auto TLS, a REST API, LAN discovery, and auto-revert.
|
||||
- **Path-based routing** — `app.numa/api → :5001`, `app.numa/auth → :5002`. Route URL paths to different backends with optional prefix stripping. Like nginx location blocks, zero config files.
|
||||
- **LAN service discovery** — Numa instances on the same network find each other automatically via mDNS. Access a teammate's `api.numa` from your machine. Opt-in via `[lan] enabled = true`.
|
||||
- **Developer overrides** — point any hostname to any IP, auto-reverts after N minutes. Full REST API for scripting. Built-in diagnostics: `curl localhost:5380/diagnose/example.com` tells you exactly how any domain resolves.
|
||||
- **DNS-over-HTTPS** — upstream queries encrypted via DoH. Your ISP sees HTTPS traffic, not DNS queries. Set `address = "https://9.9.9.9/dns-query"` in `[upstream]` or any DoH provider.
|
||||
- **Ad blocking that travels with you** — 385K+ domains blocked via [Hagezi Pro](https://github.com/hagezi/dns-blocklists). Works on any network: coffee shops, hotels, airports.
|
||||
- **Sub-microsecond caching** — 691ns cached round-trip, ~2.0M queries/sec throughput, zero heap allocations in the I/O path. [Benchmarks](bench/).
|
||||
- **Live dashboard** — real-time stats, query log, blocking controls, service management. LAN accessibility badges show which services are reachable from other devices.
|
||||
- **macOS, Linux, and Windows** — `numa install` configures system DNS, `numa service start` runs as launchd/systemd service.
|
||||
|
||||
## Local Service Proxy
|
||||
|
||||
Name your local dev services with `.numa` domains:
|
||||
Name your dev services instead of remembering port numbers:
|
||||
|
||||
```bash
|
||||
curl -X POST localhost:5380/services \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"name":"frontend","target_port":5173}'
|
||||
|
||||
open http://frontend.numa # → proxied to localhost:5173
|
||||
```
|
||||
|
||||
- **HTTPS with green lock** — auto-generated local CA + per-service TLS certs
|
||||
- **WebSocket** — Vite/webpack HMR works through the proxy
|
||||
- **Health checks** — dashboard shows green/red status per service
|
||||
- **LAN sharing** — services bound to `0.0.0.0` are automatically discoverable by other Numa instances on the network. Dashboard shows "LAN" or "local only" per service.
|
||||
- **Path-based routing** — route URL paths to different backends:
|
||||
```toml
|
||||
[[services]]
|
||||
name = "app"
|
||||
target_port = 3000
|
||||
routes = [
|
||||
{ path = "/api", port = 5001 },
|
||||
{ path = "/auth", port = 5002, strip = true },
|
||||
]
|
||||
```
|
||||
`app.numa/api/users → :5001/api/users`, `app.numa/auth/login → :5002/login` (stripped)
|
||||
- **Persistent** — services survive restarts
|
||||
- Or configure in `numa.toml`:
|
||||
Now `https://frontend.numa` works in your browser — green lock, valid cert, WebSocket passthrough for HMR. No mkcert, no nginx, no `/etc/hosts`.
|
||||
|
||||
```toml
|
||||
[[services]]
|
||||
name = "frontend"
|
||||
target_port = 5173
|
||||
```
|
||||
Add path-based routing (`app.numa/api → :5001`), share services across machines via LAN discovery, or configure everything in [`numa.toml`](numa.toml).
|
||||
|
||||
## LAN Service Discovery
|
||||
## Ad Blocking & Privacy
|
||||
|
||||
Run Numa on multiple machines. They find each other automatically:
|
||||
385K+ domains blocked via [Hagezi Pro](https://github.com/hagezi/dns-blocklists). Works on any network — coffee shops, hotels, airports. Travels with your laptop.
|
||||
|
||||
By default, Numa forwards to your existing system DNS — everything works as before, just with caching and ad blocking on top. For full privacy, set `mode = "recursive"` — Numa resolves directly from root nameservers. No upstream dependency, no single entity sees your full query pattern. DNSSEC validates the full chain of trust: RRSIG signatures, DNSKEY verification, DS delegation, NSEC/NSEC3 denial proofs. [Read how it works →](https://numa.rs/blog/posts/dnssec-from-scratch.html)
|
||||
|
||||
## LAN Discovery
|
||||
|
||||
Run Numa on multiple machines. They find each other automatically via mDNS:
|
||||
|
||||
```
|
||||
Machine A (192.168.1.5) Machine B (192.168.1.20)
|
||||
┌──────────────────────┐ ┌──────────────────────┐
|
||||
│ Numa │ mDNS │ Numa │
|
||||
│ services: │◄───────────►│ services: │
|
||||
│ - api (port 8000) │ discovery │ - grafana (3000) │
|
||||
│ - frontend (5173) │ │ │
|
||||
│ - api (port 8000) │◄───────────►│ - grafana (3000) │
|
||||
│ - frontend (5173) │ discovery │ │
|
||||
└──────────────────────┘ └──────────────────────┘
|
||||
```
|
||||
|
||||
From Machine B:
|
||||
```bash
|
||||
dig @127.0.0.1 api.numa # → 192.168.1.5
|
||||
curl http://api.numa # → proxied to Machine A's port 8000
|
||||
```
|
||||
From Machine B: `curl http://api.numa` → proxied to Machine A's port 8000. Enable with `numa lan on`.
|
||||
|
||||
Enable LAN discovery:
|
||||
```bash
|
||||
numa lan on
|
||||
```
|
||||
Or in `numa.toml`:
|
||||
```toml
|
||||
[lan]
|
||||
enabled = true
|
||||
```
|
||||
Uses standard mDNS (`_numa._tcp.local` on port 5353) — compatible with Bonjour/Avahi, silently dropped by corporate firewalls instead of triggering IPS alerts.
|
||||
|
||||
**Hub mode** — don't want to install Numa on every machine? Run one instance as a shared DNS server and point other devices to it:
|
||||
|
||||
```bash
|
||||
# On the hub machine, bind to LAN interface
|
||||
[server]
|
||||
bind_addr = "0.0.0.0:53"
|
||||
|
||||
# On other devices, set DNS to the hub's IP
|
||||
# They get .numa resolution, ad blocking, caching — zero install
|
||||
```
|
||||
**Hub mode**: run one instance with `bind_addr = "0.0.0.0:53"` and point other devices' DNS to it — they get ad blocking + `.numa` resolution without installing anything.
|
||||
|
||||
## How It Compares
|
||||
|
||||
| | Pi-hole | AdGuard Home | NextDNS | Cloudflare | Numa |
|
||||
|---|---|---|---|---|---|
|
||||
| Local service proxy | No | No | No | No | `.numa` + HTTPS + WS |
|
||||
| Path-based routing | No | No | No | No | Prefix match + strip |
|
||||
| LAN service discovery | No | No | No | No | mDNS, opt-in |
|
||||
| Developer overrides | No | No | No | No | REST API + auto-expiry |
|
||||
| Recursive resolver | No | No | Cloud only | Cloud only | From root hints, DNSSEC |
|
||||
| Encrypted upstream (DoH) | No (needs cloudflared) | Yes | Cloud only | Cloud only | Native, single binary |
|
||||
| Portable (travels with laptop) | No (appliance) | No (appliance) | Cloud only | Cloud only | Single binary |
|
||||
| Zero config | Complex | Docker/setup | Yes | Yes | Works out of the box |
|
||||
| Ad blocking | Yes | Yes | Yes | Limited | 385K+ domains |
|
||||
| Data stays local | Yes | Yes | Cloud | Cloud | 100% local |
|
||||
| | Pi-hole | AdGuard Home | Unbound | Numa |
|
||||
|---|---|---|---|---|
|
||||
| Local service proxy + auto TLS | — | — | — | `.numa` domains, HTTPS, WebSocket |
|
||||
| LAN service discovery | — | — | — | mDNS, zero config |
|
||||
| Developer overrides (REST API) | — | — | — | Auto-revert, scriptable |
|
||||
| Recursive resolver | — | — | Yes | Yes, with SRTT selection |
|
||||
| DNSSEC validation | — | — | Yes | Yes (RSA, ECDSA, Ed25519) |
|
||||
| Ad blocking | Yes | Yes | — | 385K+ domains |
|
||||
| Web admin UI | Full | Full | — | Dashboard |
|
||||
| Encrypted upstream (DoH) | Needs cloudflared | Yes | — | Native |
|
||||
| Portable (laptop) | No (appliance) | No (appliance) | Server | Single binary |
|
||||
| Community maturity | 56K stars, 10 years | 33K stars | 20 years | New |
|
||||
|
||||
## How It Works
|
||||
## Performance
|
||||
|
||||
```
|
||||
Query → Overrides → .numa TLD → Blocklist → Local Zones → Cache → Recursive/Forward
|
||||
```
|
||||
691ns cached round-trip. ~2.0M qps throughput. Zero heap allocations in the hot path. Recursive queries average 237ms after SRTT warmup (12x improvement over round-robin). ECDSA P-256 DNSSEC verification: 174ns. [Benchmarks →](bench/)
|
||||
|
||||
Two resolution modes: **forward** (relay to upstream like Quad9/Cloudflare) or **recursive** (resolve from root nameservers — no upstream dependency). Set `mode = "recursive"` in `[upstream]` to resolve independently.
|
||||
## Learn More
|
||||
|
||||
No DNS libraries — no `hickory-dns`, no `trust-dns`. The wire protocol — headers, labels, compression pointers, record types — is parsed and serialized by hand. Runs on `tokio` + `axum`, async per-query task spawning.
|
||||
|
||||
[Configuration reference](numa.toml)
|
||||
- [Blog: Implementing DNSSEC from Scratch in Rust](https://numa.rs/blog/posts/dnssec-from-scratch.html)
|
||||
- [Blog: I Built a DNS Resolver from Scratch](https://numa.rs/blog/posts/dns-from-scratch.html)
|
||||
- [Configuration reference](numa.toml) — all options documented inline
|
||||
- [REST API](src/api.rs) — 27 endpoints across overrides, cache, blocking, services, diagnostics
|
||||
|
||||
## Roadmap
|
||||
|
||||
- [x] DNS proxy core — forwarding, caching, local zones
|
||||
- [x] Developer overrides — REST API with auto-expiry
|
||||
- [x] Ad blocking — 385K+ domains, live dashboard, allowlist
|
||||
- [x] System integration — macOS + Linux, launchd/systemd, Tailscale/VPN auto-discovery
|
||||
- [x] Local service proxy — `.numa` domains, HTTP/HTTPS proxy, auto TLS, WebSocket
|
||||
- [x] Path-based routing — URL prefix routing with optional strip, REST API
|
||||
- [x] LAN service discovery — mDNS auto-discovery (opt-in), cross-machine DNS + proxy
|
||||
- [x] DNS-over-HTTPS — encrypted upstream via DoH (Quad9, Cloudflare, any provider)
|
||||
- [x] Recursive resolution — resolve from root nameservers, no upstream dependency
|
||||
- [x] DNSSEC validation — chain-of-trust, NSEC/NSEC3 denial proofs, AD bit (RSA, ECDSA, Ed25519)
|
||||
- [ ] pkarr integration — self-sovereign DNS via Mainline DHT (15M nodes)
|
||||
- [ ] Global `.numa` names — self-publish, DHT-backed, first-come-first-served
|
||||
- [x] DNS forwarding, caching, ad blocking, developer overrides
|
||||
- [x] `.numa` local domains — auto TLS, path routing, WebSocket proxy
|
||||
- [x] LAN service discovery — mDNS, cross-machine DNS + proxy
|
||||
- [x] DNS-over-HTTPS — encrypted upstream
|
||||
- [x] Recursive resolution + DNSSEC — chain-of-trust, NSEC/NSEC3
|
||||
- [x] SRTT-based nameserver selection
|
||||
- [ ] pkarr integration — self-sovereign DNS via Mainline DHT
|
||||
- [ ] Global `.numa` names — DHT-backed, no registrar
|
||||
|
||||
## License
|
||||
|
||||
|
||||
@@ -50,17 +50,7 @@ TLD priming solves this. On startup, Numa queries root for NS records of 34 comm
|
||||
|
||||
DNSSEC doesn't encrypt DNS traffic. It *signs* it. Every DNS record can have an accompanying RRSIG (signature) record. The resolver verifies the signature against the zone's DNSKEY, then verifies that DNSKEY against the parent zone's DS (delegation signer) record, walking up until it reaches the root trust anchor — a hardcoded public key that IANA publishes and the entire internet agrees on.
|
||||
|
||||
```
|
||||
cloudflare.com A 104.16.132.229
|
||||
signed by → RRSIG (key_tag=34505, algo=13, signer=cloudflare.com)
|
||||
verified with → DNSKEY (cloudflare.com, key_tag=34505, ECDSA P-256)
|
||||
vouched for by → DS (at .com, key_tag=2371, digest=SHA-256 of cloudflare's DNSKEY)
|
||||
signed by → RRSIG (key_tag=19718, signer=com)
|
||||
verified with → DNSKEY (com, key_tag=19718)
|
||||
vouched for by → DS (at root, key_tag=30909)
|
||||
signed by → RRSIG (signer=.)
|
||||
verified with → DNSKEY (., key_tag=20326) ← root trust anchor (hardcoded)
|
||||
```
|
||||
<img src="../dnssec-chain.svg" alt="DNSSEC chain of trust diagram — verifying cloudflare.com from answer through .com TLD to root trust anchor">
|
||||
|
||||
### How keys get there
|
||||
|
||||
@@ -165,11 +155,9 @@ The network fetch dominates. The crypto is noise.
|
||||
|
||||
## Surviving hostile networks
|
||||
|
||||
I deployed Numa as my system DNS and switched to a different network. Everything broke. Every query: SERVFAIL, 3-second timeout.
|
||||
I deployed Numa as my system DNS and switched networks. Everything broke — every query SERVFAIL, 3-second timeout. The ISP blocks outbound UDP port 53 to everything except whitelisted public resolvers. Root servers, TLD servers, authoritative servers — all unreachable over UDP.
|
||||
|
||||
The network probe told the story: the ISP blocks outbound UDP port 53 to all servers except a handful of whitelisted public resolvers (Google, Cloudflare). Root servers, TLD servers, authoritative servers — all unreachable over UDP. The ISP forces you onto their DNS or a blessed upstream. Recursive resolution is impossible.
|
||||
|
||||
Except TCP port 53 worked fine. And every DNS server is required to support TCP (RFC 1035 section 4.2.2). The ISP apparently only filters UDP.
|
||||
But TCP port 53 worked. Every DNS server is required to support TCP (RFC 1035 section 4.2.2). The ISP only filters UDP.
|
||||
|
||||
The fix has three parts:
|
||||
|
||||
|
||||
618
docs/marketing/launch-drafts.md
Normal file
618
docs/marketing/launch-drafts.md
Normal file
@@ -0,0 +1,618 @@
|
||||
# Launch Drafts
|
||||
|
||||
## Lessons Learned
|
||||
|
||||
**r/selfhosted** (0 upvotes, hostile) — "replaces Pi-hole" framing triggered
|
||||
defensive comparisons. Audience protects their stack.
|
||||
|
||||
**r/programare** (26 upvotes, 22 comments, 12K views, 90.6% ratio) — worked
|
||||
because it led with technical achievement. But: "what does this offer over
|
||||
/etc/hosts?" and "mature solutions exist (dnsmasq, nginx)" were the top
|
||||
objections. Tool-replacement angle falls flat with generalist audiences.
|
||||
|
||||
**r/webdev** — removed by moderators (self-promotion rules).
|
||||
|
||||
Key takeaways:
|
||||
|
||||
- Lead with what's *unique*, not what it *replaces*
|
||||
- Write like explaining to a colleague, not marketing copy
|
||||
- Pick ONE hook per community — don't try to be everything
|
||||
- Triple-check the GitHub link works before posting
|
||||
- Authentic tone > polished bullets
|
||||
- Agree with "just use X" — then show what X can't do
|
||||
- Don't oversell the pkarr/token vision — one sentence max
|
||||
- Benchmark request from r/programare (Mydocalm) — warm follow-up content
|
||||
|
||||
---
|
||||
|
||||
## Launch Order
|
||||
|
||||
~~0. **r/programare** — done (2026-03-21). 12K views, 26 upvotes, 22 comments.~~
|
||||
~~1. **r/webdev** — removed by moderators.~~
|
||||
|
||||
~~2. **r/degoogle** — done~~
|
||||
~~3. **r/node** — done~~
|
||||
|
||||
4. **r/coolgithubprojects** — zero friction, just post the repo
|
||||
~~5. **r/sideproject** — done (2026-03-29)~~
|
||||
6. **r/dns** — technical DNS audience, recursive + DNSSEC angle
|
||||
7. **Show HN** — Tuesday-Thursday, 9-10 AM ET
|
||||
8. **r/rust** — same day as HN, technical deep-dive
|
||||
9. **r/commandline** — 24h after HN
|
||||
10. **r/selfhosted** — only if HN hits front page, lead with recursive + LAN discovery
|
||||
11. **r/programare follow-up** — benchmark post + recursive/DNSSEC update
|
||||
|
||||
---
|
||||
|
||||
## Community Drafts
|
||||
|
||||
### Show HN
|
||||
|
||||
**Title (72 chars):**
|
||||
Show HN: I built a DNS resolver from scratch in Rust – no DNS libraries
|
||||
|
||||
**Body:**
|
||||
|
||||
I wanted to understand how DNS actually works at the wire level, so I built
|
||||
a resolver from scratch. No dns libraries — the RFC 1035 protocol (headers,
|
||||
labels, compression pointers, record types) is all hand-parsed. It started
|
||||
as a learning project and turned into something I use daily as my system DNS.
|
||||
|
||||
What it does today:
|
||||
|
||||
- **Forward mode by default** — transparent proxy to your existing DNS with
|
||||
caching and ad blocking. Changes nothing about your network.
|
||||
- **Full recursive resolver** — set `mode = "recursive"` and it resolves from
|
||||
root nameservers. No upstream dependency. CNAME chasing, TLD priming, SRTT.
|
||||
- **DNSSEC validation** — chain-of-trust verification from root KSK.
|
||||
RSA/SHA-256, ECDSA P-256, Ed25519. Sets the AD bit on verified responses.
|
||||
- **Ad blocking** — ~385K+ domains via Hagezi Pro, works on any network
|
||||
- **DNS-over-HTTPS** — encrypted upstream (Quad9, Cloudflare, or any
|
||||
provider) as an alternative to recursive mode
|
||||
- **`.numa` local domains** — register `frontend.numa → localhost:5173` and
|
||||
it creates both the DNS record and an HTTP/HTTPS reverse proxy with
|
||||
auto-generated TLS certs. WebSocket passthrough works (Vite HMR).
|
||||
- **LAN service discovery** — run Numa on two machines, they find each other
|
||||
via UDP multicast. Zero config.
|
||||
- **Developer overrides** — point any hostname to any IP, auto-reverts
|
||||
after N minutes. REST API for scripting.
|
||||
|
||||
Single binary, macOS + Linux. `sudo numa install` and it's your system DNS —
|
||||
forward mode by default, recursive when you're ready.
|
||||
|
||||
The interesting technical bits: the recursive resolver walks root → TLD →
|
||||
authoritative with iterative queries, caching NS/DS/DNSKEY records at each
|
||||
hop. DNSSEC validation verifies RRSIG signatures against DNSKEY, walks the
|
||||
chain via DS records up to the hardcoded root trust anchor. ECDSA P-256
|
||||
verification takes 174ns (benchmarked with criterion). Cold-cache validation
|
||||
for a new domain is ~90ms, with only 1 network fetch needed (TLD chain is
|
||||
pre-warmed on startup). SRTT-based nameserver selection learns which
|
||||
servers respond fastest — average recursive query drops from 2.8s to
|
||||
237ms after warmup (12x).
|
||||
|
||||
It also handles hostile networks: if your ISP blocks UDP port 53,
|
||||
Numa detects this after 3 failures and switches all
|
||||
queries to TCP automatically. Resets when you change networks. RFC 7816
|
||||
query minimization means root servers only see the TLD, not your full
|
||||
query.
|
||||
|
||||
The DNS cache adjusts TTLs on read (remaining time, not original). Each
|
||||
query is an async tokio task. EDNS0 with DO bit and 1232-byte payload
|
||||
(DNS Flag Day 2020).
|
||||
|
||||
Longer term I want to add pkarr/DHT resolution for self-sovereign DNS,
|
||||
but that's future work.
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### r/rust
|
||||
|
||||
**Title:** I built a recursive DNS resolver from scratch in Rust — DNSSEC, no DNS libraries
|
||||
|
||||
**Body:**
|
||||
|
||||
I've been building a DNS resolver in Rust as a learning project that became
|
||||
my daily driver. The entire DNS wire protocol is implemented by hand —
|
||||
no `trust-dns`, no `hickory-dns`, no `simple-dns`. Headers, label sequences,
|
||||
compression pointers, EDNS, all of it.
|
||||
|
||||
Some things I found interesting while building this:
|
||||
|
||||
**Recursive resolution** — iterative queries from root hints, walking
|
||||
root → TLD → authoritative. CNAME chasing, A+AAAA glue extraction from
|
||||
additional sections, referral depth limits. TLD priming pre-warms NS + DS +
|
||||
DNSKEY for 34 gTLDs + EU ccTLDs on startup.
|
||||
|
||||
**DNSSEC chain-of-trust** — the most involved part. Verify RRSIG signatures
|
||||
against DNSKEY, walk DS records up to the hardcoded root KSK (key tag 20326).
|
||||
Uses `ring` for crypto: RSA/SHA-256, ECDSA P-256 (174ns per verify), Ed25519.
|
||||
RFC 3110 RSA keys need converting to PKCS#1 DER for ring — wrote an ASN.1
|
||||
encoder for that. RRSIG time validity checks per RFC 4035 §5.3.1.
|
||||
|
||||
**NSEC/NSEC3 denial proofs** — proving a name *doesn't* exist is harder than
|
||||
proving it does. NSEC uses canonical DNS name ordering to prove gap coverage.
|
||||
NSEC3 uses iterated SHA-1 hashing + base32hex + a 3-part closest encloser
|
||||
proof (RFC 5155 §8.4). Both require authority-section RRSIG verification.
|
||||
|
||||
**Wire protocol parsing** — DNS uses a binary format with label compression
|
||||
(pointers back into the packet via 2-byte offsets). Parsing this correctly
|
||||
is surprisingly tricky because pointers can chain. I use a `BytePacketBuffer`
|
||||
that tracks position and handles jumps.
|
||||
|
||||
**Performance** — TLD chain pre-warming means cold-cache DNSSEC validation
|
||||
needs ~1 DNSKEY fetch (down from 5). Referral DS piggybacking caches DS
|
||||
from authority sections during resolution. ECDSA P-256 verify: 174ns.
|
||||
RSA/SHA-256: 10.9µs. DS verify: 257ns.
|
||||
|
||||
**LAN service discovery** — Numa instances on the same network find each
|
||||
other via UDP multicast. The tricky part was self-filtering: I initially
|
||||
filtered by IP, but two instances on the same host share an IP. Switched to
|
||||
a per-process instance ID (`pid ^ nanos`).
|
||||
|
||||
**Auto TLS** — generates a local CA + per-service certs using `rcgen`.
|
||||
`numa install` trusts the CA in the OS keychain. HTTPS proxy via `rustls` +
|
||||
`tokio-rustls`.
|
||||
|
||||
Single binary, no runtime dependencies. Uses `tokio`, `axum` (REST
|
||||
API/dashboard), `hyper` (reverse proxy), `ring` (DNSSEC crypto), `reqwest`
|
||||
(DoH), `socket2` (multicast), `rcgen` + `rustls` (TLS).
|
||||
|
||||
Happy to discuss any of the implementation decisions.
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### r/degoogle
|
||||
|
||||
**Title:** I replaced cloud DNS with a recursive resolver — resolves from root, no upstream, DNSSEC
|
||||
|
||||
**Body:**
|
||||
|
||||
I wanted a DNS setup with zero cloud dependency. No NextDNS account,
|
||||
no Cloudflare dashboard, no Pi-hole appliance, no upstream resolver seeing
|
||||
my queries. Just a single binary on my laptop that resolves everything
|
||||
itself.
|
||||
|
||||
Built one in Rust. What it does:
|
||||
|
||||
- **Forward mode by default** — transparent proxy to your existing DNS with
|
||||
caching and ad blocking. Changes nothing about your network.
|
||||
- **Recursive resolution** — set `mode = "recursive"` and it resolves directly
|
||||
from root nameservers. No Quad9, no Cloudflare, no upstream dependency.
|
||||
Each authoritative server only sees the query for its zone — no single
|
||||
entity sees your full browsing pattern.
|
||||
- **DNSSEC validation** — verifies the chain of trust from root KSK.
|
||||
Responses are cryptographically verified — no one can tamper with them
|
||||
in transit.
|
||||
- **System-level ad blocking** — Hagezi Pro list (~385K+ domains),
|
||||
works on any network. Coffee shop WiFi, airport, hotel.
|
||||
- **ISP resistant** — in recursive mode, if UDP is blocked Numa switches
|
||||
to TCP automatically. Or set `mode = "auto"` to probe on startup and
|
||||
fall back to encrypted DoH if needed.
|
||||
- **Query minimization** — root servers only see the TLD (.com), not
|
||||
your full domain. RFC 7816.
|
||||
- **Zero telemetry, zero cloud** — all data stays on your machine. No
|
||||
account, no login, no analytics. Config is a single TOML file.
|
||||
- **Local service naming** — bonus for developers: `https://app.numa`
|
||||
instead of `localhost:3000`, with auto-generated TLS certs
|
||||
|
||||
Single binary, macOS + Linux. `sudo numa install` and it's your system
|
||||
DNS — forward mode by default, recursive when you're ready. No Docker,
|
||||
no PHP, no external dependencies.
|
||||
|
||||
The DNS wire protocol is parsed from scratch — no DNS libraries. You can
|
||||
read every line of code.
|
||||
|
||||
```
|
||||
brew install razvandimescu/tap/numa
|
||||
# or
|
||||
cargo install numa
|
||||
```
|
||||
|
||||
MIT license. https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### r/node
|
||||
|
||||
**Title:** I replaced localhost:5173 with frontend.numa — auto HTTPS, HMR works, no nginx
|
||||
|
||||
**Body:**
|
||||
|
||||
Running a Vite frontend on :5173, Express API on :3000, maybe docs on
|
||||
:4000 — I could never remember which port was which. And CORS between
|
||||
`localhost:5173` and `localhost:3000` is its own special hell.
|
||||
|
||||
How do you get named domains with HTTPS locally?
|
||||
|
||||
1. /etc/hosts + mkcert + nginx
|
||||
2. dnsmasq + mkcert + Caddy
|
||||
3. `sudo numa`
|
||||
|
||||
What it actually does:
|
||||
|
||||
```
|
||||
curl -X POST localhost:5380/services \
|
||||
-d '{"name":"frontend","target_port":5173}'
|
||||
```
|
||||
|
||||
Now `https://frontend.numa` works in my browser. Green lock, valid cert.
|
||||
|
||||
- **HMR works** — Vite, webpack, socket.io all pass through the proxy.
|
||||
No special config.
|
||||
- **CORS solved** — `frontend.numa` and `api.numa` share the `.numa`
|
||||
cookie domain. Cross-service auth just works.
|
||||
- **Path routing** — `app.numa/api → :3000`, `app.numa/auth → :3001`.
|
||||
Like nginx location blocks, zero config files.
|
||||
|
||||
No mkcert, no nginx.conf, no Caddyfile, no editing /etc/hosts.
|
||||
Single binary, one command.
|
||||
|
||||
```
|
||||
brew install razvandimescu/tap/numa
|
||||
# or
|
||||
cargo install numa
|
||||
```
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### r/dns
|
||||
|
||||
**Title:** Numa — recursive DNS resolver from scratch in Rust, DNSSEC, no DNS libraries
|
||||
|
||||
**Body:**
|
||||
|
||||
I built a recursive DNS resolver where the entire wire protocol (RFC 1035 —
|
||||
headers, label compression, EDNS0) is hand-parsed. No `hickory-dns`,
|
||||
no `trust-dns`.
|
||||
|
||||
What it does:
|
||||
- Full recursive resolver from root hints (iterative queries, no upstream needed)
|
||||
- DNSSEC chain-of-trust validation (RSA/SHA-256, ECDSA P-256, Ed25519)
|
||||
- EDNS0 with DO bit, 1232-byte payload (DNS Flag Day 2020 compliant)
|
||||
- DNS-over-HTTPS as an alternative upstream mode
|
||||
- Ad blocking (~385K+ domains via Hagezi Pro)
|
||||
- Conditional forwarding (auto-detects Tailscale/VPN split-DNS)
|
||||
- Local zones, ephemeral overrides with auto-revert via REST API
|
||||
|
||||
DNSSEC implementation: DNSKEY/DS/RRSIG record parsing, canonical wire format
|
||||
for signed data, key tag computation (RFC 4034), DS digest verification.
|
||||
Chain walks from zone → TLD → root trust anchor. ECDSA P-256 signature
|
||||
verification in 174ns. TLD chain pre-warmed on startup. Referral DS records
|
||||
piggybacked from authority sections during resolution.
|
||||
|
||||
NSEC/NSEC3 authenticated denial of existence: NXDOMAIN gap proofs, NSEC3
|
||||
closest encloser proofs (3-part per RFC 5155), NODATA type absence proofs,
|
||||
authority-section RRSIG verification. Iteration cap at 500 for NSEC3 DoS
|
||||
prevention.
|
||||
|
||||
What it doesn't do (yet): no authoritative zone serving (AXFR/NOTIFY).
|
||||
|
||||
Single binary, macOS + Linux. MIT license.
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### Lobsters (invite-only)
|
||||
|
||||
**Title:** Numa — DNS resolver from scratch in Rust, no DNS libraries
|
||||
|
||||
**Body:**
|
||||
|
||||
I built a DNS resolver in Rust — RFC 1035 wire protocol parsed by hand,
|
||||
no `trust-dns` or `hickory-dns`. Started as a learning project, became
|
||||
my daily system DNS.
|
||||
|
||||
Beyond resolving, it does local `.numa` domains with auto HTTPS reverse
|
||||
proxy (register `frontend.numa → localhost:5173`, get a green lock and
|
||||
WebSocket passthrough), and LAN service discovery via UDP multicast —
|
||||
two machines running Numa find each other's services automatically.
|
||||
|
||||
Implementation bits I found interesting: DNS label compression (chained
|
||||
2-byte pointers back into the packet), browsers rejecting wildcard certs
|
||||
under single-label TLDs (`*.numa` fails — need per-service SANs), and
|
||||
`SO_REUSEPORT` on macOS for multiple processes binding the same multicast
|
||||
port.
|
||||
|
||||
Set `mode = "recursive"` for DNSSEC-validated resolution from root
|
||||
nameservers — no upstream, no middleman.
|
||||
|
||||
Single binary, macOS + Linux.
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### r/coolgithubprojects
|
||||
|
||||
**Post type:** Image post with `hero-demo.gif`, GitHub link in first comment.
|
||||
|
||||
**Title:** Numa — portable DNS resolver built from scratch in Rust. Ad blocking, local HTTPS domains, LAN discovery, recursive resolution with DNSSEC. Single binary.
|
||||
|
||||
**First comment (post immediately):**
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
```
|
||||
brew install razvandimescu/tap/numa && sudo numa
|
||||
```
|
||||
|
||||
No DNS libraries — RFC 1035 wire protocol parsed by hand.
|
||||
Recursive resolution from root nameservers with full DNSSEC
|
||||
chain-of-trust validation. 385K+ blocked ad domains.
|
||||
.numa local domains with auto TLS and WebSocket proxy.
|
||||
|
||||
---
|
||||
|
||||
### r/sideproject
|
||||
|
||||
**Title:** I built a DNS resolver from scratch in Rust — it's now my daily system DNS
|
||||
|
||||
**Body:**
|
||||
|
||||
Last year I wanted to understand how DNS actually works at the wire
|
||||
level, so I started parsing RFC 1035 packets by hand. No DNS libraries,
|
||||
no trust-dns, no hickory-dns — just bytes and the spec.
|
||||
|
||||
It turned into something I use every day. What it does now:
|
||||
|
||||
- **Ad blocking** on any network (coffee shops, airports) — 385K+
|
||||
domains blocked, travels with my laptop
|
||||
- **Local service naming** — `https://frontend.numa` instead of
|
||||
`localhost:5173`, with auto-generated TLS certs and WebSocket
|
||||
passthrough for HMR
|
||||
- **Recursive resolution** from root nameservers with DNSSEC
|
||||
chain-of-trust validation — set `mode = "recursive"` for full
|
||||
privacy, no upstream dependency, no single entity sees my query
|
||||
pattern
|
||||
- **LAN discovery** — two machines running Numa find each other's
|
||||
services automatically via mDNS
|
||||
|
||||
Single Rust binary, ~8MB, MIT license. `sudo numa install` and it's your
|
||||
system DNS — caching, ad blocking, .numa domains, zero config changes.
|
||||
|
||||
I wrote about the technical journey here:
|
||||
- [I Built a DNS Resolver from Scratch](https://numa.rs/blog/posts/dns-from-scratch.html)
|
||||
- [Implementing DNSSEC from Scratch](https://numa.rs/blog/posts/dnssec-from-scratch.html)
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### r/webdev (Showoff Saturday — posted 2026-03-28)
|
||||
|
||||
**Title:** I replaced localhost:5173 with frontend.numa — shared cookie domain, auto HTTPS, no nginx
|
||||
|
||||
**Body:**
|
||||
|
||||
The port numbers weren't the real problem. It was CORS between
|
||||
`localhost:5173` and `localhost:3000`, Secure cookies not setting over
|
||||
HTTP, and service workers requiring a secure context.
|
||||
|
||||
I built a DNS resolver that gives local services named domains under a
|
||||
shared TLD:
|
||||
|
||||
```
|
||||
curl -X POST localhost:5380/services \
|
||||
-d '{"name":"frontend","target_port":5173}'
|
||||
```
|
||||
|
||||
Now `https://frontend.numa` and `https://api.numa` share the `.numa`
|
||||
cookie domain. Cross-service auth just works. Secure cookies set.
|
||||
Service workers run.
|
||||
|
||||
What's under the hood:
|
||||
- **Auto HTTPS** — generates a local CA + per-service TLS certs. Green
|
||||
lock, no mkcert.
|
||||
- **WebSocket passthrough** — Vite/webpack HMR goes through the proxy.
|
||||
No special config.
|
||||
- **Path routing** — `app.numa/api → :3000`, `app.numa/auth → :3001`.
|
||||
Like nginx location blocks.
|
||||
- **Also a full DNS resolver** — forward mode with caching and ad
|
||||
blocking by default. Set `mode = "recursive"` for full DNSSEC-validated
|
||||
resolution from root nameservers.
|
||||
|
||||
Single Rust binary. `sudo numa install` and it's your system DNS — caching,
|
||||
ad blocking, .numa domains. No nginx, no Caddy, no /etc/hosts.
|
||||
|
||||
```
|
||||
brew install razvandimescu/tap/numa
|
||||
# or
|
||||
cargo install numa
|
||||
```
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
**Lessons from r/node (2026-03-24):** "Can't remember 3 ports?" got
|
||||
pushback — the CORS/cookie angle resonated more. Lead with what you
|
||||
can't do without it, not what's annoying.
|
||||
|
||||
---
|
||||
|
||||
### r/commandline
|
||||
|
||||
**Title:** numa — local dev DNS with auto HTTPS and LAN service discovery, single Rust binary
|
||||
|
||||
**Body:**
|
||||
|
||||
I run 5-6 local services and wanted named domains with HTTPS instead of
|
||||
remembering port numbers. Built a DNS resolver that handles `.numa`
|
||||
domains:
|
||||
|
||||
```
|
||||
curl -X POST localhost:5380/services \
|
||||
-d '{"name":"api","target_port":8000}'
|
||||
```
|
||||
|
||||
Now `https://api.numa` resolves, proxies to localhost:8000, and has a
|
||||
valid TLS cert. WebSocket passthrough works — Vite HMR goes through
|
||||
the proxy fine.
|
||||
|
||||
The part I didn't expect to be useful: LAN service discovery. Two
|
||||
machines running numa find each other via UDP multicast. I register
|
||||
`api.numa` on my laptop, my teammate's numa instance picks it up
|
||||
automatically. Zero config.
|
||||
|
||||
Also blocks ~385K+ ad domains since it's already your DNS resolver.
|
||||
Portable — works on any network (coffee shops, airports). Set
|
||||
`mode = "recursive"` for full DNSSEC-validated resolution from root
|
||||
nameservers — no upstream dependency.
|
||||
|
||||
```
|
||||
brew install razvandimescu/tap/numa
|
||||
sudo numa
|
||||
```
|
||||
|
||||
Single binary, DNS wire protocol parsed from scratch (no DNS libraries).
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
### r/selfhosted (only if Show HN hits front page)
|
||||
|
||||
**Title:** Numa — recursive resolver + ad blocking + LAN service discovery in one binary
|
||||
|
||||
**Body:**
|
||||
|
||||
I built a DNS resolver in Rust that I've been running as my system DNS.
|
||||
Two features I'm most proud of:
|
||||
|
||||
**Recursive resolution + DNSSEC** — set `mode = "recursive"` and it resolves
|
||||
from root nameservers, no upstream dependency. Chain-of-trust verification
|
||||
(RSA, ECDSA, Ed25519), NSEC/NSEC3 denial proofs. No single entity sees your
|
||||
full query pattern — each authoritative server only sees its zone's queries.
|
||||
|
||||
**LAN service discovery** — I register `api.numa → localhost:8000` on my
|
||||
laptop. My colleague's machine, also running Numa, picks it up via UDP
|
||||
multicast — `api.numa` resolves to my IP on his machine. Zero config.
|
||||
|
||||
The rest of what it does:
|
||||
- **Ad blocking** — ~385K+ domains (Hagezi Pro), portable. Works on any
|
||||
network including coffee shops and airports.
|
||||
- **DNS-over-HTTPS** — encrypted upstream as an alternative to recursive mode.
|
||||
- **Auto HTTPS for local services** — generates a local CA + per-service
|
||||
TLS certs. `https://frontend.numa` with a green lock, WebSocket passthrough.
|
||||
- **Hub mode** — point other devices' DNS to it, they get ad blocking +
|
||||
`.numa` resolution without installing anything.
|
||||
|
||||
Replaces Pi-hole + Unbound in one binary. No Raspberry Pi, no Docker, no PHP.
|
||||
|
||||
Single binary, macOS + Linux. Config is one optional TOML file.
|
||||
|
||||
**What it doesn't do (yet):** No web-based config editor (TOML + REST API).
|
||||
DoT listener is in progress.
|
||||
|
||||
`brew install razvandimescu/tap/numa` or `cargo install numa`
|
||||
|
||||
https://github.com/razvandimescu/numa
|
||||
|
||||
---
|
||||
|
||||
## Preparation Checklist
|
||||
|
||||
- [ ] Verify GitHub repo is PUBLIC before any post
|
||||
- [ ] Build some comment history on posting account first
|
||||
- [ ] Post HN Tuesday-Thursday, 9-10 AM Eastern
|
||||
- [ ] Respond to every comment within 2 hours for the first 6 hours
|
||||
- [ ] Have fixes ready to ship within 24h for reported issues
|
||||
- [ ] Don't oversell the pkarr/token vision — one sentence max
|
||||
|
||||
## Rules
|
||||
|
||||
- Verify GitHub repo is PUBLIC before every post
|
||||
- Use an account with comment history, not a fresh one
|
||||
- Respond to every comment within 2 hours
|
||||
- Never be defensive — acknowledge valid criticism, redirect
|
||||
- If someone says "just use X" — agree it works, explain what's *uniquely different*
|
||||
- Lead with unique capabilities, not tool replacement
|
||||
|
||||
---
|
||||
|
||||
## Prepared Responses
|
||||
|
||||
**"What does this offer over /etc/hosts?"** *(actual r/programare objection)*
|
||||
/etc/hosts is static and per-machine. Numa gives you: auto-revert after N
|
||||
minutes (great for testing), a REST API so scripts can create/remove entries,
|
||||
HTTPS reverse proxy with auto TLS, and LAN discovery so you don't have to
|
||||
edit hosts on every device. Different tools for different problems.
|
||||
|
||||
**"Mature solutions already exist (dnsmasq, nginx, etc.)"** *(actual r/programare objection)*
|
||||
Absolutely — and they're great. The thing they don't do: register a service
|
||||
on machine A and have it automatically appear on machine B via multicast.
|
||||
Numa integrates DNS + reverse proxy + TLS + discovery into one binary so
|
||||
those pieces work together. If you only need DNS forwarding, dnsmasq is the
|
||||
right tool.
|
||||
|
||||
**"Why not Pi-hole / AdGuard Home?"**
|
||||
They're network appliances — need dedicated hardware or Docker. Numa is a
|
||||
single binary on your laptop. When you move to a coffee shop, your ad
|
||||
blocking comes with you. Plus the reverse proxy + LAN discovery.
|
||||
|
||||
**"Why from scratch / no DNS libraries?"**
|
||||
Started as a learning project to understand the wire protocol. Turned out
|
||||
having full control over the pipeline makes features like conditional
|
||||
forwarding and override injection trivial — they're just steps in the
|
||||
resolution chain.
|
||||
|
||||
**"Vibe coded / AI generated?"**
|
||||
I use AI as a coding partner — same as using Stack Overflow or pair
|
||||
programming. I make the architecture decisions, direct what gets built,
|
||||
and review everything. The DNS wire protocol parser was the original
|
||||
learning project I wrote by hand. Later features were built collaboratively
|
||||
with AI assistance. You can read every line — nothing is opaque generated
|
||||
slop.
|
||||
|
||||
**"Why sudo / why port 53?"**
|
||||
Port 53 requires root on Unix. Numa only needs it for the UDP socket.
|
||||
You can also bind to a high port for testing: `bind_addr = "127.0.0.1:5353"`.
|
||||
|
||||
**"What about .numa TLD conflicts?"**
|
||||
The TLD is configurable in `numa.toml`. If `.numa` ever becomes official,
|
||||
change it to anything else.
|
||||
|
||||
**"Does it support DoH/DoT?"**
|
||||
DoH is built in — set `address = "https://9.9.9.9/dns-query"` in
|
||||
`[upstream]` and your queries are encrypted. Or set `mode = "auto"` to
|
||||
probe root servers and fall back to DoH if blocked. DoT listener support
|
||||
is in progress (PR #25).
|
||||
|
||||
**"But Quad9/Cloudflare still sees my queries"**
|
||||
In forward mode (the default), yes — your upstream resolver sees your queries.
|
||||
Set `mode = "recursive"` and Numa resolves directly from root nameservers —
|
||||
no single upstream sees your full query pattern. Each authoritative server
|
||||
only sees the query relevant to its zone. Add `[dnssec] enabled = true` to
|
||||
cryptographically verify responses.
|
||||
|
||||
**"Show me benchmarks / performance numbers"** *(actual r/programare request)*
|
||||
Benchmark suite is in `benches/` (criterion). Cached round-trip: 691ns.
|
||||
Pipeline throughput: ~2.0M qps. DNSSEC: ECDSA P-256 verify 174ns, RSA/SHA-256
|
||||
10.9µs, DS verify 257ns. Cold-cache DNSSEC validation ~90ms (1 network fetch,
|
||||
TLD chain pre-warmed). Full comparison against system resolver, Quad9,
|
||||
Cloudflare, Google on the site.
|
||||
|
||||
**"Why not just use Unbound?"**
|
||||
Numa supports recursive resolution with DNSSEC validation, same as Unbound
|
||||
(`mode = "recursive"`). The difference:
|
||||
Numa also has built-in ad blocking, a dashboard, `.numa` local domains with
|
||||
auto HTTPS, LAN service discovery, and developer overrides. Unbound does
|
||||
one thing well; Numa integrates six features into one binary.
|
||||
|
||||
**"Why not Technitium?"**
|
||||
Technitium is the closest in features — recursive, DNSSEC, ad blocking,
|
||||
dashboard. Good tool. Two differences: (1) Numa is a single static binary,
|
||||
Technitium requires the .NET runtime; (2) Numa has developer tooling that
|
||||
Technitium doesn't — `.numa` local domains with auto TLS reverse proxy,
|
||||
path-based routing, LAN service discovery, ephemeral overrides with
|
||||
auto-revert. Different audiences: Technitium targets server admins, Numa
|
||||
targets developers on laptops.
|
||||
|
||||
**"Does it support Windows?"**
|
||||
macOS and Linux are the primary targets. Windows has scaffolding in the code
|
||||
but is not tested. If there's demand, it's on the list.
|
||||
@@ -70,8 +70,10 @@ echo ""
|
||||
echo " \033[38;2;107;124;78mInstalled:\033[0m $INSTALL_DIR/numa ($TAG)"
|
||||
echo ""
|
||||
echo " Get started:"
|
||||
echo " sudo numa # start the DNS server"
|
||||
echo " sudo numa install # set as system DNS"
|
||||
echo " sudo numa service start # run as persistent service"
|
||||
echo " sudo numa install # install service + set as system DNS"
|
||||
echo " open http://localhost:5380 # dashboard"
|
||||
echo ""
|
||||
echo " Other commands:"
|
||||
echo " sudo numa # run in foreground (no service)"
|
||||
echo " sudo numa uninstall # restore original DNS"
|
||||
echo ""
|
||||
|
||||
@@ -54,7 +54,7 @@ enabled = true
|
||||
port = 80
|
||||
tls_port = 443
|
||||
tld = "numa"
|
||||
# bind_addr = "127.0.0.1" # default; auto 0.0.0.0 when [lan] enabled
|
||||
# bind_addr = "127.0.0.1" # default; set to "0.0.0.0" for LAN access to .numa services
|
||||
|
||||
# Pre-configured services (numa.numa is always added automatically)
|
||||
# [[services]]
|
||||
|
||||
306
scripts/benchmark.sh
Executable file
306
scripts/benchmark.sh
Executable file
@@ -0,0 +1,306 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
API="${NUMA_API:-http://127.0.0.1:5380}"
|
||||
DNS="${NUMA_DNS:-127.0.0.1}"
|
||||
NUMA_BIN="${NUMA_BIN:-/usr/local/bin/numa}"
|
||||
LAUNCHD_PLIST="/Library/LaunchDaemons/com.numa.dns.plist"
|
||||
|
||||
DOMAINS=(
|
||||
paypal.com ebay.com zoom.us slack.com discord.com
|
||||
microsoft.com apple.com meta.com oracle.com ibm.com
|
||||
docker.com kubernetes.io prometheus.io grafana.com terraform.io
|
||||
python.org nodejs.org golang.org wikipedia.org reddit.com
|
||||
stackoverflow.com stripe.com linear.app nytimes.com bbc.co.uk
|
||||
rust-lang.org fastly.com hetzner.com uber.com airbnb.com
|
||||
notion.so figma.com netflix.com spotify.com dropbox.com
|
||||
gitlab.com twitch.tv shopify.com vercel.app mozilla.org
|
||||
)
|
||||
|
||||
stats() {
|
||||
curl -s "$API/query-log" | python3 -c "
|
||||
import sys, json
|
||||
|
||||
data = json.load(sys.stdin)
|
||||
rec = [q for q in data if q['path'] == 'RECURSIVE']
|
||||
if not rec:
|
||||
print('No recursive queries in log.')
|
||||
sys.exit()
|
||||
|
||||
vals = sorted([q['latency_ms'] for q in rec])
|
||||
n = len(vals)
|
||||
|
||||
print(f'Recursive queries: {n}')
|
||||
print(f' Avg: {sum(vals)/n:.1f}ms')
|
||||
print(f' Median: {vals[n//2]:.1f}ms')
|
||||
print(f' P95: {vals[int(n*0.95)]:.1f}ms')
|
||||
print(f' P99: {vals[int(n*0.99)]:.1f}ms')
|
||||
print(f' Min: {min(vals):.1f}ms')
|
||||
print(f' Max: {max(vals):.1f}ms')
|
||||
print(f' <100ms: {sum(1 for v in vals if v < 100)}')
|
||||
print(f' <200ms: {sum(1 for v in vals if v < 200)}')
|
||||
print(f' <500ms: {sum(1 for v in vals if v < 500)}')
|
||||
print(f' >1s: {sum(1 for v in vals if v >= 1000)}')
|
||||
print()
|
||||
print('Slowest 5:')
|
||||
for q in sorted(rec, key=lambda q: q['latency_ms'], reverse=True)[:5]:
|
||||
print(f' {q[\"latency_ms\"]:>8.1f}ms {q[\"query_type\"]:5s} {q[\"domain\"]:35s} {q[\"rescode\"]}')
|
||||
print()
|
||||
print('Fastest 5:')
|
||||
for q in sorted(rec, key=lambda q: q['latency_ms'])[:5]:
|
||||
print(f' {q[\"latency_ms\"]:>8.1f}ms {q[\"query_type\"]:5s} {q[\"domain\"]:35s} {q[\"rescode\"]}')
|
||||
"
|
||||
}
|
||||
|
||||
query_all() {
|
||||
local label="$1"
|
||||
echo "=== $label ==="
|
||||
for d in "${DOMAINS[@]}"; do
|
||||
printf " %-25s " "$d"
|
||||
dig "@$DNS" "$d" A +noall +stats 2>/dev/null | grep "Query time"
|
||||
done
|
||||
echo
|
||||
}
|
||||
|
||||
flush_cache() {
|
||||
curl -s -X DELETE "$API/cache" > /dev/null
|
||||
echo "Cache flushed ($(curl -s "$API/stats" | python3 -c "import sys,json; print(json.load(sys.stdin)['cache']['entries'])" 2>/dev/null || echo '?') entries)."
|
||||
}
|
||||
|
||||
wait_for_api() {
|
||||
local attempts=0
|
||||
while ! curl -sf "$API/health" > /dev/null 2>&1; do
|
||||
attempts=$((attempts + 1))
|
||||
if [ $attempts -ge 20 ]; then
|
||||
echo "ERROR: API not reachable at $API after 10s" >&2
|
||||
exit 1
|
||||
fi
|
||||
sleep 0.5
|
||||
done
|
||||
}
|
||||
|
||||
wait_for_priming() {
|
||||
echo -n "Waiting for TLD priming..."
|
||||
local prev=0
|
||||
local stable=0
|
||||
for _ in $(seq 1 60); do
|
||||
local entries
|
||||
entries=$(curl -s "$API/stats" | python3 -c "import sys,json; print(json.load(sys.stdin)['cache']['entries'])" 2>/dev/null || echo 0)
|
||||
if [ "$entries" -gt 0 ] && [ "$entries" = "$prev" ]; then
|
||||
stable=$((stable + 1))
|
||||
if [ $stable -ge 3 ]; then
|
||||
echo " done ($entries cache entries)."
|
||||
return
|
||||
fi
|
||||
else
|
||||
stable=0
|
||||
fi
|
||||
prev="$entries"
|
||||
sleep 1
|
||||
done
|
||||
echo " timeout (cache: $prev entries)."
|
||||
}
|
||||
|
||||
# restart_numa <config_toml_body>
|
||||
# Writes config to a temp file, stops numa (launchd or manual), starts with that config.
|
||||
restart_numa() {
|
||||
local config_body="$1"
|
||||
local tmpconf
|
||||
tmpconf=$(mktemp /tmp/numa-bench-XXXXXX)
|
||||
mv "$tmpconf" "${tmpconf}.toml"
|
||||
tmpconf="${tmpconf}.toml"
|
||||
echo "$config_body" > "$tmpconf"
|
||||
|
||||
# Stop launchd-managed numa if active
|
||||
if sudo launchctl list com.numa.dns &>/dev/null; then
|
||||
sudo launchctl unload "$LAUNCHD_PLIST" 2>/dev/null || true
|
||||
sleep 1
|
||||
fi
|
||||
|
||||
# Kill any remaining
|
||||
sudo killall numa 2>/dev/null || true
|
||||
sleep 2
|
||||
|
||||
sudo "$NUMA_BIN" "$tmpconf" &
|
||||
wait_for_api
|
||||
wait_for_priming
|
||||
echo "numa ready (pid $(pgrep numa | head -1), config: $tmpconf)."
|
||||
}
|
||||
|
||||
# Restore the launchd service
|
||||
restore_launchd() {
|
||||
sudo killall numa 2>/dev/null || true
|
||||
sleep 1
|
||||
if [ -f "$LAUNCHD_PLIST" ]; then
|
||||
sudo launchctl load "$LAUNCHD_PLIST" 2>/dev/null || true
|
||||
echo "Restored launchd service."
|
||||
fi
|
||||
}
|
||||
|
||||
run_pass() {
|
||||
local label="$1"
|
||||
flush_cache
|
||||
sleep 0.5
|
||||
query_all "$label"
|
||||
echo "=== $label — stats ==="
|
||||
stats
|
||||
}
|
||||
|
||||
case "${1:-full}" in
|
||||
cold)
|
||||
echo "--- Cold cache benchmark ---"
|
||||
run_pass "Cold SRTT + Cold cache"
|
||||
;;
|
||||
warm)
|
||||
echo "--- Warm SRTT benchmark ---"
|
||||
echo "Priming SRTT..."
|
||||
for d in "${DOMAINS[@]}"; do dig "@$DNS" "$d" A +short > /dev/null 2>&1; done
|
||||
run_pass "Warm SRTT + Cold cache"
|
||||
;;
|
||||
stats)
|
||||
stats
|
||||
;;
|
||||
compare-srtt)
|
||||
echo "============================================"
|
||||
echo " A/B: SRTT OFF vs ON (dnssec off)"
|
||||
echo "============================================"
|
||||
echo
|
||||
|
||||
restart_numa "$(cat <<'TOML'
|
||||
[upstream]
|
||||
mode = "recursive"
|
||||
srtt = false
|
||||
TOML
|
||||
)"
|
||||
echo
|
||||
run_pass "SRTT OFF"
|
||||
|
||||
echo
|
||||
echo "--------------------------------------------"
|
||||
echo
|
||||
|
||||
restart_numa "$(cat <<'TOML'
|
||||
[upstream]
|
||||
mode = "recursive"
|
||||
srtt = true
|
||||
TOML
|
||||
)"
|
||||
echo
|
||||
run_pass "SRTT ON"
|
||||
|
||||
echo
|
||||
restore_launchd
|
||||
;;
|
||||
compare-dnssec)
|
||||
echo "============================================"
|
||||
echo " A/B: DNSSEC OFF vs ON (srtt on)"
|
||||
echo "============================================"
|
||||
echo
|
||||
|
||||
restart_numa "$(cat <<'TOML'
|
||||
[upstream]
|
||||
mode = "recursive"
|
||||
srtt = true
|
||||
|
||||
[dnssec]
|
||||
enabled = false
|
||||
TOML
|
||||
)"
|
||||
echo
|
||||
run_pass "DNSSEC OFF"
|
||||
|
||||
echo
|
||||
echo "--------------------------------------------"
|
||||
echo
|
||||
|
||||
restart_numa "$(cat <<'TOML'
|
||||
[upstream]
|
||||
mode = "recursive"
|
||||
srtt = true
|
||||
|
||||
[dnssec]
|
||||
enabled = true
|
||||
TOML
|
||||
)"
|
||||
echo
|
||||
run_pass "DNSSEC ON"
|
||||
|
||||
echo
|
||||
restore_launchd
|
||||
;;
|
||||
compare-all)
|
||||
echo "============================================"
|
||||
echo " Full A/B matrix"
|
||||
echo " 1. SRTT OFF + DNSSEC OFF (baseline)"
|
||||
echo " 2. SRTT ON + DNSSEC OFF"
|
||||
echo " 3. SRTT ON + DNSSEC ON"
|
||||
echo "============================================"
|
||||
echo
|
||||
|
||||
# --- 1. Baseline ---
|
||||
restart_numa "$(cat <<'TOML'
|
||||
[upstream]
|
||||
mode = "recursive"
|
||||
srtt = false
|
||||
|
||||
[dnssec]
|
||||
enabled = false
|
||||
TOML
|
||||
)"
|
||||
echo
|
||||
run_pass "SRTT OFF + DNSSEC OFF"
|
||||
|
||||
echo
|
||||
echo "--------------------------------------------"
|
||||
echo
|
||||
|
||||
# --- 2. SRTT only ---
|
||||
restart_numa "$(cat <<'TOML'
|
||||
[upstream]
|
||||
mode = "recursive"
|
||||
srtt = true
|
||||
|
||||
[dnssec]
|
||||
enabled = false
|
||||
TOML
|
||||
)"
|
||||
echo
|
||||
run_pass "SRTT ON + DNSSEC OFF"
|
||||
|
||||
echo
|
||||
echo "--------------------------------------------"
|
||||
echo
|
||||
|
||||
# --- 3. Both ---
|
||||
restart_numa "$(cat <<'TOML'
|
||||
[upstream]
|
||||
mode = "recursive"
|
||||
srtt = true
|
||||
|
||||
[dnssec]
|
||||
enabled = true
|
||||
TOML
|
||||
)"
|
||||
echo
|
||||
run_pass "SRTT ON + DNSSEC ON"
|
||||
|
||||
echo
|
||||
restore_launchd
|
||||
;;
|
||||
full|*)
|
||||
echo "--- Full benchmark (cold → warm → SRTT-only) ---"
|
||||
echo
|
||||
|
||||
wait_for_priming
|
||||
flush_cache
|
||||
sleep 0.5
|
||||
query_all "Pass 1: Cold SRTT + Cold cache"
|
||||
|
||||
flush_cache
|
||||
sleep 0.5
|
||||
query_all "Pass 2: Warm SRTT + Cold cache"
|
||||
|
||||
echo "=== Pass 2 stats (SRTT-warm) ==="
|
||||
stats
|
||||
;;
|
||||
esac
|
||||
43
scripts/release.sh
Executable file
43
scripts/release.sh
Executable file
@@ -0,0 +1,43 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "Usage: $0 <version> (e.g. 0.7.0)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
VERSION="$1"
|
||||
TAG="v$VERSION"
|
||||
|
||||
# Sanity checks
|
||||
if ! git diff --quiet || ! git diff --cached --quiet; then
|
||||
echo "ERROR: working tree is dirty — commit or stash first" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$(git branch --show-current)" != "main" ]; then
|
||||
echo "ERROR: must be on main branch" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if git tag -l "$TAG" | grep -q .; then
|
||||
echo "ERROR: tag $TAG already exists" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CURRENT=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
|
||||
echo "Bumping $CURRENT -> $VERSION"
|
||||
|
||||
# Bump version
|
||||
sed -i.bak "s/^version = \"$CURRENT\"/version = \"$VERSION\"/" Cargo.toml
|
||||
rm -f Cargo.toml.bak
|
||||
cargo update --workspace
|
||||
|
||||
# Commit, tag, push
|
||||
git add Cargo.toml Cargo.lock
|
||||
git commit -m "chore: bump version to $VERSION"
|
||||
git tag "$TAG"
|
||||
git push origin main --tags
|
||||
|
||||
echo
|
||||
echo "Released $TAG — GitHub Actions will build, publish to crates.io, and create the release."
|
||||
136
site/blog/dnssec-chain.svg
Normal file
136
site/blog/dnssec-chain.svg
Normal file
@@ -0,0 +1,136 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 680" font-family="'DM Sans', system-ui, sans-serif" font-size="13">
|
||||
<defs>
|
||||
<marker id="arr" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" fill="#64748b"/>
|
||||
</marker>
|
||||
<marker id="arr-amber" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" fill="#c0623a"/>
|
||||
</marker>
|
||||
<marker id="arr-teal" viewBox="0 0 10 10" refX="10" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" fill="#6b7c4e"/>
|
||||
</marker>
|
||||
<filter id="s" x="-3%" y="-3%" width="106%" height="106%">
|
||||
<feDropShadow dx="0" dy="1" stdDeviation="2" flood-opacity="0.06"/>
|
||||
</filter>
|
||||
</defs>
|
||||
|
||||
<!-- Background -->
|
||||
<rect width="720" height="680" rx="8" fill="#faf7f2"/>
|
||||
|
||||
<!-- Title -->
|
||||
<text x="360" y="36" text-anchor="middle" font-size="15" font-weight="600" fill="#2c2418" font-family="'Instrument Serif', Georgia, serif" letter-spacing="-0.02em">DNSSEC Chain of Trust</text>
|
||||
<text x="360" y="54" text-anchor="middle" font-size="11" fill="#a39888">Verifying cloudflare.com — from answer to root trust anchor</text>
|
||||
|
||||
<!-- Legend -->
|
||||
<g transform="translate(28, 72)">
|
||||
<rect width="14" height="14" rx="3" fill="#c0623a" opacity="0.15" stroke="#c0623a" stroke-width="1"/>
|
||||
<text x="20" y="12" font-size="11" fill="#6b5e4f">Verify signature (RRSIG → DNSKEY)</text>
|
||||
<rect x="230" width="14" height="14" rx="3" fill="#6b7c4e" opacity="0.15" stroke="#6b7c4e" stroke-width="1"/>
|
||||
<text x="250" y="12" font-size="11" fill="#6b5e4f">Vouch for key (DS → parent DNSKEY)</text>
|
||||
<rect x="478" width="14" height="14" rx="3" fill="#2c2418" opacity="0.08" stroke="#2c2418" stroke-opacity="0.15" stroke-width="1"/>
|
||||
<text x="498" y="12" font-size="11" fill="#6b5e4f">DNS record / key</text>
|
||||
</g>
|
||||
|
||||
<!-- ═══ ZONE: cloudflare.com ═══ -->
|
||||
<rect x="40" y="104" width="640" height="152" rx="8" fill="none" stroke="rgba(0,0,0,0.06)" stroke-dasharray="4,3"/>
|
||||
<text x="56" y="122" font-size="10" font-weight="600" fill="#a39888" letter-spacing="0.08em" font-family="'JetBrains Mono', monospace">CLOUDFLARE.COM ZONE</text>
|
||||
|
||||
<!-- A record -->
|
||||
<rect x="80" y="138" width="320" height="38" rx="6" fill="white" stroke="rgba(0,0,0,0.08)" filter="url(#s)"/>
|
||||
<text x="96" y="157" font-size="12" font-weight="600" fill="#2c2418" font-family="'JetBrains Mono', monospace">cloudflare.com A 104.16.132.229</text>
|
||||
<text x="96" y="170" font-size="10" fill="#a39888">The answer we want to verify</text>
|
||||
|
||||
<!-- RRSIG -->
|
||||
<line x1="400" y1="157" x2="440" y2="157" stroke="#c0623a" stroke-width="1.5" marker-end="url(#arr-amber)"/>
|
||||
<text x="412" y="149" font-size="9" fill="#c0623a" font-weight="600">signed by</text>
|
||||
|
||||
<rect x="445" y="138" width="220" height="38" rx="6" fill="rgba(192,98,58,0.06)" stroke="rgba(192,98,58,0.2)" filter="url(#s)"/>
|
||||
<text x="461" y="155" font-size="11" font-weight="600" fill="#9e4e2d" font-family="'JetBrains Mono', monospace">RRSIG</text>
|
||||
<text x="505" y="155" font-size="11" fill="#6b5e4f">tag=34505, algo=13</text>
|
||||
<text x="461" y="170" font-size="10" fill="#a39888">signer: cloudflare.com</text>
|
||||
|
||||
<!-- DNSKEY -->
|
||||
<rect x="80" y="192" width="320" height="50" rx="6" fill="white" stroke="rgba(0,0,0,0.08)" filter="url(#s)"/>
|
||||
<text x="96" y="211" font-size="11" font-weight="600" fill="#2c2418" font-family="'JetBrains Mono', monospace">DNSKEY</text>
|
||||
<text x="156" y="211" font-size="11" fill="#6b5e4f">cloudflare.com, tag=34505</text>
|
||||
<text x="96" y="228" font-size="11" fill="#6b7c4e" font-weight="500">ECDSA P-256</text>
|
||||
<text x="194" y="228" font-size="10" fill="#a39888">— 174ns to verify</text>
|
||||
|
||||
<!-- RRSIG → DNSKEY arrow -->
|
||||
<path d="M 555 176 L 555 192 L 400 192 L 400 200" stroke="#c0623a" stroke-width="1.5" fill="none" marker-end="url(#arr-amber)"/>
|
||||
<text x="460" y="189" font-size="9" fill="#c0623a" font-weight="600">verified with</text>
|
||||
|
||||
<!-- ═══ ZONE: .com ═══ -->
|
||||
<rect x="40" y="270" width="640" height="132" rx="8" fill="none" stroke="rgba(0,0,0,0.06)" stroke-dasharray="4,3"/>
|
||||
<text x="56" y="288" font-size="10" font-weight="600" fill="#a39888" letter-spacing="0.08em" font-family="'JetBrains Mono', monospace">.COM TLD ZONE</text>
|
||||
|
||||
<!-- DS connecting zones -->
|
||||
<line x1="240" y1="242" x2="240" y2="302" stroke="#6b7c4e" stroke-width="1.5" marker-end="url(#arr-teal)"/>
|
||||
<text x="252" y="276" font-size="9" fill="#6b7c4e" font-weight="600">vouched for by</text>
|
||||
|
||||
<!-- DS record at .com -->
|
||||
<rect x="80" y="304" width="320" height="38" rx="6" fill="rgba(107,124,78,0.06)" stroke="rgba(107,124,78,0.2)" filter="url(#s)"/>
|
||||
<text x="96" y="321" font-size="11" font-weight="600" fill="#566540" font-family="'JetBrains Mono', monospace">DS</text>
|
||||
<text x="118" y="321" font-size="11" fill="#6b5e4f">tag=2371, digest=SHA-256</text>
|
||||
<text x="96" y="336" font-size="10" fill="#a39888">hash of cloudflare.com DNSKEY</text>
|
||||
|
||||
<!-- DS signed by RRSIG -->
|
||||
<line x1="400" y1="323" x2="440" y2="323" stroke="#c0623a" stroke-width="1.5" marker-end="url(#arr-amber)"/>
|
||||
<text x="412" y="315" font-size="9" fill="#c0623a" font-weight="600">signed by</text>
|
||||
|
||||
<rect x="445" y="304" width="220" height="38" rx="6" fill="rgba(192,98,58,0.06)" stroke="rgba(192,98,58,0.2)" filter="url(#s)"/>
|
||||
<text x="461" y="321" font-size="11" font-weight="600" fill="#9e4e2d" font-family="'JetBrains Mono', monospace">RRSIG</text>
|
||||
<text x="505" y="321" font-size="11" fill="#6b5e4f">tag=19718, signer=com</text>
|
||||
|
||||
<!-- .com DNSKEY -->
|
||||
<rect x="80" y="356" width="320" height="32" rx="6" fill="white" stroke="rgba(0,0,0,0.08)" filter="url(#s)"/>
|
||||
<text x="96" y="377" font-size="11" font-weight="600" fill="#2c2418" font-family="'JetBrains Mono', monospace">DNSKEY</text>
|
||||
<text x="156" y="377" font-size="11" fill="#6b5e4f">com, tag=19718</text>
|
||||
|
||||
<!-- RRSIG → .com DNSKEY -->
|
||||
<path d="M 555 342 L 555 356 L 400 356 L 400 366" stroke="#c0623a" stroke-width="1.5" fill="none" marker-end="url(#arr-amber)"/>
|
||||
<text x="460" y="353" font-size="9" fill="#c0623a" font-weight="600">verified with</text>
|
||||
|
||||
<!-- ═══ ZONE: root ═══ -->
|
||||
<rect x="40" y="404" width="640" height="132" rx="8" fill="none" stroke="rgba(0,0,0,0.06)" stroke-dasharray="4,3"/>
|
||||
<text x="56" y="422" font-size="10" font-weight="600" fill="#a39888" letter-spacing="0.08em" font-family="'JetBrains Mono', monospace">ROOT ZONE (.)</text>
|
||||
|
||||
<!-- DS connecting .com → root -->
|
||||
<line x1="240" y1="388" x2="240" y2="436" stroke="#6b7c4e" stroke-width="1.5" marker-end="url(#arr-teal)"/>
|
||||
<text x="252" y="416" font-size="9" fill="#6b7c4e" font-weight="600">vouched for by</text>
|
||||
|
||||
<!-- DS at root -->
|
||||
<rect x="80" y="438" width="320" height="38" rx="6" fill="rgba(107,124,78,0.06)" stroke="rgba(107,124,78,0.2)" filter="url(#s)"/>
|
||||
<text x="96" y="455" font-size="11" font-weight="600" fill="#566540" font-family="'JetBrains Mono', monospace">DS</text>
|
||||
<text x="118" y="455" font-size="11" fill="#6b5e4f">tag=30909, digest=SHA-256</text>
|
||||
<text x="96" y="470" font-size="10" fill="#a39888">hash of com DNSKEY</text>
|
||||
|
||||
<!-- DS signed by root RRSIG -->
|
||||
<line x1="400" y1="457" x2="440" y2="457" stroke="#c0623a" stroke-width="1.5" marker-end="url(#arr-amber)"/>
|
||||
<text x="412" y="449" font-size="9" fill="#c0623a" font-weight="600">signed by</text>
|
||||
|
||||
<rect x="445" y="438" width="220" height="38" rx="6" fill="rgba(192,98,58,0.06)" stroke="rgba(192,98,58,0.2)" filter="url(#s)"/>
|
||||
<text x="461" y="455" font-size="11" font-weight="600" fill="#9e4e2d" font-family="'JetBrains Mono', monospace">RRSIG</text>
|
||||
<text x="505" y="455" font-size="11" fill="#6b5e4f">signer=.</text>
|
||||
|
||||
<!-- Root DNSKEY -->
|
||||
<rect x="80" y="490" width="320" height="32" rx="6" fill="white" stroke="rgba(0,0,0,0.08)" filter="url(#s)"/>
|
||||
<text x="96" y="511" font-size="11" font-weight="600" fill="#2c2418" font-family="'JetBrains Mono', monospace">DNSKEY</text>
|
||||
<text x="156" y="511" font-size="11" fill="#6b5e4f">root (.), tag=20326, RSA/SHA-256</text>
|
||||
|
||||
<!-- RRSIG → root DNSKEY -->
|
||||
<path d="M 555 476 L 555 490 L 400 490 L 400 500" stroke="#c0623a" stroke-width="1.5" fill="none" marker-end="url(#arr-amber)"/>
|
||||
<text x="460" y="487" font-size="9" fill="#c0623a" font-weight="600">verified with</text>
|
||||
|
||||
<!-- ═══ TRUST ANCHOR ═══ -->
|
||||
<line x1="240" y1="522" x2="240" y2="558" stroke="#2c2418" stroke-width="2" stroke-dasharray="4,3"/>
|
||||
|
||||
<rect x="120" y="560" width="480" height="52" rx="8" fill="#2c2418" filter="url(#s)"/>
|
||||
<text x="360" y="582" text-anchor="middle" font-size="12" font-weight="600" fill="#faf7f2" font-family="'JetBrains Mono', monospace">ROOT TRUST ANCHOR</text>
|
||||
<text x="360" y="600" text-anchor="middle" font-size="11" fill="#a39888">IANA KSK, key_tag=20326 — hardcoded in Numa as const [u8; 256]</text>
|
||||
|
||||
<!-- Flow summary -->
|
||||
<text x="360" y="646" text-anchor="middle" font-size="12" fill="#6b5e4f" font-style="italic">Trust flows up (DS records). Keys flow down (DNSKEY → RRSIG).</text>
|
||||
<text x="360" y="664" text-anchor="middle" font-size="11" fill="#a39888">If any link breaks — wrong signature, missing DS, expired RRSIG — Numa rejects the response.</text>
|
||||
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 9.2 KiB |
@@ -101,7 +101,7 @@ body {
|
||||
/* Stat cards row */
|
||||
.stats-row {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(5, 1fr);
|
||||
grid-template-columns: repeat(6, 1fr);
|
||||
gap: 1rem;
|
||||
}
|
||||
.stat-card {
|
||||
@@ -125,6 +125,8 @@ body {
|
||||
.stat-card.blocked::before { background: var(--rose); }
|
||||
.stat-card.overrides::before { background: var(--violet); }
|
||||
.stat-card.uptime::before { background: var(--cyan); }
|
||||
.stat-card.memory::before { background: var(--text-dim); }
|
||||
.stat-card.memory .stat-value { color: var(--text-secondary); }
|
||||
|
||||
.stat-label {
|
||||
font-size: 0.7rem;
|
||||
@@ -285,6 +287,7 @@ body {
|
||||
.path-tag.OVERRIDE { background: rgba(82, 122, 82, 0.12); color: var(--emerald); }
|
||||
.path-tag.SERVFAIL { background: rgba(181, 68, 58, 0.12); color: var(--rose); }
|
||||
.path-tag.BLOCKED { background: rgba(163, 152, 136, 0.15); color: var(--text-dim); }
|
||||
.path-tag.COALESCED { background: rgba(138, 104, 158, 0.12); color: var(--violet-dim); }
|
||||
|
||||
/* Sidebar panels */
|
||||
.sidebar {
|
||||
@@ -467,10 +470,74 @@ body {
|
||||
display: none;
|
||||
}
|
||||
|
||||
/* Memory sidebar panel */
|
||||
.memory-bar {
|
||||
display: flex;
|
||||
height: 18px;
|
||||
border-radius: 4px;
|
||||
overflow: hidden;
|
||||
background: var(--bg-surface);
|
||||
margin-bottom: 0.8rem;
|
||||
}
|
||||
.memory-bar-seg {
|
||||
height: 100%;
|
||||
min-width: 2px;
|
||||
transition: width 0.6s ease;
|
||||
}
|
||||
.memory-bar-seg.cache { background: var(--teal); }
|
||||
.memory-bar-seg.blocklist { background: var(--rose); }
|
||||
.memory-bar-seg.querylog { background: var(--amber); }
|
||||
.memory-bar-seg.srtt { background: var(--cyan); }
|
||||
.memory-bar-seg.overrides { background: var(--violet); }
|
||||
.memory-row {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
padding: 0.3rem 0;
|
||||
border-bottom: 1px solid var(--border);
|
||||
font-family: var(--font-mono);
|
||||
font-size: 0.72rem;
|
||||
}
|
||||
.memory-row:last-child { border-bottom: none; }
|
||||
.memory-row-dot {
|
||||
width: 8px;
|
||||
height: 8px;
|
||||
border-radius: 2px;
|
||||
flex-shrink: 0;
|
||||
margin-right: 0.5rem;
|
||||
}
|
||||
.memory-row-label {
|
||||
flex: 1;
|
||||
color: var(--text-secondary);
|
||||
}
|
||||
.memory-row-size {
|
||||
width: 65px;
|
||||
text-align: right;
|
||||
color: var(--text-primary);
|
||||
font-weight: 500;
|
||||
}
|
||||
.memory-row-entries {
|
||||
width: 90px;
|
||||
text-align: right;
|
||||
color: var(--text-dim);
|
||||
}
|
||||
.memory-rss {
|
||||
margin-top: 0.5rem;
|
||||
padding-top: 0.5rem;
|
||||
border-top: 1px solid var(--border);
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
font-family: var(--font-mono);
|
||||
font-size: 0.72rem;
|
||||
color: var(--text-dim);
|
||||
}
|
||||
|
||||
/* Responsive */
|
||||
@media (max-width: 1100px) {
|
||||
.main-grid { grid-template-columns: 1fr; }
|
||||
}
|
||||
@media (max-width: 900px) {
|
||||
.stats-row { grid-template-columns: repeat(3, 1fr); }
|
||||
}
|
||||
@media (max-width: 700px) {
|
||||
.stats-row { grid-template-columns: repeat(2, 1fr); }
|
||||
.dashboard { padding: 1rem; }
|
||||
@@ -523,6 +590,11 @@ body {
|
||||
<div class="stat-value" id="uptime">—</div>
|
||||
<div class="stat-sub" id="uptimeSub"> </div>
|
||||
</div>
|
||||
<div class="stat-card memory">
|
||||
<div class="stat-label">Memory</div>
|
||||
<div class="stat-value" id="memoryRss">—</div>
|
||||
<div class="stat-sub" id="memorySub"> </div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Resolution paths -->
|
||||
@@ -547,6 +619,8 @@ body {
|
||||
<select id="logFilterPath" onchange="applyLogFilter()"
|
||||
style="font-family:var(--font-mono);font-size:0.7rem;padding:0.25rem 0.4rem;border:1px solid var(--border);border-radius:4px;background:var(--bg-surface);color:var(--text-secondary);outline:none;">
|
||||
<option value="">all paths</option>
|
||||
<option value="RECURSIVE">recursive</option>
|
||||
<option value="COALESCED">coalesced</option>
|
||||
<option value="FORWARD">forward</option>
|
||||
<option value="CACHED">cached</option>
|
||||
<option value="BLOCKED">blocked</option>
|
||||
@@ -645,6 +719,17 @@ body {
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Memory breakdown -->
|
||||
<div class="panel" id="memoryPanel">
|
||||
<div class="panel-header">
|
||||
<span class="panel-title">Memory</span>
|
||||
<span class="panel-title" id="memoryTotal" style="color: var(--text-dim)"></span>
|
||||
</div>
|
||||
<div class="panel-body" id="memoryBody">
|
||||
<div class="empty-state">No memory data</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Cache entries -->
|
||||
<div class="panel">
|
||||
<div class="panel-header">
|
||||
@@ -709,6 +794,69 @@ function formatRemaining(secs) {
|
||||
return `${Math.floor(secs / 3600)}h ${Math.floor((secs % 3600) / 60)}m left`;
|
||||
}
|
||||
|
||||
function formatBytes(bytes) {
|
||||
if (bytes === 0) return '0 B';
|
||||
if (bytes < 1024) return bytes + ' B';
|
||||
if (bytes < 1048576) return (bytes / 1024).toFixed(1) + ' KB';
|
||||
if (bytes < 1073741824) return (bytes / 1048576).toFixed(1) + ' MB';
|
||||
return (bytes / 1073741824).toFixed(1) + ' GB';
|
||||
}
|
||||
|
||||
const MEMORY_COMPONENTS = [
|
||||
{ key: 'cache', label: 'Cache', cls: 'cache', color: 'var(--teal)' },
|
||||
{ key: 'blocklist', label: 'Blocklist', cls: 'blocklist', color: 'var(--rose)' },
|
||||
{ key: 'query_log', label: 'Query Log', cls: 'querylog', color: 'var(--amber)' },
|
||||
{ key: 'srtt', label: 'SRTT', cls: 'srtt', color: 'var(--cyan)' },
|
||||
{ key: 'overrides', label: 'Overrides', cls: 'overrides', color: 'var(--violet)' },
|
||||
];
|
||||
|
||||
function renderMemory(mem, stats) {
|
||||
if (!mem) return;
|
||||
|
||||
// Stat card
|
||||
document.getElementById('memoryRss').textContent = formatBytes(mem.process_memory_bytes);
|
||||
document.getElementById('memorySub').textContent = 'est. ' + formatBytes(mem.total_estimated_bytes);
|
||||
|
||||
const entryCounts = {
|
||||
cache: stats.cache.entries,
|
||||
blocklist: stats.blocking.domains_loaded,
|
||||
query_log: mem.query_log_entries,
|
||||
srtt: mem.srtt_entries,
|
||||
overrides: stats.overrides.active,
|
||||
};
|
||||
|
||||
// Sidebar panel
|
||||
const total = mem.total_estimated_bytes || 1;
|
||||
document.getElementById('memoryTotal').textContent = formatBytes(total);
|
||||
|
||||
const barSegments = MEMORY_COMPONENTS.map(c => {
|
||||
const bytes = mem[c.key + '_bytes'] || 0;
|
||||
const pct = ((bytes / total) * 100).toFixed(1);
|
||||
return `<div class="memory-bar-seg ${c.cls}" style="width:${pct}%" title="${c.label}: ${formatBytes(bytes)} (${pct}%)"></div>`;
|
||||
}).join('');
|
||||
|
||||
const rows = MEMORY_COMPONENTS.map(c => {
|
||||
const bytes = mem[c.key + '_bytes'] || 0;
|
||||
const entries = entryCounts[c.key] || 0;
|
||||
return `
|
||||
<div class="memory-row">
|
||||
<div class="memory-row-dot" style="background:${c.color}"></div>
|
||||
<span class="memory-row-label">${c.label}</span>
|
||||
<span class="memory-row-size">${formatBytes(bytes)}</span>
|
||||
<span class="memory-row-entries">${formatNumber(entries)} entries</span>
|
||||
</div>`;
|
||||
}).join('');
|
||||
|
||||
document.getElementById('memoryBody').innerHTML = `
|
||||
<div class="memory-bar">${barSegments}</div>
|
||||
${rows}
|
||||
<div class="memory-rss">
|
||||
<span>Process Footprint</span>
|
||||
<span>${formatBytes(mem.process_memory_bytes)}</span>
|
||||
</div>
|
||||
`;
|
||||
}
|
||||
|
||||
const PATH_DEFS = [
|
||||
{ key: 'forwarded', label: 'Forward', cls: 'forward' },
|
||||
{ key: 'recursive', label: 'Recursive', cls: 'recursive' },
|
||||
@@ -879,6 +1027,13 @@ async function refresh() {
|
||||
document.getElementById('footerUpstream').textContent = stats.upstream || '';
|
||||
document.getElementById('footerConfig').textContent = stats.config_path || '';
|
||||
document.getElementById('footerData').textContent = stats.data_dir || '';
|
||||
const modeEl = document.getElementById('footerMode');
|
||||
modeEl.textContent = stats.mode || '—';
|
||||
modeEl.style.color = stats.mode === 'recursive' ? 'var(--emerald)' : 'var(--amber)';
|
||||
document.getElementById('footerDnssec').textContent = stats.dnssec ? 'on' : 'off';
|
||||
document.getElementById('footerDnssec').style.color = stats.dnssec ? 'var(--emerald)' : 'var(--text-dim)';
|
||||
document.getElementById('footerSrtt').textContent = stats.srtt ? 'on' : 'off';
|
||||
document.getElementById('footerSrtt').style.color = stats.srtt ? 'var(--emerald)' : 'var(--text-dim)';
|
||||
|
||||
// LAN status indicator
|
||||
const lanEl = document.getElementById('lanToggle');
|
||||
@@ -938,7 +1093,7 @@ async function refresh() {
|
||||
prevTime = now;
|
||||
|
||||
// Cache hit rate
|
||||
const answered = q.cached + q.forwarded + q.local + q.overridden;
|
||||
const answered = q.cached + q.forwarded + q.recursive + q.coalesced + q.local + q.overridden;
|
||||
const hitRate = answered > 0 ? ((q.cached / answered) * 100).toFixed(1) : '0.0';
|
||||
document.getElementById('cacheRate').textContent = hitRate + '%';
|
||||
|
||||
@@ -950,6 +1105,7 @@ async function refresh() {
|
||||
renderServices(services);
|
||||
renderBlockingInfo(blockingInfo);
|
||||
renderAllowlist(allowlist);
|
||||
renderMemory(stats.memory, stats);
|
||||
|
||||
} catch (err) {
|
||||
document.getElementById('statusDot').className = 'status-dot error';
|
||||
@@ -1229,6 +1385,9 @@ setInterval(refresh, 2000);
|
||||
Config: <span id="footerConfig" style="user-select:all;color:var(--emerald);"></span>
|
||||
· Data: <span id="footerData" style="user-select:all;color:var(--emerald);"></span>
|
||||
· Upstream: <span id="footerUpstream" style="user-select:all;color:var(--emerald);"></span>
|
||||
· Mode: <span id="footerMode" style="color:var(--text-dim);">—</span>
|
||||
· DNSSEC: <span id="footerDnssec" style="color:var(--text-dim);">—</span>
|
||||
· SRTT: <span id="footerSrtt" style="color:var(--text-dim);">—</span>
|
||||
· Logs: <span style="user-select:all;color:var(--emerald);">macOS: /usr/local/var/log/numa.log · Linux: journalctl -u numa -f</span>
|
||||
· <a href="https://github.com/razvandimescu/numa" target="_blank" rel="noopener" style="color:var(--amber);text-decoration:none;">GitHub</a>
|
||||
</div>
|
||||
|
||||
@@ -4,10 +4,10 @@
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Numa — DNS you own. Everywhere you go.</title>
|
||||
<meta name="description" content="DNS you own. Recursive resolver with full DNSSEC validation, ad blocking, .numa local domains, developer overrides. A single portable binary built from scratch in Rust.">
|
||||
<meta name="description" content="DNS you own. Portable DNS resolver with caching, ad blocking, .numa local domains, developer overrides. Optional recursive resolution with full DNSSEC validation. Built from scratch in Rust.">
|
||||
<link rel="canonical" href="https://numa.rs">
|
||||
<meta property="og:title" content="Numa — DNS you own. Everywhere you go.">
|
||||
<meta property="og:description" content="Recursive DNS resolver with full DNSSEC validation, ad blocking, .numa local domains, and developer overrides. Built from scratch in Rust.">
|
||||
<meta property="og:description" content="Portable DNS resolver with caching, ad blocking, .numa local domains, and developer overrides. Optional recursive resolution with full DNSSEC validation. Built from scratch in Rust.">
|
||||
<meta property="og:type" content="website">
|
||||
<meta property="og:url" content="https://numa.rs">
|
||||
<link rel="stylesheet" href="/fonts/fonts.css">
|
||||
@@ -1232,17 +1232,17 @@ footer .closing {
|
||||
<div class="reveal">
|
||||
<div class="section-label">How It Works</div>
|
||||
<h2>What it does today</h2>
|
||||
<p class="lead">A recursive DNS resolver with DNSSEC validation, ad blocking, local service domains, and a REST API. Everything runs in a single binary.</p>
|
||||
<p class="lead">A DNS resolver with caching, ad blocking, local service domains, and a REST API. Optional recursive resolution with DNSSEC. Everything runs in a single binary.</p>
|
||||
</div>
|
||||
<div class="layers-grid">
|
||||
<div class="layer-card reveal reveal-delay-1">
|
||||
<div class="layer-badge">Layer 1</div>
|
||||
<h3>Resolve & Protect</h3>
|
||||
<ul>
|
||||
<li>Recursive resolution — resolve from root nameservers, no upstream needed</li>
|
||||
<li>DNSSEC validation — chain-of-trust + NSEC/NSEC3 denial proofs (RSA, ECDSA, Ed25519)</li>
|
||||
<li>Forward mode by default — transparent proxy to your existing DNS, with caching</li>
|
||||
<li>Ad & tracker blocking — 385K+ domains, zero config</li>
|
||||
<li>DNS-over-HTTPS — encrypted upstream as alternative to recursive mode</li>
|
||||
<li>Recursive resolution — opt-in, resolve from root nameservers, no upstream needed</li>
|
||||
<li>DNSSEC validation — chain-of-trust + NSEC/NSEC3 denial proofs (RSA, ECDSA, Ed25519)</li>
|
||||
<li>TTL-aware caching (sub-ms lookups)</li>
|
||||
<li>Single binary, portable — macOS, Linux, and Windows</li>
|
||||
</ul>
|
||||
|
||||
68
src/api.rs
68
src/api.rs
@@ -160,13 +160,17 @@ struct QueryLogResponse {
|
||||
struct StatsResponse {
|
||||
uptime_secs: u64,
|
||||
upstream: String,
|
||||
mode: &'static str, // "recursive" or "forward" — never "auto" at runtime
|
||||
config_path: String,
|
||||
data_dir: String,
|
||||
dnssec: bool,
|
||||
srtt: bool,
|
||||
queries: QueriesStats,
|
||||
cache: CacheStats,
|
||||
overrides: OverrideStats,
|
||||
blocking: BlockingStatsResponse,
|
||||
lan: LanStatsResponse,
|
||||
memory: MemoryStats,
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
@@ -180,6 +184,7 @@ struct QueriesStats {
|
||||
total: u64,
|
||||
forwarded: u64,
|
||||
recursive: u64,
|
||||
coalesced: u64,
|
||||
cached: u64,
|
||||
local: u64,
|
||||
overridden: u64,
|
||||
@@ -206,6 +211,19 @@ struct BlockingStatsResponse {
|
||||
allowlist_size: usize,
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
struct MemoryStats {
|
||||
cache_bytes: usize,
|
||||
blocklist_bytes: usize,
|
||||
query_log_bytes: usize,
|
||||
query_log_entries: usize,
|
||||
srtt_bytes: usize,
|
||||
srtt_entries: usize,
|
||||
overrides_bytes: usize,
|
||||
total_estimated_bytes: usize,
|
||||
process_memory_bytes: usize,
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
struct DiagnoseResponse {
|
||||
domain: String,
|
||||
@@ -407,14 +425,8 @@ async fn forward_query_for_diagnose(
|
||||
timeout: std::time::Duration,
|
||||
) -> (bool, String) {
|
||||
use crate::packet::DnsPacket;
|
||||
use crate::question::DnsQuestion;
|
||||
|
||||
let mut query = DnsPacket::new();
|
||||
query.header.id = 0xBEEF;
|
||||
query.header.recursion_desired = true;
|
||||
query
|
||||
.questions
|
||||
.push(DnsQuestion::new(domain.to_string(), QueryType::A));
|
||||
let query = DnsPacket::query(0xBEEF, domain, QueryType::A);
|
||||
|
||||
match forward_query(&query, upstream, timeout).await {
|
||||
Ok(resp) => (
|
||||
@@ -473,12 +485,29 @@ async fn query_log(
|
||||
|
||||
async fn stats(State(ctx): State<Arc<ServerCtx>>) -> Json<StatsResponse> {
|
||||
let snap = ctx.stats.lock().unwrap().snapshot();
|
||||
let (cache_len, cache_max) = {
|
||||
let (cache_len, cache_max, cache_bytes) = {
|
||||
let cache = ctx.cache.read().unwrap();
|
||||
(cache.len(), cache.max_entries())
|
||||
(cache.len(), cache.max_entries(), cache.heap_bytes())
|
||||
};
|
||||
let override_count = ctx.overrides.read().unwrap().active_count();
|
||||
let bl_stats = ctx.blocklist.read().unwrap().stats();
|
||||
let (override_count, overrides_bytes) = {
|
||||
let ov = ctx.overrides.read().unwrap();
|
||||
(ov.active_count(), ov.heap_bytes())
|
||||
};
|
||||
let (bl_stats, blocklist_bytes) = {
|
||||
let bl = ctx.blocklist.read().unwrap();
|
||||
(bl.stats(), bl.heap_bytes())
|
||||
};
|
||||
let (query_log_bytes, query_log_entries) = {
|
||||
let log = ctx.query_log.lock().unwrap();
|
||||
(log.heap_bytes(), log.len())
|
||||
};
|
||||
let (srtt_bytes, srtt_entries, srtt_enabled) = {
|
||||
let s = ctx.srtt.read().unwrap();
|
||||
(s.heap_bytes(), s.len(), s.is_enabled())
|
||||
};
|
||||
|
||||
let total_estimated =
|
||||
cache_bytes + blocklist_bytes + query_log_bytes + srtt_bytes + overrides_bytes;
|
||||
|
||||
let upstream = if ctx.upstream_mode == crate::config::UpstreamMode::Recursive {
|
||||
"recursive (root hints)".to_string()
|
||||
@@ -489,12 +518,16 @@ async fn stats(State(ctx): State<Arc<ServerCtx>>) -> Json<StatsResponse> {
|
||||
Json(StatsResponse {
|
||||
uptime_secs: snap.uptime_secs,
|
||||
upstream,
|
||||
mode: ctx.upstream_mode.as_str(),
|
||||
config_path: ctx.config_path.clone(),
|
||||
data_dir: ctx.data_dir.to_string_lossy().to_string(),
|
||||
dnssec: ctx.dnssec_enabled,
|
||||
srtt: srtt_enabled,
|
||||
queries: QueriesStats {
|
||||
total: snap.total,
|
||||
forwarded: snap.forwarded,
|
||||
recursive: snap.recursive,
|
||||
coalesced: snap.coalesced,
|
||||
cached: snap.cached,
|
||||
local: snap.local,
|
||||
overridden: snap.overridden,
|
||||
@@ -518,6 +551,17 @@ async fn stats(State(ctx): State<Arc<ServerCtx>>) -> Json<StatsResponse> {
|
||||
enabled: ctx.lan_enabled,
|
||||
peers: ctx.lan_peers.lock().unwrap().list().len(),
|
||||
},
|
||||
memory: MemoryStats {
|
||||
cache_bytes,
|
||||
blocklist_bytes,
|
||||
query_log_bytes,
|
||||
query_log_entries,
|
||||
srtt_bytes,
|
||||
srtt_entries,
|
||||
overrides_bytes,
|
||||
total_estimated_bytes: total_estimated,
|
||||
process_memory_bytes: crate::stats::process_memory_bytes(),
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
@@ -948,6 +992,8 @@ mod tests {
|
||||
tls_config: None,
|
||||
upstream_mode: crate::config::UpstreamMode::Forward,
|
||||
root_hints: Vec::new(),
|
||||
srtt: RwLock::new(crate::srtt::SrttCache::new(true)),
|
||||
inflight: Mutex::new(std::collections::HashMap::new()),
|
||||
dnssec_enabled: false,
|
||||
dnssec_strict: false,
|
||||
})
|
||||
|
||||
@@ -183,6 +183,15 @@ impl BlocklistStore {
|
||||
self.allowlist.iter().cloned().collect()
|
||||
}
|
||||
|
||||
pub fn heap_bytes(&self) -> usize {
|
||||
let per_slot_overhead = std::mem::size_of::<u64>() + std::mem::size_of::<String>() + 1;
|
||||
let domains_table = self.domains.capacity() * per_slot_overhead;
|
||||
let domains_heap: usize = self.domains.iter().map(|d| d.capacity()).sum();
|
||||
let allow_table = self.allowlist.capacity() * per_slot_overhead;
|
||||
let allow_heap: usize = self.allowlist.iter().map(|d| d.capacity()).sum();
|
||||
domains_table + domains_heap + allow_table + allow_heap
|
||||
}
|
||||
|
||||
pub fn stats(&self) -> BlocklistStats {
|
||||
BlocklistStats {
|
||||
enabled: self.is_enabled(),
|
||||
@@ -234,6 +243,23 @@ pub fn parse_blocklist(text: &str) -> HashSet<String> {
|
||||
domains
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn heap_bytes_grows_with_domains() {
|
||||
let mut store = BlocklistStore::new();
|
||||
let empty = store.heap_bytes();
|
||||
let domains: HashSet<String> = ["example.com", "example.org", "test.net"]
|
||||
.iter()
|
||||
.map(|s| s.to_string())
|
||||
.collect();
|
||||
store.swap_domains(domains, vec![]);
|
||||
assert!(store.heap_bytes() > empty);
|
||||
}
|
||||
}
|
||||
|
||||
pub async fn download_blocklists(lists: &[String]) -> Vec<(String, String)> {
|
||||
let client = reqwest::Client::builder()
|
||||
.timeout(std::time::Duration::from_secs(30))
|
||||
|
||||
40
src/cache.rs
40
src/cache.rs
@@ -142,6 +142,26 @@ impl DnsCache {
|
||||
self.entry_count = 0;
|
||||
}
|
||||
|
||||
pub fn heap_bytes(&self) -> usize {
|
||||
let outer_slot = std::mem::size_of::<u64>()
|
||||
+ std::mem::size_of::<String>()
|
||||
+ std::mem::size_of::<HashMap<QueryType, CacheEntry>>()
|
||||
+ 1;
|
||||
let mut total = self.entries.capacity() * outer_slot;
|
||||
for (domain, type_map) in &self.entries {
|
||||
total += domain.capacity();
|
||||
let inner_slot = std::mem::size_of::<u64>()
|
||||
+ std::mem::size_of::<QueryType>()
|
||||
+ std::mem::size_of::<CacheEntry>()
|
||||
+ 1;
|
||||
total += type_map.capacity() * inner_slot;
|
||||
for entry in type_map.values() {
|
||||
total += entry.packet.heap_bytes();
|
||||
}
|
||||
}
|
||||
total
|
||||
}
|
||||
|
||||
pub fn remove(&mut self, domain: &str) {
|
||||
let domain_lower = domain.to_lowercase();
|
||||
if let Some(type_map) = self.entries.remove(&domain_lower) {
|
||||
@@ -194,3 +214,23 @@ fn adjust_ttls(records: &mut [DnsRecord], new_ttl: u32) {
|
||||
record.set_ttl(new_ttl);
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::packet::DnsPacket;
|
||||
|
||||
#[test]
|
||||
fn heap_bytes_grows_with_entries() {
|
||||
let mut cache = DnsCache::new(100, 1, 3600);
|
||||
let empty = cache.heap_bytes();
|
||||
let mut pkt = DnsPacket::new();
|
||||
pkt.answers.push(DnsRecord::A {
|
||||
domain: "example.com".into(),
|
||||
addr: "1.2.3.4".parse().unwrap(),
|
||||
ttl: 300,
|
||||
});
|
||||
cache.insert("example.com", QueryType::A, &pkt);
|
||||
assert!(cache.heap_bytes() > empty);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -59,18 +59,31 @@ fn default_bind_addr() -> String {
|
||||
"0.0.0.0:53".to_string()
|
||||
}
|
||||
|
||||
pub const DEFAULT_API_PORT: u16 = 5380;
|
||||
|
||||
fn default_api_port() -> u16 {
|
||||
5380
|
||||
DEFAULT_API_PORT
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Default, PartialEq, Eq, Clone, Copy)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
pub enum UpstreamMode {
|
||||
Auto,
|
||||
#[default]
|
||||
Forward,
|
||||
Recursive,
|
||||
}
|
||||
|
||||
impl UpstreamMode {
|
||||
pub fn as_str(&self) -> &'static str {
|
||||
match self {
|
||||
UpstreamMode::Auto => "auto",
|
||||
UpstreamMode::Forward => "forward",
|
||||
UpstreamMode::Recursive => "recursive",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Deserialize)]
|
||||
pub struct UpstreamConfig {
|
||||
#[serde(default)]
|
||||
@@ -85,6 +98,8 @@ pub struct UpstreamConfig {
|
||||
pub root_hints: Vec<String>,
|
||||
#[serde(default = "default_prime_tlds")]
|
||||
pub prime_tlds: Vec<String>,
|
||||
#[serde(default = "default_srtt")]
|
||||
pub srtt: bool,
|
||||
}
|
||||
|
||||
impl Default for UpstreamConfig {
|
||||
@@ -96,10 +111,19 @@ impl Default for UpstreamConfig {
|
||||
timeout_ms: default_timeout_ms(),
|
||||
root_hints: default_root_hints(),
|
||||
prime_tlds: default_prime_tlds(),
|
||||
srtt: default_srtt(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn default_true() -> bool {
|
||||
true
|
||||
}
|
||||
|
||||
fn default_srtt() -> bool {
|
||||
default_true()
|
||||
}
|
||||
|
||||
fn default_prime_tlds() -> Vec<String> {
|
||||
vec![
|
||||
// gTLDs
|
||||
|
||||
593
src/ctx.rs
593
src/ctx.rs
@@ -1,3 +1,4 @@
|
||||
use std::collections::HashMap;
|
||||
use std::net::SocketAddr;
|
||||
use std::path::PathBuf;
|
||||
use std::sync::{Mutex, RwLock};
|
||||
@@ -7,6 +8,9 @@ use arc_swap::ArcSwap;
|
||||
use log::{debug, error, info, warn};
|
||||
use rustls::ServerConfig;
|
||||
use tokio::net::UdpSocket;
|
||||
use tokio::sync::broadcast;
|
||||
|
||||
type InflightMap = HashMap<(String, QueryType), broadcast::Sender<Option<DnsPacket>>>;
|
||||
|
||||
use crate::blocklist::BlocklistStore;
|
||||
use crate::buffer::BytePacketBuffer;
|
||||
@@ -21,6 +25,7 @@ use crate::query_log::{QueryLog, QueryLogEntry};
|
||||
use crate::question::QueryType;
|
||||
use crate::record::DnsRecord;
|
||||
use crate::service_store::ServiceStore;
|
||||
use crate::srtt::SrttCache;
|
||||
use crate::stats::{QueryPath, ServerStats};
|
||||
use crate::system_dns::ForwardingRule;
|
||||
|
||||
@@ -51,6 +56,8 @@ pub struct ServerCtx {
|
||||
pub tls_config: Option<ArcSwap<ServerConfig>>,
|
||||
pub upstream_mode: UpstreamMode,
|
||||
pub root_hints: Vec<SocketAddr>,
|
||||
pub srtt: RwLock<SrttCache>,
|
||||
pub inflight: Mutex<InflightMap>,
|
||||
pub dnssec_enabled: bool,
|
||||
pub dnssec_strict: bool,
|
||||
}
|
||||
@@ -86,18 +93,13 @@ pub async fn handle_query(
|
||||
} else if qname == "localhost" || qname.ends_with(".localhost") {
|
||||
// RFC 6761: .localhost always resolves to loopback
|
||||
let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
|
||||
match qtype {
|
||||
QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
|
||||
domain: qname.clone(),
|
||||
addr: std::net::Ipv6Addr::LOCALHOST,
|
||||
ttl: 300,
|
||||
}),
|
||||
_ => resp.answers.push(DnsRecord::A {
|
||||
domain: qname.clone(),
|
||||
addr: std::net::Ipv4Addr::LOCALHOST,
|
||||
ttl: 300,
|
||||
}),
|
||||
}
|
||||
resp.answers.push(sinkhole_record(
|
||||
&qname,
|
||||
qtype,
|
||||
std::net::Ipv4Addr::LOCALHOST,
|
||||
std::net::Ipv6Addr::LOCALHOST,
|
||||
300,
|
||||
));
|
||||
(resp, QueryPath::Local, DnssecStatus::Indeterminate)
|
||||
} else if is_special_use_domain(&qname) {
|
||||
// RFC 6761/8880: private PTR, DDR, NAT64 — answer locally
|
||||
@@ -106,12 +108,17 @@ pub async fn handle_query(
|
||||
} else if !ctx.proxy_tld_suffix.is_empty()
|
||||
&& (qname.ends_with(&ctx.proxy_tld_suffix) || qname == ctx.proxy_tld)
|
||||
{
|
||||
// Resolve .numa: local services → 127.0.0.1, LAN peers → peer IP
|
||||
// Resolve .numa: remote clients get LAN IP (can't reach 127.0.0.1), local get loopback
|
||||
let service_name = qname.strip_suffix(&ctx.proxy_tld_suffix).unwrap_or(&qname);
|
||||
let is_remote = !src_addr.ip().is_loopback();
|
||||
let resolve_ip = {
|
||||
let local = ctx.services.lock().unwrap();
|
||||
if local.lookup(service_name).is_some() {
|
||||
if is_remote {
|
||||
*ctx.lan_ip.lock().unwrap()
|
||||
} else {
|
||||
std::net::Ipv4Addr::LOCALHOST
|
||||
}
|
||||
} else {
|
||||
let mut peers = ctx.lan_peers.lock().unwrap();
|
||||
peers
|
||||
@@ -123,38 +130,24 @@ pub async fn handle_query(
|
||||
.unwrap_or(std::net::Ipv4Addr::LOCALHOST)
|
||||
}
|
||||
};
|
||||
let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
|
||||
match qtype {
|
||||
QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
|
||||
domain: qname.clone(),
|
||||
addr: if resolve_ip == std::net::Ipv4Addr::LOCALHOST {
|
||||
let v6 = if resolve_ip == std::net::Ipv4Addr::LOCALHOST {
|
||||
std::net::Ipv6Addr::LOCALHOST
|
||||
} else {
|
||||
resolve_ip.to_ipv6_mapped()
|
||||
},
|
||||
ttl: 300,
|
||||
}),
|
||||
_ => resp.answers.push(DnsRecord::A {
|
||||
domain: qname.clone(),
|
||||
addr: resolve_ip,
|
||||
ttl: 300,
|
||||
}),
|
||||
}
|
||||
};
|
||||
let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
|
||||
resp.answers
|
||||
.push(sinkhole_record(&qname, qtype, resolve_ip, v6, 300));
|
||||
(resp, QueryPath::Local, DnssecStatus::Indeterminate)
|
||||
} else if ctx.blocklist.read().unwrap().is_blocked(&qname) {
|
||||
let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
|
||||
match qtype {
|
||||
QueryType::AAAA => resp.answers.push(DnsRecord::AAAA {
|
||||
domain: qname.clone(),
|
||||
addr: std::net::Ipv6Addr::UNSPECIFIED,
|
||||
ttl: 60,
|
||||
}),
|
||||
_ => resp.answers.push(DnsRecord::A {
|
||||
domain: qname.clone(),
|
||||
addr: std::net::Ipv4Addr::UNSPECIFIED,
|
||||
ttl: 60,
|
||||
}),
|
||||
}
|
||||
resp.answers.push(sinkhole_record(
|
||||
&qname,
|
||||
qtype,
|
||||
std::net::Ipv4Addr::UNSPECIFIED,
|
||||
std::net::Ipv6Addr::UNSPECIFIED,
|
||||
60,
|
||||
));
|
||||
(resp, QueryPath::Blocked, DnssecStatus::Indeterminate)
|
||||
} else if let Some(records) = ctx.zone_map.get(qname.as_str()).and_then(|m| m.get(&qtype)) {
|
||||
let mut resp = DnsPacket::response_from(&query, ResultCode::NOERROR);
|
||||
@@ -170,28 +163,30 @@ pub async fn handle_query(
|
||||
}
|
||||
(resp, QueryPath::Cached, cached_dnssec)
|
||||
} else if ctx.upstream_mode == UpstreamMode::Recursive {
|
||||
match crate::recursive::resolve_recursive(
|
||||
let key = (qname.clone(), qtype);
|
||||
let (resp, path, err) = resolve_coalesced(&ctx.inflight, key, &query, || {
|
||||
crate::recursive::resolve_recursive(
|
||||
&qname,
|
||||
qtype,
|
||||
&ctx.cache,
|
||||
&query,
|
||||
&ctx.root_hints,
|
||||
&ctx.srtt,
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(resp) => (resp, QueryPath::Recursive, DnssecStatus::Indeterminate),
|
||||
Err(e) => {
|
||||
})
|
||||
.await;
|
||||
if path == QueryPath::Coalesced {
|
||||
debug!("{} | {:?} {} | COALESCED", src_addr, qtype, qname);
|
||||
} else if path == QueryPath::UpstreamError {
|
||||
error!(
|
||||
"{} | {:?} {} | RECURSIVE ERROR | {}",
|
||||
src_addr, qtype, qname, e
|
||||
src_addr,
|
||||
qtype,
|
||||
qname,
|
||||
err.as_deref().unwrap_or("leader failed")
|
||||
);
|
||||
(
|
||||
DnsPacket::response_from(&query, ResultCode::SERVFAIL),
|
||||
QueryPath::UpstreamError,
|
||||
DnssecStatus::Indeterminate,
|
||||
)
|
||||
}
|
||||
}
|
||||
(resp, path, DnssecStatus::Indeterminate)
|
||||
} else {
|
||||
let upstream =
|
||||
match crate::system_dns::match_forwarding_rule(&qname, &ctx.forwarding_rules) {
|
||||
@@ -226,7 +221,8 @@ pub async fn handle_query(
|
||||
let mut dnssec = dnssec;
|
||||
if ctx.dnssec_enabled && path == QueryPath::Recursive {
|
||||
let (status, vstats) =
|
||||
crate::dnssec::validate_response(&response, &ctx.cache, &ctx.root_hints).await;
|
||||
crate::dnssec::validate_response(&response, &ctx.cache, &ctx.root_hints, &ctx.srtt)
|
||||
.await;
|
||||
|
||||
debug!(
|
||||
"DNSSEC | {} | {:?} | {}ms | dnskey_hit={} dnskey_fetch={} ds_hit={} ds_fetch={}",
|
||||
@@ -366,7 +362,110 @@ fn is_special_use_domain(qname: &str) -> bool {
|
||||
return true;
|
||||
}
|
||||
// NAT64 (RFC 8880)
|
||||
qname == "ipv4only.arpa"
|
||||
if qname == "ipv4only.arpa" {
|
||||
return true;
|
||||
}
|
||||
// RFC 6762: .local is reserved for mDNS — never forward to upstream
|
||||
qname == "local" || qname.ends_with(".local")
|
||||
}
|
||||
|
||||
fn sinkhole_record(
|
||||
domain: &str,
|
||||
qtype: QueryType,
|
||||
v4: std::net::Ipv4Addr,
|
||||
v6: std::net::Ipv6Addr,
|
||||
ttl: u32,
|
||||
) -> DnsRecord {
|
||||
match qtype {
|
||||
QueryType::AAAA => DnsRecord::AAAA {
|
||||
domain: domain.to_string(),
|
||||
addr: v6,
|
||||
ttl,
|
||||
},
|
||||
_ => DnsRecord::A {
|
||||
domain: domain.to_string(),
|
||||
addr: v4,
|
||||
ttl,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
enum Disposition {
|
||||
Leader(broadcast::Sender<Option<DnsPacket>>),
|
||||
Follower(broadcast::Receiver<Option<DnsPacket>>),
|
||||
}
|
||||
|
||||
fn acquire_inflight(inflight: &Mutex<InflightMap>, key: (String, QueryType)) -> Disposition {
|
||||
let mut map = inflight.lock().unwrap();
|
||||
if let Some(tx) = map.get(&key) {
|
||||
Disposition::Follower(tx.subscribe())
|
||||
} else {
|
||||
let (tx, _) = broadcast::channel::<Option<DnsPacket>>(1);
|
||||
map.insert(key, tx.clone());
|
||||
Disposition::Leader(tx)
|
||||
}
|
||||
}
|
||||
|
||||
/// Run a resolve function with in-flight coalescing. Multiple concurrent calls
|
||||
/// for the same key share a single resolution — the first caller (leader)
|
||||
/// executes `resolve_fn`, and followers wait for the broadcast result.
|
||||
async fn resolve_coalesced<F, Fut>(
|
||||
inflight: &Mutex<InflightMap>,
|
||||
key: (String, QueryType),
|
||||
query: &DnsPacket,
|
||||
resolve_fn: F,
|
||||
) -> (DnsPacket, QueryPath, Option<String>)
|
||||
where
|
||||
F: FnOnce() -> Fut,
|
||||
Fut: std::future::Future<Output = crate::Result<DnsPacket>>,
|
||||
{
|
||||
let disposition = acquire_inflight(inflight, key.clone());
|
||||
|
||||
match disposition {
|
||||
Disposition::Follower(mut rx) => match rx.recv().await {
|
||||
Ok(Some(mut resp)) => {
|
||||
resp.header.id = query.header.id;
|
||||
(resp, QueryPath::Coalesced, None)
|
||||
}
|
||||
_ => (
|
||||
DnsPacket::response_from(query, ResultCode::SERVFAIL),
|
||||
QueryPath::UpstreamError,
|
||||
None,
|
||||
),
|
||||
},
|
||||
Disposition::Leader(tx) => {
|
||||
let guard = InflightGuard { inflight, key };
|
||||
let result = resolve_fn().await;
|
||||
drop(guard);
|
||||
|
||||
match result {
|
||||
Ok(resp) => {
|
||||
let _ = tx.send(Some(resp.clone()));
|
||||
(resp, QueryPath::Recursive, None)
|
||||
}
|
||||
Err(e) => {
|
||||
let _ = tx.send(None);
|
||||
let err_msg = e.to_string();
|
||||
(
|
||||
DnsPacket::response_from(query, ResultCode::SERVFAIL),
|
||||
QueryPath::UpstreamError,
|
||||
Some(err_msg),
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
struct InflightGuard<'a> {
|
||||
inflight: &'a Mutex<InflightMap>,
|
||||
key: (String, QueryType),
|
||||
}
|
||||
|
||||
impl Drop for InflightGuard<'_> {
|
||||
fn drop(&mut self) {
|
||||
self.inflight.lock().unwrap().remove(&self.key);
|
||||
}
|
||||
}
|
||||
|
||||
fn special_use_response(query: &DnsPacket, qname: &str, qtype: QueryType) -> DnsPacket {
|
||||
@@ -402,3 +501,391 @@ fn special_use_response(query: &DnsPacket, qname: &str, qtype: QueryType) -> Dns
|
||||
DnsPacket::response_from(query, ResultCode::NXDOMAIN)
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::collections::HashMap;
|
||||
use std::net::Ipv4Addr;
|
||||
use std::sync::{Arc, Mutex};
|
||||
use tokio::sync::broadcast;
|
||||
|
||||
// ---- InflightGuard unit tests ----
|
||||
|
||||
#[test]
|
||||
fn inflight_guard_removes_key_on_drop() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key = ("example.com".to_string(), QueryType::A);
|
||||
let (tx, _) = broadcast::channel::<Option<DnsPacket>>(1);
|
||||
map.lock().unwrap().insert(key.clone(), tx);
|
||||
|
||||
assert_eq!(map.lock().unwrap().len(), 1);
|
||||
{
|
||||
let _guard = InflightGuard {
|
||||
inflight: &map,
|
||||
key: key.clone(),
|
||||
};
|
||||
} // guard dropped here
|
||||
assert!(map.lock().unwrap().is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn inflight_guard_only_removes_own_key() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key_a = ("a.com".to_string(), QueryType::A);
|
||||
let key_b = ("b.com".to_string(), QueryType::A);
|
||||
let (tx_a, _) = broadcast::channel::<Option<DnsPacket>>(1);
|
||||
let (tx_b, _) = broadcast::channel::<Option<DnsPacket>>(1);
|
||||
map.lock().unwrap().insert(key_a.clone(), tx_a);
|
||||
map.lock().unwrap().insert(key_b.clone(), tx_b);
|
||||
|
||||
{
|
||||
let _guard = InflightGuard {
|
||||
inflight: &map,
|
||||
key: key_a,
|
||||
};
|
||||
}
|
||||
let m = map.lock().unwrap();
|
||||
assert_eq!(m.len(), 1);
|
||||
assert!(m.contains_key(&key_b));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn inflight_guard_same_domain_different_qtype_independent() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key_a = ("example.com".to_string(), QueryType::A);
|
||||
let key_aaaa = ("example.com".to_string(), QueryType::AAAA);
|
||||
let (tx_a, _) = broadcast::channel::<Option<DnsPacket>>(1);
|
||||
let (tx_aaaa, _) = broadcast::channel::<Option<DnsPacket>>(1);
|
||||
map.lock().unwrap().insert(key_a.clone(), tx_a);
|
||||
map.lock().unwrap().insert(key_aaaa.clone(), tx_aaaa);
|
||||
|
||||
{
|
||||
let _guard = InflightGuard {
|
||||
inflight: &map,
|
||||
key: key_a,
|
||||
};
|
||||
}
|
||||
let m = map.lock().unwrap();
|
||||
assert_eq!(m.len(), 1);
|
||||
assert!(m.contains_key(&key_aaaa));
|
||||
}
|
||||
|
||||
// ---- Coalescing disposition tests (via acquire_inflight) ----
|
||||
|
||||
#[test]
|
||||
fn first_caller_becomes_leader() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key = ("test.com".to_string(), QueryType::A);
|
||||
|
||||
let d = acquire_inflight(&map, key.clone());
|
||||
assert!(matches!(d, Disposition::Leader(_)));
|
||||
assert_eq!(map.lock().unwrap().len(), 1);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn second_caller_becomes_follower() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key = ("test.com".to_string(), QueryType::A);
|
||||
|
||||
let _leader = acquire_inflight(&map, key.clone());
|
||||
let follower = acquire_inflight(&map, key);
|
||||
assert!(matches!(follower, Disposition::Follower(_)));
|
||||
// Map still has exactly 1 entry — follower subscribes, doesn't insert
|
||||
assert_eq!(map.lock().unwrap().len(), 1);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn leader_broadcast_reaches_follower() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key = ("test.com".to_string(), QueryType::A);
|
||||
|
||||
let leader = acquire_inflight(&map, key.clone());
|
||||
let follower = acquire_inflight(&map, key);
|
||||
|
||||
let tx = match leader {
|
||||
Disposition::Leader(tx) => tx,
|
||||
_ => panic!("expected leader"),
|
||||
};
|
||||
let mut rx = match follower {
|
||||
Disposition::Follower(rx) => rx,
|
||||
_ => panic!("expected follower"),
|
||||
};
|
||||
|
||||
let mut resp = DnsPacket::new();
|
||||
resp.header.id = 42;
|
||||
resp.answers.push(DnsRecord::A {
|
||||
domain: "test.com".into(),
|
||||
addr: Ipv4Addr::new(1, 2, 3, 4),
|
||||
ttl: 300,
|
||||
});
|
||||
let _ = tx.send(Some(resp));
|
||||
|
||||
let received = rx.recv().await.unwrap().unwrap();
|
||||
assert_eq!(received.header.id, 42);
|
||||
assert_eq!(received.answers.len(), 1);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn leader_none_signals_failure_to_follower() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key = ("test.com".to_string(), QueryType::A);
|
||||
|
||||
let leader = acquire_inflight(&map, key.clone());
|
||||
let follower = acquire_inflight(&map, key);
|
||||
|
||||
let tx = match leader {
|
||||
Disposition::Leader(tx) => tx,
|
||||
_ => panic!("expected leader"),
|
||||
};
|
||||
let mut rx = match follower {
|
||||
Disposition::Follower(rx) => rx,
|
||||
_ => panic!("expected follower"),
|
||||
};
|
||||
|
||||
let _ = tx.send(None);
|
||||
assert!(rx.recv().await.unwrap().is_none());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn multiple_followers_all_receive_via_acquire() {
|
||||
let map: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let key = ("multi.com".to_string(), QueryType::A);
|
||||
|
||||
let leader = acquire_inflight(&map, key.clone());
|
||||
let f1 = acquire_inflight(&map, key.clone());
|
||||
let f2 = acquire_inflight(&map, key.clone());
|
||||
let f3 = acquire_inflight(&map, key);
|
||||
|
||||
let tx = match leader {
|
||||
Disposition::Leader(tx) => tx,
|
||||
_ => panic!("expected leader"),
|
||||
};
|
||||
|
||||
let mut resp = DnsPacket::new();
|
||||
resp.answers.push(DnsRecord::A {
|
||||
domain: "multi.com".into(),
|
||||
addr: Ipv4Addr::new(10, 0, 0, 1),
|
||||
ttl: 60,
|
||||
});
|
||||
let _ = tx.send(Some(resp));
|
||||
|
||||
for f in [f1, f2, f3] {
|
||||
let mut rx = match f {
|
||||
Disposition::Follower(rx) => rx,
|
||||
_ => panic!("expected follower"),
|
||||
};
|
||||
let r = rx.recv().await.unwrap().unwrap();
|
||||
assert_eq!(r.answers.len(), 1);
|
||||
}
|
||||
}
|
||||
|
||||
// ---- Integration: resolve_coalesced with mock futures ----
|
||||
|
||||
fn mock_response(domain: &str) -> DnsPacket {
|
||||
let mut resp = DnsPacket::new();
|
||||
resp.header.response = true;
|
||||
resp.header.rescode = ResultCode::NOERROR;
|
||||
resp.answers.push(DnsRecord::A {
|
||||
domain: domain.to_string(),
|
||||
addr: Ipv4Addr::new(10, 0, 0, 1),
|
||||
ttl: 300,
|
||||
});
|
||||
resp
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn concurrent_queries_coalesce_to_single_resolution() {
|
||||
let inflight = Arc::new(Mutex::new(HashMap::new()));
|
||||
let resolve_count = Arc::new(std::sync::atomic::AtomicU32::new(0));
|
||||
|
||||
let mut handles = Vec::new();
|
||||
for i in 0..5u16 {
|
||||
let count = resolve_count.clone();
|
||||
let inf = inflight.clone();
|
||||
let key = ("coalesce.test".to_string(), QueryType::A);
|
||||
let query = DnsPacket::query(100 + i, "coalesce.test", QueryType::A);
|
||||
handles.push(tokio::spawn(async move {
|
||||
resolve_coalesced(&inf, key, &query, || async {
|
||||
count.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
|
||||
tokio::time::sleep(Duration::from_millis(200)).await;
|
||||
Ok(mock_response("coalesce.test"))
|
||||
})
|
||||
.await
|
||||
}));
|
||||
}
|
||||
|
||||
let mut paths = Vec::new();
|
||||
for h in handles {
|
||||
let (_, path, _) = h.await.unwrap();
|
||||
paths.push(path);
|
||||
}
|
||||
|
||||
let actual = resolve_count.load(std::sync::atomic::Ordering::Relaxed);
|
||||
assert_eq!(actual, 1, "expected 1 resolution, got {}", actual);
|
||||
|
||||
let recursive = paths.iter().filter(|p| **p == QueryPath::Recursive).count();
|
||||
let coalesced = paths.iter().filter(|p| **p == QueryPath::Coalesced).count();
|
||||
assert_eq!(recursive, 1, "expected 1 RECURSIVE, got {}", recursive);
|
||||
assert_eq!(coalesced, 4, "expected 4 COALESCED, got {}", coalesced);
|
||||
|
||||
assert!(inflight.lock().unwrap().is_empty());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn different_qtypes_not_coalesced() {
|
||||
let inflight = Arc::new(Mutex::new(HashMap::new()));
|
||||
let resolve_count = Arc::new(std::sync::atomic::AtomicU32::new(0));
|
||||
|
||||
let inf1 = inflight.clone();
|
||||
let inf2 = inflight.clone();
|
||||
let count1 = resolve_count.clone();
|
||||
let count2 = resolve_count.clone();
|
||||
|
||||
let query_a = DnsPacket::query(200, "same.domain", QueryType::A);
|
||||
let query_aaaa = DnsPacket::query(201, "same.domain", QueryType::AAAA);
|
||||
|
||||
let h1 = tokio::spawn(async move {
|
||||
resolve_coalesced(
|
||||
&inf1,
|
||||
("same.domain".to_string(), QueryType::A),
|
||||
&query_a,
|
||||
|| async {
|
||||
count1.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
|
||||
tokio::time::sleep(Duration::from_millis(100)).await;
|
||||
Ok(mock_response("same.domain"))
|
||||
},
|
||||
)
|
||||
.await
|
||||
});
|
||||
let h2 = tokio::spawn(async move {
|
||||
resolve_coalesced(
|
||||
&inf2,
|
||||
("same.domain".to_string(), QueryType::AAAA),
|
||||
&query_aaaa,
|
||||
|| async {
|
||||
count2.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
|
||||
tokio::time::sleep(Duration::from_millis(100)).await;
|
||||
Ok(mock_response("same.domain"))
|
||||
},
|
||||
)
|
||||
.await
|
||||
});
|
||||
|
||||
let (_, path1, _) = h1.await.unwrap();
|
||||
let (_, path2, _) = h2.await.unwrap();
|
||||
|
||||
let actual = resolve_count.load(std::sync::atomic::Ordering::Relaxed);
|
||||
assert_eq!(actual, 2, "A and AAAA should each resolve, got {}", actual);
|
||||
assert_eq!(path1, QueryPath::Recursive);
|
||||
assert_eq!(path2, QueryPath::Recursive);
|
||||
|
||||
assert!(inflight.lock().unwrap().is_empty());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn inflight_map_cleaned_after_error() {
|
||||
let inflight: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let query = DnsPacket::query(300, "will-fail.test", QueryType::A);
|
||||
|
||||
let (_, path, _) = resolve_coalesced(
|
||||
&inflight,
|
||||
("will-fail.test".to_string(), QueryType::A),
|
||||
&query,
|
||||
|| async { Err::<DnsPacket, _>("upstream timeout".into()) },
|
||||
)
|
||||
.await;
|
||||
|
||||
assert_eq!(path, QueryPath::UpstreamError);
|
||||
assert!(inflight.lock().unwrap().is_empty());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn follower_gets_servfail_when_leader_fails() {
|
||||
let inflight = Arc::new(Mutex::new(HashMap::new()));
|
||||
|
||||
let mut handles = Vec::new();
|
||||
for i in 0..3u16 {
|
||||
let inf = inflight.clone();
|
||||
let query = DnsPacket::query(400 + i, "fail.test", QueryType::A);
|
||||
handles.push(tokio::spawn(async move {
|
||||
resolve_coalesced(
|
||||
&inf,
|
||||
("fail.test".to_string(), QueryType::A),
|
||||
&query,
|
||||
|| async {
|
||||
tokio::time::sleep(Duration::from_millis(200)).await;
|
||||
Err::<DnsPacket, _>("upstream error".into())
|
||||
},
|
||||
)
|
||||
.await
|
||||
}));
|
||||
}
|
||||
|
||||
let mut paths = Vec::new();
|
||||
for h in handles {
|
||||
let (resp, path, _) = h.await.unwrap();
|
||||
assert_eq!(resp.header.rescode, ResultCode::SERVFAIL);
|
||||
assert_eq!(
|
||||
resp.questions.len(),
|
||||
1,
|
||||
"SERVFAIL must echo question section"
|
||||
);
|
||||
assert_eq!(resp.questions[0].name, "fail.test");
|
||||
paths.push(path);
|
||||
}
|
||||
|
||||
let errors = paths
|
||||
.iter()
|
||||
.filter(|p| **p == QueryPath::UpstreamError)
|
||||
.count();
|
||||
assert_eq!(errors, 3, "all 3 should be UpstreamError, got {}", errors);
|
||||
|
||||
assert!(inflight.lock().unwrap().is_empty());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn servfail_leader_includes_question_section() {
|
||||
let inflight: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let query = DnsPacket::query(500, "question.test", QueryType::A);
|
||||
|
||||
let (resp, _, _) = resolve_coalesced(
|
||||
&inflight,
|
||||
("question.test".to_string(), QueryType::A),
|
||||
&query,
|
||||
|| async { Err::<DnsPacket, _>("fail".into()) },
|
||||
)
|
||||
.await;
|
||||
|
||||
assert_eq!(resp.header.rescode, ResultCode::SERVFAIL);
|
||||
assert_eq!(
|
||||
resp.questions.len(),
|
||||
1,
|
||||
"SERVFAIL must echo question section"
|
||||
);
|
||||
assert_eq!(resp.questions[0].name, "question.test");
|
||||
assert_eq!(resp.questions[0].qtype, QueryType::A);
|
||||
assert_eq!(resp.header.id, 500);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn leader_error_preserves_message() {
|
||||
let inflight: Mutex<InflightMap> = Mutex::new(HashMap::new());
|
||||
let query = DnsPacket::query(700, "err-msg.test", QueryType::A);
|
||||
|
||||
let (_, path, err) = resolve_coalesced(
|
||||
&inflight,
|
||||
("err-msg.test".to_string(), QueryType::A),
|
||||
&query,
|
||||
|| async { Err::<DnsPacket, _>("connection refused by upstream".into()) },
|
||||
)
|
||||
.await;
|
||||
|
||||
assert_eq!(path, QueryPath::UpstreamError);
|
||||
assert_eq!(
|
||||
err.as_deref(),
|
||||
Some("connection refused by upstream"),
|
||||
"error message must be preserved for logging"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -9,6 +9,7 @@ use crate::cache::{DnsCache, DnssecStatus};
|
||||
use crate::packet::DnsPacket;
|
||||
use crate::question::QueryType;
|
||||
use crate::record::DnsRecord;
|
||||
use crate::srtt::SrttCache;
|
||||
|
||||
#[derive(Debug, Default)]
|
||||
pub struct ValidationStats {
|
||||
@@ -64,6 +65,7 @@ pub async fn validate_response(
|
||||
response: &DnsPacket,
|
||||
cache: &RwLock<DnsCache>,
|
||||
root_hints: &[std::net::SocketAddr],
|
||||
srtt: &RwLock<SrttCache>,
|
||||
) -> (DnssecStatus, ValidationStats) {
|
||||
let start = Instant::now();
|
||||
let stats = Mutex::new(ValidationStats::default());
|
||||
@@ -95,7 +97,7 @@ pub async fn validate_response(
|
||||
}
|
||||
}
|
||||
for zone in &signer_zones {
|
||||
fetch_dnskeys(zone, cache, root_hints, &stats).await;
|
||||
fetch_dnskeys(zone, cache, root_hints, srtt, &stats).await;
|
||||
}
|
||||
|
||||
// Group answer records into RRsets (by domain + type, excluding RRSIGs)
|
||||
@@ -132,7 +134,8 @@ pub async fn validate_response(
|
||||
..
|
||||
} = rrsig
|
||||
{
|
||||
let dnskey_response = fetch_dnskeys(signer_name, cache, root_hints, &stats).await;
|
||||
let dnskey_response =
|
||||
fetch_dnskeys(signer_name, cache, root_hints, srtt, &stats).await;
|
||||
let dnskeys: Vec<&DnsRecord> = dnskey_response
|
||||
.iter()
|
||||
.filter(|r| matches!(r, DnsRecord::DNSKEY { .. }))
|
||||
@@ -206,6 +209,7 @@ pub async fn validate_response(
|
||||
&dnskey_response,
|
||||
cache,
|
||||
root_hints,
|
||||
srtt,
|
||||
trust_anchors,
|
||||
0,
|
||||
&stats,
|
||||
@@ -276,11 +280,13 @@ pub async fn validate_response(
|
||||
|
||||
/// Walk the chain of trust from zone DNSKEY up to root trust anchor.
|
||||
/// `zone_records` contains both DNSKEY and RRSIG records from the DNSKEY response.
|
||||
#[allow(clippy::too_many_arguments)]
|
||||
fn validate_chain<'a>(
|
||||
zone: &'a str,
|
||||
zone_records: &'a [DnsRecord],
|
||||
cache: &'a RwLock<DnsCache>,
|
||||
root_hints: &'a [std::net::SocketAddr],
|
||||
srtt: &'a RwLock<SrttCache>,
|
||||
trust_anchors: &'a [DnsRecord],
|
||||
depth: u8,
|
||||
stats: &'a Mutex<ValidationStats>,
|
||||
@@ -343,7 +349,7 @@ fn validate_chain<'a>(
|
||||
return DnssecStatus::Indeterminate;
|
||||
}
|
||||
let parent = parent_zone(zone);
|
||||
let ds_records = fetch_ds(zone, cache, root_hints, stats).await;
|
||||
let ds_records = fetch_ds(zone, cache, root_hints, srtt, stats).await;
|
||||
|
||||
if ds_records.is_empty() {
|
||||
debug!("dnssec: no DS for zone '{}' at parent '{}'", zone, parent);
|
||||
@@ -377,7 +383,7 @@ fn validate_chain<'a>(
|
||||
|
||||
// Walk up: validate the parent's DNSKEY
|
||||
trace!("dnssec: fetching parent DNSKEY for '{}'", parent);
|
||||
let parent_records = fetch_dnskeys(&parent, cache, root_hints, stats).await;
|
||||
let parent_records = fetch_dnskeys(&parent, cache, root_hints, srtt, stats).await;
|
||||
if parent_records.is_empty() {
|
||||
debug!("dnssec: no parent DNSKEY for '{}' — Indeterminate", parent);
|
||||
return DnssecStatus::Indeterminate;
|
||||
@@ -388,6 +394,7 @@ fn validate_chain<'a>(
|
||||
&parent_records,
|
||||
cache,
|
||||
root_hints,
|
||||
srtt,
|
||||
trust_anchors,
|
||||
depth + 1,
|
||||
stats,
|
||||
@@ -460,6 +467,7 @@ async fn fetch_dnskeys(
|
||||
zone: &str,
|
||||
cache: &RwLock<DnsCache>,
|
||||
root_hints: &[std::net::SocketAddr],
|
||||
srtt: &RwLock<SrttCache>,
|
||||
stats: &Mutex<ValidationStats>,
|
||||
) -> Vec<DnsRecord> {
|
||||
if let Some(pkt) = cache.read().unwrap().lookup(zone, QueryType::DNSKEY) {
|
||||
@@ -475,7 +483,8 @@ async fn fetch_dnskeys(
|
||||
trace!("dnssec: fetch_dnskeys('{}') cache miss — resolving", zone);
|
||||
stats.lock().unwrap().dnskey_fetches += 1;
|
||||
if let Ok(pkt) =
|
||||
crate::recursive::resolve_iterative(zone, QueryType::DNSKEY, cache, root_hints, 0, 0).await
|
||||
crate::recursive::resolve_iterative(zone, QueryType::DNSKEY, cache, root_hints, srtt, 0, 0)
|
||||
.await
|
||||
{
|
||||
cache.write().unwrap().insert(zone, QueryType::DNSKEY, &pkt);
|
||||
return pkt.answers;
|
||||
@@ -488,6 +497,7 @@ async fn fetch_ds(
|
||||
child: &str,
|
||||
cache: &RwLock<DnsCache>,
|
||||
root_hints: &[std::net::SocketAddr],
|
||||
srtt: &RwLock<SrttCache>,
|
||||
stats: &Mutex<ValidationStats>,
|
||||
) -> Vec<DnsRecord> {
|
||||
if let Some(pkt) = cache.read().unwrap().lookup(child, QueryType::DS) {
|
||||
@@ -501,7 +511,8 @@ async fn fetch_ds(
|
||||
|
||||
stats.lock().unwrap().ds_fetches += 1;
|
||||
if let Ok(pkt) =
|
||||
crate::recursive::resolve_iterative(child, QueryType::DS, cache, root_hints, 0, 0).await
|
||||
crate::recursive::resolve_iterative(child, QueryType::DS, cache, root_hints, srtt, 0, 0)
|
||||
.await
|
||||
{
|
||||
cache.write().unwrap().insert(child, QueryType::DS, &pkt);
|
||||
return pkt
|
||||
|
||||
@@ -141,7 +141,7 @@ mod tests {
|
||||
use std::future::IntoFuture;
|
||||
|
||||
use crate::header::ResultCode;
|
||||
use crate::question::{DnsQuestion, QueryType};
|
||||
use crate::question::QueryType;
|
||||
use crate::record::DnsRecord;
|
||||
|
||||
#[test]
|
||||
@@ -160,12 +160,7 @@ mod tests {
|
||||
}
|
||||
|
||||
fn make_query() -> DnsPacket {
|
||||
let mut q = DnsPacket::new();
|
||||
q.header.id = 0xABCD;
|
||||
q.header.recursion_desired = true;
|
||||
q.questions
|
||||
.push(DnsQuestion::new("example.com".to_string(), QueryType::A));
|
||||
q
|
||||
DnsPacket::query(0xABCD, "example.com", QueryType::A)
|
||||
}
|
||||
|
||||
fn make_response(query: &DnsPacket) -> DnsPacket {
|
||||
|
||||
@@ -16,6 +16,7 @@ pub mod question;
|
||||
pub mod record;
|
||||
pub mod recursive;
|
||||
pub mod service_store;
|
||||
pub mod srtt;
|
||||
pub mod stats;
|
||||
pub mod system_dns;
|
||||
pub mod tls;
|
||||
|
||||
100
src/main.rs
100
src/main.rs
@@ -17,8 +17,7 @@ use numa::query_log::QueryLog;
|
||||
use numa::service_store::ServiceStore;
|
||||
use numa::stats::ServerStats;
|
||||
use numa::system_dns::{
|
||||
discover_system_dns, install_service, install_system_dns, restart_service, service_status,
|
||||
uninstall_service, uninstall_system_dns,
|
||||
discover_system_dns, install_service, restart_service, service_status, uninstall_service,
|
||||
};
|
||||
|
||||
#[tokio::main]
|
||||
@@ -31,12 +30,12 @@ async fn main() -> numa::Result<()> {
|
||||
let arg1 = std::env::args().nth(1).unwrap_or_default();
|
||||
match arg1.as_str() {
|
||||
"install" => {
|
||||
eprintln!("\x1b[1;38;2;192;98;58mNuma\x1b[0m — configuring system DNS\n");
|
||||
return install_system_dns().map_err(|e| e.into());
|
||||
eprintln!("\x1b[1;38;2;192;98;58mNuma\x1b[0m — installing\n");
|
||||
return install_service().map_err(|e| e.into());
|
||||
}
|
||||
"uninstall" => {
|
||||
eprintln!("\x1b[1;38;2;192;98;58mNuma\x1b[0m — restoring system DNS\n");
|
||||
return uninstall_system_dns().map_err(|e| e.into());
|
||||
eprintln!("\x1b[1;38;2;192;98;58mNuma\x1b[0m — uninstalling\n");
|
||||
return uninstall_service().map_err(|e| e.into());
|
||||
}
|
||||
"service" => {
|
||||
let sub = std::env::args().nth(2).unwrap_or_default();
|
||||
@@ -107,6 +106,46 @@ async fn main() -> numa::Result<()> {
|
||||
// Discover system DNS in a single pass (upstream + forwarding rules)
|
||||
let system_dns = discover_system_dns();
|
||||
|
||||
let root_hints = numa::recursive::parse_root_hints(&config.upstream.root_hints);
|
||||
|
||||
let (resolved_mode, upstream_auto, upstream, upstream_label) = match config.upstream.mode {
|
||||
numa::config::UpstreamMode::Auto => {
|
||||
info!("auto mode: probing recursive resolution...");
|
||||
if numa::recursive::probe_recursive(&root_hints).await {
|
||||
info!("recursive probe succeeded — self-sovereign mode");
|
||||
let dummy = Upstream::Udp("0.0.0.0:0".parse().unwrap());
|
||||
(
|
||||
numa::config::UpstreamMode::Recursive,
|
||||
false,
|
||||
dummy,
|
||||
"recursive (root hints)".to_string(),
|
||||
)
|
||||
} else {
|
||||
log::warn!("recursive probe failed — falling back to Quad9 DoH");
|
||||
let client = reqwest::Client::builder()
|
||||
.use_rustls_tls()
|
||||
.build()
|
||||
.unwrap_or_default();
|
||||
let url = "https://dns.quad9.net/dns-query".to_string();
|
||||
let label = url.clone();
|
||||
(
|
||||
numa::config::UpstreamMode::Forward,
|
||||
false,
|
||||
Upstream::Doh { url, client },
|
||||
label,
|
||||
)
|
||||
}
|
||||
}
|
||||
numa::config::UpstreamMode::Recursive => {
|
||||
let dummy = Upstream::Udp("0.0.0.0:0".parse().unwrap());
|
||||
(
|
||||
numa::config::UpstreamMode::Recursive,
|
||||
false,
|
||||
dummy,
|
||||
"recursive (root hints)".to_string(),
|
||||
)
|
||||
}
|
||||
numa::config::UpstreamMode::Forward => {
|
||||
let upstream_addr = if config.upstream.address.is_empty() {
|
||||
system_dns
|
||||
.default_upstream
|
||||
@@ -129,10 +168,19 @@ async fn main() -> numa::Result<()> {
|
||||
client,
|
||||
}
|
||||
} else {
|
||||
let addr: SocketAddr = format!("{}:{}", upstream_addr, config.upstream.port).parse()?;
|
||||
let addr: SocketAddr =
|
||||
format!("{}:{}", upstream_addr, config.upstream.port).parse()?;
|
||||
Upstream::Udp(addr)
|
||||
};
|
||||
let upstream_label = upstream.to_string();
|
||||
let label = upstream.to_string();
|
||||
(
|
||||
numa::config::UpstreamMode::Forward,
|
||||
config.upstream.address.is_empty(),
|
||||
upstream,
|
||||
label,
|
||||
)
|
||||
}
|
||||
};
|
||||
let api_port = config.server.api_port;
|
||||
|
||||
let mut blocklist = BlocklistStore::new();
|
||||
@@ -183,7 +231,7 @@ async fn main() -> numa::Result<()> {
|
||||
lan_peers: Mutex::new(numa::lan::PeerStore::new(config.lan.peer_timeout_secs)),
|
||||
forwarding_rules,
|
||||
upstream: Mutex::new(upstream),
|
||||
upstream_auto: config.upstream.address.is_empty(),
|
||||
upstream_auto,
|
||||
upstream_port: config.upstream.port,
|
||||
lan_ip: Mutex::new(numa::lan::detect_lan_ip().unwrap_or(std::net::Ipv4Addr::LOCALHOST)),
|
||||
timeout: Duration::from_millis(config.upstream.timeout_ms),
|
||||
@@ -199,14 +247,15 @@ async fn main() -> numa::Result<()> {
|
||||
config_dir: numa::config_dir(),
|
||||
data_dir: numa::data_dir(),
|
||||
tls_config: initial_tls,
|
||||
upstream_mode: config.upstream.mode,
|
||||
root_hints: numa::recursive::parse_root_hints(&config.upstream.root_hints),
|
||||
upstream_mode: resolved_mode,
|
||||
root_hints,
|
||||
srtt: std::sync::RwLock::new(numa::srtt::SrttCache::new(config.upstream.srtt)),
|
||||
inflight: std::sync::Mutex::new(std::collections::HashMap::new()),
|
||||
dnssec_enabled: config.dnssec.enabled,
|
||||
dnssec_strict: config.dnssec.strict,
|
||||
});
|
||||
|
||||
let zone_count: usize = ctx.zone_map.values().map(|m| m.len()).sum();
|
||||
|
||||
// Build banner rows, then size the box to fit the longest value
|
||||
let api_url = format!("http://localhost:{}", api_port);
|
||||
let proxy_label = if config.proxy.enabled {
|
||||
@@ -306,6 +355,17 @@ async fn main() -> numa::Result<()> {
|
||||
);
|
||||
if let Some(ref label) = proxy_label {
|
||||
row("Proxy", g, label);
|
||||
if config.proxy.bind_addr == "127.0.0.1" {
|
||||
let y = "\x1b[38;2;204;176;59m"; // yellow
|
||||
row(
|
||||
"",
|
||||
y,
|
||||
&format!(
|
||||
"⚠ proxy on 127.0.0.1 — .{} not LAN reachable",
|
||||
config.proxy.tld
|
||||
),
|
||||
);
|
||||
}
|
||||
}
|
||||
if config.lan.enabled {
|
||||
row("LAN", g, "mDNS (_numa._tcp.local)");
|
||||
@@ -353,7 +413,12 @@ async fn main() -> numa::Result<()> {
|
||||
let prime_ctx = Arc::clone(&ctx);
|
||||
let prime_tlds = config.upstream.prime_tlds;
|
||||
tokio::spawn(async move {
|
||||
numa::recursive::prime_tld_cache(&prime_ctx.cache, &prime_ctx.root_hints, &prime_tlds)
|
||||
numa::recursive::prime_tld_cache(
|
||||
&prime_ctx.cache,
|
||||
&prime_ctx.root_hints,
|
||||
&prime_tlds,
|
||||
&prime_ctx.srtt,
|
||||
)
|
||||
.await;
|
||||
});
|
||||
}
|
||||
@@ -368,16 +433,11 @@ async fn main() -> numa::Result<()> {
|
||||
axum::serve(listener, app).await.unwrap();
|
||||
});
|
||||
|
||||
// Proxy binds 0.0.0.0 when LAN is enabled (cross-machine access), otherwise config value
|
||||
let proxy_bind: std::net::Ipv4Addr = if config.lan.enabled {
|
||||
std::net::Ipv4Addr::UNSPECIFIED
|
||||
} else {
|
||||
config
|
||||
let proxy_bind: std::net::Ipv4Addr = config
|
||||
.proxy
|
||||
.bind_addr
|
||||
.parse()
|
||||
.unwrap_or(std::net::Ipv4Addr::LOCALHOST)
|
||||
};
|
||||
.unwrap_or(std::net::Ipv4Addr::LOCALHOST);
|
||||
|
||||
// Spawn HTTP reverse proxy for .numa domains
|
||||
if config.proxy.enabled {
|
||||
|
||||
@@ -117,6 +117,22 @@ impl OverrideStore {
|
||||
self.entries.clear();
|
||||
}
|
||||
|
||||
pub fn heap_bytes(&self) -> usize {
|
||||
let per_slot = std::mem::size_of::<u64>()
|
||||
+ std::mem::size_of::<String>()
|
||||
+ std::mem::size_of::<OverrideEntry>()
|
||||
+ 1;
|
||||
let table = self.entries.capacity() * per_slot;
|
||||
let heap: usize = self
|
||||
.entries
|
||||
.iter()
|
||||
.map(|(k, v)| {
|
||||
k.capacity() + v.domain.capacity() + v.target.capacity() + v.record.heap_bytes()
|
||||
})
|
||||
.sum();
|
||||
table + heap
|
||||
}
|
||||
|
||||
pub fn active_count(&self) -> usize {
|
||||
self.entries.values().filter(|e| !e.is_expired()).count()
|
||||
}
|
||||
@@ -154,3 +170,16 @@ fn parse_target(domain: &str, target: &str, ttl: u32) -> Result<(QueryType, DnsR
|
||||
},
|
||||
))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn heap_bytes_grows_with_entries() {
|
||||
let mut store = OverrideStore::new();
|
||||
let empty = store.heap_bytes();
|
||||
store.insert("example.com", "1.2.3.4", 300, None).unwrap();
|
||||
assert!(store.heap_bytes() > empty);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -57,6 +57,34 @@ impl DnsPacket {
|
||||
}
|
||||
}
|
||||
|
||||
pub fn query(id: u16, domain: &str, qtype: crate::question::QueryType) -> DnsPacket {
|
||||
let mut pkt = DnsPacket::new();
|
||||
pkt.header.id = id;
|
||||
pkt.header.recursion_desired = true;
|
||||
pkt.questions
|
||||
.push(crate::question::DnsQuestion::new(domain.to_string(), qtype));
|
||||
pkt
|
||||
}
|
||||
|
||||
pub fn heap_bytes(&self) -> usize {
|
||||
fn records_heap(records: &[DnsRecord]) -> usize {
|
||||
records
|
||||
.iter()
|
||||
.map(|r| std::mem::size_of::<DnsRecord>() + r.heap_bytes())
|
||||
.sum::<usize>()
|
||||
}
|
||||
let questions: usize = self
|
||||
.questions
|
||||
.iter()
|
||||
.map(|q| std::mem::size_of::<DnsQuestion>() + q.name.capacity())
|
||||
.sum();
|
||||
questions
|
||||
+ records_heap(&self.answers)
|
||||
+ records_heap(&self.authorities)
|
||||
+ records_heap(&self.resources)
|
||||
+ self.edns.as_ref().map_or(0, |e| e.options.capacity())
|
||||
}
|
||||
|
||||
pub fn response_from(query: &DnsPacket, rescode: crate::header::ResultCode) -> DnsPacket {
|
||||
let mut resp = DnsPacket::new();
|
||||
resp.header.id = query.header.id;
|
||||
@@ -582,4 +610,16 @@ mod tests {
|
||||
panic!("expected DNSKEY");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn heap_bytes_accounts_for_records() {
|
||||
let mut pkt = DnsPacket::new();
|
||||
let empty = pkt.heap_bytes();
|
||||
pkt.answers.push(DnsRecord::A {
|
||||
domain: "example.com".into(),
|
||||
addr: "1.2.3.4".parse().unwrap(),
|
||||
ttl: 300,
|
||||
});
|
||||
assert!(pkt.heap_bytes() > empty);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -38,6 +38,21 @@ impl QueryLog {
|
||||
self.entries.push_back(entry);
|
||||
}
|
||||
|
||||
pub fn len(&self) -> usize {
|
||||
self.entries.len()
|
||||
}
|
||||
|
||||
pub fn is_empty(&self) -> bool {
|
||||
self.entries.is_empty()
|
||||
}
|
||||
|
||||
pub fn heap_bytes(&self) -> usize {
|
||||
self.entries
|
||||
.iter()
|
||||
.map(|e| std::mem::size_of::<QueryLogEntry>() + e.domain.capacity())
|
||||
.sum()
|
||||
}
|
||||
|
||||
pub fn query(&self, filter: &QueryLogFilter) -> Vec<&QueryLogEntry> {
|
||||
self.entries
|
||||
.iter()
|
||||
@@ -77,3 +92,25 @@ pub struct QueryLogFilter {
|
||||
pub since: Option<SystemTime>,
|
||||
pub limit: Option<usize>,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn heap_bytes_grows_with_entries() {
|
||||
let mut log = QueryLog::new(100);
|
||||
let empty = log.heap_bytes();
|
||||
log.push(QueryLogEntry {
|
||||
timestamp: SystemTime::now(),
|
||||
src_addr: "127.0.0.1:1234".parse().unwrap(),
|
||||
domain: "example.com".into(),
|
||||
query_type: QueryType::A,
|
||||
path: QueryPath::Forwarded,
|
||||
rescode: ResultCode::NOERROR,
|
||||
latency_us: 500,
|
||||
dnssec: DnssecStatus::Indeterminate,
|
||||
});
|
||||
assert!(log.heap_bytes() > empty);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -136,6 +136,46 @@ impl DnsRecord {
|
||||
}
|
||||
}
|
||||
|
||||
pub fn heap_bytes(&self) -> usize {
|
||||
match self {
|
||||
DnsRecord::A { domain, .. } => domain.capacity(),
|
||||
DnsRecord::NS { domain, host, .. } | DnsRecord::CNAME { domain, host, .. } => {
|
||||
domain.capacity() + host.capacity()
|
||||
}
|
||||
DnsRecord::MX { domain, host, .. } => domain.capacity() + host.capacity(),
|
||||
DnsRecord::AAAA { domain, .. } => domain.capacity(),
|
||||
DnsRecord::DNSKEY {
|
||||
domain, public_key, ..
|
||||
} => domain.capacity() + public_key.capacity(),
|
||||
DnsRecord::DS { domain, digest, .. } => domain.capacity() + digest.capacity(),
|
||||
DnsRecord::RRSIG {
|
||||
domain,
|
||||
signer_name,
|
||||
signature,
|
||||
..
|
||||
} => domain.capacity() + signer_name.capacity() + signature.capacity(),
|
||||
DnsRecord::NSEC {
|
||||
domain,
|
||||
next_domain,
|
||||
type_bitmap,
|
||||
..
|
||||
} => domain.capacity() + next_domain.capacity() + type_bitmap.capacity(),
|
||||
DnsRecord::NSEC3 {
|
||||
domain,
|
||||
salt,
|
||||
next_hashed_owner,
|
||||
type_bitmap,
|
||||
..
|
||||
} => {
|
||||
domain.capacity()
|
||||
+ salt.capacity()
|
||||
+ next_hashed_owner.capacity()
|
||||
+ type_bitmap.capacity()
|
||||
}
|
||||
DnsRecord::UNKNOWN { domain, data, .. } => domain.capacity() + data.capacity(),
|
||||
}
|
||||
}
|
||||
|
||||
pub fn set_ttl(&mut self, new_ttl: u32) {
|
||||
match self {
|
||||
DnsRecord::A { ttl, .. }
|
||||
@@ -650,4 +690,14 @@ mod tests {
|
||||
let parsed = round_trip(&rec);
|
||||
assert_eq!(rec, parsed);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn heap_bytes_reflects_string_capacity() {
|
||||
let rec = DnsRecord::CNAME {
|
||||
domain: "a]".repeat(100),
|
||||
host: "b".repeat(200),
|
||||
ttl: 60,
|
||||
};
|
||||
assert!(rec.heap_bytes() >= 300);
|
||||
}
|
||||
}
|
||||
|
||||
196
src/recursive.rs
196
src/recursive.rs
@@ -1,7 +1,7 @@
|
||||
use std::net::{IpAddr, SocketAddr};
|
||||
use std::sync::atomic::{AtomicU16, Ordering};
|
||||
use std::sync::RwLock;
|
||||
use std::time::Duration;
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
use log::{debug, info};
|
||||
|
||||
@@ -9,8 +9,9 @@ use crate::cache::DnsCache;
|
||||
use crate::forward::forward_udp;
|
||||
use crate::header::ResultCode;
|
||||
use crate::packet::DnsPacket;
|
||||
use crate::question::{DnsQuestion, QueryType};
|
||||
use crate::question::QueryType;
|
||||
use crate::record::DnsRecord;
|
||||
use crate::srtt::SrttCache;
|
||||
|
||||
const MAX_REFERRAL_DEPTH: u8 = 10;
|
||||
const MAX_CNAME_DEPTH: u8 = 8;
|
||||
@@ -20,7 +21,8 @@ const UDP_FAIL_THRESHOLD: u8 = 3;
|
||||
|
||||
static QUERY_ID: AtomicU16 = AtomicU16::new(1);
|
||||
static UDP_FAILURES: std::sync::atomic::AtomicU8 = std::sync::atomic::AtomicU8::new(0);
|
||||
static UDP_DISABLED: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
|
||||
pub(crate) static UDP_DISABLED: std::sync::atomic::AtomicBool =
|
||||
std::sync::atomic::AtomicBool::new(false);
|
||||
|
||||
fn next_id() -> u16 {
|
||||
QUERY_ID.fetch_add(1, Ordering::Relaxed)
|
||||
@@ -30,6 +32,14 @@ fn dns_addr(ip: impl Into<IpAddr>) -> SocketAddr {
|
||||
SocketAddr::new(ip.into(), 53)
|
||||
}
|
||||
|
||||
fn record_to_addr(rec: &DnsRecord) -> Option<SocketAddr> {
|
||||
match rec {
|
||||
DnsRecord::A { addr, .. } => Some(dns_addr(*addr)),
|
||||
DnsRecord::AAAA { addr, .. } => Some(dns_addr(*addr)),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn reset_udp_state() {
|
||||
UDP_DISABLED.store(false, Ordering::Release);
|
||||
UDP_FAILURES.store(0, Ordering::Release);
|
||||
@@ -44,11 +54,8 @@ pub async fn probe_udp(root_hints: &[SocketAddr]) {
|
||||
Some(h) => *h,
|
||||
None => return,
|
||||
};
|
||||
let mut probe = DnsPacket::new();
|
||||
probe.header.id = next_id();
|
||||
probe
|
||||
.questions
|
||||
.push(DnsQuestion::new(".".to_string(), QueryType::NS));
|
||||
let mut probe = DnsPacket::query(next_id(), ".", QueryType::NS);
|
||||
probe.header.recursion_desired = false;
|
||||
if forward_udp(&probe, hint, Duration::from_millis(1500))
|
||||
.await
|
||||
.is_ok()
|
||||
@@ -58,7 +65,27 @@ pub async fn probe_udp(root_hints: &[SocketAddr]) {
|
||||
}
|
||||
}
|
||||
|
||||
pub async fn prime_tld_cache(cache: &RwLock<DnsCache>, root_hints: &[SocketAddr], tlds: &[String]) {
|
||||
/// Probe whether recursive resolution works by querying root servers.
|
||||
/// Tries up to 3 hints before declaring failure.
|
||||
pub async fn probe_recursive(root_hints: &[SocketAddr]) -> bool {
|
||||
let mut probe = DnsPacket::query(next_id(), ".", QueryType::NS);
|
||||
probe.header.recursion_desired = false;
|
||||
for hint in root_hints.iter().take(3) {
|
||||
if let Ok(resp) = forward_udp(&probe, *hint, Duration::from_secs(3)).await {
|
||||
if !resp.answers.is_empty() || !resp.authorities.is_empty() {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
pub async fn prime_tld_cache(
|
||||
cache: &RwLock<DnsCache>,
|
||||
root_hints: &[SocketAddr],
|
||||
tlds: &[String],
|
||||
srtt: &RwLock<SrttCache>,
|
||||
) {
|
||||
if root_hints.is_empty() || tlds.is_empty() {
|
||||
return;
|
||||
}
|
||||
@@ -66,7 +93,7 @@ pub async fn prime_tld_cache(cache: &RwLock<DnsCache>, root_hints: &[SocketAddr]
|
||||
let mut root_addr = root_hints[0];
|
||||
for hint in root_hints {
|
||||
info!("prime: probing root {}", hint);
|
||||
match send_query(".", QueryType::NS, *hint).await {
|
||||
match send_query(".", QueryType::NS, *hint, srtt).await {
|
||||
Ok(_) => {
|
||||
info!("prime: root {} reachable", hint);
|
||||
root_addr = *hint;
|
||||
@@ -79,7 +106,7 @@ pub async fn prime_tld_cache(cache: &RwLock<DnsCache>, root_hints: &[SocketAddr]
|
||||
}
|
||||
|
||||
// Fetch root DNSKEY (needed for DNSSEC chain-of-trust terminus)
|
||||
if let Ok(root_dnskey) = send_query(".", QueryType::DNSKEY, root_addr).await {
|
||||
if let Ok(root_dnskey) = send_query(".", QueryType::DNSKEY, root_addr, srtt).await {
|
||||
cache
|
||||
.write()
|
||||
.unwrap()
|
||||
@@ -91,7 +118,7 @@ pub async fn prime_tld_cache(cache: &RwLock<DnsCache>, root_hints: &[SocketAddr]
|
||||
|
||||
for tld in tlds {
|
||||
// Fetch NS referral (includes DS in authority section from root)
|
||||
let response = match send_query(tld, QueryType::NS, root_addr).await {
|
||||
let response = match send_query(tld, QueryType::NS, root_addr, srtt).await {
|
||||
Ok(r) => r,
|
||||
Err(e) => {
|
||||
debug!("prime: failed to query NS for .{}: {}", tld, e);
|
||||
@@ -108,7 +135,6 @@ pub async fn prime_tld_cache(cache: &RwLock<DnsCache>, root_hints: &[SocketAddr]
|
||||
let mut cache_w = cache.write().unwrap();
|
||||
cache_w.insert(tld, QueryType::NS, &response);
|
||||
cache_glue(&mut cache_w, &response, &ns_names);
|
||||
// Cache DS records from referral authority section
|
||||
cache_ds_from_authority(&mut cache_w, &response);
|
||||
}
|
||||
|
||||
@@ -116,7 +142,7 @@ pub async fn prime_tld_cache(cache: &RwLock<DnsCache>, root_hints: &[SocketAddr]
|
||||
let first_ns_name = ns_names.first().map(|s| s.as_str()).unwrap_or("");
|
||||
let first_ns = glue_addrs_for(&response, first_ns_name);
|
||||
if let Some(ns_addr) = first_ns.first() {
|
||||
if let Ok(dnskey_resp) = send_query(tld, QueryType::DNSKEY, *ns_addr).await {
|
||||
if let Ok(dnskey_resp) = send_query(tld, QueryType::DNSKEY, *ns_addr, srtt).await {
|
||||
cache
|
||||
.write()
|
||||
.unwrap()
|
||||
@@ -140,10 +166,11 @@ pub async fn resolve_recursive(
|
||||
cache: &RwLock<DnsCache>,
|
||||
original_query: &DnsPacket,
|
||||
root_hints: &[SocketAddr],
|
||||
srtt: &RwLock<SrttCache>,
|
||||
) -> crate::Result<DnsPacket> {
|
||||
// No overall timeout — each hop is bounded by NS_QUERY_TIMEOUT (UDP + TCP fallback),
|
||||
// and MAX_REFERRAL_DEPTH caps the chain length.
|
||||
let mut resp = resolve_iterative(qname, qtype, cache, root_hints, 0, 0).await?;
|
||||
let mut resp = resolve_iterative(qname, qtype, cache, root_hints, srtt, 0, 0).await?;
|
||||
|
||||
resp.header.id = original_query.header.id;
|
||||
resp.header.recursion_available = true;
|
||||
@@ -157,6 +184,7 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
qtype: QueryType,
|
||||
cache: &'a RwLock<DnsCache>,
|
||||
root_hints: &'a [SocketAddr],
|
||||
srtt: &'a RwLock<SrttCache>,
|
||||
referral_depth: u8,
|
||||
cname_depth: u8,
|
||||
) -> std::pin::Pin<Box<dyn std::future::Future<Output = crate::Result<DnsPacket>> + Send + 'a>> {
|
||||
@@ -170,6 +198,7 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
}
|
||||
|
||||
let (mut current_zone, mut ns_addrs) = find_closest_ns(qname, cache, root_hints);
|
||||
srtt.read().unwrap().sort_by_rtt(&mut ns_addrs);
|
||||
let mut ns_idx = 0;
|
||||
|
||||
for _ in 0..MAX_REFERRAL_DEPTH {
|
||||
@@ -185,7 +214,7 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
ns_addr, q_type, q_name, current_zone, referral_depth
|
||||
);
|
||||
|
||||
let response = match send_query(q_name, q_type, ns_addr).await {
|
||||
let response = match send_query(q_name, q_type, ns_addr, srtt).await {
|
||||
Ok(r) => r,
|
||||
Err(e) => {
|
||||
debug!("recursive: NS {} failed: {}", ns_addr, e);
|
||||
@@ -194,7 +223,6 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
}
|
||||
};
|
||||
|
||||
// Minimized query response — treat as referral, not final answer
|
||||
if (q_type != qtype || !q_name.eq_ignore_ascii_case(qname))
|
||||
&& (!response.authorities.is_empty() || !response.answers.is_empty())
|
||||
{
|
||||
@@ -205,8 +233,9 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
if all_ns.is_empty() {
|
||||
all_ns = extract_ns_names(&response);
|
||||
}
|
||||
let new_addrs = resolve_ns_addrs_from_glue(&response, &all_ns, cache);
|
||||
let mut new_addrs = resolve_ns_addrs_from_glue(&response, &all_ns, cache);
|
||||
if !new_addrs.is_empty() {
|
||||
srtt.read().unwrap().sort_by_rtt(&mut new_addrs);
|
||||
ns_addrs = new_addrs;
|
||||
ns_idx = 0;
|
||||
continue;
|
||||
@@ -233,6 +262,7 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
qtype,
|
||||
cache,
|
||||
root_hints,
|
||||
srtt,
|
||||
0,
|
||||
cname_depth + 1,
|
||||
)
|
||||
@@ -256,8 +286,6 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
return Ok(response);
|
||||
}
|
||||
|
||||
// Referral — extract NS + glue, cache glue, resolve NS addresses
|
||||
// Update zone for query minimization
|
||||
if let Some(zone) = referral_zone(&response) {
|
||||
current_zone = zone;
|
||||
}
|
||||
@@ -276,29 +304,20 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
for ns_name in &ns_names {
|
||||
if referral_depth < MAX_REFERRAL_DEPTH {
|
||||
debug!("recursive: resolving glue-less NS {}", ns_name);
|
||||
// Try A first, then AAAA
|
||||
for qt in [QueryType::A, QueryType::AAAA] {
|
||||
if let Ok(ns_resp) = resolve_iterative(
|
||||
ns_name,
|
||||
qt,
|
||||
cache,
|
||||
root_hints,
|
||||
srtt,
|
||||
referral_depth + 1,
|
||||
cname_depth,
|
||||
)
|
||||
.await
|
||||
{
|
||||
for rec in &ns_resp.answers {
|
||||
match rec {
|
||||
DnsRecord::A { addr, .. } => {
|
||||
new_ns_addrs.push(dns_addr(*addr));
|
||||
}
|
||||
DnsRecord::AAAA { addr, .. } => {
|
||||
new_ns_addrs.push(dns_addr(*addr));
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
new_ns_addrs
|
||||
.extend(ns_resp.answers.iter().filter_map(record_to_addr));
|
||||
}
|
||||
if !new_ns_addrs.is_empty() {
|
||||
break;
|
||||
@@ -316,6 +335,7 @@ pub(crate) fn resolve_iterative<'a>(
|
||||
return Err(format!("could not resolve any NS for {}", qname).into());
|
||||
}
|
||||
|
||||
srtt.read().unwrap().sort_by_rtt(&mut new_ns_addrs);
|
||||
ns_addrs = new_ns_addrs;
|
||||
ns_idx = 0;
|
||||
}
|
||||
@@ -351,13 +371,7 @@ fn find_closest_ns(
|
||||
if let DnsRecord::NS { host, .. } = ns_rec {
|
||||
for qt in [QueryType::A, QueryType::AAAA] {
|
||||
if let Some(resp) = guard.lookup(host, qt) {
|
||||
for rec in &resp.answers {
|
||||
match rec {
|
||||
DnsRecord::A { addr, .. } => addrs.push(dns_addr(*addr)),
|
||||
DnsRecord::AAAA { addr, .. } => addrs.push(dns_addr(*addr)),
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
addrs.extend(resp.answers.iter().filter_map(record_to_addr));
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -443,13 +457,7 @@ fn addrs_from_cache(cache: &RwLock<DnsCache>, name: &str) -> Vec<SocketAddr> {
|
||||
let mut addrs = Vec::new();
|
||||
for qt in [QueryType::A, QueryType::AAAA] {
|
||||
if let Some(pkt) = guard.lookup(name, qt) {
|
||||
for rec in &pkt.answers {
|
||||
match rec {
|
||||
DnsRecord::A { addr, .. } => addrs.push(dns_addr(*addr)),
|
||||
DnsRecord::AAAA { addr, .. } => addrs.push(dns_addr(*addr)),
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
addrs.extend(pkt.answers.iter().filter_map(record_to_addr));
|
||||
}
|
||||
}
|
||||
addrs
|
||||
@@ -459,15 +467,13 @@ fn glue_addrs_for(response: &DnsPacket, ns_name: &str) -> Vec<SocketAddr> {
|
||||
response
|
||||
.resources
|
||||
.iter()
|
||||
.filter_map(|r| match r {
|
||||
DnsRecord::A { domain, addr, .. } if domain.eq_ignore_ascii_case(ns_name) => {
|
||||
Some(dns_addr(*addr))
|
||||
.filter(|r| match r {
|
||||
DnsRecord::A { domain, .. } | DnsRecord::AAAA { domain, .. } => {
|
||||
domain.eq_ignore_ascii_case(ns_name)
|
||||
}
|
||||
DnsRecord::AAAA { domain, addr, .. } if domain.eq_ignore_ascii_case(ns_name) => {
|
||||
Some(dns_addr(*addr))
|
||||
}
|
||||
_ => None,
|
||||
_ => false,
|
||||
})
|
||||
.filter_map(record_to_addr)
|
||||
.collect()
|
||||
}
|
||||
|
||||
@@ -561,36 +567,63 @@ fn make_glue_packet() -> DnsPacket {
|
||||
pkt
|
||||
}
|
||||
|
||||
async fn send_query(qname: &str, qtype: QueryType, server: SocketAddr) -> crate::Result<DnsPacket> {
|
||||
let mut query = DnsPacket::new();
|
||||
query.header.id = next_id();
|
||||
async fn tcp_with_srtt(
|
||||
query: &DnsPacket,
|
||||
server: SocketAddr,
|
||||
srtt: &RwLock<SrttCache>,
|
||||
start: Instant,
|
||||
) -> crate::Result<DnsPacket> {
|
||||
match crate::forward::forward_tcp(query, server, TCP_TIMEOUT).await {
|
||||
Ok(resp) => {
|
||||
srtt.write()
|
||||
.unwrap()
|
||||
.record_rtt(server.ip(), start.elapsed().as_millis() as u64, true);
|
||||
Ok(resp)
|
||||
}
|
||||
Err(e) => {
|
||||
srtt.write().unwrap().record_failure(server.ip());
|
||||
Err(e)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async fn send_query(
|
||||
qname: &str,
|
||||
qtype: QueryType,
|
||||
server: SocketAddr,
|
||||
srtt: &RwLock<SrttCache>,
|
||||
) -> crate::Result<DnsPacket> {
|
||||
let mut query = DnsPacket::query(next_id(), qname, qtype);
|
||||
query.header.recursion_desired = false;
|
||||
query
|
||||
.questions
|
||||
.push(DnsQuestion::new(qname.to_string(), qtype));
|
||||
query.edns = Some(crate::packet::EdnsOpt {
|
||||
do_bit: true,
|
||||
..Default::default()
|
||||
});
|
||||
|
||||
// Skip IPv6 if the socket can't handle it (bound to 0.0.0.0)
|
||||
let start = Instant::now();
|
||||
|
||||
// IPv6 forced to TCP — our UDP socket is bound to 0.0.0.0
|
||||
if server.is_ipv6() {
|
||||
return crate::forward::forward_tcp(&query, server, TCP_TIMEOUT).await;
|
||||
return tcp_with_srtt(&query, server, srtt, start).await;
|
||||
}
|
||||
|
||||
// If UDP has been detected as blocked, go TCP-first
|
||||
// UDP detected as blocked — go TCP-first
|
||||
if UDP_DISABLED.load(Ordering::Acquire) {
|
||||
return crate::forward::forward_tcp(&query, server, TCP_TIMEOUT).await;
|
||||
return tcp_with_srtt(&query, server, srtt, start).await;
|
||||
}
|
||||
|
||||
match forward_udp(&query, server, NS_QUERY_TIMEOUT).await {
|
||||
Ok(resp) if resp.header.truncated_message => {
|
||||
debug!("send_query: truncated from {}, retrying TCP", server);
|
||||
crate::forward::forward_tcp(&query, server, TCP_TIMEOUT).await
|
||||
tcp_with_srtt(&query, server, srtt, start).await
|
||||
}
|
||||
Ok(resp) => {
|
||||
// UDP works — reset failure counter
|
||||
UDP_FAILURES.store(0, Ordering::Release);
|
||||
srtt.write().unwrap().record_rtt(
|
||||
server.ip(),
|
||||
start.elapsed().as_millis() as u64,
|
||||
false,
|
||||
);
|
||||
Ok(resp)
|
||||
}
|
||||
Err(e) => {
|
||||
@@ -603,7 +636,7 @@ async fn send_query(qname: &str, qtype: QueryType, server: SocketAddr) -> crate:
|
||||
);
|
||||
}
|
||||
debug!("send_query: UDP failed for {}: {}, trying TCP", server, e);
|
||||
crate::forward::forward_tcp(&query, server, TCP_TIMEOUT).await
|
||||
tcp_with_srtt(&query, server, srtt, start).await
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -894,7 +927,8 @@ mod tests {
|
||||
})
|
||||
.await;
|
||||
|
||||
let result = send_query("test.example.com", QueryType::A, server_addr).await;
|
||||
let srtt = RwLock::new(SrttCache::new(true));
|
||||
let result = send_query("test.example.com", QueryType::A, server_addr, &srtt).await;
|
||||
|
||||
let resp = result.expect("should resolve via TCP fallback");
|
||||
assert_eq!(resp.header.rescode, ResultCode::NOERROR);
|
||||
@@ -945,7 +979,8 @@ mod tests {
|
||||
})
|
||||
.await;
|
||||
|
||||
let result = send_query("hello.example.com", QueryType::A, server_addr).await;
|
||||
let srtt = RwLock::new(SrttCache::new(true));
|
||||
let result = send_query("hello.example.com", QueryType::A, server_addr, &srtt).await;
|
||||
let resp = result.expect("TCP-only send_query should work");
|
||||
assert_eq!(resp.header.rescode, ResultCode::NOERROR);
|
||||
match &resp.answers[0] {
|
||||
@@ -967,10 +1002,19 @@ mod tests {
|
||||
.await;
|
||||
|
||||
let cache = RwLock::new(DnsCache::new(100, 60, 86400));
|
||||
let srtt = RwLock::new(SrttCache::new(true));
|
||||
let root_hints = vec![server_addr];
|
||||
|
||||
let result =
|
||||
resolve_iterative("nonexistent.test", QueryType::A, &cache, &root_hints, 0, 0).await;
|
||||
let result = resolve_iterative(
|
||||
"nonexistent.test",
|
||||
QueryType::A,
|
||||
&cache,
|
||||
&root_hints,
|
||||
&srtt,
|
||||
0,
|
||||
0,
|
||||
)
|
||||
.await;
|
||||
|
||||
let resp = result.expect("NXDOMAIN should still return a response");
|
||||
assert_eq!(resp.header.rescode, ResultCode::NXDOMAIN);
|
||||
@@ -1005,11 +1049,7 @@ mod tests {
|
||||
})
|
||||
.await;
|
||||
|
||||
let mut query = DnsPacket::new();
|
||||
query.header.id = 0xBEEF;
|
||||
query
|
||||
.questions
|
||||
.push(DnsQuestion::new("test.com".to_string(), QueryType::A));
|
||||
let query = DnsPacket::query(0xBEEF, "test.com", QueryType::A);
|
||||
|
||||
let resp = crate::forward::forward_tcp(&query, server_addr, Duration::from_secs(2))
|
||||
.await
|
||||
@@ -1069,11 +1109,7 @@ mod tests {
|
||||
.unwrap();
|
||||
});
|
||||
|
||||
let mut query = DnsPacket::new();
|
||||
query.header.id = 0xCAFE;
|
||||
query
|
||||
.questions
|
||||
.push(DnsQuestion::new("strict.test".to_string(), QueryType::A));
|
||||
let query = DnsPacket::query(0xCAFE, "strict.test", QueryType::A);
|
||||
|
||||
let resp = crate::forward::forward_tcp(&query, addr, Duration::from_secs(2))
|
||||
.await
|
||||
|
||||
345
src/srtt.rs
Normal file
345
src/srtt.rs
Normal file
@@ -0,0 +1,345 @@
|
||||
use std::collections::HashMap;
|
||||
use std::net::{IpAddr, SocketAddr};
|
||||
use std::time::Instant;
|
||||
|
||||
const INITIAL_SRTT_MS: u64 = 200;
|
||||
const FAILURE_PENALTY_MS: u64 = 5000;
|
||||
const TCP_PENALTY_MS: u64 = 100;
|
||||
const DECAY_AFTER_SECS: u64 = 300;
|
||||
const MAX_ENTRIES: usize = 4096;
|
||||
const EVICT_BATCH: usize = 64;
|
||||
|
||||
struct SrttEntry {
|
||||
srtt_ms: u64,
|
||||
updated_at: Instant,
|
||||
}
|
||||
|
||||
pub struct SrttCache {
|
||||
entries: HashMap<IpAddr, SrttEntry>,
|
||||
enabled: bool,
|
||||
}
|
||||
|
||||
impl Default for SrttCache {
|
||||
fn default() -> Self {
|
||||
Self::new(true)
|
||||
}
|
||||
}
|
||||
|
||||
impl SrttCache {
|
||||
pub fn new(enabled: bool) -> Self {
|
||||
Self {
|
||||
entries: HashMap::new(),
|
||||
enabled,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn is_enabled(&self) -> bool {
|
||||
self.enabled
|
||||
}
|
||||
|
||||
/// Get current SRTT for an IP, applying decay if stale. Returns INITIAL for unknown.
|
||||
pub fn get(&self, ip: IpAddr) -> u64 {
|
||||
match self.entries.get(&ip) {
|
||||
Some(entry) => Self::decayed_srtt(entry),
|
||||
None => INITIAL_SRTT_MS,
|
||||
}
|
||||
}
|
||||
|
||||
/// Apply time-based decay: each DECAY_AFTER_SECS period halves distance to INITIAL.
|
||||
fn decayed_srtt(entry: &SrttEntry) -> u64 {
|
||||
let age_secs = entry.updated_at.elapsed().as_secs();
|
||||
if age_secs > DECAY_AFTER_SECS {
|
||||
let periods = (age_secs / DECAY_AFTER_SECS).min(8);
|
||||
let mut srtt = entry.srtt_ms;
|
||||
for _ in 0..periods {
|
||||
srtt = (srtt + INITIAL_SRTT_MS) / 2;
|
||||
}
|
||||
srtt
|
||||
} else {
|
||||
entry.srtt_ms
|
||||
}
|
||||
}
|
||||
|
||||
/// Record a successful query RTT. No-op when disabled.
|
||||
pub fn record_rtt(&mut self, ip: IpAddr, rtt_ms: u64, tcp: bool) {
|
||||
if !self.enabled {
|
||||
return;
|
||||
}
|
||||
let effective = if tcp { rtt_ms + TCP_PENALTY_MS } else { rtt_ms };
|
||||
self.maybe_evict();
|
||||
let entry = self.entries.entry(ip).or_insert(SrttEntry {
|
||||
srtt_ms: effective,
|
||||
updated_at: Instant::now(),
|
||||
});
|
||||
// Apply decay before EWMA so recovered servers aren't stuck at stale penalties
|
||||
let base = Self::decayed_srtt(entry);
|
||||
// BIND EWMA: new = (old * 7 + sample) / 8
|
||||
entry.srtt_ms = (base * 7 + effective) / 8;
|
||||
entry.updated_at = Instant::now();
|
||||
}
|
||||
|
||||
/// Record a failure (timeout or error). No-op when disabled.
|
||||
pub fn record_failure(&mut self, ip: IpAddr) {
|
||||
if !self.enabled {
|
||||
return;
|
||||
}
|
||||
self.maybe_evict();
|
||||
let entry = self.entries.entry(ip).or_insert(SrttEntry {
|
||||
srtt_ms: FAILURE_PENALTY_MS,
|
||||
updated_at: Instant::now(),
|
||||
});
|
||||
entry.srtt_ms = FAILURE_PENALTY_MS;
|
||||
entry.updated_at = Instant::now();
|
||||
}
|
||||
|
||||
/// Sort addresses by SRTT ascending (lowest/fastest first). No-op when disabled.
|
||||
pub fn sort_by_rtt(&self, addrs: &mut [SocketAddr]) {
|
||||
if !self.enabled {
|
||||
return;
|
||||
}
|
||||
addrs.sort_by_key(|a| self.get(a.ip()));
|
||||
}
|
||||
|
||||
pub fn heap_bytes(&self) -> usize {
|
||||
let per_slot = std::mem::size_of::<u64>()
|
||||
+ std::mem::size_of::<IpAddr>()
|
||||
+ std::mem::size_of::<SrttEntry>()
|
||||
+ 1;
|
||||
self.entries.capacity() * per_slot
|
||||
}
|
||||
|
||||
pub fn len(&self) -> usize {
|
||||
self.entries.len()
|
||||
}
|
||||
|
||||
pub fn is_empty(&self) -> bool {
|
||||
self.entries.is_empty()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
fn set_updated_at(&mut self, ip: IpAddr, at: Instant) {
|
||||
if let Some(entry) = self.entries.get_mut(&ip) {
|
||||
entry.updated_at = at;
|
||||
}
|
||||
}
|
||||
|
||||
fn maybe_evict(&mut self) {
|
||||
if self.entries.len() < MAX_ENTRIES {
|
||||
return;
|
||||
}
|
||||
// Batch eviction: remove the oldest EVICT_BATCH entries at once
|
||||
let mut by_age: Vec<IpAddr> = self.entries.keys().copied().collect();
|
||||
by_age.sort_by_key(|ip| self.entries[ip].updated_at);
|
||||
for ip in by_age.into_iter().take(EVICT_BATCH) {
|
||||
self.entries.remove(&ip);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::net::Ipv4Addr;
|
||||
|
||||
fn ip(last: u8) -> IpAddr {
|
||||
IpAddr::V4(Ipv4Addr::new(192, 0, 2, last))
|
||||
}
|
||||
|
||||
fn sock(last: u8) -> SocketAddr {
|
||||
SocketAddr::new(ip(last), 53)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unknown_returns_initial() {
|
||||
let cache = SrttCache::new(true);
|
||||
assert_eq!(cache.get(ip(1)), INITIAL_SRTT_MS);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ewma_converges() {
|
||||
let mut cache = SrttCache::new(true);
|
||||
for _ in 0..20 {
|
||||
cache.record_rtt(ip(1), 100, false);
|
||||
}
|
||||
let srtt = cache.get(ip(1));
|
||||
assert!(srtt >= 98 && srtt <= 102, "srtt={}", srtt);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn failure_sets_penalty() {
|
||||
let mut cache = SrttCache::new(true);
|
||||
cache.record_rtt(ip(1), 50, false);
|
||||
cache.record_failure(ip(1));
|
||||
assert_eq!(cache.get(ip(1)), FAILURE_PENALTY_MS);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn tcp_penalty_added() {
|
||||
let mut cache = SrttCache::new(true);
|
||||
for _ in 0..20 {
|
||||
cache.record_rtt(ip(1), 50, true);
|
||||
}
|
||||
let srtt = cache.get(ip(1));
|
||||
assert!(srtt >= 148 && srtt <= 152, "srtt={}", srtt);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sort_by_rtt_orders_correctly() {
|
||||
let mut cache = SrttCache::new(true);
|
||||
for _ in 0..20 {
|
||||
cache.record_rtt(ip(1), 500, false);
|
||||
cache.record_rtt(ip(2), 100, false);
|
||||
cache.record_rtt(ip(3), 10, false);
|
||||
}
|
||||
let mut addrs = vec![sock(1), sock(2), sock(3)];
|
||||
cache.sort_by_rtt(&mut addrs);
|
||||
assert_eq!(addrs, vec![sock(3), sock(2), sock(1)]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unknown_servers_sort_equal() {
|
||||
let cache = SrttCache::new(true);
|
||||
let mut addrs = vec![sock(1), sock(2), sock(3)];
|
||||
let original = addrs.clone();
|
||||
cache.sort_by_rtt(&mut addrs);
|
||||
assert_eq!(addrs, original);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn disabled_is_noop() {
|
||||
let mut cache = SrttCache::new(false);
|
||||
cache.record_rtt(ip(1), 50, false);
|
||||
cache.record_failure(ip(2));
|
||||
assert_eq!(cache.len(), 0);
|
||||
|
||||
let mut addrs = vec![sock(2), sock(1)];
|
||||
let original = addrs.clone();
|
||||
cache.sort_by_rtt(&mut addrs);
|
||||
assert_eq!(addrs, original);
|
||||
}
|
||||
|
||||
fn age(secs: u64) -> Instant {
|
||||
Instant::now() - std::time::Duration::from_secs(secs)
|
||||
}
|
||||
|
||||
/// Cache with ip(1) saturated at FAILURE_PENALTY_MS
|
||||
fn saturated_penalty_cache() -> SrttCache {
|
||||
let mut cache = SrttCache::new(true);
|
||||
for _ in 0..30 {
|
||||
cache.record_rtt(ip(1), FAILURE_PENALTY_MS, false);
|
||||
}
|
||||
cache
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn no_decay_within_threshold() {
|
||||
let mut cache = SrttCache::new(true);
|
||||
cache.record_rtt(ip(1), 5000, false);
|
||||
cache.set_updated_at(ip(1), age(DECAY_AFTER_SECS));
|
||||
assert_eq!(cache.get(ip(1)), cache.entries[&ip(1)].srtt_ms);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn one_decay_period() {
|
||||
let mut cache = saturated_penalty_cache();
|
||||
let raw = cache.entries[&ip(1)].srtt_ms;
|
||||
cache.set_updated_at(ip(1), age(DECAY_AFTER_SECS + 1));
|
||||
let expected = (raw + INITIAL_SRTT_MS) / 2;
|
||||
assert_eq!(cache.get(ip(1)), expected);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn multiple_decay_periods() {
|
||||
let mut cache = saturated_penalty_cache();
|
||||
let raw = cache.entries[&ip(1)].srtt_ms;
|
||||
cache.set_updated_at(ip(1), age(DECAY_AFTER_SECS * 4 + 1));
|
||||
let mut expected = raw;
|
||||
for _ in 0..4 {
|
||||
expected = (expected + INITIAL_SRTT_MS) / 2;
|
||||
}
|
||||
assert_eq!(cache.get(ip(1)), expected);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn decay_caps_at_8_periods() {
|
||||
// 9 periods and 100 periods should produce the same result (capped at 8)
|
||||
let mut cache_a = saturated_penalty_cache();
|
||||
let mut cache_b = saturated_penalty_cache();
|
||||
cache_a.set_updated_at(ip(1), age(DECAY_AFTER_SECS * 9 + 1));
|
||||
cache_b.set_updated_at(ip(1), age(DECAY_AFTER_SECS * 100));
|
||||
assert_eq!(cache_a.get(ip(1)), cache_b.get(ip(1)));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn decay_converges_toward_initial() {
|
||||
let mut cache = saturated_penalty_cache();
|
||||
cache.set_updated_at(ip(1), age(DECAY_AFTER_SECS * 100));
|
||||
let decayed = cache.get(ip(1));
|
||||
let diff = decayed.abs_diff(INITIAL_SRTT_MS);
|
||||
assert!(
|
||||
diff < 25,
|
||||
"expected near INITIAL_SRTT_MS, got {} (diff={})",
|
||||
decayed,
|
||||
diff
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn record_rtt_applies_decay_before_ewma() {
|
||||
let mut cache = saturated_penalty_cache();
|
||||
cache.set_updated_at(ip(1), age(DECAY_AFTER_SECS * 8));
|
||||
cache.record_rtt(ip(1), 50, false);
|
||||
let srtt = cache.get(ip(1));
|
||||
// Without decay-before-EWMA, result would be ~(5000*7+50)/8 ≈ 4381
|
||||
assert!(srtt < 500, "expected decay before EWMA, got srtt={}", srtt);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn decay_reranks_stale_failures() {
|
||||
let mut cache = saturated_penalty_cache();
|
||||
for _ in 0..30 {
|
||||
cache.record_rtt(ip(2), 300, false);
|
||||
}
|
||||
let mut addrs = vec![sock(1), sock(2)];
|
||||
cache.sort_by_rtt(&mut addrs);
|
||||
assert_eq!(addrs, vec![sock(2), sock(1)]);
|
||||
|
||||
// Age server 1 so it decays toward INITIAL (200ms) — below server 2's 300ms
|
||||
cache.set_updated_at(ip(1), age(DECAY_AFTER_SECS * 100));
|
||||
let mut addrs = vec![sock(1), sock(2)];
|
||||
cache.sort_by_rtt(&mut addrs);
|
||||
assert_eq!(addrs, vec![sock(1), sock(2)]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn heap_bytes_grows_with_entries() {
|
||||
let mut cache = SrttCache::new(true);
|
||||
let empty = cache.heap_bytes();
|
||||
for i in 1..=10u8 {
|
||||
cache.record_rtt(ip(i), 100, false);
|
||||
}
|
||||
assert!(cache.heap_bytes() > empty);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn eviction_removes_oldest() {
|
||||
let mut cache = SrttCache::new(true);
|
||||
for i in 0..MAX_ENTRIES {
|
||||
let octets = [
|
||||
10,
|
||||
((i >> 16) & 0xFF) as u8,
|
||||
((i >> 8) & 0xFF) as u8,
|
||||
(i & 0xFF) as u8,
|
||||
];
|
||||
cache.record_rtt(
|
||||
IpAddr::V4(Ipv4Addr::new(octets[0], octets[1], octets[2], octets[3])),
|
||||
100,
|
||||
false,
|
||||
);
|
||||
}
|
||||
assert_eq!(cache.len(), MAX_ENTRIES);
|
||||
cache.record_rtt(ip(1), 100, false);
|
||||
// Batch eviction removes EVICT_BATCH entries
|
||||
assert!(cache.len() <= MAX_ENTRIES - EVICT_BATCH + 1);
|
||||
}
|
||||
}
|
||||
101
src/stats.rs
101
src/stats.rs
@@ -1,9 +1,97 @@
|
||||
use std::time::Instant;
|
||||
|
||||
/// Returns the process memory footprint in bytes, or 0 if unavailable.
|
||||
/// macOS: phys_footprint (matches Activity Monitor). Linux: RSS from /proc/self/statm.
|
||||
pub fn process_memory_bytes() -> usize {
|
||||
#[cfg(target_os = "macos")]
|
||||
{
|
||||
macos_rss()
|
||||
}
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
linux_rss()
|
||||
}
|
||||
#[cfg(not(any(target_os = "macos", target_os = "linux")))]
|
||||
{
|
||||
0
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
fn macos_rss() -> usize {
|
||||
use std::mem;
|
||||
extern "C" {
|
||||
fn mach_task_self() -> u32;
|
||||
fn task_info(
|
||||
target_task: u32,
|
||||
flavor: u32,
|
||||
task_info_out: *mut TaskVmInfo,
|
||||
task_info_count: *mut u32,
|
||||
) -> i32;
|
||||
}
|
||||
// Partial task_vm_info_data_t — only fields up to phys_footprint.
|
||||
#[repr(C)]
|
||||
struct TaskVmInfo {
|
||||
virtual_size: u64,
|
||||
region_count: i32,
|
||||
page_size: i32,
|
||||
resident_size: u64,
|
||||
resident_size_peak: u64,
|
||||
device: u64,
|
||||
device_peak: u64,
|
||||
internal: u64,
|
||||
internal_peak: u64,
|
||||
external: u64,
|
||||
external_peak: u64,
|
||||
reusable: u64,
|
||||
reusable_peak: u64,
|
||||
purgeable_volatile_pmap: u64,
|
||||
purgeable_volatile_resident: u64,
|
||||
purgeable_volatile_virtual: u64,
|
||||
compressed: u64,
|
||||
compressed_peak: u64,
|
||||
compressed_lifetime: u64,
|
||||
phys_footprint: u64,
|
||||
}
|
||||
const TASK_VM_INFO: u32 = 22;
|
||||
let mut info: TaskVmInfo = unsafe { mem::zeroed() };
|
||||
let mut count = (mem::size_of::<TaskVmInfo>() / mem::size_of::<u32>()) as u32;
|
||||
let kr = unsafe { task_info(mach_task_self(), TASK_VM_INFO, &mut info, &mut count) };
|
||||
if kr == 0 {
|
||||
info.phys_footprint as usize
|
||||
} else {
|
||||
0
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
fn linux_rss() -> usize {
|
||||
extern "C" {
|
||||
fn sysconf(name: i32) -> i64;
|
||||
}
|
||||
const SC_PAGESIZE: i32 = 30; // x86_64 + aarch64; differs on mips (28), sparc (29)
|
||||
let page_size = unsafe { sysconf(SC_PAGESIZE) };
|
||||
let page_size = if page_size > 0 {
|
||||
page_size as usize
|
||||
} else {
|
||||
4096
|
||||
};
|
||||
|
||||
if let Ok(statm) = std::fs::read_to_string("/proc/self/statm") {
|
||||
if let Some(rss_pages) = statm.split_whitespace().nth(1) {
|
||||
if let Ok(pages) = rss_pages.parse::<usize>() {
|
||||
return pages * page_size;
|
||||
}
|
||||
}
|
||||
}
|
||||
0
|
||||
}
|
||||
|
||||
pub struct ServerStats {
|
||||
queries_total: u64,
|
||||
queries_forwarded: u64,
|
||||
queries_recursive: u64,
|
||||
queries_coalesced: u64,
|
||||
queries_cached: u64,
|
||||
queries_blocked: u64,
|
||||
queries_local: u64,
|
||||
@@ -12,12 +100,13 @@ pub struct ServerStats {
|
||||
started_at: Instant,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, PartialEq, Eq)]
|
||||
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
|
||||
pub enum QueryPath {
|
||||
Local,
|
||||
Cached,
|
||||
Forwarded,
|
||||
Recursive,
|
||||
Coalesced,
|
||||
Blocked,
|
||||
Overridden,
|
||||
UpstreamError,
|
||||
@@ -30,6 +119,7 @@ impl QueryPath {
|
||||
QueryPath::Cached => "CACHED",
|
||||
QueryPath::Forwarded => "FORWARD",
|
||||
QueryPath::Recursive => "RECURSIVE",
|
||||
QueryPath::Coalesced => "COALESCED",
|
||||
QueryPath::Blocked => "BLOCKED",
|
||||
QueryPath::Overridden => "OVERRIDE",
|
||||
QueryPath::UpstreamError => "SERVFAIL",
|
||||
@@ -45,6 +135,8 @@ impl QueryPath {
|
||||
Some(QueryPath::Forwarded)
|
||||
} else if s.eq_ignore_ascii_case("RECURSIVE") {
|
||||
Some(QueryPath::Recursive)
|
||||
} else if s.eq_ignore_ascii_case("COALESCED") {
|
||||
Some(QueryPath::Coalesced)
|
||||
} else if s.eq_ignore_ascii_case("BLOCKED") {
|
||||
Some(QueryPath::Blocked)
|
||||
} else if s.eq_ignore_ascii_case("OVERRIDE") {
|
||||
@@ -69,6 +161,7 @@ impl ServerStats {
|
||||
queries_total: 0,
|
||||
queries_forwarded: 0,
|
||||
queries_recursive: 0,
|
||||
queries_coalesced: 0,
|
||||
queries_cached: 0,
|
||||
queries_blocked: 0,
|
||||
queries_local: 0,
|
||||
@@ -85,6 +178,7 @@ impl ServerStats {
|
||||
QueryPath::Cached => self.queries_cached += 1,
|
||||
QueryPath::Forwarded => self.queries_forwarded += 1,
|
||||
QueryPath::Recursive => self.queries_recursive += 1,
|
||||
QueryPath::Coalesced => self.queries_coalesced += 1,
|
||||
QueryPath::Blocked => self.queries_blocked += 1,
|
||||
QueryPath::Overridden => self.queries_overridden += 1,
|
||||
QueryPath::UpstreamError => self.upstream_errors += 1,
|
||||
@@ -106,6 +200,7 @@ impl ServerStats {
|
||||
total: self.queries_total,
|
||||
forwarded: self.queries_forwarded,
|
||||
recursive: self.queries_recursive,
|
||||
coalesced: self.queries_coalesced,
|
||||
cached: self.queries_cached,
|
||||
local: self.queries_local,
|
||||
overridden: self.queries_overridden,
|
||||
@@ -121,11 +216,12 @@ impl ServerStats {
|
||||
let secs = uptime.as_secs() % 60;
|
||||
|
||||
log::info!(
|
||||
"STATS | uptime {}h{}m{}s | total {} | fwd {} | recursive {} | cached {} | local {} | override {} | blocked {} | errors {}",
|
||||
"STATS | uptime {}h{}m{}s | total {} | fwd {} | recursive {} | coalesced {} | cached {} | local {} | override {} | blocked {} | errors {}",
|
||||
hours, mins, secs,
|
||||
self.queries_total,
|
||||
self.queries_forwarded,
|
||||
self.queries_recursive,
|
||||
self.queries_coalesced,
|
||||
self.queries_cached,
|
||||
self.queries_local,
|
||||
self.queries_overridden,
|
||||
@@ -140,6 +236,7 @@ pub struct StatsSnapshot {
|
||||
pub total: u64,
|
||||
pub forwarded: u64,
|
||||
pub recursive: u64,
|
||||
pub coalesced: u64,
|
||||
pub cached: u64,
|
||||
pub local: u64,
|
||||
pub overridden: u64,
|
||||
|
||||
@@ -2,6 +2,10 @@ use std::net::SocketAddr;
|
||||
|
||||
use log::info;
|
||||
|
||||
fn is_loopback_or_stub(addr: &str) -> bool {
|
||||
matches!(addr, "127.0.0.1" | "127.0.0.53" | "0.0.0.0" | "::1" | "")
|
||||
}
|
||||
|
||||
/// A conditional forwarding rule: domains matching `suffix` are forwarded to `upstream`.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct ForwardingRule {
|
||||
@@ -26,10 +30,7 @@ pub fn discover_system_dns() -> SystemDnsInfo {
|
||||
}
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
SystemDnsInfo {
|
||||
default_upstream: detect_upstream_linux_or_backup(),
|
||||
forwarding_rules: Vec::new(),
|
||||
}
|
||||
discover_linux()
|
||||
}
|
||||
#[cfg(windows)]
|
||||
{
|
||||
@@ -102,11 +103,7 @@ fn discover_macos() -> SystemDnsInfo {
|
||||
if ns.parse::<std::net::Ipv4Addr>().is_ok() {
|
||||
current_nameserver = Some(ns.clone());
|
||||
// Capture first non-supplemental, non-loopback nameserver as default upstream
|
||||
if !is_supplemental
|
||||
&& default_upstream.is_none()
|
||||
&& ns != "127.0.0.1"
|
||||
&& ns != "0.0.0.0"
|
||||
{
|
||||
if !is_supplemental && default_upstream.is_none() && !is_loopback_or_stub(&ns) {
|
||||
default_upstream = Some(ns);
|
||||
}
|
||||
}
|
||||
@@ -156,7 +153,7 @@ fn discover_macos() -> SystemDnsInfo {
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
#[cfg(any(target_os = "macos", target_os = "linux"))]
|
||||
fn make_rule(domain: &str, nameserver: &str) -> Option<ForwardingRule> {
|
||||
let addr: SocketAddr = format!("{}:53", nameserver).parse().ok()?;
|
||||
Some(ForwardingRule {
|
||||
@@ -166,38 +163,100 @@ fn make_rule(domain: &str, nameserver: &str) -> Option<ForwardingRule> {
|
||||
})
|
||||
}
|
||||
|
||||
/// Detect upstream from /etc/resolv.conf, falling back to backup file if resolv.conf
|
||||
/// only has loopback (meaning numa install already ran).
|
||||
#[cfg(target_os = "linux")]
|
||||
fn detect_upstream_linux_or_backup() -> Option<String> {
|
||||
// Try /etc/resolv.conf first
|
||||
if let Some(ns) = read_upstream_from_file("/etc/resolv.conf") {
|
||||
const CLOUD_VPC_RESOLVER: &str = "169.254.169.253";
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
fn discover_linux() -> SystemDnsInfo {
|
||||
// Parse resolv.conf once for both upstream and search domains
|
||||
let (upstream, search_domains) = parse_resolv_conf("/etc/resolv.conf");
|
||||
|
||||
let default_upstream = if let Some(ns) = upstream {
|
||||
info!("detected system upstream: {}", ns);
|
||||
return Some(ns);
|
||||
}
|
||||
// If resolv.conf only has loopback, check the backup from `numa install`
|
||||
Some(ns)
|
||||
} else {
|
||||
// Fallback to backup from a previous `numa install`
|
||||
let backup = {
|
||||
let home = std::env::var("HOME")
|
||||
.map(std::path::PathBuf::from)
|
||||
.unwrap_or_else(|_| std::path::PathBuf::from("/root"));
|
||||
home.join(".numa").join("original-resolv.conf")
|
||||
};
|
||||
if let Some(ns) = read_upstream_from_file(backup.to_str().unwrap_or("")) {
|
||||
let (ns, _) = parse_resolv_conf(backup.to_str().unwrap_or(""));
|
||||
if let Some(ref ns) = ns {
|
||||
info!("detected original upstream from backup: {}", ns);
|
||||
return Some(ns);
|
||||
}
|
||||
None
|
||||
ns
|
||||
};
|
||||
|
||||
// On cloud VMs (AWS/GCP), internal domains need to reach the VPC resolver
|
||||
let forwarding_rules = if search_domains.is_empty() {
|
||||
Vec::new()
|
||||
} else {
|
||||
let forwarder = resolvectl_dns_server().unwrap_or_else(|| CLOUD_VPC_RESOLVER.to_string());
|
||||
let rules: Vec<_> = search_domains
|
||||
.iter()
|
||||
.filter_map(|domain| {
|
||||
let rule = make_rule(domain, &forwarder)?;
|
||||
info!("forwarding .{} to {}", domain, forwarder);
|
||||
Some(rule)
|
||||
})
|
||||
.collect();
|
||||
if !rules.is_empty() {
|
||||
info!("detected {} search domain forwarding rules", rules.len());
|
||||
}
|
||||
rules
|
||||
};
|
||||
|
||||
SystemDnsInfo {
|
||||
default_upstream,
|
||||
forwarding_rules,
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse resolv.conf in a single pass, extracting both the first non-loopback
|
||||
/// nameserver and all search domains.
|
||||
#[cfg(target_os = "linux")]
|
||||
fn read_upstream_from_file(path: &str) -> Option<String> {
|
||||
let text = std::fs::read_to_string(path).ok()?;
|
||||
fn parse_resolv_conf(path: &str) -> (Option<String>, Vec<String>) {
|
||||
let text = match std::fs::read_to_string(path) {
|
||||
Ok(t) => t,
|
||||
Err(_) => return (None, Vec::new()),
|
||||
};
|
||||
let mut upstream = None;
|
||||
let mut search_domains = Vec::new();
|
||||
for line in text.lines() {
|
||||
let line = line.trim();
|
||||
if line.starts_with("nameserver") {
|
||||
if upstream.is_none() {
|
||||
if let Some(ns) = line.split_whitespace().nth(1) {
|
||||
if ns != "127.0.0.1" && ns != "0.0.0.0" && ns != "::1" {
|
||||
return Some(ns.to_string());
|
||||
if !is_loopback_or_stub(ns) {
|
||||
upstream = Some(ns.to_string());
|
||||
}
|
||||
}
|
||||
}
|
||||
} else if line.starts_with("search") || line.starts_with("domain") {
|
||||
for domain in line.split_whitespace().skip(1) {
|
||||
search_domains.push(domain.to_string());
|
||||
}
|
||||
}
|
||||
}
|
||||
(upstream, search_domains)
|
||||
}
|
||||
|
||||
/// Query resolvectl for the real upstream DNS server (e.g. VPC resolver on AWS).
|
||||
#[cfg(target_os = "linux")]
|
||||
fn resolvectl_dns_server() -> Option<String> {
|
||||
let output = std::process::Command::new("resolvectl")
|
||||
.args(["status", "--no-pager"])
|
||||
.output()
|
||||
.ok()?;
|
||||
let text = String::from_utf8_lossy(&output.stdout);
|
||||
for line in text.lines() {
|
||||
if line.contains("DNS Servers") || line.contains("Current DNS Server") {
|
||||
if let Some(ip) = line.split(':').next_back() {
|
||||
let ip = ip.trim();
|
||||
if ip.parse::<std::net::IpAddr>().is_ok() && !is_loopback_or_stub(ip) {
|
||||
return Some(ip.to_string());
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -236,10 +295,7 @@ fn detect_dhcp_dns_macos() -> Option<String> {
|
||||
// Take the first non-loopback DNS server
|
||||
for addr in inner.split(',') {
|
||||
let addr = addr.trim();
|
||||
if !addr.is_empty()
|
||||
&& addr != "127.0.0.1"
|
||||
&& addr != "0.0.0.0"
|
||||
&& addr.parse::<std::net::Ipv4Addr>().is_ok()
|
||||
if !is_loopback_or_stub(addr) && addr.parse::<std::net::Ipv4Addr>().is_ok()
|
||||
{
|
||||
log::info!("detected DHCP DNS: {}", addr);
|
||||
return Some(addr.to_string());
|
||||
@@ -278,7 +334,7 @@ fn discover_windows() -> SystemDnsInfo {
|
||||
if trimmed.contains("DNS Servers") || trimmed.contains("DNS-Server") {
|
||||
if let Some(ip) = trimmed.split(':').next_back() {
|
||||
let ip = ip.trim();
|
||||
if !ip.is_empty() && ip != "127.0.0.1" && ip != "::1" {
|
||||
if !is_loopback_or_stub(ip) {
|
||||
upstream = Some(ip.to_string());
|
||||
break;
|
||||
}
|
||||
@@ -316,43 +372,6 @@ pub fn match_forwarding_rule(domain: &str, rules: &[ForwardingRule]) -> Option<S
|
||||
|
||||
// --- System DNS configuration (install/uninstall) ---
|
||||
|
||||
/// Set the system DNS to 127.0.0.1 so all queries go through Numa.
|
||||
/// Saves the original DNS settings for later restoration.
|
||||
pub fn install_system_dns() -> Result<(), String> {
|
||||
#[cfg(target_os = "macos")]
|
||||
let result = install_macos();
|
||||
#[cfg(target_os = "linux")]
|
||||
let result = install_linux();
|
||||
#[cfg(not(any(target_os = "macos", target_os = "linux")))]
|
||||
let result = Err("system DNS configuration not supported on this OS".to_string());
|
||||
|
||||
if result.is_ok() {
|
||||
if let Err(e) = trust_ca() {
|
||||
eprintln!(" warning: could not trust CA: {}", e);
|
||||
eprintln!(" HTTPS proxy will work but browsers will show certificate warnings.\n");
|
||||
}
|
||||
}
|
||||
result
|
||||
}
|
||||
|
||||
/// Restore the original system DNS settings saved during install.
|
||||
pub fn uninstall_system_dns() -> Result<(), String> {
|
||||
let _ = untrust_ca();
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
{
|
||||
uninstall_macos()
|
||||
}
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
uninstall_linux()
|
||||
}
|
||||
#[cfg(not(any(target_os = "macos", target_os = "linux")))]
|
||||
{
|
||||
Err("system DNS configuration not supported on this OS".to_string())
|
||||
}
|
||||
}
|
||||
|
||||
// --- macOS implementation ---
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
@@ -500,21 +519,25 @@ const SYSTEMD_UNIT: &str = "/etc/systemd/system/numa.service";
|
||||
/// Install Numa as a system service that starts on boot and auto-restarts.
|
||||
pub fn install_service() -> Result<(), String> {
|
||||
#[cfg(target_os = "macos")]
|
||||
{
|
||||
install_service_macos()
|
||||
}
|
||||
let result = install_service_macos();
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
install_service_linux()
|
||||
}
|
||||
let result = install_service_linux();
|
||||
#[cfg(not(any(target_os = "macos", target_os = "linux")))]
|
||||
{
|
||||
Err("service installation not supported on this OS".to_string())
|
||||
let result = Err::<(), String>("service installation not supported on this OS".to_string());
|
||||
|
||||
if result.is_ok() {
|
||||
if let Err(e) = trust_ca() {
|
||||
eprintln!(" warning: could not trust CA: {}", e);
|
||||
eprintln!(" HTTPS proxy will work but browsers will show certificate warnings.\n");
|
||||
}
|
||||
}
|
||||
result
|
||||
}
|
||||
|
||||
/// Uninstall the Numa system service.
|
||||
pub fn uninstall_service() -> Result<(), String> {
|
||||
let _ = untrust_ca();
|
||||
|
||||
#[cfg(target_os = "macos")]
|
||||
{
|
||||
uninstall_service_macos()
|
||||
@@ -609,7 +632,7 @@ fn install_service_macos() -> Result<(), String> {
|
||||
std::fs::write(PLIST_DEST, plist)
|
||||
.map_err(|e| format!("failed to write {}: {}", PLIST_DEST, e))?;
|
||||
|
||||
// Load the service
|
||||
// Load the service first so numa is listening before DNS redirect
|
||||
let status = std::process::Command::new("launchctl")
|
||||
.args(["load", "-w", PLIST_DEST])
|
||||
.status()
|
||||
@@ -619,14 +642,34 @@ fn install_service_macos() -> Result<(), String> {
|
||||
return Err("launchctl load failed".to_string());
|
||||
}
|
||||
|
||||
// Set system DNS to 127.0.0.1 now that the service is running
|
||||
eprintln!(" Service installed and started.");
|
||||
// Wait for numa to be ready before redirecting DNS
|
||||
let api_up = (0..10).any(|i| {
|
||||
if i > 0 {
|
||||
std::thread::sleep(std::time::Duration::from_millis(500));
|
||||
}
|
||||
std::net::TcpStream::connect(("127.0.0.1", crate::config::DEFAULT_API_PORT)).is_ok()
|
||||
});
|
||||
if !api_up {
|
||||
// Service failed to start — don't redirect DNS to a dead endpoint
|
||||
let _ = std::process::Command::new("launchctl")
|
||||
.args(["unload", PLIST_DEST])
|
||||
.status();
|
||||
return Err(
|
||||
"numa service did not start (port 53 may be in use). Service unloaded.".to_string(),
|
||||
);
|
||||
}
|
||||
|
||||
if let Err(e) = install_macos() {
|
||||
eprintln!(" warning: failed to configure system DNS: {}", e);
|
||||
}
|
||||
|
||||
eprintln!(" Service installed and started.");
|
||||
eprintln!(" Numa will auto-start on boot and restart if killed.");
|
||||
eprintln!(" Logs: /usr/local/var/log/numa.log");
|
||||
eprintln!(" Run 'sudo numa service stop' to fully uninstall.\n");
|
||||
eprintln!(" Run 'sudo numa uninstall' to restore original DNS.\n");
|
||||
eprintln!(" Want full DNS sovereignty? Add to numa.toml:");
|
||||
eprintln!(" [upstream]");
|
||||
eprintln!(" mode = \"recursive\"\n");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -708,7 +751,10 @@ fn install_linux() -> Result<(), String> {
|
||||
.map_err(|e| format!("failed to create {}: {}", resolved_dir.display(), e))?;
|
||||
|
||||
let drop_in = resolved_dir.join("numa.conf");
|
||||
std::fs::write(&drop_in, "[Resolve]\nDNS=127.0.0.1\nDomains=~.\n")
|
||||
std::fs::write(
|
||||
&drop_in,
|
||||
"[Resolve]\nDNS=127.0.0.1\nDomains=~.\nDNSStubListener=no\n",
|
||||
)
|
||||
.map_err(|e| format!("failed to write {}: {}", drop_in.display(), e))?;
|
||||
|
||||
let _ = run_systemctl(&["restart", "systemd-resolved"]);
|
||||
@@ -802,17 +848,21 @@ fn install_service_linux() -> Result<(), String> {
|
||||
|
||||
run_systemctl(&["daemon-reload"])?;
|
||||
run_systemctl(&["enable", "numa"])?;
|
||||
run_systemctl(&["start", "numa"])?;
|
||||
|
||||
eprintln!(" Service installed and started.");
|
||||
|
||||
// Set system DNS now that the service is running
|
||||
// Configure system DNS before starting numa so resolved releases port 53 first
|
||||
if let Err(e) = install_linux() {
|
||||
eprintln!(" warning: failed to configure system DNS: {}", e);
|
||||
}
|
||||
|
||||
run_systemctl(&["start", "numa"])?;
|
||||
|
||||
eprintln!(" Service installed and started.");
|
||||
eprintln!(" Numa will auto-start on boot and restart if killed.");
|
||||
eprintln!(" Logs: journalctl -u numa -f");
|
||||
eprintln!(" Run 'sudo numa service stop' to fully uninstall.\n");
|
||||
eprintln!(" Run 'sudo numa uninstall' to restore original DNS.\n");
|
||||
eprintln!(" Want full DNS sovereignty? Add to numa.toml:");
|
||||
eprintln!(" [upstream]");
|
||||
eprintln!(" mode = \"recursive\"\n");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user