fix: port Windows VPN DNS settling fix to master

cmd/cli/dns_intercept_darwin.go

@@ -1407,7 +1407,7 @@ func (p *prog) scheduleDelayedRechecks() {
 			ctx := ctrld.LoggerCtx(context.Background(), p.logger.Load())
 			ctrld.InitializeOsResolver(ctx, true)
 			if p.vpnDNS != nil {
-				p.vpnDNS.Refresh(ctx)
+				p.vpnDNS.Refresh(ctx, true)
 			}
 		})
 	}

cmd/cli/dns_intercept_windows.go

@@ -1623,7 +1623,7 @@ func (p *prog) scheduleDelayedRechecks() {
 			ctx := ctrld.LoggerCtx(context.Background(), p.logger.Load())
 			ctrld.InitializeOsResolver(ctx, true)
 			if p.vpnDNS != nil {
-				p.vpnDNS.Refresh(ctx)
+				p.vpnDNS.Refresh(ctx, true)
 			}
 
 			// NRPT watchdog: some VPN software clears NRPT policy rules on

cmd/cli/dns_proxy.go

@@ -639,13 +639,14 @@ func (p *prog) proxy(ctx context.Context, req *proxyRequest) *proxyResponse {
 		if vpnServers := p.vpnDNS.UpstreamForDomain(domain); len(vpnServers) > 0 {
 			ctrld.Log(ctx, p.Debug(), "VPN DNS route matched for domain %s, using servers: %v", domain, vpnServers)
 
-			// Try each VPN DNS server
+			var gotTransportFailure bool
 			for _, server := range vpnServers {
 				upstreamConfig := p.vpnDNS.upstreamConfigFor(server)
 				ctrld.Log(ctx, p.Debug(), "Querying VPN DNS server: %s", server)
 
 				answer := p.queryUpstream(ctx, req, "vpn-dns", upstreamConfig)
 				if answer != nil {
+					p.vpnDNS.VPNDNSReachable()
 					ctrld.Log(ctx, p.Debug(), "VPN DNS query successful")
 
 					// Update cache if enabled
@@ -654,15 +655,87 @@ func (p *prog) proxy(ctx context.Context, req *proxyRequest) *proxyResponse {
 					}
 
 					return &proxyResponse{answer: answer, cached: false}
-				} else {
-					ctrld.Log(ctx, p.Debug(), "VPN DNS server %s failed", server)
 				}
+				gotTransportFailure = true
+				ctrld.Log(ctx, p.Debug(), "VPN DNS server %s failed", server)
+			}
+
+			// Explicit VPN DNS routes are authoritative for their suffix. If all
+			// routed servers fail at the transport layer while Windows is serving
+			// retained VPN DNS state, fail closed instead of leaking VPN/internal
+			// names to normal upstreams.
+			if gotTransportFailure && p.vpnDNS.ShouldFailClosedAfterVPNDNSTransportFailure(domain, vpnServers) {
+				ctrld.Log(ctx, p.Debug(),
+					"All VPN DNS servers had transport failures for %s; returning SERVFAIL while retained VPN DNS state is active", domain)
+				answer := new(dns.Msg)
+				answer.SetRcode(req.msg, dns.RcodeServerFailure)
+				return &proxyResponse{answer: answer, cached: false}
 			}
 
 			ctrld.Log(ctx, p.Debug(), "All VPN DNS servers failed, falling back to normal upstreams")
 		}
 	}
 
+	// Domain-less VPN DNS fallback: when a query is going to upstream.os via a
+	// split-rule (matched policy) and we have VPN DNS servers with no associated
+	// domains, try those servers for this query. This handles cases like F5 VPN
+	// where the VPN doesn't advertise DNS search domains but its DNS servers
+	// know the internal zones referenced by split-rules (e.g., *.provisur.local).
+	// These servers are NOT used for general OS resolver queries to avoid
+	// polluting captive portal / DHCP flows.
+	if dnsIntercept && p.vpnDNS != nil && req.ufr.matched &&
+		len(upstreams) > 0 && upstreams[0] == upstreamOS &&
+		len(req.msg.Question) > 0 {
+		if dlServers := p.vpnDNS.DomainlessServers(); len(dlServers) > 0 {
+			domain := req.msg.Question[0].Name
+			ctrld.Log(ctx, p.Debug(),
+				"Split-rule query %s going to upstream.os, trying %d domain-less VPN DNS servers first: %v",
+				domain, len(dlServers), dlServers)
+
+			var gotDNSAnswer bool
+			var gotTransportFailure bool
+			for _, server := range dlServers {
+				upstreamConfig := p.vpnDNS.upstreamConfigFor(server)
+				ctrld.Log(ctx, p.Debug(), "Querying domain-less VPN DNS server: %s", server)
+
+				answer := p.queryUpstream(ctx, req, "vpn-dns", upstreamConfig)
+				if answer != nil {
+					gotDNSAnswer = true
+					p.vpnDNS.VPNDNSReachable()
+				}
+				if answer != nil && answer.Rcode == dns.RcodeSuccess {
+					ctrld.Log(ctx, p.Debug(),
+						"Domain-less VPN DNS server %s answered %s successfully", server, domain)
+					return &proxyResponse{answer: answer, cached: false}
+				}
+				if answer != nil {
+					ctrld.Log(ctx, p.Debug(),
+						"Domain-less VPN DNS server %s returned %s for %s, trying next",
+						server, dns.RcodeToString[answer.Rcode], domain)
+				} else {
+					gotTransportFailure = true
+					ctrld.Log(ctx, p.Debug(), "Domain-less VPN DNS server %s failed for %s", server, domain)
+				}
+			}
+
+			// If every domainless VPN DNS attempt failed before receiving a DNS
+			// packet while Windows is serving retained VPN DNS state, fail closed
+			// instead of asking LAN/public DNS about internal split-rule names and
+			// caching false negatives. Reachable negative DNS responses still fall
+			// through to the old OS fallback behavior below.
+			if !gotDNSAnswer && gotTransportFailure && p.vpnDNS.ShouldFailClosedAfterVPNDNSTransportFailure(domain, dlServers) {
+				ctrld.Log(ctx, p.Debug(),
+					"All domain-less VPN DNS servers had transport failures for %s; returning SERVFAIL while retained VPN DNS state is active", domain)
+				answer := new(dns.Msg)
+				answer.SetRcode(req.msg, dns.RcodeServerFailure)
+				return &proxyResponse{answer: answer, cached: false}
+			}
+
+			ctrld.Log(ctx, p.Debug(),
+				"All domain-less VPN DNS servers failed for %s, falling back to OS resolver", domain)
+		}
+	}
+
 	ctrld.Log(ctx, p.Debug(), "No cache hit, trying upstreams")
 	if res := p.tryUpstreams(ctx, req, upstreams, upstreamConfigs); res != nil {
 		ctrld.Log(ctx, p.Debug(), "Upstream query successful")
@@ -1662,7 +1735,7 @@ func (p *prog) monitorNetworkChanges(ctx context.Context) error {
 			// even though the physical interface didn't change. Runs after tunnel checks
 			// so the pf anchor rebuild includes current VPN DNS exemptions.
 			if dnsIntercept && p.vpnDNS != nil {
-				p.vpnDNS.Refresh(ctx)
+				p.vpnDNS.Refresh(ctx, true)
 			}
 			return
 		}
@@ -1749,7 +1822,7 @@ func (p *prog) monitorNetworkChanges(ctx context.Context) error {
 			// Refresh VPN DNS routes — runs after tunnel checks so the anchor
 			// rebuild includes current VPN DNS exemptions.
 			if p.vpnDNS != nil {
-				p.vpnDNS.Refresh(ctrld.LoggerCtx(ctx, p.logger.Load()))
+				p.vpnDNS.Refresh(ctrld.LoggerCtx(ctx, p.logger.Load()), true)
 			}
 			// Schedule delayed re-checks to catch async VPN teardown changes.
 			p.scheduleDelayedRechecks()
@@ -2077,7 +2150,7 @@ func (p *prog) completeRecovery(reason RecoveryReason, recovered string) error {
 		// This also re-exempts VPN DNS servers (which may have changed) and
 		// removes any DHCP exemptions that were added during recovery.
 		if p.vpnDNS != nil {
-			p.vpnDNS.Refresh(ctrld.LoggerCtx(context.Background(), p.logger.Load()))
+			p.vpnDNS.Refresh(ctrld.LoggerCtx(context.Background(), p.logger.Load()), true)
 		}
 
 		// Reinitialize OS resolver for the recovered state.

cmd/cli/vpn_dns.go

@@ -3,6 +3,7 @@ package cli
 import (
 	"context"
 	"net"
+	"runtime"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -12,6 +13,8 @@ import (
 	"github.com/Control-D-Inc/ctrld"
 )
 
+var vpnDNSSettlingEnabled = runtime.GOOS == "windows"
+
 // vpnDNSExemption represents a VPN DNS server that needs pf/WFP exemption,
 // including the interface it was discovered on. The interface is used on macOS
 // to create interface-scoped pf exemptions that allow the VPN's local DNS
@@ -39,6 +42,16 @@ type vpnDNSManager struct {
 	// Map of domain suffix → DNS servers for fast lookup
 	routes map[string][]string
 	logger *atomic.Pointer[ctrld.Logger]
+	// DNS servers from VPN interfaces that have no domain/suffix config.
+	// These are NOT added to the global OS resolver. They're only used
+	// as additional nameservers for queries that match split-DNS rules
+	// (from ctrld config, AD domain, or VPN suffix config).
+	domainlessServers []string
+	// retainedAfterEmptyDiscovery means Windows reported an empty VPN DNS
+	// snapshot once while previous VPN DNS state existed. We keep that last-known
+	// state for one guarded refresh cycle because Windows can briefly report an
+	// intermediate empty adapter/DNS state after sleep/wake or reconnect.
+	retainedAfterEmptyDiscovery bool
 	// Called when VPN DNS server list changes, to update intercept exemptions.
 	onServersChanged vpnDNSExemptFunc
 }
@@ -56,8 +69,9 @@ func newVPNDNSManager(logger *atomic.Pointer[ctrld.Logger], exemptFunc vpnDNSExe
 
 // Refresh re-discovers VPN DNS configs from the OS.
 // Called on network change events.
-func (m *vpnDNSManager) Refresh(ctx context.Context) {
+func (m *vpnDNSManager) Refresh(ctx context.Context, guardAgainstNoNameservers ...bool) {
 	logger := ctrld.LoggerFromCtx(ctx)
+	guardedRefresh := len(guardAgainstNoNameservers) > 0 && guardAgainstNoNameservers[0]
 
 	ctrld.Log(ctx, logger.Debug(), "Refreshing VPN DNS configurations")
 	configs := ctrld.DiscoverVPNDNS(ctx)
@@ -80,6 +94,29 @@ func (m *vpnDNSManager) Refresh(ctx context.Context) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
+	if vpnDNSSettlingEnabled && len(configs) == 0 && guardedRefresh && m.hasVPNDNSStateLocked() {
+		if !m.retainedAfterEmptyDiscovery {
+			exemptions := m.currentExemptionsLocked()
+			m.retainedAfterEmptyDiscovery = true
+			ctrld.Log(ctx, logger.Debug(),
+				"VPN DNS discovery empty; retaining last-known VPN DNS state for one guarded refresh (%d domainless servers, %d exemptions)",
+				len(m.domainlessServers), len(exemptions))
+			if m.onServersChanged != nil {
+				if err := m.onServersChanged(exemptions); err != nil {
+					ctrld.Log(ctx, logger.Error().Err(err), "Failed to re-apply retained VPN DNS exemptions")
+				}
+			}
+			return
+		}
+		ctrld.Log(ctx, logger.Debug(),
+			"VPN DNS discovery still empty on next guarded refresh; clearing retained VPN DNS state (%d domainless servers)",
+			len(m.domainlessServers))
+	}
+
+	// Any discovery path that does not return with retained state clears the
+	// settling marker: non-empty discovery replaces old servers immediately, and
+	// an unguarded/second empty discovery clears stale state below.
+	m.retainedAfterEmptyDiscovery = false
 	m.configs = configs
 	m.routes = make(map[string][]string)
 
@@ -122,8 +159,28 @@ func (m *vpnDNSManager) Refresh(ctx context.Context) {
 		}
 	}
 
-	ctrld.Log(ctx, logger.Debug(), "VPN DNS refresh completed: %d configs, %d routes, %d unique exemptions",
-		len(m.configs), len(m.routes), len(exemptions))
+	// Collect domain-less VPN DNS servers. These are NOT added to the global
+	// OS resolver (that would pollute captive portal / DHCP flows). Instead,
+	// they're stored separately and only used for queries that match existing
+	// split-DNS rules (from ctrld config, AD domain, or VPN suffix config).
+	var domainlessServers []string
+	seenDomainless := make(map[string]bool)
+	for _, config := range configs {
+		if len(config.Domains) == 0 && len(config.Servers) > 0 {
+			ctrld.Log(ctx, logger.Debug(), "VPN interface %s has DNS servers but no domains, storing as split-rule fallback: %v",
+				config.InterfaceName, config.Servers)
+			for _, server := range config.Servers {
+				if !seenDomainless[server] {
+					seenDomainless[server] = true
+					domainlessServers = append(domainlessServers, server)
+				}
+			}
+		}
+	}
+	m.domainlessServers = domainlessServers
+
+	ctrld.Log(ctx, logger.Debug(), "VPN DNS refresh completed: %d configs, %d routes, %d domainless servers, %d unique exemptions",
+		len(m.configs), len(m.routes), len(m.domainlessServers), len(exemptions))
 
 	// Update intercept rules to permit VPN DNS traffic.
 	// Always call onServersChanged — including when exemptions is empty — so that
@@ -135,6 +192,69 @@ func (m *vpnDNSManager) Refresh(ctx context.Context) {
 	}
 }
 
+func (m *vpnDNSManager) hasVPNDNSStateLocked() bool {
+	return len(m.configs) > 0 || len(m.routes) > 0 || len(m.domainlessServers) > 0
+}
+
+func (m *vpnDNSManager) currentExemptionsLocked() []vpnDNSExemption {
+	type key struct{ server, iface string }
+	seen := make(map[key]bool)
+	var exemptions []vpnDNSExemption
+	for _, config := range m.configs {
+		for _, server := range config.Servers {
+			k := key{server, config.InterfaceName}
+			if seen[k] {
+				continue
+			}
+			seen[k] = true
+			exemptions = append(exemptions, vpnDNSExemption{
+				Server:     server,
+				Interface:  config.InterfaceName,
+				IsExitMode: config.IsExitMode,
+			})
+		}
+	}
+	return exemptions
+}
+
+// ShouldFailClosedAfterVPNDNSTransportFailure reports whether split-rule
+// queries should fail closed instead of falling back to OS/public DNS after
+// every candidate VPN DNS server failed before returning a DNS packet. This is
+// Windows-only and only active while serving retained VPN DNS state from a
+// guarded empty discovery, which is the short window where Windows can report
+// VPN DNS before routes to those servers are usable after wake/reconnect.
+func (m *vpnDNSManager) ShouldFailClosedAfterVPNDNSTransportFailure(domain string, servers []string) bool {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	if !vpnDNSSettlingEnabled || len(servers) == 0 || !m.retainedAfterEmptyDiscovery || !m.hasVPNDNSStateLocked() {
+		return false
+	}
+
+	logger := m.logger.Load()
+	if logger != nil {
+		logger.Debug().Msgf(
+			"VPN DNS transport failed for %s while retained VPN DNS state is active; suppressing OS fallback for this query (servers=%v)",
+			domain, servers)
+	}
+	return true
+}
+
+// VPNDNSReachable records that a VPN DNS server returned a DNS response. The
+// response may be negative (NXDOMAIN/SERVFAIL); the important signal is that
+// the VPN DNS transport is reachable again.
+func (m *vpnDNSManager) VPNDNSReachable() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.retainedAfterEmptyDiscovery {
+		logger := m.logger.Load()
+		if logger != nil {
+			logger.Debug().Msg("VPN DNS transport recovered; clearing retained-empty-discovery state")
+		}
+	}
+	m.retainedAfterEmptyDiscovery = false
+}
+
 // UpstreamForDomain checks if the domain matches any VPN search domain.
 // Returns VPN DNS servers if matched, nil otherwise.
 // Uses suffix matching: "foo.provisur.local" matches "provisur.local"
@@ -165,6 +285,15 @@ func (m *vpnDNSManager) UpstreamForDomain(domain string) []string {
 	return nil
 }
 
+// DomainlessServers returns VPN DNS servers that have no associated domains.
+// These should only be used for queries matching split-DNS rules, not for
+// general OS resolver queries (to avoid polluting captive portal / DHCP flows).
+func (m *vpnDNSManager) DomainlessServers() []string {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	return append([]string{}, m.domainlessServers...)
+}
+
 // CurrentServers returns the current set of unique VPN DNS server IPs.
 // Used by pf anchor rebuild to include VPN DNS exemptions without a full Refresh().
 func (m *vpnDNSManager) CurrentServers() []string {
@@ -189,24 +318,7 @@ func (m *vpnDNSManager) CurrentServers() []string {
 func (m *vpnDNSManager) CurrentExemptions() []vpnDNSExemption {
 	m.mu.RLock()
 	defer m.mu.RUnlock()
-
-	type key struct{ server, iface string }
-	seen := make(map[key]bool)
-	var exemptions []vpnDNSExemption
-	for _, config := range m.configs {
-		for _, server := range config.Servers {
-			k := key{server, config.InterfaceName}
-			if !seen[k] {
-				seen[k] = true
-				exemptions = append(exemptions, vpnDNSExemption{
-					Server:     server,
-					Interface:  config.InterfaceName,
-					IsExitMode: config.IsExitMode,
-				})
-			}
-		}
-	}
-	return exemptions
+	return m.currentExemptionsLocked()
 }
 
 // Routes returns a copy of the current VPN DNS routes for debugging.

cmd/cli/vpn_dns_test.go

@@ -0,0 +1,88 @@
+package cli
+
+import (
+	"context"
+	"testing"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+func withVPNDNSSettlingEnabled(t *testing.T) {
+	t.Helper()
+	old := vpnDNSSettlingEnabled
+	vpnDNSSettlingEnabled = true
+	t.Cleanup(func() { vpnDNSSettlingEnabled = old })
+}
+
+func TestVPNDNSRefreshRetainsStateForOneGuardedEmptyDiscovery(t *testing.T) {
+	withVPNDNSSettlingEnabled(t)
+	var gotExemptions []vpnDNSExemption
+	m := newVPNDNSManager(&mainLog, func(exemptions []vpnDNSExemption) error {
+		gotExemptions = exemptions
+		return nil
+	})
+	m.configs = []ctrld.VPNDNSConfig{{
+		InterfaceName: "Ethernet 6",
+		Servers:       []string{"10.25.37.21", "10.25.37.22"},
+	}}
+	m.domainlessServers = []string{"10.25.37.21", "10.25.37.22"}
+
+	m.Refresh(context.Background(), true)
+
+	if got := m.DomainlessServers(); len(got) != 2 {
+		t.Fatalf("expected retained domainless servers, got %v", got)
+	}
+	if len(gotExemptions) != 2 {
+		t.Fatalf("expected retained exemptions to be re-applied, got %v", gotExemptions)
+	}
+	if !m.retainedAfterEmptyDiscovery {
+		t.Fatal("expected empty discovery retention to be marked")
+	}
+}
+
+func TestVPNDNSRefreshClearsOnSecondGuardedEmptyDiscovery(t *testing.T) {
+	withVPNDNSSettlingEnabled(t)
+	var gotExemptions []vpnDNSExemption
+	m := newVPNDNSManager(&mainLog, func(exemptions []vpnDNSExemption) error {
+		gotExemptions = exemptions
+		return nil
+	})
+	m.configs = []ctrld.VPNDNSConfig{{
+		InterfaceName: "Ethernet 6",
+		Servers:       []string{"10.25.37.21"},
+	}}
+	m.domainlessServers = []string{"10.25.37.21"}
+	m.retainedAfterEmptyDiscovery = true
+
+	m.Refresh(context.Background(), true)
+
+	if got := m.DomainlessServers(); len(got) != 0 {
+		t.Fatalf("expected domainless servers to be cleared on second empty discovery, got %v", got)
+	}
+	if len(gotExemptions) != 0 {
+		t.Fatalf("expected empty exemptions after clearing stale state, got %v", gotExemptions)
+	}
+	if m.retainedAfterEmptyDiscovery {
+		t.Fatal("expected retained empty-discovery marker to be cleared with stale state")
+	}
+}
+
+func TestVPNDNSTransportFailureSuppressesFallbackOnlyWhileRetainingState(t *testing.T) {
+	withVPNDNSSettlingEnabled(t)
+	m := newVPNDNSManager(&mainLog, nil)
+	m.domainlessServers = []string{"10.25.37.21"}
+
+	if m.ShouldFailClosedAfterVPNDNSTransportFailure("splunk.aws.arena.net.", []string{"10.25.37.21"}) {
+		t.Fatal("did not expect transport failure to suppress OS fallback outside retained empty-discovery state")
+	}
+
+	m.retainedAfterEmptyDiscovery = true
+	if !m.ShouldFailClosedAfterVPNDNSTransportFailure("splunk.aws.arena.net.", []string{"10.25.37.21"}) {
+		t.Fatal("expected transport failure to suppress OS fallback while retained state is active")
+	}
+
+	m.VPNDNSReachable()
+	if m.retainedAfterEmptyDiscovery {
+		t.Fatal("expected reachable DNS response to clear retained empty-discovery state")
+	}
+}