cmd/cli: ensure set/reset DNS is done before checking OS resolver

Otherwise, new DNS settings could be reverted by dns watchers, causing
the checking will be always false.

cmd/cli/dns_proxy.go

@@ -552,7 +552,7 @@ func (p *prog) proxy(ctx context.Context, req *proxyRequest) *proxyResponse {
 			continue
 		}
 		if p.um.isDown(upstreams[n]) {
-			ctrld.Log(ctx, mainLog.Load().Warn(), "%s is down", upstreams[n])
+			ctrld.Log(ctx, mainLog.Load().Debug(), "%s is down", upstreams[n])
 			continue
 		}
 		answer := resolve(n, upstreamConfig, req.msg)

cmd/cli/prog.go

@@ -728,7 +728,7 @@ func (p *prog) dnsWatchdog(iface *net.Interface, nameservers []string, allIfaces
 			mainLog.Load().Debug().Msg("stop dns watchdog")
 			return
 		case <-ticker.C:
-			if p.leakingQuery.Load() {
+			if p.leakingQuery.Load() || p.um.isChecking(upstreamOS) {
 				return
 			}
 			if dnsChanged(iface, ns) {

cmd/cli/resolvconf.go

@@ -40,7 +40,7 @@ func (p *prog) watchResolvConf(iface *net.Interface, ns []netip.Addr, setDnsFn f
 			mainLog.Load().Debug().Msgf("stopping watcher for %s", resolvConfPath)
 			return
 		case event, ok := <-watcher.Events:
-			if p.leakingQuery.Load() {
+			if p.leakingQuery.Load() || p.um.isChecking(upstreamOS) {
 				return
 			}
 			if !ok {

cmd/cli/upstream_monitor.go

@@ -60,6 +60,14 @@ func (um *upstreamMonitor) isDown(upstream string) bool {
 	return um.down[upstream]
 }
 
+// isChecking reports whether the given upstream is being checked.
+func (um *upstreamMonitor) isChecking(upstream string) bool {
+	um.mu.Lock()
+	defer um.mu.Unlock()
+
+	return um.checking[upstream]
+}
+
 // reset marks an upstream as up and set failed queries counter to zero.
 func (um *upstreamMonitor) reset(upstream string) {
 	um.mu.Lock()
@@ -86,9 +94,10 @@ func (p *prog) checkUpstream(upstream string, uc *ctrld.UpstreamConfig) {
 		p.um.mu.Unlock()
 	}()
 
-	if uc.Type == ctrld.ResolverTypeOS {
+	isOsResolver := uc.Type == ctrld.ResolverTypeOS
-		ns := ctrld.InitializeOsResolver()
+	if isOsResolver {
-		mainLog.Load().Debug().Msgf("re-initializing OS resolver with nameservers: %v", ns)
+		p.resetDNS()
+		defer p.setDNS()
 	}
 	resolver, err := ctrld.NewResolver(uc)
 	if err != nil {
@@ -105,12 +114,16 @@ func (p *prog) checkUpstream(upstream string, uc *ctrld.UpstreamConfig) {
 		ctx, cancel := context.WithTimeout(context.Background(), timeout)
 		defer cancel()
 		uc.ReBootstrap()
+		if isOsResolver {
+			ctrld.InitializeOsResolver()
+		}
 		_, err := resolver.Resolve(ctx, msg)
 		return err
 	}
+	mainLog.Load().Warn().Msgf("upstream %q is offline", uc.Endpoint)
 	for {
 		if err := check(); err == nil {
-			mainLog.Load().Debug().Msgf("upstream %q is online", uc.Endpoint)
+			mainLog.Load().Warn().Msgf("upstream %q is online", uc.Endpoint)
 			p.um.reset(upstream)
 			if p.leakingQuery.CompareAndSwap(true, false) {
 				p.leakingQueryMu.Lock()
@@ -120,7 +133,7 @@ func (p *prog) checkUpstream(upstream string, uc *ctrld.UpstreamConfig) {
 			}
 			return
 		} else {
-			mainLog.Load().Debug().Msgf("upstream %q is offline: %v", uc.Endpoint, err)
+			mainLog.Load().Debug().Msgf("checked upstream %q failed: %v", uc.Endpoint, err)
 		}
 		time.Sleep(checkUpstreamBackoffSleep)
 	}