scripts: fix wrong package path

Otherwise, actual hostname will be overriden with "localhost", which is
rather confusing/bad for UX.

.dockerignore

@@ -0,0 +1,2 @@
+Dockerfile
+.git/

README.md

@@ -9,6 +9,8 @@ A highly configurable DNS forwarding proxy with support for:
 - Multiple upstreams with fallbacks
 - Multiple network policy driven DNS query steering
 - Policy driven domain based "split horizon" DNS with wildcard support
+- Integrations with common router vendors and firmware
+- LAN client discovery via DHCP, mDNS, and ARP
 
 ## TLDR
 Proxy legacy DNS traffic to secure DNS upstreams in highly configurable ways. 
@@ -25,12 +27,14 @@ All DNS protocols are supported, including:
 2. Create source IP based DNS routing policies with variable secure DNS upstreams. Subnet 1 (admin) uses upstream resolver A, while Subnet 2 (employee) uses upstream resolver B.
 3. Create destination IP based DNS routing policies with variable secure DNS upstreams. Listener 1 uses upstream resolver C, while Listener 2 uses upstream resolver D.
 4. Create domain level "split horizon" DNS routing policies to send internal domains (*.company.int) to a local DNS server, while everything else goes to another upstream.
+5. Deploy on a router and create LAN client specific DNS routing policies from a web GUI (When using ControlD.com).
 
 
 ## OS Support
 - Windows (386, amd64, arm)
 - Mac (amd64, arm64)
 - Linux (386, amd64, arm, mips)
+- FreeBSD
 - Common routers (See Router Mode below)
 
 # Install
@@ -48,6 +52,11 @@ Windows user and prefer Powershell (who doesn't)? No problem, execute this comma
 powershell -Command "(Invoke-WebRequest -Uri 'https://api.controld.com/dl' -UseBasicParsing).Content | Set-Content 'ctrld_install.bat'" && ctrld_install.bat
 ```
 
+Or you can pull and run a Docker container from [Docker Hub](https://hub.docker.com/r/controldns/ctrld)
+```
+$ docker pull controldns/ctrld
+```
+
 ## Download Manually
 Alternatively, if you know what you're doing you can download pre-compiled binaries from the [Releases](https://github.com/Control-D-Inc/ctrld/releases) section for the appropriate platform. 
 
@@ -64,6 +73,13 @@ or
 $ go install github.com/Control-D-Inc/ctrld/cmd/ctrld@latest
 ```
 
+or 
+
+```
+$ docker build -t controldns/ctrld . -f docker/Dockerfile
+$ docker run -d --name=ctrld -p 53:53/tcp -p 53:53/udp controldns/ctrld --cd=RESOLVER_ID_GOES_HERE -vv
+```
+
 
 # Usage
 The cli is self documenting, so free free to run `--help` on any sub-command to get specific usages. 
@@ -85,16 +101,10 @@ Available Commands:
   service     Manage ctrld service
   start       Quick start service and configure DNS on interface
   stop        Quick stop service and remove DNS from interface
-  setup       Auto-setup Control D on a router.
-
-Supported platforms:
-
-    ₒ ddwrt
-    ₒ merlin
-    ₒ openwrt
-    ₒ ubios
-    ₒ auto - detect the platform you are running on
-
+  restart     Restart the ctrld service
+  status      Show status of the ctrld service
+  uninstall   Stop and uninstall the ctrld service
+  clients     Manage clients
 
 Flags:
   -h, --help            help for ctrld
@@ -122,49 +132,30 @@ To start the server with default configuration, simply run: `./ctrld run`. This
 If `verify.controld.com` resolves, you're successfully using the default Control D upstream. From here, you can start editing the config file and go nuts with it. To enforce a new config, restart the server. 
 
 ## Service Mode
-To run the application in service mode on any Windows, MacOS or Linux distibution, simply run: `./ctrld start` as system/root user. This will create a generic `ctrld.toml` file in the **user home** directory (on Windows) or `/etc/controld/` (everywhere else), start the system service, and configure the listener on the default network interface. Service will start on OS boot.
+To run the application in service mode on any Windows, MacOS, Linux distibution or supported router, simply run: `./ctrld start` as system/root user. This will create a generic `ctrld.toml` file in the **user home** directory (on Windows) or `/etc/controld/` (almost everywhere else), start the system service, and configure the listener on the default network interface. Service will start on OS boot.
 
-In order to stop the service, and restore your DNS to original state, simply run `./ctrld stop`. If you wish to uninstall the service permanently, run `./ctrld service uninstall`. 
+When Control D upstreams are used, `ctrld` willl [relay your network topology](https://docs.controld.com/docs/device-clients) to Control D (LAN IPs, MAC addresses, and hostnames), and you will be able to see your LAN devices in the web panel, view analytics and apply unique profiles to them. 
 
-For granular control of the service, run the `service` command. Each sub-command has its own help section so you can see what arguments you can supply.
+In order to stop the service, and restore your DNS to original state, simply run `./ctrld stop`. If you wish to stop and uninstall the service permanently, run `./ctrld uninstall`. 
 
-```
-  Manage ctrld service
 
-  Usage:
-    ctrld service [command]
-
-  Available Commands:
-    interfaces  Manage network interfaces
-    restart     Restart the ctrld service
-    start       Start the ctrld service
-    status      Show status of the ctrld service
-    stop        Stop the ctrld service
-    uninstall   Uninstall the ctrld service
-
-  Flags:
-    -h, --help   help for service
-
-  Global Flags:
-    -v, --verbose count   verbose log output, "-v" basic logging, "-vv" debug level logging
-
-  Use "ctrld service [command] --help" for more information about a command.
-```
-
-## Router Mode
+### Supported Routers
 You can run `ctrld` on any supported router, which will function similarly to the Service Mode mentioned above. The list of supported routers and firmware includes:
-- OpenWRT
-- DD-WRT
 - Asus Merlin
+- DD-WRT
+- Firewalla
+- FreshTomato
 - GL.iNet
-- Ubiquiti
+- OpenWRT
+- pfSense / OPNsense
+- Synology 
+- Ubiquiti (UniFi, EdgeOS)
 
-In order to start `ctrld` as a DNS provider, simply run `./ctrld setup auto` command. 
+`ctrld` will attempt to interface with dnsmasq whenever possible and set itself as the upstream, while running on port 5354. On FreeBSD based OSes, `ctrld` will terminate dnsmasq and unbound in order to be able to listen on port 53 directly.  
 
-In this mode, and when Control D upstreams are used, the router will [relay your network topology](https://docs.controld.com/docs/device-clients) to Control D (LAN IPs, MAC addresses, and hostnames), and you will be able to see your LAN devices in the web panel, view analytics and apply unique profiles to them. 
 
 ### Control D Auto Configuration
-Application can be started with a specific resolver config, instead of the default one. Simply supply your Resolver ID with a `--cd` flag, when using the `run` (foreground) or `start` (service) or `setup` (router) modes. 
+Application can be started with a specific resolver config, instead of the default one. Simply supply your Resolver ID with a `--cd` flag, when using the `run` (foreground) or `start` (service) modes. 
 
 The following command will start the application in foreground mode, using the free "p2" resolver, which blocks Ads & Trackers. 
 
@@ -178,14 +169,9 @@ Alternatively, you can use your own personal Control D Device resolver, and star
 ./ctrld start --cd abcd1234
 ```
 
-You can do the same while starting in router mode:
-```shell
-./ctrld setup auto --cd abcd1234
-```
-
-Once you run the above commands (in service or router modes only), the following things will happen:
+Once you run the above commands (in service mode only), the following things will happen:
 - You resolver configuration will be fetched from the API, and config file templated with the resolver data
-- Application will start as a service, and keep running (even after reboot) until you run the `stop` or `service uninstall` sub-commands
+- Application will start as a service, and keep running (even after reboot) until you run the `stop` or `uninstall` sub-commands
 - Your default network interface will be updated to use the listener started by the service
 - All OS DNS queries will be sent to the listener
 
@@ -202,8 +188,8 @@ See [Configuration Docs](docs/config.md).
 [listener]
 
   [listener.0]
-    ip = "127.0.0.1"
-    port = 53
+    ip = ""
+    port = 0
     restricted = false
 
 [network]
@@ -234,6 +220,8 @@ See [Configuration Docs](docs/config.md).
 
 ```
 
+`ctrld` will pick a working config for `listener.0` then writing the default config to disk for the first run.
+
 ## Advanced Configuration
 The above is the most basic example, which will work out of the box. If you're looking to do advanced configurations using policies, see [Configuration Docs](docs/config.md) for complete documentation of the config file.
 
@@ -246,4 +234,5 @@ See [Contribution Guideline](./docs/contributing.md)
 The following functionality is on the roadmap and will be available in future releases. 
 - Prometheus metrics exporter 
 - DNS intercept mode
+- Direct listener mode
 - Support for more routers (let us know which ones)

client_info.go

@@ -8,4 +8,13 @@ type ClientInfo struct {
 	Mac      string
 	IP       string
 	Hostname string
+	Self     bool
 }
+
+// LeaseFileFormat specifies the format of DHCP lease file.
+type LeaseFileFormat string
+
+const (
+	Dnsmasq  LeaseFileFormat = "dnsmasq"
+	IscDhcpd LeaseFileFormat = "isc-dhcpd"
+)

cmd/cli/cli_test.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"os"

cmd/cli/conn.go

@@ -0,0 +1,51 @@
+package cli
+
+import (
+	"net"
+	"time"
+)
+
+// logConn wraps a net.Conn, override the Write behavior.
+// runCmd uses this wrapper, so as long as startCmd finished,
+// ctrld log won't be flushed with un-necessary write errors.
+type logConn struct {
+	conn net.Conn
+}
+
+func (lc *logConn) Read(b []byte) (n int, err error) {
+	return lc.conn.Read(b)
+}
+
+func (lc *logConn) Close() error {
+	return lc.conn.Close()
+}
+
+func (lc *logConn) LocalAddr() net.Addr {
+	return lc.conn.LocalAddr()
+}
+
+func (lc *logConn) RemoteAddr() net.Addr {
+	return lc.conn.RemoteAddr()
+}
+
+func (lc *logConn) SetDeadline(t time.Time) error {
+	return lc.conn.SetDeadline(t)
+}
+
+func (lc *logConn) SetReadDeadline(t time.Time) error {
+	return lc.conn.SetReadDeadline(t)
+}
+
+func (lc *logConn) SetWriteDeadline(t time.Time) error {
+	return lc.conn.SetWriteDeadline(t)
+}
+
+func (lc *logConn) Write(b []byte) (int, error) {
+	// Write performs writes with underlying net.Conn, ignore any errors happen.
+	// "ctrld run" command use this wrapper to report errors to "ctrld start".
+	// If no error occurred, "ctrld start" may finish before "ctrld run" attempt
+	// to close the connection, so ignore errors conservatively here, prevent
+	// un-necessary error "write to closed connection" flushed to ctrld log.
+	_, _ = lc.conn.Write(b)
+	return len(b), nil
+}

cmd/cli/control_client.go

@@ -0,0 +1,29 @@
+package cli
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"time"
+)
+
+type controlClient struct {
+	c *http.Client
+}
+
+func newControlClient(addr string) *controlClient {
+	return &controlClient{c: &http.Client{
+		Transport: &http.Transport{
+			DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+				d := net.Dialer{}
+				return d.DialContext(ctx, "unix", addr)
+			},
+		},
+		Timeout: time.Second * 30,
+	}}
+}
+
+func (c *controlClient) post(path string, data io.Reader) (*http.Response, error) {
+	return c.c.Post("http://unix"+path, contentTypeJson, data)
+}

cmd/cli/control_server.go

@@ -0,0 +1,85 @@
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"net/http"
+	"os"
+	"sort"
+	"time"
+)
+
+const (
+	contentTypeJson = "application/json"
+	listClientsPath = "/clients"
+	startedPath     = "/started"
+)
+
+type controlServer struct {
+	server *http.Server
+	mux    *http.ServeMux
+	addr   string
+}
+
+func newControlServer(addr string) (*controlServer, error) {
+	mux := http.NewServeMux()
+	s := &controlServer{
+		server: &http.Server{Handler: mux},
+		mux:    mux,
+	}
+	s.addr = addr
+	return s, nil
+}
+
+func (s *controlServer) start() error {
+	_ = os.Remove(s.addr)
+	unixListener, err := net.Listen("unix", s.addr)
+	if l, ok := unixListener.(*net.UnixListener); ok {
+		l.SetUnlinkOnClose(true)
+	}
+	if err != nil {
+		return err
+	}
+	go s.server.Serve(unixListener)
+	return nil
+}
+
+func (s *controlServer) stop() error {
+	_ = os.Remove(s.addr)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*2)
+	defer cancel()
+	return s.server.Shutdown(ctx)
+}
+
+func (s *controlServer) register(pattern string, handler http.Handler) {
+	s.mux.Handle(pattern, jsonResponse(handler))
+}
+
+func (p *prog) registerControlServerHandler() {
+	p.cs.register(listClientsPath, http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		clients := p.ciTable.ListClients()
+		sort.Slice(clients, func(i, j int) bool {
+			return clients[i].IP.Less(clients[j].IP)
+		})
+		if err := json.NewEncoder(w).Encode(&clients); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	}))
+	p.cs.register(startedPath, http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		select {
+		case <-p.onStartedDone:
+			w.WriteHeader(http.StatusOK)
+		case <-time.After(10 * time.Second):
+			w.WriteHeader(http.StatusRequestTimeout)
+		}
+	}))
+}
+
+func jsonResponse(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		next.ServeHTTP(w, r)
+	})
+}

cmd/cli/control_server_test.go

@@ -0,0 +1,54 @@
+package cli
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"os"
+	"testing"
+)
+
+func TestControlServer(t *testing.T) {
+	f, err := os.CreateTemp("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(f.Name())
+	f.Close()
+
+	s, err := newControlServer(f.Name())
+	if err != nil {
+		t.Fatal(err)
+	}
+	pattern := "/ping"
+	respBody := []byte("pong")
+	s.register(pattern, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write(respBody)
+	}))
+	if err := s.start(); err != nil {
+		t.Fatal(err)
+	}
+
+	c := newControlClient(f.Name())
+	resp, err := c.post(pattern, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		t.Fatalf("unepxected response code: %d", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("content-type"); ct != contentTypeJson {
+		t.Fatalf("unexpected content type: %s", ct)
+	}
+	buf, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(buf, respBody) {
+		t.Errorf("unexpected response body, want: %q, got: %q", string(respBody), string(buf))
+	}
+	if err := s.stop(); err != nil {
+		t.Fatal(err)
+	}
+}

cmd/cli/dns.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 //lint:ignore U1000 use in os_linux.go
 type getDNS func(iface string) []string

cmd/cli/dns_proxy.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"context"
@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net"
+	"net/netip"
 	"runtime"
 	"strconv"
 	"strings"
@@ -14,11 +15,12 @@ import (
 
 	"github.com/miekg/dns"
 	"golang.org/x/sync/errgroup"
+	"tailscale.com/net/interfaces"
+	"tailscale.com/net/netaddr"
 
 	"github.com/Control-D-Inc/ctrld"
 	"github.com/Control-D-Inc/ctrld/internal/dnscache"
 	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
-	"github.com/Control-D-Inc/ctrld/internal/router"
 )
 
 const (
@@ -39,7 +41,7 @@ func (p *prog) serveDNS(listenerNum string) error {
 	listenerConfig := p.cfg.Listener[listenerNum]
 	// make sure ip is allocated
 	if allocErr := p.allocateIP(listenerConfig.IP); allocErr != nil {
-		mainLog.Error().Err(allocErr).Str("ip", listenerConfig.IP).Msg("serveUDP: failed to allocate listen ip")
+		mainLog.Load().Error().Err(allocErr).Str("ip", listenerConfig.IP).Msg("serveUDP: failed to allocate listen ip")
 		return allocErr
 	}
 	var failoverRcodes []int
@@ -47,26 +49,31 @@ func (p *prog) serveDNS(listenerNum string) error {
 		failoverRcodes = listenerConfig.Policy.FailoverRcodeNumbers
 	}
 	handler := dns.HandlerFunc(func(w dns.ResponseWriter, m *dns.Msg) {
+		p.sema.acquire()
+		defer p.sema.release()
+		go p.detectLoop(m)
 		q := m.Question[0]
 		domain := canonicalName(q.Name)
 		reqId := requestID()
-		fmtSrcToDest := fmtRemoteToLocal(listenerNum, w.RemoteAddr().String(), w.LocalAddr().String())
+		remoteIP, _, _ := net.SplitHostPort(w.RemoteAddr().String())
+		ci := p.getClientInfo(remoteIP, m)
+		remoteAddr := spoofRemoteAddr(w.RemoteAddr(), ci)
+		fmtSrcToDest := fmtRemoteToLocal(listenerNum, remoteAddr.String(), w.LocalAddr().String())
 		t := time.Now()
 		ctx := context.WithValue(context.Background(), ctrld.ReqIdCtxKey{}, reqId)
-		ctrld.Log(ctx, mainLog.Debug(), "%s received query: %s %s", fmtSrcToDest, dns.TypeToString[q.Qtype], domain)
-		upstreams, matched := p.upstreamFor(ctx, listenerNum, listenerConfig, w.RemoteAddr(), domain)
+		ctrld.Log(ctx, mainLog.Load().Debug(), "%s received query: %s %s", fmtSrcToDest, dns.TypeToString[q.Qtype], domain)
+		upstreams, matched := p.upstreamFor(ctx, listenerNum, listenerConfig, remoteAddr, domain)
 		var answer *dns.Msg
 		if !matched && listenerConfig.Restricted {
 			answer = new(dns.Msg)
 			answer.SetRcode(m, dns.RcodeRefused)
-
 		} else {
-			answer = p.proxy(ctx, upstreams, failoverRcodes, m)
+			answer = p.proxy(ctx, upstreams, failoverRcodes, m, ci)
 			rtt := time.Since(t)
-			ctrld.Log(ctx, mainLog.Debug(), "received response of %d bytes in %s", answer.Len(), rtt)
+			ctrld.Log(ctx, mainLog.Load().Debug(), "received response of %d bytes in %s", answer.Len(), rtt)
 		}
 		if err := w.WriteMsg(answer); err != nil {
-			ctrld.Log(ctx, mainLog.Error().Err(err), "serveUDP: failed to send DNS response to client")
+			ctrld.Log(ctx, mainLog.Load().Error().Err(err), "serveUDP: failed to send DNS response to client")
 		}
 	})
 
@@ -78,32 +85,55 @@ func (p *prog) serveDNS(listenerNum string) error {
 				s, errCh := runDNSServer(net.JoinHostPort("::1", strconv.Itoa(listenerConfig.Port)), proto, handler)
 				defer s.Shutdown()
 				select {
+				case <-p.stopCh:
 				case <-ctx.Done():
 				case err := <-errCh:
 					// Local ipv6 listener should not terminate ctrld.
 					// It's a workaround for a quirk on Windows.
-					mainLog.Warn().Err(err).Msg("local ipv6 listener failed")
+					mainLog.Load().Warn().Err(err).Msg("local ipv6 listener failed")
+				}
+				return nil
+			})
+		}
+		// When we spawn a listener on 127.0.0.1, also spawn listeners on the RFC1918
+		// addresses of the machine. So ctrld could receive queries from LAN clients.
+		if needRFC1918Listeners(listenerConfig) {
+			g.Go(func() error {
+				for _, addr := range rfc1918Addresses() {
+					func() {
+						listenAddr := net.JoinHostPort(addr, strconv.Itoa(listenerConfig.Port))
+						s, errCh := runDNSServer(listenAddr, proto, handler)
+						defer s.Shutdown()
+						select {
+						case <-p.stopCh:
+						case <-ctx.Done():
+						case err := <-errCh:
+							// RFC1918 listener should not terminate ctrld.
+							// It's a workaround for a quirk on system with systemd-resolved.
+							mainLog.Load().Warn().Err(err).Msgf("could not listen on %s: %s", proto, listenAddr)
+						}
+					}()
 				}
 				return nil
 			})
 		}
 		g.Go(func() error {
-			s, errCh := runDNSServer(dnsListenAddress(listenerNum, listenerConfig), proto, handler)
+			addr := net.JoinHostPort(listenerConfig.IP, strconv.Itoa(listenerConfig.Port))
+			s, errCh := runDNSServer(addr, proto, handler)
 			defer s.Shutdown()
-			if listenerConfig.Port == 0 {
-				switch s.Net {
-				case "udp":
-					mainLog.Info().Msgf("Random port chosen for udp listener.%s: %s", listenerNum, s.PacketConn.LocalAddr())
-				case "tcp":
-					mainLog.Info().Msgf("Random port chosen for tcp listener.%s: %s", listenerNum, s.Listener.Addr())
-				}
+			select {
+			case err := <-errCh:
+				return err
+			case <-time.After(5 * time.Second):
+				p.started <- struct{}{}
 			}
 			select {
+			case <-p.stopCh:
 			case <-ctx.Done():
-				return nil
 			case err := <-errCh:
 				return err
 			}
+			return nil
 		})
 	}
 	return g.Wait()
@@ -117,7 +147,7 @@ func (p *prog) serveDNS(listenerNum string) error {
 // processed later, because policy logging want to know whether a network rule
 // is disregarded in favor of the domain level rule.
 func (p *prog) upstreamFor(ctx context.Context, defaultUpstreamNum string, lc *ctrld.ListenerConfig, addr net.Addr, domain string) ([]string, bool) {
-	upstreams := []string{"upstream." + defaultUpstreamNum}
+	upstreams := []string{upstreamPrefix + defaultUpstreamNum}
 	matchedPolicy := "no policy"
 	matchedNetwork := "no network"
 	matchedRule := "no rule"
@@ -125,10 +155,14 @@ func (p *prog) upstreamFor(ctx context.Context, defaultUpstreamNum string, lc *c
 
 	defer func() {
 		if !matched && lc.Restricted {
-			ctrld.Log(ctx, mainLog.Info(), "query refused, %s does not match any network policy", addr.String())
+			ctrld.Log(ctx, mainLog.Load().Info(), "query refused, %s does not match any network policy", addr.String())
 			return
 		}
-		ctrld.Log(ctx, mainLog.Info(), "%s, %s, %s -> %v", matchedPolicy, matchedNetwork, matchedRule, upstreams)
+		if matched {
+			ctrld.Log(ctx, mainLog.Load().Info(), "%s, %s, %s -> %v", matchedPolicy, matchedNetwork, matchedRule, upstreams)
+		} else {
+			ctrld.Log(ctx, mainLog.Load().Info(), "no explicit policy matched, using default routing -> %v", upstreams)
+		}
 	}()
 
 	if lc.Policy == nil {
@@ -191,13 +225,13 @@ networkRules:
 	return upstreams, matched
 }
 
-func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []int, msg *dns.Msg) *dns.Msg {
+func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []int, msg *dns.Msg, ci *ctrld.ClientInfo) *dns.Msg {
 	var staleAnswer *dns.Msg
 	serveStaleCache := p.cache != nil && p.cfg.Service.CacheServeStale
 	upstreamConfigs := p.upstreamConfigsFromUpstreamNumbers(upstreams)
 	if len(upstreamConfigs) == 0 {
 		upstreamConfigs = []*ctrld.UpstreamConfig{osUpstreamConfig}
-		upstreams = []string{"upstream.os"}
+		upstreams = []string{upstreamOS}
 	}
 	// Inverse query should not be cached: https://www.rfc-editor.org/rfc/rfc1035#section-7.4
 	if p.cache != nil && msg.Question[0].Qtype != dns.TypePTR {
@@ -210,7 +244,7 @@ func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []i
 			answer.SetRcode(msg, answer.Rcode)
 			now := time.Now()
 			if cachedValue.Expire.After(now) {
-				ctrld.Log(ctx, mainLog.Debug(), "hit cached response")
+				ctrld.Log(ctx, mainLog.Load().Debug(), "hit cached response")
 				setCachedAnswerTTL(answer, now, cachedValue.Expire)
 				return answer
 			}
@@ -218,10 +252,10 @@ func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []i
 		}
 	}
 	resolve1 := func(n int, upstreamConfig *ctrld.UpstreamConfig, msg *dns.Msg) (*dns.Msg, error) {
-		ctrld.Log(ctx, mainLog.Debug(), "sending query to %s: %s", upstreams[n], upstreamConfig.Name)
+		ctrld.Log(ctx, mainLog.Load().Debug(), "sending query to %s: %s", upstreams[n], upstreamConfig.Name)
 		dnsResolver, err := ctrld.NewResolver(upstreamConfig)
 		if err != nil {
-			ctrld.Log(ctx, mainLog.Error().Err(err), "failed to create resolver")
+			ctrld.Log(ctx, mainLog.Load().Error().Err(err), "failed to create resolver")
 			return nil, err
 		}
 		resolveCtx, cancel := context.WithCancel(ctx)
@@ -234,24 +268,19 @@ func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []i
 		return dnsResolver.Resolve(resolveCtx, msg)
 	}
 	resolve := func(n int, upstreamConfig *ctrld.UpstreamConfig, msg *dns.Msg) *dns.Msg {
-		if upstreamConfig.UpstreamSendClientInfo() {
-			ci := router.GetClientInfoByMac(macFromMsg(msg))
-			if ci != nil {
-				ctrld.Log(ctx, mainLog.Debug(), "including client info with the request")
-				ctx = context.WithValue(ctx, ctrld.ClientInfoCtxKey{}, ci)
-			}
+		if upstreamConfig.UpstreamSendClientInfo() && ci != nil {
+			ctrld.Log(ctx, mainLog.Load().Debug(), "including client info with the request")
+			ctx = context.WithValue(ctx, ctrld.ClientInfoCtxKey{}, ci)
 		}
 		answer, err := resolve1(n, upstreamConfig, msg)
-		// Only do re-bootstrapping if bootstrap ip is not explicitly set by user.
-		if err != nil && upstreamConfig.BootstrapIP == "" {
-			ctrld.Log(ctx, mainLog.Debug().Err(err), "could not resolve query on first attempt, retrying...")
-			// If any error occurred, re-bootstrap transport/ip, retry the request.
-			upstreamConfig.ReBootstrap()
-			answer, err = resolve1(n, upstreamConfig, msg)
-			if err == nil {
-				return answer
+		if err != nil {
+			ctrld.Log(ctx, mainLog.Load().Error().Err(err), "failed to resolve query")
+			if errNetworkError(err) {
+				p.um.increaseFailureCount(upstreams[n])
+				if p.um.isDown(upstreams[n]) {
+					go p.um.checkUpstream(upstreams[n], upstreamConfig)
+				}
 			}
-			ctrld.Log(ctx, mainLog.Error().Err(err), "failed to resolve query")
 			return nil
 		}
 		return answer
@@ -260,10 +289,18 @@ func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []i
 		if upstreamConfig == nil {
 			continue
 		}
+		if p.isLoop(upstreamConfig) {
+			mainLog.Load().Warn().Msgf("dns loop detected, upstream: %q, endpoint: %q", upstreamConfig.Name, upstreamConfig.Endpoint)
+			continue
+		}
+		if p.um.isDown(upstreams[n]) {
+			ctrld.Log(ctx, mainLog.Load().Warn(), "%s is down", upstreams[n])
+			continue
+		}
 		answer := resolve(n, upstreamConfig, msg)
 		if answer == nil {
 			if serveStaleCache && staleAnswer != nil {
-				ctrld.Log(ctx, mainLog.Debug(), "serving stale cached response")
+				ctrld.Log(ctx, mainLog.Load().Debug(), "serving stale cached response")
 				now := time.Now()
 				setCachedAnswerTTL(staleAnswer, now, now.Add(staleTTL))
 				return staleAnswer
@@ -271,7 +308,7 @@ func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []i
 			continue
 		}
 		if answer.Rcode != dns.RcodeSuccess && len(upstreamConfigs) > 1 && containRcode(failoverRcodes, answer.Rcode) {
-			ctrld.Log(ctx, mainLog.Debug(), "failover rcode matched, process to next upstream")
+			ctrld.Log(ctx, mainLog.Load().Debug(), "failover rcode matched, process to next upstream")
 			continue
 		}
 
@@ -287,11 +324,11 @@ func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []i
 			}
 			setCachedAnswerTTL(answer, now, expired)
 			p.cache.Add(dnscache.NewKey(msg, upstreams[n]), dnscache.NewValue(answer, expired))
-			ctrld.Log(ctx, mainLog.Debug(), "add cached response")
+			ctrld.Log(ctx, mainLog.Load().Debug(), "add cached response")
 		}
 		return answer
 	}
-	ctrld.Log(ctx, mainLog.Error(), "all upstreams failed")
+	ctrld.Log(ctx, mainLog.Load().Error(), "all %v endpoints failed", upstreams)
 	answer := new(dns.Msg)
 	answer.SetRcode(msg, dns.RcodeServerFailure)
 	return answer
@@ -300,7 +337,7 @@ func (p *prog) proxy(ctx context.Context, upstreams []string, failoverRcodes []i
 func (p *prog) upstreamConfigsFromUpstreamNumbers(upstreams []string) []*ctrld.UpstreamConfig {
 	upstreamConfigs := make([]*ctrld.UpstreamConfig, 0, len(upstreams))
 	for _, upstream := range upstreams {
-		upstreamNum := strings.TrimPrefix(upstream, "upstream.")
+		upstreamNum := strings.TrimPrefix(upstream, upstreamPrefix)
 		upstreamConfigs = append(upstreamConfigs, p.cfg.Upstream[upstreamNum])
 	}
 	return upstreamConfigs
@@ -397,25 +434,46 @@ func needLocalIPv6Listener() bool {
 	return ctrldnet.SupportsIPv6ListenLocal() && runtime.GOOS == "windows"
 }
 
-func dnsListenAddress(lcNum string, lc *ctrld.ListenerConfig) string {
-	if addr := router.ListenAddress(); setupRouter && addr != "" && lcNum == "0" {
-		return addr
-	}
-	return net.JoinHostPort(lc.IP, strconv.Itoa(lc.Port))
-}
-
-func macFromMsg(msg *dns.Msg) string {
+// ipAndMacFromMsg extracts IP and MAC information included in a DNS message, if any.
+func ipAndMacFromMsg(msg *dns.Msg) (string, string) {
+	ip, mac := "", ""
 	if opt := msg.IsEdns0(); opt != nil {
 		for _, s := range opt.Option {
 			switch e := s.(type) {
 			case *dns.EDNS0_LOCAL:
 				if e.Code == EDNS0_OPTION_MAC {
-					return net.HardwareAddr(e.Data).String()
+					mac = net.HardwareAddr(e.Data).String()
+				}
+			case *dns.EDNS0_SUBNET:
+				if len(e.Address) > 0 && !e.Address.IsLoopback() {
+					ip = e.Address.String()
 				}
 			}
 		}
 	}
-	return ""
+	return ip, mac
+}
+
+func spoofRemoteAddr(addr net.Addr, ci *ctrld.ClientInfo) net.Addr {
+	if ci != nil && ci.IP != "" {
+		switch addr := addr.(type) {
+		case *net.UDPAddr:
+			udpAddr := &net.UDPAddr{
+				IP:   net.ParseIP(ci.IP),
+				Port: addr.Port,
+				Zone: addr.Zone,
+			}
+			return udpAddr
+		case *net.TCPAddr:
+			udpAddr := &net.TCPAddr{
+				IP:   net.ParseIP(ci.IP),
+				Port: addr.Port,
+				Zone: addr.Zone,
+			}
+			return udpAddr
+		}
+	}
+	return addr
 }
 
 // runDNSServer starts a DNS server for given address and network,
@@ -439,10 +497,98 @@ func runDNSServer(addr, network string, handler dns.Handler) (*dns.Server, <-cha
 		defer close(errCh)
 		if err := s.ListenAndServe(); err != nil {
 			waitLock.Unlock()
-			mainLog.Error().Err(err).Msgf("could not listen and serve on: %s", s.Addr)
+			mainLog.Load().Error().Err(err).Msgf("could not listen and serve on: %s", s.Addr)
 			errCh <- err
 		}
 	}()
 	waitLock.Lock()
 	return s, errCh
 }
+
+func (p *prog) getClientInfo(remoteIP string, msg *dns.Msg) *ctrld.ClientInfo {
+	ci := &ctrld.ClientInfo{}
+	if p.appCallback != nil {
+		ci.IP = p.appCallback.LanIp()
+		ci.Mac = p.appCallback.MacAddress()
+		ci.Hostname = p.appCallback.HostName()
+		ci.Self = true
+		return ci
+	}
+	ci.IP, ci.Mac = ipAndMacFromMsg(msg)
+	switch {
+	case ci.IP != "" && ci.Mac != "":
+		// Nothing to do.
+	case ci.IP == "" && ci.Mac != "":
+		// Have MAC, no IP.
+		ci.IP = p.ciTable.LookupIP(ci.Mac)
+	case ci.IP == "" && ci.Mac == "":
+		// Have nothing, use remote IP then lookup MAC.
+		ci.IP = remoteIP
+		fallthrough
+	case ci.IP != "" && ci.Mac == "":
+		// Have IP, no MAC.
+		ci.Mac = p.ciTable.LookupMac(ci.IP)
+	}
+
+	// If MAC is still empty here, that mean the requests are made from virtual interface,
+	// like VPN/Wireguard clients, so we use whatever MAC address associated with remoteIP
+	// (most likely 127.0.0.1), and ci.IP as hostname, so we can distinguish those clients.
+	if ci.Mac == "" {
+		ci.Mac = p.ciTable.LookupMac(remoteIP)
+		if hostname := p.ciTable.LookupHostname(ci.IP, ""); hostname != "" {
+			ci.Hostname = hostname
+		} else {
+			ci.Hostname = ci.IP
+			p.ciTable.StoreVPNClient(ci)
+		}
+	} else {
+		ci.Hostname = p.ciTable.LookupHostname(ci.IP, ci.Mac)
+	}
+	ci.Self = queryFromSelf(ci.IP)
+	return ci
+}
+
+// queryFromSelf reports whether the input IP is from device running ctrld.
+func queryFromSelf(ip string) bool {
+	netIP := netip.MustParseAddr(ip)
+	ifaces, err := interfaces.GetList()
+	if err != nil {
+		mainLog.Load().Warn().Err(err).Msg("could not get interfaces list")
+		return false
+	}
+	for _, iface := range ifaces {
+		addrs, err := iface.Addrs()
+		if err != nil {
+			mainLog.Load().Warn().Err(err).Msgf("could not get interfaces addresses: %s", iface.Name)
+			continue
+		}
+		for _, a := range addrs {
+			switch v := a.(type) {
+			case *net.IPNet:
+				if pfx, ok := netaddr.FromStdIPNet(v); ok && pfx.Addr().Compare(netIP) == 0 {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+func needRFC1918Listeners(lc *ctrld.ListenerConfig) bool {
+	return lc.IP == "127.0.0.1" && lc.Port == 53
+}
+
+func rfc1918Addresses() []string {
+	var res []string
+	interfaces.ForeachInterface(func(i interfaces.Interface, prefixes []netip.Prefix) {
+		addrs, _ := i.Addrs()
+		for _, addr := range addrs {
+			ipNet, ok := addr.(*net.IPNet)
+			if !ok || !ipNet.IP.IsPrivate() {
+				continue
+			}
+			res = append(res, ipNet.IP.String())
+		}
+	})
+	return res
+}

cmd/cli/dns_proxy_test.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"context"
@@ -149,44 +149,87 @@ func TestCache(t *testing.T) {
 	answer2.SetRcode(msg, dns.RcodeRefused)
 	prog.cache.Add(dnscache.NewKey(msg, "upstream.0"), dnscache.NewValue(answer2, time.Now().Add(time.Minute)))
 
-	got1 := prog.proxy(context.Background(), []string{"upstream.1"}, nil, msg)
-	got2 := prog.proxy(context.Background(), []string{"upstream.0"}, nil, msg)
+	got1 := prog.proxy(context.Background(), []string{"upstream.1"}, nil, msg, nil)
+	got2 := prog.proxy(context.Background(), []string{"upstream.0"}, nil, msg, nil)
 	assert.NotSame(t, got1, got2)
 	assert.Equal(t, answer1.Rcode, got1.Rcode)
 	assert.Equal(t, answer2.Rcode, got2.Rcode)
 }
 
-func Test_macFromMsg(t *testing.T) {
+func Test_ipAndMacFromMsg(t *testing.T) {
 	tests := []struct {
 		name    string
+		ip      string
+		wantIp  bool
 		mac     string
 		wantMac bool
 	}{
-		{"has mac", "4c:20:b8:ab:87:1b", true},
-		{"no mac", "4c:20:b8:ab:87:1b", false},
+		{"has ip v4 and mac", "1.2.3.4", true, "4c:20:b8:ab:87:1b", true},
+		{"has ip v6 and mac", "2606:1a40:3::1", true, "4c:20:b8:ab:87:1b", true},
+		{"no ip", "1.2.3.4", false, "4c:20:b8:ab:87:1b", false},
+		{"no mac", "1.2.3.4", false, "4c:20:b8:ab:87:1b", false},
 	}
 	for _, tc := range tests {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
+			ip := net.ParseIP(tc.ip)
+			if ip == nil {
+				t.Fatal("missing IP")
+			}
 			hw, err := net.ParseMAC(tc.mac)
 			if err != nil {
 				t.Fatal(err)
 			}
 			m := new(dns.Msg)
-			m.SetQuestion(selfCheckFQDN+".", dns.TypeA)
+			m.SetQuestion("example.com.", dns.TypeA)
 			o := &dns.OPT{Hdr: dns.RR_Header{Name: ".", Rrtype: dns.TypeOPT}}
 			if tc.wantMac {
 				ec1 := &dns.EDNS0_LOCAL{Code: EDNS0_OPTION_MAC, Data: hw}
 				o.Option = append(o.Option, ec1)
 			}
-			m.Extra = append(m.Extra, o)
-			got := macFromMsg(m)
-			if tc.wantMac && got != tc.mac {
-				t.Errorf("mismatch, want: %q, got: %q", tc.mac, got)
+			if tc.wantIp {
+				ec2 := &dns.EDNS0_SUBNET{Address: ip}
+				o.Option = append(o.Option, ec2)
 			}
-			if !tc.wantMac && got != "" {
-				t.Errorf("unexpected mac: %q", got)
+			m.Extra = append(m.Extra, o)
+			gotIP, gotMac := ipAndMacFromMsg(m)
+			if tc.wantMac && gotMac != tc.mac {
+				t.Errorf("mismatch, want: %q, got: %q", tc.mac, gotMac)
+			}
+			if !tc.wantMac && gotMac != "" {
+				t.Errorf("unexpected mac: %q", gotMac)
+			}
+			if tc.wantIp && gotIP != tc.ip {
+				t.Errorf("mismatch, want: %q, got: %q", tc.ip, gotIP)
+			}
+			if !tc.wantIp && gotIP != "" {
+				t.Errorf("unexpected ip: %q", gotIP)
+			}
+		})
+	}
+}
+
+func Test_remoteAddrFromMsg(t *testing.T) {
+	loopbackIP := net.ParseIP("127.0.0.1")
+	tests := []struct {
+		name string
+		addr net.Addr
+		ci   *ctrld.ClientInfo
+		want string
+	}{
+		{"tcp", &net.TCPAddr{IP: loopbackIP, Port: 12345}, &ctrld.ClientInfo{IP: "192.168.1.10"}, "192.168.1.10:12345"},
+		{"udp", &net.UDPAddr{IP: loopbackIP, Port: 12345}, &ctrld.ClientInfo{IP: "192.168.1.11"}, "192.168.1.11:12345"},
+		{"nil client info", &net.UDPAddr{IP: loopbackIP, Port: 12345}, nil, "127.0.0.1:12345"},
+		{"empty ip", &net.UDPAddr{IP: loopbackIP, Port: 12345}, &ctrld.ClientInfo{}, "127.0.0.1:12345"},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			addr := spoofRemoteAddr(tc.addr, tc.ci)
+			if addr.String() != tc.want {
+				t.Errorf("unexpected result, want: %q, got: %q", tc.want, addr.String())
 			}
 		})
 	}

cmd/cli/library.go

@@ -0,0 +1,18 @@
+package cli
+
+// AppCallback provides hooks for injecting certain functionalities
+// from mobile platforms to main ctrld cli.
+type AppCallback struct {
+	HostName   func() string
+	LanIp      func() string
+	MacAddress func() string
+	Exit       func(error string)
+}
+
+// AppConfig allows overwriting ctrld cli flags from mobile platforms.
+type AppConfig struct {
+	CdUID   string
+	HomeDir string
+	Verbose int
+	LogPath string
+}

cmd/cli/loop.go

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+const (
+	loopTestDomain = ".test"
+	loopTestQtype  = dns.TypeTXT
+)
+
+// isLoop reports whether the given upstream config is detected as having DNS loop.
+func (p *prog) isLoop(uc *ctrld.UpstreamConfig) bool {
+	p.loopMu.Lock()
+	defer p.loopMu.Unlock()
+	return p.loop[uc.UID()]
+}
+
+// detectLoop checks if the given DNS message is initialized sent by ctrld.
+// If yes, marking the corresponding upstream as loop, prevent infinite DNS
+// forwarding loop.
+//
+// See p.checkDnsLoop for more details how it works.
+func (p *prog) detectLoop(msg *dns.Msg) {
+	if len(msg.Question) != 1 {
+		return
+	}
+	q := msg.Question[0]
+	if q.Qtype != loopTestQtype {
+		return
+	}
+	unFQDNname := strings.TrimSuffix(q.Name, ".")
+	uid := strings.TrimSuffix(unFQDNname, loopTestDomain)
+	p.loopMu.Lock()
+	if _, loop := p.loop[uid]; loop {
+		p.loop[uid] = loop
+	}
+	p.loopMu.Unlock()
+}
+
+// checkDnsLoop sends a message to check if there's any DNS forwarding loop
+// with all the upstreams. The way it works based on dnsmasq --dns-loop-detect.
+//
+// - Generating a TXT test query and sending it to all upstream.
+// - The test query is formed by upstream UID and test domain: <uid>.test
+// - If the test query returns to ctrld, mark the corresponding upstream as loop (see p.detectLoop).
+//
+// See: https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html
+func (p *prog) checkDnsLoop() {
+	mainLog.Load().Debug().Msg("start checking DNS loop")
+	upstream := make(map[string]*ctrld.UpstreamConfig)
+	p.loopMu.Lock()
+	for _, uc := range p.cfg.Upstream {
+		uid := uc.UID()
+		p.loop[uid] = false
+		upstream[uid] = uc
+	}
+	p.loopMu.Unlock()
+
+	for uid := range p.loop {
+		msg := loopTestMsg(uid)
+		uc := upstream[uid]
+		resolver, err := ctrld.NewResolver(uc)
+		if err != nil {
+			mainLog.Load().Warn().Err(err).Msgf("could not perform loop check for upstream: %q, endpoint: %q", uc.Name, uc.Endpoint)
+			continue
+		}
+		if _, err := resolver.Resolve(context.Background(), msg); err != nil {
+			mainLog.Load().Warn().Err(err).Msgf("could not send DNS loop check query for upstream: %q, endpoint: %q", uc.Name, uc.Endpoint)
+		}
+	}
+	mainLog.Load().Debug().Msg("end checking DNS loop")
+}
+
+// checkDnsLoopTicker performs p.checkDnsLoop every minute.
+func (p *prog) checkDnsLoopTicker() {
+	timer := time.NewTicker(time.Minute)
+	defer timer.Stop()
+	for {
+		select {
+		case <-p.stopCh:
+			return
+		case <-timer.C:
+			p.checkDnsLoop()
+		}
+	}
+}
+
+// loopTestMsg generates DNS message for checking loop.
+func loopTestMsg(uid string) *dns.Msg {
+	msg := new(dns.Msg)
+	msg.SetQuestion(dns.Fqdn(uid+loopTestDomain), loopTestQtype)
+	return msg
+}

cmd/cli/main.go

@@ -0,0 +1,168 @@
+package cli
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"time"
+
+	"github.com/kardianos/service"
+	"github.com/rs/zerolog"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+var (
+	configPath        string
+	configBase64      string
+	daemon            bool
+	listenAddress     string
+	primaryUpstream   string
+	secondaryUpstream string
+	domains           []string
+	logPath           string
+	homedir           string
+	cacheSize         int
+	cfg               ctrld.Config
+	verbose           int
+	silent            bool
+	cdUID             string
+	cdOrg             string
+	cdDev             bool
+	iface             string
+	ifaceStartStop    string
+
+	mainLog       atomic.Pointer[zerolog.Logger]
+	consoleWriter zerolog.ConsoleWriter
+	noConfigStart bool
+)
+
+const (
+	cdUidFlagName = "cd"
+	cdOrgFlagName = "cd-org"
+)
+
+func init() {
+	l := zerolog.New(io.Discard)
+	mainLog.Store(&l)
+}
+
+func Main() {
+	ctrld.InitConfig(v, "ctrld")
+	initCLI()
+	if err := rootCmd.Execute(); err != nil {
+		mainLog.Load().Error().Msg(err.Error())
+		os.Exit(1)
+	}
+}
+
+func normalizeLogFilePath(logFilePath string) string {
+	if logFilePath == "" || filepath.IsAbs(logFilePath) || service.Interactive() {
+		return logFilePath
+	}
+	if homedir != "" {
+		return filepath.Join(homedir, logFilePath)
+	}
+	dir, _ := userHomeDir()
+	if dir == "" {
+		return logFilePath
+	}
+	return filepath.Join(dir, logFilePath)
+}
+
+// initConsoleLogging initializes console logging, then storing to mainLog.
+func initConsoleLogging() {
+	consoleWriter = zerolog.NewConsoleWriter(func(w *zerolog.ConsoleWriter) {
+		w.TimeFormat = time.StampMilli
+	})
+	multi := zerolog.MultiLevelWriter(consoleWriter)
+	l := mainLog.Load().Output(multi).With().Timestamp().Logger()
+	mainLog.Store(&l)
+	switch {
+	case silent:
+		zerolog.SetGlobalLevel(zerolog.NoLevel)
+	case verbose == 1:
+		zerolog.SetGlobalLevel(zerolog.InfoLevel)
+	case verbose > 1:
+		zerolog.SetGlobalLevel(zerolog.DebugLevel)
+	default:
+		zerolog.SetGlobalLevel(zerolog.NoticeLevel)
+	}
+}
+
+// initLogging initializes global logging setup.
+func initLogging() {
+	initLoggingWithBackup(true)
+}
+
+// initLoggingWithBackup initializes log setup base on current config.
+// If doBackup is true, backup old log file with ".1" suffix.
+//
+// This is only used in runCmd for special handling in case of logging config
+// change in cd mode. Without special reason, the caller should use initLogging
+// wrapper instead of calling this function directly.
+func initLoggingWithBackup(doBackup bool) {
+	writers := []io.Writer{io.Discard}
+	if logFilePath := normalizeLogFilePath(cfg.Service.LogPath); logFilePath != "" {
+		// Create parent directory if necessary.
+		if err := os.MkdirAll(filepath.Dir(logFilePath), 0750); err != nil {
+			mainLog.Load().Error().Msgf("failed to create log path: %v", err)
+			os.Exit(1)
+		}
+
+		// Default open log file in append mode.
+		flags := os.O_CREATE | os.O_RDWR | os.O_APPEND
+		if doBackup {
+			// Backup old log file with .1 suffix.
+			if err := os.Rename(logFilePath, logFilePath+".1"); err != nil && !os.IsNotExist(err) {
+				mainLog.Load().Error().Msgf("could not backup old log file: %v", err)
+			} else {
+				// Backup was created, set flags for truncating old log file.
+				flags = os.O_CREATE | os.O_RDWR
+			}
+		}
+		logFile, err := os.OpenFile(logFilePath, flags, os.FileMode(0o600))
+		if err != nil {
+			mainLog.Load().Error().Msgf("failed to create log file: %v", err)
+			os.Exit(1)
+		}
+		writers = append(writers, logFile)
+	}
+	writers = append(writers, consoleWriter)
+	multi := zerolog.MultiLevelWriter(writers...)
+	l := mainLog.Load().Output(multi).With().Timestamp().Logger()
+	mainLog.Store(&l)
+	// TODO: find a better way.
+	ctrld.ProxyLogger.Store(&l)
+
+	zerolog.SetGlobalLevel(zerolog.NoticeLevel)
+	logLevel := cfg.Service.LogLevel
+	switch {
+	case silent:
+		zerolog.SetGlobalLevel(zerolog.NoLevel)
+		return
+	case verbose == 1:
+		logLevel = "info"
+	case verbose > 1:
+		logLevel = "debug"
+	}
+	if logLevel == "" {
+		return
+	}
+	level, err := zerolog.ParseLevel(logLevel)
+	if err != nil {
+		mainLog.Load().Warn().Err(err).Msg("could not set log level")
+		return
+	}
+	zerolog.SetGlobalLevel(level)
+}
+
+func initCache() {
+	if !cfg.Service.CacheEnable {
+		return
+	}
+	if cfg.Service.CacheSize == 0 {
+		cfg.Service.CacheSize = 4096
+	}
+}

cmd/cli/main_test.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"os"
@@ -11,6 +11,7 @@ import (
 var logOutput strings.Builder
 
 func TestMain(m *testing.M) {
-	mainLog = zerolog.New(&logOutput)
+	l := zerolog.New(&logOutput)
+	mainLog.Store(&l)
 	os.Exit(m.Run())
 }

cmd/cli/net_darwin.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"bufio"
@@ -17,7 +17,7 @@ func patchNetIfaceName(iface *net.Interface) error {
 
 	if name := networkServiceName(iface.Name, bytes.NewReader(b)); name != "" {
 		iface.Name = name
-		mainLog.Debug().Str("network_service", name).Msg("found network service name for interface")
+		mainLog.Load().Debug().Str("network_service", name).Msg("found network service name for interface")
 	}
 	return nil
 }

cmd/cli/net_darwin_test.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"strings"

cmd/cli/net_others.go

@@ -1,6 +1,6 @@
 //go:build !darwin
 
-package main
+package cli
 
 import "net"
 

cmd/cli/netlink_linux.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"github.com/vishvananda/netlink"
@@ -10,7 +10,7 @@ func (p *prog) watchLinkState() {
 	done := make(chan struct{})
 	defer close(done)
 	if err := netlink.LinkSubscribe(ch, done); err != nil {
-		mainLog.Warn().Err(err).Msg("could not subscribe link")
+		mainLog.Load().Warn().Err(err).Msg("could not subscribe link")
 		return
 	}
 	for lu := range ch {
@@ -18,7 +18,7 @@ func (p *prog) watchLinkState() {
 			continue
 		}
 		if lu.Change&unix.IFF_UP != 0 {
-			mainLog.Debug().Msgf("link state changed, re-bootstrapping")
+			mainLog.Load().Debug().Msgf("link state changed, re-bootstrapping")
 			for _, uc := range p.cfg.Upstream {
 				uc.ReBootstrap()
 			}

cmd/cli/netlink_others.go

@@ -1,5 +1,5 @@
 //go:build !linux
 
-package main
+package cli
 
 func (p *prog) watchLinkState() {}

cmd/cli/network_manager_linux.go

@@ -1,8 +1,9 @@
-package main
+package cli
 
 import (
 	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"time"
 
@@ -16,45 +17,56 @@ const (
 dns=none
 systemd-resolved=false
 `
-	nmSystemdUnitName   = "NetworkManager.service"
-	systemdEnabledState = "enabled"
+	nmSystemdUnitName = "NetworkManager.service"
 )
 
 var networkManagerCtrldConfFile = filepath.Join(nmConfDir, nmCtrldConfFilename)
 
+// hasNetworkManager reports whether NetworkManager executable found.
+func hasNetworkManager() bool {
+	exe, _ := exec.LookPath("NetworkManager")
+	return exe != ""
+}
+
 func setupNetworkManager() error {
+	if !hasNetworkManager() {
+		return nil
+	}
 	if content, _ := os.ReadFile(nmCtrldConfContent); string(content) == nmCtrldConfContent {
-		mainLog.Debug().Msg("NetworkManager already setup, nothing to do")
+		mainLog.Load().Debug().Msg("NetworkManager already setup, nothing to do")
 		return nil
 	}
 	err := os.WriteFile(networkManagerCtrldConfFile, []byte(nmCtrldConfContent), os.FileMode(0644))
 	if os.IsNotExist(err) {
-		mainLog.Debug().Msg("NetworkManager is not available")
+		mainLog.Load().Debug().Msg("NetworkManager is not available")
 		return nil
 	}
 	if err != nil {
-		mainLog.Debug().Err(err).Msg("could not write NetworkManager ctrld config file")
+		mainLog.Load().Debug().Err(err).Msg("could not write NetworkManager ctrld config file")
 		return err
 	}
 
 	reloadNetworkManager()
-	mainLog.Debug().Msg("setup NetworkManager done")
+	mainLog.Load().Debug().Msg("setup NetworkManager done")
 	return nil
 }
 
 func restoreNetworkManager() error {
+	if !hasNetworkManager() {
+		return nil
+	}
 	err := os.Remove(networkManagerCtrldConfFile)
 	if os.IsNotExist(err) {
-		mainLog.Debug().Msg("NetworkManager is not available")
+		mainLog.Load().Debug().Msg("NetworkManager is not available")
 		return nil
 	}
 	if err != nil {
-		mainLog.Debug().Err(err).Msg("could not remove NetworkManager ctrld config file")
+		mainLog.Load().Debug().Err(err).Msg("could not remove NetworkManager ctrld config file")
 		return err
 	}
 
 	reloadNetworkManager()
-	mainLog.Debug().Msg("restore NetworkManager done")
+	mainLog.Load().Debug().Msg("restore NetworkManager done")
 	return nil
 }
 
@@ -63,14 +75,15 @@ func reloadNetworkManager() {
 	defer cancel()
 	conn, err := dbus.NewSystemConnectionContext(ctx)
 	if err != nil {
-		mainLog.Error().Err(err).Msg("could not create new system connection")
+		mainLog.Load().Error().Err(err).Msg("could not create new system connection")
 		return
 	}
 	defer conn.Close()
 
 	waitCh := make(chan string)
 	if _, err := conn.ReloadUnitContext(ctx, nmSystemdUnitName, "ignore-dependencies", waitCh); err != nil {
-		mainLog.Debug().Err(err).Msg("could not reload NetworkManager")
+		mainLog.Load().Debug().Err(err).Msg("could not reload NetworkManager")
+		return
 	}
 	<-waitCh
 }

cmd/cli/network_manager_others.go

@@ -1,6 +1,6 @@
 //go:build !linux
 
-package main
+package cli
 
 func setupNetworkManager() error {
 	reloadNetworkManager()

cmd/cli/os_darwin.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"net"
@@ -12,7 +12,7 @@ import (
 func allocateIP(ip string) error {
 	cmd := exec.Command("ifconfig", "lo0", "alias", ip, "up")
 	if err := cmd.Run(); err != nil {
-		mainLog.Error().Err(err).Msg("allocateIP failed")
+		mainLog.Load().Error().Err(err).Msg("allocateIP failed")
 		return err
 	}
 	return nil
@@ -21,7 +21,7 @@ func allocateIP(ip string) error {
 func deAllocateIP(ip string) error {
 	cmd := exec.Command("ifconfig", "lo0", "-alias", ip)
 	if err := cmd.Run(); err != nil {
-		mainLog.Error().Err(err).Msg("deAllocateIP failed")
+		mainLog.Load().Error().Err(err).Msg("deAllocateIP failed")
 		return err
 	}
 	return nil
@@ -36,7 +36,7 @@ func setDNS(iface *net.Interface, nameservers []string) error {
 	args = append(args, nameservers...)
 
 	if err := exec.Command(cmd, args...).Run(); err != nil {
-		mainLog.Error().Err(err).Msgf("setDNS failed, ips = %q", nameservers)
+		mainLog.Load().Error().Err(err).Msgf("setDNS failed, ips = %q", nameservers)
 		return err
 	}
 	return nil
@@ -48,7 +48,7 @@ func resetDNS(iface *net.Interface) error {
 	args := []string{"-setdnsservers", iface.Name, "empty"}
 
 	if err := exec.Command(cmd, args...).Run(); err != nil {
-		mainLog.Error().Err(err).Msgf("resetDNS failed")
+		mainLog.Load().Error().Err(err).Msgf("resetDNS failed")
 		return err
 	}
 	return nil

cmd/cli/os_freebsd.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"net"
@@ -14,7 +14,7 @@ import (
 func allocateIP(ip string) error {
 	cmd := exec.Command("ifconfig", "lo0", ip, "alias")
 	if err := cmd.Run(); err != nil {
-		mainLog.Error().Err(err).Msg("allocateIP failed")
+		mainLog.Load().Error().Err(err).Msg("allocateIP failed")
 		return err
 	}
 	return nil
@@ -23,7 +23,7 @@ func allocateIP(ip string) error {
 func deAllocateIP(ip string) error {
 	cmd := exec.Command("ifconfig", "lo0", ip, "-alias")
 	if err := cmd.Run(); err != nil {
-		mainLog.Error().Err(err).Msg("deAllocateIP failed")
+		mainLog.Load().Error().Err(err).Msg("deAllocateIP failed")
 		return err
 	}
 	return nil
@@ -33,7 +33,7 @@ func deAllocateIP(ip string) error {
 func setDNS(iface *net.Interface, nameservers []string) error {
 	r, err := dns.NewOSConfigurator(logf, iface.Name)
 	if err != nil {
-		mainLog.Error().Err(err).Msg("failed to create DNS OS configurator")
+		mainLog.Load().Error().Err(err).Msg("failed to create DNS OS configurator")
 		return err
 	}
 
@@ -43,7 +43,7 @@ func setDNS(iface *net.Interface, nameservers []string) error {
 	}
 
 	if err := r.SetDNS(dns.OSConfig{Nameservers: ns}); err != nil {
-		mainLog.Error().Err(err).Msg("failed to set DNS")
+		mainLog.Load().Error().Err(err).Msg("failed to set DNS")
 		return err
 	}
 	return nil
@@ -52,12 +52,12 @@ func setDNS(iface *net.Interface, nameservers []string) error {
 func resetDNS(iface *net.Interface) error {
 	r, err := dns.NewOSConfigurator(logf, iface.Name)
 	if err != nil {
-		mainLog.Error().Err(err).Msg("failed to create DNS OS configurator")
+		mainLog.Load().Error().Err(err).Msg("failed to create DNS OS configurator")
 		return err
 	}
 
 	if err := r.Close(); err != nil {
-		mainLog.Error().Err(err).Msg("failed to rollback DNS setting")
+		mainLog.Load().Error().Err(err).Msg("failed to rollback DNS setting")
 		return err
 	}
 	return nil

cmd/cli/os_linux.go

@@ -0,0 +1,301 @@
+package cli
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/insomniacslk/dhcp/dhcpv4/nclient4"
+	"github.com/insomniacslk/dhcp/dhcpv6"
+	"github.com/insomniacslk/dhcp/dhcpv6/client6"
+	"tailscale.com/util/dnsname"
+
+	"github.com/Control-D-Inc/ctrld/internal/dns"
+	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
+	"github.com/Control-D-Inc/ctrld/internal/resolvconffile"
+)
+
+const resolvConfBackupFailedMsg = "open /etc/resolv.pre-ctrld-backup.conf: read-only file system"
+
+// allocate loopback ip
+// sudo ip a add 127.0.0.2/24 dev lo
+func allocateIP(ip string) error {
+	cmd := exec.Command("ip", "a", "add", ip+"/24", "dev", "lo")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		mainLog.Load().Error().Err(err).Msgf("allocateIP failed: %s", string(out))
+		return err
+	}
+	return nil
+}
+
+func deAllocateIP(ip string) error {
+	cmd := exec.Command("ip", "a", "del", ip+"/24", "dev", "lo")
+	if err := cmd.Run(); err != nil {
+		mainLog.Load().Error().Err(err).Msg("deAllocateIP failed")
+		return err
+	}
+	return nil
+}
+
+const maxSetDNSAttempts = 5
+
+// set the dns server for the provided network interface
+func setDNS(iface *net.Interface, nameservers []string) error {
+	r, err := dns.NewOSConfigurator(logf, iface.Name)
+	if err != nil {
+		mainLog.Load().Error().Err(err).Msg("failed to create DNS OS configurator")
+		return err
+	}
+
+	ns := make([]netip.Addr, 0, len(nameservers))
+	for _, nameserver := range nameservers {
+		ns = append(ns, netip.MustParseAddr(nameserver))
+	}
+
+	osConfig := dns.OSConfig{
+		Nameservers:   ns,
+		SearchDomains: []dnsname.FQDN{},
+	}
+
+	trySystemdResolve := false
+	for i := 0; i < maxSetDNSAttempts; i++ {
+		if err := r.SetDNS(osConfig); err != nil {
+			if strings.Contains(err.Error(), "Rejected send message") &&
+				strings.Contains(err.Error(), "org.freedesktop.network1.Manager") {
+				mainLog.Load().Warn().Msg("Interfaces are managed by systemd-networkd, switch to systemd-resolve for setting DNS")
+				trySystemdResolve = true
+				break
+			}
+			// This error happens on read-only file system, which causes ctrld failed to create backup
+			// for /etc/resolv.conf file. It is ok, because the DNS is still set anyway, and restore
+			// DNS will fallback to use DHCP if there's no backup /etc/resolv.conf file.
+			// The error format is controlled by us, so checking for error string is fine.
+			// See: ../../internal/dns/direct.go:L278
+			if r.Mode() == "direct" && strings.Contains(err.Error(), resolvConfBackupFailedMsg) {
+				return nil
+			}
+			return err
+		}
+		if useSystemdResolved {
+			if out, err := exec.Command("systemctl", "restart", "systemd-resolved").CombinedOutput(); err != nil {
+				mainLog.Load().Warn().Err(err).Msgf("could not restart systemd-resolved: %s", string(out))
+			}
+		}
+		currentNS := currentDNS(iface)
+		if isSubSet(nameservers, currentNS) {
+			return nil
+		}
+	}
+	if trySystemdResolve {
+		// Stop systemd-networkd and retry setting DNS.
+		if out, err := exec.Command("systemctl", "stop", "systemd-networkd").CombinedOutput(); err != nil {
+			return fmt.Errorf("%s: %w", string(out), err)
+		}
+		args := []string{"--interface=" + iface.Name, "--set-domain=~"}
+		for _, nameserver := range nameservers {
+			args = append(args, "--set-dns="+nameserver)
+		}
+		for i := 0; i < maxSetDNSAttempts; i++ {
+			if out, err := exec.Command("systemd-resolve", args...).CombinedOutput(); err != nil {
+				return fmt.Errorf("%s: %w", string(out), err)
+			}
+			currentNS := currentDNS(iface)
+			if isSubSet(nameservers, currentNS) {
+				return nil
+			}
+			time.Sleep(time.Second)
+		}
+	}
+	mainLog.Load().Debug().Msg("DNS was not set for some reason")
+	return nil
+}
+
+func resetDNS(iface *net.Interface) (err error) {
+	defer func() {
+		if err == nil {
+			return
+		}
+		// Start systemd-networkd if present.
+		if exe, _ := exec.LookPath("/lib/systemd/systemd-networkd"); exe != "" {
+			_ = exec.Command("systemctl", "start", "systemd-networkd").Run()
+		}
+		if r, oerr := dns.NewOSConfigurator(logf, iface.Name); oerr == nil {
+			_ = r.SetDNS(dns.OSConfig{})
+			if err := r.Close(); err != nil {
+				mainLog.Load().Error().Err(err).Msg("failed to rollback DNS setting")
+				return
+			}
+			err = nil
+		}
+	}()
+
+	var ns []string
+	c, err := nclient4.New(iface.Name)
+	if err != nil {
+		return fmt.Errorf("nclient4.New: %w", err)
+	}
+	defer c.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	lease, err := c.Request(ctx)
+	if err != nil {
+		return fmt.Errorf("nclient4.Request: %w", err)
+	}
+	for _, nameserver := range lease.ACK.DNS() {
+		if nameserver.Equal(net.IPv4zero) {
+			continue
+		}
+		ns = append(ns, nameserver.String())
+	}
+
+	// TODO(cuonglm): handle DHCPv6 properly.
+	if ctrldnet.IPv6Available(ctx) {
+		c := client6.NewClient()
+		conversation, err := c.Exchange(iface.Name)
+		if err != nil && !errAddrInUse(err) {
+			mainLog.Load().Debug().Err(err).Msg("could not exchange DHCPv6")
+		}
+		for _, packet := range conversation {
+			if packet.Type() == dhcpv6.MessageTypeReply {
+				msg, err := packet.GetInnerMessage()
+				if err != nil {
+					mainLog.Load().Debug().Err(err).Msg("could not get inner DHCPv6 message")
+					return nil
+				}
+				nameservers := msg.Options.DNS()
+				for _, nameserver := range nameservers {
+					ns = append(ns, nameserver.String())
+				}
+			}
+		}
+	}
+
+	return ignoringEINTR(func() error {
+		return setDNS(iface, ns)
+	})
+}
+
+func currentDNS(iface *net.Interface) []string {
+	for _, fn := range []getDNS{getDNSByResolvectl, getDNSBySystemdResolved, getDNSByNmcli, resolvconffile.NameServers} {
+		if ns := fn(iface.Name); len(ns) > 0 {
+			return ns
+		}
+	}
+	return nil
+}
+
+func getDNSByResolvectl(iface string) []string {
+	b, err := exec.Command("resolvectl", "dns", "-i", iface).Output()
+	if err != nil {
+		return nil
+	}
+
+	parts := strings.Fields(strings.SplitN(string(b), "%", 2)[0])
+	if len(parts) > 2 {
+		return parts[3:]
+	}
+	return nil
+}
+
+func getDNSBySystemdResolved(iface string) []string {
+	b, err := exec.Command("systemd-resolve", "--status", iface).Output()
+	if err != nil {
+		return nil
+	}
+	return getDNSBySystemdResolvedFromReader(bytes.NewReader(b))
+}
+
+func getDNSBySystemdResolvedFromReader(r io.Reader) []string {
+	scanner := bufio.NewScanner(r)
+	var ret []string
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if len(ret) > 0 {
+			if net.ParseIP(line) != nil {
+				ret = append(ret, line)
+			}
+			continue
+		}
+		after, found := strings.CutPrefix(line, "DNS Servers: ")
+		if !found {
+			continue
+		}
+		if net.ParseIP(after) != nil {
+			ret = append(ret, after)
+		}
+	}
+	return ret
+}
+
+func getDNSByNmcli(iface string) []string {
+	b, err := exec.Command("nmcli", "dev", "show", iface).Output()
+	if err != nil {
+		return nil
+	}
+	s := bufio.NewScanner(bytes.NewReader(b))
+	var dns []string
+	do := func(line string) {
+		parts := strings.SplitN(line, ":", 2)
+		if len(parts) > 1 {
+			dns = append(dns, strings.TrimSpace(parts[1]))
+		}
+	}
+	for s.Scan() {
+		line := s.Text()
+		switch {
+		case strings.HasPrefix(line, "IP4.DNS"):
+			fallthrough
+		case strings.HasPrefix(line, "IP6.DNS"):
+			do(line)
+		}
+	}
+	return dns
+}
+
+func ignoringEINTR(fn func() error) error {
+	for {
+		err := fn()
+		if err != syscall.EINTR {
+			return err
+		}
+	}
+}
+
+// isSubSet reports whether s2 contains all elements of s1.
+func isSubSet(s1, s2 []string) bool {
+	ok := true
+	for _, ns := range s1 {
+		// TODO(cuonglm): use slices.Contains once upgrading to go1.21
+		if sliceContains(s2, ns) {
+			continue
+		}
+		ok = false
+		break
+	}
+	return ok
+}
+
+// sliceContains reports whether v is present in s.
+func sliceContains[S ~[]E, E comparable](s S, v E) bool {
+	return sliceIndex(s, v) >= 0
+}
+
+// sliceIndex returns the index of the first occurrence of v in s,
+// or -1 if not present.
+func sliceIndex[S ~[]E, E comparable](s S, v E) int {
+	for i := range s {
+		if v == s[i] {
+			return i
+		}
+	}
+	return -1
+}

cmd/cli/os_linux_test.go

@@ -0,0 +1,23 @@
+package cli
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func Test_getDNSBySystemdResolvedFromReader(t *testing.T) {
+	r := strings.NewReader(`Link 2 (eth0)
+      Current Scopes: DNS
+       LLMNR setting: yes
+MulticastDNS setting: no
+      DNSSEC setting: no
+    DNSSEC supported: no
+         DNS Servers: 8.8.8.8
+                      8.8.4.4`)
+	want := []string{"8.8.8.8", "8.8.4.4"}
+	ns := getDNSBySystemdResolvedFromReader(r)
+	if !reflect.DeepEqual(ns, want) {
+		t.Logf("unexpected result, want: %v, got: %v", want, ns)
+	}
+}

cmd/cli/os_others.go

@@ -1,6 +1,6 @@
 //go:build !linux && !darwin && !freebsd
 
-package main
+package cli
 
 // TODO(cuonglm): implement.
 func allocateIP(ip string) error {

cmd/cli/os_windows.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"errors"
@@ -30,12 +30,12 @@ func setDNS(iface *net.Interface, nameservers []string) error {
 func resetDNS(iface *net.Interface) error {
 	if ctrldnet.SupportsIPv6ListenLocal() {
 		if output, err := netsh("interface", "ipv6", "set", "dnsserver", strconv.Itoa(iface.Index), "dhcp"); err != nil {
-			mainLog.Warn().Err(err).Msgf("failed to reset ipv6 DNS: %s", string(output))
+			mainLog.Load().Warn().Err(err).Msgf("failed to reset ipv6 DNS: %s", string(output))
 		}
 	}
 	output, err := netsh("interface", "ipv4", "set", "dnsserver", strconv.Itoa(iface.Index), "dhcp")
 	if err != nil {
-		mainLog.Error().Err(err).Msgf("failed to reset ipv4 DNS: %s", string(output))
+		mainLog.Load().Error().Err(err).Msgf("failed to reset ipv4 DNS: %s", string(output))
 		return err
 	}
 	return nil
@@ -49,7 +49,7 @@ func setPrimaryDNS(iface *net.Interface, dns string) error {
 	idx := strconv.Itoa(iface.Index)
 	output, err := netsh("interface", ipVer, "set", "dnsserver", idx, "static", dns)
 	if err != nil {
-		mainLog.Error().Err(err).Msgf("failed to set primary DNS: %s", string(output))
+		mainLog.Load().Error().Err(err).Msgf("failed to set primary DNS: %s", string(output))
 		return err
 	}
 	if ipVer == "ipv4" && ctrldnet.SupportsIPv6ListenLocal() {
@@ -67,7 +67,7 @@ func addSecondaryDNS(iface *net.Interface, dns string) error {
 	}
 	output, err := netsh("interface", ipVer, "add", "dns", strconv.Itoa(iface.Index), dns, "index=2")
 	if err != nil {
-		mainLog.Warn().Err(err).Msgf("failed to add secondary DNS: %s", string(output))
+		mainLog.Load().Warn().Err(err).Msgf("failed to add secondary DNS: %s", string(output))
 	}
 	return nil
 }
@@ -79,12 +79,12 @@ func netsh(args ...string) ([]byte, error) {
 func currentDNS(iface *net.Interface) []string {
 	luid, err := winipcfg.LUIDFromIndex(uint32(iface.Index))
 	if err != nil {
-		mainLog.Error().Err(err).Msg("failed to get interface LUID")
+		mainLog.Load().Error().Err(err).Msg("failed to get interface LUID")
 		return nil
 	}
 	nameservers, err := luid.DNS()
 	if err != nil {
-		mainLog.Error().Err(err).Msg("failed to get interface DNS")
+		mainLog.Load().Error().Err(err).Msg("failed to get interface DNS")
 		return nil
 	}
 	ns := make([]string, 0, len(nameservers))

cmd/cli/prog.go

@@ -0,0 +1,464 @@
+package cli
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"math/rand"
+	"net"
+	"net/netip"
+	"net/url"
+	"os"
+	"runtime"
+	"sort"
+	"strconv"
+	"sync"
+	"syscall"
+
+	"github.com/kardianos/service"
+	"tailscale.com/net/interfaces"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/Control-D-Inc/ctrld/internal/clientinfo"
+	"github.com/Control-D-Inc/ctrld/internal/dnscache"
+	"github.com/Control-D-Inc/ctrld/internal/router"
+)
+
+const (
+	defaultSemaphoreCap  = 256
+	ctrldLogUnixSock     = "ctrld_start.sock"
+	ctrldControlUnixSock = "ctrld_control.sock"
+	upstreamPrefix       = "upstream."
+	upstreamOS           = upstreamPrefix + "os"
+)
+
+var logf = func(format string, args ...any) {
+	mainLog.Load().Debug().Msgf(format, args...)
+}
+
+var svcConfig = &service.Config{
+	Name:        "ctrld",
+	DisplayName: "Control-D Helper Service",
+	Option:      service.KeyValue{},
+}
+
+var useSystemdResolved = false
+
+type prog struct {
+	mu      sync.Mutex
+	waitCh  chan struct{}
+	stopCh  chan struct{}
+	logConn net.Conn
+	cs      *controlServer
+
+	cfg         *ctrld.Config
+	appCallback *AppCallback
+	cache       dnscache.Cacher
+	sema        semaphore
+	ciTable     *clientinfo.Table
+	um          *upstreamMonitor
+	router      router.Router
+
+	loopMu sync.Mutex
+	loop   map[string]bool
+
+	started       chan struct{}
+	onStartedDone chan struct{}
+	onStarted     []func()
+	onStopped     []func()
+}
+
+func (p *prog) Start(s service.Service) error {
+	p.cfg = &cfg
+	go p.run()
+	return nil
+}
+
+func (p *prog) preRun() {
+	if !service.Interactive() {
+		p.setDNS()
+	}
+	if runtime.GOOS == "darwin" {
+		p.onStopped = append(p.onStopped, func() {
+			if !service.Interactive() {
+				p.resetDNS()
+			}
+		})
+	}
+}
+
+func (p *prog) run() {
+	// Wait the caller to signal that we can do our logic.
+	<-p.waitCh
+	p.preRun()
+	numListeners := len(p.cfg.Listener)
+	p.started = make(chan struct{}, numListeners)
+	p.onStartedDone = make(chan struct{})
+	p.loop = make(map[string]bool)
+	if p.cfg.Service.CacheEnable {
+		cacher, err := dnscache.NewLRUCache(p.cfg.Service.CacheSize)
+		if err != nil {
+			mainLog.Load().Error().Err(err).Msg("failed to create cacher, caching is disabled")
+		} else {
+			p.cache = cacher
+		}
+	}
+	p.sema = &chanSemaphore{ready: make(chan struct{}, defaultSemaphoreCap)}
+	if mcr := p.cfg.Service.MaxConcurrentRequests; mcr != nil {
+		n := *mcr
+		if n == 0 {
+			p.sema = &noopSemaphore{}
+		} else {
+			p.sema = &chanSemaphore{ready: make(chan struct{}, n)}
+		}
+	}
+	var wg sync.WaitGroup
+	wg.Add(len(p.cfg.Listener))
+
+	for _, nc := range p.cfg.Network {
+		for _, cidr := range nc.Cidrs {
+			_, ipNet, err := net.ParseCIDR(cidr)
+			if err != nil {
+				mainLog.Load().Error().Err(err).Str("network", nc.Name).Str("cidr", cidr).Msg("invalid cidr")
+				continue
+			}
+			nc.IPNets = append(nc.IPNets, ipNet)
+		}
+	}
+
+	p.um = newUpstreamMonitor(p.cfg)
+	for n := range p.cfg.Upstream {
+		uc := p.cfg.Upstream[n]
+		uc.Init()
+		if uc.BootstrapIP == "" {
+			uc.SetupBootstrapIP()
+			mainLog.Load().Info().Msgf("bootstrap IPs for upstream.%s: %q", n, uc.BootstrapIPs())
+		} else {
+			mainLog.Load().Info().Str("bootstrap_ip", uc.BootstrapIP).Msgf("using bootstrap IP for upstream.%s", n)
+		}
+		uc.SetCertPool(rootCertPool)
+		go uc.Ping()
+	}
+
+	p.ciTable = clientinfo.NewTable(&cfg, defaultRouteIP(), cdUID)
+	if leaseFile := p.cfg.Service.DHCPLeaseFile; leaseFile != "" {
+		mainLog.Load().Debug().Msgf("watching custom lease file: %s", leaseFile)
+		format := ctrld.LeaseFileFormat(p.cfg.Service.DHCPLeaseFileFormat)
+		p.ciTable.AddLeaseFile(leaseFile, format)
+	}
+	// Newer versions of android and iOS denies permission which breaks connectivity.
+	if !isMobile() {
+		go func() {
+			p.ciTable.Init()
+			p.ciTable.RefreshLoop(p.stopCh)
+		}()
+		go p.watchLinkState()
+	}
+
+	for listenerNum := range p.cfg.Listener {
+		p.cfg.Listener[listenerNum].Init()
+		go func(listenerNum string) {
+			defer wg.Done()
+			listenerConfig := p.cfg.Listener[listenerNum]
+			upstreamConfig := p.cfg.Upstream[listenerNum]
+			if upstreamConfig == nil {
+				mainLog.Load().Warn().Msgf("no default upstream for: [listener.%s]", listenerNum)
+			}
+			addr := net.JoinHostPort(listenerConfig.IP, strconv.Itoa(listenerConfig.Port))
+			mainLog.Load().Info().Msgf("starting DNS server on listener.%s: %s", listenerNum, addr)
+			if err := p.serveDNS(listenerNum); err != nil {
+				mainLog.Load().Fatal().Err(err).Msgf("unable to start dns proxy on listener.%s", listenerNum)
+			}
+		}(listenerNum)
+	}
+
+	for i := 0; i < numListeners; i++ {
+		<-p.started
+	}
+	for _, f := range p.onStarted {
+		f()
+	}
+	// Check for possible DNS loop.
+	p.checkDnsLoop()
+	close(p.onStartedDone)
+
+	// Start check DNS loop ticker.
+	go p.checkDnsLoopTicker()
+
+	// Stop writing log to unix socket.
+	consoleWriter.Out = os.Stdout
+	initLoggingWithBackup(false)
+	if p.logConn != nil {
+		_ = p.logConn.Close()
+	}
+	if p.cs != nil {
+		p.registerControlServerHandler()
+		if err := p.cs.start(); err != nil {
+			mainLog.Load().Warn().Err(err).Msg("could not start control server")
+		}
+	}
+	wg.Wait()
+}
+
+func (p *prog) Stop(s service.Service) error {
+	mainLog.Load().Info().Msg("Service stopped")
+	close(p.stopCh)
+	if err := p.deAllocateIP(); err != nil {
+		mainLog.Load().Error().Err(err).Msg("de-allocate ip failed")
+		return err
+	}
+	return nil
+}
+
+func (p *prog) allocateIP(ip string) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if !p.cfg.Service.AllocateIP {
+		return nil
+	}
+	return allocateIP(ip)
+}
+
+func (p *prog) deAllocateIP() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if !p.cfg.Service.AllocateIP {
+		return nil
+	}
+	for _, lc := range p.cfg.Listener {
+		if err := deAllocateIP(lc.IP); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (p *prog) setDNS() {
+	if cfg.Listener == nil {
+		return
+	}
+	if iface == "" {
+		return
+	}
+	if iface == "auto" {
+		iface = defaultIfaceName()
+	}
+	lc := cfg.FirstListener()
+	if lc == nil {
+		return
+	}
+	logger := mainLog.Load().With().Str("iface", iface).Logger()
+	netIface, err := netInterface(iface)
+	if err != nil {
+		logger.Error().Err(err).Msg("could not get interface")
+		return
+	}
+	if err := setupNetworkManager(); err != nil {
+		logger.Error().Err(err).Msg("could not patch NetworkManager")
+		return
+	}
+
+	logger.Debug().Msg("setting DNS for interface")
+	ns := lc.IP
+	switch {
+	case lc.IsDirectDnsListener():
+		// If ctrld is direct listener, use 127.0.0.1 as nameserver.
+		ns = "127.0.0.1"
+	case lc.Port != 53:
+		ns = "127.0.0.1"
+		if resolver := router.LocalResolverIP(); resolver != "" {
+			ns = resolver
+		}
+	default:
+		// If we ever reach here, it means ctrld is running on lc.IP port 53,
+		// so we could just use lc.IP as nameserver.
+	}
+
+	nameservers := []string{ns}
+	if needRFC1918Listeners(lc) {
+		nameservers = append(nameservers, rfc1918Addresses()...)
+	}
+	if err := setDNS(netIface, nameservers); err != nil {
+		logger.Error().Err(err).Msgf("could not set DNS for interface")
+		return
+	}
+	logger.Debug().Msg("setting DNS successfully")
+}
+
+func (p *prog) resetDNS() {
+	if iface == "" {
+		return
+	}
+	if iface == "auto" {
+		iface = defaultIfaceName()
+	}
+	logger := mainLog.Load().With().Str("iface", iface).Logger()
+	netIface, err := netInterface(iface)
+	if err != nil {
+		logger.Error().Err(err).Msg("could not get interface")
+		return
+	}
+	if err := restoreNetworkManager(); err != nil {
+		logger.Error().Err(err).Msg("could not restore NetworkManager")
+		return
+	}
+	logger.Debug().Msg("Restoring DNS for interface")
+	if err := resetDNS(netIface); err != nil {
+		logger.Error().Err(err).Msgf("could not reset DNS")
+		return
+	}
+	logger.Debug().Msg("Restoring DNS successfully")
+}
+
+func randomLocalIP() string {
+	n := rand.Intn(254-2) + 2
+	return fmt.Sprintf("127.0.0.%d", n)
+}
+
+func randomPort() int {
+	max := 1<<16 - 1
+	min := 1025
+	n := rand.Intn(max-min) + min
+	return n
+}
+
+// runLogServer starts a unix listener, use by startCmd to gather log from runCmd.
+func runLogServer(sockPath string) net.Conn {
+	addr, err := net.ResolveUnixAddr("unix", sockPath)
+	if err != nil {
+		mainLog.Load().Warn().Err(err).Msg("invalid log sock path")
+		return nil
+	}
+	ln, err := net.ListenUnix("unix", addr)
+	if err != nil {
+		mainLog.Load().Warn().Err(err).Msg("could not listen log socket")
+		return nil
+	}
+	defer ln.Close()
+
+	server, err := ln.Accept()
+	if err != nil {
+		mainLog.Load().Warn().Err(err).Msg("could not accept connection")
+		return nil
+	}
+	return server
+}
+
+func errAddrInUse(err error) bool {
+	var opErr *net.OpError
+	if errors.As(err, &opErr) {
+		return errors.Is(opErr.Err, syscall.EADDRINUSE) || errors.Is(opErr.Err, windowsEADDRINUSE)
+	}
+	return false
+}
+
+var _ = errAddrInUse
+
+// https://learn.microsoft.com/en-us/windows/win32/winsock/windows-sockets-error-codes-2
+var (
+	windowsECONNREFUSED = syscall.Errno(10061)
+	windowsENETUNREACH  = syscall.Errno(10051)
+	windowsEINVAL       = syscall.Errno(10022)
+	windowsEADDRINUSE   = syscall.Errno(10048)
+)
+
+func errUrlNetworkError(err error) bool {
+	var urlErr *url.Error
+	if errors.As(err, &urlErr) {
+		return errNetworkError(urlErr.Err)
+	}
+	return false
+}
+
+func errNetworkError(err error) bool {
+	var opErr *net.OpError
+	if errors.As(err, &opErr) {
+		if opErr.Temporary() {
+			return true
+		}
+		switch {
+		case errors.Is(opErr.Err, syscall.ECONNREFUSED),
+			errors.Is(opErr.Err, syscall.EINVAL),
+			errors.Is(opErr.Err, syscall.ENETUNREACH),
+			errors.Is(opErr.Err, windowsENETUNREACH),
+			errors.Is(opErr.Err, windowsEINVAL),
+			errors.Is(opErr.Err, windowsECONNREFUSED):
+			return true
+		}
+	}
+	return false
+}
+
+func ifaceFirstPrivateIP(iface *net.Interface) string {
+	if iface == nil {
+		return ""
+	}
+	do := func(addrs []net.Addr, v4 bool) net.IP {
+		for _, addr := range addrs {
+			if netIP, ok := addr.(*net.IPNet); ok && netIP.IP.IsPrivate() {
+				if v4 {
+					return netIP.IP.To4()
+				}
+				return netIP.IP
+			}
+		}
+		return nil
+	}
+	addrs, _ := iface.Addrs()
+	if ip := do(addrs, true); ip != nil {
+		return ip.String()
+	}
+	if ip := do(addrs, false); ip != nil {
+		return ip.String()
+	}
+	return ""
+}
+
+// defaultRouteIP returns private IP string of the default route if present, prefer IPv4 over IPv6.
+func defaultRouteIP() string {
+	dr, err := interfaces.DefaultRoute()
+	if err != nil {
+		return ""
+	}
+	drNetIface, err := netInterface(dr.InterfaceName)
+	if err != nil {
+		return ""
+	}
+	mainLog.Load().Debug().Str("iface", drNetIface.Name).Msg("checking default route interface")
+	if ip := ifaceFirstPrivateIP(drNetIface); ip != "" {
+		mainLog.Load().Debug().Str("ip", ip).Msg("found ip with default route interface")
+		return ip
+	}
+
+	// If we reach here, it means the default route interface is connected directly to ISP.
+	// We need to find the LAN interface with the same Mac address with drNetIface.
+	//
+	// There could be multiple LAN interfaces with the same Mac address, so we find all private
+	// IPs then using the smallest one.
+	var addrs []netip.Addr
+	interfaces.ForeachInterface(func(i interfaces.Interface, prefixes []netip.Prefix) {
+		if i.Name == drNetIface.Name {
+			return
+		}
+		if bytes.Equal(i.HardwareAddr, drNetIface.HardwareAddr) {
+			for _, pfx := range prefixes {
+				addr := pfx.Addr()
+				if addr.IsPrivate() {
+					addrs = append(addrs, addr)
+				}
+			}
+		}
+	})
+
+	if len(addrs) == 0 {
+		mainLog.Load().Warn().Msg("no default route IP found")
+		return ""
+	}
+	sort.Slice(addrs, func(i, j int) bool {
+		return addrs[i].Less(addrs[j])
+	})
+
+	ip := addrs[0].String()
+	mainLog.Load().Debug().Str("ip", ip).Msg("found LAN interface IP")
+	return ip
+}

cmd/cli/prog_darwin.go

@@ -1,23 +1,11 @@
-package main
+package cli
 
 import (
 	"github.com/kardianos/service"
 )
 
-func (p *prog) preRun() {
-	if !service.Interactive() {
-		p.setDNS()
-	}
-}
-
 func setDependencies(svc *service.Config) {}
 
 func setWorkingDirectory(svc *service.Config, dir string) {
 	svc.WorkingDirectory = dir
 }
-
-func (p *prog) preStop() {
-	if !service.Interactive() {
-		p.resetDNS()
-	}
-}

cmd/cli/prog_freebsd.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import (
 	"os"
@@ -6,17 +6,9 @@ import (
 	"github.com/kardianos/service"
 )
 
-func (p *prog) preRun() {
-	if !service.Interactive() {
-		p.setDNS()
-	}
-}
-
 func setDependencies(svc *service.Config) {
 	// TODO(cuonglm): remove once https://github.com/kardianos/service/issues/359 fixed.
 	_ = os.MkdirAll("/usr/local/etc/rc.d", 0755)
 }
 
 func setWorkingDirectory(svc *service.Config, dir string) {}
-
-func (p *prog) preStop() {}

cmd/cli/prog_linux.go

@@ -1,12 +1,14 @@
-package main
+package cli
 
 import (
 	"github.com/kardianos/service"
+
+	"github.com/Control-D-Inc/ctrld/internal/dns"
 )
 
-func (p *prog) preRun() {
-	if !service.Interactive() {
-		p.setDNS()
+func init() {
+	if r, err := dns.NewOSConfigurator(func(format string, args ...any) {}, "lo"); err == nil {
+		useSystemdResolved = r.Mode() == "systemd-resolved"
 	}
 }
 
@@ -16,11 +18,13 @@ func setDependencies(svc *service.Config) {
 		"After=network-online.target",
 		"Wants=NetworkManager-wait-online.service",
 		"After=NetworkManager-wait-online.service",
+		"Wants=systemd-networkd-wait-online.service",
+		"After=systemd-networkd-wait-online.service",
+		"Wants=nss-lookup.target",
+		"After=nss-lookup.target",
 	}
 }
 
 func setWorkingDirectory(svc *service.Config, dir string) {
 	svc.WorkingDirectory = dir
 }
-
-func (p *prog) preStop() {}

cmd/cli/prog_others.go

@@ -1,16 +1,12 @@
 //go:build !linux && !freebsd && !darwin
 
-package main
+package cli
 
 import "github.com/kardianos/service"
 
-func (p *prog) preRun() {}
-
 func setDependencies(svc *service.Config) {}
 
 func setWorkingDirectory(svc *service.Config, dir string) {
 	// WorkingDirectory is not supported on Windows.
 	svc.WorkingDirectory = dir
 }
-
-func (p *prog) preStop() {}

cmd/cli/sema.go

@@ -0,0 +1,24 @@
+package cli
+
+type semaphore interface {
+	acquire()
+	release()
+}
+
+type noopSemaphore struct{}
+
+func (n noopSemaphore) acquire() {}
+
+func (n noopSemaphore) release() {}
+
+type chanSemaphore struct {
+	ready chan struct{}
+}
+
+func (c *chanSemaphore) acquire() {
+	c.ready <- struct{}{}
+}
+
+func (c *chanSemaphore) release() {
+	<-c.ready
+}

cmd/cli/service.go

@@ -0,0 +1,167 @@
+package cli
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"github.com/kardianos/service"
+
+	"github.com/Control-D-Inc/ctrld/internal/router"
+)
+
+// newService wraps service.New call to return service.Service
+// wrapper which is suitable for the current platform.
+func newService(i service.Interface, c *service.Config) (service.Service, error) {
+	s, err := service.New(i, c)
+	if err != nil {
+		return nil, err
+	}
+	switch {
+	case router.IsOldOpenwrt():
+		return &procd{&sysV{s}}, nil
+	case router.IsGLiNet():
+		return &sysV{s}, nil
+	case s.Platform() == "unix-systemv":
+		return &sysV{s}, nil
+	case s.Platform() == "linux-systemd":
+		return &systemd{s}, nil
+	}
+	return s, nil
+}
+
+// sysV wraps a service.Service, and provide start/stop/status command
+// base on "/etc/init.d/<service_name>".
+//
+// Use this on system where "service" command is not available, like GL.iNET router.
+type sysV struct {
+	service.Service
+}
+
+func (s *sysV) installed() bool {
+	fi, err := os.Stat("/etc/init.d/ctrld")
+	if err != nil {
+		return false
+	}
+	mode := fi.Mode()
+	return mode.IsRegular() && (mode&0111) != 0
+}
+
+func (s *sysV) Start() error {
+	if !s.installed() {
+		return service.ErrNotInstalled
+	}
+	_, err := exec.Command("/etc/init.d/ctrld", "start").CombinedOutput()
+	return err
+}
+
+func (s *sysV) Stop() error {
+	if !s.installed() {
+		return service.ErrNotInstalled
+	}
+	_, err := exec.Command("/etc/init.d/ctrld", "stop").CombinedOutput()
+	return err
+}
+
+func (s *sysV) Restart() error {
+	if !s.installed() {
+		return service.ErrNotInstalled
+	}
+	// We don't care about error returned by s.Stop,
+	// because the service may already be stopped.
+	_ = s.Stop()
+	return s.Start()
+}
+
+func (s *sysV) Status() (service.Status, error) {
+	if !s.installed() {
+		return service.StatusUnknown, service.ErrNotInstalled
+	}
+	return unixSystemVServiceStatus()
+}
+
+// procd wraps a service.Service, and provide start/stop command
+// base on "/etc/init.d/<service_name>", status command base on parsing "ps" command output.
+//
+// Use this on system where "/etc/init.d/<service_name> status" command is not available,
+// like old GL.iNET Opal router.
+type procd struct {
+	*sysV
+}
+
+func (s *procd) Status() (service.Status, error) {
+	if !s.installed() {
+		return service.StatusUnknown, service.ErrNotInstalled
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return service.StatusUnknown, nil
+	}
+	// Looking for something like "/sbin/ctrld run ".
+	shellCmd := fmt.Sprintf("ps | grep -q %q", exe+" [r]un ")
+	if err := exec.Command("sh", "-c", shellCmd).Run(); err != nil {
+		return service.StatusStopped, nil
+	}
+	return service.StatusRunning, nil
+}
+
+// procd wraps a service.Service, and provide status command to
+// report the status correctly.
+type systemd struct {
+	service.Service
+}
+
+func (s *systemd) Status() (service.Status, error) {
+	out, _ := exec.Command("systemctl", "status", "ctrld").CombinedOutput()
+	if bytes.Contains(out, []byte("/FAILURE)")) {
+		return service.StatusStopped, nil
+	}
+	return s.Service.Status()
+}
+
+type task struct {
+	f            func() error
+	abortOnError bool
+}
+
+func doTasks(tasks []task) bool {
+	var prevErr error
+	for _, task := range tasks {
+		if err := task.f(); err != nil {
+			if task.abortOnError {
+				mainLog.Load().Error().Msg(errors.Join(prevErr, err).Error())
+				return false
+			}
+			prevErr = err
+		}
+	}
+	return true
+}
+
+func checkHasElevatedPrivilege() {
+	ok, err := hasElevatedPrivilege()
+	if err != nil {
+		mainLog.Load().Error().Msgf("could not detect user privilege: %v", err)
+		return
+	}
+	if !ok {
+		mainLog.Load().Error().Msg("Please relaunch process with admin/root privilege.")
+		os.Exit(1)
+	}
+}
+
+func unixSystemVServiceStatus() (service.Status, error) {
+	out, err := exec.Command("/etc/init.d/ctrld", "status").CombinedOutput()
+	if err != nil {
+		return service.StatusUnknown, nil
+	}
+
+	switch string(bytes.ToLower(bytes.TrimSpace(out))) {
+	case "running":
+		return service.StatusRunning, nil
+	default:
+		return service.StatusStopped, nil
+	}
+}

cmd/cli/service_others.go

@@ -1,6 +1,6 @@
 //go:build !windows
 
-package main
+package cli
 
 import (
 	"os"

cmd/cli/service_windows.go

@@ -1,4 +1,4 @@
-package main
+package cli
 
 import "golang.org/x/sys/windows"
 

cmd/cli/upstream_monitor.go

@@ -0,0 +1,98 @@
+package cli
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/miekg/dns"
+	"tailscale.com/logtail/backoff"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+const (
+	// maxFailureRequest is the maximum failed queries allowed before an upstream is marked as down.
+	maxFailureRequest = 100
+	// checkUpstreamMaxBackoff is the max backoff time when checking upstream status.
+	checkUpstreamMaxBackoff = 2 * time.Minute
+)
+
+// upstreamMonitor performs monitoring upstreams health.
+type upstreamMonitor struct {
+	cfg *ctrld.Config
+
+	down       map[string]*atomic.Bool
+	failureReq map[string]*atomic.Uint64
+
+	mu       sync.Mutex
+	checking map[string]bool
+}
+
+func newUpstreamMonitor(cfg *ctrld.Config) *upstreamMonitor {
+	um := &upstreamMonitor{
+		cfg:        cfg,
+		down:       make(map[string]*atomic.Bool),
+		failureReq: make(map[string]*atomic.Uint64),
+		checking:   make(map[string]bool),
+	}
+	for n := range cfg.Upstream {
+		upstream := upstreamPrefix + n
+		um.down[upstream] = new(atomic.Bool)
+		um.failureReq[upstream] = new(atomic.Uint64)
+	}
+	um.down[upstreamOS] = new(atomic.Bool)
+	um.failureReq[upstreamOS] = new(atomic.Uint64)
+	return um
+}
+
+// increaseFailureCount increase failed queries count for an upstream by 1.
+func (um *upstreamMonitor) increaseFailureCount(upstream string) {
+	failedCount := um.failureReq[upstream].Add(1)
+	um.down[upstream].Store(failedCount >= maxFailureRequest)
+}
+
+// isDown reports whether the given upstream is being marked as down.
+func (um *upstreamMonitor) isDown(upstream string) bool {
+	return um.down[upstream].Load()
+}
+
+// reset marks an upstream as up and set failed queries counter to zero.
+func (um *upstreamMonitor) reset(upstream string) {
+	um.failureReq[upstream].Store(0)
+	um.down[upstream].Store(false)
+}
+
+// checkUpstream checks the given upstream status, periodically sending query to upstream
+// until successfully. An upstream status/counter will be reset once it becomes reachable.
+func (um *upstreamMonitor) checkUpstream(upstream string, uc *ctrld.UpstreamConfig) {
+	um.mu.Lock()
+	isChecking := um.checking[upstream]
+	if isChecking {
+		um.mu.Unlock()
+		return
+	}
+	um.checking[upstream] = true
+	um.mu.Unlock()
+
+	bo := backoff.NewBackoff("checkUpstream", logf, checkUpstreamMaxBackoff)
+	resolver, err := ctrld.NewResolver(uc)
+	if err != nil {
+		mainLog.Load().Warn().Err(err).Msg("could not check upstream")
+		return
+	}
+	msg := new(dns.Msg)
+	msg.SetQuestion(".", dns.TypeNS)
+	ctx := context.Background()
+
+	for {
+		_, err := resolver.Resolve(ctx, msg)
+		if err == nil {
+			mainLog.Load().Debug().Msgf("upstream %q is online", uc.Endpoint)
+			um.reset(upstream)
+			return
+		}
+		bo.BackOff(ctx, err)
+	}
+}

cmd/ctrld/cli.go

@@ -1,949 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"crypto/x509"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/cuonglm/osinfo"
-	"github.com/fsnotify/fsnotify"
-	"github.com/go-playground/validator/v10"
-	"github.com/kardianos/service"
-	"github.com/miekg/dns"
-	"github.com/pelletier/go-toml/v2"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"tailscale.com/logtail/backoff"
-	"tailscale.com/net/interfaces"
-
-	"github.com/Control-D-Inc/ctrld"
-	"github.com/Control-D-Inc/ctrld/internal/certs"
-	"github.com/Control-D-Inc/ctrld/internal/controld"
-	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
-	"github.com/Control-D-Inc/ctrld/internal/router"
-)
-
-const selfCheckFQDN = "verify.controld.com"
-
-var (
-	version = "dev"
-	commit  = "none"
-)
-
-var (
-	v                    = viper.NewWithOptions(viper.KeyDelimiter("::"))
-	defaultConfigWritten = false
-	defaultConfigFile    = "ctrld.toml"
-	rootCertPool         *x509.CertPool
-)
-
-var basicModeFlags = []string{"listen", "primary_upstream", "secondary_upstream", "domains"}
-
-func isNoConfigStart(cmd *cobra.Command) bool {
-	for _, flagName := range basicModeFlags {
-		if cmd.Flags().Lookup(flagName).Changed {
-			return true
-		}
-	}
-	return false
-}
-
-const rootShortDesc = `
-        __         .__       .___
-  _____/  |________|  |    __| _/
-_/ ___\   __\_  __ \  |   / __ |
-\  \___|  |  |  | \/  |__/ /_/ |
- \___  >__|  |__|  |____/\____ |
-     \/ dns forwarding proxy  \/
-`
-
-var rootCmd = &cobra.Command{
-	Use:     "ctrld",
-	Short:   strings.TrimLeft(rootShortDesc, "\n"),
-	Version: curVersion(),
-	PreRun: func(cmd *cobra.Command, args []string) {
-		initConsoleLogging()
-	},
-}
-
-func curVersion() string {
-	if version != "dev" && !strings.HasPrefix(version, "v") {
-		version = "v" + version
-	}
-	if len(commit) > 7 {
-		commit = commit[:7]
-	}
-	return fmt.Sprintf("%s-%s", version, commit)
-}
-
-func initCLI() {
-	// Enable opening via explorer.exe on Windows.
-	// See: https://github.com/spf13/cobra/issues/844.
-	cobra.MousetrapHelpText = ""
-	cobra.EnableCommandSorting = false
-
-	rootCmd.PersistentFlags().CountVarP(
-		&verbose,
-		"verbose",
-		"v",
-		`verbose log output, "-v" basic logging, "-vv" debug level logging`,
-	)
-	rootCmd.PersistentFlags().BoolVarP(
-		&silent,
-		"silent",
-		"s",
-		false,
-		`do not write any log output`,
-	)
-	rootCmd.SetHelpCommand(&cobra.Command{Hidden: true})
-	rootCmd.CompletionOptions.HiddenDefaultCmd = true
-
-	runCmd := &cobra.Command{
-		Use:   "run",
-		Short: "Run the DNS proxy server",
-		Args:  cobra.NoArgs,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-		},
-		Run: func(cmd *cobra.Command, args []string) {
-			if daemon && runtime.GOOS == "windows" {
-				mainLog.Fatal().Msg("Cannot run in daemon mode. Please install a Windows service.")
-			}
-
-			waitCh := make(chan struct{})
-			stopCh := make(chan struct{})
-			if !daemon {
-				// We need to call s.Run() as soon as possible to response to the OS manager, so it
-				// can see ctrld is running and don't mark ctrld as failed service.
-				go func() {
-					p := &prog{
-						waitCh: waitCh,
-						stopCh: stopCh,
-					}
-					s, err := service.New(p, svcConfig)
-					if err != nil {
-						mainLog.Fatal().Err(err).Msg("failed create new service")
-					}
-					s = newService(s)
-					serviceLogger, err := s.Logger(nil)
-					if err != nil {
-						mainLog.Error().Err(err).Msg("failed to get service logger")
-						return
-					}
-
-					if err := s.Run(); err != nil {
-						if sErr := serviceLogger.Error(err); sErr != nil {
-							mainLog.Error().Err(sErr).Msg("failed to write service log")
-						}
-						mainLog.Error().Err(err).Msg("failed to start service")
-					}
-				}()
-			}
-			noConfigStart := isNoConfigStart(cmd)
-			writeDefaultConfig := !noConfigStart && configBase64 == ""
-			tryReadingConfig(writeDefaultConfig)
-
-			readBase64Config(configBase64)
-			processNoConfigFlags(noConfigStart)
-			if err := v.Unmarshal(&cfg); err != nil {
-				mainLog.Fatal().Msgf("failed to unmarshal config: %v", err)
-			}
-
-			mainLog.Info().Msgf("starting ctrld %s", curVersion())
-			oi := osinfo.New()
-			mainLog.Info().Msgf("os: %s", oi.String())
-
-			// Wait for network up.
-			if !ctrldnet.Up() {
-				mainLog.Fatal().Msg("network is not up yet")
-			}
-			processLogAndCacheFlags()
-			// Log config do not have thing to validate, so it's safe to init log here,
-			// so it's able to log information in processCDFlags.
-			initLogging()
-
-			if setupRouter {
-				if err := router.PreStart(); err != nil {
-					mainLog.Fatal().Err(err).Msg("failed to perform router pre-start check")
-				}
-			}
-
-			processCDFlags()
-			if err := ctrld.ValidateConfig(validator.New(), &cfg); err != nil {
-				mainLog.Fatal().Msgf("invalid config: %v", err)
-			}
-			initCache()
-
-			if daemon {
-				exe, err := os.Executable()
-				if err != nil {
-					mainLog.Error().Err(err).Msg("failed to find the binary")
-					os.Exit(1)
-				}
-				curDir, err := os.Getwd()
-				if err != nil {
-					mainLog.Error().Err(err).Msg("failed to get current working directory")
-					os.Exit(1)
-				}
-				// If running as daemon, re-run the command in background, with daemon off.
-				cmd := exec.Command(exe, append(os.Args[1:], "-d=false")...)
-				cmd.Dir = curDir
-				if err := cmd.Start(); err != nil {
-					mainLog.Error().Err(err).Msg("failed to start process as daemon")
-					os.Exit(1)
-				}
-				mainLog.Info().Int("pid", cmd.Process.Pid).Msg("DNS proxy started")
-				os.Exit(0)
-			}
-
-			if setupRouter {
-				switch platform := router.Name(); {
-				case platform == router.DDWrt:
-					rootCertPool = certs.CACertPool()
-					fallthrough
-				case platform != "":
-					mainLog.Debug().Msg("Router setup")
-					err := router.Configure(&cfg)
-					if errors.Is(err, router.ErrNotSupported) {
-						unsupportedPlatformHelp(cmd)
-						os.Exit(1)
-					}
-					if err != nil {
-						mainLog.Fatal().Err(err).Msg("failed to configure router")
-					}
-				}
-			}
-
-			close(waitCh)
-			<-stopCh
-		},
-	}
-	runCmd.Flags().BoolVarP(&daemon, "daemon", "d", false, "Run as daemon")
-	runCmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
-	runCmd.Flags().StringVarP(&configBase64, "base64_config", "", "", "Base64 encoded config")
-	runCmd.Flags().StringVarP(&listenAddress, "listen", "", "", "Listener address and port, in format: address:port")
-	runCmd.Flags().StringVarP(&primaryUpstream, "primary_upstream", "", "", "Primary upstream endpoint")
-	runCmd.Flags().StringVarP(&secondaryUpstream, "secondary_upstream", "", "", "Secondary upstream endpoint")
-	runCmd.Flags().StringSliceVarP(&domains, "domains", "", nil, "List of domain to apply in a split DNS policy")
-	runCmd.Flags().StringVarP(&logPath, "log", "", "", "Path to log file")
-	runCmd.Flags().IntVarP(&cacheSize, "cache_size", "", 0, "Enable cache with size items")
-	runCmd.Flags().StringVarP(&cdUID, "cd", "", "", "Control D resolver uid")
-	runCmd.Flags().StringVarP(&homedir, "homedir", "", "", "")
-	_ = runCmd.Flags().MarkHidden("homedir")
-	runCmd.Flags().StringVarP(&iface, "iface", "", "", `Update DNS setting for iface, "auto" means the default interface gateway`)
-	_ = runCmd.Flags().MarkHidden("iface")
-	runCmd.Flags().BoolVarP(&setupRouter, "router", "", false, `setup for running on router platforms`)
-	_ = runCmd.Flags().MarkHidden("router")
-
-	rootCmd.AddCommand(runCmd)
-
-	startCmd := &cobra.Command{
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-			checkHasElevatedPrivilege()
-		},
-		Use:   "start",
-		Short: "Install and start the ctrld service",
-		Args:  cobra.NoArgs,
-		Run: func(cmd *cobra.Command, args []string) {
-			sc := &service.Config{}
-			*sc = *svcConfig
-			osArgs := os.Args[2:]
-			if os.Args[1] == "service" {
-				osArgs = os.Args[3:]
-			}
-			setDependencies(sc)
-			sc.Arguments = append([]string{"run"}, osArgs...)
-			if err := router.ConfigureService(sc); err != nil {
-				mainLog.Fatal().Err(err).Msg("failed to configure service on router")
-			}
-
-			// No config path, generating config in HOME directory.
-			noConfigStart := isNoConfigStart(cmd)
-			writeDefaultConfig := !noConfigStart && configBase64 == ""
-			if configPath != "" {
-				v.SetConfigFile(configPath)
-			}
-			if dir, err := userHomeDir(); err == nil {
-				setWorkingDirectory(sc, dir)
-				if configPath == "" && writeDefaultConfig {
-					defaultConfigFile = filepath.Join(dir, defaultConfigFile)
-				}
-				sc.Arguments = append(sc.Arguments, "--homedir="+dir)
-			}
-
-			tryReadingConfig(writeDefaultConfig)
-
-			if err := v.Unmarshal(&cfg); err != nil {
-				mainLog.Fatal().Msgf("failed to unmarshal config: %v", err)
-			}
-
-			logPath := cfg.Service.LogPath
-			cfg.Service.LogPath = ""
-			initLogging()
-			cfg.Service.LogPath = logPath
-
-			processCDFlags()
-
-			// Explicitly passing config, so on system where home directory could not be obtained,
-			// or sub-process env is different with the parent, we still behave correctly and use
-			// the expected config file.
-			if configPath == "" {
-				sc.Arguments = append(sc.Arguments, "--config="+defaultConfigFile)
-			}
-
-			prog := &prog{}
-			s, err := service.New(prog, sc)
-			if err != nil {
-				mainLog.Error().Msg(err.Error())
-				return
-			}
-			s = newService(s)
-			tasks := []task{
-				{s.Stop, false},
-				{s.Uninstall, false},
-				{s.Install, false},
-				{s.Start, true},
-			}
-			if doTasks(tasks) {
-				if err := router.PostInstall(); err != nil {
-					mainLog.Warn().Err(err).Msg("post installation failed, please check system/service log for details error")
-					return
-				}
-				status, err := serviceStatus(s)
-				if err != nil {
-					mainLog.Warn().Err(err).Msg("could not get service status")
-					return
-				}
-
-				status = selfCheckStatus(status)
-				switch status {
-				case service.StatusRunning:
-					mainLog.Notice().Msg("Service started")
-				default:
-					mainLog.Error().Msg("Service did not start, please check system/service log for details error")
-					if runtime.GOOS == "linux" {
-						prog.resetDNS()
-					}
-					os.Exit(1)
-				}
-				prog.setDNS()
-			}
-		},
-	}
-	// Keep these flags in sync with runCmd above, except for "-d".
-	startCmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
-	startCmd.Flags().StringVarP(&configBase64, "base64_config", "", "", "Base64 encoded config")
-	startCmd.Flags().StringVarP(&listenAddress, "listen", "", "", "Listener address and port, in format: address:port")
-	startCmd.Flags().StringVarP(&primaryUpstream, "primary_upstream", "", "", "Primary upstream endpoint")
-	startCmd.Flags().StringVarP(&secondaryUpstream, "secondary_upstream", "", "", "Secondary upstream endpoint")
-	startCmd.Flags().StringSliceVarP(&domains, "domains", "", nil, "List of domain to apply in a split DNS policy")
-	startCmd.Flags().StringVarP(&logPath, "log", "", "", "Path to log file")
-	startCmd.Flags().IntVarP(&cacheSize, "cache_size", "", 0, "Enable cache with size items")
-	startCmd.Flags().StringVarP(&cdUID, "cd", "", "", "Control D resolver uid")
-	startCmd.Flags().StringVarP(&iface, "iface", "", "", `Update DNS setting for iface, "auto" means the default interface gateway`)
-	startCmd.Flags().BoolVarP(&setupRouter, "router", "", false, `setup for running on router platforms`)
-	_ = startCmd.Flags().MarkHidden("router")
-
-	stopCmd := &cobra.Command{
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-			checkHasElevatedPrivilege()
-		},
-		Use:   "stop",
-		Short: "Stop the ctrld service",
-		Args:  cobra.NoArgs,
-		Run: func(cmd *cobra.Command, args []string) {
-			prog := &prog{}
-			s, err := service.New(prog, svcConfig)
-			if err != nil {
-				mainLog.Error().Msg(err.Error())
-				return
-			}
-			s = newService(s)
-			initLogging()
-			if doTasks([]task{{s.Stop, true}}) {
-				prog.resetDNS()
-				mainLog.Notice().Msg("Service stopped")
-			}
-		},
-	}
-	stopCmd.Flags().StringVarP(&iface, "iface", "", "", `Reset DNS setting for iface, "auto" means the default interface gateway`)
-
-	restartCmd := &cobra.Command{
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-			checkHasElevatedPrivilege()
-		},
-		Use:   "restart",
-		Short: "Restart the ctrld service",
-		Args:  cobra.NoArgs,
-		Run: func(cmd *cobra.Command, args []string) {
-			s, err := service.New(&prog{}, svcConfig)
-			if err != nil {
-				mainLog.Error().Msg(err.Error())
-				return
-			}
-			s = newService(s)
-			initLogging()
-			if doTasks([]task{{s.Restart, true}}) {
-				mainLog.Notice().Msg("Service restarted")
-			}
-		},
-	}
-
-	statusCmd := &cobra.Command{
-		Use:   "status",
-		Short: "Show status of the ctrld service",
-		Args:  cobra.NoArgs,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-		},
-		Run: func(cmd *cobra.Command, args []string) {
-			s, err := service.New(&prog{}, svcConfig)
-			if err != nil {
-				mainLog.Error().Msg(err.Error())
-				return
-			}
-			s = newService(s)
-			status, err := serviceStatus(s)
-			if err != nil {
-				mainLog.Error().Msg(err.Error())
-				os.Exit(1)
-			}
-			switch status {
-			case service.StatusUnknown:
-				mainLog.Notice().Msg("Unknown status")
-				os.Exit(2)
-			case service.StatusRunning:
-				mainLog.Notice().Msg("Service is running")
-				os.Exit(0)
-			case service.StatusStopped:
-				mainLog.Notice().Msg("Service is stopped")
-				os.Exit(1)
-			}
-		},
-	}
-	if runtime.GOOS == "darwin" {
-		// On darwin, running status command without privileges may return wrong information.
-		statusCmd.PreRun = func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-			checkHasElevatedPrivilege()
-		}
-	}
-
-	uninstallCmd := &cobra.Command{
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-			checkHasElevatedPrivilege()
-		},
-		Use:   "uninstall",
-		Short: "Stop and uninstall the ctrld service",
-		Long: `Stop and uninstall the ctrld service.
-
-NOTE: Uninstalling will set DNS to values provided by DHCP.`,
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, args []string) {
-			prog := &prog{}
-			s, err := service.New(prog, svcConfig)
-			if err != nil {
-				mainLog.Error().Msg(err.Error())
-				return
-			}
-			tasks := []task{
-				{s.Stop, false},
-				{s.Uninstall, true},
-			}
-			initLogging()
-			if doTasks(tasks) {
-				if iface == "" {
-					iface = "auto"
-				}
-				prog.resetDNS()
-				mainLog.Debug().Msg("Router cleanup")
-				if err := router.Cleanup(); err != nil {
-					mainLog.Warn().Err(err).Msg("could not cleanup router")
-				}
-				mainLog.Notice().Msg("Service uninstalled")
-				return
-			}
-		},
-	}
-	uninstallCmd.Flags().StringVarP(&iface, "iface", "", "", `Reset DNS setting for iface, use "auto" for the default gateway interface`)
-
-	listIfacesCmd := &cobra.Command{
-		Use:   "list",
-		Short: "List network interfaces of the host",
-		Args:  cobra.NoArgs,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-		},
-		Run: func(cmd *cobra.Command, args []string) {
-			err := interfaces.ForeachInterface(func(i interfaces.Interface, prefixes []netip.Prefix) {
-				fmt.Printf("Index : %d\n", i.Index)
-				fmt.Printf("Name  : %s\n", i.Name)
-				addrs, _ := i.Addrs()
-				for i, ipaddr := range addrs {
-					if i == 0 {
-						fmt.Printf("Addrs : %v\n", ipaddr)
-						continue
-					}
-					fmt.Printf("        %v\n", ipaddr)
-				}
-				for i, dns := range currentDNS(i.Interface) {
-					if i == 0 {
-						fmt.Printf("DNS   : %s\n", dns)
-						continue
-					}
-					fmt.Printf("      : %s\n", dns)
-				}
-				println()
-			})
-			if err != nil {
-				mainLog.Error().Msg(err.Error())
-			}
-		},
-	}
-	interfacesCmd := &cobra.Command{
-		Use:   "interfaces",
-		Short: "Manage network interfaces",
-		Args:  cobra.OnlyValidArgs,
-		ValidArgs: []string{
-			listIfacesCmd.Use,
-		},
-	}
-	interfacesCmd.AddCommand(listIfacesCmd)
-
-	serviceCmd := &cobra.Command{
-		Use:   "service",
-		Short: "Manage ctrld service",
-		Args:  cobra.OnlyValidArgs,
-		ValidArgs: []string{
-			statusCmd.Use,
-			stopCmd.Use,
-			restartCmd.Use,
-			statusCmd.Use,
-			uninstallCmd.Use,
-			interfacesCmd.Use,
-		},
-	}
-	serviceCmd.AddCommand(startCmd)
-	serviceCmd.AddCommand(stopCmd)
-	serviceCmd.AddCommand(restartCmd)
-	serviceCmd.AddCommand(statusCmd)
-	serviceCmd.AddCommand(uninstallCmd)
-	serviceCmd.AddCommand(interfacesCmd)
-	rootCmd.AddCommand(serviceCmd)
-	startCmdAlias := &cobra.Command{
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-			checkHasElevatedPrivilege()
-		},
-		Use:   "start",
-		Short: "Quick start service and configure DNS on interface",
-		Run: func(cmd *cobra.Command, args []string) {
-			if !cmd.Flags().Changed("iface") {
-				os.Args = append(os.Args, "--iface="+ifaceStartStop)
-			}
-			iface = ifaceStartStop
-			startCmd.Run(cmd, args)
-		},
-	}
-	startCmdAlias.Flags().StringVarP(&ifaceStartStop, "iface", "", "auto", `Update DNS setting for iface, "auto" means the default interface gateway`)
-	startCmdAlias.Flags().AddFlagSet(startCmd.Flags())
-	rootCmd.AddCommand(startCmdAlias)
-	stopCmdAlias := &cobra.Command{
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-			checkHasElevatedPrivilege()
-		},
-		Use:   "stop",
-		Short: "Quick stop service and remove DNS from interface",
-		Run: func(cmd *cobra.Command, args []string) {
-			if !cmd.Flags().Changed("iface") {
-				os.Args = append(os.Args, "--iface="+ifaceStartStop)
-			}
-			iface = ifaceStartStop
-			stopCmd.Run(cmd, args)
-		},
-	}
-	stopCmdAlias.Flags().StringVarP(&ifaceStartStop, "iface", "", "auto", `Reset DNS setting for iface, "auto" means the default interface gateway`)
-	stopCmdAlias.Flags().AddFlagSet(stopCmd.Flags())
-	rootCmd.AddCommand(stopCmdAlias)
-}
-
-func writeConfigFile() error {
-	if cfu := v.ConfigFileUsed(); cfu != "" {
-		defaultConfigFile = cfu
-	} else if configPath != "" {
-		defaultConfigFile = configPath
-	}
-	f, err := os.OpenFile(defaultConfigFile, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, os.FileMode(0o644))
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	if cdUID != "" {
-		if _, err := f.WriteString("# AUTO-GENERATED VIA CD FLAG - DO NOT MODIFY\n\n"); err != nil {
-			return err
-		}
-	}
-	enc := toml.NewEncoder(f).SetIndentTables(true)
-	if err := enc.Encode(&cfg); err != nil {
-		return err
-	}
-	if err := f.Close(); err != nil {
-		return err
-	}
-	return nil
-}
-
-func readConfigFile(writeDefaultConfig bool) bool {
-	// If err == nil, there's a config supplied via `--config`, no default config written.
-	err := v.ReadInConfig()
-	if err == nil {
-		mainLog.Info().Msg("loading config file from: " + v.ConfigFileUsed())
-		defaultConfigFile = v.ConfigFileUsed()
-		return true
-	}
-
-	if !writeDefaultConfig {
-		return false
-	}
-
-	// If error is viper.ConfigFileNotFoundError, write default config.
-	if _, ok := err.(viper.ConfigFileNotFoundError); ok {
-		if err := v.Unmarshal(&cfg); err != nil {
-			mainLog.Fatal().Msgf("failed to unmarshal default config: %v", err)
-		}
-		if err := writeConfigFile(); err != nil {
-			mainLog.Fatal().Msgf("failed to write default config file: %v", err)
-		} else {
-			fp, err := filepath.Abs(defaultConfigFile)
-			if err != nil {
-				mainLog.Fatal().Msgf("failed to get default config file path: %v", err)
-			}
-			mainLog.Info().Msg("writing default config file to: " + fp)
-		}
-		defaultConfigWritten = true
-		return false
-	}
-	// Otherwise, report fatal error and exit.
-	mainLog.Fatal().Msgf("failed to decode config file: %v", err)
-	return false
-}
-
-func readBase64Config(configBase64 string) {
-	if configBase64 == "" {
-		return
-	}
-	configStr, err := base64.StdEncoding.DecodeString(configBase64)
-	if err != nil {
-		mainLog.Fatal().Msgf("invalid base64 config: %v", err)
-	}
-	if err := v.ReadConfig(bytes.NewReader(configStr)); err != nil {
-		mainLog.Fatal().Msgf("failed to read base64 config: %v", err)
-	}
-}
-
-func processNoConfigFlags(noConfigStart bool) {
-	if !noConfigStart {
-		return
-	}
-	if listenAddress == "" || primaryUpstream == "" {
-		mainLog.Fatal().Msg(`"listen" and "primary_upstream" flags must be set in no config mode`)
-	}
-	processListenFlag()
-
-	endpointAndTyp := func(endpoint string) (string, string) {
-		typ := ctrld.ResolverTypeFromEndpoint(endpoint)
-		return strings.TrimPrefix(endpoint, "quic://"), typ
-	}
-	pEndpoint, pType := endpointAndTyp(primaryUpstream)
-	upstream := map[string]*ctrld.UpstreamConfig{
-		"0": {
-			Name:     pEndpoint,
-			Endpoint: pEndpoint,
-			Type:     pType,
-			Timeout:  5000,
-		},
-	}
-	if secondaryUpstream != "" {
-		sEndpoint, sType := endpointAndTyp(secondaryUpstream)
-		upstream["1"] = &ctrld.UpstreamConfig{
-			Name:     sEndpoint,
-			Endpoint: sEndpoint,
-			Type:     sType,
-			Timeout:  5000,
-		}
-		rules := make([]ctrld.Rule, 0, len(domains))
-		for _, domain := range domains {
-			rules = append(rules, ctrld.Rule{domain: []string{"upstream.1"}})
-		}
-		lc := v.Get("listener").(map[string]*ctrld.ListenerConfig)["0"]
-		lc.Policy = &ctrld.ListenerPolicyConfig{Name: "My Policy", Rules: rules}
-	}
-	v.Set("upstream", upstream)
-}
-
-func processCDFlags() {
-	if cdUID == "" {
-		return
-	}
-	if iface == "" {
-		iface = "auto"
-	}
-	logger := mainLog.With().Str("mode", "cd").Logger()
-	logger.Info().Msgf("fetching Controld D configuration from API: %s", cdUID)
-	resolverConfig, err := controld.FetchResolverConfig(cdUID, rootCmd.Version)
-	if uer, ok := err.(*controld.UtilityErrorResponse); ok && uer.ErrorField.Code == controld.InvalidConfigCode {
-		s, err := service.New(&prog{}, svcConfig)
-		if err != nil {
-			logger.Warn().Err(err).Msg("failed to create new service")
-			return
-		}
-
-		if netIface, _ := netInterface(iface); netIface != nil {
-			if err := restoreNetworkManager(); err != nil {
-				logger.Error().Err(err).Msg("could not restore NetworkManager")
-				return
-			}
-			logger.Debug().Str("iface", netIface.Name).Msg("Restoring DNS for interface")
-			if err := resetDNS(netIface); err != nil {
-				logger.Warn().Err(err).Msg("something went wrong while restoring DNS")
-			} else {
-				logger.Debug().Str("iface", netIface.Name).Msg("Restoring DNS successfully")
-			}
-		}
-
-		tasks := []task{{s.Uninstall, true}}
-		if doTasks(tasks) {
-			logger.Info().Msg("uninstalled service")
-		}
-		logger.Fatal().Err(uer).Msg("failed to fetch resolver config")
-	}
-	if err != nil {
-		logger.Warn().Err(err).Msg("could not fetch resolver config")
-		return
-	}
-
-	logger.Info().Msg("generating ctrld config from Control-D configuration")
-	if resolverConfig.Ctrld.CustomConfig != "" {
-		logger.Info().Msg("using defined custom config of Control-D resolver")
-		readBase64Config(resolverConfig.Ctrld.CustomConfig)
-		if err := v.Unmarshal(&cfg); err != nil {
-			mainLog.Fatal().Msgf("failed to unmarshal config: %v", err)
-		}
-		for _, listener := range cfg.Listener {
-			if listener.IP == "" {
-				listener.IP = randomLocalIP()
-			}
-			if listener.Port == 0 {
-				listener.Port = 53
-			}
-		}
-		// On router, we want to keep the listener address point to dnsmasq listener, aka 127.0.0.1:53.
-		if router.Name() != "" {
-			if lc := cfg.Listener["0"]; lc != nil {
-				lc.IP = "127.0.0.1"
-				lc.Port = 53
-			}
-		}
-	} else {
-		cfg = ctrld.Config{}
-		cfg.Network = make(map[string]*ctrld.NetworkConfig)
-		cfg.Network["0"] = &ctrld.NetworkConfig{
-			Name:  "Network 0",
-			Cidrs: []string{"0.0.0.0/0"},
-		}
-		cfg.Upstream = make(map[string]*ctrld.UpstreamConfig)
-		cfg.Upstream["0"] = &ctrld.UpstreamConfig{
-			Endpoint: resolverConfig.DOH,
-			Type:     ctrld.ResolverTypeDOH,
-			Timeout:  5000,
-		}
-		rules := make([]ctrld.Rule, 0, len(resolverConfig.Exclude))
-		for _, domain := range resolverConfig.Exclude {
-			rules = append(rules, ctrld.Rule{domain: []string{}})
-		}
-		cfg.Listener = make(map[string]*ctrld.ListenerConfig)
-		cfg.Listener["0"] = &ctrld.ListenerConfig{
-			IP:   "127.0.0.1",
-			Port: 53,
-			Policy: &ctrld.ListenerPolicyConfig{
-				Name:  "My Policy",
-				Rules: rules,
-			},
-		}
-		processLogAndCacheFlags()
-	}
-
-	if err := writeConfigFile(); err != nil {
-		logger.Fatal().Err(err).Msg("failed to write config file")
-	} else {
-		logger.Info().Msg("writing config file to: " + defaultConfigFile)
-	}
-}
-
-func processListenFlag() {
-	if listenAddress == "" {
-		return
-	}
-	host, portStr, err := net.SplitHostPort(listenAddress)
-	if err != nil {
-		mainLog.Fatal().Msgf("invalid listener address: %v", err)
-	}
-	port, err := strconv.Atoi(portStr)
-	if err != nil {
-		mainLog.Fatal().Msgf("invalid port number: %v", err)
-	}
-	lc := &ctrld.ListenerConfig{
-		IP:   host,
-		Port: port,
-	}
-	v.Set("listener", map[string]*ctrld.ListenerConfig{
-		"0": lc,
-	})
-}
-
-func processLogAndCacheFlags() {
-	if logPath != "" {
-		cfg.Service.LogLevel = "debug"
-		cfg.Service.LogPath = logPath
-	}
-
-	if cacheSize != 0 {
-		cfg.Service.CacheEnable = true
-		cfg.Service.CacheSize = cacheSize
-	}
-	v.Set("service", cfg.Service)
-}
-
-func netInterface(ifaceName string) (*net.Interface, error) {
-	if ifaceName == "auto" {
-		ifaceName = defaultIfaceName()
-	}
-	var iface *net.Interface
-	err := interfaces.ForeachInterface(func(i interfaces.Interface, prefixes []netip.Prefix) {
-		if i.Name == ifaceName {
-			iface = i.Interface
-		}
-	})
-	if iface == nil {
-		return nil, errors.New("interface not found")
-	}
-	if err := patchNetIfaceName(iface); err != nil {
-		return nil, err
-	}
-	return iface, err
-}
-
-func defaultIfaceName() string {
-	dri, err := interfaces.DefaultRouteInterface()
-	if err != nil {
-		mainLog.Fatal().Err(err).Msg("failed to get default route interface")
-	}
-	return dri
-}
-
-func selfCheckStatus(status service.Status) service.Status {
-	c := new(dns.Client)
-	bo := backoff.NewBackoff("self-check", logf, 10*time.Second)
-	bo.LogLongerThan = 500 * time.Millisecond
-	ctx := context.Background()
-	err := errors.New("query failed")
-	maxAttempts := 20
-	mainLog.Debug().Msg("Performing self-check")
-	var (
-		lcChanged map[string]*ctrld.ListenerConfig
-		mu        sync.Mutex
-	)
-	v.OnConfigChange(func(in fsnotify.Event) {
-		mu.Lock()
-		defer mu.Unlock()
-		if err := v.UnmarshalKey("listener", &lcChanged); err != nil {
-			mainLog.Error().Msgf("failed to unmarshal listener config: %v", err)
-			return
-		}
-	})
-	v.WatchConfig()
-	for i := 0; i < maxAttempts; i++ {
-		lc := cfg.Listener["0"]
-		mu.Lock()
-		if lcChanged != nil {
-			lc = lcChanged["0"]
-		}
-		mu.Unlock()
-		m := new(dns.Msg)
-		m.SetQuestion(selfCheckFQDN+".", dns.TypeA)
-		m.RecursionDesired = true
-		r, _, _ := c.ExchangeContext(ctx, m, net.JoinHostPort(lc.IP, strconv.Itoa(lc.Port)))
-		if r != nil && r.Rcode == dns.RcodeSuccess && len(r.Answer) > 0 {
-			mainLog.Debug().Msgf("self-check against %q succeeded", selfCheckFQDN)
-			return status
-		}
-		bo.BackOff(ctx, err)
-	}
-	mainLog.Debug().Msgf("self-check against %q failed", selfCheckFQDN)
-	return service.StatusUnknown
-}
-
-func unsupportedPlatformHelp(cmd *cobra.Command) {
-	mainLog.Error().Msg("Unsupported or incorrectly chosen router platform. Please open an issue and provide all relevant information: https://github.com/Control-D-Inc/ctrld/issues/new")
-}
-
-func userHomeDir() (string, error) {
-	switch router.Name() {
-	case router.DDWrt, router.Merlin:
-		exe, err := os.Executable()
-		if err != nil {
-			return "", err
-		}
-		return filepath.Dir(exe), nil
-	}
-	// viper will expand for us.
-	if runtime.GOOS == "windows" {
-		return os.UserHomeDir()
-	}
-	dir := "/etc/controld"
-	if err := os.MkdirAll(dir, 0750); err != nil {
-		return "", err
-	}
-	return dir, nil
-}
-
-func tryReadingConfig(writeDefaultConfig bool) {
-	configs := []struct {
-		name    string
-		written bool
-	}{
-		// For compatibility, we check for config.toml first, but only read it if exists.
-		{"config", false},
-		{"ctrld", writeDefaultConfig},
-	}
-
-	dir, err := userHomeDir()
-	if err != nil {
-		mainLog.Fatal().Msgf("failed to get config dir: %v", err)
-	}
-	for _, config := range configs {
-		ctrld.SetConfigNameWithPath(v, config.name, dir)
-		v.SetConfigFile(configPath)
-		if readConfigFile(config.written) {
-			break
-		}
-	}
-}

cmd/ctrld/cli_router_linux.go

@@ -1,97 +0,0 @@
-package main
-
-import (
-	"os"
-	"os/exec"
-	"strings"
-
-	"github.com/spf13/cobra"
-
-	"github.com/Control-D-Inc/ctrld/internal/router"
-)
-
-func initRouterCLI() {
-	validArgs := append(router.SupportedPlatforms(), "auto")
-	var b strings.Builder
-	b.WriteString("Auto-setup Control D on a router.\n\nSupported platforms:\n\n")
-	for _, arg := range validArgs {
-		b.WriteString("    ₒ ")
-		b.WriteString(arg)
-		if arg == "auto" {
-			b.WriteString(" - detect the platform you are running on")
-		}
-		b.WriteString("\n")
-	}
-
-	routerCmd := &cobra.Command{
-		Use:   "setup",
-		Short: b.String(),
-		PreRun: func(cmd *cobra.Command, args []string) {
-			initConsoleLogging()
-		},
-		Run: func(cmd *cobra.Command, args []string) {
-			if len(args) == 0 {
-				_ = cmd.Help()
-				return
-			}
-			if len(args) != 1 {
-				_ = cmd.Help()
-				return
-			}
-			platform := args[0]
-			if platform == "auto" {
-				platform = router.Name()
-			}
-			switch platform {
-			case router.DDWrt, router.Merlin, router.OpenWrt, router.Ubios:
-			default:
-				unsupportedPlatformHelp(cmd)
-				os.Exit(1)
-			}
-			exe, err := os.Executable()
-			if err != nil {
-				mainLog.Fatal().Msgf("could not find executable path: %v", err)
-				os.Exit(1)
-			}
-
-			cmdArgs := []string{"start"}
-			cmdArgs = append(cmdArgs, osArgs(platform)...)
-			cmdArgs = append(cmdArgs, "--router")
-			command := exec.Command(exe, cmdArgs...)
-			command.Stdout = os.Stdout
-			command.Stderr = os.Stderr
-			command.Stdin = os.Stdin
-			if err := command.Run(); err != nil {
-				mainLog.Fatal().Msg(err.Error())
-			}
-		},
-	}
-	// Keep these flags in sync with startCmd, except for "--router".
-	routerCmd.Flags().StringVarP(&configPath, "config", "c", "", "Path to config file")
-	routerCmd.Flags().StringVarP(&configBase64, "base64_config", "", "", "Base64 encoded config")
-	routerCmd.Flags().StringVarP(&listenAddress, "listen", "", "", "Listener address and port, in format: address:port")
-	routerCmd.Flags().StringVarP(&primaryUpstream, "primary_upstream", "", "", "Primary upstream endpoint")
-	routerCmd.Flags().StringVarP(&secondaryUpstream, "secondary_upstream", "", "", "Secondary upstream endpoint")
-	routerCmd.Flags().StringSliceVarP(&domains, "domains", "", nil, "List of domain to apply in a split DNS policy")
-	routerCmd.Flags().StringVarP(&logPath, "log", "", "", "Path to log file")
-	routerCmd.Flags().IntVarP(&cacheSize, "cache_size", "", 0, "Enable cache with size items")
-	routerCmd.Flags().StringVarP(&cdUID, "cd", "", "", "Control D resolver uid")
-	routerCmd.Flags().StringVarP(&iface, "iface", "", "", `Update DNS setting for iface, "auto" means the default interface gateway`)
-
-	tmpl := routerCmd.UsageTemplate()
-	tmpl = strings.Replace(tmpl, "{{.UseLine}}", "{{.UseLine}} [platform]", 1)
-	routerCmd.SetUsageTemplate(tmpl)
-	rootCmd.AddCommand(routerCmd)
-}
-
-func osArgs(platform string) []string {
-	args := os.Args[2:]
-	n := 0
-	for _, x := range args {
-		if x != platform && x != "auto" {
-			args[n] = x
-			n++
-		}
-	}
-	return args[:n]
-}

cmd/ctrld/cli_router_others.go

@@ -1,5 +0,0 @@
-//go:build !linux
-
-package main
-
-func initRouterCLI() {}

cmd/ctrld/main.go

@@ -1,134 +1,7 @@
 package main
 
-import (
-	"io"
-	"os"
-	"path/filepath"
-	"time"
-
-	"github.com/kardianos/service"
-	"github.com/rs/zerolog"
-
-	"github.com/Control-D-Inc/ctrld"
-)
-
-var (
-	configPath        string
-	configBase64      string
-	daemon            bool
-	listenAddress     string
-	primaryUpstream   string
-	secondaryUpstream string
-	domains           []string
-	logPath           string
-	homedir           string
-	cacheSize         int
-	cfg               ctrld.Config
-	verbose           int
-	silent            bool
-	cdUID             string
-	iface             string
-	ifaceStartStop    string
-	setupRouter       bool
-
-	mainLog       = zerolog.New(io.Discard)
-	consoleWriter zerolog.ConsoleWriter
-)
+import "github.com/Control-D-Inc/ctrld/cmd/cli"
 
 func main() {
-	ctrld.InitConfig(v, "ctrld")
-	initCLI()
-	initRouterCLI()
-	if err := rootCmd.Execute(); err != nil {
-		mainLog.Error().Msg(err.Error())
-		os.Exit(1)
-	}
-}
-
-func normalizeLogFilePath(logFilePath string) string {
-	if logFilePath == "" || filepath.IsAbs(logFilePath) || service.Interactive() {
-		return logFilePath
-	}
-	if homedir != "" {
-		return filepath.Join(homedir, logFilePath)
-	}
-	dir, _ := userHomeDir()
-	if dir == "" {
-		return logFilePath
-	}
-	return filepath.Join(dir, logFilePath)
-}
-
-func initConsoleLogging() {
-	consoleWriter = zerolog.NewConsoleWriter(func(w *zerolog.ConsoleWriter) {
-		w.TimeFormat = time.StampMilli
-	})
-	multi := zerolog.MultiLevelWriter(consoleWriter)
-	mainLog = mainLog.Output(multi).With().Timestamp().Logger()
-	switch {
-	case silent:
-		zerolog.SetGlobalLevel(zerolog.NoLevel)
-	case verbose == 1:
-		zerolog.SetGlobalLevel(zerolog.InfoLevel)
-	case verbose > 1:
-		zerolog.SetGlobalLevel(zerolog.DebugLevel)
-	default:
-		zerolog.SetGlobalLevel(zerolog.NoticeLevel)
-	}
-}
-
-func initLogging() {
-	writers := []io.Writer{io.Discard}
-	if logFilePath := normalizeLogFilePath(cfg.Service.LogPath); logFilePath != "" {
-		// Create parent directory if necessary.
-		if err := os.MkdirAll(filepath.Dir(logFilePath), 0750); err != nil {
-			mainLog.Error().Msgf("failed to create log path: %v", err)
-			os.Exit(1)
-		}
-		// Backup old log file with .1 suffix.
-		if err := os.Rename(logFilePath, logFilePath+".1"); err != nil && !os.IsNotExist(err) {
-			mainLog.Error().Msgf("could not backup old log file: %v", err)
-		}
-		logFile, err := os.OpenFile(logFilePath, os.O_CREATE|os.O_RDWR, os.FileMode(0o600))
-		if err != nil {
-			mainLog.Error().Msgf("failed to create log file: %v", err)
-			os.Exit(1)
-		}
-		writers = append(writers, logFile)
-	}
-	writers = append(writers, consoleWriter)
-	multi := zerolog.MultiLevelWriter(writers...)
-	mainLog = mainLog.Output(multi).With().Timestamp().Logger()
-	// TODO: find a better way.
-	ctrld.ProxyLog = mainLog
-
-	zerolog.SetGlobalLevel(zerolog.NoticeLevel)
-	logLevel := cfg.Service.LogLevel
-	switch {
-	case silent:
-		zerolog.SetGlobalLevel(zerolog.NoLevel)
-		return
-	case verbose == 1:
-		logLevel = "info"
-	case verbose > 1:
-		logLevel = "debug"
-	}
-	if logLevel == "" {
-		return
-	}
-	level, err := zerolog.ParseLevel(logLevel)
-	if err != nil {
-		mainLog.Warn().Err(err).Msg("could not set log level")
-		return
-	}
-	zerolog.SetGlobalLevel(level)
-}
-
-func initCache() {
-	if !cfg.Service.CacheEnable {
-		return
-	}
-	if cfg.Service.CacheSize == 0 {
-		cfg.Service.CacheSize = 4096
-	}
+	cli.Main()
 }

cmd/ctrld/os_linux.go

@@ -1,195 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"fmt"
-	"net"
-	"net/netip"
-	"os/exec"
-	"reflect"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/insomniacslk/dhcp/dhcpv4/nclient4"
-	"github.com/insomniacslk/dhcp/dhcpv6"
-	"github.com/insomniacslk/dhcp/dhcpv6/client6"
-	"tailscale.com/util/dnsname"
-
-	"github.com/Control-D-Inc/ctrld/internal/dns"
-	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
-	"github.com/Control-D-Inc/ctrld/internal/resolvconffile"
-)
-
-// allocate loopback ip
-// sudo ip a add 127.0.0.2/24 dev lo
-func allocateIP(ip string) error {
-	cmd := exec.Command("ip", "a", "add", ip+"/24", "dev", "lo")
-	if out, err := cmd.CombinedOutput(); err != nil {
-		mainLog.Error().Err(err).Msgf("allocateIP failed: %s", string(out))
-		return err
-	}
-	return nil
-}
-
-func deAllocateIP(ip string) error {
-	cmd := exec.Command("ip", "a", "del", ip+"/24", "dev", "lo")
-	if err := cmd.Run(); err != nil {
-		mainLog.Error().Err(err).Msg("deAllocateIP failed")
-		return err
-	}
-	return nil
-}
-
-const maxSetDNSAttempts = 5
-
-// set the dns server for the provided network interface
-func setDNS(iface *net.Interface, nameservers []string) error {
-	r, err := dns.NewOSConfigurator(logf, iface.Name)
-	if err != nil {
-		mainLog.Error().Err(err).Msg("failed to create DNS OS configurator")
-		return err
-	}
-
-	ns := make([]netip.Addr, 0, len(nameservers))
-	for _, nameserver := range nameservers {
-		ns = append(ns, netip.MustParseAddr(nameserver))
-	}
-
-	osConfig := dns.OSConfig{
-		Nameservers:   ns,
-		SearchDomains: []dnsname.FQDN{},
-	}
-
-	for i := 0; i < maxSetDNSAttempts; i++ {
-		if err := r.SetDNS(osConfig); err != nil {
-			return err
-		}
-		currentNS := currentDNS(iface)
-		if reflect.DeepEqual(currentNS, nameservers) {
-			return nil
-		}
-	}
-	mainLog.Debug().Msg("DNS was not set for some reason")
-	return nil
-}
-
-func resetDNS(iface *net.Interface) (err error) {
-	defer func() {
-		if err == nil {
-			return
-		}
-		if r, oerr := dns.NewOSConfigurator(logf, iface.Name); oerr == nil {
-			_ = r.SetDNS(dns.OSConfig{})
-			if err := r.Close(); err != nil {
-				mainLog.Error().Err(err).Msg("failed to rollback DNS setting")
-				return
-			}
-			err = nil
-		}
-	}()
-
-	var ns []string
-	c, err := nclient4.New(iface.Name)
-	if err != nil {
-		return fmt.Errorf("nclient4.New: %w", err)
-	}
-	defer c.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
-	defer cancel()
-	lease, err := c.Request(ctx)
-	if err != nil {
-		return fmt.Errorf("nclient4.Request: %w", err)
-	}
-	for _, nameserver := range lease.ACK.DNS() {
-		if nameserver.Equal(net.IPv4zero) {
-			continue
-		}
-		ns = append(ns, nameserver.String())
-	}
-
-	// TODO(cuonglm): handle DHCPv6 properly.
-	if ctrldnet.IPv6Available(ctx) {
-		c := client6.NewClient()
-		conversation, err := c.Exchange(iface.Name)
-		if err != nil {
-			mainLog.Debug().Err(err).Msg("could not exchange DHCPv6")
-		}
-		for _, packet := range conversation {
-			if packet.Type() == dhcpv6.MessageTypeReply {
-				msg, err := packet.GetInnerMessage()
-				if err != nil {
-					mainLog.Debug().Err(err).Msg("could not get inner DHCPv6 message")
-					return nil
-				}
-				nameservers := msg.Options.DNS()
-				for _, nameserver := range nameservers {
-					ns = append(ns, nameserver.String())
-				}
-			}
-		}
-	}
-
-	return ignoringEINTR(func() error {
-		return setDNS(iface, ns)
-	})
-}
-
-func currentDNS(iface *net.Interface) []string {
-	for _, fn := range []getDNS{getDNSByResolvectl, getDNSByNmcli, resolvconffile.NameServers} {
-		if ns := fn(iface.Name); len(ns) > 0 {
-			return ns
-		}
-	}
-	return nil
-}
-
-func getDNSByResolvectl(iface string) []string {
-	b, err := exec.Command("resolvectl", "dns", "-i", iface).Output()
-	if err != nil {
-		return nil
-	}
-
-	parts := strings.Fields(strings.SplitN(string(b), "%", 2)[0])
-	if len(parts) > 2 {
-		return parts[3:]
-	}
-	return nil
-}
-
-func getDNSByNmcli(iface string) []string {
-	b, err := exec.Command("nmcli", "dev", "show", iface).Output()
-	if err != nil {
-		return nil
-	}
-	s := bufio.NewScanner(bytes.NewReader(b))
-	var dns []string
-	do := func(line string) {
-		parts := strings.SplitN(line, ":", 2)
-		if len(parts) > 1 {
-			dns = append(dns, strings.TrimSpace(parts[1]))
-		}
-	}
-	for s.Scan() {
-		line := s.Text()
-		switch {
-		case strings.HasPrefix(line, "IP4.DNS"):
-			fallthrough
-		case strings.HasPrefix(line, "IP6.DNS"):
-			do(line)
-		}
-	}
-	return dns
-}
-
-func ignoringEINTR(fn func() error) error {
-	for {
-		err := fn()
-		if err != syscall.EINTR {
-			return err
-		}
-	}
-}

cmd/ctrld/prog.go

@@ -1,241 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"math/rand"
-	"net"
-	"os"
-	"strconv"
-	"sync"
-	"syscall"
-
-	"github.com/kardianos/service"
-
-	"github.com/Control-D-Inc/ctrld"
-	"github.com/Control-D-Inc/ctrld/internal/dnscache"
-	"github.com/Control-D-Inc/ctrld/internal/router"
-)
-
-var logf = func(format string, args ...any) {
-	mainLog.Debug().Msgf(format, args...)
-}
-
-var errWindowsAddrInUse = syscall.Errno(0x2740)
-
-var svcConfig = &service.Config{
-	Name:        "ctrld",
-	DisplayName: "Control-D Helper Service",
-	Option:      service.KeyValue{},
-}
-
-type prog struct {
-	mu     sync.Mutex
-	waitCh chan struct{}
-	stopCh chan struct{}
-
-	cfg   *ctrld.Config
-	cache dnscache.Cacher
-}
-
-func (p *prog) Start(s service.Service) error {
-	p.cfg = &cfg
-	go p.run()
-	return nil
-}
-
-func (p *prog) run() {
-	// Wait the caller to signal that we can do our logic.
-	<-p.waitCh
-	p.preRun()
-	if p.cfg.Service.CacheEnable {
-		cacher, err := dnscache.NewLRUCache(p.cfg.Service.CacheSize)
-		if err != nil {
-			mainLog.Error().Err(err).Msg("failed to create cacher, caching is disabled")
-		} else {
-			p.cache = cacher
-		}
-	}
-	var wg sync.WaitGroup
-	wg.Add(len(p.cfg.Listener))
-
-	for _, nc := range p.cfg.Network {
-		for _, cidr := range nc.Cidrs {
-			_, ipNet, err := net.ParseCIDR(cidr)
-			if err != nil {
-				mainLog.Error().Err(err).Str("network", nc.Name).Str("cidr", cidr).Msg("invalid cidr")
-				continue
-			}
-			nc.IPNets = append(nc.IPNets, ipNet)
-		}
-	}
-	for n := range p.cfg.Upstream {
-		uc := p.cfg.Upstream[n]
-		uc.Init()
-		if uc.BootstrapIP == "" {
-			uc.SetupBootstrapIP()
-			mainLog.Info().Msgf("Bootstrap IPs for upstream.%s: %q", n, uc.BootstrapIPs())
-		} else {
-			mainLog.Info().Str("bootstrap_ip", uc.BootstrapIP).Msgf("Using bootstrap IP for upstream.%s", n)
-		}
-		uc.SetCertPool(rootCertPool)
-		uc.SetupTransport()
-	}
-
-	go p.watchLinkState()
-
-	for listenerNum := range p.cfg.Listener {
-		p.cfg.Listener[listenerNum].Init()
-		go func(listenerNum string) {
-			defer wg.Done()
-			listenerConfig := p.cfg.Listener[listenerNum]
-			upstreamConfig := p.cfg.Upstream[listenerNum]
-			if upstreamConfig == nil {
-				mainLog.Warn().Msgf("no default upstream for: [listener.%s]", listenerNum)
-			}
-			addr := net.JoinHostPort(listenerConfig.IP, strconv.Itoa(listenerConfig.Port))
-			mainLog.Info().Msgf("Starting DNS server on listener.%s: %s", listenerNum, addr)
-			err := p.serveDNS(listenerNum)
-			if err != nil && !defaultConfigWritten && cdUID == "" {
-				mainLog.Fatal().Err(err).Msgf("Unable to start dns proxy on listener.%s", listenerNum)
-				return
-			}
-			if err == nil {
-				return
-			}
-
-			if opErr, ok := err.(*net.OpError); ok && listenerNum == "0" {
-				if sErr, ok := opErr.Err.(*os.SyscallError); ok && errors.Is(opErr.Err, syscall.EADDRINUSE) || errors.Is(sErr.Err, errWindowsAddrInUse) {
-					mainLog.Warn().Msgf("Address %s already in used, pick a random one", addr)
-					ip := randomLocalIP()
-					listenerConfig.IP = ip
-					port := listenerConfig.Port
-					cfg.Upstream = map[string]*ctrld.UpstreamConfig{"0": cfg.Upstream["0"]}
-					if err := writeConfigFile(); err != nil {
-						mainLog.Fatal().Err(err).Msg("failed to write config file")
-					} else {
-						mainLog.Info().Msg("writing config file to: " + defaultConfigFile)
-					}
-					p.mu.Lock()
-					p.cfg.Service.AllocateIP = true
-					p.mu.Unlock()
-					p.preRun()
-					mainLog.Info().Msgf("Starting DNS server on listener.%s: %s", listenerNum, net.JoinHostPort(ip, strconv.Itoa(port)))
-					if err := p.serveDNS(listenerNum); err != nil {
-						mainLog.Fatal().Err(err).Msgf("Unable to start dns proxy on listener.%s", listenerNum)
-						return
-					}
-				}
-			}
-			mainLog.Fatal().Err(err).Msgf("Unable to start dns proxy on listener.%s", listenerNum)
-		}(listenerNum)
-	}
-
-	wg.Wait()
-}
-
-func (p *prog) Stop(s service.Service) error {
-	if err := p.deAllocateIP(); err != nil {
-		mainLog.Error().Err(err).Msg("de-allocate ip failed")
-		return err
-	}
-	p.preStop()
-	if err := router.Stop(); err != nil {
-		mainLog.Warn().Err(err).Msg("problem occurred while stopping router")
-	}
-	mainLog.Info().Msg("Service stopped")
-	close(p.stopCh)
-	return nil
-}
-
-func (p *prog) allocateIP(ip string) error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if !p.cfg.Service.AllocateIP {
-		return nil
-	}
-	return allocateIP(ip)
-}
-
-func (p *prog) deAllocateIP() error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if !p.cfg.Service.AllocateIP {
-		return nil
-	}
-	for _, lc := range p.cfg.Listener {
-		if err := deAllocateIP(lc.IP); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (p *prog) setDNS() {
-	switch router.Name() {
-	case router.DDWrt, router.OpenWrt, router.Ubios:
-		// On router, ctrld run as a DNS forwarder, it does not have to change system DNS.
-		// Except for Merlin, which has WAN DNS setup on boot for NTP.
-		return
-	}
-	if cfg.Listener == nil || cfg.Listener["0"] == nil {
-		return
-	}
-	if iface == "" {
-		return
-	}
-	if iface == "auto" {
-		iface = defaultIfaceName()
-	}
-	logger := mainLog.With().Str("iface", iface).Logger()
-	netIface, err := netInterface(iface)
-	if err != nil {
-		logger.Error().Err(err).Msg("could not get interface")
-		return
-	}
-	if err := setupNetworkManager(); err != nil {
-		logger.Error().Err(err).Msg("could not patch NetworkManager")
-		return
-	}
-	logger.Debug().Msg("setting DNS for interface")
-	if err := setDNS(netIface, []string{cfg.Listener["0"].IP}); err != nil {
-		logger.Error().Err(err).Msgf("could not set DNS for interface")
-		return
-	}
-	logger.Debug().Msg("setting DNS successfully")
-}
-
-func (p *prog) resetDNS() {
-	switch router.Name() {
-	case router.DDWrt, router.OpenWrt, router.Ubios:
-		// See comment in p.setDNS method.
-		return
-	}
-	if iface == "" {
-		return
-	}
-	if iface == "auto" {
-		iface = defaultIfaceName()
-	}
-	logger := mainLog.With().Str("iface", iface).Logger()
-	netIface, err := netInterface(iface)
-	if err != nil {
-		logger.Error().Err(err).Msg("could not get interface")
-		return
-	}
-	if err := restoreNetworkManager(); err != nil {
-		logger.Error().Err(err).Msg("could not restore NetworkManager")
-		return
-	}
-	logger.Debug().Msg("Restoring DNS for interface")
-	if err := resetDNS(netIface); err != nil {
-		logger.Error().Err(err).Msgf("could not reset DNS")
-		return
-	}
-	logger.Debug().Msg("Restoring DNS successfully")
-}
-
-func randomLocalIP() string {
-	n := rand.Intn(254-2) + 2
-	return fmt.Sprintf("127.0.0.%d", n)
-}

cmd/ctrld/service.go

@@ -1,94 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"errors"
-	"os"
-	"os/exec"
-
-	"github.com/kardianos/service"
-
-	"github.com/Control-D-Inc/ctrld/internal/router"
-)
-
-func newService(s service.Service) service.Service {
-	// TODO: unify for other SysV system.
-	if router.IsGLiNet() {
-		return &sysV{s}
-	}
-	return s
-}
-
-// sysV wraps a service.Service, and provide start/stop/status command
-// base on "/etc/init.d/<service_name>".
-//
-// Use this on system wherer "service" command is not available, like GL.iNET router.
-type sysV struct {
-	service.Service
-}
-
-func (s *sysV) Start() error {
-	_, err := exec.Command("/etc/init.d/ctrld", "start").CombinedOutput()
-	return err
-}
-
-func (s *sysV) Stop() error {
-	_, err := exec.Command("/etc/init.d/ctrld", "stop").CombinedOutput()
-	return err
-}
-
-func (s *sysV) Status() (service.Status, error) {
-	return unixSystemVServiceStatus()
-}
-
-type task struct {
-	f            func() error
-	abortOnError bool
-}
-
-func doTasks(tasks []task) bool {
-	var prevErr error
-	for _, task := range tasks {
-		if err := task.f(); err != nil {
-			if task.abortOnError {
-				mainLog.Error().Msg(errors.Join(prevErr, err).Error())
-				return false
-			}
-			prevErr = err
-		}
-	}
-	return true
-}
-
-func checkHasElevatedPrivilege() {
-	ok, err := hasElevatedPrivilege()
-	if err != nil {
-		mainLog.Error().Msgf("could not detect user privilege: %v", err)
-		return
-	}
-	if !ok {
-		mainLog.Error().Msg("Please relaunch process with admin/root privilege.")
-		os.Exit(1)
-	}
-}
-
-func serviceStatus(s service.Service) (service.Status, error) {
-	status, err := s.Status()
-	if err != nil && service.Platform() == "unix-systemv" {
-		return unixSystemVServiceStatus()
-	}
-	return status, err
-}
-
-func unixSystemVServiceStatus() (service.Status, error) {
-	out, err := exec.Command("/etc/init.d/ctrld", "status").CombinedOutput()
-	if err != nil {
-		return service.StatusUnknown, nil
-	}
-	switch string(bytes.TrimSpace(out)) {
-	case "running":
-		return service.StatusRunning, nil
-	default:
-		return service.StatusStopped, nil
-	}
-}

cmd/ctrld_library/main.go

@@ -0,0 +1,74 @@
+package ctrld_library
+
+import (
+	"github.com/Control-D-Inc/ctrld/cmd/cli"
+)
+
+// Controller holds global state
+type Controller struct {
+	stopCh      chan struct{}
+	AppCallback AppCallback
+	Config      cli.AppConfig
+}
+
+// NewController provides reference to global state to be managed by android vpn service and iOS network extension.
+// reference is not safe for concurrent use.
+func NewController(appCallback AppCallback) *Controller {
+	return &Controller{AppCallback: appCallback}
+}
+
+// AppCallback provides access to app instance.
+type AppCallback interface {
+	Hostname() string
+	LanIp() string
+	MacAddress() string
+	Exit(error string)
+}
+
+// Start configures utility with config.toml from provided directory.
+// This function will block until Stop is called
+// Check port availability prior to calling it.
+func (c *Controller) Start(CdUID string, HomeDir string, logLevel int, logPath string) {
+	if c.stopCh == nil {
+		c.stopCh = make(chan struct{})
+		c.Config = cli.AppConfig{
+			CdUID:   CdUID,
+			HomeDir: HomeDir,
+			Verbose: logLevel,
+			LogPath: logPath,
+		}
+		appCallback := mapCallback(c.AppCallback)
+		cli.RunMobile(&c.Config, &appCallback, c.stopCh)
+	}
+}
+
+// As workaround to avoid circular dependency between cli and ctrld_library module
+func mapCallback(callback AppCallback) cli.AppCallback {
+	return cli.AppCallback{
+		HostName: func() string {
+			return callback.Hostname()
+		},
+		LanIp: func() string {
+			return callback.LanIp()
+		},
+		MacAddress: func() string {
+			return callback.MacAddress()
+		},
+		Exit: func(err string) {
+			callback.Exit(err)
+		},
+	}
+}
+
+func (c *Controller) Stop() bool {
+	if c.stopCh != nil {
+		close(c.stopCh)
+		c.stopCh = nil
+		return true
+	}
+	return false
+}
+
+func (c *Controller) IsRunning() bool {
+	return c.stopCh != nil
+}

config.go

@@ -2,16 +2,23 @@ package ctrld
 
 import (
 	"context"
+	crand "crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/hex"
 	"errors"
+	"io"
 	"math/rand"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
+	"runtime"
+	"sort"
+	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/go-playground/validator/v10"
@@ -24,14 +31,31 @@ import (
 	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
 )
 
+// IpStackBoth ...
 const (
-	IpStackBoth  = "both"
-	IpStackV4    = "v4"
-	IpStackV6    = "v6"
+	// IpStackBoth indicates that ctrld will use either ipv4 or ipv6 for connecting to upstream,
+	// depending on which stack is available when receiving the DNS query.
+	IpStackBoth = "both"
+	// IpStackV4 indicates that ctrld will use only ipv4 for connecting to upstream.
+	IpStackV4 = "v4"
+	// IpStackV6 indicates that ctrld will use only ipv6 for connecting to upstream.
+	IpStackV6 = "v6"
+	// IpStackSplit indicates that ctrld will use either ipv4 or ipv6 for connecting to upstream,
+	// depending on the record type of the DNS query.
 	IpStackSplit = "split"
+
+	controlDComDomain = "controld.com"
+	controlDNetDomain = "controld.net"
+	controlDDevDomain = "controld.dev"
 )
 
-var controldParentDomains = []string{"controld.com", "controld.net", "controld.dev"}
+var (
+	controldParentDomains  = []string{controlDComDomain, controlDNetDomain, controlDDevDomain}
+	controldVerifiedDomain = map[string]string{
+		controlDComDomain: "verify.controld.com",
+		controlDDevDomain: "verify.controld.dev",
+	}
+)
 
 // SetConfigName set the config name that ctrld will look for.
 // DEPRECATED: use SetConfigNameWithPath instead.
@@ -56,8 +80,8 @@ func SetConfigNameWithPath(v *viper.Viper, name, configPath string) {
 func InitConfig(v *viper.Viper, name string) {
 	v.SetDefault("listener", map[string]*ListenerConfig{
 		"0": {
-			IP:   "127.0.0.1",
-			Port: 53,
+			IP:   "",
+			Port: 0,
 		},
 	})
 	v.SetDefault("network", map[string]*NetworkConfig{
@@ -103,16 +127,62 @@ func (c *Config) HasUpstreamSendClientInfo() bool {
 	return false
 }
 
+// FirstListener returns the first listener config of current config. Listeners are sorted numerically.
+//
+// It panics if Config has no listeners configured.
+func (c *Config) FirstListener() *ListenerConfig {
+	listeners := make([]int, 0, len(c.Listener))
+	for k := range c.Listener {
+		n, err := strconv.Atoi(k)
+		if err != nil {
+			continue
+		}
+		listeners = append(listeners, n)
+	}
+	if len(listeners) == 0 {
+		panic("missing listener config")
+	}
+	sort.Ints(listeners)
+	return c.Listener[strconv.Itoa(listeners[0])]
+}
+
+// FirstUpstream returns the first upstream of current config. Upstreams are sorted numerically.
+//
+// It panics if Config has no upstreams configured.
+func (c *Config) FirstUpstream() *UpstreamConfig {
+	upstreams := make([]int, 0, len(c.Upstream))
+	for k := range c.Upstream {
+		n, err := strconv.Atoi(k)
+		if err != nil {
+			continue
+		}
+		upstreams = append(upstreams, n)
+	}
+	if len(upstreams) == 0 {
+		panic("missing listener config")
+	}
+	sort.Ints(upstreams)
+	return c.Upstream[strconv.Itoa(upstreams[0])]
+}
+
 // ServiceConfig specifies the general ctrld config.
 type ServiceConfig struct {
-	LogLevel         string `mapstructure:"log_level" toml:"log_level,omitempty"`
-	LogPath          string `mapstructure:"log_path" toml:"log_path,omitempty"`
-	CacheEnable      bool   `mapstructure:"cache_enable" toml:"cache_enable,omitempty"`
-	CacheSize        int    `mapstructure:"cache_size" toml:"cache_size,omitempty"`
-	CacheTTLOverride int    `mapstructure:"cache_ttl_override" toml:"cache_ttl_override,omitempty"`
-	CacheServeStale  bool   `mapstructure:"cache_serve_stale" toml:"cache_serve_stale,omitempty"`
-	Daemon           bool   `mapstructure:"-" toml:"-"`
-	AllocateIP       bool   `mapstructure:"-" toml:"-"`
+	LogLevel              string `mapstructure:"log_level" toml:"log_level,omitempty"`
+	LogPath               string `mapstructure:"log_path" toml:"log_path,omitempty"`
+	CacheEnable           bool   `mapstructure:"cache_enable" toml:"cache_enable,omitempty"`
+	CacheSize             int    `mapstructure:"cache_size" toml:"cache_size,omitempty"`
+	CacheTTLOverride      int    `mapstructure:"cache_ttl_override" toml:"cache_ttl_override,omitempty"`
+	CacheServeStale       bool   `mapstructure:"cache_serve_stale" toml:"cache_serve_stale,omitempty"`
+	MaxConcurrentRequests *int   `mapstructure:"max_concurrent_requests" toml:"max_concurrent_requests,omitempty" validate:"omitempty,gte=0"`
+	DHCPLeaseFile         string `mapstructure:"dhcp_lease_file_path" toml:"dhcp_lease_file_path" validate:"omitempty,file"`
+	DHCPLeaseFileFormat   string `mapstructure:"dhcp_lease_file_format" toml:"dhcp_lease_file_format" validate:"required_unless=DHCPLeaseFile '',omitempty,oneof=dnsmasq isc-dhcp"`
+	DiscoverMDNS          *bool  `mapstructure:"discover_mdns" toml:"discover_mdns,omitempty"`
+	DiscoverARP           *bool  `mapstructure:"discover_arp" toml:"discover_dhcp,omitempty"`
+	DiscoverDHCP          *bool  `mapstructure:"discover_dhcp" toml:"discover_dhcp,omitempty"`
+	DiscoverPtr           *bool  `mapstructure:"discover_ptr" toml:"discover_ptr,omitempty"`
+	DiscoverHosts         *bool  `mapstructure:"discover_hosts" toml:"discover_hosts,omitempty"`
+	Daemon                bool   `mapstructure:"-" toml:"-"`
+	AllocateIP            bool   `mapstructure:"-" toml:"-"`
 }
 
 // NetworkConfig specifies configuration for networks where ctrld will handle requests.
@@ -126,7 +196,7 @@ type NetworkConfig struct {
 type UpstreamConfig struct {
 	Name        string `mapstructure:"name" toml:"name,omitempty"`
 	Type        string `mapstructure:"type" toml:"type,omitempty" validate:"oneof=doh doh3 dot doq os legacy"`
-	Endpoint    string `mapstructure:"endpoint" toml:"endpoint,omitempty" validate:"required_unless=Type os"`
+	Endpoint    string `mapstructure:"endpoint" toml:"endpoint,omitempty"`
 	BootstrapIP string `mapstructure:"bootstrap_ip" toml:"bootstrap_ip,omitempty"`
 	Domain      string `mapstructure:"-" toml:"-"`
 	IPStack     string `mapstructure:"ip_stack" toml:"ip_stack,omitempty" validate:"ipstack"`
@@ -136,11 +206,12 @@ type UpstreamConfig struct {
 	SendClientInfo *bool `mapstructure:"send_client_info" toml:"send_client_info,omitempty"`
 
 	g                  singleflight.Group
-	mu                 sync.Mutex
+	rebootstrap        atomic.Bool
 	bootstrapIPs       []string
 	bootstrapIPs4      []string
 	bootstrapIPs6      []string
 	transport          *http.Transport
+	transportOnce      sync.Once
 	transport4         *http.Transport
 	transport6         *http.Transport
 	http3RoundTripper  http.RoundTripper
@@ -148,6 +219,7 @@ type UpstreamConfig struct {
 	http3RoundTripper6 http.RoundTripper
 	certPool           *x509.CertPool
 	u                  *url.URL
+	uid                string
 }
 
 // ListenerConfig specifies the networks configuration that ctrld will run on.
@@ -158,6 +230,24 @@ type ListenerConfig struct {
 	Policy     *ListenerPolicyConfig `mapstructure:"policy" toml:"policy,omitempty"`
 }
 
+// IsDirectDnsListener reports whether ctrld can be a direct listener on port 53.
+// It returns true only if ctrld can listen on port 53 for all interfaces. That means
+// there's no other software listening on port 53.
+//
+// If someone listening on port 53, or ctrld could only listen on port 53 for a specific
+// interface, ctrld could only be configured as a DNS forwarder.
+func (lc *ListenerConfig) IsDirectDnsListener() bool {
+	if lc == nil || lc.Port != 53 {
+		return false
+	}
+	switch lc.IP {
+	case "", "::", "0.0.0.0":
+		return true
+	default:
+		return false
+	}
+}
+
 // ListenerPolicyConfig specifies the policy rules for ctrld to filter incoming requests.
 type ListenerPolicyConfig struct {
 	Name                 string   `mapstructure:"name" toml:"name,omitempty"`
@@ -174,6 +264,7 @@ type Rule map[string][]string
 
 // Init initialized necessary values for an UpstreamConfig.
 func (uc *UpstreamConfig) Init() {
+	uc.uid = upstreamUID()
 	if u, err := url.Parse(uc.Endpoint); err == nil {
 		uc.Domain = u.Host
 		switch uc.Type {
@@ -201,6 +292,23 @@ func (uc *UpstreamConfig) Init() {
 	}
 }
 
+// VerifyDomain returns the domain name that could be resolved by the upstream endpoint.
+// It returns empty for non-ControlD upstream endpoint.
+func (uc *UpstreamConfig) VerifyDomain() string {
+	domain := uc.Domain
+	if domain == "" {
+		if u, err := url.Parse(uc.Endpoint); err == nil {
+			domain = u.Hostname()
+		}
+	}
+	for _, parent := range controldParentDomains {
+		if dns.IsSubDomain(parent, domain) {
+			return controldVerifiedDomain[parent]
+		}
+	}
+	return ""
+}
+
 // UpstreamSendClientInfo reports whether the upstream is
 // configured to send client info to Control D DNS server.
 //
@@ -209,11 +317,8 @@ func (uc *UpstreamConfig) Init() {
 //   - Lan IP
 //   - Hostname
 func (uc *UpstreamConfig) UpstreamSendClientInfo() bool {
-	if uc.SendClientInfo != nil && !(*uc.SendClientInfo) {
-		return false
-	}
-	if uc.SendClientInfo == nil {
-		return true
+	if uc.SendClientInfo != nil {
+		return *uc.SendClientInfo
 	}
 	switch uc.Type {
 	case ResolverTypeDOH, ResolverTypeDOH3:
@@ -224,6 +329,7 @@ func (uc *UpstreamConfig) UpstreamSendClientInfo() bool {
 	return false
 }
 
+// BootstrapIPs returns the bootstrap IPs list of upstreams.
 func (uc *UpstreamConfig) BootstrapIPs() []string {
 	return uc.bootstrapIPs
 }
@@ -239,16 +345,35 @@ func (uc *UpstreamConfig) SetupBootstrapIP() {
 	uc.setupBootstrapIP(true)
 }
 
+// UID returns the unique identifier of the upstream.
+func (uc *UpstreamConfig) UID() string {
+	return uc.uid
+}
+
 // SetupBootstrapIP manually find all available IPs of the upstream.
 // The first usable IP will be used as bootstrap IP of the upstream.
 func (uc *UpstreamConfig) setupBootstrapIP(withBootstrapDNS bool) {
-	b := backoff.NewBackoff("setupBootstrapIP", func(format string, args ...any) {}, 2*time.Second)
+	b := backoff.NewBackoff("setupBootstrapIP", func(format string, args ...any) {}, 10*time.Second)
+	isControlD := uc.isControlD()
 	for {
 		uc.bootstrapIPs = lookupIP(uc.Domain, uc.Timeout, withBootstrapDNS)
+		// For ControlD upstream, the bootstrap IPs could not be RFC 1918 addresses,
+		// filtering them out here to prevent weird behavior.
+		if isControlD {
+			n := 0
+			for _, ip := range uc.bootstrapIPs {
+				netIP := net.ParseIP(ip)
+				if netIP != nil && !netIP.IsPrivate() {
+					uc.bootstrapIPs[n] = ip
+					n++
+				}
+			}
+			uc.bootstrapIPs = uc.bootstrapIPs[:n]
+		}
 		if len(uc.bootstrapIPs) > 0 {
 			break
 		}
-		ProxyLog.Warn().Msg("could not resolve bootstrap IPs, retrying...")
+		ProxyLogger.Load().Warn().Msg("could not resolve bootstrap IPs, retrying...")
 		b.BackOff(context.Background(), errors.New("no bootstrap IPs"))
 	}
 	for _, ip := range uc.bootstrapIPs {
@@ -258,7 +383,7 @@ func (uc *UpstreamConfig) setupBootstrapIP(withBootstrapDNS bool) {
 			uc.bootstrapIPs4 = append(uc.bootstrapIPs4, ip)
 		}
 	}
-	ProxyLog.Debug().Msgf("Bootstrap IPs: %v", uc.bootstrapIPs)
+	ProxyLogger.Load().Debug().Msgf("bootstrap IPs: %v", uc.bootstrapIPs)
 }
 
 // ReBootstrap re-setup the bootstrap IP and the transport.
@@ -269,21 +394,12 @@ func (uc *UpstreamConfig) ReBootstrap() {
 		return
 	}
 	_, _, _ = uc.g.Do("ReBootstrap", func() (any, error) {
-		ProxyLog.Debug().Msg("re-bootstrapping upstream ip")
-		uc.setupTransportWithoutPingUpstream()
+		ProxyLogger.Load().Debug().Msg("re-bootstrapping upstream ip")
+		uc.rebootstrap.Store(true)
 		return true, nil
 	})
 }
 
-func (uc *UpstreamConfig) setupTransportWithoutPingUpstream() {
-	switch uc.Type {
-	case ResolverTypeDOH:
-		uc.setupDOHTransportWithoutPingUpstream()
-	case ResolverTypeDOH3:
-		uc.setupDOH3TransportWithoutPingUpstream()
-	}
-}
-
 // SetupTransport initializes the network transport used to connect to upstream server.
 // For now, only DoH upstream is supported.
 func (uc *UpstreamConfig) SetupTransport() {
@@ -296,14 +412,31 @@ func (uc *UpstreamConfig) SetupTransport() {
 }
 
 func (uc *UpstreamConfig) setupDOHTransport() {
-	uc.setupDOHTransportWithoutPingUpstream()
-	go uc.pingUpstream()
+	switch uc.IPStack {
+	case IpStackBoth, "":
+		uc.transport = uc.newDOHTransport(uc.bootstrapIPs)
+	case IpStackV4:
+		uc.transport = uc.newDOHTransport(uc.bootstrapIPs4)
+	case IpStackV6:
+		uc.transport = uc.newDOHTransport(uc.bootstrapIPs6)
+	case IpStackSplit:
+		uc.transport4 = uc.newDOHTransport(uc.bootstrapIPs4)
+		if hasIPv6() {
+			uc.transport6 = uc.newDOHTransport(uc.bootstrapIPs6)
+		} else {
+			uc.transport6 = uc.transport4
+		}
+		uc.transport = uc.newDOHTransport(uc.bootstrapIPs)
+	}
 }
 
 func (uc *UpstreamConfig) newDOHTransport(addrs []string) *http.Transport {
 	transport := http.DefaultTransport.(*http.Transport).Clone()
-	transport.IdleConnTimeout = 5 * time.Second
-	transport.TLSClientConfig = &tls.Config{RootCAs: uc.certPool}
+	transport.MaxIdleConnsPerHost = 100
+	transport.TLSClientConfig = &tls.Config{
+		RootCAs:            uc.certPool,
+		ClientSessionCache: tls.NewLRUClientSessionCache(0),
+	}
 
 	dialerTimeoutMs := 2000
 	if uc.Timeout > 0 && uc.Timeout < dialerTimeoutMs {
@@ -315,7 +448,7 @@ func (uc *UpstreamConfig) newDOHTransport(addrs []string) *http.Transport {
 		if uc.BootstrapIP != "" {
 			dialer := net.Dialer{Timeout: dialerTimeout, KeepAlive: dialerTimeout}
 			addr := net.JoinHostPort(uc.BootstrapIP, port)
-			Log(ctx, ProxyLog.Debug(), "sending doh request to: %s", addr)
+			Log(ctx, ProxyLogger.Load().Debug(), "sending doh request to: %s", addr)
 			return dialer.DialContext(ctx, network, addr)
 		}
 		pd := &ctrldnet.ParallelDialer{}
@@ -329,49 +462,46 @@ func (uc *UpstreamConfig) newDOHTransport(addrs []string) *http.Transport {
 		if err != nil {
 			return nil, err
 		}
-		Log(ctx, ProxyLog.Debug(), "sending doh request to: %s", conn.RemoteAddr())
+		Log(ctx, ProxyLogger.Load().Debug(), "sending doh request to: %s", conn.RemoteAddr())
 		return conn, nil
 	}
+	runtime.SetFinalizer(transport, func(transport *http.Transport) {
+		transport.CloseIdleConnections()
+	})
 	return transport
 }
 
-func (uc *UpstreamConfig) setupDOHTransportWithoutPingUpstream() {
-	uc.mu.Lock()
-	defer uc.mu.Unlock()
-	switch uc.IPStack {
-	case IpStackBoth, "":
-		uc.transport = uc.newDOHTransport(uc.bootstrapIPs)
-	case IpStackV4:
-		uc.transport = uc.newDOHTransport(uc.bootstrapIPs4)
-	case IpStackV6:
-		uc.transport = uc.newDOHTransport(uc.bootstrapIPs6)
-	case IpStackSplit:
-		uc.transport4 = uc.newDOHTransport(uc.bootstrapIPs4)
-		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-		defer cancel()
-		if ctrldnet.IPv6Available(ctx) {
-			uc.transport6 = uc.newDOHTransport(uc.bootstrapIPs6)
-		} else {
-			uc.transport6 = uc.transport4
-		}
-
-		uc.transport = uc.newDOHTransport(uc.bootstrapIPs)
-	}
-}
-
-func (uc *UpstreamConfig) pingUpstream() {
-	// Warming up the transport by querying a test packet.
-	dnsResolver, err := NewResolver(uc)
-	if err != nil {
-		ProxyLog.Error().Err(err).Msgf("failed to create resolver for upstream: %s", uc.Name)
+// Ping warms up the connection to DoH/DoH3 upstream.
+func (uc *UpstreamConfig) Ping() {
+	switch uc.Type {
+	case ResolverTypeDOH, ResolverTypeDOH3:
+	default:
 		return
 	}
-	msg := new(dns.Msg)
-	msg.SetQuestion(".", dns.TypeNS)
-	msg.MsgHdr.RecursionDesired = true
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	_, _ = dnsResolver.Resolve(ctx, msg)
+
+	ping := func(t http.RoundTripper) {
+		if t == nil {
+			return
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		req, _ := http.NewRequestWithContext(ctx, "HEAD", uc.Endpoint, nil)
+		resp, _ := t.RoundTrip(req)
+		if resp == nil {
+			return
+		}
+		defer resp.Body.Close()
+		_, _ = io.Copy(io.Discard, resp.Body)
+	}
+
+	for _, typ := range []uint16{dns.TypeA, dns.TypeAAAA} {
+		switch uc.Type {
+		case ResolverTypeDOH:
+			ping(uc.dohTransport(typ))
+		case ResolverTypeDOH3:
+			ping(uc.doh3Transport(typ))
+		}
+	}
 }
 
 func (uc *UpstreamConfig) isControlD() bool {
@@ -390,8 +520,12 @@ func (uc *UpstreamConfig) isControlD() bool {
 }
 
 func (uc *UpstreamConfig) dohTransport(dnsType uint16) http.RoundTripper {
-	uc.mu.Lock()
-	defer uc.mu.Unlock()
+	uc.transportOnce.Do(func() {
+		uc.SetupTransport()
+	})
+	if uc.rebootstrap.CompareAndSwap(true, false) {
+		uc.SetupTransport()
+	}
 	switch uc.IPStack {
 	case IpStackBoth, IpStackV4, IpStackV6:
 		return uc.transport
@@ -419,7 +553,10 @@ func (uc *UpstreamConfig) bootstrapIPForDNSType(dnsType uint16) string {
 		case dns.TypeA:
 			return pick(uc.bootstrapIPs4)
 		default:
-			return pick(uc.bootstrapIPs6)
+			if hasIPv6() {
+				return pick(uc.bootstrapIPs6)
+			}
+			return pick(uc.bootstrapIPs4)
 		}
 	}
 	return pick(uc.bootstrapIPs)
@@ -438,7 +575,10 @@ func (uc *UpstreamConfig) netForDNSType(dnsType uint16) (string, string) {
 		case dns.TypeA:
 			return "tcp4-tls", "udp4"
 		default:
-			return "tcp6-tls", "udp6"
+			if hasIPv6() {
+				return "tcp6-tls", "udp6"
+			}
+			return "tcp4-tls", "udp4"
 		}
 	}
 	return "tcp-tls", "udp"
@@ -459,6 +599,7 @@ func ValidateConfig(validate *validator.Validate, cfg *Config) error {
 	_ = validate.RegisterValidation("dnsrcode", validateDnsRcode)
 	_ = validate.RegisterValidation("ipstack", validateIpStack)
 	_ = validate.RegisterValidation("iporempty", validateIpOrEmpty)
+	validate.RegisterStructValidation(upstreamConfigStructLevelValidation, UpstreamConfig{})
 	return validate.Struct(cfg)
 }
 
@@ -483,6 +624,32 @@ func validateIpOrEmpty(fl validator.FieldLevel) bool {
 	return net.ParseIP(val) != nil
 }
 
+func upstreamConfigStructLevelValidation(sl validator.StructLevel) {
+	uc := sl.Current().Addr().Interface().(*UpstreamConfig)
+	if uc.Type == ResolverTypeOS {
+		return
+	}
+
+	// Endpoint is required for non os resolver.
+	if uc.Endpoint == "" {
+		sl.ReportError(uc.Endpoint, "endpoint", "Endpoint", "required_unless", "")
+		return
+	}
+
+	// DoH/DoH3 requires endpoint is an HTTP url.
+	if uc.Type == ResolverTypeDOH || uc.Type == ResolverTypeDOH3 {
+		u, err := url.Parse(uc.Endpoint)
+		if err != nil || u.Host == "" {
+			sl.ReportError(uc.Endpoint, "endpoint", "Endpoint", "http_url", "")
+			return
+		}
+		if u.Scheme != "http" && u.Scheme != "https" {
+			sl.ReportError(uc.Endpoint, "endpoint", "Endpoint", "http_url", "")
+			return
+		}
+	}
+}
+
 func defaultPortFor(typ string) string {
 	switch typ {
 	case ResolverTypeDOH, ResolverTypeDOH3:
@@ -522,3 +689,15 @@ func ResolverTypeFromEndpoint(endpoint string) string {
 func pick(s []string) string {
 	return s[rand.Intn(len(s))]
 }
+
+// upstreamUID generates an unique identifier for an upstream.
+func upstreamUID() string {
+	b := make([]byte, 4)
+	for {
+		if _, err := crand.Read(b); err != nil {
+			ProxyLogger.Load().Warn().Err(err).Msg("could not generate uid for upstream, retrying...")
+			continue
+		}
+		return hex.EncodeToString(b)
+	}
+}

config_internal_test.go

@@ -185,11 +185,100 @@ func TestUpstreamConfig_Init(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			tc.uc.Init()
+			tc.uc.uid = "" // we don't care about the uid.
 			assert.Equal(t, tc.expected, tc.uc)
 		})
 	}
 }
 
+func TestUpstreamConfig_VerifyDomain(t *testing.T) {
+	tests := []struct {
+		name         string
+		uc           *UpstreamConfig
+		verifyDomain string
+	}{
+		{
+			controlDComDomain,
+			&UpstreamConfig{Endpoint: "https://freedns.controld.com/p2"},
+			controldVerifiedDomain[controlDComDomain],
+		},
+		{
+			controlDDevDomain,
+			&UpstreamConfig{Endpoint: "https://freedns.controld.dev/p2"},
+			controldVerifiedDomain[controlDDevDomain],
+		},
+		{
+			"non-ControlD upstream",
+			&UpstreamConfig{Endpoint: "https://dns.google/dns-query"},
+			"",
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := tc.uc.VerifyDomain(); got != tc.verifyDomain {
+				t.Errorf("unexpected verify domain, want: %q, got: %q", tc.verifyDomain, got)
+			}
+		})
+	}
+}
+
+func TestUpstreamConfig_UpstreamSendClientInfo(t *testing.T) {
+	tests := []struct {
+		name           string
+		uc             *UpstreamConfig
+		sendClientInfo bool
+	}{
+		{
+			"default with controld upstream DoH",
+			&UpstreamConfig{Endpoint: "https://freedns.controld.com/p2", Type: ResolverTypeDOH},
+			true,
+		},
+		{
+			"default with controld upstream DoH3",
+			&UpstreamConfig{Endpoint: "https://freedns.controld.com/p2", Type: ResolverTypeDOH3},
+			true,
+		},
+		{
+			"default with non-ControlD upstream",
+			&UpstreamConfig{Endpoint: "https://dns.google/dns-query", Type: ResolverTypeDOH},
+			false,
+		},
+		{
+			"set false with controld upstream",
+			&UpstreamConfig{Endpoint: "https://freedns.controld.com/p2", Type: ResolverTypeDOH, SendClientInfo: ptrBool(false)},
+			false,
+		},
+		{
+			"set true with controld upstream",
+			&UpstreamConfig{Endpoint: "https://freedns.controld.com/p2", SendClientInfo: ptrBool(true)},
+			true,
+		},
+		{
+			"set false with non-ControlD upstream",
+			&UpstreamConfig{Endpoint: "https://dns.google/dns-query", SendClientInfo: ptrBool(false)},
+			false,
+		},
+		{
+			"set true with non-ControlD upstream",
+			&UpstreamConfig{Endpoint: "https://dns.google/dns-query", Type: ResolverTypeDOH, SendClientInfo: ptrBool(true)},
+			true,
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := tc.uc.UpstreamSendClientInfo(); got != tc.sendClientInfo {
+				t.Errorf("unexpected result, want: %v, got: %v", tc.sendClientInfo, got)
+			}
+		})
+	}
+}
+
 func ptrBool(b bool) *bool {
 	return &b
 }

config_quic.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"runtime"
 	"sync"
 	"time"
 
@@ -19,48 +20,6 @@ import (
 )
 
 func (uc *UpstreamConfig) setupDOH3Transport() {
-	uc.setupDOH3TransportWithoutPingUpstream()
-	go uc.pingUpstream()
-}
-
-func (uc *UpstreamConfig) newDOH3Transport(addrs []string) http.RoundTripper {
-	rt := &http3.RoundTripper{}
-	rt.TLSClientConfig = &tls.Config{RootCAs: uc.certPool}
-	rt.Dial = func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
-		domain := addr
-		_, port, _ := net.SplitHostPort(addr)
-		// if we have a bootstrap ip set, use it to avoid DNS lookup
-		if uc.BootstrapIP != "" {
-			addr = net.JoinHostPort(uc.BootstrapIP, port)
-			ProxyLog.Debug().Msgf("sending doh3 request to: %s", addr)
-			udpConn, err := net.ListenUDP("udp", nil)
-			if err != nil {
-				return nil, err
-			}
-			remoteAddr, err := net.ResolveUDPAddr("udp", addr)
-			if err != nil {
-				return nil, err
-			}
-			return quic.DialEarlyContext(ctx, udpConn, remoteAddr, domain, tlsCfg, cfg)
-		}
-		dialAddrs := make([]string, len(addrs))
-		for i := range addrs {
-			dialAddrs[i] = net.JoinHostPort(addrs[i], port)
-		}
-		pd := &quicParallelDialer{}
-		conn, err := pd.Dial(ctx, domain, dialAddrs, tlsCfg, cfg)
-		if err != nil {
-			return nil, err
-		}
-		ProxyLog.Debug().Msgf("sending doh3 request to: %s", conn.RemoteAddr())
-		return conn, err
-	}
-	return rt
-}
-
-func (uc *UpstreamConfig) setupDOH3TransportWithoutPingUpstream() {
-	uc.mu.Lock()
-	defer uc.mu.Unlock()
 	switch uc.IPStack {
 	case IpStackBoth, "":
 		uc.http3RoundTripper = uc.newDOH3Transport(uc.bootstrapIPs)
@@ -81,9 +40,50 @@ func (uc *UpstreamConfig) setupDOH3TransportWithoutPingUpstream() {
 	}
 }
 
+func (uc *UpstreamConfig) newDOH3Transport(addrs []string) http.RoundTripper {
+	rt := &http3.RoundTripper{}
+	rt.TLSClientConfig = &tls.Config{RootCAs: uc.certPool}
+	rt.Dial = func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
+		_, port, _ := net.SplitHostPort(addr)
+		// if we have a bootstrap ip set, use it to avoid DNS lookup
+		if uc.BootstrapIP != "" {
+			addr = net.JoinHostPort(uc.BootstrapIP, port)
+			ProxyLogger.Load().Debug().Msgf("sending doh3 request to: %s", addr)
+			udpConn, err := net.ListenUDP("udp", nil)
+			if err != nil {
+				return nil, err
+			}
+			remoteAddr, err := net.ResolveUDPAddr("udp", addr)
+			if err != nil {
+				return nil, err
+			}
+			return quic.DialEarly(ctx, udpConn, remoteAddr, tlsCfg, cfg)
+		}
+		dialAddrs := make([]string, len(addrs))
+		for i := range addrs {
+			dialAddrs[i] = net.JoinHostPort(addrs[i], port)
+		}
+		pd := &quicParallelDialer{}
+		conn, err := pd.Dial(ctx, dialAddrs, tlsCfg, cfg)
+		if err != nil {
+			return nil, err
+		}
+		ProxyLogger.Load().Debug().Msgf("sending doh3 request to: %s", conn.RemoteAddr())
+		return conn, err
+	}
+	runtime.SetFinalizer(rt, func(rt *http3.RoundTripper) {
+		rt.CloseIdleConnections()
+	})
+	return rt
+}
+
 func (uc *UpstreamConfig) doh3Transport(dnsType uint16) http.RoundTripper {
-	uc.mu.Lock()
-	defer uc.mu.Unlock()
+	uc.transportOnce.Do(func() {
+		uc.SetupTransport()
+	})
+	if uc.rebootstrap.CompareAndSwap(true, false) {
+		uc.SetupTransport()
+	}
 	switch uc.IPStack {
 	case IpStackBoth, IpStackV4, IpStackV6:
 		return uc.http3RoundTripper
@@ -109,13 +109,16 @@ type parallelDialerResult struct {
 
 type quicParallelDialer struct{}
 
-func (d *quicParallelDialer) Dial(ctx context.Context, domain string, addrs []string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
+// Dial performs parallel dialing to the given address list.
+func (d *quicParallelDialer) Dial(ctx context.Context, addrs []string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
 	if len(addrs) == 0 {
 		return nil, errors.New("empty addresses")
 	}
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	done := make(chan struct{})
+	defer close(done)
 	ch := make(chan *parallelDialerResult, len(addrs))
 	var wg sync.WaitGroup
 	wg.Add(len(addrs))
@@ -137,9 +140,14 @@ func (d *quicParallelDialer) Dial(ctx context.Context, domain string, addrs []st
 				ch <- &parallelDialerResult{conn: nil, err: err}
 				return
 			}
-
-			conn, err := quic.DialEarlyContext(ctx, udpConn, remoteAddr, domain, tlsCfg, cfg)
-			ch <- &parallelDialerResult{conn: conn, err: err}
+			conn, err := quic.DialEarly(ctx, udpConn, remoteAddr, tlsCfg, cfg)
+			select {
+			case ch <- &parallelDialerResult{conn: conn, err: err}:
+			case <-done:
+				if conn != nil {
+					conn.CloseWithError(quic.ApplicationErrorCode(http3.ErrCodeNoError), "")
+				}
+			}
 		}(addr)
 	}
 

config_quic_free.go

@@ -6,5 +6,4 @@ import "net/http"
 
 func (uc *UpstreamConfig) setupDOH3Transport() {}
 
-func (uc *UpstreamConfig) setupDOH3TransportWithoutPingUpstream()         {}
 func (uc *UpstreamConfig) doh3Transport(dnsType uint16) http.RoundTripper { return nil }

config_test.go

@@ -1,6 +1,8 @@
 package ctrld_test
 
 import (
+	"os"
+	"strings"
 	"testing"
 
 	"github.com/go-playground/validator/v10"
@@ -56,6 +58,20 @@ func TestLoadDefaultConfig(t *testing.T) {
 	assert.Len(t, cfg.Upstream, 2)
 }
 
+func TestConfigOverride(t *testing.T) {
+	v := viper.NewWithOptions(viper.KeyDelimiter("::"))
+	ctrld.InitConfig(v, "test_load_config")
+	v.SetConfigType("toml")
+	require.NoError(t, v.ReadConfig(strings.NewReader(testhelper.SampleConfigStr(t))))
+	cfg := ctrld.Config{Listener: map[string]*ctrld.ListenerConfig{
+		"0": {IP: "127.0.0.1", Port: 53},
+	}}
+	require.NoError(t, v.Unmarshal(&cfg))
+
+	assert.Equal(t, "10.10.42.69", cfg.Listener["1"].IP)
+	assert.Equal(t, 1337, cfg.Listener["1"].Port)
+}
+
 func TestConfigValidation(t *testing.T) {
 	tests := []struct {
 		name    string
@@ -75,6 +91,11 @@ func TestConfigValidation(t *testing.T) {
 		{"os upstream", configWithOsUpstream(t), false},
 		{"invalid rules", configWithInvalidRules(t), true},
 		{"invalid dns rcodes", configWithInvalidRcodes(t), true},
+		{"invalid max concurrent requests", configWithInvalidMaxConcurrentRequests(t), true},
+		{"non-existed lease file", configWithNonExistedLeaseFile(t), true},
+		{"lease file format required if lease file exist", configWithExistedLeaseFile(t), true},
+		{"invalid lease file format", configWithInvalidLeaseFileFormat(t), true},
+		{"invalid doh/doh3 endpoint", configWithInvalidDoHEndpoint(t), true},
 	}
 
 	for _, tc := range tests {
@@ -176,3 +197,39 @@ func configWithInvalidRcodes(t *testing.T) *ctrld.Config {
 	}
 	return cfg
 }
+
+func configWithInvalidMaxConcurrentRequests(t *testing.T) *ctrld.Config {
+	cfg := defaultConfig(t)
+	n := -1
+	cfg.Service.MaxConcurrentRequests = &n
+	return cfg
+}
+
+func configWithNonExistedLeaseFile(t *testing.T) *ctrld.Config {
+	cfg := defaultConfig(t)
+	cfg.Service.DHCPLeaseFile = "non-existed"
+	return cfg
+}
+
+func configWithExistedLeaseFile(t *testing.T) *ctrld.Config {
+	cfg := defaultConfig(t)
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg.Service.DHCPLeaseFile = exe
+	return cfg
+}
+
+func configWithInvalidLeaseFileFormat(t *testing.T) *ctrld.Config {
+	cfg := defaultConfig(t)
+	cfg.Service.DHCPLeaseFileFormat = "invalid"
+	return cfg
+}
+
+func configWithInvalidDoHEndpoint(t *testing.T) *ctrld.Config {
+	cfg := defaultConfig(t)
+	cfg.Upstream["0"].Endpoint = "1.1.1.1"
+	cfg.Upstream["0"].Type = ctrld.ResolverTypeDOH
+	return cfg
+}

docker/Dockerfile

@@ -0,0 +1,32 @@
+# Using Debian bullseye for building regular image.
+# Using scratch image for minimal image size.
+# The final image has:
+#
+# - Timezone info file.
+# - CA certs file.
+# - /etc/{passwd,group} file.
+# - Non-cgo ctrld binary.
+#
+# CI_COMMIT_TAG is used to set the version of ctrld binary.
+FROM golang:1.20-bullseye as base
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y upx-ucl
+
+COPY . .
+
+ARG tag=master
+ENV CI_COMMIT_TAG=$tag
+RUN CTRLD_NO_QF=yes CGO_ENABLED=0 ./scripts/build.sh
+
+FROM scratch
+
+COPY --from=base /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=base /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=base /etc/passwd /etc/passwd
+COPY --from=base /etc/group /etc/group
+
+COPY --from=base /app/ctrld-linux-*-nocgo ctrld
+
+ENTRYPOINT ["./ctrld", "run"]

docker/Dockerfile.debug

@@ -0,0 +1,32 @@
+# Using Debian bullseye for building regular image.
+# Using scratch image for minimal image size.
+# The final image has:
+#
+# - Timezone info file.
+# - CA certs file.
+# - /etc/{passwd,group} file.
+# - Non-cgo ctrld binary.
+#
+# CI_COMMIT_TAG is used to set the version of ctrld binary.
+FROM golang:1.20-bullseye as base
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y upx-ucl
+
+COPY . .
+
+ARG tag=master
+ENV CI_COMMIT_TAG=$tag
+RUN CTRLD_NO_QF=yes CGO_ENABLED=0 ./scripts/build.sh
+
+FROM alpine
+
+COPY --from=base /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=base /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=base /etc/passwd /etc/passwd
+COPY --from=base /etc/group /etc/group
+
+COPY --from=base /app/ctrld-linux-*-nocgo ctrld
+
+ENTRYPOINT ["./ctrld", "run"]

docs/config.md

@@ -14,10 +14,15 @@ The config file allows for advanced configuration of the `ctrld` utility to cove
 
 
 ## Config Location
-`ctrld` uses [TOML](toml_link) format for its configuration file. Default configuration file is `config.toml` found in following order:
+`ctrld` uses [TOML](toml_link) format for its configuration file. Default configuration file is `ctrld.toml` found in following order:
 
- - `$HOME/.ctrld`
- - Current directory
+ - `/etc/controld` on *nix.
+ - User's home directory on Windows.
+ - Same directory with `ctrld` binary on these routers:
+   - `ddwrt`
+   - `merlin`
+   - `freshtomato`
+ - Current directory.
 
 The user can choose to override default value using command line `--config` or `-c`:
 
@@ -38,6 +43,8 @@ if it's existed.
     log_path = ""
     cache_enable = true
     cache_size = 4096
+    cache_ttl_override = 60
+    cache_serve_stale = true
 
 [network.0]
     cidrs = ["0.0.0.0/0"]
@@ -53,6 +60,7 @@ if it's existed.
     name = "Control D - Anti-Malware"
     timeout = 5000
     type = "doh"
+    ip_stack = "both"
 
 [upstream.1]
     bootstrap_ip = "76.76.2.11"
@@ -60,6 +68,7 @@ if it's existed.
     name = "Control D - No Ads"
     timeout = 5000
     type = "doq"
+    ip_stack = "split"
 
 [upstream.2]
     bootstrap_ip = "76.76.2.22"
@@ -67,6 +76,7 @@ if it's existed.
     name = "Control D - Private"
     timeout = 5000
     type = "dot"
+    ip_stack = "v4"
 
 [listener.0]
     ip = "127.0.0.1"
@@ -104,8 +114,8 @@ Logging level you wish to enable.
 
  - Type: string
  - Required: no
- - Valid values: `debug`, `info`, `warn`, `error`, `fatal`, `panic`
- - Default: `info`
+ - Valid values: `debug`, `info`, `warn`, `notice`, `error`, `fatal`, `panic`
+ - Default: `notice`
 
 
 ### log_path
@@ -113,12 +123,14 @@ Relative or absolute path of the log file.
 
 - Type: string
 - Required: no
+- Default: ""
 
 ### cache_enable
 When `cache_enable = true`, all resolved DNS query responses will be cached for duration of the upstream record TTLs.
 
 - Type: boolean
 - Required: no
+- Default: false
 
 ### cache_size
 The number of cached records, must be a positive integer. Tweaking this value with care depends on your available RAM. 
@@ -128,29 +140,80 @@ An invalid `cache_size` value will disable the cache, regardless of `cache_enabl
 
 - Type: int
 - Required: no
+- Default: 4096
 
 ### cache_ttl_override
 When `cache_ttl_override` is set to a positive value (in seconds), TTLs are overridden to this value and cached for this long.
 
 - Type: int
 - Required: no
+- Default: 0
 
 ### cache_serve_stale
 When `cache_serve_stale = true`, in cases of upstream failures (upstreams not reachable), `ctrld` will keep serving
 stale cached records (regardless of their TTLs) until upstream comes online.
 
-The above config will look like this at query time.
+- Type: boolean
+- Required: no
+- Default: false
 
-```
-2022-11-14T22:18:53.808 INF Setting bootstrap IP for upstream.0 bootstrap_ip=76.76.2.11
-2022-11-14T22:18:53.808 INF Starting DNS server on listener.0: 127.0.0.1:53
-2022-11-14T22:18:56.381 DBG [9fd5d3] 127.0.0.1:53978 -> listener.0: 127.0.0.1:53: received query: verify.controld.com
-2022-11-14T22:18:56.381 INF [9fd5d3] no policy, no network, no rule -> [upstream.0]
-2022-11-14T22:18:56.381 DBG [9fd5d3] sending query to upstream.0: Control D - DOH Free
-2022-11-14T22:18:56.381 DBG [9fd5d3] debug dial context freedns.controld.com:443 - tcp - 76.76.2.0
-2022-11-14T22:18:56.381 DBG [9fd5d3] sending doh request to: 76.76.2.11:443
-2022-11-14T22:18:56.420 DBG [9fd5d3] received response of 118 bytes in 39.662597ms
-```
+### max_concurrent_requests
+The number of concurrent requests that will be handled, must be a non-negative integer. 
+Tweaking this value depends on the capacity of your system.
+
+- Type: number
+- Required: no
+- Default: 256
+
+### discover_mdns
+Perform LAN client discovery using mDNS. This will spawn a listener on port 5353. 
+
+- Type: boolean
+- Required: no
+- Default: true
+
+### discover_arp
+Perform LAN client discovery using ARP.  
+
+- Type: boolean
+- Required: no
+- Default: true
+
+### discover_dhcp
+Perform LAN client discovery using DHCP leases files. Common file locations are auto-discovered.  
+
+- Type: boolean
+- Required: no
+- Default: true
+
+### discover_ptr
+Perform LAN client discovery using PTR queries.  
+
+- Type: boolean
+- Required: no
+- Default: true
+
+### discover_hosts
+Perform LAN client discovery using hosts file.
+
+- Type: boolean
+- Required: no
+- Default: true
+
+### dhcp_lease_file_path
+Relative or absolute path to a custom DHCP leases file location. 
+
+- Type: string
+- Required: no
+- Default: ""
+
+### dhcp_lease_file_format
+DHCP leases file format. 
+
+- Type: string
+- Required: no
+- Valid values: `dnsmasq`, `isc-dhcp`
+- Default: ""
 
 ## Upstream
 The `[upstream]` section specifies the DNS upstream servers that `ctrld` will forward DNS requests to.
@@ -162,6 +225,7 @@ The `[upstream]` section specifies the DNS upstream servers that `ctrld` will fo
   name = "Control D - DOH"
   timeout = 5000
   type = "doh"
+  ip_stack = "split"
   
 [upstream.1]
   bootstrap_ip = ""
@@ -169,6 +233,7 @@ The `[upstream]` section specifies the DNS upstream servers that `ctrld` will fo
   name = "Control D - DOH3"
   timeout = 5000
   type = "doh3"
+  ip_stack = "both"
   
 [upstream.2]
   bootstrap_ip = ""
@@ -176,6 +241,7 @@ The `[upstream]` section specifies the DNS upstream servers that `ctrld` will fo
   name = "Controld D - DOT"
   timeout = 5000
   type = "dot"
+  ip_stack = "v4"
   
 [upstream.3]
   bootstrap_ip = ""
@@ -183,6 +249,7 @@ The `[upstream]` section specifies the DNS upstream servers that `ctrld` will fo
   name = "Controld D - DOT"
   timeout = 5000
   type = "doq"
+  ip_stack = "v6"
   
 [upstream.4]
   bootstrap_ip = ""
@@ -190,6 +257,7 @@ The `[upstream]` section specifies the DNS upstream servers that `ctrld` will fo
   name = "Control D - Ad Blocking"
   timeout = 5000
   type = "legacy"
+  ip_stack = "both"
 ```
 
 ### bootstrap_ip
@@ -200,6 +268,7 @@ If `bootstrap_ip` is empty, `ctrld` will resolve this itself using its own boots
 
  - type: ip address string
  - required: no
+ - Default: ""
 
 ### endpoint
 IP address, hostname or URL of upstream DNS. Used together with `Type` of the endpoint.
@@ -214,6 +283,7 @@ Human-readable name of the upstream.
 
 - Type: string
 - Required: no
+- Default: ""
 
 ### timeout
 Timeout in milliseconds before request failsover to the next upstream (if defined). 
@@ -221,7 +291,8 @@ Timeout in milliseconds before request failsover to the next upstream (if define
 Value `0` means no timeout.
 
  - Type: number
- - required: no
+ - Required: no
+ - Default: 0
 
 ### type
 The protocol that `ctrld` will use to send DNS requests to upstream.
@@ -266,12 +337,14 @@ Name of the network.
 
  - Type: string
  - Required: no
+ - Default: ""
 
 ### cidrs
 Specifies the network addresses that the `listener` will accept requests from. You will see more details in the listener policy section.
 
  - Type: array of network CIDR string
  - Required: no
+ - Default: []
 
 
 ## listener
@@ -291,18 +364,23 @@ The `[listener]` section specifies the ip and port of the local DNS server. You
 ### ip
 IP address that serves the incoming requests. If `ip` is empty, ctrld will listen on all available addresses.
 
-- Type: ip address
+- Type: ip address string
+- Required: no
+- Default: "0.0.0.0" or RFC1918 addess or "127.0.0.1" (depending on platform)
 
 ### port
 Port number that the listener will listen on for incoming requests. If `port` is `0`, a random available port will be chosen.
 
 - Type: number
+- Required: no
+- Default: 0 or 53 or 5354 (depending on platform)
 
 ### restricted
 If set to `true` makes the listener `REFUSE` DNS queries from all source IP addresses that are not explicitly defined in the policy using a `network`. 
 
 - Type: bool
 - Required: no
+- Default: false
 
 ### policy
 Allows `ctrld` to set policy rules to determine which upstreams the requests will be forwarded to.
@@ -346,19 +424,30 @@ rules = [
 
 - Type: string
 - Required: no
+- Default: ""
 
 ### networks:
 `networks` is the list of network rules of the policy.
 
-- type: array of networks
+- Type: array of networks
+- Required: no
+- Default: []
 
 ### rules:
 `rules` is the list of domain rules within the policy. Domain can be either FQDN or wildcard domain.
 
-- type: array of rule
+- Type: array of rule
+- Required: no
+- Default: []
 
 ### failover_rcodes
-For non success response, `failover_rcodes` allows the request to be forwarded to next upstream, if the response `RCODE` matches any value defined in `failover_rcodes`. For example:
+For non success response, `failover_rcodes` allows the request to be forwarded to next upstream, if the response `RCODE` matches any value defined in `failover_rcodes`.
+
+- Type: array of string
+- Required: no
+- Default: []
+- 
+For example:
 
 ```toml
 [listener.0.policy]

doh.go

@@ -8,18 +8,69 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"runtime"
+	"strings"
+	"sync"
+
+	"github.com/cuonglm/osinfo"
 
 	"github.com/miekg/dns"
 )
 
 const (
-	DoHMacHeader  = "x-cd-mac"
-	DoHIPHeader   = "x-cd-ip"
-	DoHHostHeader = "x-cd-host"
-
+	dohMacHeader         = "x-cd-mac"
+	dohIPHeader          = "x-cd-ip"
+	dohHostHeader        = "x-cd-host"
+	dohOsHeader          = "x-cd-os"
 	headerApplicationDNS = "application/dns-message"
 )
 
+// EncodeOsNameMap provides mapping from OS name to a shorter string, used for encoding x-cd-os value.
+var EncodeOsNameMap = map[string]string{
+	"windows": "1",
+	"darwin":  "2",
+	"linux":   "3",
+	"freebsd": "4",
+}
+
+// DecodeOsNameMap provides mapping from encoded OS name to real value, used for decoding x-cd-os value.
+var DecodeOsNameMap = map[string]string{}
+
+// EncodeArchNameMap provides mapping from OS arch to a shorter string, used for encoding x-cd-os value.
+var EncodeArchNameMap = map[string]string{
+	"amd64":  "1",
+	"arm64":  "2",
+	"arm":    "3",
+	"386":    "4",
+	"mips":   "5",
+	"mipsle": "6",
+	"mips64": "7",
+}
+
+// DecodeArchNameMap provides mapping from encoded OS arch to real value, used for decoding x-cd-os value.
+var DecodeArchNameMap = map[string]string{}
+
+func init() {
+	for k, v := range EncodeOsNameMap {
+		DecodeOsNameMap[v] = k
+	}
+	for k, v := range EncodeArchNameMap {
+		DecodeArchNameMap[v] = k
+	}
+}
+
+// TODO: use sync.OnceValue when upgrading to go1.21
+var xCdOsValueOnce sync.Once
+var xCdOsValue string
+
+func dohOsHeaderValue() string {
+	xCdOsValueOnce.Do(func() {
+		oi := osinfo.New()
+		xCdOsValue = strings.Join([]string{EncodeOsNameMap[runtime.GOOS], EncodeArchNameMap[runtime.GOARCH], oi.Dist}, "-")
+	})
+	return xCdOsValue
+}
+
 func newDohResolver(uc *UpstreamConfig) *dohResolver {
 	r := &dohResolver{
 		endpoint:          uc.u,
@@ -98,18 +149,27 @@ func (r *dohResolver) Resolve(ctx context.Context, msg *dns.Msg) (*dns.Msg, erro
 func addHeader(ctx context.Context, req *http.Request, sendClientInfo bool) {
 	req.Header.Set("Content-Type", headerApplicationDNS)
 	req.Header.Set("Accept", headerApplicationDNS)
+	req.Header.Set(dohOsHeader, dohOsHeaderValue())
+
+	printed := false
 	if sendClientInfo {
 		if ci, ok := ctx.Value(ClientInfoCtxKey{}).(*ClientInfo); ok && ci != nil {
+			printed = ci.Mac != "" || ci.IP != "" || ci.Hostname != ""
 			if ci.Mac != "" {
-				req.Header.Set(DoHMacHeader, ci.Mac)
+				req.Header.Set(dohMacHeader, ci.Mac)
 			}
 			if ci.IP != "" {
-				req.Header.Set(DoHIPHeader, ci.IP)
+				req.Header.Set(dohIPHeader, ci.IP)
 			}
 			if ci.Hostname != "" {
-				req.Header.Set(DoHHostHeader, ci.Hostname)
+				req.Header.Set(dohHostHeader, ci.Hostname)
+			}
+			if ci.Self {
+				req.Header.Set(dohOsHeader, dohOsHeaderValue())
 			}
 		}
 	}
-	Log(ctx, ProxyLog.Debug().Interface("header", req.Header), "sending request header")
+	if printed {
+		Log(ctx, ProxyLogger.Load().Debug().Interface("header", req.Header), "sending request header")
+	}
 }

doh_test.go

@@ -0,0 +1,23 @@
+package ctrld
+
+import (
+	"runtime"
+	"testing"
+)
+
+func Test_dohOsHeaderValue(t *testing.T) {
+	val := dohOsHeaderValue()
+	if val == "" {
+		t.Fatalf("empty %s", dohOsHeader)
+	}
+	t.Log(val)
+
+	encodedOs := EncodeOsNameMap[runtime.GOOS]
+	if encodedOs == "" {
+		t.Fatalf("missing encoding value for: %q", runtime.GOOS)
+	}
+	decodedOs := DecodeOsNameMap[encodedOs]
+	if decodedOs == "" {
+		t.Fatalf("missing decoding value for: %q", runtime.GOOS)
+	}
+}

doq.go

@@ -51,7 +51,7 @@ func resolve(ctx context.Context, msg *dns.Msg, endpoint string, tlsConfig *tls.
 }
 
 func doResolve(ctx context.Context, msg *dns.Msg, endpoint string, tlsConfig *tls.Config) (*dns.Msg, error) {
-	session, err := quic.DialAddr(endpoint, tlsConfig, nil)
+	session, err := quic.DialAddr(ctx, endpoint, tlsConfig, nil)
 	if err != nil {
 		return nil, err
 	}

dot.go

@@ -33,6 +33,7 @@ func (r *dotResolver) Resolve(ctx context.Context, msg *dns.Msg) (*dns.Msg, erro
 	endpoint := r.uc.Endpoint
 	if r.uc.BootstrapIP != "" {
 		dnsClient.TLSConfig.ServerName = r.uc.Domain
+		dnsClient.Net = "tcp-tls"
 		_, port, _ := net.SplitHostPort(endpoint)
 		endpoint = net.JoinHostPort(r.uc.BootstrapIP, port)
 	}

go.mod

@@ -4,29 +4,32 @@ go 1.20
 
 require (
 	github.com/coreos/go-systemd/v22 v22.5.0
-	github.com/cuonglm/osinfo v0.0.0-20230329055532-c513f836da19
-	github.com/frankban/quicktest v1.14.3
+	github.com/cuonglm/osinfo v0.0.0-20230921071424-e0e1b1e0bbbf
+	github.com/frankban/quicktest v1.14.5
 	github.com/fsnotify/fsnotify v1.6.0
 	github.com/go-playground/validator/v10 v10.11.1
-	github.com/godbus/dbus/v5 v5.0.6
+	github.com/godbus/dbus/v5 v5.1.0
 	github.com/hashicorp/golang-lru/v2 v2.0.1
 	github.com/illarion/gonotify v1.0.1
-	github.com/insomniacslk/dhcp v0.0.0-20221215072855-de60144f33f8
+	github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16
+	github.com/jaytaylor/go-hostsfile v0.0.0-20220426042432-61485ac1fa6c
 	github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86
 	github.com/kardianos/service v1.2.1
-	github.com/miekg/dns v1.1.50
-	github.com/pelletier/go-toml/v2 v2.0.6
-	github.com/quic-go/quic-go v0.32.0
+	github.com/miekg/dns v1.1.55
+	github.com/olekukonko/tablewriter v0.0.5
+	github.com/pelletier/go-toml/v2 v2.0.8
+	github.com/quic-go/quic-go v0.38.0
 	github.com/rs/zerolog v1.28.0
-	github.com/spf13/cobra v1.4.0
-	github.com/spf13/viper v1.14.0
-	github.com/stretchr/testify v1.8.1
-	github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54
-	golang.org/x/net v0.7.0
-	golang.org/x/sync v0.1.0
-	golang.org/x/sys v0.5.0
+	github.com/spf13/cobra v1.7.0
+	github.com/spf13/pflag v1.0.5
+	github.com/spf13/viper v1.16.0
+	github.com/stretchr/testify v1.8.3
+	github.com/vishvananda/netlink v1.2.1-beta.2
+	golang.org/x/net v0.10.0
+	golang.org/x/sync v0.2.0
+	golang.org/x/sys v0.8.1-0.20230609144347-5059a07aa46a
 	golang.zx2c4.com/wireguard/windows v0.5.3
-	tailscale.com v1.38.3
+	tailscale.com v1.44.0
 )
 
 require (
@@ -34,47 +37,46 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-playground/locales v0.14.0 // indirect
 	github.com/go-playground/universal-translator v0.18.0 // indirect
-	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
+	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/jsimonetti/rtnetlink v1.1.2-0.20220408201609-d380b505068b // indirect
-	github.com/kr/pretty v0.3.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.3.2 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.18 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
 	github.com/mdlayher/ethernet v0.0.0-20190606142754-0394541c37b7 // indirect
-	github.com/mdlayher/netlink v1.7.1 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065 // indirect
-	github.com/mdlayher/socket v0.4.0 // indirect
+	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/onsi/ginkgo/v2 v2.2.0 // indirect
-	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/onsi/ginkgo/v2 v2.9.5 // indirect
+	github.com/pierrec/lz4/v4 v4.1.17 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.4.0 // indirect
-	github.com/quic-go/qtls-go1-18 v0.2.0 // indirect
-	github.com/quic-go/qtls-go1-19 v0.2.0 // indirect
-	github.com/quic-go/qtls-go1-20 v0.1.0 // indirect
-	github.com/rogpeppe/go-internal v1.8.1-0.20211023094830-115ce09fd6b4 // indirect
-	github.com/spf13/afero v1.9.3 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/quic-go/qtls-go1-20 v0.3.2 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/rogpeppe/go-internal v1.10.0 // indirect
+	github.com/spf13/afero v1.9.5 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/subosito/gotenv v1.4.1 // indirect
-	github.com/u-root/uio v0.0.0-20221213070652-c3537552635f // indirect
-	github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 // indirect
-	go4.org/mem v0.0.0-20210711025021-927187094b94 // indirect
-	golang.org/x/crypto v0.6.0 // indirect
-	golang.org/x/exp v0.0.0-20221205204356-47842c84f3db // indirect
-	golang.org/x/mod v0.7.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
-	golang.org/x/tools v0.4.1-0.20221208213631-3f74d914ae6d // indirect
+	github.com/subosito/gotenv v1.4.2 // indirect
+	github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 // indirect
+	github.com/vishvananda/netns v0.0.4 // indirect
+	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
+	golang.org/x/crypto v0.9.0 // indirect
+	golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53 // indirect
+	golang.org/x/mobile v0.0.0-20230531173138-3c911d8e3eda // indirect
+	golang.org/x/mod v0.10.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/tools v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 

go.sum

@@ -46,18 +46,19 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cilium/ebpf v0.8.1 h1:bLSSEbBLqGPXxls55pGr5qWZaTqcmfDJHhou7t254ao=
-github.com/cilium/ebpf v0.8.1/go.mod h1:f5zLIM0FSNuAkSyLAN7X+Hy6yznlF1mNiWUMfxMtrgk=
+github.com/cilium/ebpf v0.10.0 h1:nk5HPMeoBXtOzbkZBWym+ZWq1GIiHUsBFXxwewXAHLQ=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cuonglm/osinfo v0.0.0-20230329055532-c513f836da19 h1:7P/f19Mr0oa3ug8BYt4JuRe/Zq3dF4Mrr4m8+Kw+Hcs=
 github.com/cuonglm/osinfo v0.0.0-20230329055532-c513f836da19/go.mod h1:G45410zMgmnSjLVKCq4f6GpbYAzoP2plX9rPwgx6C24=
+github.com/cuonglm/osinfo v0.0.0-20230921071424-e0e1b1e0bbbf h1:40DHYsri+d1bnroFDU2FQAeq68f3kAlOzlQ93kCf26Q=
+github.com/cuonglm/osinfo v0.0.0-20230921071424-e0e1b1e0bbbf/go.mod h1:G45410zMgmnSjLVKCq4f6GpbYAzoP2plX9rPwgx6C24=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -67,15 +68,14 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fanliao/go-promise v0.0.0-20141029170127-1890db352a72/go.mod h1:PjfxuH4FZdUyfMdtBio2lsRr1AKEaVPwelzuHuh8Lqc=
-github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
-github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
-github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
+github.com/frankban/quicktest v1.14.5 h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
+github.com/frankban/quicktest v1.14.5/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
 github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBYNjji3q3A=
 github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
@@ -84,11 +84,11 @@ github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/j
 github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
 github.com/go-playground/validator/v10 v10.11.1 h1:prmOlTVv+YjZjmRmNSF3VmspqJIxJWXmqUsHwfTRRkQ=
 github.com/go-playground/validator/v10 v10.11.1/go.mod h1:i+3WkQ1FvaUjjxh1kSvIA4dMGDBiPU55YFDl0WbKdWU=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.0.6 h1:mkgN1ofwASrYnJ5W6U/BxG15eXXXjirgZc7CLqkcaro=
-github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -116,7 +116,7 @@ github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvq
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -128,8 +128,6 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
@@ -152,7 +150,6 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru/v2 v2.0.1 h1:5pv5N1lT1fjLg2VQ5KWc7kmucp2x/kvFOnxuVTqZ6x4=
@@ -160,36 +157,32 @@ github.com/hashicorp/golang-lru/v2 v2.0.1/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyf
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714 h1:/jC7qQFrv8CrSJVmaolDVOxTfS9kc36uB6H40kdbQq8=
-github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714/go.mod h1:2Goc3h8EklBH5mspfHFxBnEoURQCGzQQH1ga9Myjvis=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/illarion/gonotify v1.0.1 h1:F1d+0Fgbq/sDWjj/r66ekjDG+IDeecQKUFH4wNwsoio=
 github.com/illarion/gonotify v1.0.1/go.mod h1:zt5pmDofZpU1f8aqlK0+95eQhoEAn/d4G4B/FjVW4jE=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/insomniacslk/dhcp v0.0.0-20221215072855-de60144f33f8 h1:Z72DOke2yOK0Ms4Z2LK1E1OrRJXOxSj5DllTz2FYTRg=
-github.com/insomniacslk/dhcp v0.0.0-20221215072855-de60144f33f8/go.mod h1:m5WMe03WCvWcXjRnhvaAbAAXdCnu20J5P+mmH44ZzpE=
-github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16 h1:+aAGyK41KRn8jbF2Q7PLL0Sxwg6dShGcQSeCC7nZQ8E=
+github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16/go.mod h1:IKrnDWs3/Mqq5n0lI+RxA2sB7MvN/vbMBP3ehXg65UI=
+github.com/jaytaylor/go-hostsfile v0.0.0-20220426042432-61485ac1fa6c h1:kbTQ8oGf+BVFvt/fM+ECI+NbZDCqoi0vtZTfB2p2hrI=
+github.com/jaytaylor/go-hostsfile v0.0.0-20220426042432-61485ac1fa6c/go.mod h1:k6+89xKz7BSMJ+DzIerBdtpEUeTlBMugO/hcVSzahog=
 github.com/josharian/native v1.0.1-0.20221213033349-c1e37c09b531/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 h1:elKwZS1OcdQ0WwEDBeqxKwb7WB62QX8bvZ/FJnVXIfk=
 github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86/go.mod h1:aFAMtuldEgx/4q7iSGazk22+IcgvtiC+HIimFO9XlS8=
-github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
-github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=
-github.com/jsimonetti/rtnetlink v0.0.0-20201009170750-9c6f07d100c1/go.mod h1:hqoO/u39cqLeBLebZ8fWdE96O7FxrAsRYhnVOdgHxok=
-github.com/jsimonetti/rtnetlink v0.0.0-20201110080708-d2c240429e6c/go.mod h1:huN4d1phzjhlOsNIjFsw2SVRbwIHj3fJDMEU2SDPTmg=
-github.com/jsimonetti/rtnetlink v1.1.2-0.20220408201609-d380b505068b h1:Yws7RV6kZr2O7PPdT+RkbSmmOponA8i/1DuGHe8BRsM=
-github.com/jsimonetti/rtnetlink v1.1.2-0.20220408201609-d380b505068b/go.mod h1:TzDCVOZKUa79z6iXbbXqhtAflVgUKaFkZ21M5tK5tzY=
+github.com/jsimonetti/rtnetlink v1.3.2 h1:dcn0uWkfxycEEyNy0IGfx3GrhQ38LH7odjxAghimsVI=
+github.com/jsimonetti/rtnetlink v1.3.2/go.mod h1:BBu4jZCpTjP6Gk0/wfrO8qcqymnN3g0hoFqObRmUo6U=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/kardianos/service v1.2.1 h1:AYndMsehS+ywIS6RB9KOlcXzteWUzxgMgBymJD7+BYk=
 github.com/kardianos/service v1.2.1/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -198,36 +191,39 @@ github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
 github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.18 h1:DOKFKCQ7FNG2L1rbrmstDN4QVRdS89Nkh85u68Uwp98=
+github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
+github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mdlayher/ethernet v0.0.0-20190606142754-0394541c37b7 h1:lez6TS6aAau+8wXUP3G9I3TGlmPFEq2CTxBaRqY6AGE=
 github.com/mdlayher/ethernet v0.0.0-20190606142754-0394541c37b7/go.mod h1:U6ZQobyTjI/tJyq2HG+i/dfSoFUt8/aZCM+GKtmFk/Y=
-github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
-github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
-github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
-github.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZmb2XgV7o=
-github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA=
-github.com/mdlayher/netlink v1.7.1 h1:FdUaT/e33HjEXagwELR8R3/KL1Fq5x3G5jgHLp/BTmg=
-github.com/mdlayher/netlink v1.7.1/go.mod h1:nKO5CSjE/DJjVhk/TNp6vCE1ktVxEA8VEh8drhZzxsQ=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/raw v0.0.0-20190606142536-fef19f00fc18/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
 github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065 h1:aFkJ6lx4FPip+S+Uw4aTegFMct9shDvP+79PsSxpm3w=
 github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
-github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
-github.com/mdlayher/socket v0.4.0 h1:280wsy40IC9M9q1uPGcLBwXpcTQDtoGwVt+BNoITxIw=
-github.com/mdlayher/socket v0.4.0/go.mod h1:xxFqz5GRCUN3UEOm9CZqEJsAbe1C8OwSK46NlmWuVoc=
-github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
-github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
+github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
+github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
+github.com/miekg/dns v1.1.55 h1:GoQ4hpsj0nFLYe+bWiCToyrBEJXkQfOOIvFGFy0lEgo=
+github.com/miekg/dns v1.1.55/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/onsi/ginkgo/v2 v2.2.0 h1:3ZNA3L1c5FYDFTTxbFeVGGD8jYvjYauHD30YgLxVsNI=
-github.com/onsi/ginkgo/v2 v2.2.0/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
-github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
-github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
-github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
-github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
+github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
+github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
+github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
+github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
+github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
+github.com/pelletier/go-toml/v2 v2.0.8 h1:0ctb6s9mE31h0/lhu+J6OPmVeDxJn+kYnJc2jZR9tGQ=
+github.com/pelletier/go-toml/v2 v2.0.8/go.mod h1:vuYfssBdrU2XDZ9bYydBu6t+6a6PYNcZljzZR9VXg+4=
+github.com/pierrec/lz4/v4 v4.1.14/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.17 h1:kV4Ip+/hUBC+8T6+2EgburRtkE9ef4nbY3f4dFhGjMc=
+github.com/pierrec/lz4/v4 v4.1.17/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
@@ -236,35 +232,33 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
 github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
-github.com/quic-go/qtls-go1-18 v0.2.0 h1:5ViXqBZ90wpUcZS0ge79rf029yx0dYB0McyPJwqqj7U=
-github.com/quic-go/qtls-go1-18 v0.2.0/go.mod h1:moGulGHK7o6O8lSPSZNoOwcLvJKJ85vVNc7oJFD65bc=
-github.com/quic-go/qtls-go1-19 v0.2.0 h1:Cvn2WdhyViFUHoOqK52i51k4nDX8EwIh5VJiVM4nttk=
-github.com/quic-go/qtls-go1-19 v0.2.0/go.mod h1:ySOI96ew8lnoKPtSqx2BlI5wCpUVPT05RMAlajtnyOI=
-github.com/quic-go/qtls-go1-20 v0.1.0 h1:d1PK3ErFy9t7zxKsG3NXBJXZjp/kMLoIb3y/kV54oAI=
-github.com/quic-go/qtls-go1-20 v0.1.0/go.mod h1:JKtK6mjbAVcUTN/9jZpvLbGxvdWIKS8uT7EiStoU1SM=
-github.com/quic-go/quic-go v0.32.0 h1:lY02md31s1JgPiiyfqJijpu/UX/Iun304FI3yUqX7tA=
-github.com/quic-go/quic-go v0.32.0/go.mod h1:/fCsKANhQIeD5l76c2JFU+07gVE3KaA0FP+0zMWwfwo=
+github.com/quic-go/qtls-go1-20 v0.3.2 h1:rRgN3WfnKbyik4dBV8A6girlJVxGand/d+jVKbQq5GI=
+github.com/quic-go/qtls-go1-20 v0.3.2/go.mod h1:X9Nh97ZL80Z+bX/gUXMbipO6OxdiDi58b/fMC9mAL+k=
+github.com/quic-go/quic-go v0.38.0 h1:T45lASr5q/TrVwt+jrVccmqHhPL2XuSyoCLVCpfOSLc=
+github.com/quic-go/quic-go v0.38.0/go.mod h1:MPCuRq7KBK2hNcfKj/1iD1BGuN3eAYMeNxp3T42LRUg=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
-github.com/rogpeppe/go-internal v1.8.1-0.20211023094830-115ce09fd6b4 h1:Ha8xCaq6ln1a+R91Km45Oq6lPXj2Mla6CRJYcuV2h1w=
-github.com/rogpeppe/go-internal v1.8.1-0.20211023094830-115ce09fd6b4/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/spf13/afero v1.9.3 h1:41FoI0fD7OR7mGcKE/aOiLkGreyf8ifIOQmJANWogMk=
-github.com/spf13/afero v1.9.3/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
-github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
-github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
-github.com/spf13/cobra v1.4.0 h1:y+wJpx64xcgO1V+RcnwW0LEHxTKRi2ZDPSBjWnrg88Q=
-github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
+github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
+github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
+github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
+github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
+github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.14.0 h1:Rg7d3Lo706X9tHsJMUjdiwMpHB7W8WnSVOssIY+JElU=
-github.com/spf13/viper v1.14.0/go.mod h1:WT//axPky3FdvXHzGw33dNdXXXfFQqmEalje+egj8As=
+github.com/spf13/viper v1.16.0 h1:rGGH0XDZhdUOryiDWjmIvUSWpbNqisK8Wk0Vyefw8hc=
+github.com/spf13/viper v1.16.0/go.mod h1:yg78JgCJcbrQOvV9YLXgkLaZqUidkY9K+Dd1FofRzQg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
@@ -276,17 +270,17 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
-github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
-github.com/u-root/uio v0.0.0-20221213070652-c3537552635f h1:dpx1PHxYqAnXzbryJrWP1NQLzEjwcVgFLhkknuFQ7ww=
-github.com/u-root/uio v0.0.0-20221213070652-c3537552635f/go.mod h1:IogEAUBXDEwX7oR/BMmCctShYs80ql4hF0ySdzGxf7E=
-github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54 h1:8mhqcHPqTMhSPoslhGYihEgSfc77+7La1P6kiB6+9So=
-github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
+github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
+github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
+github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 h1:YcojQL98T/OO+rybuzn2+5KrD5dBwXIvYBvQ2cD3Avg=
+github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63/go.mod h1:eLL9Nub3yfAho7qB0MzZizFhTU2QkLeoVsWdHtDW264=
+github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
+github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 h1:gga7acRE695APm9hlsSMoOoE65U4/TcqNj90mc69Rlg=
-github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
+github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
+github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -298,18 +292,18 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go4.org/mem v0.0.0-20210711025021-927187094b94 h1:OAAkygi2Js191AJP1Ds42MhJRgeofeKGjuoUqNp1QC4=
-go4.org/mem v0.0.0-20210711025021-927187094b94/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
+go4.org/mem v0.0.0-20220726221520-4f986261bf13 h1:CbZeCBZ0aZj8EfVgnqQcYZgf0lpZ3H9rmp5nkDTAst8=
+go4.org/mem v0.0.0-20220726221520-4f986261bf13/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
+golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -320,8 +314,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20221205204356-47842c84f3db h1:D/cFflL63o2KSLJIwjlcIt8PR064j/xsmdEJL/YvY/o=
-golang.org/x/exp v0.0.0-20221205204356-47842c84f3db/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53 h1:5llv2sWeaMSnA3w2kS57ouQQ4pudlXrR0dCgw51QK9o=
+golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -337,6 +331,8 @@ golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPI
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
+golang.org/x/mobile v0.0.0-20230531173138-3c911d8e3eda h1:O+EUvnBNPwI4eLthn8W5K+cS8zQZfgTABPLNm6Bna34=
+golang.org/x/mobile v0.0.0-20230531173138-3c911d8e3eda/go.mod h1:aAjjkJNdrh3PMckS4B10TGS2nag27cbKR1y2BpUxsiY=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
@@ -346,8 +342,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -361,8 +357,6 @@ golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -377,20 +371,15 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -411,12 +400,11 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190418153312-f0ce4c0180be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -425,9 +413,7 @@ golang.org/x/sys v0.0.0-20190606122018-79a91cf218c4/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -447,9 +433,7 @@ golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201101102859-da207088b7d1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -462,17 +446,15 @@ golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220622161953-175b2fd9d664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.1-0.20230609144347-5059a07aa46a h1:qMsju+PNttu/NMbq8bQ9waDdxgJMu9QNoUDuhnBaYt0=
+golang.org/x/sys v0.8.1-0.20230609144347-5059a07aa46a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -481,8 +463,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -492,7 +474,6 @@ golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
@@ -535,9 +516,8 @@ golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.4.1-0.20221208213631-3f74d914ae6d h1:9ZNWAi4CYhNv60mXGgAncgq7SGc5qa7C8VZV8Tg7Ggs=
-golang.org/x/tools v0.4.1-0.20221208213631-3f74d914ae6d/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
+golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -632,7 +612,7 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -641,8 +621,6 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
@@ -657,5 +635,5 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-tailscale.com v1.38.3 h1:2aX3+u0Re8QcN6nq7zf9Aa4ZCR2Nf6Imv3isqdQrb58=
-tailscale.com v1.38.3/go.mod h1:UWLQxcd8dz+lds2I+HpfXSruHrvXM1j4zd4zdx86t7w=
+tailscale.com v1.44.0 h1:MPos9n30kJvdyfL52045gVFyNg93K+bwgDsr8gqKq2o=
+tailscale.com v1.44.0/go.mod h1:+iYwTdeHyVJuNDu42Zafwihq1Uqfh+pW7pRaY1GD328=

internal/clientinfo/arp.go

@@ -0,0 +1,49 @@
+package clientinfo
+
+import "sync"
+
+type arpDiscover struct {
+	mac sync.Map // ip  => mac
+	ip  sync.Map // mac => ip
+}
+
+func (a *arpDiscover) refresh() error {
+	a.scan()
+	return nil
+}
+
+func (a *arpDiscover) LookupIP(mac string) string {
+	val, ok := a.ip.Load(mac)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+func (a *arpDiscover) LookupMac(ip string) string {
+	val, ok := a.mac.Load(ip)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+func (a *arpDiscover) String() string {
+	return "arp"
+}
+
+func (a *arpDiscover) List() []string {
+	if a == nil {
+		return nil
+	}
+	var ips []string
+	a.ip.Range(func(key, value any) bool {
+		ips = append(ips, value.(string))
+		return true
+	})
+	a.mac.Range(func(key, value any) bool {
+		ips = append(ips, key.(string))
+		return true
+	})
+	return ips
+}

internal/clientinfo/arp_linux.go

@@ -0,0 +1,28 @@
+package clientinfo
+
+import (
+	"bufio"
+	"os"
+	"strings"
+)
+
+const procNetArpFile = "/proc/net/arp"
+
+func (a *arpDiscover) scan() {
+	f, err := os.Open(procNetArpFile)
+	if err != nil {
+		return
+	}
+	defer f.Close()
+
+	s := bufio.NewScanner(f)
+	s.Scan() // skip header
+	for s.Scan() {
+		line := s.Text()
+		fields := strings.Fields(line)
+		ip := fields[0]
+		mac := fields[3]
+		a.mac.Store(ip, mac)
+		a.ip.Store(mac, ip)
+	}
+}

internal/clientinfo/arp_test.go

@@ -0,0 +1,23 @@
+package clientinfo
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestArpScan(t *testing.T) {
+	a := &arpDiscover{}
+	a.scan()
+
+	for _, table := range []*sync.Map{&a.mac, &a.ip} {
+		count := 0
+		table.Range(func(key, value any) bool {
+			count++
+			t.Logf("%s => %s", key, value)
+			return true
+		})
+		if count == 0 {
+			t.Error("empty result from arp scan")
+		}
+	}
+}

internal/clientinfo/arp_unix.go

@@ -0,0 +1,30 @@
+//go:build !linux && !windows
+
+package clientinfo
+
+import (
+	"os/exec"
+	"strings"
+)
+
+func (a *arpDiscover) scan() {
+	data, err := exec.Command("arp", "-an").Output()
+	if err != nil {
+		return
+	}
+
+	for _, line := range strings.Split(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) <= 3 {
+			continue
+		}
+
+		// trim brackets
+		ip := strings.ReplaceAll(fields[1], "(", "")
+		ip = strings.ReplaceAll(ip, ")", "")
+
+		mac := fields[3]
+		a.mac.Store(ip, mac)
+		a.ip.Store(mac, ip)
+	}
+}

internal/clientinfo/arp_windows.go

@@ -0,0 +1,38 @@
+package clientinfo
+
+import (
+	"os/exec"
+	"strings"
+)
+
+func (a *arpDiscover) scan() {
+	data, err := exec.Command("arp", "-a").Output()
+	if err != nil {
+		return
+	}
+
+	header := false
+	for _, line := range strings.Split(string(data), "\n") {
+		if len(line) == 0 {
+			continue // empty lines
+		}
+		if line[0] != ' ' {
+			header = true // "Interface:" lines, next is header line.
+			continue
+		}
+		if header {
+			header = false // header lines
+			continue
+		}
+
+		fields := strings.Fields(line)
+		if len(fields) < 2 {
+			continue
+		}
+
+		ip := fields[0]
+		mac := strings.ReplaceAll(fields[1], "-", ":")
+		a.mac.Store(ip, mac)
+		a.ip.Store(mac, ip)
+	}
+}

internal/clientinfo/client_info.go

@@ -0,0 +1,391 @@
+package clientinfo
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/Control-D-Inc/ctrld/internal/controld"
+)
+
+// IpResolver is the interface for retrieving IP from Mac.
+type IpResolver interface {
+	fmt.Stringer
+	// LookupIP returns ip of the device with given mac.
+	LookupIP(mac string) string
+}
+
+// MacResolver is the interface for retrieving Mac from IP.
+type MacResolver interface {
+	fmt.Stringer
+	// LookupMac returns mac of the device with given ip.
+	LookupMac(ip string) string
+}
+
+// HostnameByIpResolver is the interface for retrieving hostname from IP.
+type HostnameByIpResolver interface {
+	// LookupHostnameByIP returns hostname of the given ip.
+	LookupHostnameByIP(ip string) string
+}
+
+// HostnameByMacResolver is the interface for retrieving hostname from Mac.
+type HostnameByMacResolver interface {
+	// LookupHostnameByMac returns hostname of the device with given mac.
+	LookupHostnameByMac(mac string) string
+}
+
+// HostnameResolver is the interface for retrieving hostname from either IP or Mac.
+type HostnameResolver interface {
+	fmt.Stringer
+	HostnameByIpResolver
+	HostnameByMacResolver
+}
+
+type refresher interface {
+	refresh() error
+}
+
+type ipLister interface {
+	fmt.Stringer
+	// List returns list of ip known by the resolver.
+	List() []string
+}
+
+type Client struct {
+	IP       netip.Addr
+	Mac      string
+	Hostname string
+	Source   map[string]struct{}
+}
+
+type Table struct {
+	ipResolvers       []IpResolver
+	macResolvers      []MacResolver
+	hostnameResolvers []HostnameResolver
+	refreshers        []refresher
+	initOnce          sync.Once
+
+	dhcp   *dhcp
+	merlin *merlinDiscover
+	arp    *arpDiscover
+	ptr    *ptrDiscover
+	mdns   *mdns
+	hf     *hostsFile
+	vni    *virtualNetworkIface
+	cfg    *ctrld.Config
+	quitCh chan struct{}
+	selfIP string
+	cdUID  string
+}
+
+func NewTable(cfg *ctrld.Config, selfIP, cdUID string) *Table {
+	return &Table{
+		cfg:    cfg,
+		quitCh: make(chan struct{}),
+		selfIP: selfIP,
+		cdUID:  cdUID,
+	}
+}
+
+func (t *Table) AddLeaseFile(name string, format ctrld.LeaseFileFormat) {
+	if !t.discoverDHCP() {
+		return
+	}
+	clientInfoFiles[name] = format
+}
+
+func (t *Table) RefreshLoop(stopCh chan struct{}) {
+	timer := time.NewTicker(time.Minute * 5)
+	defer timer.Stop()
+	for {
+		select {
+		case <-timer.C:
+			for _, r := range t.refreshers {
+				_ = r.refresh()
+			}
+		case <-stopCh:
+			close(t.quitCh)
+			return
+		}
+	}
+}
+
+func (t *Table) Init() {
+	t.initOnce.Do(t.init)
+}
+
+func (t *Table) init() {
+	// Custom client ID presents, use it as the only source.
+	if _, clientID := controld.ParseRawUID(t.cdUID); clientID != "" {
+		ctrld.ProxyLogger.Load().Debug().Msg("start self discovery")
+		t.dhcp = &dhcp{selfIP: t.selfIP}
+		t.dhcp.addSelf()
+		t.ipResolvers = append(t.ipResolvers, t.dhcp)
+		t.macResolvers = append(t.macResolvers, t.dhcp)
+		t.hostnameResolvers = append(t.hostnameResolvers, t.dhcp)
+		return
+	}
+
+	// Otherwise, process all possible sources in order, that means
+	// the first result of IP/MAC/Hostname lookup will be used.
+	//
+	// Merlin custom clients.
+	if t.discoverDHCP() || t.discoverARP() {
+		t.merlin = &merlinDiscover{}
+		if err := t.merlin.refresh(); err != nil {
+			ctrld.ProxyLogger.Load().Error().Err(err).Msg("could not init Merlin discover")
+		} else {
+			t.hostnameResolvers = append(t.hostnameResolvers, t.merlin)
+			t.refreshers = append(t.refreshers, t.merlin)
+		}
+	}
+	// Hosts file mapping.
+	if t.discoverHosts() {
+		t.hf = &hostsFile{}
+		ctrld.ProxyLogger.Load().Debug().Msg("start hosts file discovery")
+		if err := t.hf.init(); err != nil {
+			ctrld.ProxyLogger.Load().Error().Err(err).Msg("could not init hosts file discover")
+		} else {
+			t.hostnameResolvers = append(t.hostnameResolvers, t.hf)
+			t.refreshers = append(t.refreshers, t.hf)
+		}
+		go t.hf.watchChanges()
+	}
+	// DHCP lease files.
+	if t.discoverDHCP() {
+		t.dhcp = &dhcp{selfIP: t.selfIP}
+		ctrld.ProxyLogger.Load().Debug().Msg("start dhcp discovery")
+		if err := t.dhcp.init(); err != nil {
+			ctrld.ProxyLogger.Load().Error().Err(err).Msg("could not init DHCP discover")
+		} else {
+			t.ipResolvers = append(t.ipResolvers, t.dhcp)
+			t.macResolvers = append(t.macResolvers, t.dhcp)
+			t.hostnameResolvers = append(t.hostnameResolvers, t.dhcp)
+		}
+		go t.dhcp.watchChanges()
+	}
+	// ARP table.
+	if t.discoverARP() {
+		t.arp = &arpDiscover{}
+		ctrld.ProxyLogger.Load().Debug().Msg("start arp discovery")
+		if err := t.arp.refresh(); err != nil {
+			ctrld.ProxyLogger.Load().Error().Err(err).Msg("could not init ARP discover")
+		} else {
+			t.ipResolvers = append(t.ipResolvers, t.arp)
+			t.macResolvers = append(t.macResolvers, t.arp)
+			t.refreshers = append(t.refreshers, t.arp)
+		}
+	}
+	// PTR lookup.
+	if t.discoverPTR() {
+		t.ptr = &ptrDiscover{resolver: ctrld.NewPrivateResolver()}
+		ctrld.ProxyLogger.Load().Debug().Msg("start ptr discovery")
+		if err := t.ptr.refresh(); err != nil {
+			ctrld.ProxyLogger.Load().Error().Err(err).Msg("could not init PTR discover")
+		} else {
+			t.hostnameResolvers = append(t.hostnameResolvers, t.ptr)
+			t.refreshers = append(t.refreshers, t.ptr)
+		}
+	}
+	// mdns.
+	if t.discoverMDNS() {
+		t.mdns = &mdns{}
+		ctrld.ProxyLogger.Load().Debug().Msg("start mdns discovery")
+		if err := t.mdns.init(t.quitCh); err != nil {
+			ctrld.ProxyLogger.Load().Error().Err(err).Msg("could not init mDNS discover")
+		} else {
+			t.hostnameResolvers = append(t.hostnameResolvers, t.mdns)
+		}
+	}
+	// VPN clients.
+	if t.discoverDHCP() || t.discoverARP() {
+		t.vni = &virtualNetworkIface{}
+		t.hostnameResolvers = append(t.hostnameResolvers, t.vni)
+	}
+}
+
+func (t *Table) LookupIP(mac string) string {
+	t.initOnce.Do(t.init)
+	for _, r := range t.ipResolvers {
+		if ip := r.LookupIP(mac); ip != "" {
+			return ip
+		}
+	}
+	return ""
+}
+
+func (t *Table) LookupMac(ip string) string {
+	t.initOnce.Do(t.init)
+	for _, r := range t.macResolvers {
+		if mac := r.LookupMac(ip); mac != "" {
+			return mac
+		}
+	}
+	return ""
+}
+
+func (t *Table) LookupHostname(ip, mac string) string {
+	t.initOnce.Do(t.init)
+	for _, r := range t.hostnameResolvers {
+		if name := r.LookupHostnameByIP(ip); name != "" {
+			return name
+		}
+		if name := r.LookupHostnameByMac(mac); name != "" {
+			return name
+		}
+	}
+	return ""
+}
+
+type macEntry struct {
+	mac string
+	src string
+}
+
+type hostnameEntry struct {
+	name string
+	src  string
+}
+
+func (t *Table) lookupMacAll(ip string) []*macEntry {
+	var res []*macEntry
+	for _, r := range t.macResolvers {
+		res = append(res, &macEntry{mac: r.LookupMac(ip), src: r.String()})
+	}
+	return res
+}
+
+func (t *Table) lookupHostnameAll(ip, mac string) []*hostnameEntry {
+	var res []*hostnameEntry
+	for _, r := range t.hostnameResolvers {
+		src := r.String()
+		// For ptrDiscover, lookup hostname may block due to server unavailable,
+		// so only lookup from cache to prevent timeout reached.
+		if ptrResolver, ok := r.(*ptrDiscover); ok {
+			if name := ptrResolver.lookupHostnameFromCache(ip); name != "" {
+				res = append(res, &hostnameEntry{name: name, src: src})
+			}
+			continue
+		}
+		if name := r.LookupHostnameByIP(ip); name != "" {
+			res = append(res, &hostnameEntry{name: name, src: src})
+			continue
+		}
+		if name := r.LookupHostnameByMac(mac); name != "" {
+			res = append(res, &hostnameEntry{name: name, src: src})
+			continue
+		}
+	}
+	return res
+}
+
+// ListClients returns list of clients discovered by ctrld.
+func (t *Table) ListClients() []*Client {
+	for _, r := range t.refreshers {
+		_ = r.refresh()
+	}
+	ipMap := make(map[string]*Client)
+	il := []ipLister{t.dhcp, t.arp, t.ptr, t.mdns, t.vni}
+	for _, ir := range il {
+		for _, ip := range ir.List() {
+			c, ok := ipMap[ip]
+			if !ok {
+				c = &Client{
+					IP:     netip.MustParseAddr(ip),
+					Source: map[string]struct{}{ir.String(): {}},
+				}
+				ipMap[ip] = c
+			} else {
+				c.Source[ir.String()] = struct{}{}
+			}
+		}
+	}
+	for ip := range ipMap {
+		c := ipMap[ip]
+		for _, e := range t.lookupMacAll(ip) {
+			if c.Mac == "" && e.mac != "" {
+				c.Mac = e.mac
+			}
+			if e.mac != "" {
+				c.Source[e.src] = struct{}{}
+			}
+		}
+		for _, e := range t.lookupHostnameAll(ip, c.Mac) {
+			if c.Hostname == "" && e.name != "" {
+				c.Hostname = e.name
+			}
+			if e.name != "" {
+				c.Source[e.src] = struct{}{}
+			}
+		}
+	}
+	clients := make([]*Client, 0, len(ipMap))
+	for _, c := range ipMap {
+		clients = append(clients, c)
+	}
+	return clients
+}
+
+// StoreVPNClient stores client info for VPN clients.
+func (t *Table) StoreVPNClient(ci *ctrld.ClientInfo) {
+	if ci == nil || t.vni == nil {
+		return
+	}
+	t.vni.mac.Store(ci.IP, ci.Mac)
+	t.vni.ip2name.Store(ci.IP, ci.Hostname)
+}
+
+func (t *Table) discoverDHCP() bool {
+	if t.cfg.Service.DiscoverDHCP == nil {
+		return true
+	}
+	return *t.cfg.Service.DiscoverDHCP
+}
+
+func (t *Table) discoverARP() bool {
+	if t.cfg.Service.DiscoverARP == nil {
+		return true
+	}
+	return *t.cfg.Service.DiscoverARP
+}
+
+func (t *Table) discoverMDNS() bool {
+	if t.cfg.Service.DiscoverMDNS == nil {
+		return true
+	}
+	return *t.cfg.Service.DiscoverMDNS
+}
+
+func (t *Table) discoverPTR() bool {
+	if t.cfg.Service.DiscoverPtr == nil {
+		return true
+	}
+	return *t.cfg.Service.DiscoverPtr
+}
+
+func (t *Table) discoverHosts() bool {
+	if t.cfg.Service.DiscoverHosts == nil {
+		return true
+	}
+	return *t.cfg.Service.DiscoverHosts
+}
+
+// normalizeIP normalizes the ip parsed from dnsmasq/dhcpd lease file.
+func normalizeIP(in string) string {
+	// dnsmasq may put ip with interface index in lease file, strip it here.
+	ip, _, found := strings.Cut(in, "%")
+	if found {
+		return ip
+	}
+	return in
+}
+
+func normalizeHostname(name string) string {
+	if before, _, found := strings.Cut(name, "."); found {
+		return before // remove ".local.", ".lan.", ... suffix
+	}
+	return name
+}

internal/clientinfo/client_info_test.go

@@ -0,0 +1,27 @@
+package clientinfo
+
+import (
+	"testing"
+)
+
+func Test_normalizeIP(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"v4", "127.0.0.1", "127.0.0.1"},
+		{"v4 with index", "127.0.0.1%lo", "127.0.0.1"},
+		{"v6", "fe80::1", "fe80::1"},
+		{"v6 with index", "fe80::1%22002", "fe80::1"},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := normalizeIP(tc.in); got != tc.want {
+				t.Errorf("normalizeIP() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}

internal/clientinfo/dhcp.go

@@ -0,0 +1,317 @@
+package clientinfo
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/fsnotify/fsnotify"
+	"tailscale.com/net/interfaces"
+	"tailscale.com/util/lineread"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/Control-D-Inc/ctrld/internal/router"
+)
+
+type dhcp struct {
+	mac2name sync.Map // mac => name
+	ip2name  sync.Map // ip  => name
+	ip       sync.Map // mac => ip
+	mac      sync.Map // ip  => mac
+
+	watcher *fsnotify.Watcher
+	selfIP  string
+}
+
+func (d *dhcp) init() error {
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return err
+	}
+	d.addSelf()
+	d.watcher = watcher
+	for file, format := range clientInfoFiles {
+		// Ignore errors for default lease files.
+		_ = d.addLeaseFile(file, format)
+	}
+	return nil
+}
+
+func (d *dhcp) watchChanges() {
+	if d.watcher == nil {
+		return
+	}
+	if dir := router.LeaseFilesDir(); dir != "" {
+		if err := d.watcher.Add(dir); err != nil {
+			ctrld.ProxyLogger.Load().Err(err).Str("dir", dir).Msg("could not watch lease dir")
+		}
+	}
+	for {
+		select {
+		case event, ok := <-d.watcher.Events:
+			if !ok {
+				return
+			}
+			if event.Has(fsnotify.Create) {
+				if format, ok := clientInfoFiles[event.Name]; ok {
+					if err := d.addLeaseFile(event.Name, format); err != nil {
+						ctrld.ProxyLogger.Load().Err(err).Str("file", event.Name).Msg("could not add lease file")
+					}
+				}
+				continue
+			}
+			if event.Has(fsnotify.Write) || event.Has(fsnotify.Rename) || event.Has(fsnotify.Chmod) || event.Has(fsnotify.Remove) {
+				format := clientInfoFiles[event.Name]
+				if err := d.readLeaseFile(event.Name, format); err != nil && !os.IsNotExist(err) {
+					ctrld.ProxyLogger.Load().Err(err).Str("file", event.Name).Msg("leases file changed but failed to update client info")
+				}
+			}
+		case err, ok := <-d.watcher.Errors:
+			if !ok {
+				return
+			}
+			ctrld.ProxyLogger.Load().Err(err).Msg("could not watch client info file")
+		}
+	}
+
+}
+
+func (d *dhcp) LookupIP(mac string) string {
+	val, ok := d.ip.Load(mac)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+func (d *dhcp) LookupMac(ip string) string {
+	val, ok := d.mac.Load(ip)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+func (d *dhcp) LookupHostnameByIP(ip string) string {
+	val, ok := d.ip2name.Load(ip)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+func (d *dhcp) LookupHostnameByMac(mac string) string {
+	val, ok := d.mac2name.Load(mac)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+func (d *dhcp) String() string {
+	return "dhcp"
+}
+
+func (d *dhcp) List() []string {
+	if d == nil {
+		return nil
+	}
+	var ips []string
+	d.ip.Range(func(key, value any) bool {
+		ips = append(ips, value.(string))
+		return true
+	})
+	d.mac.Range(func(key, value any) bool {
+		ips = append(ips, key.(string))
+		return true
+	})
+	return ips
+}
+
+// AddLeaseFile adds given lease file for reading/watching clients info.
+func (d *dhcp) addLeaseFile(name string, format ctrld.LeaseFileFormat) error {
+	if d.watcher == nil {
+		return nil
+	}
+	if err := d.readLeaseFile(name, format); err != nil {
+		return fmt.Errorf("could not read lease file: %w", err)
+	}
+	clientInfoFiles[name] = format
+	return d.watcher.Add(name)
+}
+
+// readLeaseFile reads the lease file with given format, saving client information to dhcp table.
+func (d *dhcp) readLeaseFile(name string, format ctrld.LeaseFileFormat) error {
+	switch format {
+	case ctrld.Dnsmasq:
+		return d.dnsmasqReadClientInfoFile(name)
+	case ctrld.IscDhcpd:
+		return d.iscDHCPReadClientInfoFile(name)
+	}
+	return fmt.Errorf("unsupported format: %s, file: %s", format, name)
+}
+
+// dnsmasqReadClientInfoFile populates dhcp table with client info reading from dnsmasq lease file.
+func (d *dhcp) dnsmasqReadClientInfoFile(name string) error {
+	f, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	return d.dnsmasqReadClientInfoReader(f)
+
+}
+
+// dnsmasqReadClientInfoReader likes ctrld.Dnsmasq, but reading from an io.Reader instead of file.
+func (d *dhcp) dnsmasqReadClientInfoReader(reader io.Reader) error {
+	return lineread.Reader(reader, func(line []byte) error {
+		fields := bytes.Fields(line)
+		if len(fields) < 4 {
+			return nil
+		}
+
+		mac := string(fields[1])
+		if _, err := net.ParseMAC(mac); err != nil {
+			// The second field is not a dhcp, skip.
+			return nil
+		}
+		ip := normalizeIP(string(fields[2]))
+		if net.ParseIP(ip) == nil {
+			ctrld.ProxyLogger.Load().Warn().Msgf("invalid ip address entry: %q", ip)
+			ip = ""
+		}
+
+		d.mac.Store(ip, mac)
+		d.ip.Store(mac, ip)
+		hostname := string(fields[3])
+		if hostname == "*" {
+			return nil
+		}
+		name := normalizeHostname(hostname)
+		d.mac2name.Store(mac, name)
+		d.ip2name.Store(ip, name)
+		return nil
+	})
+}
+
+// iscDHCPReadClientInfoFile populates dhcp table with client info reading from isc-dhcpd lease file.
+func (d *dhcp) iscDHCPReadClientInfoFile(name string) error {
+	f, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	return d.iscDHCPReadClientInfoReader(f)
+}
+
+// iscDHCPReadClientInfoReader likes ctrld.IscDhcpd, but reading from an io.Reader instead of file.
+func (d *dhcp) iscDHCPReadClientInfoReader(reader io.Reader) error {
+	s := bufio.NewScanner(reader)
+	var ip, mac, hostname string
+	for s.Scan() {
+		line := s.Text()
+		if strings.HasPrefix(line, "}") {
+			d.mac.Store(ip, mac)
+			d.ip.Store(mac, ip)
+			if hostname != "" && hostname != "*" {
+				name := normalizeHostname(hostname)
+				d.mac2name.Store(mac, name)
+				d.ip2name.Store(ip, hostname)
+				ip, mac, hostname = "", "", ""
+			}
+			continue
+		}
+		fields := strings.Fields(line)
+		if len(fields) < 2 {
+			continue
+		}
+		switch fields[0] {
+		case "lease":
+			ip = normalizeIP(strings.ToLower(fields[1]))
+			if net.ParseIP(ip) == nil {
+				ctrld.ProxyLogger.Load().Warn().Msgf("invalid ip address entry: %q", ip)
+				ip = ""
+			}
+		case "hardware":
+			if len(fields) >= 3 {
+				mac = strings.ToLower(strings.TrimRight(fields[2], ";"))
+				if _, err := net.ParseMAC(mac); err != nil {
+					// Invalid dhcp, skip.
+					mac = ""
+				}
+			}
+		case "client-hostname":
+			hostname = strings.Trim(fields[1], `";`)
+		}
+	}
+	return nil
+}
+
+// addSelf populates current host info to dhcp, so queries from
+// the host itself can be attached with proper client info.
+func (d *dhcp) addSelf() {
+	hostname, err := os.Hostname()
+	if err != nil {
+		ctrld.ProxyLogger.Load().Err(err).Msg("could not get hostname")
+		return
+	}
+	hostname = normalizeHostname(hostname)
+	d.ip2name.Store("127.0.0.1", hostname)
+	d.ip2name.Store("::1", hostname)
+	found := false
+	interfaces.ForeachInterface(func(i interfaces.Interface, prefixes []netip.Prefix) {
+		mac := i.HardwareAddr.String()
+		// Skip loopback interfaces, info was stored above.
+		if mac == "" {
+			return
+		}
+		addrs, _ := i.Addrs()
+		for _, addr := range addrs {
+			if found {
+				return
+			}
+			ipNet, ok := addr.(*net.IPNet)
+			if !ok {
+				continue
+			}
+			ip := ipNet.IP
+			d.mac.Store(ip.String(), mac)
+			d.ip.Store(mac, ip.String())
+			if ip.To4() != nil {
+				d.mac.Store("127.0.0.1", mac)
+			} else {
+				d.mac.Store("::1", mac)
+			}
+			d.mac2name.Store(mac, hostname)
+			d.ip2name.Store(ip.String(), hostname)
+			// If we have self IP set, and this IP is it, use this IP only.
+			if ip.String() == d.selfIP {
+				found = true
+			}
+		}
+	})
+	for _, netIface := range router.SelfInterfaces() {
+		mac := netIface.HardwareAddr.String()
+		if mac == "" {
+			return
+		}
+		d.mac2name.Store(mac, hostname)
+		addrs, _ := netIface.Addrs()
+		for _, addr := range addrs {
+			ipNet, ok := addr.(*net.IPNet)
+			if !ok {
+				continue
+			}
+			ip := ipNet.IP
+			d.mac.LoadOrStore(ip.String(), mac)
+			d.ip.LoadOrStore(mac, ip.String())
+			d.ip2name.Store(ip.String(), hostname)
+		}
+	}
+}

internal/clientinfo/dhcp_lease_files.go

@@ -0,0 +1,18 @@
+package clientinfo
+
+import "github.com/Control-D-Inc/ctrld"
+
+// clientInfoFiles specifies client info files and how to read them on supported platforms.
+var clientInfoFiles = map[string]ctrld.LeaseFileFormat{
+	"/tmp/dnsmasq.leases":                      ctrld.Dnsmasq,  // ddwrt
+	"/tmp/dhcp.leases":                         ctrld.Dnsmasq,  // openwrt
+	"/var/lib/misc/dnsmasq.leases":             ctrld.Dnsmasq,  // merlin
+	"/mnt/data/udapi-config/dnsmasq.lease":     ctrld.Dnsmasq,  // UDM Pro
+	"/data/udapi-config/dnsmasq.lease":         ctrld.Dnsmasq,  // UDR
+	"/etc/dhcpd/dhcpd-leases.log":              ctrld.Dnsmasq,  // Synology
+	"/tmp/var/lib/misc/dnsmasq.leases":         ctrld.Dnsmasq,  // Tomato
+	"/run/dnsmasq-dhcp.leases":                 ctrld.Dnsmasq,  // EdgeOS
+	"/run/dhcpd.leases":                        ctrld.IscDhcpd, // EdgeOS
+	"/var/dhcpd/var/db/dhcpd.leases":           ctrld.IscDhcpd, // Pfsense
+	"/home/pi/.router/run/dhcp/dnsmasq.leases": ctrld.Dnsmasq,  // Firewalla
+}

internal/clientinfo/dhcp_test.go

@@ -0,0 +1,88 @@
+package clientinfo
+
+import (
+	"io"
+	"strings"
+	"testing"
+)
+
+func Test_readClientInfoReader(t *testing.T) {
+	d := &dhcp{}
+	tests := []struct {
+		name     string
+		in       string
+		readFunc func(r io.Reader) error
+		mac      string
+		hostname string
+	}{
+		{
+			"good dnsmasq",
+			`1683329857 e6:20:59:b8:c1:6d 192.168.1.186 host1 01:e6:20:59:b8:c1:6d
+`,
+			d.dnsmasqReadClientInfoReader,
+			"e6:20:59:b8:c1:6d",
+			"host1",
+		},
+		{
+			"bad dnsmasq seen on UDMdream machine",
+			`1683329857 e6:20:59:b8:c1:6e 192.168.1.111 host1 01:e6:20:59:b8:c1:6e
+duid 00:01:00:01:2b:e4:2e:2c:52:52:14:26:dc:1c
+1683322985 117442354 2600:4040:b0e6:b700::111 ASDASD 00:01:00:01:2a:d0:b9:81:00:07:32:4c:1c:07
+`,
+			d.dnsmasqReadClientInfoReader,
+			"e6:20:59:b8:c1:6e",
+			"host1",
+		},
+		{
+			"isc-dhcpd good",
+			`lease 192.168.1.1 {
+    hardware ethernet 00:00:00:00:00:01;
+    client-hostname "host-1";
+}
+`,
+			d.iscDHCPReadClientInfoReader,
+			"00:00:00:00:00:01",
+			"host-1",
+		},
+		{
+			"isc-dhcpd bad dhcp",
+			`lease 192.168.1.1 {
+    hardware ethernet invalid-dhcp;
+    client-hostname "host-1";
+}
+
+lease 192.168.1.2 {
+    hardware ethernet 00:00:00:00:00:02;
+    client-hostname "host-2";
+}
+`,
+			d.iscDHCPReadClientInfoReader,
+			"00:00:00:00:00:02",
+			"host-2",
+		},
+		{
+			"",
+			`1685794060 00:00:00:00:00:04 192.168.0.209 example 00:00:00:00:00:04 9`,
+			d.dnsmasqReadClientInfoReader,
+			"00:00:00:00:00:04",
+			"example",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			d.mac2name.Delete(tc.mac)
+			if err := tc.readFunc(strings.NewReader(tc.in)); err != nil {
+				t.Errorf("readClientInfoReader() error = %v", err)
+			}
+			val, existed := d.mac2name.Load(tc.mac)
+			if !existed {
+				t.Error("client info missing")
+			}
+			hostname := val.(string)
+			if existed && hostname != tc.hostname {
+				t.Errorf("hostname mismatched, want: %q, got: %q", tc.hostname, hostname)
+			}
+		})
+	}
+}

internal/clientinfo/hostsfile.go

@@ -0,0 +1,120 @@
+package clientinfo
+
+import (
+	"os"
+	"sync"
+
+	"github.com/fsnotify/fsnotify"
+	"github.com/jaytaylor/go-hostsfile"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+const (
+	ipv4LocalhostName = "localhost"
+	ipv6LocalhostName = "ip6-localhost"
+	ipv6LoopbackName  = "ip6-loopback"
+)
+
+// hostsFile provides client discovery functionality using system hosts file.
+type hostsFile struct {
+	watcher *fsnotify.Watcher
+	mu      sync.Mutex
+	m       map[string][]string
+}
+
+// init performs initialization works, which is necessary before hostsFile can be fully operated.
+func (hf *hostsFile) init() error {
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return err
+	}
+	hf.watcher = watcher
+	if err := hf.watcher.Add(hostsfile.HostsPath); err != nil {
+		return err
+	}
+	m, err := hostsfile.ParseHosts(hostsfile.ReadHostsFile())
+	if err != nil {
+		return err
+	}
+	hf.mu.Lock()
+	hf.m = m
+	hf.mu.Unlock()
+	return nil
+}
+
+// refresh reloads hosts file entries.
+func (hf *hostsFile) refresh() error {
+	m, err := hostsfile.ParseHosts(hostsfile.ReadHostsFile())
+	if err != nil {
+		return err
+	}
+	hf.mu.Lock()
+	hf.m = m
+	hf.mu.Unlock()
+	return nil
+}
+
+// watchChanges watches and updates hosts file data if any changes happens.
+func (hf *hostsFile) watchChanges() {
+	if hf.watcher == nil {
+		return
+	}
+	for {
+		select {
+		case event, ok := <-hf.watcher.Events:
+			if !ok {
+				return
+			}
+			if event.Has(fsnotify.Write) || event.Has(fsnotify.Rename) || event.Has(fsnotify.Chmod) || event.Has(fsnotify.Remove) {
+				if err := hf.refresh(); err != nil && !os.IsNotExist(err) {
+					ctrld.ProxyLogger.Load().Err(err).Msg("hosts file changed but failed to update client info")
+				}
+			}
+		case err, ok := <-hf.watcher.Errors:
+			if !ok {
+				return
+			}
+			ctrld.ProxyLogger.Load().Err(err).Msg("could not watch client info file")
+		}
+	}
+
+}
+
+// LookupHostnameByIP returns hostname for given IP from current hosts file entries.
+func (hf *hostsFile) LookupHostnameByIP(ip string) string {
+	hf.mu.Lock()
+	defer hf.mu.Unlock()
+	if names := hf.m[ip]; len(names) > 0 {
+		isLoopback := ip == "127.0.0.1" || ip == "::1"
+		for _, hostname := range names {
+			name := normalizeHostname(hostname)
+			// Ignoring ipv4/ipv6 loopback entry.
+			if isLoopback && isLocalhostName(name) {
+				continue
+			}
+			return name
+		}
+	}
+	return ""
+}
+
+// LookupHostnameByMac returns hostname for given Mac from current hosts file entries.
+func (hf *hostsFile) LookupHostnameByMac(mac string) string {
+	return ""
+}
+
+// String returns human-readable format of hostsFile.
+func (hf *hostsFile) String() string {
+	return "hosts"
+}
+
+// isLocalhostName reports whether the given hostname represents localhost.
+func isLocalhostName(hostname string) bool {
+	switch hostname {
+	case ipv4LocalhostName, ipv6LocalhostName, ipv6LoopbackName:
+		return true
+	default:
+		return false
+	}
+}

internal/clientinfo/hostsfile_test.go

@@ -0,0 +1,33 @@
+package clientinfo
+
+import (
+	"testing"
+)
+
+func Test_hostsFile_LookupHostnameByIP(t *testing.T) {
+	tests := []struct {
+		name             string
+		ip               string
+		hostnames        []string
+		expectedHostname string
+	}{
+		{"ipv4 loopback", "127.0.0.1", []string{ipv4LocalhostName}, ""},
+		{"ipv6 loopback", "::1", []string{ipv6LocalhostName, ipv6LoopbackName}, ""},
+		{"non-localhost", "::1", []string{"foo"}, "foo"},
+		{"multiple hostnames", "::1", []string{ipv4LocalhostName, "foo"}, "foo"},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			hf := &hostsFile{m: make(map[string][]string)}
+			hf.mu.Lock()
+			hf.m[tc.ip] = tc.hostnames
+			hf.mu.Unlock()
+			if got := hf.LookupHostnameByIP(tc.ip); got != tc.expectedHostname {
+				t.Errorf("unpexpected result, want: %q, got: %q", tc.expectedHostname, got)
+			}
+		})
+	}
+}

internal/clientinfo/mdns.go

@@ -0,0 +1,212 @@
+package clientinfo
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/miekg/dns"
+	"tailscale.com/logtail/backoff"
+
+	"github.com/Control-D-Inc/ctrld"
+	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
+)
+
+var (
+	mdnsV4Addr = &net.UDPAddr{
+		IP:   net.ParseIP("224.0.0.251"),
+		Port: 5353,
+	}
+	mdnsV6Addr = &net.UDPAddr{
+		IP:   net.ParseIP("ff02::fb"),
+		Port: 5353,
+	}
+)
+
+type mdns struct {
+	name sync.Map // ip => hostname
+}
+
+func (m *mdns) LookupHostnameByIP(ip string) string {
+	val, ok := m.name.Load(ip)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+func (m *mdns) LookupHostnameByMac(mac string) string {
+	return ""
+}
+
+func (m *mdns) String() string {
+	return "mdns"
+}
+
+func (m *mdns) List() []string {
+	if m == nil {
+		return nil
+	}
+	var ips []string
+	m.name.Range(func(key, value any) bool {
+		ips = append(ips, key.(string))
+		return true
+	})
+	return ips
+}
+
+func (m *mdns) init(quitCh chan struct{}) error {
+	ifaces, err := multicastInterfaces()
+	if err != nil {
+		return err
+	}
+
+	v4ConnList := make([]*net.UDPConn, 0, len(ifaces))
+	v6ConnList := make([]*net.UDPConn, 0, len(ifaces))
+	for _, iface := range ifaces {
+		if iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+		if conn, err := net.ListenMulticastUDP("udp4", &iface, mdnsV4Addr); err == nil {
+			v4ConnList = append(v4ConnList, conn)
+			go m.readLoop(conn)
+		}
+		if ctrldnet.IPv6Available(context.Background()) {
+			if conn, err := net.ListenMulticastUDP("udp6", &iface, mdnsV6Addr); err == nil {
+				v6ConnList = append(v6ConnList, conn)
+				go m.readLoop(conn)
+			}
+		}
+	}
+
+	go m.probeLoop(v4ConnList, mdnsV4Addr, quitCh)
+	go m.probeLoop(v6ConnList, mdnsV6Addr, quitCh)
+
+	return nil
+}
+
+// probeLoop performs mdns probe actively to get hostname updates.
+func (m *mdns) probeLoop(conns []*net.UDPConn, remoteAddr net.Addr, quitCh chan struct{}) {
+	bo := backoff.NewBackoff("mdns probe", func(format string, args ...any) {}, time.Second*30)
+	for {
+		err := m.probe(conns, remoteAddr)
+		if isErrNetUnreachableOrInvalid(err) {
+			ctrld.ProxyLogger.Load().Warn().Msgf("stop probing %q: network unreachable or invalid", remoteAddr)
+			break
+		}
+		if err != nil {
+			ctrld.ProxyLogger.Load().Warn().Err(err).Msg("error while probing mdns")
+			bo.BackOff(context.Background(), errors.New("mdns probe backoff"))
+			continue
+		}
+		break
+	}
+	<-quitCh
+	for _, conn := range conns {
+		_ = conn.Close()
+	}
+}
+
+// readLoop reads from mdns connection, save/update any hostnames found.
+func (m *mdns) readLoop(conn *net.UDPConn) {
+	defer conn.Close()
+	buf := make([]byte, dns.MaxMsgSize)
+
+	for {
+		_ = conn.SetReadDeadline(time.Now().Add(time.Second * 30))
+		n, _, err := conn.ReadFromUDP(buf)
+		if err != nil {
+			if err, ok := err.(*net.OpError); ok && (err.Timeout() || err.Temporary()) {
+				continue
+			}
+			ctrld.ProxyLogger.Load().Debug().Err(err).Msg("mdns readLoop error")
+			return
+		}
+
+		var msg dns.Msg
+		if err := msg.Unpack(buf[:n]); err != nil {
+			continue
+		}
+
+		var ip, name string
+		rrs := make([]dns.RR, 0, len(msg.Answer)+len(msg.Extra))
+		rrs = append(rrs, msg.Answer...)
+		rrs = append(rrs, msg.Extra...)
+		for _, rr := range rrs {
+			switch ar := rr.(type) {
+			case *dns.A:
+				ip, name = ar.A.String(), ar.Hdr.Name
+			case *dns.AAAA:
+				ip, name = ar.AAAA.String(), ar.Hdr.Name
+			}
+			if ip != "" && name != "" {
+				name = normalizeHostname(name)
+				if val, loaded := m.name.LoadOrStore(ip, name); !loaded {
+					ctrld.ProxyLogger.Load().Debug().Msgf("found hostname: %q, ip: %q via mdns", name, ip)
+				} else {
+					old := val.(string)
+					if old != name {
+						ctrld.ProxyLogger.Load().Debug().Msgf("update hostname: %q, ip: %q, old: %q via mdns", name, ip, old)
+						m.name.Store(ip, name)
+					}
+				}
+				ip, name = "", ""
+			}
+		}
+	}
+}
+
+// probe performs mdns queries with known services.
+func (m *mdns) probe(conns []*net.UDPConn, remoteAddr net.Addr) error {
+	msg := new(dns.Msg)
+	msg.Question = make([]dns.Question, len(services))
+	msg.Compress = true
+	for i, service := range services {
+		msg.Question[i] = dns.Question{
+			Name:   dns.CanonicalName(service),
+			Qtype:  dns.TypePTR,
+			Qclass: dns.ClassINET,
+		}
+	}
+
+	buf, err := msg.Pack()
+	if err != nil {
+		return err
+	}
+	for _, conn := range conns {
+		_ = conn.SetWriteDeadline(time.Now().Add(time.Second * 30))
+		if _, werr := conn.WriteTo(buf, remoteAddr); werr != nil {
+			err = werr
+		}
+	}
+	return err
+}
+
+func multicastInterfaces() ([]net.Interface, error) {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+	interfaces := make([]net.Interface, 0, len(ifaces))
+	for _, ifi := range ifaces {
+		if (ifi.Flags & net.FlagUp) == 0 {
+			continue
+		}
+		if (ifi.Flags & net.FlagMulticast) > 0 {
+			interfaces = append(interfaces, ifi)
+		}
+	}
+	return interfaces, nil
+}
+
+func isErrNetUnreachableOrInvalid(err error) bool {
+	var se *os.SyscallError
+	if errors.As(err, &se) {
+		return se.Err == syscall.ENETUNREACH || se.Err == syscall.EINVAL
+	}
+	return false
+}

internal/clientinfo/mdns_services.go

@@ -0,0 +1,70 @@
+package clientinfo
+
+var services = [...]string{
+	// From: https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/
+	"_afpovertcp._tcp.local.",
+	"_airdroid._tcp.local.",
+	"_airdrop._tcp.local.",
+	"_airplay._tcp.local.",
+	"_airport._tcp.local.",
+	"_amzn-wplay._tcp.local.",
+	"_sub._apple-mobdev2._tcp.local.",
+	"_apple-mobdev2._tcp.local.",
+	"_apple-sasl._tcp.local.",
+	"_atc._tcp.local.",
+	"_sketchmirror._tcp.local.",
+	"_bp2p._tcp.local.",
+	"_Friendly._sub._bp2p._tcp.local.",
+	"_invoke._sub._bp2p._tcp.local.",
+	"_webdav._sub._bp2p._tcp.local.",
+	"_device-info._tcp.local.",
+	"_distcc._tcp.local.",
+	"_dpap._tcp.local.",
+	"_eppc._tcp.local.",
+	"_esdevice._tcp.local.",
+	"_esfileshare._tcp.local.",
+	"_ftp._tcp.local.",
+	"_googlecast._tcp.local.",
+	"_googlezone._tcp.local.",
+	"_hap._tcp.local.",
+	"_homekit._tcp.local.",
+	"_home-sharing._tcp.local.",
+	"_http._tcp.local.",
+	"_hudson._tcp.local.",
+	"_ica-networking._tcp.local.",
+	"_print._sub._ipp._tcp.local.",
+	"_cups._sub._ipps._tcp.local.",
+	"_print._sub._ipps._tcp.local.",
+	"_jenkins._tcp.local.",
+	"_KeynoteControl._tcp.local.",
+	"_keynotepair._tcp.local.",
+	"_mediaremotetv._tcp.local.",
+	"_nfs._tcp.local.",
+	"_nvstream._tcp.local.",
+	"_androidtvremote._tcp.local.",
+	"_omnistate._tcp.local.",
+	"_photoshopserver._tcp.local.",
+	"_printer._tcp.local.",
+	"_raop._tcp.local.",
+	"_readynas._tcp.local.",
+	"_rfb._tcp.local.",
+	"_physicalweb._tcp.local.",
+	"_rsp._tcp.local.",
+	"_scanner._tcp.local.",
+	"_sftp-ssh._tcp.local.",
+	"_sleep-proxy._udp.local.",
+	"_smb._tcp.local.",
+	"_spotify-connect._tcp.local.",
+	"_ssh._tcp.local.",
+	"_teamviewer._tcp.local.",
+	"_telnet._tcp.local.",
+	"_touch-able._tcp.local.",
+	"_tunnel._tcp.local.",
+	"_webdav._tcp.local.",
+	"_webdav._tcp.local.",
+	"_workstation._tcp.local.",
+	"_xserveraid._tcp.local.",
+
+	// Merlin
+	"_alexa._tcp",
+}

internal/clientinfo/merlin.go

@@ -0,0 +1,71 @@
+package clientinfo
+
+import (
+	"strings"
+	"sync"
+
+	"github.com/Control-D-Inc/ctrld/internal/router"
+	"github.com/Control-D-Inc/ctrld/internal/router/merlin"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/Control-D-Inc/ctrld/internal/router/nvram"
+)
+
+const merlinNvramCustomClientListKey = "custom_clientlist"
+
+type merlinDiscover struct {
+	hostname sync.Map // mac => hostname
+}
+
+func (m *merlinDiscover) refresh() error {
+	if router.Name() != merlin.Name {
+		return nil
+	}
+	out, err := nvram.Run("get", merlinNvramCustomClientListKey)
+	if err != nil {
+		return err
+	}
+	ctrld.ProxyLogger.Load().Debug().Msg("reading Merlin custom client list")
+	m.parseMerlinCustomClientList(out)
+	return nil
+}
+
+func (m *merlinDiscover) LookupHostnameByIP(ip string) string {
+	return ""
+}
+
+func (m *merlinDiscover) LookupHostnameByMac(mac string) string {
+	val, ok := m.hostname.Load(mac)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+// "nvram get custom_clientlist" output:
+//
+// <client 1>00:00:00:00:00:01>0>4>><client 2>00:00:00:00:00:02>0>24>>...
+//
+// So to parse it, do the following steps:
+//
+//   - Split by "<"                 => entries
+//   - For each entry, split by ">" => parts
+//   - Empty parts                  => skip
+//   - Empty parts[0]               => skip empty hostname
+//   - Empty parts[1]               => skip empty MAC
+func (m *merlinDiscover) parseMerlinCustomClientList(data string) {
+	entries := strings.Split(data, "<")
+	for _, entry := range entries {
+		parts := strings.SplitN(string(entry), ">", 3)
+		if len(parts) < 2 || len(parts[0]) == 0 || len(parts[1]) == 0 {
+			continue
+		}
+		hostname := normalizeHostname(parts[0])
+		mac := strings.ToLower(parts[1])
+		m.hostname.Store(mac, hostname)
+	}
+}
+
+func (m *merlinDiscover) String() string {
+	return "merlin"
+}

internal/clientinfo/merlin_test.go

@@ -0,0 +1,82 @@
+package clientinfo
+
+import (
+	"testing"
+)
+
+func TestParseMerlinCustomClientList(t *testing.T) {
+	tests := []struct {
+		name              string
+		clientList        string
+		macList           []string
+		hostnameList      []string
+		macNotPresentList []string
+	}{
+		{
+			"normal",
+			"<client1>00:00:00:00:00:01>0>4>>",
+			[]string{"00:00:00:00:00:01"},
+			[]string{"client1"},
+			nil,
+		},
+		{
+			"multiple clients",
+			"<client1>00:00:00:00:00:01>0>4>><client2>00:00:00:00:00:02>0>24>>",
+			[]string{"00:00:00:00:00:01", "00:00:00:00:00:02"},
+			[]string{"client1", "client2"},
+			nil,
+		},
+		{
+			"empty hostname",
+			"<client1>00:00:00:00:00:01>0>4>><>00:00:00:00:00:02>0>24>>",
+			[]string{"00:00:00:00:00:01"},
+			[]string{"client1"},
+			[]string{"00:00:00:00:00:02"},
+		},
+		{
+			"empty dhcp",
+			"<client1>00:00:00:00:00:01>0>4>><client 1>>>",
+			[]string{"00:00:00:00:00:01"},
+			[]string{"client1"},
+			[]string{""},
+		},
+		{
+			"invalid",
+			"qwerty",
+			nil,
+			nil,
+			nil,
+		},
+		{
+			"empty",
+			"",
+
+			nil,
+			nil,
+			nil,
+		},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			m := &merlinDiscover{}
+			m.parseMerlinCustomClientList(tc.clientList)
+			for i, mac := range tc.macList {
+				val, ok := m.hostname.Load(mac)
+				if !ok {
+					t.Errorf("missing hostname: %s", mac)
+				}
+				hostname := val.(string)
+				if hostname != tc.hostnameList[i] {
+					t.Errorf("hostname mismatch, want: %q, got: %q", tc.hostnameList[i], hostname)
+				}
+			}
+			for _, mac := range tc.macNotPresentList {
+				if _, ok := m.hostname.Load(mac); ok {
+					t.Errorf("mac2name address %q should not be present", mac)
+				}
+			}
+		})
+	}
+}

internal/clientinfo/ptr_lookup.go

@@ -0,0 +1,116 @@
+package clientinfo
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/miekg/dns"
+	"tailscale.com/logtail/backoff"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+type ptrDiscover struct {
+	hostname   sync.Map // ip => hostname
+	resolver   ctrld.Resolver
+	serverDown atomic.Bool
+}
+
+func (p *ptrDiscover) refresh() error {
+	p.hostname.Range(func(key, value any) bool {
+		ip := key.(string)
+		if name := p.lookupHostname(ip); name != "" {
+			p.hostname.Store(ip, name)
+		}
+		return true
+	})
+	return nil
+}
+
+func (p *ptrDiscover) LookupHostnameByIP(ip string) string {
+	if val, ok := p.hostname.Load(ip); ok {
+		return val.(string)
+	}
+	return p.lookupHostname(ip)
+}
+func (p *ptrDiscover) LookupHostnameByMac(mac string) string {
+	return ""
+}
+
+func (p *ptrDiscover) String() string {
+	return "ptr"
+}
+
+func (p *ptrDiscover) List() []string {
+	if p == nil {
+		return nil
+	}
+	var ips []string
+	p.hostname.Range(func(key, value any) bool {
+		ips = append(ips, key.(string))
+		return true
+	})
+	return ips
+}
+
+func (p *ptrDiscover) lookupHostnameFromCache(ip string) string {
+	if val, ok := p.hostname.Load(ip); ok {
+		return val.(string)
+	}
+	return ""
+}
+
+func (p *ptrDiscover) lookupHostname(ip string) string {
+	// If nameserver is down, do nothing.
+	if p.serverDown.Load() {
+		return ""
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	msg := new(dns.Msg)
+	addr, err := dns.ReverseAddr(ip)
+	if err != nil {
+		ctrld.ProxyLogger.Load().Warn().Str("discovery", "ptr").Err(err).Msg("invalid ip address")
+		return ""
+	}
+	msg.SetQuestion(addr, dns.TypePTR)
+	ans, err := p.resolver.Resolve(ctx, msg)
+	if err != nil {
+		ctrld.ProxyLogger.Load().Warn().Str("discovery", "ptr").Err(err).Msg("could not perform PTR lookup")
+		p.serverDown.Store(true)
+		go p.checkServer()
+		return ""
+	}
+	for _, rr := range ans.Answer {
+		if ptr, ok := rr.(*dns.PTR); ok {
+			hostname := normalizeHostname(ptr.Ptr)
+			p.hostname.Store(ip, hostname)
+			return hostname
+		}
+	}
+	return ""
+}
+
+// checkServer monitors if the resolver can reach its nameserver. When the nameserver
+// is reachable, set p.serverDown to false, so p.lookupHostname can continue working.
+func (p *ptrDiscover) checkServer() {
+	bo := backoff.NewBackoff("ptrDiscover", func(format string, args ...any) {}, time.Minute*5)
+	m := new(dns.Msg)
+	m.SetQuestion(".", dns.TypeNS)
+	ping := func() error {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_, err := p.resolver.Resolve(ctx, m)
+		return err
+	}
+	for {
+		if err := ping(); err != nil {
+			bo.BackOff(context.Background(), err)
+			continue
+		}
+		break
+	}
+	p.serverDown.Store(false)
+}

internal/clientinfo/virtual_iface.go

@@ -0,0 +1,43 @@
+package clientinfo
+
+import (
+	"sync"
+)
+
+// virtualNetworkIface is the manager for clients from virtual network interface.
+type virtualNetworkIface struct {
+	ip2name sync.Map // ip  => name
+	mac     sync.Map // ip  => mac
+}
+
+// LookupHostnameByIP returns hostname of the given VPN client ip.
+func (v *virtualNetworkIface) LookupHostnameByIP(ip string) string {
+	val, ok := v.ip2name.Load(ip)
+	if !ok {
+		return ""
+	}
+	return val.(string)
+}
+
+// LookupHostnameByMac always returns empty string.
+func (v *virtualNetworkIface) LookupHostnameByMac(mac string) string {
+	return ""
+}
+
+// String returns the string representation of virtualNetworkIface struct.
+func (v *virtualNetworkIface) String() string {
+	return ""
+}
+
+// List lists all known VPN clients IP.
+func (v *virtualNetworkIface) List() []string {
+	if v == nil {
+		return nil
+	}
+	var ips []string
+	v.mac.Range(func(key, value any) bool {
+		ips = append(ips, key.(string))
+		return true
+	})
+	return ips
+}

internal/controld/config.go

@@ -6,20 +6,26 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
+	"os"
+	"strings"
 	"time"
 
 	"github.com/Control-D-Inc/ctrld"
 	"github.com/Control-D-Inc/ctrld/internal/certs"
 	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
 	"github.com/Control-D-Inc/ctrld/internal/router"
+	"github.com/Control-D-Inc/ctrld/internal/router/ddwrt"
 )
 
 const (
-	apiDomain         = "api.controld.com"
-	resolverDataURL   = "https://api.controld.com/utility"
-	InvalidConfigCode = 40401
+	apiDomainCom       = "api.controld.com"
+	apiDomainDev       = "api.controld.dev"
+	resolverDataURLCom = "https://api.controld.com/utility"
+	resolverDataURLDev = "https://api.controld.dev/utility"
+	InvalidConfigCode  = 40401
 )
 
 // ResolverConfig represents Control D resolver data.
@@ -29,6 +35,7 @@ type ResolverConfig struct {
 		CustomConfig string `json:"custom_config"`
 	} `json:"ctrld"`
 	Exclude []string `json:"exclude"`
+	UID     string   `json:"uid"`
 }
 
 type utilityResponse struct {
@@ -50,13 +57,39 @@ func (u UtilityErrorResponse) Error() string {
 }
 
 type utilityRequest struct {
-	UID string `json:"uid"`
+	UID      string `json:"uid"`
+	ClientID string `json:"client_id,omitempty"`
+}
+
+type utilityOrgRequest struct {
+	ProvToken string `json:"prov_token"`
+	Hostname  string `json:"hostname"`
 }
 
 // FetchResolverConfig fetch Control D config for given uid.
-func FetchResolverConfig(uid, version string) (*ResolverConfig, error) {
-	body, _ := json.Marshal(utilityRequest{UID: uid})
-	req, err := http.NewRequest("POST", resolverDataURL, bytes.NewReader(body))
+func FetchResolverConfig(rawUID, version string, cdDev bool) (*ResolverConfig, error) {
+	uid, clientID := ParseRawUID(rawUID)
+	req := utilityRequest{UID: uid}
+	if clientID != "" {
+		req.ClientID = clientID
+	}
+	body, _ := json.Marshal(req)
+	return postUtilityAPI(version, cdDev, bytes.NewReader(body))
+}
+
+// FetchResolverUID fetch resolver uid from provision token.
+func FetchResolverUID(pt, version string, cdDev bool) (*ResolverConfig, error) {
+	hostname, _ := os.Hostname()
+	body, _ := json.Marshal(utilityOrgRequest{ProvToken: pt, Hostname: hostname})
+	return postUtilityAPI(version, cdDev, bytes.NewReader(body))
+}
+
+func postUtilityAPI(version string, cdDev bool, body io.Reader) (*ResolverConfig, error) {
+	apiUrl := resolverDataURLCom
+	if cdDev {
+		apiUrl = resolverDataURLDev
+	}
+	req, err := http.NewRequest("POST", apiUrl, body)
 	if err != nil {
 		return nil, fmt.Errorf("http.NewRequest: %w", err)
 	}
@@ -67,12 +100,16 @@ func FetchResolverConfig(uid, version string) (*ResolverConfig, error) {
 	req.Header.Add("Content-Type", "application/json")
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	transport.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		apiDomain := apiDomainCom
+		if cdDev {
+			apiDomain = apiDomainDev
+		}
 		ips := ctrld.LookupIP(apiDomain)
 		if len(ips) == 0 {
-			ctrld.ProxyLog.Warn().Msgf("No IPs found for %s, connecting to %s", apiDomain, addr)
+			ctrld.ProxyLogger.Load().Warn().Msgf("No IPs found for %s, connecting to %s", apiDomain, addr)
 			return ctrldnet.Dialer.DialContext(ctx, network, addr)
 		}
-		ctrld.ProxyLog.Debug().Msgf("API IPs: %v", ips)
+		ctrld.ProxyLogger.Load().Debug().Msgf("API IPs: %v", ips)
 		_, port, _ := net.SplitHostPort(addr)
 		addrs := make([]string, len(ips))
 		for i := range ips {
@@ -82,7 +119,7 @@ func FetchResolverConfig(uid, version string) (*ResolverConfig, error) {
 		return d.DialContext(ctx, network, addrs)
 	}
 
-	if router.Name() == router.DDWrt {
+	if router.Name() == ddwrt.Name {
 		transport.TLSClientConfig = &tls.Config{RootCAs: certs.CACertPool()}
 	}
 	client := http.Client{
@@ -109,3 +146,13 @@ func FetchResolverConfig(uid, version string) (*ResolverConfig, error) {
 	}
 	return &ur.Body.Resolver, nil
 }
+
+// ParseRawUID parse the input raw UID, returning real UID and ClientID.
+// The raw UID can have 2 forms:
+//
+// - <uid>
+// - <uid>/<client_id>
+func ParseRawUID(rawUID string) (string, string) {
+	uid, clientID, _ := strings.Cut(rawUID, "/")
+	return uid, clientID
+}

internal/controld/config_test.go

@@ -1,32 +1,31 @@
-//go:build controld
-
 package controld
 
 import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
-func TestFetchResolverConfig(t *testing.T) {
+func Test_parseUID(t *testing.T) {
 	tests := []struct {
-		name    string
-		uid     string
-		wantErr bool
+		name         string
+		uid          string
+		wantUID      string
+		wantClientID string
 	}{
-		{"valid", "p2", false},
-		{"invalid uid", "abcd1234", true},
+		{"empty", "", "", ""},
+		{"only uid", "abcd1234", "abcd1234", ""},
+		{"with client id", "abcd1234/clientID", "abcd1234", "clientID"},
+		{"with empty clientID", "abcd1234/", "abcd1234", ""},
 	}
+
 	for _, tc := range tests {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			got, err := FetchResolverConfig(tc.uid, "dev-test")
-			require.False(t, (err != nil) != tc.wantErr, err)
-			if !tc.wantErr {
-				assert.NotEmpty(t, got.DOH)
-			}
+			gotUID, gotClientID := ParseRawUID(tc.uid)
+			assert.Equal(t, tc.wantUID, gotUID)
+			assert.Equal(t, tc.wantClientID, gotClientID)
 		})
 	}
 }

internal/controld/controld_test.go

@@ -0,0 +1,34 @@
+//go:build controld
+
+package controld
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFetchResolverConfig(t *testing.T) {
+	tests := []struct {
+		name    string
+		uid     string
+		dev     bool
+		wantErr bool
+	}{
+		{"valid com", "p2", false, false},
+		{"valid dev", "p2", true, false},
+		{"invalid uid", "abcd1234", false, true},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := FetchResolverConfig(tc.uid, "dev-test", tc.dev)
+			require.False(t, (err != nil) != tc.wantErr, err)
+			if !tc.wantErr {
+				assert.NotEmpty(t, got.DOH)
+			}
+		})
+	}
+}

internal/dns/direct.go

@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//lint:file-ignore U1000 satisfy CI.
+//lint:file-ignore U1000 Ignore, this file is forked from upstream code.
+//lint:file-ignore ST1005 Ignore, this file is forked from upstream code.
 
 package dns
 

internal/dns/manager_linux.go

@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//lint:file-ignore U1000 Ignore this file, it's a copy.
+
 package dns
 
 import (

internal/dns/nm.go

@@ -267,5 +267,5 @@ func (m *nmManager) Close() error {
 }
 
 func (m *nmManager) Mode() string {
-	return "network-maanger"
+	return "network-manager"
 }

internal/net/net.go

@@ -4,8 +4,11 @@ import (
 	"context"
 	"errors"
 	"net"
+	"os"
+	"os/signal"
 	"sync"
 	"sync/atomic"
+	"syscall"
 	"time"
 
 	"tailscale.com/logtail/backoff"
@@ -13,17 +16,17 @@ import (
 
 const (
 	controldIPv6Test = "ipv6.controld.io"
-	bootstrapDNS     = "76.76.2.0:53"
+	v4BootstrapDNS   = "76.76.2.0:53"
+	v6BootstrapDNS   = "[2606:1a40::]:53"
 )
 
 var Dialer = &net.Dialer{
 	Resolver: &net.Resolver{
 		PreferGo: true,
 		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-			d := net.Dialer{
-				Timeout: 10 * time.Second,
-			}
-			return d.DialContext(ctx, "udp", bootstrapDNS)
+			d := ParallelDialer{}
+			d.Timeout = 10 * time.Second
+			return d.DialContext(ctx, "udp", []string{v4BootstrapDNS, v6BootstrapDNS})
 		},
 	},
 }
@@ -59,14 +62,32 @@ func supportListenIPv6Local() bool {
 }
 
 func probeStack() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	go func() {
+		sigs := make(chan os.Signal, 1)
+		signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
+		<-sigs
+		cancel()
+	}()
+
 	b := backoff.NewBackoff("probeStack", func(format string, args ...any) {}, 5*time.Second)
 	for {
-		if _, err := probeStackDialer.Dial("udp", bootstrapDNS); err == nil {
+		if _, err := probeStackDialer.DialContext(ctx, "udp", v4BootstrapDNS); err == nil {
 			hasNetworkUp = true
 			break
-		} else {
-			b.BackOff(context.Background(), err)
 		}
+		if _, err := probeStackDialer.DialContext(ctx, "udp", v6BootstrapDNS); err == nil {
+			hasNetworkUp = true
+			break
+		}
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+		b.BackOff(context.Background(), errors.New("network is down"))
 	}
 	canListenIPv6Local = supportListenIPv6Local()
 }
@@ -110,6 +131,8 @@ func (d *ParallelDialer) DialContext(ctx context.Context, network string, addrs
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	done := make(chan struct{})
+	defer close(done)
 	ch := make(chan *parallelDialerResult, len(addrs))
 	var wg sync.WaitGroup
 	wg.Add(len(addrs))
@@ -122,7 +145,13 @@ func (d *ParallelDialer) DialContext(ctx context.Context, network string, addrs
 		go func(addr string) {
 			defer wg.Done()
 			conn, err := d.Dialer.DialContext(ctx, network, addr)
-			ch <- &parallelDialerResult{conn: conn, err: err}
+			select {
+			case ch <- &parallelDialerResult{conn: conn, err: err}:
+			case <-done:
+				if conn != nil {
+					conn.Close()
+				}
+			}
 		}(addr)
 	}
 
@@ -134,6 +163,5 @@ func (d *ParallelDialer) DialContext(ctx context.Context, network string, addrs
 		}
 		errs = append(errs, res.err)
 	}
-
 	return nil, errors.Join(errs...)
 }

internal/router/client_info.go

@@ -1,121 +0,0 @@
-package router
-
-import (
-	"bytes"
-	"io"
-	"log"
-	"net"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/fsnotify/fsnotify"
-	"tailscale.com/util/lineread"
-
-	"github.com/Control-D-Inc/ctrld"
-)
-
-var clientInfoFiles = []string{
-	"/tmp/dnsmasq.leases",                  // ddwrt
-	"/tmp/dhcp.leases",                     // openwrt
-	"/var/lib/misc/dnsmasq.leases",         // merlin
-	"/mnt/data/udapi-config/dnsmasq.lease", // UDM Pro
-	"/data/udapi-config/dnsmasq.lease",     // UDR
-}
-
-func (r *router) watchClientInfoTable() {
-	if r.watcher == nil {
-		return
-	}
-	timer := time.NewTicker(time.Minute * 5)
-	for {
-		select {
-		case <-timer.C:
-			for _, name := range r.watcher.WatchList() {
-				_ = readClientInfoFile(name)
-			}
-		case event, ok := <-r.watcher.Events:
-			if !ok {
-				return
-			}
-			if event.Has(fsnotify.Write) {
-				if err := readClientInfoFile(event.Name); err != nil && !os.IsNotExist(err) {
-					log.Println("could not read client info file:", err)
-				}
-			}
-		case err, ok := <-r.watcher.Errors:
-			if !ok {
-				return
-			}
-			log.Println("error:", err)
-		}
-	}
-}
-
-func Stop() error {
-	if Name() == "" {
-		return nil
-	}
-	r := routerPlatform.Load()
-	if r.watcher != nil {
-		if err := r.watcher.Close(); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func GetClientInfoByMac(mac string) *ctrld.ClientInfo {
-	if mac == "" {
-		return nil
-	}
-	_ = Name()
-	r := routerPlatform.Load()
-	val, ok := r.mac.Load(mac)
-	if !ok {
-		return nil
-	}
-	return val.(*ctrld.ClientInfo)
-}
-
-func readClientInfoFile(name string) error {
-	f, err := os.Open(name)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	return readClientInfoReader(f)
-
-}
-
-func readClientInfoReader(reader io.Reader) error {
-	r := routerPlatform.Load()
-	return lineread.Reader(reader, func(line []byte) error {
-		fields := bytes.Fields(line)
-		if len(fields) != 5 {
-			return nil
-		}
-		mac := string(fields[1])
-		if _, err := net.ParseMAC(mac); err != nil {
-			// The second field is not a mac, skip.
-			return nil
-		}
-		ip := normalizeIP(string(fields[2]))
-		if net.ParseIP(ip) == nil {
-			log.Printf("invalid ip address entry: %q", ip)
-			ip = ""
-		}
-		hostname := string(fields[3])
-		r.mac.Store(mac, &ctrld.ClientInfo{Mac: mac, IP: ip, Hostname: hostname})
-		return nil
-	})
-}
-
-func normalizeIP(in string) string {
-	// dnsmasq may put ip with interface index in lease file, strip it here.
-	ip, _, found := strings.Cut(in, "%")
-	if found {
-		return ip
-	}
-	return in
-}

internal/router/client_info_test.go

@@ -1,70 +0,0 @@
-package router
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/Control-D-Inc/ctrld"
-)
-
-func Test_normalizeIP(t *testing.T) {
-	tests := []struct {
-		name string
-		in   string
-		want string
-	}{
-		{"v4", "127.0.0.1", "127.0.0.1"},
-		{"v4 with index", "127.0.0.1%lo", "127.0.0.1"},
-		{"v6", "fe80::1", "fe80::1"},
-		{"v6 with index", "fe80::1%22002", "fe80::1"},
-	}
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			if got := normalizeIP(tc.in); got != tc.want {
-				t.Errorf("normalizeIP() = %v, want %v", got, tc.want)
-			}
-		})
-	}
-}
-
-func Test_readClientInfoReader(t *testing.T) {
-	tests := []struct {
-		name string
-		in   string
-		mac  string
-	}{
-		{
-			"good",
-			`1683329857 e6:20:59:b8:c1:6d 192.168.1.186 * 01:e6:20:59:b8:c1:6d
-`,
-			"e6:20:59:b8:c1:6d",
-		},
-		{
-			"bad seen on UDMdream machine",
-			`1683329857 e6:20:59:b8:c1:6e 192.168.1.111 * 01:e6:20:59:b8:c1:6e
-duid 00:01:00:01:2b:e4:2e:2c:52:52:14:26:dc:1c
-1683322985 117442354 2600:4040:b0e6:b700::111 ASDASD 00:01:00:01:2a:d0:b9:81:00:07:32:4c:1c:07
-`,
-			"e6:20:59:b8:c1:6e",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			r := routerPlatform.Load()
-			r.mac.Delete(tc.mac)
-			if err := readClientInfoReader(strings.NewReader(tc.in)); err != nil {
-				t.Errorf("readClientInfoReader() error = %v", err)
-			}
-			info, existed := r.mac.Load(tc.mac)
-			if !existed {
-				t.Error("client info missing")
-			}
-			if ci, ok := info.(*ctrld.ClientInfo); ok && existed && ci.Mac != tc.mac {
-				t.Errorf("mac mismatched, got: %q, want: %q", ci.Mac, tc.mac)
-			}
-		})
-	}
-}

internal/router/ddwrt.go

@@ -1,71 +0,0 @@
-package router
-
-import (
-	"errors"
-	"fmt"
-	"os/exec"
-)
-
-const (
-	nvramCtrldKeyPrefix = "ctrld_"
-	nvramCtrldSetupKey  = "ctrld_setup"
-	nvramRCStartupKey   = "rc_startup"
-)
-
-//lint:ignore ST1005 This error is for human.
-var errDdwrtJffs2NotEnabled = errors.New(`could not install service without jffs, follow this guide to enable:
-
-https://wiki.dd-wrt.com/wiki/index.php/Journalling_Flash_File_System
-`)
-
-func setupDDWrt() error {
-	// Already setup.
-	if val, _ := nvram("get", nvramCtrldSetupKey); val == "1" {
-		return nil
-	}
-
-	data, err := dnsMasqConf()
-	if err != nil {
-		return err
-	}
-
-	nvramKvMap := nvramKV()
-	nvramKvMap["dnsmasq_options"] = data
-	if err := nvramSetup(nvramKvMap); err != nil {
-		return err
-	}
-
-	// Restart dnsmasq service.
-	if err := ddwrtRestartDNSMasq(); err != nil {
-		return err
-	}
-	return nil
-}
-
-func cleanupDDWrt() error {
-	// Restore old configs.
-	if err := nvramRestore(nvramKV()); err != nil {
-		return err
-	}
-	// Restart dnsmasq service.
-	if err := ddwrtRestartDNSMasq(); err != nil {
-		return err
-	}
-	return nil
-}
-
-func postInstallDDWrt() error {
-	return nil
-}
-
-func ddwrtRestartDNSMasq() error {
-	if out, err := exec.Command("restart_dns").CombinedOutput(); err != nil {
-		return fmt.Errorf("restart_dns: %s, %w", string(out), err)
-	}
-	return nil
-}
-
-func ddwrtJff2Enabled() bool {
-	out, _ := nvram("get", "enable_jffs2")
-	return out == "1"
-}

internal/router/ddwrt/ddwrt.go

@@ -0,0 +1,117 @@
+package ddwrt
+
+import (
+	"errors"
+	"fmt"
+	"os/exec"
+
+	"github.com/kardianos/service"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/Control-D-Inc/ctrld/internal/router/dnsmasq"
+	"github.com/Control-D-Inc/ctrld/internal/router/ntp"
+	"github.com/Control-D-Inc/ctrld/internal/router/nvram"
+)
+
+const Name = "ddwrt"
+
+//lint:ignore ST1005 This error is for human.
+var errDdwrtJffs2NotEnabled = errors.New(`could not install service without jffs, follow this guide to enable:
+
+https://wiki.dd-wrt.com/wiki/index.php/Journalling_Flash_File_System
+`)
+
+var nvramKvMap = map[string]string{
+	"dns_dnsmasq":     "1", // Make dnsmasq running but disable DNS ability, ctrld will replace it.
+	"dnsmasq_options": "",  // Configuration of dnsmasq set by ctrld, filled by setupDDWrt.
+	"dns_crypt":       "0", // Disable DNSCrypt.
+	"dnssec":          "0", // Disable DNSSEC.
+}
+
+type Ddwrt struct {
+	cfg *ctrld.Config
+}
+
+// New returns a router.Router for configuring/setup/run ctrld on ddwrt routers.
+func New(cfg *ctrld.Config) *Ddwrt {
+	return &Ddwrt{cfg: cfg}
+}
+
+func (d *Ddwrt) ConfigureService(config *service.Config) error {
+	if !ddwrtJff2Enabled() {
+		return errDdwrtJffs2NotEnabled
+	}
+	return nil
+}
+
+func (d *Ddwrt) Install(_ *service.Config) error {
+	return nil
+}
+
+func (d *Ddwrt) Uninstall(_ *service.Config) error {
+	return nil
+}
+
+func (d *Ddwrt) PreRun() error {
+	_ = d.Cleanup()
+	return ntp.WaitNvram()
+}
+
+func (d *Ddwrt) Setup() error {
+	if d.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	// Already setup.
+	if val, _ := nvram.Run("get", nvram.CtrldSetupKey); val == "1" {
+		return nil
+	}
+
+	data, err := dnsmasq.ConfTmpl(dnsmasq.ConfigContentTmpl, d.cfg)
+	if err != nil {
+		return err
+	}
+
+	nvramKvMap["dnsmasq_options"] = data
+	if err := nvram.SetKV(nvramKvMap, nvram.CtrldSetupKey); err != nil {
+		return err
+	}
+
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (d *Ddwrt) Cleanup() error {
+	if d.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	if val, _ := nvram.Run("get", nvram.CtrldSetupKey); val != "1" {
+		return nil // was restored, nothing to do.
+	}
+
+	nvramKvMap["dnsmasq_options"] = ""
+	// Restore old configs.
+	if err := nvram.Restore(nvramKvMap, nvram.CtrldSetupKey); err != nil {
+		return err
+	}
+
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func restartDNSMasq() error {
+	if out, err := exec.Command("restart_dns").CombinedOutput(); err != nil {
+		return fmt.Errorf("restart_dns: %s, %w", string(out), err)
+	}
+	return nil
+}
+
+func ddwrtJff2Enabled() bool {
+	out, _ := nvram.Run("get", "enable_jffs2")
+	return out == "1"
+}

internal/router/dnsmasq.go

@@ -1,67 +0,0 @@
-package router
-
-import (
-	"strings"
-	"text/template"
-)
-
-const dnsMasqConfigContentTmpl = `# GENERATED BY ctrld - DO NOT MODIFY
-no-resolv
-server=127.0.0.1#5354
-{{- if .SendClientInfo}}
-add-mac
-{{- end}}
-`
-
-const merlinDNSMasqPostConfPath = "/jffs/scripts/dnsmasq.postconf"
-const merlinDNSMasqPostConfMarker = `# GENERATED BY ctrld - EOF`
-
-const merlinDNSMasqPostConfTmpl = `# GENERATED BY ctrld - DO NOT MODIFY
-
-#!/bin/sh
-
-config_file="$1"
-. /usr/sbin/helper.sh
-
-pid=$(cat /tmp/ctrld.pid 2>/dev/null)
-if [ -n "$pid" ] && [ -f "/proc/${pid}/cmdline" ]; then
-  pc_delete "servers-file" "$config_file"           # no WAN DNS settings
-  pc_append "no-resolv" "$config_file"              # do not read /etc/resolv.conf
-  pc_append "server=127.0.0.1#5354" "$config_file"  # use ctrld as upstream
-  {{- if .SendClientInfo}}
-  pc_append "add-mac" "$config_file"                # add client mac
-  {{- end}}
-  pc_delete "dnssec" "$config_file"                 # disable DNSSEC
-  pc_delete "trust-anchor=" "$config_file"          # disable DNSSEC
-	
-  # For John fork
-  pc_delete "resolv-file" "$config_file"            # no WAN DNS settings
-
-  # Change /etc/resolv.conf, which may be changed by WAN DNS setup
-  pc_delete "nameserver" /etc/resolv.conf
-  pc_append "nameserver 127.0.0.1" /etc/resolv.conf
-
-  exit 0
-fi
-`
-
-func dnsMasqConf() (string, error) {
-	var sb strings.Builder
-	var tmplText string
-	switch Name() {
-	case DDWrt, OpenWrt, Ubios:
-		tmplText = dnsMasqConfigContentTmpl
-	case Merlin:
-		tmplText = merlinDNSMasqPostConfTmpl
-	}
-	tmpl := template.Must(template.New("").Parse(tmplText))
-	var to = &struct {
-		SendClientInfo bool
-	}{
-		routerPlatform.Load().sendClientInfo,
-	}
-	if err := tmpl.Execute(&sb, to); err != nil {
-		return "", err
-	}
-	return sb.String(), nil
-}

internal/router/dnsmasq/conf.go

@@ -0,0 +1,30 @@
+package dnsmasq
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"strings"
+)
+
+func InterfaceNameFromConfig(filename string) (string, error) {
+	buf, err := os.ReadFile(filename)
+	if err != nil {
+		return "", err
+	}
+	return interfaceNameFromReader(bytes.NewReader(buf))
+}
+
+func interfaceNameFromReader(r io.Reader) (string, error) {
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		line := scanner.Text()
+		after, found := strings.CutPrefix(line, "interface=")
+		if found {
+			return after, nil
+		}
+	}
+	return "", errors.New("not found")
+}

internal/router/dnsmasq/conf_test.go

@@ -0,0 +1,46 @@
+package dnsmasq
+
+import (
+	"strings"
+	"testing"
+)
+
+func Test_interfaceNameFromReader(t *testing.T) {
+	tests := []struct {
+		name      string
+		in        string
+		wantIface string
+	}{
+		{
+			"good",
+			`interface=lo`,
+			"lo",
+		},
+		{
+			"multiple",
+			`interface=lo
+interface=eth0
+`,
+			"lo",
+		},
+		{
+			"no iface",
+			`cache-size=100`,
+			"",
+		},
+	}
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			ifaceName, err := interfaceNameFromReader(strings.NewReader(tc.in))
+			if tc.wantIface != "" && err != nil {
+				t.Errorf("unexpected error: %v", err)
+				return
+			}
+			if tc.wantIface != ifaceName {
+				t.Errorf("mismatched, want: %q, got: %q", tc.wantIface, ifaceName)
+			}
+		})
+	}
+}

internal/router/dnsmasq/dnsmasq.go

@@ -0,0 +1,135 @@
+package dnsmasq
+
+import (
+	"errors"
+	"html/template"
+	"net"
+	"path/filepath"
+	"strings"
+
+	"github.com/Control-D-Inc/ctrld"
+)
+
+const ConfigContentTmpl = `# GENERATED BY ctrld - DO NOT MODIFY
+no-resolv
+{{- range .Upstreams}}
+server={{ .IP }}#{{ .Port }}
+{{- end}}
+{{- if .SendClientInfo}}
+add-mac
+add-subnet=32,128
+{{- end}}
+`
+
+const MerlinPostConfPath = "/jffs/scripts/dnsmasq.postconf"
+const MerlinPostConfMarker = `# GENERATED BY ctrld - EOF`
+const MerlinPostConfTmpl = `# GENERATED BY ctrld - DO NOT MODIFY
+
+#!/bin/sh
+
+config_file="$1"
+. /usr/sbin/helper.sh
+
+pid=$(cat /tmp/ctrld.pid 2>/dev/null)
+if [ -n "$pid" ] && [ -f "/proc/${pid}/cmdline" ]; then
+  pc_delete "servers-file" "$config_file"           # no WAN DNS settings
+  pc_append "no-resolv" "$config_file"              # do not read /etc/resolv.conf
+  # use ctrld as upstream
+  pc_delete "server=" "$config_file"
+  {{- range .Upstreams}}
+  pc_append "server={{ .IP }}#{{ .Port }}" "$config_file"
+  {{- end}}
+  {{- if .SendClientInfo}}
+  pc_delete "add-mac" "$config_file"
+  pc_delete "add-subnet" "$config_file"
+  pc_append "add-mac" "$config_file"                # add client mac
+  pc_append "add-subnet=32,128" "$config_file"      # add client ip
+  {{- end}}
+  pc_delete "dnssec" "$config_file"                 # disable DNSSEC
+  pc_delete "trust-anchor=" "$config_file"          # disable DNSSEC
+	
+  # For John fork
+  pc_delete "resolv-file" "$config_file"            # no WAN DNS settings
+
+  # Change /etc/resolv.conf, which may be changed by WAN DNS setup
+  pc_delete "nameserver" /etc/resolv.conf
+  pc_append "nameserver 127.0.0.1" /etc/resolv.conf
+
+  exit 0
+fi
+`
+
+type Upstream struct {
+	IP   string
+	Port int
+}
+
+func ConfTmpl(tmplText string, cfg *ctrld.Config) (string, error) {
+	listener := cfg.FirstListener()
+	if listener == nil {
+		return "", errors.New("missing listener")
+	}
+	ip := listener.IP
+	if ip == "0.0.0.0" || ip == "::" || ip == "" {
+		ip = "127.0.0.1"
+	}
+	upstreams := []Upstream{{IP: ip, Port: listener.Port}}
+	return confTmpl(tmplText, upstreams, cfg.HasUpstreamSendClientInfo())
+}
+
+func FirewallaConfTmpl(tmplText string, cfg *ctrld.Config) (string, error) {
+	if lc := cfg.FirstListener(); lc != nil && (lc.IP == "0.0.0.0" || lc.IP == "") {
+		return confTmpl(tmplText, firewallaUpstreams(lc.Port), cfg.HasUpstreamSendClientInfo())
+	}
+	return ConfTmpl(tmplText, cfg)
+}
+
+func confTmpl(tmplText string, upstreams []Upstream, sendClientInfo bool) (string, error) {
+	tmpl := template.Must(template.New("").Parse(tmplText))
+	var to = &struct {
+		SendClientInfo bool
+		Upstreams      []Upstream
+	}{
+		SendClientInfo: sendClientInfo,
+		Upstreams:      upstreams,
+	}
+	var sb strings.Builder
+	if err := tmpl.Execute(&sb, to); err != nil {
+		return "", err
+	}
+	return sb.String(), nil
+}
+
+func firewallaUpstreams(port int) []Upstream {
+	ifaces := FirewallaSelfInterfaces()
+	upstreams := make([]Upstream, 0, len(ifaces))
+	for _, netIface := range ifaces {
+		addrs, _ := netIface.Addrs()
+		for _, addr := range addrs {
+			if netIP, ok := addr.(*net.IPNet); ok && netIP.IP.To4() != nil {
+				upstreams = append(upstreams, Upstream{
+					IP:   netIP.IP.To4().String(),
+					Port: port,
+				})
+			}
+		}
+	}
+	return upstreams
+}
+
+// FirewallaSelfInterfaces returns list of interfaces that will be configured with default dnsmasq setup on Firewalla.
+func FirewallaSelfInterfaces() []*net.Interface {
+	matches, err := filepath.Glob("/home/pi/firerouter/etc/dnsmasq.dns.*.conf")
+	if err != nil {
+		return nil
+	}
+	ifaces := make([]*net.Interface, 0, len(matches))
+	for _, match := range matches {
+		// Trim prefix and suffix to get the iface name only.
+		ifaceName := strings.TrimSuffix(strings.TrimPrefix(match, "/home/pi/firerouter/etc/dnsmasq.dns."), ".conf")
+		if netIface, _ := net.InterfaceByName(ifaceName); netIface != nil {
+			ifaces = append(ifaces, netIface)
+		}
+	}
+	return ifaces
+}

internal/router/edgeos/edgeos.go

@@ -0,0 +1,189 @@
+package edgeos
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/Control-D-Inc/ctrld/internal/router/dnsmasq"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/kardianos/service"
+)
+
+const (
+	Name                       = "edgeos"
+	edgeOSDNSMasqConfigPath    = "/etc/dnsmasq.d/dnsmasq-zzz-ctrld.conf"
+	usgDNSMasqConfigPath       = "/etc/dnsmasq.conf"
+	usgDNSMasqBackupConfigPath = "/etc/dnsmasq.conf.bak"
+	toggleContentFilteringLink = "https://community.ui.com/questions/UDM-Pro-disable-enable-DNS-filtering/e2cc4060-e56a-4139-b200-62d7f773ff8f"
+)
+
+var ErrContentFilteringEnabled = fmt.Errorf(`the "Content Filtering" feature" is enabled, which is conflicted with ctrld.\n
+To disable it, folowing instruction here: %s`, toggleContentFilteringLink)
+
+type EdgeOS struct {
+	cfg   *ctrld.Config
+	isUSG bool
+}
+
+// New returns a router.Router for configuring/setup/run ctrld on EdgeOS routers.
+func New(cfg *ctrld.Config) *EdgeOS {
+	e := &EdgeOS{cfg: cfg}
+	e.isUSG = checkUSG()
+	return e
+}
+
+func (e *EdgeOS) ConfigureService(config *service.Config) error {
+	return nil
+}
+
+func (e *EdgeOS) Install(_ *service.Config) error {
+	// If "Content Filtering" is enabled, UniFi OS will create firewall rules to intercept all DNS queries
+	// from outside, and route those queries to separated interfaces (e.g: dnsfilter-2@if79) created by UniFi OS.
+	// Thus, those queries will never reach ctrld listener. UniFi OS does not provide any mechanism to toggle this
+	// feature via command line, so there's nothing ctrld can do to disable this feature. For now, reporting an
+	// error and guiding users to disable the feature using UniFi OS web UI.
+	if ContentFilteringEnabled() {
+		return ErrContentFilteringEnabled
+	}
+	return nil
+}
+
+func (e *EdgeOS) Uninstall(_ *service.Config) error {
+	return nil
+}
+
+func (e *EdgeOS) PreRun() error {
+	return nil
+}
+
+func (e *EdgeOS) Setup() error {
+	if e.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	if e.isUSG {
+		return e.setupUSG()
+	}
+	return e.setupUDM()
+}
+
+func (e *EdgeOS) Cleanup() error {
+	if e.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	if e.isUSG {
+		return e.cleanupUSG()
+	}
+	return e.cleanupUDM()
+}
+
+func (e *EdgeOS) setupUSG() error {
+	// On USG, dnsmasq is configured to forward queries to external provider by default.
+	// So instead of generating config in /etc/dnsmasq.d, we need to create a backup of
+	// the config, then modify it to forward queries to ctrld listener.
+
+	// Creating a backup.
+	buf, err := os.ReadFile(usgDNSMasqConfigPath)
+	if err != nil {
+		return fmt.Errorf("setupUSG: reading current config: %w", err)
+	}
+	if err := os.WriteFile(usgDNSMasqBackupConfigPath, buf, 0600); err != nil {
+		return fmt.Errorf("setupUSG: backup current config: %w", err)
+	}
+
+	// Removing all configured upstreams.
+	var sb strings.Builder
+	scanner := bufio.NewScanner(bytes.NewReader(buf))
+	for scanner.Scan() {
+		line := scanner.Text()
+		if strings.HasPrefix(line, "server=") {
+			continue
+		}
+		if strings.HasPrefix(line, "all-servers") {
+			continue
+		}
+		sb.WriteString(line)
+	}
+
+	data, err := dnsmasq.ConfTmpl(dnsmasq.ConfigContentTmpl, e.cfg)
+	if err != nil {
+		return err
+	}
+	sb.WriteString("\n")
+	sb.WriteString(data)
+	if err := os.WriteFile(usgDNSMasqConfigPath, []byte(sb.String()), 0644); err != nil {
+		return fmt.Errorf("setupUSG: writing dnsmasq config: %w", err)
+	}
+
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return fmt.Errorf("setupUSG: restartDNSMasq: %w", err)
+	}
+	return nil
+}
+
+func (e *EdgeOS) setupUDM() error {
+	data, err := dnsmasq.ConfTmpl(dnsmasq.ConfigContentTmpl, e.cfg)
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(edgeOSDNSMasqConfigPath, []byte(data), 0600); err != nil {
+		return fmt.Errorf("setupUDM: generating dnsmasq config: %w", err)
+	}
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return fmt.Errorf("setupUDM: restartDNSMasq: %w", err)
+	}
+	return nil
+}
+
+func (e *EdgeOS) cleanupUSG() error {
+	if err := os.Rename(usgDNSMasqBackupConfigPath, usgDNSMasqConfigPath); err != nil {
+		return fmt.Errorf("cleanupUSG: os.Rename: %w", err)
+	}
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return fmt.Errorf("cleanupUSG: restartDNSMasq: %w", err)
+	}
+	return nil
+}
+
+func (e *EdgeOS) cleanupUDM() error {
+	// Remove the custom dnsmasq config
+	if err := os.Remove(edgeOSDNSMasqConfigPath); err != nil {
+		return fmt.Errorf("cleanupUDM: os.Remove: %w", err)
+	}
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return fmt.Errorf("cleanupUDM: restartDNSMasq: %w", err)
+	}
+	return nil
+}
+
+func ContentFilteringEnabled() bool {
+	st, err := os.Stat("/run/dnsfilter/dnsfilter")
+	return err == nil && !st.IsDir()
+}
+
+func LeaseFileDir() string {
+	if checkUSG() {
+		return ""
+	}
+	return "/run"
+}
+
+func checkUSG() bool {
+	out, _ := os.ReadFile("/etc/version")
+	return bytes.HasPrefix(out, []byte("UniFiSecurityGateway."))
+}
+
+func restartDNSMasq() error {
+	if out, err := exec.Command("/etc/init.d/dnsmasq", "restart").CombinedOutput(); err != nil {
+		return fmt.Errorf("edgeosRestartDNSMasq: %s, %w", string(out), err)
+	}
+	return nil
+}

internal/router/firewalla/firewalla.go

@@ -0,0 +1,110 @@
+package firewalla
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/Control-D-Inc/ctrld/internal/router/dnsmasq"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/kardianos/service"
+)
+
+const (
+	Name = "firewalla"
+
+	firewallaDNSMasqConfigPath   = "/home/pi/.firewalla/config/dnsmasq_local/ctrld"
+	firewallaConfigPostMainDir   = "/home/pi/.firewalla/config/post_main.d"
+	firewallaCtrldInitScriptPath = "/home/pi/.firewalla/config/post_main.d/start_ctrld.sh"
+)
+
+type Firewalla struct {
+	cfg *ctrld.Config
+}
+
+// New returns a router.Router for configuring/setup/run ctrld on Firewalla routers.
+func New(cfg *ctrld.Config) *Firewalla {
+	return &Firewalla{cfg: cfg}
+}
+
+func (f *Firewalla) ConfigureService(_ *service.Config) error {
+	return nil
+}
+
+func (f *Firewalla) Install(_ *service.Config) error {
+	// Writing startup script.
+	if err := writeFirewallStartupScript(); err != nil {
+		return fmt.Errorf("writing startup script: %w", err)
+	}
+	return nil
+}
+
+func (f *Firewalla) Uninstall(_ *service.Config) error {
+	// Removing startup script.
+	if err := os.Remove(firewallaCtrldInitScriptPath); err != nil {
+		return fmt.Errorf("removing startup script: %w", err)
+	}
+	return nil
+}
+
+func (f *Firewalla) PreRun() error {
+	return nil
+}
+
+func (f *Firewalla) Setup() error {
+	if f.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	data, err := dnsmasq.FirewallaConfTmpl(dnsmasq.ConfigContentTmpl, f.cfg)
+	if err != nil {
+		return fmt.Errorf("generating dnsmasq config: %w", err)
+	}
+	if err := os.WriteFile(firewallaDNSMasqConfigPath, []byte(data), 0600); err != nil {
+		return fmt.Errorf("writing ctrld config: %w", err)
+	}
+
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return fmt.Errorf("restartDNSMasq: %w", err)
+	}
+
+	return nil
+}
+
+func (f *Firewalla) Cleanup() error {
+	if f.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	// Removing current config.
+	if err := os.Remove(firewallaDNSMasqConfigPath); err != nil {
+		return fmt.Errorf("removing ctrld config: %w", err)
+	}
+
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return fmt.Errorf("restartDNSMasq: %w", err)
+	}
+
+	return nil
+}
+
+func writeFirewallStartupScript() error {
+	if err := os.MkdirAll(firewallaConfigPostMainDir, 0775); err != nil {
+		return err
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	// This is called when "ctrld start ..." runs, so recording
+	// the same command line arguments to use in startup script.
+	argStr := strings.Join(os.Args[1:], " ")
+	script := fmt.Sprintf("#!/bin/bash\n\nsudo %q %s\n", exe, argStr)
+	return os.WriteFile(firewallaCtrldInitScriptPath, []byte(script), 0755)
+}
+
+func restartDNSMasq() error {
+	return exec.Command("systemctl", "restart", "firerouter_dns").Run()
+}

internal/router/merlin.go

@@ -1,89 +0,0 @@
-package router
-
-import (
-	"bytes"
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
-	"unicode"
-)
-
-func setupMerlin() error {
-	buf, err := os.ReadFile(merlinDNSMasqPostConfPath)
-	// Already setup.
-	if bytes.Contains(buf, []byte(merlinDNSMasqPostConfMarker)) {
-		return nil
-	}
-	if err != nil && !os.IsNotExist(err) {
-		return err
-	}
-
-	merlinDNSMasqPostConf, err := dnsMasqConf()
-	if err != nil {
-		return err
-	}
-	data := strings.Join([]string{
-		merlinDNSMasqPostConf,
-		"\n",
-		merlinDNSMasqPostConfMarker,
-		"\n",
-		string(buf),
-	}, "\n")
-	// Write dnsmasq post conf file.
-	if err := os.WriteFile(merlinDNSMasqPostConfPath, []byte(data), 0750); err != nil {
-		return err
-	}
-	// Restart dnsmasq service.
-	if err := merlinRestartDNSMasq(); err != nil {
-		return err
-	}
-
-	if err := nvramSetup(nvramKV()); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func cleanupMerlin() error {
-	// Restore old configs.
-	if err := nvramRestore(nvramKV()); err != nil {
-		return err
-	}
-	buf, err := os.ReadFile(merlinDNSMasqPostConfPath)
-	if err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	// Restore dnsmasq post conf file.
-	if err := os.WriteFile(merlinDNSMasqPostConfPath, merlinParsePostConf(buf), 0750); err != nil {
-		return err
-	}
-	// Restart dnsmasq service.
-	if err := merlinRestartDNSMasq(); err != nil {
-		return err
-	}
-	return nil
-}
-
-func postInstallMerlin() error {
-	return nil
-}
-
-func merlinRestartDNSMasq() error {
-	if out, err := exec.Command("service", "restart_dnsmasq").CombinedOutput(); err != nil {
-		return fmt.Errorf("restart_dnsmasq: %s, %w", string(out), err)
-	}
-	return nil
-}
-
-func merlinParsePostConf(buf []byte) []byte {
-	if len(buf) == 0 {
-		return nil
-	}
-	parts := bytes.Split(buf, []byte(merlinDNSMasqPostConfMarker))
-	if len(parts) != 1 {
-		return bytes.TrimLeftFunc(parts[1], unicode.IsSpace)
-	}
-	return buf
-}

internal/router/merlin/merlin.go

@@ -0,0 +1,142 @@
+package merlin
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"unicode"
+
+	"github.com/kardianos/service"
+
+	"github.com/Control-D-Inc/ctrld"
+	"github.com/Control-D-Inc/ctrld/internal/router/dnsmasq"
+	"github.com/Control-D-Inc/ctrld/internal/router/ntp"
+	"github.com/Control-D-Inc/ctrld/internal/router/nvram"
+)
+
+const Name = "merlin"
+
+var nvramKvMap = map[string]string{
+	"dnspriv_enable": "0", // Ensure Merlin native DoT disabled.
+}
+
+type Merlin struct {
+	cfg *ctrld.Config
+}
+
+// New returns a router.Router for configuring/setup/run ctrld on Merlin routers.
+func New(cfg *ctrld.Config) *Merlin {
+	return &Merlin{cfg: cfg}
+}
+
+func (m *Merlin) ConfigureService(config *service.Config) error {
+	return nil
+}
+
+func (m *Merlin) Install(_ *service.Config) error {
+	return nil
+}
+
+func (m *Merlin) Uninstall(_ *service.Config) error {
+	return nil
+}
+
+func (m *Merlin) PreRun() error {
+	_ = m.Cleanup()
+	return ntp.WaitNvram()
+}
+
+func (m *Merlin) Setup() error {
+	if m.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	// Already setup.
+	if val, _ := nvram.Run("get", nvram.CtrldSetupKey); val == "1" {
+		return nil
+	}
+	if _, err := nvram.Run("set", nvram.CtrldSetupKey+"=1"); err != nil {
+		return err
+	}
+	buf, err := os.ReadFile(dnsmasq.MerlinPostConfPath)
+	// Already setup.
+	if bytes.Contains(buf, []byte(dnsmasq.MerlinPostConfMarker)) {
+		return nil
+	}
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	data, err := dnsmasq.ConfTmpl(dnsmasq.MerlinPostConfTmpl, m.cfg)
+	if err != nil {
+		return err
+	}
+	data = strings.Join([]string{
+		data,
+		"\n",
+		dnsmasq.MerlinPostConfMarker,
+		"\n",
+		string(buf),
+	}, "\n")
+	// Write dnsmasq post conf file.
+	if err := os.WriteFile(dnsmasq.MerlinPostConfPath, []byte(data), 0750); err != nil {
+		return err
+	}
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return err
+	}
+
+	if err := nvram.SetKV(nvramKvMap, nvram.CtrldSetupKey); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *Merlin) Cleanup() error {
+	if m.cfg.FirstListener().IsDirectDnsListener() {
+		return nil
+	}
+	if val, _ := nvram.Run("get", nvram.CtrldSetupKey); val != "1" {
+		return nil // was restored, nothing to do.
+	}
+
+	// Restore old configs.
+	if err := nvram.Restore(nvramKvMap, nvram.CtrldSetupKey); err != nil {
+		return err
+	}
+
+	buf, err := os.ReadFile(dnsmasq.MerlinPostConfPath)
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	// Restore dnsmasq post conf file.
+	if err := os.WriteFile(dnsmasq.MerlinPostConfPath, merlinParsePostConf(buf), 0750); err != nil {
+		return err
+	}
+	// Restart dnsmasq service.
+	if err := restartDNSMasq(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func restartDNSMasq() error {
+	if out, err := exec.Command("service", "restart_dnsmasq").CombinedOutput(); err != nil {
+		return fmt.Errorf("restart_dnsmasq: %s, %w", string(out), err)
+	}
+	return nil
+}
+
+func merlinParsePostConf(buf []byte) []byte {
+	if len(buf) == 0 {
+		return nil
+	}
+	parts := bytes.Split(buf, []byte(dnsmasq.MerlinPostConfMarker))
+	if len(parts) != 1 {
+		return bytes.TrimLeftFunc(parts[1], unicode.IsSpace)
+	}
+	return buf
+}

internal/router/merlin/merlin_test.go

@@ -1,17 +1,19 @@
-package router
+package merlin
 
 import (
 	"bytes"
 	"strings"
 	"testing"
+
+	"github.com/Control-D-Inc/ctrld/internal/router/dnsmasq"
 )
 
 func Test_merlinParsePostConf(t *testing.T) {
 	origContent := "# foo"
 	data := strings.Join([]string{
-		merlinDNSMasqPostConfTmpl,
+		dnsmasq.MerlinPostConfTmpl,
 		"\n",
-		merlinDNSMasqPostConfMarker,
+		dnsmasq.MerlinPostConfMarker,
 		"\n",
 	}, "\n")
 

internal/router/ntp/ntp.go

@@ -0,0 +1,49 @@
+package ntp
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"time"
+
+	"tailscale.com/logtail/backoff"
+
+	"github.com/Control-D-Inc/ctrld/internal/router/nvram"
+)
+
+// WaitNvram waits NTP synced by checking "ntp_ready" value using nvram.
+func WaitNvram() error {
+	// Wait until `ntp_ready=1` set.
+	b := backoff.NewBackoff("ntp.Wait", func(format string, args ...any) {}, 10*time.Second)
+	for {
+		// ddwrt use "ntp_done": https://github.com/mirror/dd-wrt/blob/a08c693527ab3204bf7bebd408a7c9a83b6ede47/src/router/rc/ntp.c#L100
+		for _, key := range []string{"ntp_ready", "ntp_done"} {
+			out, err := nvram.Run("get", key)
+			if err != nil {
+				return fmt.Errorf("PreStart: nvram: %w", err)
+			}
+			if out == "1" {
+				return nil
+			}
+		}
+		b.BackOff(context.Background(), errors.New("ntp not ready"))
+	}
+}
+
+// WaitUpstart waits NTP synced by checking upstart task "ntpsync" is in "stop/waiting" state.
+func WaitUpstart() error {
+	// Wait until `initctl status ntpsync` returns stop state.
+	b := backoff.NewBackoff("ntp.WaitUpstart", func(format string, args ...any) {}, 10*time.Second)
+	for {
+		out, err := exec.Command("initctl", "status", "ntpsync").CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("exec.Command: %w", err)
+		}
+		if bytes.Contains(out, []byte("stop/waiting")) {
+			return nil
+		}
+		b.BackOff(context.Background(), errors.New("ntp not ready"))
+	}
+}