mirror of
https://github.com/Control-D-Inc/ctrld.git
synced 2026-10-24 14:08:27 +02:00
Cuong Manh Le
bf7c264464
When no intercept mode is selected by flag or config, a new installation on macOS or a Windows desktop edition now uses "dns". Windows Server, iOS and other platforms keep interface DNS mode unless intercept is selected explicitly, and so does a config that cannot run in intercept mode. Existing Standard installations are not switched on upgrade. ctrld start marks the services it installs fresh, and the service applies the default below service.intercept_mode against the config it fetches, so a service with neither a mode nor the marker predates the default and keeps interface DNS mode, whichever path upgrades it; the macOS package also pins such a service to "off" explicitly. An explicit "off" stays final and is persisted.
DNS Intercept Test Scripts
Manual test scripts for verifying DNS intercept mode behavior. These require root/admin privileges and a running ctrld instance.
Structure
test-scripts/
├── darwin/
│ ├── test-recovery-bypass.sh # Captive portal recovery simulation
│ ├── test-dns-intercept.sh # Basic pf intercept verification
│ ├── test-pf-group-exemption.sh # Group-based pf exemption test
│ ├── validate-pf-rules.sh # Dry-run pf rule validation
│ ├── diag-lo0-capture.sh # Capture DNS on lo0 for pf debugging
│ ├── diag-pf-poll.sh # Poll pf rules/states every 2s
│ └── diag-vpn-connect.sh # VPN connect/disconnect diagnostic
└── windows/
├── test-recovery-bypass.ps1 # Captive portal recovery simulation
└── test-dns-intercept.ps1 # Basic WFP intercept verification
Prerequisites
- ctrld running with
--intercept-mode dns(or--intercept-mode hard) - Verbose logging:
-v 1 --log /tmp/dns.log(macOS) or--log C:\temp\dns.log(Windows) - Root (macOS) or Administrator (Windows)
- For recovery tests: disconnect VPNs (e.g., Tailscale) that provide alternative routes
Recovery Bypass Test
Simulates a captive portal by blackholing ctrld's upstream DoH IPs and cycling wifi. Verifies that ctrld's recovery bypass activates, discovers DHCP nameservers, and forwards queries to them until the upstream recovers.
macOS
sudo bash test-scripts/darwin/test-recovery-bypass.sh en0
Windows (PowerShell as Administrator)
.\test-scripts\windows\test-recovery-bypass.ps1 -WifiAdapter "Wi-Fi"
Safety
All scripts clean up on exit (including Ctrl+C):
- macOS: Removes route blackholes, re-enables wifi
- Windows: Removes firewall rules, re-enables adapter