mirror of
https://github.com/Control-D-Inc/ctrld.git
synced 2026-03-25 23:30:41 +01:00
289a46dc2c
Implement DNS interception on macOS using pf (packet filter): - Anchor injection into running ruleset (not /etc/pf.conf) - route-to lo0 + rdr rules for locally-originated DNS capture - _ctrld group exemption so ctrld's own queries bypass interception - Watchdog to detect and restore wiped anchor rules - Probe-based auto-heal for Parallels VM pf corruption - IPv6 DNS blocking and block-return for clean timeouts - Interface-specific tunnel detection for VPN coexistence - Port 5354 fallback in intercept mode Includes pf technical reference docs and test scripts. Squashed from intercept mode development on v1.0 branch (#497).
48 lines
1.8 KiB
Markdown
48 lines
1.8 KiB
Markdown
# DNS Intercept Test Scripts
|
|
|
|
Manual test scripts for verifying DNS intercept mode behavior. These require root/admin privileges and a running ctrld instance.
|
|
|
|
## Structure
|
|
|
|
```
|
|
test-scripts/
|
|
├── darwin/
|
|
│ ├── test-recovery-bypass.sh # Captive portal recovery simulation
|
|
│ ├── test-dns-intercept.sh # Basic pf intercept verification
|
|
│ ├── test-pf-group-exemption.sh # Group-based pf exemption test
|
|
│ ├── validate-pf-rules.sh # Dry-run pf rule validation
|
|
│ ├── diag-lo0-capture.sh # Capture DNS on lo0 for pf debugging
|
|
│ ├── diag-pf-poll.sh # Poll pf rules/states every 2s
|
|
│ └── diag-vpn-connect.sh # VPN connect/disconnect diagnostic
|
|
└── windows/
|
|
├── test-recovery-bypass.ps1 # Captive portal recovery simulation
|
|
└── test-dns-intercept.ps1 # Basic WFP intercept verification
|
|
```
|
|
|
|
## Prerequisites
|
|
|
|
- ctrld running with `--intercept-mode dns` (or `--intercept-mode hard`)
|
|
- Verbose logging: `-v 1 --log /tmp/dns.log` (macOS) or `--log C:\temp\dns.log` (Windows)
|
|
- Root (macOS) or Administrator (Windows)
|
|
- For recovery tests: disconnect VPNs (e.g., Tailscale) that provide alternative routes
|
|
|
|
## Recovery Bypass Test
|
|
|
|
Simulates a captive portal by blackholing ctrld's upstream DoH IPs and cycling wifi. Verifies that ctrld's recovery bypass activates, discovers DHCP nameservers, and forwards queries to them until the upstream recovers.
|
|
|
|
### macOS
|
|
```bash
|
|
sudo bash test-scripts/darwin/test-recovery-bypass.sh en0
|
|
```
|
|
|
|
### Windows (PowerShell as Administrator)
|
|
```powershell
|
|
.\test-scripts\windows\test-recovery-bypass.ps1 -WifiAdapter "Wi-Fi"
|
|
```
|
|
|
|
## Safety
|
|
|
|
All scripts clean up on exit (including Ctrl+C):
|
|
- **macOS**: Removes route blackholes, re-enables wifi
|
|
- **Windows**: Removes firewall rules, re-enables adapter
|