Files
ctrld/cmd/cli
Dev Scribe aea147fbb9 fix(cli): confirm IPv6-only evidence before setting the Intercept target
"No IPv4 yet" is also the state of a dual-stack network whose router
advertisement arrived before the DHCPv4 ACK. In that window the DHCP
read fails, configd has no IPv4 state, and the interface holds only
SLAAC IPv6, so a single IPv6-only observation could write 127.0.0.53 on
a service that provides IPv4 DNS seconds later.

The IPv6-only evidence must now hold on the same service and device for
15 seconds before it admits a target. The first observation starts the
clock and schedules one confirming reconcile. Any pass that reads the
evidence and finds a readable lease, IPv4 state, CLAT, or a different
service ends the confirmation without a write. Shutdown drops a pending
confirmation. CLAT evidence still admits immediately.

Review follow-ups: the service-name and networksetup mapping tail is a
shared reader helper, the IPv6 interface check uses an escaped tab, and
nativeIPv6OnlyAddresses has its own table test.
2026-10-20 17:23:47 +07:00
..
2025-01-24 14:54:20 +07:00