fix(iroh-relay): happy eyeballs for relay clients

Frando · Frando · commit 3d14dc09933e · 2026-06-02T13:25:23.000+02:00
diff --git a/iroh-dns/src/dns.rs b/iroh-dns/src/dns.rs
@@ -479,6 +479,53 @@ impl DnsResolver {
         }
     }
 
+    /// Resolves a hostname from a URL to all of its IP addresses, ordered by preference.
+    ///
+    /// The addresses of the preferred family come first (IPv6 when `prefer_ipv6`,
+    /// otherwise IPv4), followed by the addresses of the other family. Callers can
+    /// dial these in order and fall back across families when the preferred address
+    /// is unreachable.
+    pub async fn resolve_host_all(
+        &self,
+        url: &Url,
+        prefer_ipv6: bool,
+        timeout: Duration,
+    ) -> Result<Vec<IpAddr>, DnsError> {
+        let host = url.host().ok_or_else(|| e!(DnsError::MissingHost))?;
+        match host {
+            url::Host::Domain(domain) => {
+                let lookup = tokio::join!(
+                    self.lookup_ipv4(domain, timeout),
+                    self.lookup_ipv6(domain, timeout)
+                );
+                let addrs: Vec<IpAddr> = match lookup {
+                    (Err(ipv4_err), Err(ipv6_err)) => {
+                        return Err(e!(DnsError::ResolveBoth {
+                            ipv4: Box::new(ipv4_err),
+                            ipv6: Box::new(ipv6_err)
+                        }));
+                    }
+                    (Err(_), Ok(v6)) => v6.collect(),
+                    (Ok(v4), Err(_)) => v4.collect(),
+                    (Ok(v4), Ok(v6)) => {
+                        if prefer_ipv6 {
+                            v6.chain(v4).collect()
+                        } else {
+                            v4.chain(v6).collect()
+                        }
+                    }
+                };
+                if addrs.is_empty() {
+                    Err(e!(DnsError::NoResponse))
+                } else {
+                    Ok(addrs)
+                }
+            }
+            url::Host::Ipv4(ip) => Ok(vec![IpAddr::V4(ip)]),
+            url::Host::Ipv6(ip) => Ok(vec![IpAddr::V6(ip)]),
+        }
+    }
+
     /// Performs an IPv4 lookup with a timeout in a staggered fashion.
     ///
     /// From the moment this function is called, each lookup is scheduled after the delays in
diff --git a/iroh-relay/src/client.rs b/iroh-relay/src/client.rs
@@ -210,12 +210,13 @@ impl ClientBuilder {
         self
     }
 
-    /// Returns if we should prefer ipv6
-    /// it replaces the relayhttp.AddressFamilySelector we pass
-    /// It provides the hint as to whether in an IPv4-vs-IPv6 race that
-    /// IPv4 should be held back a bit to give IPv6 a better-than-50/50
-    /// chance of winning. We only return true when we believe IPv6 will
-    /// work anyway, so we don't artificially delay the connection speed.
+    /// Sets a callback hinting whether to prefer IPv6 when dialing the relay.
+    ///
+    /// The callback runs on each dial. When it returns `true`, IPv6 addresses
+    /// are tried first and IPv4 dials are held back slightly, biasing the
+    /// happy-eyeballs race towards IPv6; when it returns `false`, IPv4 is
+    /// preferred. Only return `true` when IPv6 is expected to work, since
+    /// otherwise the bias just delays the connection.
     pub fn address_family_selector<S>(mut self, selector: S) -> Self
     where
         S: Fn() -> bool + Send + Sync + 'static,
diff --git a/iroh-relay/src/client/tls.rs b/iroh-relay/src/client/tls.rs
@@ -10,9 +10,11 @@ use bytes::Bytes;
 use data_encoding::BASE64URL;
 use http_body_util::Empty;
 use hyper::{Request, upgrade::Parts};
+use hyper_util::rt::TokioIo;
 use n0_error::e;
-use n0_future::{task, time};
+use n0_future::{IterExt, StreamExt, task, time};
 use rustls::client::Resumption;
+use tokio::net::TcpStream;
 use tracing::error;
 
 use super::{
@@ -111,61 +113,26 @@ impl MaybeTlsStreamBuilder {
             let stream = self.dial_url_proxy(proxy.clone(), tls_connector).await?;
             Ok(ProxyStream::Proxied(stream))
         } else {
-            let stream = self.dial_url_direct().await?;
+            let stream =
+                dial_happy_eyeballs(&self.dns_resolver, &self.url, self.prefer_ipv6).await?;
             Ok(ProxyStream::Raw(stream))
         }
     }
 
-    async fn dial_url_direct(&self) -> Result<tokio::net::TcpStream, DialError> {
-        use tokio::net::TcpStream;
-        let dst_ip = self
-            .dns_resolver
-            .resolve_host(&self.url, self.prefer_ipv6, DNS_TIMEOUT)
-            .await?;
-
-        let port = url_port(&self.url).ok_or_else(|| e!(DialError::InvalidTargetPort))?;
-        let addr = SocketAddr::new(dst_ip, port);
-
-        trace!("connecting to {}", addr);
-        let tcp_stream = time::timeout(DIAL_ENDPOINT_TIMEOUT, async move {
-            TcpStream::connect(addr).await
-        })
-        .await
-        .map_err(|err| e!(DialError::Timeout, err))??;
-
-        tcp_stream.set_nodelay(true)?;
-
-        Ok(tcp_stream)
-    }
-
     async fn dial_url_proxy(
         &self,
         proxy_url: Url,
         tls_connector: &tokio_rustls::TlsConnector,
     ) -> Result<util::Chain<std::io::Cursor<Bytes>, MaybeTlsStream<tokio::net::TcpStream>>, DialError>
     {
-        use hyper_util::rt::TokioIo;
-        use tokio::net::TcpStream;
         debug!(%self.url, %proxy_url, "dial url via proxy");
 
-        // Resolve proxy DNS
-        let proxy_ip = self
-            .dns_resolver
-            .resolve_host(&proxy_url, self.prefer_ipv6, DNS_TIMEOUT)
-            .await?;
-
-        let proxy_port =
-            url_port(&proxy_url).ok_or_else(|| e!(DialError::ProxyInvalidTargetPort))?;
-        let proxy_addr = SocketAddr::new(proxy_ip, proxy_port);
-
-        debug!(%proxy_addr, "connecting to proxy");
-
-        let tcp_stream = time::timeout(DIAL_ENDPOINT_TIMEOUT, async move {
-            TcpStream::connect(proxy_addr).await
-        })
-        .await??;
-
-        tcp_stream.set_nodelay(true)?;
+        let tcp_stream = dial_happy_eyeballs(&self.dns_resolver, &proxy_url, self.prefer_ipv6)
+            .await
+            .map_err(|err| match err {
+                DialError::InvalidTargetPort { meta } => DialError::ProxyInvalidTargetPort { meta },
+                err @ _ => err,
+            })?;
 
         // Setup TLS if necessary
         let io = if proxy_url.scheme() == "http" {
@@ -254,6 +221,56 @@ impl MaybeTlsStreamBuilder {
     }
 }
 
+/// Resolves `url` and races a TCP connection across the resolved addresses.
+///
+/// The host is resolved to all of its addresses in preference order (IPv6 first
+/// when `prefer_ipv6`, otherwise IPv4). Each successive dial is started
+/// [`DIAL_STAGGER_DELAY`] after the previous one and capped at
+/// [`DIAL_ENDPOINT_TIMEOUT`], so a slow or unreachable preferred address
+/// does not hold back the rest for the full timeout. The first connection to succeed
+/// is returned. The remaining attempts are cancelled.
+async fn dial_happy_eyeballs(
+    dns_resolver: &DnsResolver,
+    url: &Url,
+    prefer_ipv6: bool,
+) -> Result<TcpStream, DialError> {
+    let port = url_port(url).ok_or_else(|| e!(DialError::InvalidTargetPort))?;
+    let addrs = dns_resolver
+        .resolve_host_all(url, prefer_ipv6, DNS_TIMEOUT)
+        .await?;
+    let mut dials = addrs
+        .into_iter()
+        .enumerate()
+        .map(|(i, ip)| {
+            let addr = SocketAddr::new(ip, port);
+            async move {
+                time::sleep(DIAL_STAGGER_DELAY * i as u32).await;
+                trace!("connecting to {}", addr);
+                let tcp_stream = time::timeout(DIAL_ENDPOINT_TIMEOUT, TcpStream::connect(addr))
+                    .await
+                    .map_err(|err| e!(DialError::Timeout, err))
+                    .and_then(|res| res.map_err(|err| e!(DialError::Io, err)))
+                    .inspect_err(|err| {
+                        debug!(%addr, "failed to connect to relay at {addr}: {err:#}");
+                    })?;
+                tcp_stream.set_nodelay(true)?;
+                Ok(tcp_stream)
+            }
+        })
+        .into_unordered_stream();
+
+    let mut last_err = None;
+    while let Some(res) = dials.next().await {
+        match res {
+            Ok(tcp_stream) => return Ok(tcp_stream),
+            Err(err) => last_err = Some(err),
+        }
+    }
+
+    // If we haven't returned yet, last_err is always set unless `addrs` was empty.
+    Err(last_err.unwrap_or_else(|| e!(DnsError::NoResponse).into()))
+}
+
 fn url_port(url: &Url) -> Option<u16> {
     if let Some(port) = url.port() {
         return Some(port);
diff --git a/iroh-relay/src/defaults.rs b/iroh-relay/src/defaults.rs
@@ -31,6 +31,10 @@ pub mod timeouts {
     /// using `TcpStream::connect`
     pub(crate) const DIAL_ENDPOINT_TIMEOUT: Duration = Duration::from_millis(1500);
 
+    /// Delay before starting the next address's dial in the staggered
+    /// "happy eyeballs" connection race.
+    pub(crate) const DIAL_STAGGER_DELAY: Duration = Duration::from_millis(250);
+
     /// Default timeout for DNS queries issued by [`DnsResolver`].
     ///
     /// [`DnsResolver`]: iroh_dns::dns::DnsResolver
diff --git a/iroh-relay/src/server.rs b/iroh-relay/src/server.rs
@@ -1156,16 +1156,21 @@ impl hyper::service::Service<Request<Incoming>> for CaptivePortalService {
 
 #[cfg(test)]
 mod tests {
-    use std::{net::Ipv4Addr, sync::Arc, time::Duration};
+    use std::{
+        net::{Ipv4Addr, Ipv6Addr},
+        sync::Arc,
+        time::Duration,
+    };
 
     use http::StatusCode;
     use iroh_base::{EndpointId, RelayUrl, SecretKey};
-    use iroh_dns::dns::DnsResolver;
-    use n0_error::Result;
-    use n0_future::{SinkExt, StreamExt};
+    use iroh_dns::dns::{BoxIter, DnsError, DnsResolver, Resolver, TxtRecordData};
+    use n0_error::{Result, StackResultExt, StdResultExt};
+    use n0_future::{SinkExt, StreamExt, boxed::BoxFuture};
     use n0_tracing_test::traced_test;
     use rand::{RngExt, SeedableRng};
     use tracing::{info, instrument};
+    use url::Url;
 
     use super::{
         Access, AccessControl, ClientRequest, NO_CONTENT_CHALLENGE_HEADER,
@@ -1177,7 +1182,7 @@ mod tests {
             handshake,
             relay::{ClientToRelayMsg, Datagrams, RelayToClientMsg},
         },
-        tls::{CaRootsConfig, default_provider},
+        tls::{self, CaRootsConfig, default_provider},
     };
 
     /// An [`AccessControl`] backed by a closure, for tests.
@@ -1569,4 +1574,70 @@ mod tests {
         }
         Ok(())
     }
+
+    /// A resolver that hands out fixed IPv4 and IPv6 addresses for every host.
+    #[derive(Debug, Clone)]
+    struct StaticResolver {
+        v4: Vec<Ipv4Addr>,
+        v6: Vec<Ipv6Addr>,
+    }
+
+    impl Resolver for StaticResolver {
+        fn lookup_ipv4(&self, _host: String) -> BoxFuture<Result<BoxIter<Ipv4Addr>, DnsError>> {
+            let v4 = self.v4.clone();
+            Box::pin(async move { Ok(Box::new(v4.into_iter()) as BoxIter<Ipv4Addr>) })
+        }
+
+        fn lookup_ipv6(&self, _host: String) -> BoxFuture<Result<BoxIter<Ipv6Addr>, DnsError>> {
+            let v6 = self.v6.clone();
+            Box::pin(async move { Ok(Box::new(v6.into_iter()) as BoxIter<Ipv6Addr>) })
+        }
+
+        fn lookup_txt(&self, _host: String) -> BoxFuture<Result<BoxIter<TxtRecordData>, DnsError>> {
+            Box::pin(async move { Ok(Box::new(std::iter::empty()) as BoxIter<TxtRecordData>) })
+        }
+
+        fn clear_cache(&self) {}
+
+        fn reset(&self) -> Box<dyn Resolver> {
+            Box::new(self.clone())
+        }
+    }
+
+    /// A relay client that prefers IPv6 falls back to IPv4 when the advertised IPv6
+    /// address is unreachable.
+    #[tokio::test]
+    #[traced_test]
+    async fn test_relay_client_falls_back_to_ipv4() -> Result {
+        // A relay reachable only over IPv4.
+        let mut config = ServerConfig::default();
+        config.relay = Some(RelayConfig::new((Ipv4Addr::LOCALHOST, 0)));
+        let server = Server::spawn(config).await?;
+        let addr = server.http_addr().expect("http relay address");
+
+        // `relay.test` resolves to the relay's real IPv4 address alongside an
+        // unreachable IPv6 address from the RFC 3849 documentation prefix, standing
+        // in for the stale AAAA record from the issue.
+        let resolver = DnsResolver::custom(StaticResolver {
+            v4: vec![Ipv4Addr::LOCALHOST],
+            v6: vec!["2001:db8::dead".parse().expect("valid IPv6")],
+        });
+        let url: Url = format!("http://relay.test:{}", addr.port())
+            .parse()
+            .expect("valid relay url");
+
+        // Force the IPv6 preference, as a client with working IPv6 connectivity
+        // would have after a net report.
+        let client = ClientBuilder::new(url, SecretKey::generate(), resolver)
+            .tls_client_config(tls::make_dangerous_client_config())
+            .address_family_selector(|| true);
+
+        tokio::time::timeout(Duration::from_secs(10), client.connect())
+            .await
+            .with_std_context(|_| "relay connect timed out")?
+            .context("relay connect")?;
+
+        server.shutdown().await.context("relay server shutdown")?;
+        Ok(())
+    }
 }
