fix(tun): Windows single-label DNS via a search suffix + NRPT (not catch-all)

Windows never issues a DNS query for a BARE single-label name (LLMNR/NetBIOS only), so the NRPT catch-all could never catch it: "Could not resolve host" in real apps, even though the in-stack resolver answered a direct query fine. Advertise a search suffix on plug0 so getaddrinfo turns my-service into my-service.plug (a real DNS query), route ".plug" to the resolver via NRPT, and strip the suffix back in answerDNS. Same mechanism Tailscale/WireGuard use for short names.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hhfrancois

cli/internal/tun/dns.go

@@ -19,6 +19,14 @@ const (
 	dnsHost  = 53         // reserved host byte: this instance's DNS is base|53
 )
 
+// searchSuffix is the DNS search suffix plug0 advertises on Windows so the OS
+// actually issues a DNS query for a single-label cluster name. Windows resolves a
+// BARE name (my-service) via LLMNR/NetBIOS, never DNS — so getaddrinfo never reaches
+// our resolver. With this suffix in the search list, getaddrinfo tries
+// "my-service.plug"; an NRPT rule routes ".plug" to our resolver, and answerDNS
+// strips it back to the bare name. No effect on macOS/Linux (nothing appends it).
+const searchSuffix = "plug"
+
 // faketab maps minted fake IPs to cluster names, all within ONE instance's
 // 198.18.<N>.0/24. The DNS forwarder mints; the netstack TCP forwarder looks up.
 // In-process, shared, mutex-guarded.
@@ -106,6 +114,19 @@ func answerDNS(q []byte, tab *faketab, upstream *net.Resolver) []byte {
 	case qtype != 1: // non-A → NODATA
 	case strings.EqualFold(name, "localhost") || strings.HasSuffix(strings.ToLower(name), ".localhost"):
 		answerIP = net.IPv4(127, 0, 0, 1)
+	case strings.HasSuffix(strings.ToLower(name), "."+searchSuffix):
+		// Windows appended plug0's search suffix (my-service → my-service.plug) to
+		// force a DNS query. Strip it and mint the SAME fake IP as the bare name, so
+		// the connect maps back to "my-service" for the agent to resolve.
+		if base := name[:len(name)-len(searchSuffix)-1]; base != "" && !strings.Contains(base, ".") {
+			if ip := tab.mint(base); ip != 0 {
+				answerIP = net.IPv4(byte(ip>>24), byte(ip>>16), byte(ip>>8), byte(ip))
+			} else {
+				rcode = 3
+			}
+		} else {
+			rcode = 3
+		}
 	case !strings.Contains(name, "."): // single-label cluster name → fake
 		if ip := tab.mint(name); ip != 0 {
 			answerIP = net.IPv4(byte(ip>>24), byte(ip>>16), byte(ip>>8), byte(ip))

cli/internal/tun/route_windows.go

@@ -43,21 +43,22 @@ func configure(dev any, _, cidr, dnsIP string, log logfn) ([]string, string, fun
 	if err := luid.AddRoute(netip.MustParsePrefix(cidr), netip.IPv4Unspecified(), 0); err != nil {
 		return nil, "", func() {}, fmt.Errorf("add %s route: %w", cidr, err)
 	}
+	// Advertise the search suffix on plug0 too: Windows won't DNS-query a BARE
+	// single-label name (LLMNR/NetBIOS only), so getaddrinfo must be nudged to try
+	// "my-service.<suffix>" — that's what turns it into a real DNS query.
 	if dns, err := netip.ParseAddr(dnsIP); err == nil {
-		if e := luid.SetDNS(v4, []netip.Addr{dns}, nil); e != nil {
+		if e := luid.SetDNS(v4, []netip.Addr{dns}, []string{searchSuffix}); e != nil {
 			log.f("tun[win]: set DNS: %v", e)
 		}
 	}
-	// Adapter DNS alone doesn't cover SINGLE-LABEL names (my-service): Windows
-	// devolution + interface ordering skip it, so getaddrinfo("my-service") never
-	// reaches our resolver ("Could not resolve host"). An NRPT catch-all rule points
-	// ALL name resolution at dnsIP — the Windows counterpart of the macOS scutil
-	// repoint. Our in-stack DNS answers cluster names with a fake IP and forwards the
-	// rest to the saved upstreams, so a machine-wide rule is safe.
+	// Route that suffix to our resolver via NRPT (the Windows counterpart of the
+	// macOS scutil repoint; the same mechanism Tailscale/WireGuard use). ".<suffix>"
+	// is surgical — only "*.<suffix>" goes in-stack, real internet DNS is untouched —
+	// and answerDNS strips the suffix back to the bare cluster name.
 	if err := setSystemNRPT(dnsIP); err != nil {
 		log.f("tun[win]: NRPT repoint failed — single-label names may not resolve: %v", err)
 	} else {
-		log.f("tun[win]: system DNS repointed to %s (NRPT catch-all)", dnsIP)
+		log.f("tun[win]: system DNS repointed — *.%s → %s (NRPT)", searchSuffix, dnsIP)
 	}
 
 	cleanup := func() {
@@ -76,7 +77,7 @@ func configure(dev any, _, cidr, dnsIP string, log logfn) ([]string, string, fun
 // the resolver cache so a prior negative answer ("Could not resolve") doesn't stick.
 func setSystemNRPT(dnsIP string) error {
 	clearSystemNRPT(dnsIP) // drop a stale rule a crashed run may have left
-	return psRun("Add-DnsClientNrptRule -Namespace '.' -NameServers '" + dnsIP + "'; Clear-DnsClientCache")
+	return psRun("Add-DnsClientNrptRule -Namespace '." + searchSuffix + "' -NameServers '" + dnsIP + "'; Clear-DnsClientCache")
 }
 
 // clearSystemNRPT removes the rule(s) pointing at dnsIP and flushes the cache. Keyed