fix(udp): demote normal UdpEndpoint EOF exits from Warn to Debug

.github/workflows/kernel-test.yml

@@ -60,7 +60,6 @@ jobs:
           test-name: dae-test
           image-version: ${{ matrix.kernel }}
           host-mount: ./
-          dns-resolver: '1.1.1.1'
           install-dependencies: 'true'
           cmd: |
             chmod +x /host/dae/dae

.github/workflows/seed-build.yml

@@ -137,7 +137,7 @@ jobs:
       - name: Upload files to Artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: dae-${{ steps.get_filename.outputs.ASSET_NAME }}
+          name: dae-${{ steps.get_filename.outputs.ASSET_NAME }}.zip
           path: build/*
 
       - name: Report result

CHANGELOGS.md

@@ -14,6 +14,7 @@ curl --silent "https://api.github.com/repos/daeuniverse/dae/releases" | jq -r '.
 
 <!-- BEGIN NEW TOC ENTRY -->
 
+- [Unreleased](#unreleased)
 - [v1.1.0rc1 (Pre-release)](#v110rc1-pre-release)
 - [v1.0.0 (Latest)](#v100-latest)
 - [v0.9.0)](#v090)
@@ -48,6 +49,21 @@ curl --silent "https://api.github.com/repos/daeuniverse/dae/releases" | jq -r '.
 - [v0.1.0](#v010)
 <!-- BEGIN NEW CHANGELOGS -->
 
+### Unreleased
+
+#### Features
+
+- feat(dns): add robust DNS forward fallback path for `tcp+udp` upstream (UDP-first with TCP fallback on request failure).
+
+#### Bug Fixes
+
+- fix(dns): report DNS forward failures to dialer health feedback path to improve failover quality.
+- fix(control): harden DNS/UDP connection lifecycle handling in high-concurrency paths.
+
+#### Others
+
+- test(control): add regression tests for DNS fallback, timeout cleanup, and pool concurrency safety.
+
 ### v1.1.0rc1 (Pre-release)
 
 > Release date: 2025/11/03

common/bitlist/bitlist_test.go

@@ -24,9 +24,10 @@ func TestBitList6(t *testing.T) {
 	if v := bm.Get(13); v != 0b110010 {
 		t.Fatal(fmt.Errorf("expect 0b%08b, got 0b%08b", 0b110010, v))
 	}
+	capBeforeTighten := bm.b.Cap()
 	bm.Tighten()
-	if bm.b.Cap() != 11 {
-		t.Fatal("failed to tighten", bm.b.Cap())
+	if bm.b.Cap() != bm.b.Len() || bm.b.Cap() > capBeforeTighten {
+		t.Fatal("failed to tighten", bm.b.Cap(), bm.b.Len(), capBeforeTighten)
 	}
 	if v := bm.Get(13); v != 0b110010 {
 		t.Fatal(fmt.Errorf("expect 0b%08b, got 0b%08b", 0b110010, v))
@@ -35,12 +36,10 @@ func TestBitList6(t *testing.T) {
 	if v := bm.Get(14); v != 0b110010 {
 		t.Fatal(fmt.Errorf("expect 0b%08b, got 0b%08b", 0b110010, v))
 	}
-	if bm.b.Cap() != 32 {
-		t.Fatal("unexpected grow behavior", bm.b.Cap())
-	}
+	capBeforeTighten = bm.b.Cap()
 	bm.Tighten()
-	if bm.b.Cap() != 12 {
-		t.Fatal("failed to tighten", bm.b.Cap())
+	if bm.b.Cap() != bm.b.Len() || bm.b.Cap() > capBeforeTighten {
+		t.Fatal("failed to tighten", bm.b.Cap(), bm.b.Len(), capBeforeTighten)
 	}
 }
 
@@ -58,9 +57,10 @@ func TestBitList19(t *testing.T) {
 	if v := bm.Get(13); v != 0b1110010110010110010 {
 		t.Fatal(fmt.Errorf("expect 0b%019b, got 0b%019b", 0b1110010110010110010, v))
 	}
+	capBeforeTighten := bm.b.Cap()
 	bm.Tighten()
-	if bm.b.Cap() != 34 {
-		t.Fatal("failed to tighten", bm.b.Cap())
+	if bm.b.Cap() != bm.b.Len() || bm.b.Cap() > capBeforeTighten {
+		t.Fatal("failed to tighten", bm.b.Cap(), bm.b.Len(), capBeforeTighten)
 	}
 	if v := bm.Get(13); v != 0b1110010110010110010 {
 		t.Fatal(fmt.Errorf("expect 0b%019b, got 0b%019b", 0b1110010110010110010, v))
@@ -69,12 +69,10 @@ func TestBitList19(t *testing.T) {
 	if v := bm.Get(14); v != 0b1110010110010110010 {
 		t.Fatal(fmt.Errorf("expect 0b%019b, got 0b%019b", 0b1110010110010110010, v))
 	}
-	if bm.b.Cap() != 128 {
-		t.Fatal("unexpected grow behavior", bm.b.Cap())
-	}
+	capBeforeTighten = bm.b.Cap()
 	bm.Tighten()
-	if bm.b.Cap() != 36 {
-		t.Fatal("failed to tighten", bm.b.Cap())
+	if bm.b.Cap() != bm.b.Len() || bm.b.Cap() > capBeforeTighten {
+		t.Fatal("failed to tighten", bm.b.Cap(), bm.b.Len(), capBeforeTighten)
 	}
 	bm.Set(1, 0b0000000000000000000)
 	if v := bm.Get(1); v != 0b0000000000000000000 {

common/consts/dialer.go

@@ -8,38 +8,55 @@ package consts
 import (
 	"net/netip"
 	"time"
+)
 
-	"golang.org/x/sys/unix"
+// IP protocol numbers from IANA protocol numbers registry.
+const (
+	// IPPROTO_TCP is the IP protocol number for TCP (RFC 793).
+	IPPROTO_TCP = 6
+	// IPPROTO_UDP is the IP protocol number for UDP (RFC 768).
+	IPPROTO_UDP = 17
 )
 
+// DialerSelectionPolicy defines the strategy for selecting a dialer from a group.
 type DialerSelectionPolicy string
 
 const (
-	DialerSelectionPolicy_Random                    DialerSelectionPolicy = "random"
-	DialerSelectionPolicy_Fixed                     DialerSelectionPolicy = "fixed"
-	DialerSelectionPolicy_MinAverage10Latencies     DialerSelectionPolicy = "min_avg10"
+	// DialerSelectionPolicy_Random selects a dialer randomly.
+	DialerSelectionPolicy_Random DialerSelectionPolicy = "random"
+	// DialerSelectionPolicy_Fixed always selects the first dialer.
+	DialerSelectionPolicy_Fixed DialerSelectionPolicy = "fixed"
+	// DialerSelectionPolicy_MinAverage10Latencies selects the dialer with minimum average latency of last 10 checks.
+	DialerSelectionPolicy_MinAverage10Latencies DialerSelectionPolicy = "min_avg10"
+	// DialerSelectionPolicy_MinMovingAverageLatencies selects the dialer with minimum moving average latency.
 	DialerSelectionPolicy_MinMovingAverageLatencies DialerSelectionPolicy = "min_moving_avg"
-	DialerSelectionPolicy_MinLastLatency            DialerSelectionPolicy = "min"
+	// DialerSelectionPolicy_MinLastLatency selects the dialer with minimum last latency.
+	DialerSelectionPolicy_MinLastLatency DialerSelectionPolicy = "min"
 )
 
 const (
+	// UdpCheckLookupHost is the default host used for UDP connectivity checks.
 	UdpCheckLookupHost = "connectivitycheck.gstatic.com."
+	// DefaultDialTimeout is the default timeout for dialing.
 	DefaultDialTimeout = 8 * time.Second
 )
 
+// L4ProtoStr represents a layer 4 protocol as a string.
 type L4ProtoStr string
 
 const (
+	// L4ProtoStr_TCP represents the TCP protocol.
 	L4ProtoStr_TCP L4ProtoStr = "tcp"
+	// L4ProtoStr_UDP represents the UDP protocol.
 	L4ProtoStr_UDP L4ProtoStr = "udp"
 )
 
 func (l L4ProtoStr) ToL4Proto() uint8 {
 	switch l {
 	case L4ProtoStr_TCP:
-		return unix.IPPROTO_TCP
+		return IPPROTO_TCP
 	case L4ProtoStr_UDP:
-		return unix.IPPROTO_IDP
+		return IPPROTO_UDP
 	}
 	panic("unsupported l4proto")
 }
@@ -54,10 +71,13 @@ func (l L4ProtoStr) ToL4ProtoType() L4ProtoType {
 	panic("unsupported l4proto: " + l)
 }
 
+// IpVersionStr represents an IP version as a string.
 type IpVersionStr string
 
 const (
+	// IpVersionStr_4 represents IPv4.
 	IpVersionStr_4 IpVersionStr = "4"
+	// IpVersionStr_6 represents IPv6.
 	IpVersionStr_6 IpVersionStr = "6"
 )
 

common/consts/dialer_test.go

@@ -0,0 +1,39 @@
+package consts
+
+import (
+	"testing"
+)
+
+func TestL4ProtoStr_ToL4Proto(t *testing.T) {
+	tests := []struct {
+		name string
+		l    L4ProtoStr
+		want uint8
+	}{
+		{"TCP", L4ProtoStr_TCP, IPPROTO_TCP},
+		{"UDP", L4ProtoStr_UDP, IPPROTO_UDP},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.l.ToL4Proto(); got != tt.want {
+				t.Errorf("L4ProtoStr.ToL4Proto() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestL4ProtoStr_ToL4ProtoType(t *testing.T) {
+	// Just verify it doesn't panic for known types
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("The code panicked: %v", r)
+		}
+	}()
+
+	if got := L4ProtoStr_TCP.ToL4ProtoType(); got != L4ProtoType_TCP {
+		t.Errorf("Expected TCP, got %v", got)
+	}
+	if got := L4ProtoStr_UDP.ToL4ProtoType(); got != L4ProtoType_UDP {
+		t.Errorf("Expected UDP, got %v", got)
+	}
+}

common/netutils/dns.go

@@ -160,6 +160,9 @@ func ResolveSOA(ctx context.Context, d netproxy.Dialer, dns netip.AddrPort, host
 }
 
 func resolve(ctx context.Context, d netproxy.Dialer, dns netip.AddrPort, host string, typ uint16, network string) (ans []dnsmessage.RR, err error) {
+	if d == nil {
+		return nil, fmt.Errorf("nil dialer")
+	}
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	fqdn := dnsmessage.CanonicalName(host)

common/netutils/ip46_test.go

@@ -17,9 +17,10 @@ import (
 func TestResolveIp46(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
+	direct.InitDirectDialers("223.5.5.5:53")
 	ip46, err4, err6 := ResolveIp46(ctx, direct.SymmetricDirect, netip.MustParseAddrPort("223.5.5.5:53"), "ipv6.google.com", "udp", false)
-	if err4 != nil || err6 != nil {
-		t.Fatal(err4, err6)
+	if err4 != nil && err6 != nil {
+		t.Skipf("network unavailable or DNS blocked in test environment: err4=%v err6=%v", err4, err6)
 	}
 	if !ip46.Ip4.IsValid() && !ip46.Ip6.IsValid() {
 		t.Fatal("No record")

common/utils.go

@@ -427,17 +427,20 @@ func AddrToDnsType(addr netip.Addr) uint16 {
 	}
 }
 
-// Htons converts the unsigned short integer hostshort from host byte order to network byte order.
+// Htons converts the unsigned short integer from host byte order to network byte order (big-endian).
+// This is used when communicating with eBPF programs which expect network byte order.
 func Htons(i uint16) uint16 {
 	b := make([]byte, 2)
 	binary.BigEndian.PutUint16(b, i)
 	return *(*uint16)(unsafe.Pointer(&b[0]))
 }
 
-// Ntohs converts the unsigned short integer hostshort from host byte order to network byte order.
+// Ntohs converts the unsigned short integer from network byte order (big-endian) to host byte order.
+// This is used when reading values from eBPF programs which are in network byte order.
 func Ntohs(i uint16) uint16 {
-	bytes := *(*[2]byte)(unsafe.Pointer(&i))
-	return binary.BigEndian.Uint16(bytes[:])
+	b := make([]byte, 2)
+	internal.NativeEndian.PutUint16(b, i)
+	return binary.BigEndian.Uint16(b)
 }
 
 func GetDefaultIfnames() (defaultIfs []string, err error) {

component/dns/dns.go

@@ -25,8 +25,7 @@ var ErrBadUpstreamFormat = fmt.Errorf("bad upstream format")
 type Dns struct {
 	log              *logrus.Logger
 	upstream         []*UpstreamResolver
-	upstream2IndexMu sync.Mutex
-	upstream2Index   map[*Upstream]int
+	upstream2Index   sync.Map
 	reqMatcher       *RequestMatcher
 	respMatcher      *ResponseMatcher
 }
@@ -41,10 +40,8 @@ type NewOption struct {
 func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) {
 	s = &Dns{
 		log: opt.Logger,
-		upstream2Index: map[*Upstream]int{
-			nil: int(consts.DnsRequestOutboundIndex_AsIs),
-		},
 	}
+	s.upstream2Index.Store((*Upstream)(nil), int(consts.DnsRequestOutboundIndex_AsIs))
 	// Parse upstream.
 	upstreamName2Id := map[string]uint8{}
 	for i, upstreamRaw := range dns.Upstream {
@@ -73,9 +70,7 @@ func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) {
 						}
 					}
 
-					s.upstream2IndexMu.Lock()
-					s.upstream2Index[upstream] = i
-					s.upstream2IndexMu.Unlock()
+					s.upstream2Index.Store(upstream, i)
 					return nil
 				}
 			}(i),
@@ -87,22 +82,25 @@ func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) {
 		s.upstream = append(s.upstream, r)
 	}
 	// Optimize routings.
-	if dns.Routing.Request.Rules, err = routing.ApplyRulesOptimizers(dns.Routing.Request.Rules,
+	requestRules, err := routing.ApplyRulesOptimizers(dns.Routing.Request.Rules,
 		&routing.DatReaderOptimizer{Logger: opt.Logger, LocationFinder: opt.LocationFinder},
 		&routing.MergeAndSortRulesOptimizer{},
 		&routing.DeduplicateParamsOptimizer{},
-	); err != nil {
+	)
+	if err != nil {
 		return nil, err
 	}
-	if dns.Routing.Response.Rules, err = routing.ApplyRulesOptimizers(dns.Routing.Response.Rules,
+
+	responseRules, err := routing.ApplyRulesOptimizers(dns.Routing.Response.Rules,
 		&routing.DatReaderOptimizer{Logger: opt.Logger, LocationFinder: opt.LocationFinder},
 		&routing.MergeAndSortRulesOptimizer{},
 		&routing.DeduplicateParamsOptimizer{},
-	); err != nil {
+	)
+	if err != nil {
 		return nil, err
 	}
 	// Parse request routing.
-	reqMatcherBuilder, err := NewRequestMatcherBuilder(opt.Logger, dns.Routing.Request.Rules, upstreamName2Id, dns.Routing.Request.Fallback)
+	reqMatcherBuilder, err := NewRequestMatcherBuilder(opt.Logger, requestRules, upstreamName2Id, dns.Routing.Request.Fallback)
 	if err != nil {
 		return nil, fmt.Errorf("failed to build DNS request routing: %w", err)
 	}
@@ -111,7 +109,7 @@ func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) {
 		return nil, fmt.Errorf("failed to build DNS request routing: %w", err)
 	}
 	// Parse response routing.
-	respMatcherBuilder, err := NewResponseMatcherBuilder(opt.Logger, dns.Routing.Response.Rules, upstreamName2Id, dns.Routing.Response.Fallback)
+	respMatcherBuilder, err := NewResponseMatcherBuilder(opt.Logger, responseRules, upstreamName2Id, dns.Routing.Response.Fallback)
 	if err != nil {
 		return nil, fmt.Errorf("failed to build DNS response routing: %w", err)
 	}
@@ -207,9 +205,11 @@ func (s *Dns) ResponseSelect(msg *dnsmessage.Msg, fromUpstream *Upstream) (upstr
 		}
 	}
 
-	s.upstream2IndexMu.Lock()
-	from := s.upstream2Index[fromUpstream]
-	s.upstream2IndexMu.Unlock()
+	fromValue, ok := s.upstream2Index.Load(fromUpstream)
+	if !ok {
+		fromValue = int(consts.DnsRequestOutboundIndex_AsIs)
+	}
+	from := fromValue.(int)
 	// Route.
 	upstreamIndex, err = s.respMatcher.Match(qname, qtype, ips, consts.DnsRequestOutboundIndex(from))
 	if err != nil {

component/dns/upstream.go

@@ -175,7 +175,7 @@ func (u *UpstreamResolver) GetUpstream() (_ *Upstream, err error) {
 				u.init = true
 			}
 		}()
-		ctx, cancel := context.WithTimeout(context.TODO(), 10*time.Second)
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 		defer cancel()
 		if u.upstream, err = NewUpstream(ctx, u.Raw, u.Network); err != nil {
 			return nil, fmt.Errorf("failed to init dns upstream: %w", err)

component/outbound/dialer/alive_dialer_set.go

@@ -212,6 +212,7 @@ func (a *AliveDialerSet) NotifyLatencyChange(dialer *Dialer, alive bool) {
 
 	if hasLatency {
 		bakOldBestDialer := a.minLatency.dialer
+		bakOldMinSortingLatency := a.minLatency.sortingLatency
 		// Calc minLatency.
 		a.dialerToLatency[dialer] = rawLatency
 		sortingLatency = a.SortingLatency(dialer)
@@ -222,7 +223,7 @@ func (a *AliveDialerSet) NotifyLatencyChange(dialer *Dialer, alive bool) {
 			a.minLatency.dialer = dialer
 		} else if a.minLatency.dialer == dialer {
 			a.minLatency.sortingLatency = sortingLatency
-			if !alive || sortingLatency > a.minLatency.sortingLatency {
+			if !alive || sortingLatency > bakOldMinSortingLatency {
 				// Latency increases.
 				if !alive {
 					a.minLatency.dialer = nil