magic dns (#813)

This patch implements:

1. A dns server that handles .et.net. zone in local and forward all other queries to system dns server.

2. A dns server instance which is a singleton in one machine, using one specific tcp port to be exclusive with each other. this instance is responsible for config system dns and run the dns server to handle dns queries.

3. A dns client instance that all easytier instance will run one, this instance will try to connect to dns server instance, and update the dns record in the dns server instance.

this pr only implements the system config for windows. linux & mac will do later.

easytier/src/instance/dns_server/client_instance.rs

@@ -0,0 +1,104 @@
+use std::{sync::Arc, time::Duration};
+
+use tokio::task::JoinSet;
+
+use crate::{
+    peers::peer_manager::PeerManager,
+    proto::{
+        cli::Route,
+        common::Void,
+        magic_dns::{
+            HandshakeRequest, MagicDnsServerRpc, MagicDnsServerRpcClientFactory,
+            UpdateDnsRecordRequest,
+        },
+        rpc_impl::standalone::StandAloneClient,
+        rpc_types::controller::BaseController,
+    },
+    tunnel::tcp::TcpTunnelConnector,
+};
+
+use super::{DEFAULT_ET_DNS_ZONE, MAGIC_DNS_INSTANCE_ADDR};
+
+pub struct MagicDnsClientInstance {
+    rpc_client: StandAloneClient<TcpTunnelConnector>,
+    rpc_stub: Option<Box<dyn MagicDnsServerRpc<Controller = BaseController> + Send>>,
+    peer_mgr: Arc<PeerManager>,
+    tasks: JoinSet<()>,
+}
+
+impl MagicDnsClientInstance {
+    pub async fn new(peer_mgr: Arc<PeerManager>) -> Result<Self, anyhow::Error> {
+        let tcp_connector = TcpTunnelConnector::new(MAGIC_DNS_INSTANCE_ADDR.parse().unwrap());
+        let mut rpc_client = StandAloneClient::new(tcp_connector);
+        let rpc_stub = rpc_client
+            .scoped_client::<MagicDnsServerRpcClientFactory<BaseController>>("".to_string())
+            .await?;
+        Ok(MagicDnsClientInstance {
+            rpc_client,
+            rpc_stub: Some(rpc_stub),
+            peer_mgr,
+            tasks: JoinSet::new(),
+        })
+    }
+
+    async fn update_dns_task(
+        peer_mgr: Arc<PeerManager>,
+        rpc_stub: Box<dyn MagicDnsServerRpc<Controller = BaseController> + Send>,
+    ) -> Result<(), anyhow::Error> {
+        let mut prev_last_update = None;
+        rpc_stub
+            .handshake(BaseController::default(), HandshakeRequest::default())
+            .await?;
+        loop {
+            rpc_stub
+                .heartbeat(BaseController::default(), Void::default())
+                .await?;
+
+            let last_update = peer_mgr.get_route_peer_info_last_update_time().await;
+            if Some(last_update) == prev_last_update {
+                tokio::time::sleep(Duration::from_millis(500)).await;
+                continue;
+            }
+            prev_last_update = Some(last_update);
+            let mut routes = peer_mgr.list_routes().await;
+            // add self as a route
+            let ctx = peer_mgr.get_global_ctx();
+            routes.push(Route {
+                hostname: ctx.get_hostname(),
+                ipv4_addr: ctx.get_ipv4().map(Into::into),
+                ..Default::default()
+            });
+            let req = UpdateDnsRecordRequest {
+                routes,
+                zone: DEFAULT_ET_DNS_ZONE.to_string(),
+            };
+            tracing::debug!(
+                "MagicDnsClientInstance::update_dns_task: update dns records: {:?}",
+                req
+            );
+            rpc_stub
+                .update_dns_record(BaseController::default(), req)
+                .await?;
+        }
+    }
+
+    pub async fn run_and_wait(&mut self) {
+        let rpc_stub = self.rpc_stub.take().unwrap();
+        let peer_mgr = self.peer_mgr.clone();
+        self.tasks.spawn(async move {
+            let ret = Self::update_dns_task(peer_mgr, rpc_stub).await;
+            if let Err(e) = ret {
+                tracing::error!("MagicDnsServerInstanceData::run_and_wait: {:?}", e);
+            }
+        });
+
+        tokio::select! {
+            _ = self.tasks.join_next() => {
+                tracing::warn!("MagicDnsServerInstanceData::run_and_wait: dns record update task exited");
+            }
+            _ = self.rpc_client.wait() => {
+                tracing::warn!("MagicDnsServerInstanceData::run_and_wait: rpc client exited");
+            }
+        }
+    }
+}

easytier/src/instance/dns_server/config.rs

@@ -0,0 +1,193 @@
+use hickory_proto::rr;
+use hickory_proto::rr::RData;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::{IpAddr, Ipv4Addr};
+use std::str::FromStr;
+use std::time::Duration;
+
+#[derive(Serialize, Deserialize, Debug, Clone, derive_builder::Builder)]
+pub struct RunConfig {
+    general: GeneralConfig,
+
+    #[builder(default = HashMap::new())]
+    zones: Zone,
+
+    #[builder(default = Vec::new())]
+    #[serde(default)]
+    excluded_forward_nameservers: Vec<IpAddr>,
+}
+
+impl RunConfig {
+    pub fn general(&self) -> &GeneralConfig {
+        &self.general
+    }
+
+    pub fn zones(&self) -> &Zone {
+        &self.zones
+    }
+
+    pub fn excluded_forward_nameservers(&self) -> &Vec<IpAddr> {
+        &self.excluded_forward_nameservers
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, derive_builder::Builder)]
+pub struct GeneralConfig {
+    #[builder(setter(into, strip_option), default = None)]
+    listen_tcp: Option<String>,
+
+    #[builder(setter(into, strip_option), default = None)]
+    listen_udp: Option<String>,
+}
+
+impl GeneralConfig {
+    pub fn listen_tcp(&self) -> &Option<String> {
+        &self.listen_tcp
+    }
+
+    pub fn listen_udp(&self) -> &Option<String> {
+        &self.listen_udp
+    }
+}
+
+pub type Zone = HashMap<String, Vec<Record>>; // domain -> records
+
+pub type RecordType = rr::RecordType;
+
+#[derive(Serialize, Deserialize, Debug, Clone, derive_builder::Builder)]
+pub struct Record {
+    #[serde(rename = "type")]
+    rr_type: RecordType,
+
+    name: String,
+    value: String,
+
+    #[serde(with = "humantime_serde")]
+    ttl: Duration,
+}
+
+impl Record {
+    fn name(&self) -> anyhow::Result<rr::Name> {
+        let name = rr::Name::from_str(self.name.as_str())?;
+        Ok(name)
+    }
+
+    fn rr_type(&self) -> rr::RecordType {
+        self.rr_type.clone().into()
+    }
+}
+
+impl TryFrom<Record> for rr::Record {
+    type Error = anyhow::Error;
+
+    fn try_from(value: Record) -> Result<Self, Self::Error> {
+        let r: rr::Record = (&value).try_into()?;
+        Ok(r)
+    }
+}
+
+impl TryFrom<&Record> for rr::Record {
+    type Error = anyhow::Error;
+
+    fn try_from(value: &Record) -> Result<Self, Self::Error> {
+        let name = value.name()?;
+        let mut record = Self::update0(name, value.ttl.as_secs() as u32, value.rr_type());
+        record.set_dns_class(rr::DNSClass::IN);
+        match value.rr_type {
+            RecordType::A => {
+                let addr: Ipv4Addr = value.value.parse()?;
+                record.set_data(RData::A(rr::rdata::a::A(addr)));
+            }
+            RecordType::SOA => {
+                let soa = value.value.split_whitespace().collect::<Vec<_>>();
+                if soa.len() != 7 {
+                    return Err(anyhow::anyhow!("invalid SOA record"));
+                }
+                let mname = rr::Name::from_str(soa[0])?;
+                let rname = rr::Name::from_str(soa[1])?;
+                let serial: u32 = soa[2].parse()?;
+                let refresh: u32 = soa[3].parse()?;
+                let retry: u32 = soa[4].parse()?;
+                let expire: u32 = soa[5].parse()?;
+                let minimum: u32 = soa[6].parse()?;
+                record.set_data(RData::SOA(rr::rdata::soa::SOA::new(
+                    mname,
+                    rname,
+                    serial,
+                    refresh.try_into().unwrap(),
+                    retry.try_into().unwrap(),
+                    expire.try_into().unwrap(),
+                    minimum,
+                )));
+            }
+            _ => todo!(),
+        }
+        Ok(record)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use anyhow::anyhow;
+
+    #[tokio::test]
+    async fn it_works() -> anyhow::Result<()> {
+        let text = r#"
+[general]
+listen_tcp = "127.0.0.1:5300"
+listen_udp = "127.0.0.1:5353"
+
+[[zones."et.internal"]]
+type = "A"
+name = "www"
+value = "123.123.123.123"
+ttl = "60s"
+
+[[zones."et.top"]]
+type = "A"
+name = "@"
+value = "100.100.100.100"
+ttl = "61s"
+
+"#;
+
+        let config = toml::from_str::<RunConfig>(text)?;
+        assert_eq!(
+            config.general.listen_tcp().clone().unwrap(),
+            "127.0.0.1:5300"
+        );
+        assert_eq!(
+            config.general.listen_udp().clone().unwrap(),
+            "127.0.0.1:5353"
+        );
+        assert_eq!(config.zones.len(), 2);
+
+        let (domain, records) = config
+            .zones
+            .get_key_value("et.internal")
+            .map_or(Err(anyhow!("parse error")), |x| Ok(x))?;
+        assert_eq!(domain, "et.internal");
+        assert_eq!(records.len(), 1);
+        let record = &records[0];
+        assert_eq!(record.rr_type, RecordType::A);
+        assert_eq!(record.name, "www");
+        assert_eq!(record.value, "123.123.123.123");
+        assert_eq!(record.ttl.as_secs(), 60);
+
+        let (domain, records) = config
+            .zones
+            .get_key_value("et.top")
+            .map_or(Err(anyhow!("parse error")), |x| Ok(x))?;
+        assert_eq!(domain, "et.top");
+        assert_eq!(records.len(), 1);
+        let record = &records[0];
+        assert_eq!(record.rr_type, RecordType::A);
+        assert_eq!(record.name, "@");
+        assert_eq!(record.value, "100.100.100.100");
+        assert_eq!(record.ttl.as_secs(), 61);
+
+        Ok(())
+    }
+}

easytier/src/instance/dns_server/mod.rs

@@ -0,0 +1,15 @@
+// This module is copy and modified from https://github.com/fanyang89/libdns
+pub(crate) mod config;
+pub(crate) mod server;
+
+pub mod client_instance;
+pub mod runner;
+pub mod server_instance;
+pub mod system_config;
+
+#[cfg(test)]
+mod tests;
+
+pub static MAGIC_DNS_INSTANCE_ADDR: &str = "tcp://127.0.0.1:49813";
+pub static MAGIC_DNS_FAKE_IP: &str = "100.100.100.101";
+pub static DEFAULT_ET_DNS_ZONE: &str = "et.net.";

easytier/src/instance/dns_server/runner.rs

@@ -0,0 +1,93 @@
+use cidr::Ipv4Inet;
+use tokio_util::sync::CancellationToken;
+
+use crate::peers::peer_manager::PeerManager;
+use std::{net::Ipv4Addr, sync::Arc, time::Duration};
+
+use super::{client_instance::MagicDnsClientInstance, server_instance::MagicDnsServerInstance};
+
+static DEFAULT_ET_DNS_ZONE: &str = "et.net.";
+
+pub struct DnsRunner {
+    client: Option<MagicDnsClientInstance>,
+    server: Option<MagicDnsServerInstance>,
+    peer_mgr: Arc<PeerManager>,
+    tun_dev: Option<String>,
+    tun_inet: Ipv4Inet,
+    fake_ip: Ipv4Addr,
+}
+
+impl DnsRunner {
+    pub fn new(
+        peer_mgr: Arc<PeerManager>,
+        tun_dev: Option<String>,
+        tun_inet: Ipv4Inet,
+        fake_ip: Ipv4Addr,
+    ) -> Self {
+        Self {
+            client: None,
+            server: None,
+            peer_mgr,
+            tun_dev,
+            tun_inet,
+            fake_ip,
+        }
+    }
+
+    async fn clean_env(&mut self) {
+        if let Some(server) = self.server.take() {
+            server.clean_env().await;
+        }
+        self.client.take();
+    }
+
+    async fn run_once(&mut self) -> anyhow::Result<()> {
+        // try server first
+        match MagicDnsServerInstance::new(
+            self.peer_mgr.clone(),
+            self.tun_dev.clone(),
+            self.tun_inet,
+            self.fake_ip,
+        )
+        .await
+        {
+            Ok(server) => {
+                self.server = Some(server);
+                tracing::info!("DnsRunner::run_once: server started");
+            }
+            Err(e) => {
+                tracing::error!("DnsRunner::run_once: {:?}", e);
+            }
+        }
+
+        // every runner must run a client
+        let client = MagicDnsClientInstance::new(self.peer_mgr.clone()).await?;
+        self.client = Some(client);
+        self.client.as_mut().unwrap().run_and_wait().await;
+
+        return Err(anyhow::anyhow!("Client instance exit"));
+    }
+
+    pub async fn run(&mut self, canel_token: CancellationToken) {
+        loop {
+            tracing::info!("DnsRunner::run: start");
+            tokio::select! {
+                _ = canel_token.cancelled() => {
+                    self.clean_env().await;
+                    tracing::info!("DnsRunner::run: cancelled");
+                    return;
+                }
+
+                ret = self.run_once() => {
+                    self.clean_env().await;
+                    if let Err(e) = ret {
+                        tracing::error!("DnsRunner::run: {:?}", e);
+                    } else {
+                        tracing::info!("DnsRunner::run: unexpected exit, server may be down");
+                    }
+                    tokio::time::sleep(Duration::from_millis(500)).await;
+                }
+            }
+        }
+    }
+}

easytier/src/instance/dns_server/server.rs

@@ -0,0 +1,338 @@
+use anyhow::{Context, Result};
+use hickory_proto::op::Edns;
+use hickory_proto::rr;
+use hickory_proto::rr::LowerName;
+use hickory_resolver::config::ResolverOpts;
+use hickory_resolver::name_server::TokioConnectionProvider;
+use hickory_resolver::system_conf::read_system_conf;
+use hickory_server::authority::{AuthorityObject, Catalog, ZoneType};
+use hickory_server::server::{Request, RequestHandler, ResponseHandler, ResponseInfo};
+use hickory_server::store::forwarder::ForwardConfig;
+use hickory_server::store::{forwarder::ForwardAuthority, in_memory::InMemoryAuthority};
+use hickory_server::ServerFuture;
+use std::io;
+use std::net::SocketAddr;
+use std::str::FromStr;
+use std::sync::Arc;
+use std::time::Duration;
+use tokio::net::{TcpListener, UdpSocket};
+use tokio::sync::{RwLock, RwLockReadGuard, RwLockWriteGuard};
+use tokio::task::JoinSet;
+
+use crate::common::stun::get_default_resolver_config;
+
+use super::config::{GeneralConfig, Record, RunConfig};
+
+pub struct Server {
+    server: ServerFuture<CatalogRequestHandler>,
+    catalog: Arc<RwLock<Catalog>>,
+    general_config: GeneralConfig,
+    udp_local_addr: Option<SocketAddr>,
+    tcp_local_addr: Option<SocketAddr>,
+    tasks: JoinSet<()>,
+}
+
+struct CatalogRequestHandler {
+    catalog: Arc<RwLock<Catalog>>,
+}
+
+impl CatalogRequestHandler {
+    fn new(catalog: Arc<RwLock<Catalog>>) -> CatalogRequestHandler {
+        // let system_conf = read_system_conf();
+        // let recursor = match system_conf {
+        //     Ok((conf, _)) => RecursorBuilder::default().build(conf),
+        //     Err(_) => RecursorBuilder::default().build(get_default_resolver_config()),
+        // }
+        // // policy is security unware, this will never return an error
+        // .unwrap();
+
+        Self { catalog }
+    }
+}
+
+#[async_trait::async_trait]
+impl RequestHandler for CatalogRequestHandler {
+    async fn handle_request<R: ResponseHandler>(
+        &self,
+        request: &Request,
+        response_handle: R,
+    ) -> ResponseInfo {
+        self.catalog
+            .read()
+            .await
+            .handle_request(request, response_handle)
+            .await
+    }
+}
+
+pub fn build_authority(domain: &str, records: &[Record]) -> Result<InMemoryAuthority> {
+    let zone = rr::Name::from_str(domain)?;
+    let mut authority = InMemoryAuthority::empty(zone.clone(), ZoneType::Primary, false);
+    for record in records.iter() {
+        let r = record.try_into()?;
+        authority.upsert_mut(r, 0);
+    }
+    Ok(authority)
+}
+
+impl Server {
+    pub fn new(config: RunConfig) -> Self {
+        Self::try_new(config).unwrap()
+    }
+
+    fn try_new(config: RunConfig) -> Result<Self> {
+        let mut catalog = Catalog::new();
+        for (domain, records) in config.zones().iter() {
+            let zone = rr::Name::from_str(domain.as_str())?;
+            let authroty = build_authority(domain, records)?;
+            catalog.upsert(zone.clone().into(), vec![Arc::new(authroty)]);
+        }
+
+        // use forwarder authority for the root zone
+        let system_conf =
+            read_system_conf().unwrap_or((get_default_resolver_config(), ResolverOpts::default()));
+        let forward_config = ForwardConfig {
+            name_servers: system_conf
+                .0
+                .name_servers()
+                .iter()
+                .cloned()
+                .filter(|x| {
+                    !config
+                        .excluded_forward_nameservers()
+                        .contains(&x.socket_addr.ip())
+                })
+                .collect::<Vec<_>>()
+                .into(),
+            options: Some(system_conf.1),
+        };
+        let auth = ForwardAuthority::builder_with_config(
+            forward_config,
+            TokioConnectionProvider::default(),
+        )
+        .build()
+        .unwrap();
+
+        catalog.upsert(rr::Name::from_str(".")?.into(), vec![Arc::new(auth)]);
+
+        let catalog = Arc::new(RwLock::new(catalog));
+        let handler = CatalogRequestHandler::new(catalog.clone());
+        let server = ServerFuture::new(handler);
+
+        Ok(Self {
+            server,
+            catalog,
+            general_config: config.general().clone(),
+            udp_local_addr: None,
+            tcp_local_addr: None,
+            tasks: JoinSet::new(),
+        })
+    }
+
+    pub fn udp_local_addr(&self) -> Option<SocketAddr> {
+        self.udp_local_addr
+    }
+
+    pub fn tcp_local_addr(&self) -> Option<SocketAddr> {
+        self.tcp_local_addr
+    }
+
+    pub async fn register_udp_socket(&mut self, address: String) -> Result<SocketAddr> {
+        let bind_addr = SocketAddr::from_str(&address)
+            .with_context(|| format!("DNS Server failed to parse address {}", address))?;
+        let socket = socket2::Socket::new(
+            socket2::Domain::IPV4,
+            socket2::Type::DGRAM,
+            Some(socket2::Protocol::UDP),
+        )
+        .with_context(|| {
+            format!(
+                "DNS Server failed to create UDP socket for address {}",
+                address.to_string()
+            )
+        })?;
+        socket2::SockRef::from(&socket)
+            .set_reuse_address(true)
+            .with_context(|| {
+                format!(
+                    "DNS Server failed to set reuse address on socket {}",
+                    address.to_string()
+                )
+            })?;
+        socket.bind(&bind_addr.into()).with_context(|| {
+            format!("DNS Server failed to bind socket to address {}", bind_addr)
+        })?;
+        socket
+            .set_nonblocking(true)
+            .with_context(|| format!("DNS Server failed to set socket to non-blocking"))?;
+        let socket = UdpSocket::from_std(socket.into()).with_context(|| {
+            format!(
+                "DNS Server failed to convert socket to UdpSocket for address {}",
+                address.to_string()
+            )
+        })?;
+
+        let local_addr = socket
+            .local_addr()
+            .with_context(|| format!("DNS Server failed to get local address"))?;
+        self.server.register_socket(socket);
+
+        Ok(local_addr)
+    }
+
+    pub async fn run(&mut self) -> Result<()> {
+        if let Some(address) = self.general_config.listen_tcp() {
+            let tcp_listener = TcpListener::bind(address.clone())
+                .await
+                .with_context(|| format!("DNS Server failed to bind TCP address {}", address))?;
+            self.tcp_local_addr = Some(tcp_listener.local_addr()?);
+            self.server
+                .register_listener(tcp_listener, Duration::from_secs(5));
+        }
+
+        if let Some(address) = self.general_config.listen_udp() {
+            let local_addr = self.register_udp_socket(address.clone()).await?;
+            self.udp_local_addr = Some(local_addr);
+        };
+
+        Ok(())
+    }
+
+    pub async fn shutdown(&mut self) -> Result<()> {
+        self.server.shutdown_gracefully().await?;
+        Ok(())
+    }
+
+    pub async fn upsert(&self, name: LowerName, authority: Arc<dyn AuthorityObject>) {
+        self.catalog.write().await.upsert(name, vec![authority]);
+    }
+
+    pub async fn remove(&self, name: &LowerName) -> Option<Vec<Arc<dyn AuthorityObject>>> {
+        self.catalog.write().await.remove(name)
+    }
+
+    pub async fn update<R: ResponseHandler>(
+        &self,
+        update: &Request,
+        response_edns: Option<Edns>,
+        response_handle: R,
+    ) -> io::Result<ResponseInfo> {
+        self.catalog
+            .write()
+            .await
+            .update(update, response_edns, response_handle)
+            .await
+    }
+
+    pub async fn contains(&self, name: &LowerName) -> bool {
+        self.catalog.read().await.contains(name)
+    }
+
+    pub async fn lookup<R: ResponseHandler>(
+        &self,
+        request: &Request,
+        response_edns: Option<Edns>,
+        response_handle: R,
+    ) -> ResponseInfo {
+        self.catalog
+            .read()
+            .await
+            .lookup(request, response_edns, response_handle)
+            .await
+    }
+
+    pub async fn read_catalog(&self) -> RwLockReadGuard<'_, Catalog> {
+        self.catalog.read().await
+    }
+
+    pub async fn write_catalog(&self) -> RwLockWriteGuard<'_, Catalog> {
+        self.catalog.write().await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::instance::dns_server::config::{
+        GeneralConfigBuilder, RecordBuilder, RecordType, RunConfigBuilder,
+    };
+    use anyhow::Result;
+    use hickory_client::client::{Client, ClientHandle};
+    use hickory_proto::rr;
+    use hickory_proto::runtime::TokioRuntimeProvider;
+    use hickory_proto::udp::UdpClientStream;
+    use maplit::hashmap;
+    use std::time::Duration;
+
+    #[tokio::test]
+    async fn it_works() -> Result<()> {
+        let mut server = Server::new(
+            RunConfigBuilder::default()
+                .general(GeneralConfigBuilder::default().build()?)
+                .build()?,
+        );
+        server.run().await?;
+        server.shutdown().await?;
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn can_resolve_records() -> Result<()> {
+        let configured_record = RecordBuilder::default()
+            .rr_type(RecordType::A)
+            .name("www.et.internal.".to_string())
+            .value("123.123.123.123".to_string())
+            .ttl(Duration::from_secs(60))
+            .build()?;
+        let configured_record2 = RecordBuilder::default()
+            .rr_type(RecordType::A)
+            .name("中文.et.internal.".to_string())
+            .value("123.123.123.123".to_string())
+            .ttl(Duration::from_secs(60))
+            .build()?;
+        let soa_record = RecordBuilder::default()
+            .rr_type(RecordType::SOA)
+            .name("et.internal.".to_string())
+            .value(
+                "ns.et.internal. hostmaster.et.internal. 2023101001 7200 3600 1209600 86400"
+                    .to_string(),
+            )
+            .ttl(Duration::from_secs(60))
+            .build()?;
+        let config = RunConfigBuilder::default()
+            .general(
+                GeneralConfigBuilder::default()
+                    .listen_udp("127.0.0.1:0")
+                    .build()?,
+            )
+            .zones(hashmap! {
+                "et.internal.".to_string() => vec![configured_record.clone(), soa_record.clone(), configured_record2.clone()],
+            })
+            .build()?;
+
+        let mut server = Server::new(config);
+        server.run().await?;
+
+        let local_addr = server.udp_local_addr().unwrap();
+        let stream = UdpClientStream::builder(local_addr, TokioRuntimeProvider::default()).build();
+        let (mut client, background) = Client::connect(stream).await?;
+        let background_task = tokio::spawn(background);
+        let response = client
+            .query(
+                rr::Name::from_str("www.et.internal")?,
+                rr::DNSClass::IN,
+                rr::RecordType::A,
+            )
+            .await?;
+        drop(background_task);
+
+        println!("Response: {:?}", response);
+
+        assert_eq!(response.answers().len(), 1);
+        let expected_record: rr::Record = configured_record.try_into()?;
+        assert_eq!(response.answers().first().unwrap(), &expected_record);
+
+        server.shutdown().await?;
+        Ok(())
+    }
+}

easytier/src/instance/dns_server/server_instance.rs

@@ -0,0 +1,414 @@
+// single-instance server in one machine, every easytier instance that has ip address and tun device will try create a server instance.
+
+// magic dns client will connect to this server to update the dns records.
+// magic dns server will add the dns server ip address to the tun device, and forward the dns request to the dns server
+
+// magic dns client will establish a long live tcp connection to the magic dns server, and when the server stops or crashes,
+// all the clients will exit and let the easytier instance to launch a new server instance.
+
+use std::{collections::BTreeMap, net::Ipv4Addr, str::FromStr, sync::Arc, time::Duration};
+
+use anyhow::Context;
+use cidr::Ipv4Inet;
+use dashmap::DashMap;
+use hickory_proto::rr::LowerName;
+use multimap::MultiMap;
+use pnet::packet::{
+    icmp::{self, IcmpTypes, MutableIcmpPacket},
+    ip::IpNextHeaderProtocols,
+    ipv4::{self, MutableIpv4Packet},
+    tcp::{self, MutableTcpPacket},
+    udp::{self, MutableUdpPacket},
+    MutablePacket,
+};
+
+use crate::{
+    common::{
+        ifcfg::{IfConfiger, IfConfiguerTrait},
+        PeerId,
+    },
+    instance::dns_server::{
+        config::{Record, RecordBuilder, RecordType},
+        server::build_authority,
+        DEFAULT_ET_DNS_ZONE,
+    },
+    peers::{peer_manager::PeerManager, NicPacketFilter},
+    proto::{
+        cli::Route,
+        common::{TunnelInfo, Void},
+        magic_dns::{
+            dns_record::{self},
+            DnsRecord, DnsRecordA, DnsRecordList, GetDnsRecordResponse, HandshakeRequest,
+            HandshakeResponse, MagicDnsServerRpc, MagicDnsServerRpcServer, UpdateDnsRecordRequest,
+        },
+        rpc_impl::standalone::{RpcServerHook, StandAloneServer},
+        rpc_types::controller::{BaseController, Controller},
+    },
+    tunnel::{packet_def::ZCPacket, tcp::TcpTunnelListener},
+};
+
+use super::{
+    config::{GeneralConfigBuilder, RunConfigBuilder},
+    server::Server,
+    MAGIC_DNS_INSTANCE_ADDR,
+};
+
+static NIC_PIPELINE_NAME: &str = "magic_dns_server";
+
+pub(super) struct MagicDnsServerInstanceData {
+    dns_server: Server,
+    tun_dev: Option<String>,
+    tun_ip: Ipv4Addr,
+    fake_ip: Ipv4Addr,
+    my_peer_id: PeerId,
+
+    // zone -> (tunnel remote addr -> route)
+    route_infos: DashMap<String, MultiMap<url::Url, Route>>,
+}
+
+impl MagicDnsServerInstanceData {
+    pub async fn update_dns_records<'a, T: Iterator<Item = &'a Route>>(
+        &self,
+        routes: T,
+        zone: &str,
+    ) -> Result<(), anyhow::Error> {
+        let mut records: Vec<Record> = vec![];
+        for route in routes {
+            if route.hostname.is_empty() {
+                continue;
+            }
+
+            let Some(ipv4_addr) = route.ipv4_addr.unwrap_or_default().address else {
+                continue;
+            };
+
+            let record = RecordBuilder::default()
+                .rr_type(RecordType::A)
+                .name(format!("{}.{}", route.hostname, zone))
+                .value(ipv4_addr.to_string())
+                .ttl(Duration::from_secs(1))
+                .build()?;
+
+            records.push(record);
+        }
+
+        let soa_record = RecordBuilder::default()
+            .rr_type(RecordType::SOA)
+            .name(zone.to_string())
+            .value(format!(
+                "ns.{} hostmaster.{} 2023101001 7200 3600 1209600 86400",
+                zone, zone
+            ))
+            .ttl(Duration::from_secs(60))
+            .build()?;
+        records.push(soa_record);
+
+        let authority = build_authority(zone, &records)?;
+
+        self.dns_server
+            .upsert(
+                LowerName::from_str(zone)
+                    .with_context(|| "Invalid zone name, expect fomat like \"et.net.\"")?,
+                Arc::new(authority),
+            )
+            .await;
+
+        tracing::debug!("Updated DNS records for zone {}: {:?}", zone, records);
+
+        Ok(())
+    }
+
+    pub async fn update(&self) {
+        for item in self.route_infos.iter() {
+            let zone = item.key();
+            let route_iter = item.value().flat_iter().map(|x| x.1);
+            if let Err(e) = self.update_dns_records(route_iter, zone).await {
+                tracing::error!("Failed to update DNS records for zone {}: {:?}", zone, e);
+            }
+        }
+    }
+
+    fn do_system_config(&self, _zone: &str) -> Result<(), anyhow::Error> {
+        #[cfg(target_os = "windows")]
+        {
+            use super::system_config::windows::WindowsDNSManager;
+            let cfg = WindowsDNSManager::new(self.tun_dev.as_ref().unwrap())?;
+            cfg.set_primary_dns(&[self.fake_ip.clone().into()], &[_zone.to_string()])?;
+        }
+
+        Ok(())
+    }
+}
+
+#[async_trait::async_trait]
+impl MagicDnsServerRpc for MagicDnsServerInstanceData {
+    type Controller = BaseController;
+    async fn handshake(
+        &self,
+        _ctrl: Self::Controller,
+        _input: HandshakeRequest,
+    ) -> crate::proto::rpc_types::error::Result<HandshakeResponse> {
+        Ok(Default::default())
+    }
+
+    async fn update_dns_record(
+        &self,
+        ctrl: Self::Controller,
+        input: UpdateDnsRecordRequest,
+    ) -> crate::proto::rpc_types::error::Result<Void> {
+        let Some(tunnel_info) = ctrl.get_tunnel_info() else {
+            return Err(anyhow::anyhow!("No tunnel info").into());
+        };
+        let Some(remote_addr) = &tunnel_info.remote_addr else {
+            return Err(anyhow::anyhow!("No remote addr").into());
+        };
+        let zone = input.zone.clone();
+        self.route_infos
+            .entry(zone.clone())
+            .or_default()
+            .insert_many(remote_addr.clone().into(), input.routes);
+
+        self.update().await;
+        Ok(Default::default())
+    }
+
+    async fn get_dns_record(
+        &self,
+        _ctrl: Self::Controller,
+        _input: Void,
+    ) -> crate::proto::rpc_types::error::Result<GetDnsRecordResponse> {
+        let mut ret = BTreeMap::new();
+        for item in self.route_infos.iter() {
+            let zone = item.key();
+            let routes = item.value();
+            let mut dns_records = DnsRecordList::default();
+            for route in routes.iter().map(|x| x.1) {
+                dns_records.records.push(DnsRecord {
+                    record: Some(dns_record::Record::A(DnsRecordA {
+                        name: format!("{}.{}", route.hostname, zone),
+                        value: route.ipv4_addr.unwrap_or_default().address,
+                        ttl: 1,
+                    })),
+                });
+            }
+            ret.insert(zone.clone(), dns_records);
+        }
+        Ok(GetDnsRecordResponse { records: ret })
+    }
+
+    async fn heartbeat(
+        &self,
+        _ctrl: Self::Controller,
+        _input: Void,
+    ) -> crate::proto::rpc_types::error::Result<Void> {
+        Ok(Default::default())
+    }
+}
+
+#[async_trait::async_trait]
+impl NicPacketFilter for MagicDnsServerInstanceData {
+    async fn try_process_packet_from_nic(&self, zc_packet: &mut ZCPacket) -> bool {
+        let data = zc_packet.mut_payload();
+        let mut ip_packet = MutableIpv4Packet::new(data).unwrap();
+        if ip_packet.get_version() != 4 || ip_packet.get_destination() != self.fake_ip {
+            return false;
+        }
+
+        match ip_packet.get_next_level_protocol() {
+            IpNextHeaderProtocols::Udp => {
+                let Some(dns_udp_addr) = self.dns_server.udp_local_addr() else {
+                    return false;
+                };
+
+                let Some(mut udp_packet) = MutableUdpPacket::new(ip_packet.payload_mut()) else {
+                    return false;
+                };
+                if udp_packet.get_destination() == 53 {
+                    // for dns request
+                    udp_packet.set_destination(dns_udp_addr.port());
+                } else if udp_packet.get_source() == dns_udp_addr.port() {
+                    // for dns response
+                    udp_packet.set_source(53);
+                } else {
+                    return false;
+                }
+                udp_packet.set_checksum(udp::ipv4_checksum(
+                    &udp_packet.to_immutable(),
+                    &self.fake_ip,
+                    &self.tun_ip,
+                ));
+            }
+
+            IpNextHeaderProtocols::Tcp => {
+                let Some(dns_tcp_addr) = self.dns_server.tcp_local_addr() else {
+                    return false;
+                };
+
+                let Some(mut tcp_packet) = MutableTcpPacket::new(ip_packet.payload_mut()) else {
+                    return false;
+                };
+                if tcp_packet.get_destination() == 53 {
+                    // for dns request
+                    tcp_packet.set_destination(dns_tcp_addr.port());
+                } else if tcp_packet.get_source() == dns_tcp_addr.port() {
+                    // for dns response
+                    tcp_packet.set_source(53);
+                } else {
+                    return false;
+                }
+                tcp_packet.set_checksum(tcp::ipv4_checksum(
+                    &tcp_packet.to_immutable(),
+                    &self.fake_ip,
+                    &self.tun_ip,
+                ));
+            }
+
+            IpNextHeaderProtocols::Icmp => {
+                let Some(mut icmp_packet) = MutableIcmpPacket::new(ip_packet.payload_mut()) else {
+                    return false;
+                };
+                if icmp_packet.get_icmp_type() != IcmpTypes::EchoRequest {
+                    return false;
+                }
+                icmp_packet.set_icmp_type(IcmpTypes::EchoReply);
+                icmp_packet.set_checksum(icmp::checksum(&icmp_packet.to_immutable()));
+            }
+
+            _ => {
+                return false;
+            }
+        }
+
+        ip_packet.set_source(self.fake_ip);
+        ip_packet.set_destination(self.tun_ip);
+
+        ip_packet.set_checksum(ipv4::checksum(&ip_packet.to_immutable()));
+        zc_packet.mut_peer_manager_header().unwrap().to_peer_id = self.my_peer_id.into();
+
+        true
+    }
+
+    fn id(&self) -> String {
+        NIC_PIPELINE_NAME.to_string()
+    }
+}
+
+#[async_trait::async_trait]
+impl RpcServerHook for MagicDnsServerInstanceData {
+    async fn on_new_client(&self, tunnel_info: Option<TunnelInfo>) {
+        println!("New client connected: {:?}", tunnel_info);
+    }
+
+    async fn on_client_disconnected(&self, tunnel_info: Option<TunnelInfo>) {
+        println!("Client disconnected: {:?}", tunnel_info);
+        let Some(tunnel_info) = tunnel_info else {
+            return;
+        };
+        let Some(remote_addr) = tunnel_info.remote_addr else {
+            return;
+        };
+        let remote_addr = remote_addr.into();
+        for mut item in self.route_infos.iter_mut() {
+            item.value_mut().remove(&remote_addr);
+        }
+        self.route_infos.retain(|_, v| !v.is_empty());
+        self.update().await;
+    }
+}
+
+pub struct MagicDnsServerInstance {
+    rpc_server: StandAloneServer<TcpTunnelListener>,
+    pub(super) data: Arc<MagicDnsServerInstanceData>,
+    peer_mgr: Arc<PeerManager>,
+    tun_inet: Ipv4Inet,
+}
+
+impl MagicDnsServerInstance {
+    pub async fn new(
+        peer_mgr: Arc<PeerManager>,
+        tun_dev: Option<String>,
+        tun_inet: Ipv4Inet,
+        fake_ip: Ipv4Addr,
+    ) -> Result<Self, anyhow::Error> {
+        let tcp_listener = TcpTunnelListener::new(MAGIC_DNS_INSTANCE_ADDR.parse().unwrap());
+        let mut rpc_server = StandAloneServer::new(tcp_listener);
+        rpc_server.serve().await?;
+
+        let bind_addr = tun_inet.address();
+
+        let dns_config = RunConfigBuilder::default()
+            .general(
+                GeneralConfigBuilder::default()
+                    .listen_udp(format!("{}:0", bind_addr))
+                    .listen_tcp(format!("{}:0", bind_addr))
+                    .build()
+                    .unwrap(),
+            )
+            .excluded_forward_nameservers(vec![fake_ip.into()])
+            .build()
+            .unwrap();
+        let mut dns_server = Server::new(dns_config);
+        dns_server.run().await?;
+
+        if !tun_inet.contains(&fake_ip) && tun_dev.is_some() {
+            let cost = if cfg!(target_os = "windows") {
+                Some(4)
+            } else {
+                None
+            };
+            let ifcfg = IfConfiger {};
+            ifcfg
+                .add_ipv4_route(tun_dev.as_ref().unwrap(), fake_ip, 32, cost)
+                .await?;
+        }
+
+        let data = Arc::new(MagicDnsServerInstanceData {
+            dns_server,
+            tun_dev,
+            tun_ip: tun_inet.address(),
+            fake_ip,
+            my_peer_id: peer_mgr.my_peer_id(),
+            route_infos: DashMap::new(),
+        });
+        rpc_server
+            .registry()
+            .register(MagicDnsServerRpcServer::new(data.clone()), "");
+        rpc_server.set_hook(data.clone());
+
+        peer_mgr
+            .add_nic_packet_process_pipeline(Box::new(data.clone()))
+            .await;
+
+        let data_clone = data.clone();
+        tokio::task::spawn_blocking(move || data_clone.do_system_config(DEFAULT_ET_DNS_ZONE))
+            .await
+            .context("Failed to configure system")??;
+
+        Ok(Self {
+            rpc_server,
+            data,
+            peer_mgr,
+            tun_inet,
+        })
+    }
+
+    pub async fn clean_env(&self) {
+        if !self.tun_inet.contains(&self.data.fake_ip) && self.data.tun_dev.is_some() {
+            let ifcfg = IfConfiger {};
+            let _ = ifcfg
+                .remove_ipv4_route(&self.data.tun_dev.as_ref().unwrap(), self.data.fake_ip, 32)
+                .await;
+        }
+
+        let _ = self
+            .peer_mgr
+            .remove_nic_packet_process_pipeline(NIC_PIPELINE_NAME.to_string())
+            .await;
+    }
+}
+
+impl Drop for MagicDnsServerInstance {
+    fn drop(&mut self) {
+        println!("MagicDnsServerInstance dropped");
+    }
+}

easytier/src/instance/dns_server/system_config/linux.rs

@@ -0,0 +1,357 @@
+// translated from tailscale #32ce1bdb48078ec4cedaeeb5b1b2ff9c0ef61a49
+
+use crate::defer;
+use anyhow::{Context, Result};
+use dbus::blocking::stdintf::org_freedesktop_dbus::Properties as _;
+use std::fs;
+use std::net::Ipv4Addr;
+use std::path::Path;
+use std::process::Command;
+use std::time::Duration;
+use version_compare::Cmp;
+
+// 声明依赖项（需要添加到Cargo.toml）
+// use dbus::blocking::Connection;
+// use nix::unistd::AccessFlags;
+// use resolv_conf::Resolver;
+
+// 常量定义
+const RESOLV_CONF: &str = "/etc/resolv.conf";
+const PING_TIMEOUT: Duration = Duration::from_secs(1);
+
+// 错误类型定义
+#[derive(Debug)]
+struct DNSConfigError {
+    message: String,
+    source: Option<anyhow::Error>,
+}
+
+// 配置环境结构体
+struct OSConfigEnv {
+    fs: Box<dyn FileSystem>,
+    dbus_ping: Box<dyn Fn(&str, &str) -> Result<()>>,
+    dbus_read_string: Box<dyn Fn(&str, &str, &str, &str) -> Result<String>>,
+    nm_is_using_resolved: Box<dyn Fn() -> Result<()>>,
+    nm_version_between: Box<dyn Fn(&str, &str) -> Result<bool>>,
+    resolvconf_style: Box<dyn Fn() -> String>,
+}
+
+// DNS管理器trait
+trait OSConfigurator: Send + Sync {
+    // 实现相关方法
+}
+
+// 文件系统操作trait
+trait FileSystem {
+    fn read_file(&self, path: &str) -> Result<Vec<u8>>;
+    fn exists(&self, path: &str) -> bool;
+}
+
+// 直接文件系统实现
+struct DirectFS;
+
+impl FileSystem for DirectFS {
+    fn read_file(&self, path: &str) -> Result<Vec<u8>> {
+        fs::read(path).context("Failed to read file")
+    }
+
+    fn exists(&self, path: &str) -> bool {
+        Path::new(path).exists()
+    }
+}
+
+/// 检查 NetworkManager 是否使用 systemd-resolved 作为 DNS 管理器
+pub fn nm_is_using_resolved() -> Result<()> {
+    // 连接系统 D-Bus
+    let conn = dbus::blocking::Connection::new_system().context("Failed to connect to D-Bus")?;
+
+    // 创建 NetworkManager DnsManager 对象代理
+    let proxy = conn.with_proxy(
+        "org.freedesktop.NetworkManager",
+        "/org/freedesktop/NetworkManager/DnsManager",
+        std::time::Duration::from_secs(1),
+    );
+
+    // 获取 Mode 属性
+    let (value,): (dbus::arg::Variant<Box<dyn dbus::arg::RefArg + 'static>>,) = proxy
+        .method_call(
+            "org.freedesktop.DBus.Properties",
+            "Get",
+            ("org.freedesktop.NetworkManager.DnsManager", "Mode"),
+        )
+        .context("Failed to get NM mode property")?;
+
+    // 检查 Mode 是否为 "systemd-resolved"
+    if value.0.as_str() != Some("systemd-resolved") {
+        return Err(anyhow::anyhow!(
+            "NetworkManager is not using systemd-resolved, found: {:?}",
+            value
+        )
+        .into());
+    }
+
+    Ok(())
+}
+
+/// 返回系统中使用的 resolvconf 实现类型（"debian" 或 "openresolv"）
+pub fn resolvconf_style() -> String {
+    // 检查 resolvconf 命令是否存在
+    if which::which("resolvconf").is_err() {
+        return String::new();
+    }
+
+    // 执行 resolvconf --version 命令
+    let output = match Command::new("resolvconf").arg("--version").output() {
+        Ok(output) => output,
+        Err(e) => {
+            // 处理命令执行错误
+            if let Some(code) = e.raw_os_error() {
+                // Debian 版本的 resolvconf 不支持 --version，返回特定错误码 99
+                if code == 99 {
+                    return "debian".to_string();
+                }
+            }
+            return String::new(); // 其他错误返回空字符串
+        }
+    };
+
+    // 检查输出是否以 "Debian resolvconf" 开头
+    if output.stdout.starts_with(b"Debian resolvconf") {
+        return "debian".to_string();
+    }
+
+    // 默认视为 openresolv
+    "openresolv".to_string()
+}
+
+// 构建配置环境
+fn new_os_config_env() -> OSConfigEnv {
+    OSConfigEnv {
+        fs: Box::new(DirectFS),
+        dbus_ping: Box::new(dbus_ping),
+        dbus_read_string: Box::new(dbus_read_string),
+        nm_is_using_resolved: Box::new(nm_is_using_resolved),
+        nm_version_between: Box::new(nm_version_between),
+        resolvconf_style: Box::new(resolvconf_style),
+    }
+}
+
+// 创建DNS配置器
+fn new_os_configurator(_interface_name: String) -> Result<()> {
+    let env = new_os_config_env();
+
+    let mode = dns_mode(&env).context("Failed to detect DNS mode")?;
+
+    tracing::info!("dns: using {} mode", mode);
+
+    // match mode.as_str() {
+    //     "direct" => Ok(Box::new(DirectManager::new(env.fs)?)),
+    //     // "systemd-resolved" => Ok(Box::new(ResolvedManager::new(
+    //     //     &logf,
+    //     //     health,
+    //     //     interface_name,
+    //     // )?)),
+    //     // "network-manager" => Ok(Box::new(NMManager::new(interface_name)?)),
+    //     // "debian-resolvconf" => Ok(Box::new(DebianResolvconfManager::new(&logf)?)),
+    //     // "openresolv" => Ok(Box::new(OpenresolvManager::new(&logf)?)),
+    //     _ => {
+    //         tracing::warn!("Unexpected DNS mode {}, using direct manager", mode);
+    //         Ok(Box::new(DirectManager::new(env.fs)?))
+    //     }
+    // }
+    Ok(())
+}
+
+use std::io::{self, BufRead, Cursor};
+
+/// 返回 `resolv.conf` 内容的拥有者（"systemd-resolved"、"NetworkManager"、"resolvconf" 或空字符串）
+pub fn resolv_owner(bs: &[u8]) -> String {
+    let mut likely = String::new();
+    let cursor = Cursor::new(bs);
+    let reader = io::BufReader::new(cursor);
+
+    for line_result in reader.lines() {
+        match line_result {
+            Ok(line) => {
+                let line = line.trim();
+                if line.is_empty() {
+                    continue;
+                }
+
+                if !line.starts_with('#') {
+                    // 第一个非注释且非空的行，直接返回当前结果
+                    return likely;
+                }
+
+                // 检查注释行中的关键字
+                if line.contains("systemd-resolved") {
+                    likely = "systemd-resolved".to_string();
+                } else if line.contains("NetworkManager") {
+                    likely = "NetworkManager".to_string();
+                } else if line.contains("resolvconf") {
+                    likely = "resolvconf".to_string();
+                }
+            }
+            Err(_) => {
+                // 读取错误（如无效 UTF-8），直接返回当前结果
+                return likely;
+            }
+        }
+    }
+
+    likely
+}
+
+// 检测DNS模式
+fn dns_mode(env: &OSConfigEnv) -> Result<String> {
+    let debug = std::cell::RefCell::new(Vec::new());
+    let dbg = |k: &str, v: &str| debug.borrow_mut().push((k.to_string(), v.to_string()));
+
+    // defer 日志记录
+    defer! {
+        if !debug.borrow().is_empty() {
+            let log_entries: Vec<String> =
+                debug.borrow().iter().map(|(k, v)| format!("{}={}", k, v)).collect();
+            tracing::info!("dns: [{}]", log_entries.join(" "));
+        }
+    };
+
+    // 检查systemd-resolved状态
+    let resolved_up =
+        (env.dbus_ping)("org.freedesktop.resolve1", "/org/freedesktop/resolve1").is_ok();
+    if resolved_up {
+        dbg("resolved-ping", "yes");
+    }
+
+    // 读取resolv.conf
+    let content = match env.fs.read_file(RESOLV_CONF) {
+        Ok(content) => content,
+        Err(e) if e.to_string().contains("NotFound") => {
+            dbg("rc", "missing");
+            return Ok("direct".to_string());
+        }
+        Err(e) => return Err(e).context("reading /etc/resolv.conf"),
+    };
+
+    // 检查resolv.conf所有者
+    match resolv_owner(&content).as_str() {
+        "systemd-resolved" => {
+            dbg("rc", "resolved");
+            // 检查是否实际使用resolved
+            if let Err(e) = resolved_is_actually_resolver(env, &dbg, &content) {
+                tracing::warn!("resolvedIsActuallyResolver error: {}", e);
+                dbg("resolved", "not-in-use");
+                return Ok("direct".to_string());
+            }
+
+            // NetworkManager检查逻辑...
+
+            Ok("systemd-resolved".to_string())
+        }
+        "resolvconf" => {
+            // resolvconf处理逻辑...
+            Ok("debian-resolvconf".to_string())
+        }
+        "NetworkManager" => {
+            // NetworkManager处理逻辑...
+            Ok("systemd-resolved".to_string())
+        }
+        _ => Ok("direct".to_string()),
+    }
+}
+
+// D-Bus ping实现
+fn dbus_ping(name: &str, object_path: &str) -> Result<()> {
+    let conn = dbus::blocking::Connection::new_system()?;
+    let proxy = conn.with_proxy(name, object_path, PING_TIMEOUT);
+    let _: () = proxy.method_call("org.freedesktop.DBus.Peer", "Ping", ())?;
+    Ok(())
+}
+
+// D-Bus读取字符串实现
+fn dbus_read_string(name: &str, object_path: &str, iface: &str, member: &str) -> Result<String> {
+    let conn = dbus::blocking::Connection::new_system()?;
+    let proxy = conn.with_proxy(name, object_path, PING_TIMEOUT);
+    let (value,): (String,) =
+        proxy.method_call("org.freedesktop.DBus.Properties", "Get", (iface, member))?;
+    Ok(value)
+}
+
+// NetworkManager版本检查
+fn nm_version_between(first: &str, last: &str) -> Result<bool> {
+    let conn = dbus::blocking::Connection::new_system()?;
+    let proxy = conn.with_proxy(
+        "org.freedesktop.NetworkManager",
+        "/org/freedesktop/NetworkManager",
+        PING_TIMEOUT,
+    );
+
+    let version: String = proxy.get("org.freedesktop.NetworkManager", "Version")?;
+    let cmp_first = version_compare::compare(&version, first).unwrap_or(Cmp::Lt);
+    let cmp_last = version_compare::compare(&version, last).unwrap_or(Cmp::Gt);
+    Ok(cmp_first == Cmp::Ge && cmp_last == Cmp::Le)
+}
+
+// 检查是否实际使用systemd-resolved
+fn resolved_is_actually_resolver(
+    env: &OSConfigEnv,
+    dbg: &dyn Fn(&str, &str),
+    content: &[u8],
+) -> Result<()> {
+    if is_libnss_resolve_used(env).is_ok() {
+        dbg("resolved", "nss");
+        return Ok(());
+    }
+
+    // 解析resolv.conf内容
+    let resolver = resolv_conf::Config::parse(content)?;
+
+    // 检查nameserver配置
+    if resolver.nameservers.is_empty() {
+        return Err(anyhow::anyhow!("resolv.conf has no nameservers"));
+    }
+
+    for ns in resolver.nameservers {
+        if ns != Ipv4Addr::new(127, 0, 0, 53).into() {
+            return Err(anyhow::anyhow!(
+                "resolv.conf doesn't point to systemd-resolved"
+            ));
+        }
+    }
+
+    dbg("resolved", "file");
+    Ok(())
+}
+
+// 检查是否使用libnss_resolve
+fn is_libnss_resolve_used(env: &OSConfigEnv) -> Result<()> {
+    let content = env.fs.read_file("/etc/nsswitch.conf")?;
+
+    for line in String::from_utf8_lossy(&content).lines() {
+        let parts: Vec<&str> = line.split_whitespace().collect();
+        if parts.first() == Some(&"hosts:") {
+            for module in parts.iter().skip(1) {
+                if *module == "dns" {
+                    return Err(anyhow::anyhow!("dns module has higher priority"));
+                }
+                if *module == "resolve" {
+                    return Ok(());
+                }
+            }
+        }
+    }
+
+    Err(anyhow::anyhow!("libnss_resolve not used"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn dns_mode_test() {
+        let env = new_os_config_env();
+        let mode = dns_mode(&env).unwrap();
+        println!("Detected DNS mode: {}", mode);
+    }
+}

easytier/src/instance/dns_server/system_config/mod.rs

@@ -0,0 +1,5 @@
+#[cfg(target_os = "linux")]
+pub mod linux;
+
+#[cfg(target_os = "windows")]
+pub mod windows;

easytier/src/instance/dns_server/system_config/windows.rs

@@ -0,0 +1,233 @@
+use std::net::IpAddr;
+use std::process::Command;
+
+use std::io;
+use winreg::RegKey;
+
+use crate::common::ifcfg::RegistryManager;
+
+pub fn is_windows_10_or_better() -> io::Result<bool> {
+    let hklm = winreg::enums::HKEY_LOCAL_MACHINE;
+    let key_path = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion";
+    let key = winreg::RegKey::predef(hklm).open_subkey(key_path)?;
+
+    // check CurrentMajorVersionNumber, which only exists on Windows 10 and later
+    let value_name = "CurrentMajorVersionNumber";
+    key.get_raw_value(value_name).map(|_| true)
+}
+
+// 假设 interface_guid 是你的网络接口 GUID
+pub struct InterfaceControl {
+    interface_guid: String,
+}
+
+impl InterfaceControl {
+    // 构造函数
+    pub fn new(interface_guid: &str) -> Self {
+        InterfaceControl {
+            interface_guid: interface_guid.to_string(),
+        }
+    }
+
+    // 删除注册表值（模拟 delValue）
+    fn delete_value(key: &RegKey, value_name: &str) -> io::Result<()> {
+        match key.delete_value(value_name) {
+            Ok(_) => Ok(()),
+            Err(e) => {
+                if matches!(e.kind(), io::ErrorKind::NotFound) {
+                    Ok(()) // 忽略不存在的值
+                } else {
+                    Err(e.into())
+                }
+            }
+        }
+    }
+
+    pub fn set_primary_dns(&self, resolvers: &[IpAddr], domains: &[String]) -> io::Result<()> {
+        let (ipsv4, ipsv6): (Vec<String>, Vec<String>) = resolvers
+            .iter()
+            .map(|ip| ip.to_string())
+            .partition(|ip| ip.contains('.'));
+
+        let dom_strs: Vec<String> = domains
+            .iter()
+            .map(|d| d.trim_end_matches('.').to_string())
+            .collect();
+
+        // IPv4 处理
+        if let Ok(key4) = RegistryManager::open_interface_key(
+            &self.interface_guid,
+            RegistryManager::IPV4_TCPIP_INTERFACE_PREFIX,
+        ) {
+            if ipsv4.is_empty() {
+                Self::delete_value(&key4, "NameServer")?;
+            } else {
+                key4.set_value("NameServer", &ipsv4.join(","))?;
+            }
+
+            if dom_strs.is_empty() {
+                Self::delete_value(&key4, "SearchList")?;
+            } else {
+                key4.set_value("SearchList", &dom_strs.join(","))?;
+            }
+
+            // 禁用 LLMNR（通过 DisableMulticast）
+            key4.set_value("EnableMulticast", &0u32)?;
+        }
+
+        // IPv6 处理
+        if let Ok(key6) = RegistryManager::open_interface_key(
+            &self.interface_guid,
+            RegistryManager::IPV6_TCPIP_INTERFACE_PREFIX,
+        ) {
+            if ipsv6.is_empty() {
+                Self::delete_value(&key6, "NameServer")?;
+            } else {
+                key6.set_value("NameServer", &ipsv6.join(","))?;
+            }
+
+            if dom_strs.is_empty() {
+                Self::delete_value(&key6, "SearchList")?;
+            } else {
+                key6.set_value("SearchList", &dom_strs.join(","))?;
+            }
+            key6.set_value("EnableMulticast", &0u32)?;
+        }
+
+        Ok(())
+    }
+
+    fn flush_dns(&self) -> io::Result<()> {
+        // 刷新 DNS 缓存
+        let output = Command::new("ipconfig")
+            .arg("/flushdns")
+            .output()
+            .expect("failed to execute process");
+        if !output.status.success() {
+            return Err(io::Error::new(
+                io::ErrorKind::Other,
+                "Failed to flush DNS cache",
+            ));
+        }
+        Ok(())
+    }
+
+    // re-register DNS
+    pub fn re_register_dns(&self) -> io::Result<()> {
+        // ipconfig /registerdns
+        let output = Command::new("ipconfig")
+            .arg("/registerdns")
+            .output()
+            .expect("failed to execute process");
+        if !output.status.success() {
+            return Err(io::Error::new(
+                io::ErrorKind::Other,
+                "Failed to register DNS",
+            ));
+        }
+        Ok(())
+    }
+}
+
+pub struct WindowsDNSManager {
+    tun_dev_name: String,
+    interface_control: InterfaceControl,
+}
+
+impl WindowsDNSManager {
+    pub fn new(tun_dev_name: &str) -> io::Result<Self> {
+        let interface_guid = RegistryManager::find_interface_guid(tun_dev_name)?;
+        Ok(WindowsDNSManager {
+            tun_dev_name: tun_dev_name.to_string(),
+            interface_control: InterfaceControl::new(&interface_guid),
+        })
+    }
+
+    pub fn set_primary_dns(&self, resolvers: &[IpAddr], domains: &[String]) -> io::Result<()> {
+        self.interface_control.set_primary_dns(resolvers, domains)?;
+        self.interface_control.flush_dns()?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use cidr::Ipv4Inet;
+
+    #[cfg(target_os = "windows")]
+    #[tokio::test]
+    async fn test_windows_set_primary_server() {
+        use std::{net::Ipv4Addr, str::FromStr as _, time::Duration};
+
+        use tokio_util::sync::CancellationToken;
+
+        use crate::instance::dns_server::{
+            runner::DnsRunner,
+            tests::{check_dns_record, prepare_env},
+        };
+
+        let tun_ip = Ipv4Inet::from_str("10.144.144.10/24").unwrap();
+        let (peer_mgr, virtual_nic) = prepare_env("test1", tun_ip).await;
+        let tun_name = virtual_nic.ifname().await.unwrap();
+
+        println!("dev_name: {}", tun_name);
+        let fake_ip = Ipv4Addr::from_str("100.100.100.101").unwrap();
+        let mut dns_runner = DnsRunner::new(peer_mgr, Some(tun_name.clone()), tun_ip, fake_ip);
+
+        let cancel_token = CancellationToken::new();
+        let cancel_token_clone = cancel_token.clone();
+        let t = tokio::spawn(async move {
+            dns_runner.run(cancel_token_clone).await;
+        });
+
+        // windows is slow to add a ip address, wait for a longer time for dns server ready ,with ping
+        let now = std::time::Instant::now();
+        while now.elapsed() < Duration::from_secs(15) {
+            tokio::time::sleep(Duration::from_secs(1)).await;
+            if let Ok(o) = tokio::process::Command::new("ping")
+                .arg("-n")
+                .arg("1")
+                .arg("-w")
+                .arg("100")
+                .arg(&fake_ip.to_string())
+                .output()
+                .await
+            {
+                if o.status.success() {
+                    break;
+                }
+            }
+        }
+
+        check_dns_record(&fake_ip, "test1.et.net", "10.144.144.10").await;
+
+        let dns_mgr = super::WindowsDNSManager::new(&tun_name).unwrap();
+        println!("dev_name: {}", tun_name);
+        println!("guid: {}", dns_mgr.interface_control.interface_guid);
+
+        dns_mgr
+            .interface_control
+            .set_primary_dns(
+                &["100.100.100.101".parse().unwrap()],
+                &[".et.net.".to_string()],
+            )
+            .unwrap();
+        dns_mgr.interface_control.flush_dns().unwrap();
+
+        tracing::info!("check dns record with nslookup");
+
+        // nslookup should return 10.144.144.10
+        let ret = tokio::process::Command::new("nslookup")
+            .arg("test1.et.net")
+            .output()
+            .await
+            .expect("failed to execute process");
+        assert!(ret.status.success());
+        let output = String::from_utf8_lossy(&ret.stdout);
+        println!("nslookup output: {}", output);
+        assert!(output.contains("10.144.144.10"));
+
+        cancel_token.cancel();
+        let _ = t.await;
+    }
+}

easytier/src/instance/dns_server/tests.rs

@@ -0,0 +1,134 @@
+use std::net::{Ipv4Addr, SocketAddr};
+use std::str::FromStr as _;
+use std::sync::Arc;
+use std::time::Duration;
+
+use cidr::Ipv4Inet;
+use hickory_client::client::{Client, ClientHandle as _};
+use hickory_proto::rr;
+use hickory_proto::runtime::TokioRuntimeProvider;
+use hickory_proto::udp::UdpClientStream;
+use tokio_util::sync::CancellationToken;
+
+use crate::common::global_ctx::tests::get_mock_global_ctx;
+use crate::connector::udp_hole_punch::tests::replace_stun_info_collector;
+
+use crate::instance::dns_server::runner::DnsRunner;
+use crate::instance::dns_server::server_instance::MagicDnsServerInstance;
+use crate::instance::dns_server::DEFAULT_ET_DNS_ZONE;
+use crate::instance::virtual_nic::NicCtx;
+use crate::peers::peer_manager::{PeerManager, RouteAlgoType};
+
+use crate::peers::create_packet_recv_chan;
+use crate::proto::cli::Route;
+use crate::proto::common::NatType;
+
+pub async fn prepare_env(dns_name: &str, tun_ip: Ipv4Inet) -> (Arc<PeerManager>, NicCtx) {
+    let ctx = get_mock_global_ctx();
+    ctx.set_hostname(dns_name.to_owned());
+    ctx.set_ipv4(Some(tun_ip));
+    let (s, r) = create_packet_recv_chan();
+    let peer_mgr = Arc::new(PeerManager::new(RouteAlgoType::Ospf, ctx, s));
+    peer_mgr.run().await.unwrap();
+    replace_stun_info_collector(peer_mgr.clone(), NatType::PortRestricted);
+
+    let r = Arc::new(tokio::sync::Mutex::new(r));
+    let mut virtual_nic = NicCtx::new(peer_mgr.get_global_ctx(), &peer_mgr, r);
+    virtual_nic.run(tun_ip).await.unwrap();
+
+    (peer_mgr, virtual_nic)
+}
+
+pub async fn check_dns_record(fake_ip: &Ipv4Addr, domain: &str, expected_ip: &str) {
+    let stream = UdpClientStream::builder(
+        SocketAddr::new(fake_ip.clone().into(), 53),
+        TokioRuntimeProvider::default(),
+    )
+    .build();
+    let (mut client, background) = Client::connect(stream).await.unwrap();
+    let background_task = tokio::spawn(background);
+    let response = client
+        .query(
+            rr::Name::from_str(domain).unwrap(),
+            rr::DNSClass::IN,
+            rr::RecordType::A,
+        )
+        .await
+        .unwrap();
+    drop(background_task);
+
+    println!("Response: {:?}", response);
+
+    assert_eq!(response.answers().len(), 1, "{:?}", response.answers());
+    let resp = response.answers().first().unwrap();
+    assert_eq!(
+        resp.clone().into_parts().rdata.into_a().unwrap().0,
+        expected_ip.parse::<Ipv4Addr>().unwrap()
+    );
+}
+
+#[tokio::test]
+async fn test_magic_dns_server_instance() {
+    let tun_ip = Ipv4Inet::from_str("10.144.144.10/24").unwrap();
+    let (peer_mgr, virtual_nic) = prepare_env("test1", tun_ip).await;
+    let tun_name = virtual_nic.ifname().await.unwrap();
+    let fake_ip = Ipv4Addr::from_str("100.100.100.101").unwrap();
+    let dns_server_inst =
+        MagicDnsServerInstance::new(peer_mgr.clone(), Some(tun_name), tun_ip, fake_ip)
+            .await
+            .unwrap();
+
+    let routes = vec![Route {
+        hostname: "test1".to_string(),
+        ipv4_addr: Some(Ipv4Inet::from_str("8.8.8.8/24").unwrap().into()),
+        ..Default::default()
+    }];
+    dns_server_inst
+        .data
+        .update_dns_records(routes.iter(), DEFAULT_ET_DNS_ZONE)
+        .await
+        .unwrap();
+
+    check_dns_record(&fake_ip, "test1.et.net", "8.8.8.8").await;
+}
+
+#[tokio::test]
+async fn test_magic_dns_runner() {
+    let tun_ip = Ipv4Inet::from_str("10.144.144.10/24").unwrap();
+    let (peer_mgr, virtual_nic) = prepare_env("test1", tun_ip).await;
+    let tun_name = virtual_nic.ifname().await.unwrap();
+    let fake_ip = Ipv4Addr::from_str("100.100.100.101").unwrap();
+    let mut dns_runner = DnsRunner::new(peer_mgr, Some(tun_name), tun_ip, fake_ip);
+
+    let cancel_token = CancellationToken::new();
+    let cancel_token_clone = cancel_token.clone();
+    let t = tokio::spawn(async move {
+        dns_runner.run(cancel_token_clone).await;
+    });
+    tokio::time::sleep(Duration::from_secs(3)).await;
+    check_dns_record(&fake_ip, "test1.et.net", "10.144.144.10").await;
+
+    // add a new dns runner
+    let tun_ip2 = Ipv4Inet::from_str("10.144.144.20/24").unwrap();
+    let (peer_mgr, virtual_nic) = prepare_env("test2", tun_ip2).await;
+    let tun_name2 = virtual_nic.ifname().await.unwrap();
+    let mut dns_runner2 = DnsRunner::new(peer_mgr, Some(tun_name2), tun_ip2, fake_ip);
+    let cancel_token2 = CancellationToken::new();
+    let cancel_token2_clone = cancel_token2.clone();
+    let t2 = tokio::spawn(async move {
+        dns_runner2.run(cancel_token2_clone).await;
+    });
+    tokio::time::sleep(Duration::from_secs(3)).await;
+    check_dns_record(&fake_ip, "test1.et.net", "10.144.144.10").await;
+    check_dns_record(&fake_ip, "test2.et.net", "10.144.144.20").await;
+
+    // stop runner 1, runner 2 will take over the dns server
+    cancel_token.cancel();
+    t.await.unwrap();
+
+    tokio::time::sleep(Duration::from_secs(3)).await;
+    check_dns_record(&fake_ip, "test2.et.net", "10.144.144.20").await;
+
+    cancel_token2.cancel();
+    t2.await.unwrap();
+}