From 03f7511a0e9056ec54aacba834acb9d611db8578 Mon Sep 17 00:00:00 2001 From: Arjen <18398758+Origami74@users.noreply.github.com> Date: Mon, 8 Jun 2026 18:39:36 +0200 Subject: [PATCH] packaging: macOS resolver must point at ::1, not 127.0.0.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Before bf77ece (Fix DNS responder silent-drop on systemd-resolved deployments, 2026-04-29) the daemon defaulted dns.bind_addr to "::" (wildcard, accepted v4 traffic too), so the macOS pkg's resolver shim of `nameserver 127.0.0.1` reached the daemon fine over v4 loopback. That commit tightened the default to "::1" — IPv6 loopback only, which on Linux/macOS does not accept v4-mapped traffic — to defuse a mesh-interface filter / IPV6_PKTINFO bug that was silently dropping .fips queries on systemd-resolved hosts. The Linux side was updated in the same commit: fips-dns-setup now writes [::1]:5354 in every backend, and the gateway's DEFAULT_DNS_UPSTREAM moved to [::1]:5354 with an inline comment about the v4/v6 mismatch. The macOS resolver shim in packaging/macos/build-pkg.sh was missed in that sweep. Since 2026-04-29, every macOS install has shipped /etc/resolver/fips with `nameserver 127.0.0.1` while the daemon listened on `::1`, so .fips hostnames don't resolve via getaddrinfo (ping6, curl, etc.) even though `dig @::1 -p 5354 …` works. The mismatch is easy to miss: mDNSResponder swallows the timeout, VPN clients that hijack DNS (NetworkExtension match-domain : *) mask it entirely, and the symptom looks like "discovery hasn't found the peer yet". Switch the shim to nameserver ::1 to match the daemon. --- packaging/macos/build-pkg.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packaging/macos/build-pkg.sh b/packaging/macos/build-pkg.sh index 37b4531..fd25a78 100755 --- a/packaging/macos/build-pkg.sh +++ b/packaging/macos/build-pkg.sh @@ -121,9 +121,9 @@ cp "${PACKAGING_DIR}/common/hosts" "${STAGING_DIR}/usr/local/etc/fips/hosts.defa # LaunchDaemon plist cp "${SCRIPT_DIR}/com.fips.daemon.plist" "${STAGING_DIR}/Library/LaunchDaemons/" -# DNS resolver +# DNS resolver. Must match the daemon's dns.bind_addr (defaults to ::1). cat > "${STAGING_DIR}/etc/resolver/fips" <