From 1b6bc37f2859007dc4ed949b14f1f8531990b3cf Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Sat, 20 Sep 2025 16:14:44 -0700
Subject: [PATCH] net/dnscache: fix case where Resolver could return zero IP
 with single IPv6 address

The controlhttp dialer with a ControlDialPlan IPv6 entry was hitting a
case where the dnscache Resolver was returning an netip.Addr zero
value, where it should've been returning the IPv6 address.

We then tried to dial "invalid IP:80", which would immediately fail,
at least locally.

Mostly this was causing spammy logs when debugging other stuff.

Updates tailscale/corp#32534

Change-Id: If8b9a20f10c1a6aa8a662c324151d987fe9bd2f8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 net/dnscache/dnscache.go      |  3 ++
 net/dnscache/dnscache_test.go | 58 +++++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)

diff --git a/net/dnscache/dnscache.go b/net/dnscache/dnscache.go
index d60e92f0b..94d4bbee7 100644
--- a/net/dnscache/dnscache.go
+++ b/net/dnscache/dnscache.go
@@ -205,6 +205,9 @@ func (r *Resolver) LookupIP(ctx context.Context, host string) (ip, v6 netip.Addr
 			}
 			allIPs = append(allIPs, naIP)
 		}
+		if !ip.IsValid() && v6.IsValid() {
+			ip = v6
+		}
 		r.dlogf("returning %d static results", len(allIPs))
 		return
 	}
diff --git a/net/dnscache/dnscache_test.go b/net/dnscache/dnscache_test.go
index ef4249b74..58bb6cd7f 100644
--- a/net/dnscache/dnscache_test.go
+++ b/net/dnscache/dnscache_test.go
@@ -11,6 +11,7 @@ import (
 	"net"
 	"net/netip"
 	"reflect"
+	"slices"
 	"testing"
 	"time"
 
@@ -240,3 +241,60 @@ func TestShouldTryBootstrap(t *testing.T) {
 		})
 	}
 }
+
+func TestSingleHostStaticResult(t *testing.T) {
+	v4 := netip.MustParseAddr("0.0.0.1")
+	v6 := netip.MustParseAddr("2001::a")
+
+	tests := []struct {
+		name    string
+		static  []netip.Addr
+		wantIP  netip.Addr
+		wantIP6 netip.Addr
+		wantAll []netip.Addr
+	}{
+		{
+			name:    "just-v6",
+			static:  []netip.Addr{v6},
+			wantIP:  v6,
+			wantIP6: v6,
+			wantAll: []netip.Addr{v6},
+		},
+		{
+			name:    "just-v4",
+			static:  []netip.Addr{v4},
+			wantIP:  v4,
+			wantIP6: netip.Addr{},
+			wantAll: []netip.Addr{v4},
+		},
+		{
+			name:    "v6-then-v4",
+			static:  []netip.Addr{v6, v4},
+			wantIP:  v4,
+			wantIP6: v6,
+			wantAll: []netip.Addr{v6, v4},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &Resolver{
+				SingleHost:             "example.com",
+				SingleHostStaticResult: tt.static,
+			}
+			ip, ip6, all, err := r.LookupIP(context.Background(), "example.com")
+			if err != nil {
+				t.Fatal(err)
+			}
+			if ip != tt.wantIP {
+				t.Errorf("got ip %v; want %v", ip, tt.wantIP)
+			}
+			if ip6 != tt.wantIP6 {
+				t.Errorf("got ip6 %v; want %v", ip6, tt.wantIP6)
+			}
+			if !slices.Equal(all, tt.wantAll) {
+				t.Errorf("got all %v; want %v", all, tt.wantAll)
+			}
+		})
+	}
+}