Fix: dns short name

context/interfaces/src/proxy/mod.md

@@ -5,6 +5,9 @@
 - Resolving mesh names from trusted derivation state.
 - Intercepting local traffic.
 - Proxying connections over Intermesh mTLS.
+- Owning `/etc/resolv.conf` while running: snapshotting the original,
+  installing a managed file (`ndots:0`) so libc does not search-expand short
+  mesh names, and restoring on shutdown.
 
 ## Public interface
 ```rust

src/proxy/mod.rs

@@ -5,6 +5,7 @@
 
 use std::convert::Infallible;
 use std::net::{IpAddr, Ipv4Addr};
+use std::path::PathBuf;
 use std::sync::Arc;
 
 use anyhow::{Context, Result};
@@ -38,12 +39,19 @@ use crate::verifier::IntermeshVerifier;
 
 mod dns;
 mod intercept;
+mod resolv_conf;
 
 use dns::{create_resolver, Dns};
 use intercept::{
     bind_dns, bind_tcp, get_original_dst, nftables_clean, nftables_inject, EXTERNAL_PORT,
     PROXY_PORT,
 };
+use resolv_conf::ResolvConf;
+
+/// Default location of the host's resolver config.
+const RESOLV_CONF_PATH: &str = "/etc/resolv.conf";
+/// Filename of the on-disk snapshot, placed alongside the daemon state file.
+const RESOLV_CONF_SNAPSHOT: &str = "resolv.conf.orig";
 
 // ============================================================================
 // Proxy
@@ -83,8 +91,15 @@ impl Handle {
     /// enabled, creates local service for host namespace interception and
     /// spawns HTTP CONNECT listener for incoming mTLS from remote peers.
     pub(crate) async fn run(self, cancel: CancellationToken) -> Result<()> {
-        // Clean up any stale rules from a previous run.
+        // Clean up any stale state from a previous run.
         nftables_clean();
+        let resolv_conf = make_resolv_conf(&self.state)?;
+        // A prior run may have crashed with our managed file still installed.
+        // Restore the real upstream config before create_resolver() reads it,
+        // otherwise the resolver would forward queries to our own loopback
+        // nameserver. Runs regardless of intercept so a stale managed file
+        // never outlives the proxy.
+        resolv_conf.recover().context("recover resolv.conf")?;
 
         if !self.state.intercept {
             cancel.cancelled().await;
@@ -96,7 +111,21 @@ impl Handle {
         let tcp_sock = bind_tcp(Ipv4Addr::LOCALHOST, PROXY_PORT).context("bind proxy socket")?;
         let ext_sock =
             bind_tcp(Ipv4Addr::UNSPECIFIED, EXTERNAL_PORT).context("bind external socket")?;
+        // Read upstream nameservers from /etc/resolv.conf *before*
+        // resolv_conf.install() overwrites the file. Otherwise we'd read back
+        // our own `nameserver 127.0.0.1` and forward queries to ourselves.
         let resolver = create_resolver();
+        // Defer order matters: scopeguard fires LIFO. Register the resolv.conf
+        // restore first so nftables_clean (registered second) fires first on
+        // shutdown — global system rules drop ASAP, local file restore after.
+        resolv_conf
+            .install()
+            .context("install managed resolv.conf")?;
+        defer!({
+            if let Err(e) = resolv_conf.restore() {
+                error!("restore resolv.conf failed: {e:#}");
+            }
+        });
         nftables_inject().context("inject nftables rules")?;
         defer!(nftables_clean());
 
@@ -322,6 +351,17 @@ impl Handle {
 // Utilities
 // ============================================================================
 
+/// Construct a `ResolvConf` for production use, with the snapshot placed in
+/// the same directory as the daemon state file.
+fn make_resolv_conf(state: &State) -> Result<ResolvConf> {
+    let snapshot = state
+        .state_file
+        .parent()
+        .context("state file has no parent directory")?
+        .join(RESOLV_CONF_SNAPSHOT);
+    Ok(ResolvConf::new(PathBuf::from(RESOLV_CONF_PATH), snapshot))
+}
+
 /// Parse the target from an HTTP CONNECT request URI authority.
 fn parse_connect_target(uri: &Uri) -> Result<(Name, u16)> {
     let authority = uri.authority().context("missing authority")?.as_str();