feat: sync daeuniverse/dae main (e3fee8f) into fork main

[MaurUppi]

Background

The fork's last upstream base is v2.1.1 (dbae2e8), integrated in #38. Upstream main has since gained 9 commits. This PR merges upstream main at e3fee8f into fork main with a merge commit.

Merge with a merge commit. Do not squash. The branch carries upstream history, and squashing would lose that ancestry.

Checklist

• The Pull Request has been fully tested. Local checks were CI-equivalent (see Test Result). CI verifies this PR.
• There's an entry in the CHANGELOGS. N/A: upstream sync. Upstream's own CHANGELOGS entries come in with the merge.
• There is a user-facing docs PR against https://github.com/daeuniverse/dae. N/A.

Full Changelogs

Upstream commits brought in:

• eea4596 docs: turn the external DNS page into a how-to and fix its DHCP advice (docs: turn the external DNS page into a how-to and fix its DHCP advice daeuniverse/dae#1103)
• fb5eae6 fix(kern): require an exact address match before bypassing LAN UDP to a local service (fix(kern): require an exact address match before bypassing LAN UDP to a local service daeuniverse/dae#1110)
• 17cc1de fix(control): flush short TCP splice writes without corking (fix(control): flush short TCP splice writes without corking daeuniverse/dae#1115)
• 2649d5b fix(control): fail fast and auto-recover from a kernel-locked /run/netns/daens (fix(control): fail fast and auto-recover from a kernel-locked /run/netns/daens daeuniverse/dae#1111)
• 6f2f2aa fix(config): restore Marshaller.Bytes (fix(config): restore Marshaller.Bytes daeuniverse/dae#1117)
• b59e375 ci: add nightly releases and bundle source dependencies (ci: add nightly releases and bundle source dependencies daeuniverse/dae#1122)
• 5a5473d fix(config): make the digit-prefix hint actionable and validate fixed_domain_ttl (fix(config): make the digit-prefix hint actionable and validate fixed_domain_ttl daeuniverse/dae#1124)
• e6e52bb fix(daedns): dial the bootstrap resolver family-agnostically (fix(daedns): dial the bootstrap resolver family-agnostically daeuniverse/dae#1130)
• e3fee8f fix(control): stop LAN ICMP redirects by writing conf/all/send_redirects too (fix(control): stop LAN ICMP redirects by writing conf/all/send_redirects too daeuniverse/dae#1125)

The 34 files upstream changed do not overlap with any file the fork changed since dbae2e8, so the merge (9e56302) needed no conflict resolution.

Note: daeuniverse#1122 adds .github/workflows/nightly.yml, which is scheduled daily at 12:00 UTC and has no repository guard. It is merged unchanged. The repository owner will disable it in this fork's Actions settings so the fork does not publish a nightly prerelease.

Issue Reference

Follow-up to #38 and #39.

Test Result

Local checks used go1.26.0, the CI GOEXPERIMENT set, and -tags dae_stub_ebpf:

• go build ./... and go vet ./... pass.
• golangci-lint v2.11.0 reports 0 issues. gofmt and go mod tidy are clean.
• go test passes for ./cmd ./config ./component/daedns/... ./pkg/... ./common/... ./component/outbound/....
• ./control: everything passes except 9 environment-bound cases. They fail identically on the base 40dd125 in the same container and pass in this fork's CI:
  • TestTCPOffloadHeaderContract needs the control/kern/headers submodule, which is not checked out locally.
  • TestListenerClone* and TestUDPIngressRealIPv6Datagrams need IPv6, which the container's kernel lacks.

The full Linux suites (go-test, bpf-test, kernel-test, ebpf-audit) run in CI on this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BYykYRdT6p8qLLe4RMiV7s

---

Generated by Claude Code

[github-actions]

DNS Benchmark Compare

• Base ref: origin/main
• Head ref: 9e56302e99356da8cc3bd93aab823b1828ebfff5
• Base strategy: merge-base
• Suite profile: dns-module
• Benchmark count: 3
• Benchmark time: 200ms

Suite Status

• control_dns_cache: success
• component_upstream_hotpath: success

control_dns_cache

DNS Benchmark Compare

• Base: origin/main (40dd125fc487fba3d06a537da42be3a83fe498d9)
• Head: 9e56302e99356da8cc3bd93aab823b1828ebfff5 (9e56302e99356da8cc3bd93aab823b1828ebfff5)
• Package: ./control
• Benchmark filter: ^BenchmarkDnsCache_FillIntoWithTTL$
• Common benchmarks: 1
• Head-only benchmarks: 0

benchstat

goos: linux
goarch: amd64
pkg: github.com/daeuniverse/dae/control
cpu: AMD EPYC 7763 64-Core Processor                
                           │ /home/runner/work/dae/dae/bench-artifacts/control_dns_cache/base_common.txt │ /home/runner/work/dae/dae/bench-artifacts/control_dns_cache/head_common.txt │
                           │                                   sec/op                                    │                          sec/op                           vs base           │
DnsCache_FillIntoWithTTL-4                                                                  730.5n ± ∞ ¹                                               734.2n ± ∞ ¹  ~ (p=0.700 n=3) ²
¹ need >= 6 samples for confidence interval at level 0.95
² need >= 4 samples to detect a difference at alpha level 0.05

                           │ /home/runner/work/dae/dae/bench-artifacts/control_dns_cache/base_common.txt │ /home/runner/work/dae/dae/bench-artifacts/control_dns_cache/head_common.txt │
                           │                                    B/op                                     │                           B/op                            vs base           │
DnsCache_FillIntoWithTTL-4                                                                   560.0 ± ∞ ¹                                                560.0 ± ∞ ¹  ~ (p=1.000 n=3) ²
¹ need >= 6 samples for confidence interval at level 0.95
² all samples are equal

                           │ /home/runner/work/dae/dae/bench-artifacts/control_dns_cache/base_common.txt │ /home/runner/work/dae/dae/bench-artifacts/control_dns_cache/head_common.txt │
                           │                                  allocs/op                                  │                        allocs/op                          vs base           │
DnsCache_FillIntoWithTTL-4                                                                   9.000 ± ∞ ¹                                                9.000 ± ∞ ¹  ~ (p=1.000 n=3) ²
¹ need >= 6 samples for confidence interval at level 0.95
² all samples are equal

component_upstream_hotpath

DNS Benchmark Compare

• Base: origin/main (40dd125fc487fba3d06a537da42be3a83fe498d9)
• Head: 9e56302e99356da8cc3bd93aab823b1828ebfff5 (9e56302e99356da8cc3bd93aab823b1828ebfff5)
• Package: ./component/dns
• Benchmark filter: ^BenchmarkUpstreamResolver_GetUpstream_(Serial|Parallel)$
• Common benchmarks: 2
• Head-only benchmarks: 0

benchstat

goos: linux
goarch: amd64
pkg: github.com/daeuniverse/dae/component/dns
cpu: AMD EPYC 7763 64-Core Processor                
                                        │ /home/runner/work/dae/dae/bench-artifacts/component_upstream_hotpath/base_common.txt │ /home/runner/work/dae/dae/bench-artifacts/component_upstream_hotpath/head_common.txt │
                                        │                                        sec/op                                        │                            sec/op                             vs base                │
UpstreamResolver_GetUpstream_Serial-4                                                                             2.816n ± ∞ ¹                                                   2.815n ± ∞ ¹       ~ (p=0.700 n=3) ²
UpstreamResolver_GetUpstream_Parallel-4                                                                           8.551n ± ∞ ¹                                                   8.535n ± ∞ ¹       ~ (p=0.100 n=3) ²
geomean                                                                                                           4.907n                                                         4.902n        -0.11%
¹ need >= 6 samples for confidence interval at level 0.95
² need >= 4 samples to detect a difference at alpha level 0.05

                                        │ /home/runner/work/dae/dae/bench-artifacts/component_upstream_hotpath/base_common.txt │ /home/runner/work/dae/dae/bench-artifacts/component_upstream_hotpath/head_common.txt │
                                        │                                         B/op                                         │                             B/op                              vs base                │
UpstreamResolver_GetUpstream_Serial-4                                                                              0.000 ± ∞ ¹                                                    0.000 ± ∞ ¹       ~ (p=1.000 n=3) ²
UpstreamResolver_GetUpstream_Parallel-4                                                                            0.000 ± ∞ ¹                                                    0.000 ± ∞ ¹       ~ (p=1.000 n=3) ²
geomean                                                                                                                      ³                                                                 +0.00%               ³
¹ need >= 6 samples for confidence interval at level 0.95
² all samples are equal
³ summaries must be >0 to compute geomean

                                        │ /home/runner/work/dae/dae/bench-artifacts/component_upstream_hotpath/base_common.txt │ /home/runner/work/dae/dae/bench-artifacts/component_upstream_hotpath/head_common.txt │
                                        │                                      allocs/op                                       │                          allocs/op                            vs base                │
UpstreamResolver_GetUpstream_Serial-4                                                                              0.000 ± ∞ ¹                                                    0.000 ± ∞ ¹       ~ (p=1.000 n=3) ²
UpstreamResolver_GetUpstream_Parallel-4                                                                            0.000 ± ∞ ¹                                                    0.000 ± ∞ ¹       ~ (p=1.000 n=3) ²
geomean                                                                                                                      ³                                                                 +0.00%               ³
¹ need >= 6 samples for confidence interval at level 0.95
² all samples are equal
³ summaries must be >0 to compute geomean