fix(dns): say when the ending list did not load (#270)

Swallowing this was the quietest way to switch the whole namespace off.

isOurs() gates every answer on the ending set, so an empty one makes the
bridge say "not mine" to every name — and with upstreams configured,
"not mine" means forward to the clearnet, which denies all of Moshpit by
definition. The machine ends up with dig answering promptly, google.com
resolving, resolvectl looking right, systemctl green, and every Moshpit
name NXDOMAIN. Nothing in any log mentioned the list, because the fetch
was wrapped in .catch(() => []) and an empty array is also what a
registry with no endings would legitimately return.

The two lines directly beneath it have always warned about missing
upstreams. What we answer for is worth at least as much as what we
forward to.

So: report it, name the consequence rather than the detail — an operator
can act on "every Moshpit name will be forwarded to the clearnet" in a
way they cannot act on "0 endings loaded" — and print the count on the
way up, so a healthy start is visibly different from a broken one.

The branch had never been exercised because `start` reached past the
injected deps.tlds to the module-level function while `enable` used the
injectable one. Now it uses fetchTldsImpl, which is what made the four
tests here possible.

Found while chasing a resolver that answered nothing for the namespace:
the first diagnosis was a slow warm-up, which was wrong. fetchTlds is
awaited before the socket binds and returns 5674 endings in about a
second. There was no race — the list had simply failed to load, and
nothing said so.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: ralyodio

src/dns.mjs

@@ -2119,9 +2119,30 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     // Without these the bridge answers only for endings it is authoritative
     // for, which is correct for per-ending routing and fatal for catch-all.
     const upstreams = await discoverUpstreams();
-    const tldSet = new Set(await fetchTlds({ registryBase }).catch(() => []));
+    // Swallowing this was the quietest way to turn the namespace off. An empty
+    // ending set makes isOurs() say no to every name, so with upstreams present
+    // the bridge forwards the whole of Moshpit to the clearnet, which denies it
+    // — every name NXDOMAIN, `dig` answering promptly, google.com fine, nothing
+    // in any log. The line below has always warned about missing upstreams; the
+    // list of what we answer for is worth at least as much.
+    // `enable` already takes this injected; `start` reached past it to the
+    // module, which is why the branch below had never been exercised.
+    const tlds = await fetchTldsImpl({ registryBase }).then(
+      (found) => ({ found }),
+      (err) => ({ error: err?.message || String(err) }),
+    );
+    const tldSet = new Set(tlds.found || []);
     if (upstreams.length) out(`forwarding non-Moshpit lookups to ${upstreams.join(", ")}`);
     else out("! no upstreams found in /etc/resolv.conf — this bridge can only answer Moshpit names");
+    if (tldSet.size) out(`answering for ${tldSet.size} endings`);
+    else {
+      out(`! could not read the ending list from ${registryBase}${tlds.error ? ` — ${tlds.error}` : ""}`);
+      // Named as the outcome rather than the cause: "no endings loaded" reads
+      // as a detail, and this is the whole namespace being off.
+      out(upstreams.length
+        ? "  every Moshpit name will be forwarded to the clearnet and answer NXDOMAIN until this is fixed"
+        : "  this bridge has nothing to answer for and nothing to forward to");
+    }
 
     // The same two error codes the parking server above already explains, on
     // the port this command exists to bind. Without this they arrived as an

test/dns-start-bind-failure.test.mjs

@@ -26,7 +26,8 @@ import net from "node:net";
 import { createServer, dnsCommand } from "../src/dns.mjs";
 
 // Nothing here may touch the network. A registry that cannot connect is enough:
-// `dns start` already wraps its TLD fetch in .catch(() => []).
+// `dns start` reports the unreadable ending list and carries on to the bind,
+// which is the failure these tests are about.
 const DEAD_REGISTRY = "http://127.0.0.1:1";
 
 /** Hold a UDP port so the resolver's bind is guaranteed to fail. */

test/dns-tld-list-failure.test.mjs

@@ -0,0 +1,108 @@
+/**
+ * What `dns start` says when it could not read the list of endings.
+ *
+ * This was the quietest way to switch the whole namespace off. `isOurs()` gates
+ * every answer on the ending set, so an empty one makes the bridge say "not
+ * mine" to every name — and with upstreams configured, "not mine" means forward
+ * to the clearnet, which denies the entire Moshpit namespace by definition.
+ *
+ * The result is a machine where `dig` answers promptly, google.com resolves,
+ * `resolvectl` looks right, `systemctl status` is green, and every Moshpit name
+ * is NXDOMAIN. Nothing in any log said the list had not loaded, because the
+ * fetch was wrapped in `.catch(() => [])` and the empty array is also what a
+ * registry with no endings would legitimately return.
+ *
+ * The line immediately below it has always warned about missing upstreams. What
+ * we answer for is worth at least as much as what we forward to.
+ *
+ * Every test drives the failure through a held port, so the command prints its
+ * diagnosis and then returns rather than binding and serving forever.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import dgram from "node:dgram";
+
+import { dnsCommand } from "../src/dns.mjs";
+
+const DEAD_REGISTRY = "http://127.0.0.1:1";
+
+/** Hold a UDP port so the resolver bind fails and `start` returns. */
+function holdUdp() {
+  const socket = dgram.createSocket({ type: "udp4" });
+  return new Promise((resolve) => {
+    socket.bind(0, "127.0.0.1", () => resolve({
+      port: socket.address().port,
+      release: () => new Promise((done) => socket.close(done)),
+    }));
+  });
+}
+
+/** Run `dns start` with an injected ending list, on a port that cannot bind. */
+async function start(port, tlds) {
+  const lines = [];
+  const code = await dnsCommand(
+    ["start", "--port", String(port), "--parking-port", String(port), "--registry", DEAD_REGISTRY],
+    (line) => lines.push(line),
+    { tlds },
+  );
+  return { code, out: lines.join("\n") };
+}
+
+test("a TLD list that could not be fetched is reported, with the cost named", async () => {
+  const held = await holdUdp();
+  try {
+    const { out } = await start(held.port, async () => {
+      throw new Error("registry unreachable");
+    });
+
+    assert.match(out, /could not read the ending list/);
+    assert.match(out, /registry unreachable/, "the reason belongs in the message, not just the fact");
+    // The consequence is the part an operator can act on. "no endings loaded"
+    // reads as a detail; this is the namespace being off.
+    assert.match(out, /every Moshpit name will be forwarded to the clearnet/);
+  } finally {
+    await held.release();
+  }
+});
+
+test("an empty TLD list is reported too, not just a thrown one", async () => {
+  // A registry that answers with nothing is indistinguishable in effect from one
+  // that does not answer, and it was the case the old `.catch(() => [])` could
+  // never have caught: no error was ever thrown.
+  const held = await holdUdp();
+  try {
+    const { out } = await start(held.port, async () => []);
+    assert.match(out, /could not read the ending list/);
+  } finally {
+    await held.release();
+  }
+});
+
+test("a TLD list that loaded says so, so the quiet case is not the same as the broken one", async () => {
+  const held = await holdUdp();
+  try {
+    const { out } = await start(held.port, async () => ["eggs", "hacker", "rank"]);
+
+    assert.match(out, /answering for 3 endings/);
+    assert.doesNotMatch(out, /could not read the ending list/);
+    assert.doesNotMatch(out, /forwarded to the clearnet/);
+  } finally {
+    await held.release();
+  }
+});
+
+test("the ending list is taken from deps, the way `enable` already takes it", async () => {
+  // `start` reached past the injected dependency to the module-level function,
+  // which is why this whole branch had never been exercised by a test.
+  const held = await holdUdp();
+  let asked = 0;
+  try {
+    await start(held.port, async () => {
+      asked += 1;
+      return ["eggs"];
+    });
+    assert.equal(asked, 1, "the injected fetcher is the one that ran");
+  } finally {
+    await held.release();
+  }
+});