xcode/iOS: set MatchDomains when no route requires a custom DNS resolver

Updates https://github.com/tailscale/corp/issues/15802.

On iOS exclusively, this PR adds logic to use a split DNS configuration in more cases, with the goal of improving battery life. Acting as the global DNS resolver on iOS should be avoided, as it leads to frequent wakes of IPNExtension.

We try to determine if we can have Tailscale only handle DNS queries for resources inside the tailnet, that is, all routes in the DNS configuration do not require a custom resolver (this is the case for app connectors, for instance).

If so, we set all Routes as MatchDomains. This enables a split DNS configuration which will help preserve battery life. Effectively, for the average Tailscale user who only relies on MagicDNS to resolve *.ts.net domains, this means that Tailscale DNS will only be used for those domains.

This PR doesn't affect users with Override Local DNS enabled. For these users, there should be no difference and Tailscale will continue acting as a global DNS resolver.

Signed-off-by: Andrea Gottardo <andrea@tailscale.com>

net/dns/manager.go

@@ -270,6 +270,18 @@ func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig
 		// config is empty, then we need to fallback to SplitDNS mode.
 		ocfg.MatchDomains = cfg.matchDomains()
 	} else {
+		// On iOS, check if all route names point to resources inside the tailnet. If so,
+		// we can set those names as MatchDomains to enable a split DNS configuration
+		// which will help preserve battery life.
+		// Because on iOS MatchDomains must equal SearchDomains, we cannot do this when
+		// we have any Routes outside the tailnet. Otherwise when app connectors are enabled,
+		// a query for 'work-laptop' might lead to search domain expansion, resolving
+		// as 'work-laptop.aws.com' for example.
+		if runtime.GOOS == "ios" && m.iosCanUseMatchDomains(rcfg) {
+			for r := range rcfg.Routes {
+				ocfg.MatchDomains = append(ocfg.MatchDomains, r)
+			}
+		}
 		var defaultRoutes []*dnstype.Resolver
 		for _, ip := range baseCfg.Nameservers {
 			defaultRoutes = append(defaultRoutes, &dnstype.Resolver{Addr: ip.String()})
@@ -281,6 +293,28 @@ func (m *Manager) compileConfig(cfg Config) (rcfg resolver.Config, ocfg OSConfig
 	return rcfg, ocfg, nil
 }
 
+// iosCanUseMatchDomains returns true if the given resolver.Config only contains routes
+// that do not specify a set of custom resolver(s), i.e. they can be resolved locally.
+// If so, we can ask iOS to use the Tailscale resolver exclusively to resolve Routes,
+// instead of setting ourselves as the global DNS resolver, which forces all DNS queries
+// to go to Tailscale.
+func (m *Manager) iosCanUseMatchDomains(rcfg resolver.Config) bool {
+	for route, resolvers := range rcfg.Routes {
+		if route.WithoutTrailingDot() == "ts.net" {
+			// Ignore the "ts.net" route here. It always specifies the corp resolvers but
+			// its presence is not an issue, as ts.net is a search domain.
+			continue
+		}
+		if len(resolvers) != 0 {
+			// Found a route that requires custom resolvers, we have to be the global DNS
+			// resolver.
+			return false
+		}
+	}
+	// No routes have specified one or more resolvers, we can set MatchDomains.
+	return true
+}
+
 // toIPsOnly returns only the IP portion of dnstype.Resolver.
 // Only safe to use if the resolvers slice has been cleared of
 // DoH or custom-port entries with something like hasDefaultIPResolversOnly.