core/dnsserver: preserve UDP packet destination addresses (#8644)

* core/dnsserver: preserve UDP packet destination addresses Signed-off-by: houyuwushang <180804215+houyuwushang@users.noreply.github.com> * test: modernize reverse UDP reply traversal Signed-off-by: houyuwushang <180804215+houyuwushang@users.noreply.github.com> * test: account for Unix IPv4 source-control capabilities Signed-off-by: houyuwushang <180804215+houyuwushang@users.noreply.github.com> --------- Signed-off-by: houyuwushang <180804215+houyuwushang@users.noreply.github.com>
2026-10-25 11:45:43 -04:00 · 2026-10-21 11:34:18 +08:00
parent e7f823b261
commit 0fe7b08fbb
12 changed files with 1026 additions and 3 deletions
--- a/core/dnsserver/server.go
+++ b/core/dnsserver/server.go
@@ -240,6 +240,7 @@ func (s *Server) Serve(l net.Listener) error {
 // ServePacket starts the server with an existing packetconn. It blocks until the server stops.
 // This implements caddy.UDPServer interface.
 func (s *Server) ServePacket(p net.PacketConn) error {
+	p = withUDPDestination(p)
 	// Use a custom writer decorator if one was configured.
 	var dw dns.DecorateWriter
 	if s.udpDecorateWriterFunc != nil {
@@ -249,7 +250,7 @@ func (s *Server) ServePacket(p net.PacketConn) error {
 	s.server[udp] = &dns.Server{PacketConn: p, Net: "udp", Handler: dns.HandlerFunc(func(w dns.ResponseWriter, r *dns.Msg) {
 		ctx := context.WithValue(context.Background(), Key{}, s)
 		ctx = context.WithValue(ctx, LoopKey{}, 0)
-		s.ServeDNS(ctx, w, r)
+		s.ServeDNS(ctx, withUDPLocalAddr(w), r)
 	}), TsigSecret: s.TsigSecret, MsgAcceptFunc: s.msgAcceptFunc(), DecorateWriter: dw}
 	s.m.Unlock()

--- a/core/dnsserver/udp.go
+++ b/core/dnsserver/udp.go
@@ -0,0 +1,131 @@
+package dnsserver
+
+import (
+	"net"
+	"strconv"
+
+	cproxyproto "github.com/coredns/coredns/plugin/pkg/proxyproto"
+
+	"github.com/miekg/dns"
+	"github.com/pires/go-proxyproto"
+)
+
+// withUDPDestination preserves the destination of each packet on wildcard UDP
+// listeners. Keep the original listener in Caddy: ServePacket also receives
+// sockets inherited during a reload and must install the adapter there.
+func withUDPDestination(p net.PacketConn) net.PacketConn {
+	if proxy, ok := p.(*cproxyproto.PacketConn); ok {
+		wrapped := *proxy
+		wrapped.PacketConn = withUDPDestination(proxy.PacketConn)
+		if proxy.ConnPolicy != nil {
+			wrapped.ConnPolicy = func(options proxyproto.ConnPolicyOptions) (proxyproto.Policy, error) {
+				// Policy callbacks must keep seeing the native transport peer.
+				if packet, ok := options.Upstream.(*udpDestinationAddr); ok {
+					options.Upstream = packet.UDPAddr
+				}
+				return proxy.ConnPolicy(options)
+			}
+		}
+		return &wrapped
+	}
+	conn, ok := p.(*net.UDPConn)
+	if !ok {
+		return p
+	}
+	local := conn.LocalAddr().(*net.UDPAddr)
+	// Bound sockets already report their local address. In particular, avoid
+	// sending packet control messages on bound Darwin sockets (miekg/dns#724).
+	if !local.IP.IsUnspecified() || !enableUDPPacketInfo(conn) {
+		return p
+	}
+	return &udpDestinationConn{UDPConn: conn, local: *local}
+}
+
+type udpDestinationConn struct {
+	*net.UDPConn
+	local net.UDPAddr
+}
+
+type udpPacketInfo struct {
+	dst     net.IP
+	ifIndex int
+}
+
+// Keep normal route selection for unicast replies. Scoped IPv6 addresses also
+// need their interface; a global address must not force the incoming route.
+func (p udpPacketInfo) replyInterface() int {
+	if p.dst.To4() == nil && p.dst.IsLinkLocalUnicast() {
+		return p.ifIndex
+	}
+	return 0
+}
+
+// udpDestinationAddr travels through dns.Server's generic PacketConn path,
+// which retains the ReadFrom address for both RemoteAddr and WriteTo. All
+// packet information belongs to this request, not to the shared listener.
+type udpDestinationAddr struct {
+	*net.UDPAddr
+	local net.UDPAddr
+	info  udpPacketInfo
+}
+
+func (a *udpDestinationAddr) LocalAddr() net.Addr { return &a.local }
+
+func (c *udpDestinationConn) ReadFrom(b []byte) (int, net.Addr, error) {
+	oob := make([]byte, udpOOBSize)
+	n, oobn, flags, peer, err := c.ReadMsgUDP(b, oob)
+	if err != nil {
+		return n, peer, err
+	}
+	info := parseUDPPacketInfo(oob[:oobn], flags)
+	if info.dst == nil {
+		return n, peer, nil
+	}
+	if ip4 := info.dst.To4(); ip4 != nil {
+		info.dst = ip4
+	}
+	local := net.UDPAddr{IP: info.dst, Port: c.local.Port}
+	if info.dst.To4() == nil && (info.dst.IsLinkLocalUnicast() || info.dst.IsLinkLocalMulticast() || info.dst.IsInterfaceLocalMulticast()) && info.ifIndex > 0 {
+		local.Zone = strconv.Itoa(info.ifIndex)
+	}
+	return n, &udpDestinationAddr{UDPAddr: peer, local: local, info: info}, nil
+}
+
+func (c *udpDestinationConn) WriteTo(b []byte, addr net.Addr) (int, error) {
+	if packet, ok := addr.(*udpDestinationAddr); ok {
+		n, _, err := c.WriteMsgUDP(b, udpSourceControl(packet.info), packet.UDPAddr)
+		if err == nil {
+			// Datagram writes are atomic. Windows can report zero bytes for a
+			// successful synchronous WSASendMsg on supported Go versions.
+			return len(b), nil
+		}
+		return n, err
+	}
+	return c.UDPConn.WriteTo(b, addr)
+}
+
+type udpResponseWriter struct {
+	dns.ResponseWriter
+	local, remote net.Addr
+}
+
+func (w *udpResponseWriter) LocalAddr() net.Addr  { return w.local }
+func (w *udpResponseWriter) RemoteAddr() net.Addr { return w.remote }
+
+func withUDPLocalAddr(w dns.ResponseWriter) dns.ResponseWriter {
+	remote := w.RemoteAddr()
+	packet, ok := remote.(interface{ LocalAddr() net.Addr })
+	if !ok {
+		return w
+	}
+	local := packet.LocalAddr()
+	if local == nil {
+		return w
+	}
+	// Preserve the native peer type on plain UDP and the existing proxyproto
+	// address (including its client address and TLVs) on PROXY listeners.
+	if addr, ok := remote.(*udpDestinationAddr); ok {
+		remote = addr.UDPAddr
+	}
+	return &udpResponseWriter{ResponseWriter: w, local: local, remote: remote}
+}
--- a/core/dnsserver/udp_other.go
+++ b/core/dnsserver/udp_other.go
@@ -0,0 +1,11 @@
+//go:build !aix && !darwin && !dragonfly && !freebsd && !linux && !netbsd && !openbsd && !solaris && !windows
+
+package dnsserver
+
+import "net"
+
+const udpOOBSize = 0
+
+func enableUDPPacketInfo(*net.UDPConn) bool        { return false }
+func parseUDPPacketInfo([]byte, int) udpPacketInfo { return udpPacketInfo{} }
+func udpSourceControl(udpPacketInfo) []byte        { return nil }
--- a/core/dnsserver/udp_test.go
+++ b/core/dnsserver/udp_test.go
@@ -0,0 +1,371 @@
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris || windows
+
+package dnsserver
+
+import (
+	"bytes"
+	"context"
+	"encoding/hex"
+	"errors"
+	"net"
+	"runtime"
+	"slices"
+	"strconv"
+	"testing"
+	"time"
+
+	cproxyproto "github.com/coredns/coredns/plugin/pkg/proxyproto"
+	"github.com/coredns/coredns/request"
+
+	"github.com/miekg/dns"
+	"github.com/pires/go-proxyproto"
+)
+
+func udpTestConn(t *testing.T, network, address string) *net.UDPConn {
+	t.Helper()
+	addr, err := net.ResolveUDPAddr(network, address)
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn, err := net.ListenUDP(network, addr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { conn.Close() })
+	if err := conn.SetDeadline(time.Now().Add(5 * time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	return conn
+}
+
+// Two requests from the same peer must keep independent destination addresses,
+// even when their replies are sent in the opposite order.
+func TestUDPDestinationReadWrite(t *testing.T) {
+	for _, tc := range []struct {
+		name, network, bind string
+		destinations        []string
+	}{
+		{"ipv4", "udp4", "0.0.0.0:0", []string{"127.0.0.1", "127.0.0.2"}},
+		{"ipv6", "udp6", "[::]:0", []string{"::1", "::1"}},
+		{"dual_stack", "udp", "[::]:0", []string{"127.0.0.1", "::1"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.name == "dual_stack" && (runtime.GOOS == "openbsd" || runtime.GOOS == "dragonfly") {
+				t.Skip("the kernel requires IPv6-only sockets")
+			}
+			if tc.network != "udp4" {
+				probe, err := net.ListenPacket("udp6", "[::1]:0")
+				if err != nil {
+					t.Skipf("IPv6 loopback is unavailable: %v", err)
+				}
+				probe.Close()
+			}
+			if tc.name == "ipv4" {
+				switch runtime.GOOS {
+				case "windows":
+					// Winsock cannot select an unassigned 127.0.0.2 as the
+					// source. Use a second configured local address instead.
+					tc.destinations[1] = secondLocalIPv4(t)
+				case "aix", "dragonfly", "freebsd", "netbsd", "openbsd":
+					// x/net can receive IPv4 destinations but cannot marshal
+					// IPv4 source control on these systems. Preserve their
+					// existing routing behavior with one destination here.
+					tc.destinations[1] = tc.destinations[0]
+				default:
+					probe, err := net.ListenPacket("udp4", "127.0.0.2:0")
+					if err != nil {
+						t.Skipf("second loopback address is unavailable: %v", err)
+					}
+					probe.Close()
+				}
+			}
+			raw := udpTestConn(t, tc.network, tc.bind)
+			conn := withUDPDestination(raw)
+			if conn == raw {
+				t.Fatal("wildcard listener did not enable packet information")
+			}
+			port := raw.LocalAddr().(*net.UDPAddr).Port
+			peer := udpTestConn(t, tc.network, tc.bind)
+			var addresses []net.Addr
+			for i, dst := range tc.destinations {
+				payload := []byte{byte(i)}
+				if _, err := peer.WriteToUDP(payload, &net.UDPAddr{IP: net.ParseIP(dst), Port: port}); err != nil {
+					t.Fatal(err)
+				}
+				buf := make([]byte, 16)
+				n, addr, err := conn.ReadFrom(buf)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if !bytes.Equal(buf[:n], payload) {
+					t.Fatalf("received %v, want %v", buf[:n], payload)
+				}
+				addresses = append(addresses, addr)
+			}
+			for i, addr := range slices.Backward(addresses) {
+				packet, ok := addr.(interface{ LocalAddr() net.Addr })
+				if !ok {
+					t.Fatalf("missing destination on %T", addr)
+				}
+				want := net.JoinHostPort(tc.destinations[i], strconv.Itoa(port))
+				if got := packet.LocalAddr().String(); got != want {
+					t.Errorf("destination = %s, want %s", got, want)
+				}
+				if n, err := conn.WriteTo([]byte{byte(i)}, addr); err != nil || n != 1 {
+					t.Fatalf("WriteTo = %d, %v, want 1 byte", n, err)
+				}
+				buf := make([]byte, 16)
+				n, source, err := peer.ReadFromUDP(buf)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if n != 1 || buf[0] != byte(i) || source.String() != want {
+					t.Fatalf("reply = %v from %s, want [%d] from %s", buf[:n], source, i, want)
+				}
+			}
+		})
+	}
+}
+
+func secondLocalIPv4(t *testing.T) string {
+	t.Helper()
+	interfaces, err := net.Interfaces()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, iface := range interfaces {
+		if iface.Flags&net.FlagUp == 0 {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, addr := range addrs {
+			ip, _, err := net.ParseCIDR(addr.String())
+			if err == nil && ip.To4() != nil && ip.IsPrivate() && !ip.IsLoopback() {
+				return ip.String()
+			}
+		}
+	}
+	t.Skip("a second configured local IPv4 address is unavailable")
+	return ""
+}
+
+func TestUDPDestinationBoundSocket(t *testing.T) {
+	conn := udpTestConn(t, "udp4", "127.0.0.1:0")
+	if withUDPDestination(conn) != conn {
+		t.Fatal("explicitly bound listener should keep its existing UDP path")
+	}
+	addr := conn.LocalAddr().String()
+	peer := udpTestConn(t, "udp4", "127.0.0.1:0")
+	if _, err := peer.WriteToUDP([]byte("bound"), conn.LocalAddr().(*net.UDPAddr)); err != nil {
+		t.Fatal(err)
+	}
+	buf := make([]byte, 16)
+	n, from, err := conn.ReadFrom(buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := conn.WriteTo(buf[:n], from); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := peer.ReadFrom(buf); err != nil {
+		t.Fatal(err)
+	}
+	if got := conn.LocalAddr().String(); got != addr {
+		t.Fatalf("socket binding changed after reply: %s -> %s", addr, got)
+	}
+}
+
+func TestUDPDestinationDeadlineAndClose(t *testing.T) {
+	raw := udpTestConn(t, "udp4", "0.0.0.0:0")
+	conn := withUDPDestination(raw)
+	if err := conn.SetReadDeadline(time.Now().Add(-time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	_, _, err := conn.ReadFrom(make([]byte, 16))
+	var netErr net.Error
+	if !errors.As(err, &netErr) || !netErr.Timeout() {
+		t.Fatalf("expired deadline: %v", err)
+	}
+	if err := conn.SetReadDeadline(time.Time{}); err != nil {
+		t.Fatal(err)
+	}
+	done := make(chan error, 1)
+	go func() {
+		_, _, err := conn.ReadFrom(make([]byte, 16))
+		done <- err
+	}()
+	conn.Close()
+	select {
+	case err := <-done:
+		if !errors.Is(err, net.ErrClosed) {
+			t.Fatalf("closed socket: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("closing the socket did not unblock ReadFrom")
+	}
+}
+
+func TestUDPDestinationMissingPacketInfo(t *testing.T) {
+	raw := udpTestConn(t, "udp4", "0.0.0.0:0")
+	// Deliberately leave packet-info socket options disabled.
+	conn := &udpDestinationConn{UDPConn: raw, local: *raw.LocalAddr().(*net.UDPAddr)}
+	peer := udpTestConn(t, "udp4", "127.0.0.1:0")
+	dst := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: conn.local.Port}
+	if _, err := peer.WriteToUDP([]byte("fallback"), dst); err != nil {
+		t.Fatal(err)
+	}
+	buf := make([]byte, 16)
+	n, addr, err := conn.ReadFrom(buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := addr.(*net.UDPAddr); !ok {
+		t.Fatalf("missing metadata changed the peer address: %T", addr)
+	}
+	if conn.LocalAddr().String() != raw.LocalAddr().String() {
+		t.Fatal("missing metadata changed the listener address")
+	}
+	if count, err := conn.WriteTo(buf[:n], addr); err != nil || count != n {
+		t.Fatalf("fallback reply: %d, %v", count, err)
+	}
+	if _, _, err := peer.ReadFrom(buf); err != nil {
+		t.Fatal(err)
+	}
+}
+
+type udpAddressPlugin struct{}
+
+func (udpAddressPlugin) Name() string { return "udp-address" }
+func (udpAddressPlugin) ServeDNS(_ context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
+	state := request.Request{W: w, Req: r}
+	rawTLVs := ""
+	if peer, ok := w.RemoteAddr().(*cproxyproto.Addr); ok {
+		rawTLVs = hex.EncodeToString(peer.RawTLVs())
+	}
+	m := new(dns.Msg).SetReply(r)
+	m.Answer = []dns.RR{&dns.TXT{
+		Hdr: dns.RR_Header{Name: r.Question[0].Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET},
+		Txt: []string{state.LocalIP(), state.LocalPort(), state.IP(), state.Proto(), strconv.Itoa(state.Family()), rawTLVs},
+	}}
+	return dns.RcodeSuccess, w.WriteMsg(m)
+}
+
+func TestUDPDestinationServer(t *testing.T) {
+	for _, mode := range []string{"plain", "proxy", "proxy_local", "proxy_skip"} {
+		t.Run(mode, func(t *testing.T) {
+			raw := udpTestConn(t, "udp4", "0.0.0.0:0")
+			port := raw.LocalAddr().(*net.UDPAddr).Port
+			var pc net.PacketConn = raw
+			if mode != "plain" {
+				pc = &cproxyproto.PacketConn{PacketConn: raw, CaptureTLVs: true, UDPSessionTrackingTTL: time.Minute,
+					ConnPolicy: func(options proxyproto.ConnPolicyOptions) (proxyproto.Policy, error) {
+						if _, ok := options.Upstream.(*net.UDPAddr); !ok {
+							t.Errorf("policy peer has type %T, want *net.UDPAddr", options.Upstream)
+						}
+						if options.Downstream.String() != raw.LocalAddr().String() {
+							t.Errorf("policy listener = %s, want %s", options.Downstream, raw.LocalAddr())
+						}
+						if mode == "proxy_skip" {
+							return proxyproto.SKIP, nil
+						}
+						return proxyproto.USE, nil
+					},
+				}
+			}
+			ready := make(chan struct{})
+			cfg := testConfig("dns", udpAddressPlugin{})
+			cfg.UDPDecorateWriterFunc = func(*Server) dns.DecorateWriter { close(ready); return nil }
+			srv, err := NewServer("0.0.0.0:0", []*Config{cfg})
+			if err != nil {
+				t.Fatal(err)
+			}
+			done := make(chan error, 1)
+			go func() { done <- srv.ServePacket(pc) }()
+			select {
+			case <-ready:
+			case <-time.After(5 * time.Second):
+				t.Fatal("UDP adapter did not start")
+			}
+			t.Cleanup(func() {
+				if err := srv.Stop(); err != nil {
+					t.Error(err)
+				}
+				select {
+				case err := <-done:
+					if err != nil {
+						t.Error(err)
+					}
+				case <-time.After(5 * time.Second):
+					t.Error("UDP server did not stop")
+				}
+			})
+			conn, err := net.Dial("udp4", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer conn.Close()
+			conn.SetDeadline(time.Now().Add(5 * time.Second))
+			wantRemote, wantTLVs := "127.0.0.1", ""
+			if mode == "proxy" {
+				wantRemote, wantTLVs = "192.0.2.10", "ea00020102"
+			}
+			for i := range 2 {
+				m := new(dns.Msg).SetQuestion("example.com.", dns.TypeTXT)
+				packet, err := m.Pack()
+				if err != nil {
+					t.Fatal(err)
+				}
+				if i == 0 && (mode == "proxy" || mode == "proxy_local") {
+					header := &proxyproto.Header{Version: 2, Command: proxyproto.PROXY, TransportProtocol: proxyproto.UDPv4,
+						SourceAddr:      &net.UDPAddr{IP: net.ParseIP("192.0.2.10"), Port: 1234},
+						DestinationAddr: &net.UDPAddr{IP: net.ParseIP("198.51.100.53"), Port: 53}}
+					if mode == "proxy_local" {
+						header.Command = proxyproto.LOCAL
+					}
+					if err := header.SetTLVs([]proxyproto.TLV{{Type: 0xEA, Value: []byte{1, 2}}}); err != nil {
+						t.Fatal(err)
+					}
+					prefix, err := header.Format()
+					if err != nil {
+						t.Fatal(err)
+					}
+					packet = append(prefix, packet...)
+				}
+				if _, err := conn.Write(packet); err != nil {
+					t.Fatal(err)
+				}
+				answer, err := (&dns.Conn{Conn: conn}).ReadMsg()
+				if err != nil {
+					t.Fatal(err)
+				}
+				if answer.Rcode != dns.RcodeSuccess || len(answer.Answer) != 1 {
+					t.Fatalf("unexpected response: %v", answer)
+				}
+				want := []string{"127.0.0.1", strconv.Itoa(port), wantRemote, "udp", "1", wantTLVs}
+				got := answer.Answer[0].(*dns.TXT).Txt
+				for j := range want {
+					if got[j] != want[j] {
+						t.Errorf("field %d = %q, want %q", j, got[j], want[j])
+					}
+				}
+			}
+		})
+	}
+}
+
+func FuzzUDPPacketInfo(f *testing.F) {
+	f.Add([]byte{})
+	f.Add([]byte{0xff, 0xff, 0xff, 0xff})
+	f.Add(udpSourceControl(udpPacketInfo{dst: net.ParseIP("127.0.0.1"), ifIndex: 1}))
+	f.Add(udpSourceControl(udpPacketInfo{dst: net.ParseIP("::1"), ifIndex: 1}))
+	f.Fuzz(func(t *testing.T, data []byte) {
+		info := parseUDPPacketInfo(data, 0)
+		if info.dst != nil && info.dst.To16() == nil {
+			t.Fatalf("invalid destination: %v", info.dst)
+		}
+		udpSourceControl(info)
+	})
+}
--- a/core/dnsserver/udp_unix.go
+++ b/core/dnsserver/udp_unix.go
@@ -0,0 +1,45 @@
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
+
+package dnsserver
+
+import (
+	"net"
+
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+	"golang.org/x/sys/unix"
+)
+
+var udpOOBSize = len(ipv4.NewControlMessage(ipv4.FlagDst|ipv4.FlagInterface)) +
+	len(ipv6.NewControlMessage(ipv6.FlagDst|ipv6.FlagInterface))
+
+func enableUDPPacketInfo(conn *net.UDPConn) bool {
+	err4 := ipv4.NewPacketConn(conn).SetControlMessage(ipv4.FlagDst|ipv4.FlagInterface, true)
+	err6 := ipv6.NewPacketConn(conn).SetControlMessage(ipv6.FlagDst|ipv6.FlagInterface, true)
+	return err4 == nil || err6 == nil
+}
+
+func parseUDPPacketInfo(oob []byte, flags int) udpPacketInfo {
+	if flags&unix.MSG_CTRUNC != 0 {
+		return udpPacketInfo{}
+	}
+	cm6 := new(ipv6.ControlMessage)
+	if cm6.Parse(oob) == nil && cm6.Dst != nil {
+		return udpPacketInfo{dst: cm6.Dst, ifIndex: cm6.IfIndex}
+	}
+	cm4 := new(ipv4.ControlMessage)
+	if cm4.Parse(oob) == nil && cm4.Dst != nil {
+		return udpPacketInfo{dst: cm4.Dst, ifIndex: cm4.IfIndex}
+	}
+	return udpPacketInfo{}
+}
+
+func udpSourceControl(info udpPacketInfo) []byte {
+	if info.dst == nil || info.dst.IsUnspecified() || info.dst.IsMulticast() {
+		return nil
+	}
+	if ip4 := info.dst.To4(); ip4 != nil {
+		return (&ipv4.ControlMessage{Src: ip4, IfIndex: info.replyInterface()}).Marshal()
+	}
+	return (&ipv6.ControlMessage{Src: info.dst, IfIndex: info.replyInterface()}).Marshal()
+}
--- a/core/dnsserver/udp_windows.go
+++ b/core/dnsserver/udp_windows.go
@@ -0,0 +1,107 @@
+package dnsserver
+
+import (
+	"encoding/binary"
+	"math"
+	"net"
+	"strconv"
+
+	"golang.org/x/sys/windows"
+)
+
+// WSACMSGHDR contains a native-size length followed by two 32-bit integers.
+// Each control message is aligned to SIZE_T; its length excludes tail padding.
+const udpCmsgWord = strconv.IntSize / 8
+const udpCmsgHeader = udpCmsgWord + 8
+
+var udpOOBSize = udpCmsgAlign(udpCmsgHeader+8) + udpCmsgAlign(udpCmsgHeader+20)
+
+func udpCmsgAlign(n int) int { return (n + udpCmsgWord - 1) & ^(udpCmsgWord - 1) }
+
+func enableUDPPacketInfo(conn *net.UDPConn) bool {
+	raw, err := conn.SyscallConn()
+	if err != nil {
+		return false
+	}
+	var err4, err6 error
+	err = raw.Control(func(fd uintptr) {
+		// Dual-stack sockets need both options to receive both families.
+		err4 = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, windows.IP_PKTINFO, 1)
+		err6 = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, windows.IPV6_PKTINFO, 1)
+	})
+	return err == nil && (err4 == nil || err6 == nil)
+}
+
+func parseUDPPacketInfo(oob []byte, flags int) udpPacketInfo {
+	if flags&windows.MSG_CTRUNC != 0 {
+		return udpPacketInfo{}
+	}
+	for len(oob) >= udpCmsgHeader {
+		var length uint64
+		if udpCmsgWord == 8 {
+			length = binary.NativeEndian.Uint64(oob)
+		} else {
+			length = uint64(binary.NativeEndian.Uint32(oob))
+		}
+		if length < udpCmsgHeader || length > uint64(len(oob)) || length > math.MaxInt32 {
+			return udpPacketInfo{}
+		}
+		level := binary.NativeEndian.Uint32(oob[udpCmsgWord:])
+		kind := binary.NativeEndian.Uint32(oob[udpCmsgWord+4:])
+		data := oob[udpCmsgHeader:length]
+		ipLen := 0
+		switch {
+		case level == windows.IPPROTO_IP && kind == windows.IP_PKTINFO:
+			ipLen = net.IPv4len
+		case level == windows.IPPROTO_IPV6 && kind == windows.IPV6_PKTINFO:
+			ipLen = net.IPv6len
+		}
+		if ipLen != 0 {
+			if len(data) < ipLen+4 {
+				return udpPacketInfo{}
+			}
+			ifIndex := binary.NativeEndian.Uint32(data[ipLen:])
+			if ifIndex > math.MaxInt32 {
+				return udpPacketInfo{}
+			}
+			return udpPacketInfo{dst: net.IP(data[:ipLen]), ifIndex: int(ifIndex)}
+		}
+		next := udpCmsgAlign(int(length))
+		if next < int(length) || next > len(oob) {
+			break
+		}
+		oob = oob[next:]
+	}
+	return udpPacketInfo{}
+}
+
+func udpSourceControl(info udpPacketInfo) []byte {
+	if info.dst == nil || info.dst.IsUnspecified() || info.dst.IsMulticast() {
+		return nil
+	}
+	ifIndex := info.replyInterface()
+	if ifIndex < 0 || ifIndex > math.MaxInt32 {
+		return nil
+	}
+	ip := info.dst.To4()
+	level, kind := uint32(windows.IPPROTO_IP), uint32(windows.IP_PKTINFO)
+	if ip == nil {
+		ip = info.dst.To16()
+		level, kind = windows.IPPROTO_IPV6, windows.IPV6_PKTINFO
+	}
+	if ip == nil {
+		return nil
+	}
+	length := udpCmsgHeader + len(ip) + 4
+	oob := make([]byte, udpCmsgAlign(length))
+	if udpCmsgWord == 8 {
+		binary.NativeEndian.PutUint64(oob, uint64(length))
+	} else {
+		binary.NativeEndian.PutUint32(oob, uint32(length)) //nolint:gosec // Header plus a 4- or 16-byte IP and a 4-byte interface.
+	}
+	binary.NativeEndian.PutUint32(oob[udpCmsgWord:], level)
+	binary.NativeEndian.PutUint32(oob[udpCmsgWord+4:], kind)
+	copy(oob[udpCmsgHeader:], ip)
+	binary.NativeEndian.PutUint32(oob[udpCmsgHeader+len(ip):], uint32(ifIndex))
+	return oob
+}
--- a/core/dnsserver/udp_windows_test.go
+++ b/core/dnsserver/udp_windows_test.go
@@ -0,0 +1,74 @@
+package dnsserver
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/hex"
+	"net"
+	"testing"
+
+	"golang.org/x/sys/windows"
+)
+
+func TestUDPPacketInfoWindows(t *testing.T) {
+	// Native WSACMSGHDR followed by IN_PKTINFO/IN6_PKTINFO. These fixtures
+	// include the receiving interface, unlike unscoped send control messages.
+	ipv4 := "180000000000000000000000130000007f00000107000000"
+	ipv6 := "24000000000000002900000013000000fe8000000000000000000000000000010700000000000000"
+	if udpCmsgWord == 4 {
+		ipv4 = "1400000000000000130000007f00000107000000"
+		ipv6 = "200000002900000013000000fe80000000000000000000000000000107000000"
+	}
+	for _, tc := range []struct{ name, encoded, dst string }{
+		{"ipv4", ipv4, "127.0.0.1"},
+		{"ipv6", ipv6, "fe80::1"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			control, err := hex.DecodeString(tc.encoded)
+			if err != nil {
+				t.Fatal(err)
+			}
+			info := parseUDPPacketInfo(control, 0)
+			if !info.dst.Equal(net.ParseIP(tc.dst)) || info.ifIndex != 7 {
+				t.Fatalf("packet info = %+v, want %s on interface 7", info, tc.dst)
+			}
+			if got := parseUDPPacketInfo(control, windows.MSG_CTRUNC); got.dst != nil {
+				t.Fatal("truncated control data must not supply a destination")
+			}
+			for n := range udpCmsgHeader + len(info.dst) + 4 {
+				if got := parseUDPPacketInfo(control[:n], 0); got.dst != nil {
+					t.Errorf("accepted truncated control data of length %d", n)
+				}
+			}
+			if tc.name == "ipv4" {
+				// Global/loopback replies retain route selection; only scoped
+				// IPv6 replies carry an outgoing interface constraint.
+				binary.NativeEndian.PutUint32(control[udpCmsgHeader+4:], 0)
+			}
+			if got := udpSourceControl(info); !bytes.Equal(got, control) {
+				t.Errorf("source control = %x, want %x", got, control)
+			}
+		})
+	}
+}
+
+func TestUDPPacketInfoWindowsMalformed(t *testing.T) {
+	valid := udpSourceControl(udpPacketInfo{dst: net.ParseIP("127.0.0.1")})
+	for _, length := range []uint64{0, udpCmsgHeader - 1, udpCmsgHeader, udpCmsgHeader + 3, uint64(len(valid) + 1), ^uint64(0)} {
+		control := bytes.Clone(valid)
+		if udpCmsgWord == 8 {
+			binary.NativeEndian.PutUint64(control, length)
+		} else {
+			binary.NativeEndian.PutUint32(control, uint32(length))
+		}
+		if got := parseUDPPacketInfo(control, 0); got.dst != nil {
+			t.Errorf("accepted control length %d", length)
+		}
+	}
+	unknown := bytes.Clone(valid)
+	binary.NativeEndian.PutUint32(unknown[udpCmsgWord+4:], 0xffff)
+	control := append(unknown, valid...)
+	if got := parseUDPPacketInfo(control, 0); !got.dst.Equal(net.IPv4(127, 0, 0, 1)) {
+		t.Fatalf("did not find packet info after an unknown message: %+v", got)
+	}
+}