Pull request: 2704 local addresses vol.2

Merge in DNS/adguard-home from 2704-local-addresses-vol.2 to master Updates #2704. Updates #2829. Squashed commit of the following: commit 507d038c2709de59246fc0b65c3c4ab8e38d1990 Author: Eugene Burkov <e.burkov@adguard.com> Date: Wed Mar 31 14:33:05 2021 +0300 aghtest: fix file name commit 8e19f99337bee1d88ad6595adb96f9bb23fa3c41 Author: Eugene Burkov <e.burkov@adguard.com> Date: Wed Mar 31 14:06:43 2021 +0300 aghnet: rm redundant mutexes commit 361fa418b33ed160ca20862be1c455ab9378c03f Author: Eugene Burkov <e.burkov@adguard.com> Date: Wed Mar 31 13:45:30 2021 +0300 all: fix names, docs commit 14034f4f0230d7aaa3645054946ae5c278089a99 Merge: 35e265cc a72ce1cf Author: Eugene Burkov <e.burkov@adguard.com> Date: Wed Mar 31 13:38:15 2021 +0300 Merge branch 'master' into 2704-local-addresses-vol.2 commit 35e265cc8cd308ef1fda414b58c0217cb5f258e4 Author: Eugene Burkov <e.burkov@adguard.com> Date: Wed Mar 31 13:33:35 2021 +0300 aghnet: imp naming commit 7a7edac7208a40697d7bc50682b923a144e28e2b Author: Eugene Burkov <e.burkov@adguard.com> Date: Tue Mar 30 20:59:54 2021 +0300 changelog: oops, nope yet commit d26a5d2513daf662ac92053b5e235189a64cc022 Author: Eugene Burkov <e.burkov@adguard.com> Date: Tue Mar 30 20:55:53 2021 +0300 all: some renaming for the glory of semantics commit 9937fa619452b0742616217b975e3ff048d58acb Author: Eugene Burkov <e.burkov@adguard.com> Date: Mon Mar 29 15:34:42 2021 +0300 all: log changes commit d8d9e6dfeea8474466ee25f27021efdd3ddb1592 Author: Eugene Burkov <e.burkov@adguard.com> Date: Fri Mar 26 18:32:23 2021 +0300 all: imp localresolver, imp cutting off own addresses commit 344140df449b85925f19b460fd7dc7c08e29c35a Author: Eugene Burkov <e.burkov@adguard.com> Date: Fri Mar 26 14:53:33 2021 +0300 all: imp code quality commit 1c5c0babec73b125044e23dd3aa75d8eefc19b28 Author: Eugene Burkov <e.burkov@adguard.com> Date: Thu Mar 25 20:44:08 2021 +0300 all: fix go.mod commit 0b9fb3c2369a752e893af8ddc45a86bb9fb27ce5 Author: Eugene Burkov <e.burkov@adguard.com> Date: Thu Mar 25 20:38:51 2021 +0300 all: add error handling commit a7a2e51f57fc6f8f74b95a264ad345cd2a9e026e Merge: c13be634 27f4f052 Author: Eugene Burkov <e.burkov@adguard.com> Date: Thu Mar 25 19:48:36 2021 +0300 Merge branch 'master' into 2704-local-addresses-vol.2 commit c13be634f47bcaed9320a732a51c0e4752d0dad0 Author: Eugene Burkov <e.burkov@adguard.com> Date: Thu Mar 25 18:52:28 2021 +0300 all: cover rdns with tests, imp aghnet functionality commit 48bed9025944530c613ee53e7961d6d5fbabf8be Author: Eugene Burkov <e.burkov@adguard.com> Date: Wed Mar 24 20:18:07 2021 +0300 home: make rdns great again commit 1dbacfc8d5b6895807797998317fe3cc814617c1 Author: Eugene Burkov <e.burkov@adguard.com> Date: Wed Mar 24 16:07:52 2021 +0300 all: imp external client restriction commit 1208a319a7f4ffe7b7fa8956f245d7a19437c0a4 Author: Eugene Burkov <e.burkov@adguard.com> Date: Mon Mar 22 15:26:45 2021 +0300 all: finish local ptr processor commit c8827fc3db289e1a5d7a11d057743bab39957b02 Author: Eugene Burkov <e.burkov@adguard.com> Date: Tue Mar 2 13:41:22 2021 +0300 all: imp ipdetector, add local ptr processor
2021-03-31 15:00:47 +03:00
parent a72ce1cfae
commit 86444eacc2
30 changed files with 1418 additions and 360 deletions
--- a/internal/home/clients.go
+++ b/internal/home/clients.go
@@ -591,8 +591,9 @@ func (clients *clientsContainer) SetWhoisInfo(ip string, info [][]string) {
 // taken into account.  ok is true if the pairing was added.
 func (clients *clientsContainer) AddHost(ip, host string, src clientSource) (ok bool, err error) {
 	clients.lock.Lock()
+	defer clients.lock.Unlock()
+
 	ok = clients.addHostLocked(ip, host, src)
-	clients.lock.Unlock()

 	return ok, nil
 }
--- a/internal/home/dns.go
+++ b/internal/home/dns.go
@@ -61,10 +61,12 @@ func initDNSServer() error {
 	Context.dnsFilter = dnsfilter.New(&filterConf, nil)

 	p := dnsforward.DNSCreateParams{
-		DNSFilter:   Context.dnsFilter,
-		Stats:       Context.stats,
-		QueryLog:    Context.queryLog,
-		AutohostTLD: config.DNS.AutohostTLD,
+		DNSFilter:      Context.dnsFilter,
+		Stats:          Context.stats,
+		QueryLog:       Context.queryLog,
+		SubnetDetector: Context.subnetDetector,
+		LocalResolvers: Context.localResolvers,
+		AutohostTLD:    config.DNS.AutohostTLD,
 	}
 	if Context.dhcpServer != nil {
 		p.DHCPServer = Context.dhcpServer
@@ -91,7 +93,7 @@ func initDNSServer() error {
 		return fmt.Errorf("dnsServer.Prepare: %w", err)
 	}

-	Context.rdns = InitRDNS(Context.dnsServer, &Context.clients)
+	Context.rdns = NewRDNS(Context.dnsServer, &Context.clients, Context.subnetDetector, Context.localResolvers)
 	Context.whois = initWhois(&Context.clients)

 	Context.filters.Init()
@@ -105,14 +107,14 @@ func isRunning() bool {
 func onDNSRequest(d *proxy.DNSContext) {
 	ip := dnsforward.IPFromAddr(d.Addr)
 	if ip == nil {
-		// This would be quite weird if we get here
+		// This would be quite weird if we get here.
 		return
 	}

 	if !ip.IsLoopback() {
 		Context.rdns.Begin(ip)
 	}
-	if !Context.ipDetector.DetectSpecialNetwork(ip) {
+	if !Context.subnetDetector.IsSpecialNetwork(ip) {
 		Context.whois.Begin(ip)
 	}
 }
@@ -333,10 +335,10 @@ func startDNSServer() error {

 	const topClientsNumber = 100 // the number of clients to get
 	for _, ip := range Context.stats.GetTopClientsIP(topClientsNumber) {
-		if !ip.IsLoopback() {
+		if !Context.subnetDetector.IsLocallyServedNetwork(ip) {
 			Context.rdns.Begin(ip)
 		}
-		if !Context.ipDetector.DetectSpecialNetwork(ip) {
+		if !Context.subnetDetector.IsSpecialNetwork(ip) {
 			Context.whois.Begin(ip)
 		}
 	}
--- a/internal/home/home.go
+++ b/internal/home/home.go
@@ -61,7 +61,9 @@ type homeContext struct {
 	autoHosts  util.AutoHosts       // IP-hostname pairs taken from system configuration (e.g. /etc/hosts) files
 	updater    *updater.Updater

-	ipDetector *aghnet.IPDetector
+	subnetDetector  *aghnet.SubnetDetector
+	systemResolvers aghnet.SystemResolvers
+	localResolvers  aghnet.Exchanger

 	// mux is our custom http.ServeMux.
 	mux *http.ServeMux
@@ -220,6 +222,110 @@ func setupConfig(args options) {
 	}
 }

+const defaultLocalTimeout = 5 * time.Second
+
+// stringsSetSubtract subtracts b from a interpreted as sets.
+//
+// TODO(e.burkov): Move into our internal package for working with strings.
+func stringsSetSubtract(a, b []string) (c []string) {
+	// unit is an object to be used as value in set.
+	type unit = struct{}
+
+	cSet := make(map[string]unit)
+	for _, k := range a {
+		cSet[k] = unit{}
+	}
+
+	for _, k := range b {
+		delete(cSet, k)
+	}
+
+	c = make([]string, len(cSet))
+	i := 0
+	for k := range cSet {
+		c[i] = k
+		i++
+	}
+
+	return c
+}
+
+// collectAllIfacesAddrs returns the slice of all network interfaces IP
+// addresses without port number.
+func collectAllIfacesAddrs() (addrs []string, err error) {
+	var ifaces []net.Interface
+	ifaces, err = net.Interfaces()
+	if err != nil {
+		return nil, fmt.Errorf("getting network interfaces: %w", err)
+	}
+
+	for _, iface := range ifaces {
+		var ifaceAddrs []net.Addr
+		ifaceAddrs, err = iface.Addrs()
+		if err != nil {
+			return nil, fmt.Errorf("getting addresses for %q: %w", iface.Name, err)
+		}
+
+		for _, addr := range ifaceAddrs {
+			cidr := addr.String()
+			var ip net.IP
+			ip, _, err = net.ParseCIDR(cidr)
+			if err != nil {
+				return nil, fmt.Errorf("parsing %q as cidr: %w", cidr, err)
+			}
+
+			addrs = append(addrs, ip.String())
+		}
+	}
+
+	return addrs, nil
+}
+
+// collectDNSIPAddrs returns the slice of IP addresses without port number which
+// we are listening on.
+func collectDNSIPaddrs() (addrs []string, err error) {
+	addrs = make([]string, len(config.DNS.BindHosts))
+
+	for i, bh := range config.DNS.BindHosts {
+		if bh.IsUnspecified() {
+			return collectAllIfacesAddrs()
+		}
+
+		addrs[i] = bh.String()
+	}
+
+	return addrs, nil
+}
+
+func setupResolvers() {
+	// TODO(e.burkov): Enhance when the config will contain local resolvers
+	// addresses.
+
+	sysRes, err := aghnet.NewSystemResolvers(0, nil)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	Context.systemResolvers = sysRes
+
+	var ourAddrs []string
+	ourAddrs, err = collectDNSIPaddrs()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// TODO(e.burkov): The approach of subtracting sets of strings is not
+	// really applicable here since in case of listening on all network
+	// interfaces we should check the whole interface's network to cut off
+	// all the loopback addresses as well.
+	addrs := stringsSetSubtract(sysRes.Get(), ourAddrs)
+
+	Context.localResolvers, err = aghnet.NewMultiAddrExchanger(addrs, defaultLocalTimeout)
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+
 // run performs configurating and starts AdGuard Home.
 func run(args options) {
 	// configure config filename
@@ -305,11 +411,13 @@ func run(args options) {
 		log.Fatalf("Can't initialize Web module")
 	}

-	Context.ipDetector, err = aghnet.NewIPDetector()
+	Context.subnetDetector, err = aghnet.NewSubnetDetector()
 	if err != nil {
 		log.Fatal(err)
 	}

+	setupResolvers()
+
 	if !Context.firstRun {
 		err = initDNSServer()
 		if err != nil {
--- a/internal/home/rdns.go
+++ b/internal/home/rdns.go
@@ -2,129 +2,163 @@ package home

 import (
 	"encoding/binary"
+	"fmt"
 	"net"
 	"strings"
 	"time"

+	"github.com/AdguardTeam/AdGuardHome/internal/agherr"
+	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/golibs/cache"
 	"github.com/AdguardTeam/golibs/log"
 	"github.com/miekg/dns"
 )

-// RDNS - module context
+// RDNS resolves clients' addresses to enrich their metadata.
 type RDNS struct {
-	dnsServer *dnsforward.Server
-	clients   *clientsContainer
-	ipChannel chan net.IP // pass data from DNS request handling thread to rDNS thread
+	dnsServer      *dnsforward.Server
+	clients        *clientsContainer
+	subnetDetector *aghnet.SubnetDetector
+	localResolvers aghnet.Exchanger

-	// Contains IP addresses of clients to be resolved by rDNS
-	// If IP address is resolved, it stays here while it's inside Clients.
-	//  If it's removed from Clients, this IP address will be resolved once again.
-	// If IP address couldn't be resolved, it stays here for some time to prevent further attempts to resolve the same IP.
-	ipAddrs cache.Cache
+	// ipCh used to pass client's IP to rDNS workerLoop.
+	ipCh chan net.IP
+
+	// ipCache caches the IP addresses to be resolved by rDNS.  The resolved
+	// address stays here while it's inside clients.  After leaving clients
+	// the address will be resolved once again.  If the address couldn't be
+	// resolved, cache prevents further attempts to resolve it for some
+	// time.
+	ipCache cache.Cache
 }

-// InitRDNS - create module context
-func InitRDNS(dnsServer *dnsforward.Server, clients *clientsContainer) *RDNS {
-	r := &RDNS{
-		dnsServer: dnsServer,
-		clients:   clients,
-		ipAddrs: cache.New(cache.Config{
+// Default rDNS values.
+const (
+	defaultRDNSCacheSize = 10000
+	defaultRDNSCacheTTL  = 1 * 60 * 60
+	defaultRDNSIPChSize  = 256
+)
+
+// NewRDNS creates and returns initialized RDNS.
+func NewRDNS(
+	dnsServer *dnsforward.Server,
+	clients *clientsContainer,
+	snd *aghnet.SubnetDetector,
+	lr aghnet.Exchanger,
+) (rDNS *RDNS) {
+	rDNS = &RDNS{
+		dnsServer:      dnsServer,
+		clients:        clients,
+		subnetDetector: snd,
+		localResolvers: lr,
+		ipCache: cache.New(cache.Config{
 			EnableLRU: true,
-			MaxCount:  10000,
+			MaxCount:  defaultRDNSCacheSize,
 		}),
-		ipChannel: make(chan net.IP, 256),
+		ipCh: make(chan net.IP, defaultRDNSIPChSize),
 	}

-	go r.workerLoop()
-	return r
+	go rDNS.workerLoop()
+
+	return rDNS
 }

-// Begin - add IP address to rDNS queue
+// Begin adds the ip to the resolving queue if it is not cached or already
+// resolved.
 func (r *RDNS) Begin(ip net.IP) {
 	now := uint64(time.Now().Unix())
-	expire := r.ipAddrs.Get(ip)
-	if len(expire) != 0 {
-		exp := binary.BigEndian.Uint64(expire)
-		if exp > now {
+	if expire := r.ipCache.Get(ip); len(expire) != 0 {
+		if binary.BigEndian.Uint64(expire) > now {
 			return
 		}
-		// TTL expired
 	}
-	expire = make([]byte, 8)
-	const ttl = 1 * 60 * 60
-	binary.BigEndian.PutUint64(expire, now+ttl)
-	_ = r.ipAddrs.Set(ip, expire)
+
+	// The cache entry either expired or doesn't exist.
+	ttl := make([]byte, 8)
+	binary.BigEndian.PutUint64(ttl, now+defaultRDNSCacheTTL)
+	r.ipCache.Set(ip, ttl)

 	id := ip.String()
 	if r.clients.Exists(id, ClientSourceRDNS) {
 		return
 	}

-	log.Tracef("rDNS: adding %s", ip)
 	select {
-	case r.ipChannel <- ip:
-		//
+	case r.ipCh <- ip:
+		log.Tracef("rdns: %q added to queue", ip)
 	default:
-		log.Tracef("rDNS: queue is full")
+		log.Tracef("rdns: queue is full")
 	}
 }

-// Use rDNS to get hostname by IP address
-func (r *RDNS) resolve(ip net.IP) string {
-	log.Tracef("Resolving host for %s", ip)
+const (
+	// rDNSEmptyAnswerErr is returned by RDNS resolve method when the answer
+	// section of respond is empty.
+	rDNSEmptyAnswerErr agherr.Error = "the answer section is empty"

-	name, err := dns.ReverseAddr(ip.String())
-	if err != nil {
-		log.Debug("Error while calling dns.ReverseAddr(%s): %s", ip, err)
-		return ""
-	}
+	// rDNSNotPTRErr is returned by RDNS resolve method when the response is
+	// not of PTR type.
+	rDNSNotPTRErr agherr.Error = "the response is not a ptr"
+)

-	resp, err := r.dnsServer.Exchange(&dns.Msg{
+// resolve tries to resolve the ip in a suitable way.
+func (r *RDNS) resolve(ip net.IP) (host string, err error) {
+	log.Tracef("rdns: resolving host for %q", ip)
+
+	arpa := dns.Fqdn(aghnet.ReverseAddr(ip))
+	msg := &dns.Msg{
 		MsgHdr: dns.MsgHdr{
 			Id:               dns.Id(),
 			RecursionDesired: true,
 		},
+		Compress: true,
 		Question: []dns.Question{{
-			Name:   name,
+			Name:   arpa,
 			Qtype:  dns.TypePTR,
 			Qclass: dns.ClassINET,
 		}},
-	})
+	}
+
+	var resp *dns.Msg
+	if r.subnetDetector.IsLocallyServedNetwork(ip) {
+		resp, err = r.localResolvers.Exchange(msg)
+	} else {
+		resp, err = r.dnsServer.Exchange(msg)
+	}
 	if err != nil {
-		log.Debug("Error while making an rDNS lookup for %s: %s", ip, err)
-		return ""
+		return "", fmt.Errorf("performing lookup for %q: %w", arpa, err)
 	}
+
 	if len(resp.Answer) == 0 {
-		log.Debug("No answer for rDNS lookup of %s", ip)
-		return ""
+		return "", fmt.Errorf("lookup for %q: %w", arpa, rDNSEmptyAnswerErr)
 	}
+
 	ptr, ok := resp.Answer[0].(*dns.PTR)
 	if !ok {
-		log.Debug("not a PTR response for %s", ip)
-		return ""
+		return "", fmt.Errorf("type checking: %w", rDNSNotPTRErr)
 	}

-	log.Tracef("PTR response for %s: %s", ip, ptr.String())
-	if strings.HasSuffix(ptr.Ptr, ".") {
-		ptr.Ptr = ptr.Ptr[:len(ptr.Ptr)-1]
-	}
+	log.Tracef("rdns: ptr response for %q: %s", ip, ptr.String())

-	return ptr.Ptr
+	return strings.TrimSuffix(ptr.Ptr, "."), nil
 }

-// Wait for a signal and then synchronously resolve hostname by IP address
-// Add the hostname:IP pair to "Clients" array
+// workerLoop handles incoming IP addresses from ipChan and adds it into
+// clients.
 func (r *RDNS) workerLoop() {
-	for {
-		ip := <-r.ipChannel
+	defer agherr.LogPanic("rdns")
+
+	for ip := range r.ipCh {
+		host, err := r.resolve(ip)
+		if err != nil {
+			log.Error("rdns: resolving %q: %s", ip, err)

-		host := r.resolve(ip)
-		if len(host) == 0 {
 			continue
 		}

+		// Don't handle any errors since AddHost doesn't return non-nil
+		// errors for now.
 		_, _ = r.clients.AddHost(ip.String(), host, ClientSourceRDNS)
 	}
 }
--- a/internal/home/rdns_test.go
+++ b/internal/home/rdns_test.go
@@ -1,32 +1,265 @@
 package home

 import (
+	"bytes"
+	"encoding/binary"
+	"errors"
 	"net"
+	"sync"
 	"testing"
+	"time"

+	"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
 	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/AdguardTeam/dnsproxy/upstream"
+	"github.com/AdguardTeam/golibs/cache"
+	"github.com/AdguardTeam/golibs/log"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )

-func TestResolveRDNS(t *testing.T) {
-	ups := &aghtest.TestUpstream{
+func TestRDNS_Begin(t *testing.T) {
+	aghtest.ReplaceLogLevel(t, log.DEBUG)
+	w := &bytes.Buffer{}
+	aghtest.ReplaceLogWriter(t, w)
+
+	ip1234, ip1235 := net.IP{1, 2, 3, 4}, net.IP{1, 2, 3, 5}
+
+	testCases := []struct {
+		cliIDIndex    map[string]*Client
+		customChan    chan net.IP
+		name          string
+		wantLog       string
+		req           net.IP
+		wantCacheHit  int
+		wantCacheMiss int
+	}{{
+		cliIDIndex:    map[string]*Client{},
+		customChan:    nil,
+		name:          "cached",
+		wantLog:       "",
+		req:           ip1234,
+		wantCacheHit:  1,
+		wantCacheMiss: 0,
+	}, {
+		cliIDIndex:    map[string]*Client{},
+		customChan:    nil,
+		name:          "not_cached",
+		wantLog:       "rdns: queue is full",
+		req:           ip1235,
+		wantCacheHit:  0,
+		wantCacheMiss: 1,
+	}, {
+		cliIDIndex:    map[string]*Client{"1.2.3.5": {}},
+		customChan:    nil,
+		name:          "already_in_clients",
+		wantLog:       "",
+		req:           ip1235,
+		wantCacheHit:  0,
+		wantCacheMiss: 1,
+	}, {
+		cliIDIndex:    map[string]*Client{},
+		customChan:    make(chan net.IP, 1),
+		name:          "add_to_queue",
+		wantLog:       `rdns: "1.2.3.5" added to queue`,
+		req:           ip1235,
+		wantCacheHit:  0,
+		wantCacheMiss: 1,
+	}}
+
+	for _, tc := range testCases {
+		w.Reset()
+
+		ipCache := cache.New(cache.Config{
+			EnableLRU: true,
+			MaxCount:  defaultRDNSCacheSize,
+		})
+		ttl := make([]byte, binary.Size(uint64(0)))
+		binary.BigEndian.PutUint64(ttl, uint64(time.Now().Add(100*time.Hour).Unix()))
+
+		rdns := &RDNS{
+			ipCache: ipCache,
+			clients: &clientsContainer{
+				list:    map[string]*Client{},
+				idIndex: tc.cliIDIndex,
+				ipHost:  map[string]*ClientHost{},
+				allTags: map[string]bool{},
+			},
+		}
+		ipCache.Clear()
+		ipCache.Set(net.IP{1, 2, 3, 4}, ttl)
+
+		if tc.customChan != nil {
+			rdns.ipCh = tc.customChan
+			defer close(tc.customChan)
+		}
+
+		t.Run(tc.name, func(t *testing.T) {
+			rdns.Begin(tc.req)
+			assert.Equal(t, tc.wantCacheHit, ipCache.Stats().Hit)
+			assert.Equal(t, tc.wantCacheMiss, ipCache.Stats().Miss)
+			assert.Contains(t, w.String(), tc.wantLog)
+		})
+	}
+}
+
+func TestRDNS_Resolve(t *testing.T) {
+	extUpstream := &aghtest.TestUpstream{
 		Reverse: map[string][]string{
 			"1.1.1.1.in-addr.arpa.": {"one.one.one.one"},
 		},
 	}
+	locUpstream := &aghtest.TestUpstream{
+		Reverse: map[string][]string{
+			"1.1.168.192.in-addr.arpa.": {"local.domain"},
+			"2.1.168.192.in-addr.arpa.": {},
+		},
+	}
+	upstreamErr := errors.New("upstream error")
+	errUpstream := &aghtest.TestErrUpstream{
+		Err: upstreamErr,
+	}
+	nonPtrUpstream := &aghtest.TestBlockUpstream{
+		Hostname: "some-host",
+		Block:    true,
+	}
+
 	dns := dnsforward.NewCustomServer(&proxy.Proxy{
 		Config: proxy.Config{
 			UpstreamConfig: &proxy.UpstreamConfig{
-				Upstreams: []upstream.Upstream{ups},
+				Upstreams: []upstream.Upstream{extUpstream},
 			},
 		},
 	})

-	clients := &clientsContainer{}
-	rdns := InitRDNS(dns, clients)
-	r := rdns.resolve(net.IP{1, 1, 1, 1})
-	assert.Equal(t, "one.one.one.one", r, r)
+	cc := &clientsContainer{}
+
+	snd, err := aghnet.NewSubnetDetector()
+	require.NoError(t, err)
+
+	localIP := net.IP{192, 168, 1, 1}
+	testCases := []struct {
+		name        string
+		want        string
+		wantErr     error
+		locUpstream upstream.Upstream
+		req         net.IP
+	}{{
+		name:        "external_good",
+		want:        "one.one.one.one",
+		wantErr:     nil,
+		locUpstream: nil,
+		req:         net.IP{1, 1, 1, 1},
+	}, {
+		name:        "local_good",
+		want:        "local.domain",
+		wantErr:     nil,
+		locUpstream: locUpstream,
+		req:         localIP,
+	}, {
+		name:        "upstream_error",
+		want:        "",
+		wantErr:     upstreamErr,
+		locUpstream: errUpstream,
+		req:         localIP,
+	}, {
+		name:        "empty_answer_error",
+		want:        "",
+		wantErr:     rDNSEmptyAnswerErr,
+		locUpstream: locUpstream,
+		req:         net.IP{192, 168, 1, 2},
+	}, {
+		name:        "not_ptr_error",
+		want:        "",
+		wantErr:     rDNSNotPTRErr,
+		locUpstream: nonPtrUpstream,
+		req:         localIP,
+	}}
+
+	for _, tc := range testCases {
+		rdns := NewRDNS(dns, cc, snd, &aghtest.Exchanger{
+			Ups: tc.locUpstream,
+		})
+
+		t.Run(tc.name, func(t *testing.T) {
+			r, rerr := rdns.resolve(tc.req)
+			require.ErrorIs(t, rerr, tc.wantErr)
+			assert.Equal(t, tc.want, r)
+		})
+	}
+}
+
+func TestRDNS_WorkerLoop(t *testing.T) {
+	aghtest.ReplaceLogLevel(t, log.DEBUG)
+	w := &bytes.Buffer{}
+	aghtest.ReplaceLogWriter(t, w)
+
+	locUpstream := &aghtest.TestUpstream{
+		Reverse: map[string][]string{
+			"1.1.168.192.in-addr.arpa.": {"local.domain"},
+		},
+	}
+
+	snd, err := aghnet.NewSubnetDetector()
+	require.NoError(t, err)
+
+	testCases := []struct {
+		wantLog string
+		name    string
+		cliIP   net.IP
+	}{{
+		wantLog: "",
+		name:    "all_good",
+		cliIP:   net.IP{192, 168, 1, 1},
+	}, {
+		wantLog: `rdns: resolving "192.168.1.2": lookup for "2.1.168.192.in-addr.arpa.": ` +
+			string(rDNSEmptyAnswerErr),
+		name:  "resolve_error",
+		cliIP: net.IP{192, 168, 1, 2},
+	}}
+
+	for _, tc := range testCases {
+		w.Reset()
+
+		lr := &aghtest.Exchanger{
+			Ups: locUpstream,
+		}
+		cc := &clientsContainer{
+			list:    map[string]*Client{},
+			idIndex: map[string]*Client{},
+			ipHost:  map[string]*ClientHost{},
+			allTags: map[string]bool{},
+		}
+		ch := make(chan net.IP)
+		rdns := &RDNS{
+			dnsServer:      nil,
+			clients:        cc,
+			subnetDetector: snd,
+			localResolvers: lr,
+			ipCh:           ch,
+		}
+
+		t.Run(tc.name, func(t *testing.T) {
+			var wg sync.WaitGroup
+			wg.Add(1)
+			go func() {
+				rdns.workerLoop()
+				wg.Done()
+			}()
+
+			ch <- tc.cliIP
+			close(ch)
+			wg.Wait()
+
+			if tc.wantLog != "" {
+				assert.Contains(t, w.String(), tc.wantLog)
+
+				return
+			}
+
+			assert.True(t, cc.Exists(tc.cliIP.String(), ClientSourceRDNS))
+		})
+	}
 }