Skip to content

Log the tunnel build and DNS decisions for troubleshooting - #268

Open
pappz wants to merge 2 commits into
mainfrom
log-tun-dns-diagnostics
Open

pappz wants to merge 2 commits into
mainfrom
log-tun-dns-diagnostics

Conversation

@pappz

@pappz pappz commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

Adds the Android-side logging needed to diagnose route and DNS problems
from a logcat dump, which the Go status alone cannot explain.

  • IFace: log the established tunnel (address, MTU, DNS, search domains,
    routes) and the Private DNS decision together with the network it was
    taken on; explain a null from establish().
  • VPNService: log why a TUN renewal was skipped or failed, and write a
    one-line diagnostic snapshot (OS tunnel state vs. engine wants, active
    network, always-on/lockdown, battery exemption) before every debug
    bundle. currentTUNParameters becomes volatile as it is read across
    threads.
  • DNSWatch: log Private DNS transitions and host resolver changes.
  • NetworkChangeDetector: log validation transitions at info, demote the
    per-capability dump to verbose.
  • New NetworkDiagnostics helper for the one-line descriptions.

No behaviour change beyond logging.

Two conditions on Android leave the home screen saying Connected while
nothing works, and neither shows up in a logcat dump today. The Android
core writes no log file, so a debug bundle only holds whatever is still
in the logcat ring buffer; the lines that would explain a stuck tunnel
are usually gone by the time anyone looks.

Routes reach the OS only by rebuilding the VPN interface. When
establish() fails during that rebuild, configureInterface swallows the
error, recreateTUN returns silently, and the engine keeps believing the
new route set is live. Log every exit of recreateTUN, the wanted versus
applied route list on failure, and a one-line summary of each
established tunnel. A null establish() is called out separately, since
it means the app is no longer the prepared VPN.

The NetBird resolver is left out of the tunnel whenever Android reports
Private DNS in use on the active network. That check runs on every
rebuild against whatever network is active at that moment, so the
outcome depends on where the phone happened to be. Log the decision
together with the network it was taken on, and log the Private DNS
transitions and host resolver updates DNSWatch already tracks.

Add a diagnostic snapshot, written before every debug bundle and every
ten minutes while the engine runs: engine status, connected peers, the
tunnel parameters we asked for, the routes the engine wants, whether
the two agree, and what the OS actually holds on the VPN interface,
plus always-on, lockdown and battery exemption state. It lands in the
bundle's logcat.txt and reveals a route or DNS mismatch even after the
events that caused it have rolled out of the buffer.

Trim the two full NetworkCapabilities dumps in NetworkChangeDetector to
a compact form and demote the per-change one to verbose; they were the
noisiest lines in the buffer, which is the very resource these
diagnostics compete for.

currentTUNParameters becomes volatile: the snapshot reads it from the
main thread while the tunnel builder writes it from the Go or TUN
looper thread.
The snapshot stays as a one-shot before every debug bundle, where the
user asked for help and the logcat picture is worth the line. Repeating
it every ten minutes for the lifetime of the engine only fills the
buffer, and the unchanged-routes renewal message fires on every network
change, so it moves to debug level.
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

Next included review available in 4 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 87b5fe4e-6924-470f-9ae7-20029e501eac

📥 Commits

Reviewing files that changed from the base of the PR and between 0d1a201 and bcfa5fd.

📒 Files selected for processing (5)
  • tool/src/main/java/io/netbird/client/tool/DNSWatch.java
  • tool/src/main/java/io/netbird/client/tool/IFace.java
  • tool/src/main/java/io/netbird/client/tool/VPNService.java
  • tool/src/main/java/io/netbird/client/tool/networks/NetworkChangeDetector.java
  • tool/src/main/java/io/netbird/client/tool/networks/NetworkDiagnostics.java

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pappz pappz changed the title Log tun dns diagnostics Log the tunnel build and DNS decisions for troubleshooting Sep 14, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant