retch_sysinfo/

network.rs

// SPDX-FileCopyrightText: 2026 Ken Tobias
// SPDX-License-Identifier: GPL-3.0-or-later

//! Network interface detection, IP resolution, Wi-Fi, and related helpers.

use owo_colors::OwoColorize;
use sysinfo::Networks;

/// Detects the local IP address and active network interface name.
pub fn detect_active_interface_and_local_ip() -> (Option<String>, Option<String>) {
    let local_ip = std::net::UdpSocket::bind("0.0.0.0:0")
        .ok()
        .and_then(|socket| {
            socket.connect("8.8.8.8:53").ok()?;
            socket.local_addr().ok().map(|addr| addr.ip().to_string())
        });

    let active_interface = {
        #[cfg(target_os = "linux")]
        {
            let native_iface = std::fs::read_to_string("/proc/net/route")
                .ok()
                .and_then(|content| parse_proc_net_route(&content));

            native_iface.or_else(|| {
                std::process::Command::new("ip")
                    .args(["route", "show", "default"])
                    .output()
                    .ok()
                    .and_then(|o| String::from_utf8(o.stdout).ok())
                    .and_then(|s| {
                        s.split_whitespace()
                            .position(|w| w == "dev")
                            .and_then(|i| s.split_whitespace().nth(i + 1))
                            .map(|s| s.to_string())
                    })
            })
        }
        #[cfg(target_os = "macos")]
        {
            std::process::Command::new("route")
                .args(["-n", "get", "default"])
                .output()
                .ok()
                .and_then(|o| String::from_utf8(o.stdout).ok())
                .and_then(|s| {
                    s.lines()
                        .find(|l| l.contains("interface:"))
                        .and_then(|l| l.split_whitespace().last())
                        .map(|s| s.to_string())
                })
        }
        #[cfg(target_os = "windows")]
        {
            // Identify the active (default-route) interface as the adapter whose
            // assigned IPs include the outbound `local_ip` we just resolved via the
            // UDP-connect trick. This avoids spawning PowerShell `Get-NetRoute`,
            // which costs ~1s of startup on Windows and dominated `--short` runtime.
            // sysinfo already exposes per-interface IPs on Windows (see
            // `detect_networks`), so no process spawn or extra API call is needed.
            local_ip
                .as_deref()
                .and_then(|ip| ip.parse::<std::net::IpAddr>().ok())
                .and_then(|target| {
                    let networks = Networks::new_with_refreshed_list();
                    match_active_interface(
                        networks.iter().map(|(name, data)| {
                            (
                                name.to_string(),
                                data.ip_networks().iter().map(|n| n.addr).collect(),
                            )
                        }),
                        target,
                    )
                })
        }
        #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
        {
            None
        }
    };

    (local_ip, active_interface)
}

/// Returns the name of the interface whose assigned IPs include `local_ip`.
///
/// Used on Windows to identify the active (default-route) interface without a
/// slow `Get-NetRoute` PowerShell spawn: the outbound local IP the OS picks to
/// reach the internet uniquely belongs to the adapter carrying the default
/// route, so matching it against each adapter's IP set yields the same answer.
#[cfg(any(target_os = "windows", test))]
fn match_active_interface(
    ifaces: impl Iterator<Item = (String, Vec<std::net::IpAddr>)>,
    local_ip: std::net::IpAddr,
) -> Option<String> {
    ifaces
        .into_iter()
        .find(|(_, ips)| ips.contains(&local_ip))
        .map(|(name, _)| name)
}

/// Fetches the public IP address from `ipinfo.io/ip` (best-effort, 2 s timeout).
///
/// ipinfo.io rather than ipify since v0.20.2: ~96 ms against ~123 ms, 30 runs each, and
/// steadier (sd 5 vs 14 ms); it is the probe that bounds `--long`'s concurrent scope. Both
/// publish only IPv4 addresses, so the field still reports the IPv4 address.
///
/// `curl -f` makes an HTTP error a failure, and [`parse_public_ip`] rejects anything that
/// is not a single address. Until v0.20.2 neither check existed, so an error page, a
/// rate-limit notice or a captive portal's HTML would have been printed as the IP.
pub fn detect_public_ip() -> Option<String> {
    let out = std::process::Command::new("curl")
        .args(["-sf", "--max-time", "2", "https://ipinfo.io/ip"])
        .output()
        .ok()?;
    if !out.status.success() {
        return None;
    }
    parse_public_ip(&String::from_utf8_lossy(&out.stdout))
}

/// Accepts a response only if, trimmed, it is exactly one IPv4 or IPv6 address.
fn parse_public_ip(body: &str) -> Option<String> {
    body.trim()
        .parse::<std::net::IpAddr>()
        .ok()
        .map(|ip| ip.to_string())
}

/// Builds the formatted list of network interfaces with IP addresses and RX/TX stats.
/// One network interface, as both the rendered display line and the facts about it.
///
/// **The two fields exist because returning only the string was the bug.** `display.rs`
/// needed to know which entry was the active interface and which were up, and with nothing
/// but a formatted, ANSI-colourised line to go on it resorted to `line.contains(active)`
/// and `line.contains("[Up]")`. Both were wrong: the first matches any interface whose
/// *rendered line* contains the active name as a substring (`Wi-Fi` matches
/// `Wi-Fi-Native WiFi Filter Driver-0000`, and on Linux `eth0` matches `eth0.100`), and
/// the second could never match at all, because the status is colourised, so the bytes are
/// `[`+`\x1b[32m`+`Up`+`\x1b[39m`+`]` and the literal `[Up]` never appears.
///
/// Carrying the facts alongside the presentation makes both questions exact.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct NetworkInterface {
    /// Kernel/adapter interface name, exactly as the OS reports it (`eth0`, `Wi-Fi`).
    /// This is the same vocabulary `active_interface` uses, so the two compare directly.
    pub name: String,
    /// Whether the interface is up, or has moved bytes.
    pub is_up: bool,
    /// The formatted display line, including the name, addresses, status and RX/TX.
    pub line: String,
}

pub fn detect_networks(
    active_interface: Option<&str>,
    local_ip: Option<&str>,
) -> Vec<NetworkInterface> {
    // On Windows, NDIS lightweight filters bound to an adapter are reported as interfaces
    // in their own right, each carrying a copy of that adapter's counters — so a single
    // Wi-Fi card shows up as `Wi-Fi` plus several `Wi-Fi-<filter>-0000` entries with
    // identical RX/TX. Drop them, on the same rule `net-io` uses, so an adapter is listed
    // once. Computed before the loop because it is one table read, not one per interface.
    #[cfg(target_os = "windows")]
    let excluded = crate::win_iftable::excluded_interface_names();

    Networks::new_with_refreshed_list()
        .iter()
        .filter(|(name, _)| {
            #[cfg(target_os = "windows")]
            {
                !excluded.iter().any(|e| e == *name)
            }
            #[cfg(not(target_os = "windows"))]
            {
                let _ = name;
                true
            }
        })
        .map(|(name, data)| {
            let rx = format_bytes(data.total_received());
            let tx = format_bytes(data.total_transmitted());
            let is_up = data.operational_state() == sysinfo::InterfaceOperationalState::Up
                || data.total_received() > 0
                || data.total_transmitted() > 0;
            let status = if is_up {
                "Up".green().to_string()
            } else {
                "Down".red().to_string()
            };

            let mut ipv4_addresses = Vec::new();
            let mut ipv6_addresses = Vec::new();

            if is_up {
                for ip_net in data.ip_networks() {
                    let ip = ip_net.addr;
                    let name_lower = name.to_lowercase();
                    let is_loopback_iface =
                        name_lower.starts_with("lo") || name_lower.contains("loopback");
                    if ip.is_loopback() && !is_loopback_iface {
                        continue;
                    }
                    match ip {
                        std::net::IpAddr::V4(v4) => {
                            ipv4_addresses.push(v4.to_string());
                        }
                        std::net::IpAddr::V6(v6) => {
                            if !v6.is_unicast_link_local() {
                                ipv6_addresses.push(v6.to_string());
                            }
                        }
                    }
                }

                // Fallback to active interface UDP-resolved local IP if no IPs detected by sysinfo
                if ipv4_addresses.is_empty() && ipv6_addresses.is_empty() {
                    if let (Some(active), Some(ip)) = (active_interface, local_ip) {
                        if name == active {
                            ipv4_addresses.push(ip.to_string());
                        }
                    }
                }
            }

            let ip_str = if !ipv4_addresses.is_empty() || !ipv6_addresses.is_empty() {
                let mut combined = Vec::new();
                if !ipv4_addresses.is_empty() {
                    combined.push(ipv4_addresses.join(", "));
                }
                if !ipv6_addresses.is_empty() {
                    combined.push(ipv6_addresses.join(", "));
                }
                format!(" ({})", combined.join(", "))
            } else {
                String::new()
            };

            NetworkInterface {
                name: name.to_string(),
                is_up,
                line: format!("{}{} [{}] RX: {} TX: {}", name, ip_str, status, rx, tx),
            }
        })
        .collect()
}

/// Formats a byte count into human-readable form (KB, MB, GB, etc.)
pub fn format_bytes(bytes: u64) -> String {
    const KB: u64 = 1024;
    const MB: u64 = KB * 1024;
    const GB: u64 = MB * 1024;

    if bytes >= GB {
        format!("{:.1} GB", bytes as f64 / GB as f64)
    } else if bytes >= MB {
        format!("{:.1} MB", bytes as f64 / MB as f64)
    } else if bytes >= KB {
        format!("{:.1} KB", bytes as f64 / KB as f64)
    } else {
        format!("{} B", bytes)
    }
}

/// Looks up a PCI vendor name from `/usr/share/hwdata/pci.ids` (or fallback paths).
///
/// `vendor_id` should be a lowercase hex string without the `0x` prefix.
pub fn lookup_pci_vendor(vendor_id: &str) -> Option<String> {
    let vendor_id = vendor_id.trim_start_matches("0x").to_lowercase();
    let paths = ["/usr/share/hwdata/pci.ids", "/usr/share/misc/pci.ids"];
    for path in &paths {
        if let Ok(content) = std::fs::read_to_string(path) {
            for line in content.lines() {
                if line.starts_with('#') || line.is_empty() {
                    continue;
                }
                if !line.starts_with('\t') {
                    let parts: Vec<&str> = line.split_whitespace().collect();
                    if parts.len() >= 2 && parts[0].to_lowercase() == vendor_id {
                        let name = line.strip_prefix(parts[0]).unwrap().trim();
                        return Some(name.to_string());
                    }
                }
            }
        }
    }
    None
}

/// Detects the connected Wi-Fi network and link parameters.
pub fn detect_wifi() -> Option<String> {
    #[cfg(target_os = "linux")]
    {
        let mut wifi_interface = None;
        if let Ok(entries) = std::fs::read_dir("/sys/class/net") {
            for entry in entries.filter_map(|e| e.ok()) {
                let path = entry.path();
                if path.join("wireless").exists() || path.join("phy80211").exists() {
                    wifi_interface = Some(entry.file_name().to_string_lossy().to_string());
                    break;
                }
            }
        }

        if let Some(ref iface) = wifi_interface {
            if let Ok(output) = std::process::Command::new("iw")
                .args(["dev", iface, "link"])
                .output()
            {
                if let Ok(stdout) = String::from_utf8(output.stdout) {
                    let (ssid, links) = parse_iw_link_output(&stdout);
                    if let Some(s) = ssid {
                        let card_model = get_wifi_card_model(iface);
                        let prefix = if let Some(m) = card_model {
                            format!("{} [{}] - ", m, iface)
                        } else {
                            format!("[{}] - ", iface)
                        };

                        if !links.is_empty() {
                            let mut link_strs = Vec::new();
                            for link in links {
                                let freq_str = link.freq.map(|f| {
                                    let ghz_mhz = if f >= 1000.0 {
                                        format!("{:.1} GHz", f / 1000.0)
                                    } else {
                                        format!("{} MHz", f)
                                    };
                                    if let Some(ch) = freq_to_channel(f) {
                                        format!("{} ch{}", ghz_mhz, ch)
                                    } else {
                                        ghz_mhz
                                    }
                                });

                                let mut rx_tx = Vec::new();
                                if let Some(rx) = link.rx_rate {
                                    if rx != "0"
                                        && !rx.starts_with("0 ")
                                        && rx != "0 Mbps"
                                        && rx != "0 MBit/s"
                                    {
                                        rx_tx.push(format!("↓{}", clean_rate(&rx)));
                                    }
                                }
                                if let Some(tx) = link.tx_rate {
                                    if tx != "0"
                                        && !tx.starts_with("0 ")
                                        && tx != "0 Mbps"
                                        && tx != "0 MBit/s"
                                    {
                                        rx_tx.push(format!("↑{}", clean_rate(&tx)));
                                    }
                                }

                                match (freq_str, rx_tx.is_empty()) {
                                    (Some(f), false) => {
                                        link_strs.push(format!("{} [{}]", f, rx_tx.join(" ")))
                                    }
                                    (Some(f), true) => link_strs.push(f),
                                    (None, false) => link_strs.push(rx_tx.join(" ")),
                                    _ => {}
                                }
                            }
                            if !link_strs.is_empty() {
                                return Some(format!(
                                    "{}{}{} ({})",
                                    prefix,
                                    s,
                                    "",
                                    link_strs.join(", ")
                                ));
                            } else {
                                return Some(format!("{}{}", prefix, s));
                            }
                        }
                        return Some(format!("{}{}", prefix, s));
                    }
                }
            }
        }

        // Fallback to nmcli (using --rescan no to avoid slow hardware channel scans)
        if let Ok(output) = std::process::Command::new("nmcli")
            .args([
                "-t",
                "-f",
                "active,ssid,rate",
                "device",
                "wifi",
                "list",
                "--rescan",
                "no",
            ])
            .output()
        {
            if let Ok(stdout) = String::from_utf8(output.stdout) {
                for line in stdout.lines() {
                    let line = line.trim();
                    if let Some(rest) = line.strip_prefix("yes:") {
                        if let Some(colon_idx) = rest.rfind(':') {
                            let ssid = &rest[..colon_idx];
                            let rate = rest[colon_idx + 1..].trim();
                            if !ssid.is_empty() {
                                if !rate.is_empty()
                                    && rate != "0"
                                    && !rate.starts_with("0 ")
                                    && rate != "0 Mbit/s"
                                    && rate != "0 Mbps"
                                {
                                    return Some(format!("{} ({})", ssid, clean_rate(rate)));
                                } else {
                                    return Some(ssid.to_string());
                                }
                            }
                        } else if !rest.is_empty() {
                            return Some(rest.to_string());
                        }
                    }
                }
            }
        }

        // Fallback to iwgetid
        if let Ok(output) = std::process::Command::new("iwgetid").arg("-r").output() {
            if let Ok(stdout) = String::from_utf8(output.stdout) {
                let ssid = stdout.trim();
                if !ssid.is_empty() {
                    return Some(ssid.to_string());
                }
            }
        }
        None
    }

    #[cfg(target_os = "macos")]
    {
        crate::macos_ffi::get_wifi_info().map(|(ssid, rate)| match rate {
            Some(r) if r > 0 => format!("{} (↑{} Mbps)", ssid, r),
            _ => ssid,
        })
    }

    #[cfg(target_os = "windows")]
    {
        if let Ok(output) = std::process::Command::new("netsh")
            .args(["wlan", "show", "interfaces"])
            .output()
        {
            if let Ok(stdout) = String::from_utf8(output.stdout) {
                return parse_netsh_output(&stdout);
            }
        }
        None
    }

    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
    {
        None
    }
}

#[cfg(any(target_os = "linux", test))]
pub fn parse_proc_net_route(content: &str) -> Option<String> {
    for line in content.lines().skip(1) {
        let parts: Vec<&str> = line.split_whitespace().collect();
        if parts.len() >= 8 {
            let dest = parts[1];
            let mask = parts[7];
            if dest == "00000000" && mask == "00000000" {
                return Some(parts[0].to_string());
            }
        }
    }
    None
}

#[allow(
    clippy::manual_is_multiple_of,
    clippy::manual_range_contains,
    dead_code
)]
fn freq_to_channel(freq_mhz: f64) -> Option<u32> {
    let freq = freq_mhz.round() as u32;
    if freq >= 2412 && freq <= 2472 {
        Some((freq - 2407) / 5)
    } else if freq == 2484 {
        Some(14)
    } else if freq >= 5160 && freq <= 5885 {
        if (freq - 5000) % 5 == 0 {
            Some((freq - 5000) / 5)
        } else {
            None
        }
    } else if freq >= 5955 && freq <= 7115 {
        if (freq - 5950) % 5 == 0 {
            Some((freq - 5950) / 5)
        } else {
            None
        }
    } else {
        None
    }
}

#[allow(dead_code)]
fn get_wifi_card_model(iface: &str) -> Option<String> {
    let vendor = std::fs::read_to_string(format!("/sys/class/net/{}/device/vendor", iface)).ok()?;
    let device = std::fs::read_to_string(format!("/sys/class/net/{}/device/device", iface)).ok()?;
    let vendor_clean = vendor.trim().trim_start_matches("0x").to_lowercase();
    let device_clean = device.trim().trim_start_matches("0x").to_lowercase();

    let vendor_name = lookup_pci_vendor(&vendor_clean);
    let model_name = crate::gpu::lookup_pci_device(&vendor_clean, &device_clean);

    match (vendor_name, model_name) {
        (Some(v), Some(m)) => {
            let v_clean = v.replace(", Inc.", "").replace(" Corporation", "");
            if m.to_lowercase().contains(&v_clean.to_lowercase())
                || m.to_lowercase().contains(
                    &v_clean
                        .split_whitespace()
                        .next()
                        .unwrap_or("")
                        .to_lowercase(),
                )
            {
                Some(m)
            } else {
                Some(format!("{} {}", v_clean, m))
            }
        }
        (None, Some(m)) => Some(m),
        _ => None,
    }
}

#[allow(dead_code)]
fn clean_rate(rate: &str) -> String {
    rate.replace("MBit/s", "Mbps")
        .replace("GBit/s", "Gbps")
        .replace("Bit/s", "bps")
}

#[derive(Debug, Clone)]
pub struct WifiLink {
    pub freq: Option<f64>,
    pub rx_rate: Option<String>,
    pub tx_rate: Option<String>,
}

#[allow(dead_code)]
pub fn parse_iw_link_output(stdout: &str) -> (Option<String>, Vec<WifiLink>) {
    let mut ssid = None;
    let mut links = Vec::new();
    let mut current_link = None;

    for line in stdout.lines() {
        let trimmed = line.trim();
        if trimmed.starts_with("Connected to") || trimmed.starts_with("link") {
            if let Some(link) = current_link.take() {
                links.push(link);
            }
            current_link = Some(WifiLink {
                freq: None,
                rx_rate: None,
                tx_rate: None,
            });
        } else if trimmed.starts_with("SSID:") {
            ssid = Some(trimmed.strip_prefix("SSID:").unwrap().trim().to_string());
        } else if trimmed.starts_with("freq:") {
            if let Some(ref mut link) = current_link {
                let freq_str = trimmed.strip_prefix("freq:").unwrap().trim();
                link.freq = freq_str.parse::<f64>().ok();
            }
        } else if trimmed.starts_with("rx bitrate:") {
            if let Some(ref mut link) = current_link {
                let rx_str = trimmed.strip_prefix("rx bitrate:").unwrap().trim();
                let rate = rx_str
                    .split_whitespace()
                    .take(2)
                    .collect::<Vec<&str>>()
                    .join(" ");
                link.rx_rate = Some(rate);
            }
        } else if trimmed.starts_with("tx bitrate:") {
            if let Some(ref mut link) = current_link {
                let tx_str = trimmed.strip_prefix("tx bitrate:").unwrap().trim();
                let rate = tx_str
                    .split_whitespace()
                    .take(2)
                    .collect::<Vec<&str>>()
                    .join(" ");
                link.tx_rate = Some(rate);
            }
        }
    }
    if let Some(link) = current_link {
        links.push(link);
    }
    (ssid, links)
}

#[allow(dead_code)]
pub fn parse_netsh_output(stdout: &str) -> Option<String> {
    let mut ssid = None;
    let mut rx = None;
    let mut tx = None;
    let mut band = None;
    for line in stdout.lines() {
        let trimmed = line.trim();
        if trimmed.starts_with("SSID") {
            if let Some(idx) = trimmed.find(':') {
                let val = trimmed[idx + 1..].trim().to_string();
                if !val.is_empty() {
                    ssid = Some(val);
                }
            }
        } else if trimmed.starts_with("Receive rate (Mbps)") {
            if let Some(idx) = trimmed.find(':') {
                let val = trimmed[idx + 1..].trim().to_string();
                if !val.is_empty() {
                    rx = Some(val);
                }
            }
        } else if trimmed.starts_with("Transmit rate (Mbps)") {
            if let Some(idx) = trimmed.find(':') {
                let val = trimmed[idx + 1..].trim().to_string();
                if !val.is_empty() {
                    tx = Some(val);
                }
            }
        } else if trimmed.starts_with("Band") {
            if let Some(idx) = trimmed.find(':') {
                let val = trimmed[idx + 1..].trim().to_string();
                if !val.is_empty() {
                    band = Some(val);
                }
            }
        }
    }
    if let Some(s) = ssid {
        let mut rate_strs = Vec::new();
        if let Some(rx_val) = rx {
            if rx_val != "0" {
                rate_strs.push(format!("↓{} Mbps", rx_val));
            }
        }
        if let Some(tx_val) = tx {
            if tx_val != "0" {
                rate_strs.push(format!("↑{} Mbps", tx_val));
            }
        }
        let info = match (band, rate_strs.is_empty()) {
            (Some(b), false) => format!("{} [{}]", b, rate_strs.join(" ")),
            (Some(b), true) => b,
            (None, false) => rate_strs.join(" "),
            _ => String::new(),
        };
        if !info.is_empty() {
            Some(format!("{} ({})", s, info))
        } else {
            Some(s)
        }
    } else {
        None
    }
}

/// Returns the list of configured DNS nameserver addresses.
///
/// Linux/macOS: parses `nameserver` lines from `/etc/resolv.conf`.
/// Windows: reads `GetAdaptersAddresses`' per-adapter DNS server list natively.
/// Returns an empty `Vec` if nothing is found.
///
/// **This was the single slowest field in `--long` on Windows.** It spawned
/// `powershell -Command "Get-DnsClientServerAddress …"`, measured at **3409 ms** against a
/// ~322 ms process-startup floor — enough on its own to set `--long`'s wall clock
/// (3352 ms) and put retch 2.3x behind fastfetch in that mode. `-NoProfile` was measured
/// and is **not** the answer: bare `powershell -Command exit` costs 893 ms with a profile
/// and 878 ms without, so it is ~890 ms of interpreter startup plus ~2100 ms of cmdlet
/// work. Only removing the spawn removes the cost — the same conclusion #146-#150 reached
/// for the other Windows probes.
pub fn detect_dns() -> Vec<String> {
    #[cfg(target_os = "macos")]
    {
        // Ask configd what the *default route's own* service uses. `/etc/resolv.conf` on
        // macOS mirrors the MERGED resolver, so on a split-tunnel VPN it names the VPN's
        // server even though the VPN is not the default route — the same defect v0.6.11
        // fixed for `domain` on Linux. A resolvable primary service is authoritative,
        // including when it lists no servers, so we must not fall through to the merged
        // view in that case; only a machine with no default route at all falls back.
        if let Some(config) = crate::macos_ffi::get_primary_service_dns() {
            return config.servers;
        }
    }
    #[cfg(any(target_os = "linux", target_os = "macos"))]
    {
        if let Ok(content) = std::fs::read_to_string("/etc/resolv.conf") {
            return parse_resolv_conf(&content);
        }
    }
    #[cfg(target_os = "windows")]
    {
        windows_dns_servers()
    }
    #[cfg(not(target_os = "windows"))]
    Vec::new()
}

#[cfg(any(target_os = "linux", target_os = "macos", test))]
pub fn parse_resolv_conf(content: &str) -> Vec<String> {
    content
        .lines()
        .filter_map(|line| {
            let line = line.trim();
            if line.starts_with('#') || line.starts_with(';') {
                return None;
            }
            let mut parts = line.split_whitespace();
            if parts.next()? == "nameserver" {
                parts.next().map(|s| s.to_string())
            } else {
                None
            }
        })
        .collect()
}

/// Returns the configured DNS domain name.
///
/// On **Linux**, the domain of the link carrying the IP default route wins (see
/// [`resolve_default_route_domain`]). `/etc/resolv.conf` is only a fallback there, because
/// under systemd-resolved it is the stub file whose `search` list is the *merged* set of
/// every link's domains — so its first entry is frequently a VPN's domain rather than the
/// default route's. On **macOS**, `/etc/resolv.conf` is written by configd from the primary
/// network service, so it is read directly. On **Windows**, queries the primary DNS domain
/// via `GetComputerNameExW` (`ComputerNameDnsDomain`).
///
/// Returns `None` when no domain is configured (e.g. a workgroup machine, or a default-route
/// link with no DNS domain of its own) or the source is unavailable.
pub fn detect_domain() -> Option<String> {
    #[cfg(target_os = "linux")]
    {
        // Ask systemd-resolved what the *default-route* link's domain is. When it manages
        // that link its answer is authoritative — including "no domain" — so we must not
        // fall through to resolv.conf's merged list, which is what leaks a VPN's domain.
        if let (Some(iface), Some(status)) = (default_route_interface(), resolvectl_status()) {
            if let DefaultRouteDomain::Managed(domain) =
                resolve_default_route_domain(&parse_resolvectl_domains(status), &iface)
            {
                return domain;
            }
        }
        read_resolv_conf_domain()
    }
    #[cfg(target_os = "macos")]
    {
        // Same reasoning as `detect_dns`, and the same v0.6.11 shape: report the default
        // route's own domain, not the merged list that a split-tunnel VPN dominates.
        // `Some(config)` means the primary service resolved, so its answer stands even
        // when it has no domain — falling back there is exactly what resurrects the VPN's.
        if let Some(config) = crate::macos_ffi::get_primary_service_dns() {
            return config.domain;
        }
        read_resolv_conf_domain()
    }
    #[cfg(target_os = "windows")]
    {
        detect_domain_windows()
    }
    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
    {
        None
    }
}

/// Reads the `domain`/`search` fallback from `/etc/resolv.conf`.
#[cfg(any(target_os = "linux", target_os = "macos"))]
fn read_resolv_conf_domain() -> Option<String> {
    std::fs::read_to_string("/etc/resolv.conf")
        .ok()
        .and_then(|content| parse_domain_from_resolv_conf(&content))
}

/// Returns the interface carrying the IP default route, from `/proc/net/route`.
///
/// Deliberately the *routing table*, not resolvectl's `Default Route:` field — that field is
/// systemd-resolved's DNS-routing flag (may this link's servers answer arbitrary queries)
/// and is commonly `yes` for a VPN link and the physical link simultaneously, so it cannot
/// identify the default route.
#[cfg(target_os = "linux")]
fn default_route_interface() -> Option<String> {
    std::fs::read_to_string("/proc/net/route")
        .ok()
        .and_then(|content| parse_proc_net_route(&content))
}

/// Cached output of `resolvectl status --no-pager`, or `None` if it is unavailable.
#[cfg(target_os = "linux")]
static RESOLVECTL_STATUS: std::sync::OnceLock<Option<String>> = std::sync::OnceLock::new();

/// Runs `resolvectl status --no-pager` at most once per process and caches the output.
///
/// Both the `domain` and `domain-search` fields need it, and they are collected
/// sequentially; retch is a short-lived one-shot process, so a process-lifetime cache
/// cannot go stale and saves a second ~5 ms spawn in `--full`.
#[cfg(target_os = "linux")]
fn resolvectl_status() -> Option<&'static str> {
    RESOLVECTL_STATUS
        .get_or_init(|| {
            let output = std::process::Command::new("resolvectl")
                .args(["status", "--no-pager"])
                .output()
                .ok()?;
            if !output.status.success() {
                return None;
            }
            Some(String::from_utf8_lossy(&output.stdout).into_owned())
        })
        .as_deref()
}

/// Structure holding DNS configuration per Windows adapter.
#[cfg(any(target_os = "windows", test))]
#[derive(Debug, Clone, PartialEq, Eq)]
struct WinAdapterDnsInfo {
    friendly_name: String,
    dns_suffix: String,
    is_up: bool,
    is_loopback: bool,
    /// Nameservers configured on this adapter, from `GetAdaptersAddresses`.
    dns_servers: Vec<std::net::IpAddr>,
}

/// Windows `AF_INET`. Note `AF_INET6` is **23** on Windows, not 10 as on Linux.
#[cfg(any(target_os = "windows", test))]
const AF_INET: u16 = 2;
/// Windows `AF_INET6`.
#[cfg(any(target_os = "windows", test))]
const AF_INET6: u16 = 23;

/// Decodes a Win32 `sockaddr` into an IP address.
///
/// The family field is host-order `u16`; the address bytes that follow are in network
/// order, which is the order `Ipv4Addr`/`Ipv6Addr` take them in, so no swapping is needed.
/// `sockaddr_in` puts the 4 address bytes at offset 4 (after family and port);
/// `sockaddr_in6` puts its 16 at offset 8 (after family, port and flowinfo).
///
/// Every access is bounds-checked against the length the OS reported rather than assumed
/// from the family, so a short or truncated buffer yields `None` instead of reading past
/// the end of it.
#[cfg(any(target_os = "windows", test))]
fn parse_sockaddr(bytes: &[u8]) -> Option<std::net::IpAddr> {
    let family = u16::from_ne_bytes([*bytes.first()?, *bytes.get(1)?]);
    match family {
        AF_INET => {
            let octets: [u8; 4] = bytes.get(4..8)?.try_into().ok()?;
            Some(std::net::IpAddr::V4(octets.into()))
        }
        AF_INET6 => {
            let octets: [u8; 16] = bytes.get(8..24)?.try_into().ok()?;
            Some(std::net::IpAddr::V6(octets.into()))
        }
        _ => None,
    }
}

/// Collects the machine's IPv4 nameservers from the adapter list.
///
/// **IPv4-only, deliberately**: the PowerShell query this replaces passed
/// `-AddressFamily IPv4`, so restricting it here keeps the output byte-identical and makes
/// this a pure performance change. Windows also hands out well-known placeholder v6
/// servers (`fec0:0:0:ffff::1` and friends) on machines with no real v6 DNS, which would
/// need filtering of their own. Reporting v6 nameservers — Linux already does, since
/// `resolv.conf` lists them — is a separate, behavioural change.
///
/// Sorted as strings and de-duplicated, reproducing `Sort-Object -Unique`: that is a
/// lexicographic sort, so `10.10.1.1` precedes `100.101.255.254`. Preserved for parity
/// rather than because a numeric sort would be worse.
#[cfg(target_os = "windows")]
fn windows_dns_servers() -> Vec<String> {
    let mut servers: Vec<String> = get_windows_adapters_dns_info()
        .into_iter()
        .flat_map(|adapter| adapter.dns_servers)
        .filter(|ip| ip.is_ipv4())
        .map(|ip| ip.to_string())
        .collect();
    servers.sort();
    servers.dedup();
    servers
}

/// Resolves the default route's DNS domain on Windows.
///
/// Matches the default route interface against adapter friendly names and
/// returns its connection-specific `dns_suffix`. If no interface suffix is set,
/// falls back to the machine-wide `global_domain`.
#[cfg(any(target_os = "windows", test))]
fn resolve_windows_default_domain(
    active_iface: Option<&str>,
    adapters: &[WinAdapterDnsInfo],
    global_domain: Option<&str>,
) -> Option<String> {
    if let Some(iface) = active_iface {
        if let Some(adapter) = adapters
            .iter()
            .find(|a| a.friendly_name.eq_ignore_ascii_case(iface))
        {
            if let Some(suffix) = clean_domain(&adapter.dns_suffix) {
                return Some(suffix);
            }
        }
    }

    if let Some(global) = global_domain.and_then(clean_domain) {
        return Some(global);
    }

    None
}

/// Formats global and per-adapter search domain lists on Windows.
#[cfg(any(target_os = "windows", test))]
fn parse_windows_domain_search(
    global_search_list: Option<&str>,
    adapters: &[WinAdapterDnsInfo],
) -> Vec<String> {
    let mut results = Vec::new();

    if let Some(raw) = global_search_list {
        let global_domains: Vec<String> = raw
            .split(&[',', ' '][..])
            .filter_map(clean_domain)
            .collect();
        if !global_domains.is_empty() {
            results.extend(format_global_search_domains(&global_domains));
        }
    }

    for adapter in adapters {
        if adapter.is_up && !adapter.is_loopback {
            if let Some(suffix) = clean_domain(&adapter.dns_suffix) {
                results.push(format!("{}: {}", adapter.friendly_name, suffix));
            }
        }
    }

    results
}

/// Windows: returns the active adapter's DNS domain via `GetAdaptersAddresses`.
#[cfg(target_os = "windows")]
fn detect_domain_windows() -> Option<String> {
    let (_, active_iface) = detect_active_interface_and_local_ip();
    let adapters = get_windows_adapters_dns_info();
    let global_domain = crate::win_reg::get_reg_string(
        crate::win_reg::HKEY_LOCAL_MACHINE,
        "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters",
        "Domain",
    );
    resolve_windows_default_domain(active_iface.as_deref(), &adapters, global_domain.as_deref())
}

/// Queries `GetAdaptersAddresses` for per-adapter DNS suffix and status info.
#[cfg(target_os = "windows")]
fn get_windows_adapters_dns_info() -> Vec<WinAdapterDnsInfo> {
    use std::ffi::OsString;
    use std::os::windows::ffi::OsStringExt;
    use std::ptr;

    #[repr(C)]
    #[allow(non_snake_case)]
    struct IpAdapterAddresses {
        Length: u32,
        IfIndex: u32,
        Next: *mut IpAdapterAddresses,
        AdapterName: *const i8,
        FirstUnicastAddress: *const std::ffi::c_void,
        FirstAnycastAddress: *const std::ffi::c_void,
        FirstMulticastAddress: *const std::ffi::c_void,
        FirstDnsServerAddress: *const IpAdapterDnsServerAddress,
        DnsSuffix: *const u16,
        Description: *const u16,
        FriendlyName: *const u16,
        PhysicalAddress: [u8; 8],
        PhysicalAddressLength: u32,
        Flags: u32,
        Mtu: u32,
        IfType: u32,
        OperStatus: u32,
    }

    /// `SOCKET_ADDRESS` — a pointer to a `sockaddr` plus its length.
    #[repr(C)]
    #[allow(non_snake_case)]
    struct SocketAddress {
        lpSockaddr: *const u8,
        iSockaddrLength: i32,
    }

    /// `IP_ADAPTER_DNS_SERVER_ADDRESS_XP`, a singly-linked list per adapter.
    ///
    /// The header declares `Length`/`Reserved` inside a union with a `ULONGLONG Alignment`,
    /// which is why the two `u32`s sit at offset 0 and the `Next` pointer at 8.
    #[repr(C)]
    #[allow(non_snake_case)]
    struct IpAdapterDnsServerAddress {
        Length: u32,
        Reserved: u32,
        Next: *const IpAdapterDnsServerAddress,
        Address: SocketAddress,
    }

    const AF_UNSPEC: u32 = 0;
    /// `GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST`.
    ///
    /// **`GAA_FLAG_SKIP_DNS_SERVER` (0x08) used to be set here, and removing it is what
    /// makes the native `dns` field possible.** With it, Windows leaves
    /// `FirstDnsServerAddress` null — the field was declared in the struct below but could
    /// never contain anything, which is why `detect_dns` had to spawn PowerShell instead.
    /// Unicast is deliberately still requested (0x01 unset): `detect_domain` needs it.
    const GAA_FLAGS: u32 = 0x06;
    const IF_TYPE_SOFTWARE_LOOPBACK: u32 = 24;
    const IF_OPER_STATUS_UP: u32 = 1;

    #[link(name = "iphlpapi")]
    extern "system" {
        fn GetAdaptersAddresses(
            family: u32,
            flags: u32,
            reserved: *mut std::ffi::c_void,
            adapter_addresses: *mut IpAdapterAddresses,
            size_pointer: *mut u32,
        ) -> u32;
    }

    let mut size: u32 = 0;
    // SAFETY: Size probe call with null pointer.
    unsafe {
        GetAdaptersAddresses(
            AF_UNSPEC,
            GAA_FLAGS,
            ptr::null_mut(),
            ptr::null_mut(),
            &mut size,
        );
    }
    if size == 0 {
        return Vec::new();
    }

    let mut buf = vec![0u8; size as usize];
    // SAFETY: Buffer passed with capacity specified by `size`.
    let ret = unsafe {
        GetAdaptersAddresses(
            AF_UNSPEC,
            GAA_FLAGS,
            ptr::null_mut(),
            buf.as_mut_ptr() as *mut IpAdapterAddresses,
            &mut size,
        )
    };
    if ret != 0 {
        return Vec::new();
    }

    let mut result = Vec::new();
    let mut curr = buf.as_ptr() as *const IpAdapterAddresses;

    unsafe {
        while !curr.is_null() {
            let adapter = &*curr;

            let friendly_name = if !adapter.FriendlyName.is_null() {
                let mut len = 0;
                while *adapter.FriendlyName.add(len) != 0 {
                    len += 1;
                }
                let slice = std::slice::from_raw_parts(adapter.FriendlyName, len);
                OsString::from_wide(slice).to_string_lossy().into_owned()
            } else {
                String::new()
            };

            let adapter_name = if !adapter.AdapterName.is_null() {
                std::ffi::CStr::from_ptr(adapter.AdapterName)
                    .to_string_lossy()
                    .into_owned()
            } else {
                String::new()
            };

            let mut dns_suffix = if !adapter.DnsSuffix.is_null() {
                let mut len = 0;
                while *adapter.DnsSuffix.add(len) != 0 {
                    len += 1;
                }
                let slice = std::slice::from_raw_parts(adapter.DnsSuffix, len);
                OsString::from_wide(slice).to_string_lossy().into_owned()
            } else {
                String::new()
            };

            if dns_suffix.trim().is_empty() && !adapter_name.is_empty() {
                let subkey = format!(
                    "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{}",
                    adapter_name
                );
                if let Some(s) = crate::win_reg::get_reg_string(
                    crate::win_reg::HKEY_LOCAL_MACHINE,
                    &subkey,
                    "SearchList",
                ) {
                    dns_suffix = s;
                } else if let Some(s) = crate::win_reg::get_reg_string(
                    crate::win_reg::HKEY_LOCAL_MACHINE,
                    &subkey,
                    "DhcpSearchList",
                ) {
                    dns_suffix = s;
                } else if let Some(s) = crate::win_reg::get_reg_string(
                    crate::win_reg::HKEY_LOCAL_MACHINE,
                    &subkey,
                    "Domain",
                ) {
                    dns_suffix = s;
                } else if let Some(s) = crate::win_reg::get_reg_string(
                    crate::win_reg::HKEY_LOCAL_MACHINE,
                    &subkey,
                    "DhcpDomain",
                ) {
                    dns_suffix = s;
                }
            }

            // Walk this adapter's DNS server list. Each entry points at a `sockaddr` whose
            // length the OS reports; `parse_sockaddr` is handed exactly that many bytes and
            // bounds-checks within them, so a short or unfamiliar family is skipped rather
            // than read past.
            let mut dns_servers = Vec::new();
            let mut dns_entry = adapter.FirstDnsServerAddress;
            while !dns_entry.is_null() {
                let entry = &*dns_entry;
                if !entry.Address.lpSockaddr.is_null() && entry.Address.iSockaddrLength > 0 {
                    let len = entry.Address.iSockaddrLength as usize;
                    let bytes = std::slice::from_raw_parts(entry.Address.lpSockaddr, len);
                    if let Some(ip) = parse_sockaddr(bytes) {
                        dns_servers.push(ip);
                    }
                }
                dns_entry = entry.Next;
            }

            result.push(WinAdapterDnsInfo {
                friendly_name,
                dns_suffix,
                is_up: adapter.OperStatus == IF_OPER_STATUS_UP,
                is_loopback: adapter.IfType == IF_TYPE_SOFTWARE_LOOPBACK,
                dns_servers,
            });

            curr = adapter.Next;
        }
    }

    result
}

/// Trims a raw domain string and maps the empty string to `None`.
///
/// A non-domain-joined Windows host reports an empty DNS domain; treat that as
/// "no domain configured" rather than surfacing an empty value.
#[cfg(any(target_os = "windows", test))]
fn clean_domain(raw: &str) -> Option<String> {
    let trimmed = raw.trim();
    if trimmed.is_empty() {
        None
    } else {
        Some(trimmed.to_string())
    }
}

/// Returns per-interface DNS search domain lists.
///
/// On Linux, tries `resolvectl status --no-pager` first and parses per-link
/// DNS Domain / DNS Search Domains entries. Falls back to the global `search`
/// list from `/etc/resolv.conf` when resolvectl is unavailable.
/// On macOS, reads the global `search` list from `/etc/resolv.conf`.
/// On Windows, enumerates adapters via `GetAdaptersAddresses` and registry `SearchList`.
pub fn detect_domain_search() -> Vec<String> {
    #[cfg(target_os = "linux")]
    {
        // Shares the one cached `resolvectl` spawn with `detect_domain`.
        if let Some(status) = resolvectl_status() {
            let result = parse_resolvectl_search(status);
            if !result.is_empty() {
                return result;
            }
        }
        if let Ok(content) = std::fs::read_to_string("/etc/resolv.conf") {
            return format_global_search_domains(&parse_search_from_resolv_conf(&content));
        }
    }
    #[cfg(target_os = "macos")]
    {
        if let Ok(content) = std::fs::read_to_string("/etc/resolv.conf") {
            return format_global_search_domains(&parse_search_from_resolv_conf(&content));
        }
    }
    #[cfg(target_os = "windows")]
    {
        let adapters = get_windows_adapters_dns_info();
        let global_search_list = crate::win_reg::get_reg_string(
            crate::win_reg::HKEY_LOCAL_MACHINE,
            "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters",
            "SearchList",
        );
        let results = parse_windows_domain_search(global_search_list.as_deref(), &adapters);
        if !results.is_empty() {
            return results;
        }
    }
    Vec::new()
}

/// Scope label for search domains that carry no per-interface attribution.
///
/// `/etc/resolv.conf`'s `search` list is a single global list — it does not say which link
/// each domain came from — so it is labelled honestly rather than attributed to an
/// interface, which would be a fabrication on a multi-homed host.
#[cfg(any(target_os = "linux", target_os = "macos", target_os = "windows", test))]
const GLOBAL_SEARCH_SCOPE: &str = "global";

/// Renders a scope-less (global) search-domain list in the same shape as the per-link
/// resolvectl path: one entry of `"<scope>: a, b"`.
#[cfg(any(target_os = "linux", target_os = "macos", target_os = "windows", test))]
pub fn format_global_search_domains(domains: &[String]) -> Vec<String> {
    if domains.is_empty() {
        Vec::new()
    } else {
        vec![format!("{}: {}", GLOBAL_SEARCH_SCOPE, domains.join(", "))]
    }
}

/// Parses the `domain` directive (or first `search` entry as fallback) from
/// `/etc/resolv.conf` content.
#[cfg(any(target_os = "linux", target_os = "macos", test))]
pub fn parse_domain_from_resolv_conf(content: &str) -> Option<String> {
    let mut first_search: Option<String> = None;
    for line in content.lines() {
        let line = line.trim();
        if line.starts_with('#') || line.starts_with(';') {
            continue;
        }
        let mut parts = line.split_whitespace();
        match parts.next() {
            Some("domain") => {
                if let Some(d) = parts.next() {
                    return Some(d.to_string());
                }
            }
            Some("search") if first_search.is_none() => {
                if let Some(d) = parts.next() {
                    first_search = Some(d.to_string());
                }
            }
            _ => {}
        }
    }
    first_search
}

/// Parses all entries from the `search` directive in `/etc/resolv.conf` content.
#[cfg(any(target_os = "linux", target_os = "macos", test))]
pub fn parse_search_from_resolv_conf(content: &str) -> Vec<String> {
    for line in content.lines() {
        let line = line.trim();
        if line.starts_with('#') || line.starts_with(';') {
            continue;
        }
        let mut parts = line.split_whitespace();
        if parts.next() == Some("search") {
            let domains: Vec<String> = parts.map(|s| s.to_string()).collect();
            if !domains.is_empty() {
                return domains;
            }
        }
    }
    Vec::new()
}

/// One link's DNS search domains, as reported by `resolvectl status`.
#[derive(Debug, Clone, Default, PartialEq, Eq)]
#[cfg(any(target_os = "linux", test))]
pub struct LinkDomains {
    /// Interface name, e.g. `wlp194s0`.
    pub interface: String,
    /// Search domains in report order, with routing-only (`~`-prefixed) entries removed.
    /// Empty means systemd-resolved manages this link but it has no search domain.
    pub search: Vec<String>,
}

/// DNS search domains from `resolvectl status`, split by scope.
#[derive(Debug, Clone, Default, PartialEq, Eq)]
#[cfg(any(target_os = "linux", test))]
pub struct ResolvectlDomains {
    /// Domains from the `Global` section (e.g. `resolved.conf`'s `Domains=`), which belong
    /// to no particular interface.
    pub global: Vec<String>,
    /// One entry per `Link N (iface)` section, in report order.
    pub links: Vec<LinkDomains>,
}

/// Outcome of looking up the default-route link in [`ResolvectlDomains`].
#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg(any(target_os = "linux", test))]
pub enum DefaultRouteDomain {
    /// systemd-resolved manages the link, so its answer is authoritative. `None` means the
    /// link genuinely has no domain — the caller must **not** fall back to the merged
    /// `/etc/resolv.conf` search list, which would resurrect another link's (e.g. a VPN's)
    /// domain.
    Managed(Option<String>),
    /// The link has no section in the resolvectl output, so systemd-resolved has no opinion
    /// about it; the caller should fall back to `/etc/resolv.conf`.
    Unmanaged,
}

/// Picks the domain to display for `interface` from parsed resolvectl output.
///
/// Prefers the link's own first search domain, then a `Global` domain (interface-independent,
/// so it cannot be another link's). Never returns a *different* link's domain — that is the
/// whole point: the default route's domain must win over a VPN's.
#[cfg(any(target_os = "linux", test))]
pub fn resolve_default_route_domain(
    domains: &ResolvectlDomains,
    interface: &str,
) -> DefaultRouteDomain {
    match domains.links.iter().find(|l| l.interface == interface) {
        Some(link) => DefaultRouteDomain::Managed(
            link.search
                .first()
                .or_else(|| domains.global.first())
                .cloned(),
        ),
        None => DefaultRouteDomain::Unmanaged,
    }
}

/// Parses `resolvectl status --no-pager` output into per-scope DNS search domains.
///
/// Handles the two shapes that tripped up the previous single-line parser:
/// - **Wrapped values.** resolvectl right-aligns labels and continues long values on
///   following indented, label-less lines; those continuations were silently dropped.
/// - **Routing-only domains.** systemd prefixes a domain with `~` when it should only
///   *route* queries to that link, never be appended as a search suffix. Every `~` entry is
///   excluded (the old code special-cased only the exact catch-all `~.`).
///
/// Sections are recognised by content (`Global`, `Link N (iface)`) rather than by indentation,
/// since resolvectl's exact column padding varies with the longest label present. A `Link`
/// header always creates an entry, even with no domain line, so callers can distinguish
/// "managed, no domain" from "not managed at all".
#[cfg(any(target_os = "linux", test))]
pub fn parse_resolvectl_domains(content: &str) -> ResolvectlDomains {
    let mut out = ResolvectlDomains::default();
    // `None` = the Global section, `Some(iface)` = that link's section.
    let mut section: Option<String> = None;
    // True while consuming the (possibly wrapped) value of a DNS domain field.
    let mut in_domain_value = false;

    for line in content.lines() {
        let trimmed = line.trim();
        if trimmed.is_empty() {
            in_domain_value = false;
            continue;
        }

        // "Link N (iface)" starts a link section. Checked before the continuation branch
        // below, since a header carries no colon either.
        if let Some(iface) = trimmed
            .strip_prefix("Link ")
            .and_then(|rest| rest.split_once('('))
            .and_then(|(_, rest)| rest.split_once(')'))
            .map(|(iface, _)| iface)
        {
            in_domain_value = false;
            section = Some(iface.to_string());
            // Record the link even if it never reports a domain.
            if !out.links.iter().any(|l| l.interface == iface) {
                out.links.push(LinkDomains {
                    interface: iface.to_string(),
                    search: Vec::new(),
                });
            }
            continue;
        }

        if trimmed == "Global" {
            in_domain_value = false;
            section = None;
            continue;
        }

        if let Some(value) = trimmed
            .strip_prefix("DNS Domain:")
            .or_else(|| trimmed.strip_prefix("DNS Search Domains:"))
        {
            in_domain_value = true;
            push_resolvectl_domains(&mut out, section.as_deref(), value);
            continue;
        }

        // A wrapped continuation of the domain value carries no `label:` of its own, and
        // domain names cannot contain ':' — so any colon means a new field has started.
        if in_domain_value && !trimmed.contains(':') {
            push_resolvectl_domains(&mut out, section.as_deref(), trimmed);
            continue;
        }
        in_domain_value = false;
    }
    out
}

/// Appends whitespace-separated domains from one resolvectl value fragment to `section`,
/// dropping systemd routing-only (`~`-prefixed) entries.
#[cfg(any(target_os = "linux", test))]
fn push_resolvectl_domains(out: &mut ResolvectlDomains, section: Option<&str>, value: &str) {
    let domains = value
        .split_whitespace()
        .filter(|d| !d.starts_with('~'))
        .map(|d| d.to_string());
    match section {
        Some(iface) => match out.links.iter_mut().find(|l| l.interface == iface) {
            Some(link) => link.search.extend(domains),
            None => out.links.push(LinkDomains {
                interface: iface.to_string(),
                search: domains.collect(),
            }),
        },
        None => out.global.extend(domains),
    }
}

/// Parses `resolvectl status --no-pager` output into per-interface search domain strings.
///
/// Formats [`parse_resolvectl_domains`] as `"wlan0: home.local"` entries, one per link,
/// skipping links with no search domain of their own.
#[cfg(any(target_os = "linux", test))]
pub fn parse_resolvectl_search(content: &str) -> Vec<String> {
    parse_resolvectl_domains(content)
        .links
        .into_iter()
        .filter(|link| !link.search.is_empty())
        .map(|link| format!("{}: {}", link.interface, link.search.join(", ")))
        .collect()
}

#[cfg(all(test, target_os = "macos"))]
mod macos_dns_tests {
    use super::*;

    /// The macOS `dns` and `domain` fields must agree with the **default route's own**
    /// service, not with the merged resolver that `/etc/resolv.conf` mirrors.
    ///
    /// Machine-independent by construction: it does not assert *which* servers are
    /// reported, only that whatever `detect_dns` returns is exactly what configd says the
    /// primary service uses. That is the coupling a regression would break — reverting to
    /// `parse_resolv_conf` makes these diverge on any host with a supplemental resolver
    /// (a VPN, a second DNS-providing interface), while remaining identical on a plain
    /// single-interface CI runner.
    #[test]
    fn test_dns_comes_from_the_primary_service_not_resolv_conf() {
        let Some(config) = crate::macos_ffi::get_primary_service_dns() else {
            // No default route (an offline runner): the fallback path is in force and
            // there is nothing to compare against.
            return;
        };
        assert_eq!(
            detect_dns(),
            config.servers,
            "detect_dns must report the default route's own servers"
        );
        assert_eq!(
            detect_domain(),
            config.domain,
            "detect_domain must report the default route's own domain"
        );
    }

    /// A resolvable primary service is authoritative **even when it lists nothing**.
    ///
    /// This is the load-bearing half of the fix and the direct analogue of Linux's
    /// `DefaultRouteDomain::Managed(None)` (v0.6.11): falling back to the merged view when
    /// the default route has no domain of its own is precisely what resurrects a VPN's
    /// domain. Asserting it here rather than only in prose.
    #[test]
    fn test_empty_primary_config_is_not_a_fallback_signal() {
        let empty = crate::macos_ffi::ScDnsConfig::default();
        assert!(empty.servers.is_empty());
        assert!(empty.domain.is_none());
        // `Some(empty)` and `None` must be distinguishable — if `get_primary_service_dns`
        // collapsed the empty case to `None`, the caller would fall back and the bug
        // would return.
        let authoritative: Option<crate::macos_ffi::ScDnsConfig> = Some(empty);
        assert!(authoritative.is_some());
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    // ── parse_public_ip ───────────────────────────────────────────────────────

    #[test]
    fn parse_public_ip_accepts_one_address() {
        // ipinfo.io/ip answers the bare address, with no trailing newline.
        assert_eq!(
            parse_public_ip("47.148.63.226").as_deref(),
            Some("47.148.63.226")
        );
        assert_eq!(
            parse_public_ip("  203.0.113.7\n").as_deref(),
            Some("203.0.113.7")
        );
        assert_eq!(
            parse_public_ip("2001:db8::1").as_deref(),
            Some("2001:db8::1")
        );
    }

    #[test]
    fn parse_public_ip_rejects_anything_else() {
        // What a rate limit, an error page or a captive portal would put in the body.
        assert_eq!(
            parse_public_ip(r#"{"status":429,"error":{"title":"Rate limit exceeded"}}"#),
            None
        );
        assert_eq!(
            parse_public_ip("<html><body>Please sign in to the Wi-Fi</body></html>"),
            None
        );
        assert_eq!(parse_public_ip(""), None);
        assert_eq!(
            parse_public_ip("203.0.113.7 203.0.113.8"),
            None,
            "two values"
        );
        assert_eq!(parse_public_ip("203.0.113.999"), None, "not an address");
    }

    // ── parse_sockaddr ────────────────────────────────────────────────────────
    //
    // Byte fixtures rather than live adapters, so these assert the wire layout on every
    // platform's CI rather than whatever this machine's DNS happens to be — the
    // #155/v0.6.2 pattern. The bytes are laid out exactly as Windows hands them over.

    /// `sockaddr_in` for 10.10.1.1: family (host order), port, then 4 address bytes.
    fn sockaddr_in(octets: [u8; 4]) -> Vec<u8> {
        let mut v = Vec::new();
        v.extend_from_slice(&AF_INET.to_ne_bytes());
        v.extend_from_slice(&53u16.to_be_bytes()); // sin_port
        v.extend_from_slice(&octets); // sin_addr at offset 4
        v.extend_from_slice(&[0u8; 8]); // sin_zero
        v
    }

    /// `sockaddr_in6`: family, port, flowinfo, then the 16 address bytes at offset 8.
    fn sockaddr_in6(octets: [u8; 16]) -> Vec<u8> {
        let mut v = Vec::new();
        v.extend_from_slice(&AF_INET6.to_ne_bytes());
        v.extend_from_slice(&53u16.to_be_bytes());
        v.extend_from_slice(&0u32.to_ne_bytes()); // sin6_flowinfo
        v.extend_from_slice(&octets); // sin6_addr at offset 8
        v.extend_from_slice(&0u32.to_ne_bytes()); // sin6_scope_id
        v
    }

    #[test]
    fn test_parse_sockaddr_reads_ipv4_at_offset_four() {
        // The real nameserver this machine reported, so the fixture is not invented.
        assert_eq!(
            parse_sockaddr(&sockaddr_in([10, 10, 1, 1])),
            Some("10.10.1.1".parse().unwrap())
        );
        assert_eq!(
            parse_sockaddr(&sockaddr_in([100, 101, 255, 254])),
            Some("100.101.255.254".parse().unwrap())
        );
    }

    #[test]
    fn test_parse_sockaddr_reads_ipv6_at_offset_eight() {
        // fec0:0:0:ffff::1 — one of the placeholder servers Windows hands out when no real
        // v6 nameserver is configured, which is exactly why v6 is filtered out upstream.
        let mut o = [0u8; 16];
        o[0] = 0xfe;
        o[1] = 0xc0;
        o[6] = 0xff;
        o[7] = 0xff;
        o[15] = 1;
        assert_eq!(
            parse_sockaddr(&sockaddr_in6(o)),
            Some("fec0:0:0:ffff::1".parse().unwrap())
        );
    }

    #[test]
    fn test_parse_sockaddr_rejects_short_and_unknown_buffers() {
        // A truncated buffer must yield None rather than read past the end of it: the
        // length comes from the OS and is trusted for the slice, not for the family.
        assert_eq!(parse_sockaddr(&[]), None);
        assert_eq!(parse_sockaddr(&AF_INET.to_ne_bytes()), None);
        assert_eq!(parse_sockaddr(&sockaddr_in([1, 2, 3, 4])[..7]), None);
        assert_eq!(parse_sockaddr(&sockaddr_in6([0; 16])[..20]), None);
        // AF_INET6 is 23 on Windows; 10 is the Linux value and must not be mistaken for it.
        let mut wrong_family = sockaddr_in6([0; 16]);
        wrong_family[0] = 10;
        wrong_family[1] = 0;
        assert_eq!(parse_sockaddr(&wrong_family), None);
    }

    #[test]
    fn test_clean_domain() {
        // Normal domain passes through.
        assert_eq!(
            clean_domain("corp.example.com"),
            Some("corp.example.com".to_string())
        );
        // Surrounding whitespace is trimmed.
        assert_eq!(
            clean_domain("  example.org \n"),
            Some("example.org".to_string())
        );
        // A workgroup host reports an empty domain -> None (not Some("")).
        assert_eq!(clean_domain(""), None);
        assert_eq!(clean_domain("   "), None);
    }

    #[test]
    fn test_match_active_interface() {
        use std::net::IpAddr;
        let target: IpAddr = "192.168.1.50".parse().unwrap();
        let ifaces = vec![
            ("lo".to_string(), vec!["127.0.0.1".parse().unwrap()]),
            (
                "Ethernet".to_string(),
                vec!["192.168.1.50".parse().unwrap(), "fe80::1".parse().unwrap()],
            ),
            ("Wi-Fi".to_string(), vec!["10.0.0.2".parse().unwrap()]),
        ];
        // Matches the adapter that actually holds the outbound local IP.
        assert_eq!(
            match_active_interface(ifaces.into_iter(), target),
            Some("Ethernet".to_string())
        );

        // No adapter holds the target IP -> None (e.g. offline / unresolved).
        let orphan: IpAddr = "8.8.8.8".parse().unwrap();
        let ifaces2 = vec![(
            "lo".to_string(),
            vec!["127.0.0.1".parse::<IpAddr>().unwrap()],
        )];
        assert_eq!(match_active_interface(ifaces2.into_iter(), orphan), None);
    }

    #[test]
    fn test_format_bytes() {
        assert_eq!(format_bytes(500), "500 B");
        assert_eq!(format_bytes(1024), "1.0 KB");
        assert_eq!(format_bytes(1024 * 1024), "1.0 MB");
        assert_eq!(format_bytes(1024 * 1024 * 1024), "1.0 GB");
        assert_eq!(format_bytes(1536), "1.5 KB");
    }

    #[test]
    fn test_parse_proc_net_route() {
        let sample =
            "Iface\tDestination\tGateway \tFlags\tRefCnt\tUse\tMetric\tMask\t\tMTU\tWindow\tIRTT\n\
                      wlan0\t0000A8C0\t00000000\t0001\t0\t0\t600\t0000FFFF\t0\t0\t0\n\
                      wlan0\t00000000\t0100A8C0\t0003\t0\t0\t600\t00000000\t0\t0\t0\n";
        assert_eq!(parse_proc_net_route(sample), Some("wlan0".to_string()));

        let sample_no_default =
            "Iface\tDestination\tGateway \tFlags\tRefCnt\tUse\tMetric\tMask\t\tMTU\tWindow\tIRTT\n\
                                 wlan0\t0000A8C0\t00000000\t0001\t0\t0\t600\t0000FFFF\t0\t0\t0\n";
        assert_eq!(parse_proc_net_route(sample_no_default), None);
    }

    #[test]
    fn test_parse_netsh_output() {
        let sample = "    Name                   : Wi-Fi\n    State                  : connected\n    SSID                   : Office_Wi-Fi\n    Receive rate (Mbps)    : 433\n    Transmit rate (Mbps)   : 866\n    Band                   : 5 GHz\n";
        assert_eq!(
            parse_netsh_output(sample),
            Some("Office_Wi-Fi (5 GHz [↓433 Mbps ↑866 Mbps])".to_string())
        );
    }

    #[test]
    fn test_parse_iw_link_output() {
        let sample = "Connected to 84:78:48:dc:97:23 (on wlp2s0)\n        SSID: OfficeNet\n        freq: 6135.0\n        rx bitrate: 6.0 MBit/s\n        tx bitrate: 864.6 MBit/s 160MHz HE-MCS 4\n";
        let (ssid, links) = parse_iw_link_output(sample);
        assert_eq!(ssid, Some("OfficeNet".to_string()));
        assert_eq!(links.len(), 1);
        assert_eq!(links[0].freq, Some(6135.0));
        assert_eq!(links[0].rx_rate, Some("6.0 MBit/s".to_string()));
        assert_eq!(links[0].tx_rate, Some("864.6 MBit/s".to_string()));

        // MLO multi-link mock output
        let sample_mlo = "Connected to aa:bb:cc:dd:ee:ff (on wlan0)\n        SSID: HomeWiFi\n        freq: 5180.0\n        rx bitrate: 866.0 MBit/s\n        tx bitrate: 866.0 MBit/s\nConnected to aa:bb:cc:dd:ee:01 (on wlan0)\n        freq: 6135.0\n        rx bitrate: 1200.0 MBit/s\n        tx bitrate: 1200.0 MBit/s\n";
        let (ssid_mlo, links_mlo) = parse_iw_link_output(sample_mlo);
        assert_eq!(ssid_mlo, Some("HomeWiFi".to_string()));
        assert_eq!(links_mlo.len(), 2);
        assert_eq!(links_mlo[0].freq, Some(5180.0));
        assert_eq!(links_mlo[1].freq, Some(6135.0));
    }

    #[test]
    fn test_parse_resolv_conf() {
        let sample = "# Generated by NetworkManager\ndomain home\nsearch home\nnameserver 192.168.1.1\nnameserver 8.8.8.8\n; comment\nnameserver 2001:db8::1\n";
        assert_eq!(
            parse_resolv_conf(sample),
            vec!["192.168.1.1", "8.8.8.8", "2001:db8::1"]
        );

        let empty = "# no nameservers\nsearch local\n";
        assert_eq!(parse_resolv_conf(empty), Vec::<String>::new());
    }

    #[test]
    fn test_parse_domain_from_resolv_conf_domain_directive() {
        let s = "# test\ndomain example.com\nsearch fallback.com\nnameserver 1.1.1.1\n";
        assert_eq!(
            parse_domain_from_resolv_conf(s),
            Some("example.com".to_string())
        );
    }

    #[test]
    fn test_parse_domain_from_resolv_conf_search_fallback() {
        let s = "# no domain directive\nsearch local.lan other.lan\nnameserver 1.1.1.1\n";
        assert_eq!(
            parse_domain_from_resolv_conf(s),
            Some("local.lan".to_string())
        );
    }

    #[test]
    fn test_parse_domain_from_resolv_conf_none() {
        let s = "# no domain or search\nnameserver 1.1.1.1\n";
        assert_eq!(parse_domain_from_resolv_conf(s), None);
    }

    #[test]
    fn test_parse_search_from_resolv_conf() {
        let s = "search home.local corp.example.com\nnameserver 1.1.1.1\n";
        assert_eq!(
            parse_search_from_resolv_conf(s),
            vec!["home.local", "corp.example.com"]
        );
    }

    #[test]
    fn test_parse_resolvectl_search_basic() {
        let sample = "Global\n\
            Link 2 (lo)\n\
              Current Scopes: none\n\
            Link 3 (wlan0)\n\
              Current Scopes: DNS\n\
              DNS Domain: home.local\n\
            Link 4 (eth0)\n\
              Current Scopes: DNS\n\
              DNS Search Domains: corp.example.com internal.net\n";
        let result = parse_resolvectl_search(sample);
        assert_eq!(
            result,
            vec!["wlan0: home.local", "eth0: corp.example.com, internal.net"]
        );
    }

    #[test]
    fn test_parse_resolvectl_search_skips_routing_domain() {
        let sample = "Link 2 (wlan0)\n  DNS Domain: ~.\nLink 3 (eth0)\n  DNS Domain: corp.net\n";
        let result = parse_resolvectl_search(sample);
        assert_eq!(result, vec!["eth0: corp.net"]);
    }

    #[test]
    fn test_parse_resolvectl_search_empty() {
        let sample = "Global\n  DNS Servers: 1.1.1.1\n";
        assert!(parse_resolvectl_search(sample).is_empty());
    }

    // ── domain selection: default route vs. VPN ───────────────────────────────

    /// Verbatim `resolvectl status --no-pager` output from the reported machine: a NetBird
    /// VPN (`wt0`, split tunnel) alongside the Wi-Fi default route (`wlp194s0`). Note that
    /// **both** links report `Default Route: yes` — that is systemd-resolved's DNS-routing
    /// flag, not the IP default route — and that `wt0`'s DNS Domain value wraps onto a
    /// continuation line.
    const RESOLVECTL_VPN_SAMPLE: &str = concat!(
        "Global\n",
        "         Protocols: LLMNR=resolve -mDNS -DNSOverTLS DNSSEC=no/unsupported\n",
        "  resolv.conf mode: stub\n",
        "\n",
        "Link 2 (wlp194s0)\n",
        "    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6\n",
        "         Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS\n",
        "                    DNSSEC=no/unsupported\n",
        "Current DNS Server: 192.168.86.1\n",
        "       DNS Servers: 192.168.86.1\n",
        "        DNS Domain: lan\n",
        "     Default Route: yes\n",
        "\n",
        "Link 3 (wt0)\n",
        "    Current Scopes: DNS\n",
        "         Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS\n",
        "                    DNSSEC=no/unsupported\n",
        "Current DNS Server: 100.101.32.155\n",
        "       DNS Servers: 100.101.32.155\n",
        "        DNS Domain: netbird.cloud ~gammatile.com ~101.100.in-addr.arpa\n",
        "                    ~f.f.0.0.3.2.b.5.b.c.8.5.7.f.d.f.ip6.arpa ~.\n",
        "     Default Route: yes\n",
    );

    #[test]
    fn test_domain_prefers_default_route_over_vpn() {
        // The reported bug: resolv.conf's merged "search netbird.cloud lan" put the VPN
        // first, so the Domain field showed netbird.cloud. Keyed on the default-route
        // interface, the answer is the Wi-Fi link's own domain.
        let parsed = parse_resolvectl_domains(RESOLVECTL_VPN_SAMPLE);
        assert_eq!(
            resolve_default_route_domain(&parsed, "wlp194s0"),
            DefaultRouteDomain::Managed(Some("lan".to_string()))
        );
    }

    #[test]
    fn test_domain_reports_vpn_when_vpn_is_the_default_route() {
        // Full-tunnel case: if the VPN *is* the default route, its domain is correct.
        let parsed = parse_resolvectl_domains(RESOLVECTL_VPN_SAMPLE);
        assert_eq!(
            resolve_default_route_domain(&parsed, "wt0"),
            DefaultRouteDomain::Managed(Some("netbird.cloud".to_string()))
        );
    }

    #[test]
    fn test_domain_routing_only_entries_are_not_domains() {
        // Every `~`-prefixed entry is routing-only, never a search suffix — so a link whose
        // only entries are `~`-prefixed has no domain (and must not yield "~gammatile.com").
        let parsed = parse_resolvectl_domains(RESOLVECTL_VPN_SAMPLE);
        let wt0 = parsed.links.iter().find(|l| l.interface == "wt0").unwrap();
        assert_eq!(wt0.search, vec!["netbird.cloud"]);
        assert!(wt0.search.iter().all(|d| !d.starts_with('~')));

        let routing_only = "Link 5 (tun0)\n        DNS Domain: ~corp.example.com ~.\n";
        let parsed = parse_resolvectl_domains(routing_only);
        assert_eq!(
            resolve_default_route_domain(&parsed, "tun0"),
            DefaultRouteDomain::Managed(None)
        );
    }

    #[test]
    fn test_parse_resolvectl_domains_reads_wrapped_continuation_lines() {
        // Regression: the old parser read only the first line of a wrapped value, silently
        // dropping the rest. Here the continuation carries a real search domain.
        let sample = concat!(
            "Link 2 (eth0)\n",
            "        DNS Domain: one.example.com two.example.com\n",
            "                    three.example.com ~routing.example.com\n",
            "     Default Route: yes\n",
        );
        let parsed = parse_resolvectl_domains(sample);
        assert_eq!(
            parsed.links[0].search,
            vec!["one.example.com", "two.example.com", "three.example.com"]
        );
        // The following `label: value` line must end the value, not join it.
        assert!(!parsed.links[0].search.iter().any(|d| d.contains("yes")));
    }

    #[test]
    fn test_parse_resolvectl_domains_ignores_other_wrapped_fields() {
        // `Protocols:` also wraps; its continuation must not be mistaken for a domain.
        let sample = concat!(
            "Link 2 (eth0)\n",
            "         Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS\n",
            "                    DNSSEC=no/unsupported\n",
            "        DNS Domain: real.example.com\n",
        );
        let parsed = parse_resolvectl_domains(sample);
        assert_eq!(parsed.links[0].search, vec!["real.example.com"]);
    }

    #[test]
    fn test_domain_unmanaged_link_falls_back() {
        // A default-route interface systemd-resolved knows nothing about: the caller should
        // fall back to /etc/resolv.conf rather than borrow another link's domain.
        let parsed = parse_resolvectl_domains(RESOLVECTL_VPN_SAMPLE);
        assert_eq!(
            resolve_default_route_domain(&parsed, "ppp0"),
            DefaultRouteDomain::Unmanaged
        );
    }

    #[test]
    fn test_domain_managed_without_domain_does_not_borrow_from_other_links() {
        // wlp194s0 is managed but has no domain of its own; the VPN's domain must NOT be
        // substituted (that is the bug). With no Global domain either, the answer is "none".
        let sample = concat!(
            "Link 2 (wlp194s0)\n",
            "     Default Route: yes\n",
            "Link 3 (wt0)\n",
            "        DNS Domain: netbird.cloud\n",
        );
        let parsed = parse_resolvectl_domains(sample);
        assert_eq!(
            resolve_default_route_domain(&parsed, "wlp194s0"),
            DefaultRouteDomain::Managed(None)
        );
    }

    #[test]
    fn test_domain_falls_back_to_global_but_not_to_another_link() {
        // A Global domain (resolved.conf `Domains=`) belongs to no interface, so it is a
        // legitimate answer when the default-route link has none of its own.
        let sample = concat!(
            "Global\n",
            "        DNS Domain: corp.example.com\n",
            "Link 2 (wlp194s0)\n",
            "     Default Route: yes\n",
            "Link 3 (wt0)\n",
            "        DNS Domain: netbird.cloud\n",
        );
        let parsed = parse_resolvectl_domains(sample);
        assert_eq!(parsed.global, vec!["corp.example.com"]);
        assert_eq!(
            resolve_default_route_domain(&parsed, "wlp194s0"),
            DefaultRouteDomain::Managed(Some("corp.example.com".to_string()))
        );
    }

    #[test]
    fn test_parse_resolvectl_domains_merges_both_domain_labels() {
        // A link reporting both labels yields one merged entry, not two.
        let sample = concat!(
            "Link 2 (eth0)\n",
            "        DNS Domain: a.example.com\n",
            "DNS Search Domains: b.example.com\n",
        );
        let parsed = parse_resolvectl_domains(sample);
        assert_eq!(parsed.links.len(), 1);
        assert_eq!(
            parsed.links[0].search,
            vec!["a.example.com", "b.example.com"]
        );
        assert_eq!(
            parse_resolvectl_search(sample),
            vec!["eth0: a.example.com, b.example.com"]
        );
    }

    // ── Domain Search: one shape regardless of source ─────────────────────────

    #[test]
    fn test_global_search_domains_match_per_link_shape() {
        // The fallback must render like the resolvectl path — "<scope>: a, b" — so the field
        // has one shape. Regression for the CI inconsistency where the same OS flipped format
        // depending on whether systemd-resolved was reachable (bare runner vs. container).
        let per_link = parse_resolvectl_search("Link 2 (eth0)\n  DNS Domain: a.example.com\n");
        assert_eq!(per_link, vec!["eth0: a.example.com"]);

        let global = format_global_search_domains(&["a.example.com".to_string()]);
        assert_eq!(global, vec!["global: a.example.com"]);

        // Same structural shape: exactly one entry, "<scope>: <domains>".
        assert_eq!(per_link.len(), global.len());
        for entry in per_link.iter().chain(global.iter()) {
            let (scope, domains) = entry.split_once(": ").expect("entry must carry a scope");
            assert!(!scope.is_empty() && !domains.is_empty());
        }
    }

    #[test]
    fn test_global_search_domains_group_into_one_entry() {
        // The raw resolv.conf parse yields one element per domain, and the display prints one
        // line per element — so `search a b c` used to emit three bare `Domain Search:` lines
        // while resolvectl emitted one per interface. Now it is a single grouped entry.
        let parsed = parse_search_from_resolv_conf("search a.example.com b.example.com c.net\n");
        assert_eq!(parsed.len(), 3); // parser stays faithful to the file
        assert_eq!(
            format_global_search_domains(&parsed),
            vec!["global: a.example.com, b.example.com, c.net"]
        );
    }

    #[test]
    fn test_global_search_domains_empty_yields_no_line() {
        // No search list -> no entry at all, so the field stays hidden (unchanged behaviour).
        assert!(format_global_search_domains(&[]).is_empty());
        assert!(format_global_search_domains(&parse_search_from_resolv_conf(
            "nameserver 1.1.1.1\n"
        ))
        .is_empty());
    }

    #[test]
    fn test_default_route_interface_selection_matches_routing_table() {
        // The routing table is the source of truth for "default route" — not resolvectl's
        // per-link `Default Route:` flag, which is `yes` for both links in the VPN sample.
        // Real /proc/net/route from the reported machine: only wlp194s0 has dest+mask 0.
        let proc_net_route = concat!(
            "Iface\tDestination\tGateway \tFlags\tRefCnt\tUse\tMetric\tMask\t\tMTU\tWindow\tIRTT\n",
            "wlp194s0\t00000000\t0156A8C0\t0003\t0\t0\t100\t00000000\t0\t0\t0\n",
            "wt0\t00006564\t00000000\t0001\t0\t0\t0\t0000FFFF\t0\t0\t0\n",
            "wlp194s0\t0056A8C0\t00000000\t0001\t0\t0\t100\t00FFFFFF\t0\t0\t0\n",
        );
        assert_eq!(
            parse_proc_net_route(proc_net_route),
            Some("wlp194s0".to_string())
        );
    }

    #[test]
    fn test_resolve_windows_default_domain() {
        let adapters = vec![
            WinAdapterDnsInfo {
                friendly_name: "Wi-Fi".to_string(),
                dns_suffix: "lan.home".to_string(),
                is_up: true,
                is_loopback: false,
                dns_servers: Vec::new(),
            },
            WinAdapterDnsInfo {
                friendly_name: "Ethernet".to_string(),
                dns_suffix: "corp.internal".to_string(),
                is_up: true,
                is_loopback: false,
                dns_servers: Vec::new(),
            },
        ];

        // Active interface match
        assert_eq!(
            resolve_windows_default_domain(Some("Wi-Fi"), &adapters, None),
            Some("lan.home".to_string())
        );

        // Case-insensitive active interface match
        assert_eq!(
            resolve_windows_default_domain(Some("wi-fi"), &adapters, None),
            Some("lan.home".to_string())
        );

        // Active interface has no suffix -> falls back to global domain
        let adapters_no_suffix = vec![WinAdapterDnsInfo {
            friendly_name: "Wi-Fi".to_string(),
            dns_suffix: "".to_string(),
            is_up: true,
            is_loopback: false,
            dns_servers: Vec::new(),
        }];
        assert_eq!(
            resolve_windows_default_domain(
                Some("Wi-Fi"),
                &adapters_no_suffix,
                Some("global.example.com")
            ),
            Some("global.example.com".to_string())
        );

        // Active interface unknown -> falls back to global domain
        assert_eq!(
            resolve_windows_default_domain(Some("Unknown"), &adapters, Some("global.example.com")),
            Some("global.example.com".to_string())
        );
    }

    #[test]
    fn test_parse_windows_domain_search() {
        let adapters = vec![
            WinAdapterDnsInfo {
                friendly_name: "Wi-Fi".to_string(),
                dns_suffix: "lan.home".to_string(),
                is_up: true,
                is_loopback: false,
                dns_servers: Vec::new(),
            },
            WinAdapterDnsInfo {
                friendly_name: "vEthernet".to_string(),
                dns_suffix: "netbird.cloud".to_string(),
                is_up: true,
                is_loopback: false,
                dns_servers: Vec::new(),
            },
            WinAdapterDnsInfo {
                friendly_name: "Loopback Pseudo-Interface 1".to_string(),
                dns_suffix: "ignore.me".to_string(),
                is_up: true,
                is_loopback: true,
                dns_servers: Vec::new(),
            },
            WinAdapterDnsInfo {
                friendly_name: "Disconnected".to_string(),
                dns_suffix: "offline.local".to_string(),
                is_up: false,
                is_loopback: false,
                dns_servers: Vec::new(),
            },
        ];

        let result = parse_windows_domain_search(Some("search1.com, search2.com"), &adapters);
        assert_eq!(
            result,
            vec![
                "global: search1.com, search2.com",
                "Wi-Fi: lan.home",
                "vEthernet: netbird.cloud"
            ]
        );
    }

    #[test]
    #[cfg(target_os = "windows")]
    fn test_ip_adapter_addresses_layout() {
        use std::mem::{offset_of, size_of};

        #[repr(C)]
        #[allow(non_snake_case)]
        struct IpAdapterAddresses {
            Length: u32,
            IfIndex: u32,
            Next: *mut IpAdapterAddresses,
            AdapterName: *const i8,
            FirstUnicastAddress: *const std::ffi::c_void,
            FirstAnycastAddress: *const std::ffi::c_void,
            FirstMulticastAddress: *const std::ffi::c_void,
            FirstDnsServerAddress: *const std::ffi::c_void,
            DnsSuffix: *const u16,
            Description: *const u16,
            FriendlyName: *const u16,
            PhysicalAddress: [u8; 8],
            PhysicalAddressLength: u32,
            Flags: u32,
            Mtu: u32,
            IfType: u32,
            OperStatus: u32,
        }

        if cfg!(target_pointer_width = "64") {
            assert_eq!(offset_of!(IpAdapterAddresses, Next), 8);
            assert_eq!(offset_of!(IpAdapterAddresses, AdapterName), 16);
            assert_eq!(offset_of!(IpAdapterAddresses, DnsSuffix), 56);
            assert_eq!(offset_of!(IpAdapterAddresses, FriendlyName), 72);
            assert_eq!(offset_of!(IpAdapterAddresses, OperStatus), 104);
            assert_eq!(size_of::<IpAdapterAddresses>(), 112);
        }
    }
}