fix: redesign direct address allocation and membership authority

[orielhaim]

This PR addresses #18 by replacing Direct's hardcoded addressing model with a proper network-level architecture.

The root problem was broader than the 100.64.0.0/10 collision with Tailscale: Direct addressing was spread across hardcoded CIDRs, local derivation logic, DNS fake IPs, join-order precedence, and manual overrides, with no single authenticated source of truth.

The new design makes signed Genesis the authority for the network's peer allocation range, makes the coordinator the only peer-IP allocator, and makes signed membership the only EndpointId -> IP authority.

It also removes the broad connected subnet model in favor of exact /32 addresses/routes, removes legacy collision indexes and IP overrides, makes overlapping Direct networks fail explicitly instead of relying on precedence, and keeps PeerDNS/MagicDNS host-local rather than part of the Direct protocol.

The goal is a simpler zero-config model: users keep using tunnet create / invite / join, while address selection, validation, conflict detection, allocation, and routing are handled automatically.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​netdev@​0.45.0 ⏵ 0.45.1
	cargo/​russh@​0.63.1 ⏵ 0.63.2	-1
	cargo/​hickory-proto@​0.26.1 ⏵ 0.26.2
	cargo/​hickory-resolver@​0.26.1 ⏵ 0.26.2
	cargo/​mdns-sd@​0.21.1 ⏵ 0.21.2
	cargo/​tokio-rustls@​0.26.4 ⏵ 0.26.5	+2

View full report

[wighawag]

The direction is right, and better than what I was doing: making signed Genesis the allocation authority and signed membership the only EndpointId -> IP source removes the guessing entirely. accept_pending doing lookup_endpoint() instead of re-deriving is strictly better than the fix I had in #20, and moving PeerDNS to loopback sidesteps the CGNAT collision instead of just relocating inside it. Dropping the connected /10 for exact /32s should kill the route-stealing half of #18 outright.

Two things it doesn't fix, both still present in the branch and both on main today:

• multicast/broadcast still get tunneled to an exit node. is_mesh_or_link_local doesn't check is_multicast(), so they fall through to the exit catch-all, and broadcast leaks separately via the 0.0.0.0/0 an exit node puts in the subnet table. That's fix(routing): never route multicast or broadcast off-box #16, one line plus tests, independent of your redesign.
• recover_stale still fails closed when a journal record names a deleted interface, which permanently disables DNS integration on every later start. I hit it by just restarting the service and had to delete the record by hand. That's fix(dns): a vanished interface must not disable DNS integration forever #21 (and recover_stale() fails permanently when a journal record names a deleted interface orielhaim/osdns#2 upstream).

Two questions rather than objections:

• 127.0.0.1:53 will collide with anything already there, dnsmasq/unbound/pi-hole are common. Is a dedicated loopback address worth it, the way resolved uses 127.0.0.53? LocalResolverEndpoint already carries a port so it may be configurable enough as-is.
• port 53 is privileged, so PeerDNS still can't bind on Android (unprivileged app). Since the endpoint struct has a port field, a high port there might be all that's needed. Would close the MagicDNS gap in Android app: connect a phone to a Direct mesh #13.

Also: what's the migration story for networks that already exist? Removing collision indexes and overrides changes allocation, so I assume existing Direct networks renumber. Worth stating explicitly in the PR.

One heads-up: main got rebased and dropped the 8 datapath commits, so all my open PRs picked them up and look enormous. Rebasing them now, ignore the diffs until I've pushed.