test(tun): add Go tests for mobile/tun FakeDNS codec and DNS mapper

Adds 13 table-driven Go tests across two files in mobile/tun, plus an
explicit workflow step in go-test.yml so the subpackage's tests are
visible in CI output (the existing exclusion-based step reaches it
implicitly, but explicit is better for the next reader).

mobile/tun/dns_mapper_test.go (4 tests):
  - GetFakeIP assigns sequential IPs in 198.18.0.0/16
  - GetFakeIP returns stable mapping for the same hostname
  - GetHostname round-trips with GetFakeIP
  - GetHostname returns ok=false for unmapped IPs

mobile/tun/fakedns_proxy_test.go (9 tests):
  - parseDNSQuery: valid hostname, single-label, too-short (<12B),
    label length boundary (63 OK / 64 rejected), compression-pointer
    rejection (0xC0 caught by the length>63 guard).
  - buildDNSResponse: valid-IP happy path with full byte-layout
    assertions (flags 0x8400, ANCOUNT=1, name pointer 0xC00C,
    type A, rdlen 4, IPv4 trailing), invalid-IP returns nil,
    short query returns nil.

Uses only the Go stdlib 'testing' package — no testify, no external
deps — so go.mod/go.sum stay clean (build_go_mobile.sh:10-17
immutability trap requires this). Imports encoding/binary, net,
strings, testing only.

Verification (Go 1.26.1 on Windows):
  go test -count=1 ./mobile/tun/... -v   -> 13 PASS
  CI-excluded suite (go list ./... | grep -v mobile) -> exit 0
  git diff --quiet -- go.mod go.sum      -> exit 0

Author: Hidden-Node

.github/workflows/go-test.yml

@@ -19,3 +19,6 @@ jobs:
 
       - name: Run Go tests (exclude root and gomobile bridge)
         run: go test $(go list ./... | grep -v -e '^masterdnsvpn-go$' -e '^masterdnsvpn-go/mobile$')
+
+      - name: Run mobile/tun tests (explicit, incl. new characterization tests)
+        run: go test ./mobile/tun/... -v

mobile/tun/dns_mapper_test.go

@@ -0,0 +1,52 @@
+package tun
+
+import (
+	"testing"
+)
+
+func TestDNSMapper_GetFakeIP_AssignsSequentialIPsIn198_18Range(t *testing.T) {
+	d := NewDNSMapper()
+
+	first := d.GetFakeIP("a.example")
+	if first != "198.18.0.2" {
+		// counter starts at 1; first AddUint32 -> 2 in NewDNSMapper's setup
+		t.Fatalf("first fake IP = %q, want 198.18.0.2", first)
+	}
+
+	second := d.GetFakeIP("b.example")
+	if second != "198.18.0.3" {
+		t.Fatalf("second fake IP = %q, want 198.18.0.3", second)
+	}
+}
+
+func TestDNSMapper_GetFakeIP_StableForSameHostname(t *testing.T) {
+	d := NewDNSMapper()
+
+	first := d.GetFakeIP("dup.example")
+	second := d.GetFakeIP("dup.example")
+	if first != second {
+		t.Fatalf("duplicate hostname mapped to %q then %q", first, second)
+	}
+}
+
+func TestDNSMapper_GetHostname_RoundTrips(t *testing.T) {
+	d := NewDNSMapper()
+
+	const host = "roundtrip.example"
+	ip := d.GetFakeIP(host)
+
+	got, ok := d.GetHostname(ip)
+	if !ok {
+		t.Fatalf("GetHostname(%q) returned ok=false", ip)
+	}
+	if got != host {
+		t.Fatalf("GetHostname(%q) = %q, want %q", ip, got, host)
+	}
+}
+
+func TestDNSMapper_GetHostname_UnknownIPOKFalse(t *testing.T) {
+	d := NewDNSMapper()
+	if _, ok := d.GetHostname("198.18.99.99"); ok {
+		t.Fatal("GetHostname returned ok=true for unmapped IP")
+	}
+}

mobile/tun/fakedns_proxy_test.go

@@ -0,0 +1,141 @@
+package tun
+
+import (
+	"encoding/binary"
+	"net"
+	"strings"
+	"testing"
+)
+
+// helper: build a DNS query for a hostname like "example.com"
+func buildQuery(t *testing.T, hostname string) []byte {
+	t.Helper()
+	// Header: 12 bytes (id, flags, qdcount=1, ancount=0, nscount=0, arcount=0)
+	q := make([]byte, 12)
+	binary.BigEndian.PutUint16(q[0:2], 0x1234) // id
+	binary.BigEndian.PutUint16(q[4:6], 1)       // qdcount = 1
+
+	// Question section
+	parts := strings.Split(hostname, ".")
+	for _, label := range parts {
+		if len(label) > 63 {
+			t.Fatalf("label %q too long for test builder", label)
+		}
+		q = append(q, byte(len(label)))
+		q = append(q, []byte(label)...)
+	}
+	q = append(q, 0)    // terminator
+	q = append(q, 0, 1) // QTYPE = A
+	q = append(q, 0, 1) // QCLASS = IN
+	return q
+}
+
+func TestParseDNSQuery_ValidHostname(t *testing.T) {
+	q := buildQuery(t, "example.com")
+	got := parseDNSQuery(q)
+	if got != "example.com" {
+		t.Fatalf("parseDNSQuery = %q, want %q", got, "example.com")
+	}
+}
+
+func TestParseDNSQuery_SingleLabelHostname(t *testing.T) {
+	q := buildQuery(t, "localhost")
+	got := parseDNSQuery(q)
+	if got != "localhost" {
+		t.Fatalf("parseDNSQuery single label = %q, want %q", got, "localhost")
+	}
+}
+
+func TestParseDNSQuery_TooShortReturnsEmpty(t *testing.T) {
+	got := parseDNSQuery([]byte{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10}) // 11 bytes < 12
+	if got != "" {
+		t.Fatalf("parseDNSQuery short query = %q, want empty", got)
+	}
+}
+
+func TestParseDNSQuery_LabelLen63OK(t *testing.T) {
+	long := strings.Repeat("a", 63)
+	q := buildQuery(t, long+".example")
+	got := parseDNSQuery(q)
+	if got != long+".example" {
+		t.Fatalf("parseDNSQuery 63-char label = %q", got)
+	}
+}
+
+func TestParseDNSQuery_LabelLen64Rejected(t *testing.T) {
+	long := strings.Repeat("a", 64)
+	// build query manually since buildQuery rejects >63
+	q := make([]byte, 12)
+	binary.BigEndian.PutUint16(q[4:6], 1)
+	q = append(q, byte(64))
+	q = append(q, []byte(long)...)
+	q = append(q, 0, 0, 1, 0, 1)
+	got := parseDNSQuery(q)
+	if got != "" {
+		t.Fatalf("parseDNSQuery 64-char label = %q, want empty (rejected)", got)
+	}
+}
+
+func TestParseDNSQuery_CompressionPointerRejected(t *testing.T) {
+	// A compression pointer has top two bits set (0xC0). The parser rejects via length > 63.
+	q := buildQuery(t, "example.com")
+	// Replace the first label-length byte with 0xC0 0x0C (pointer to offset 12)
+	q[12] = 0xC0
+	q[13] = 0x0C
+	got := parseDNSQuery(q)
+	if got != "" {
+		t.Fatalf("parseDNSQuery compression pointer = %q, want empty (rejected)", got)
+	}
+}
+
+func TestBuildDNSResponse_ValidIPReturnsAResponse(t *testing.T) {
+	q := buildQuery(t, "example.com")
+	resp := buildDNSResponse(q, "198.18.0.5")
+	if resp == nil {
+		t.Fatal("buildDNSResponse returned nil for valid input")
+	}
+
+	// Response should be the query, with flags updated to 0x8400, ANCOUNT=1.
+	flags := binary.BigEndian.Uint16(resp[2:4])
+	if flags&0x8400 != 0x8400 {
+		t.Fatalf("response flags = 0x%04X, want 0x8400 bit set", flags)
+	}
+	ancount := binary.BigEndian.Uint16(resp[6:8])
+	if ancount != 1 {
+		t.Fatalf("ancount = %d, want 1", ancount)
+	}
+
+	// The answer section is at the end. Check that it specifies type/class A=1 IN=1
+	// and rdlength=4 and that the final 4 bytes are the IPv4.
+	// Layout: query | 0xC0 0x0C | type(2) | class(2) | ttl(4) | rdlen(2) | rdata(4)
+	answerStart := len(q)
+	if int(resp[answerStart]) != 0xC0 || int(resp[answerStart+1]) != 0x0C {
+		t.Fatalf("answer name pointer = 0x%02X%02X, want 0xC00C", resp[answerStart], resp[answerStart+1])
+	}
+	typeA := binary.BigEndian.Uint16(resp[answerStart+2 : answerStart+4])
+	if typeA != 1 {
+		t.Fatalf("answer type = %d, want 1 (A)", typeA)
+	}
+	rdlen := binary.BigEndian.Uint16(resp[answerStart+10 : answerStart+12])
+	if rdlen != 4 {
+		t.Fatalf("rdlength = %d, want 4", rdlen)
+	}
+	ip := net.IP(resp[answerStart+12 : answerStart+16]).String()
+	if ip != "198.18.0.5" {
+		t.Fatalf("answer IP = %s, want 198.18.0.5", ip)
+	}
+}
+
+func TestBuildDNSResponse_InvalidIPReturnsNil(t *testing.T) {
+	q := buildQuery(t, "example.com")
+	// An IP with no IPv4 representation: a hostname string
+	if resp := buildDNSResponse(q, "not-an-ip"); resp != nil {
+		t.Fatalf("buildDNSResponse with non-IP returned %v, want nil", resp)
+	}
+}
+
+func TestBuildDNSResponse_QueryTooShortReturnsNil(t *testing.T) {
+	if resp := buildDNSResponse([]byte{0, 1, 2}, "1.2.3.4"); resp != nil {
+		t.Fatalf("buildDNSResponse short query returned %v, want nil", resp)
+	}
+}