Connectivity01

Status: Final

Purpose

• Verify that nameservers are reachable over UDP for SOA and NS queries at the child zone name.
• Detect response-shape failures (missing records, wrong owner name, non-authoritative answers, and unexpected RCODEs).

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Nameserver addresses from ZoneNameservers .
  • Child zone name (z.Name).
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped.
  • resolver.defaults.parallel: per-nameserver query task parallelism.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Resolve nameserver list from ZoneNameservers .
3. Build disabled-transport summary tags:
   • If any IPv4 nameservers exist while IPv4 is disabled, emit CN01_IPV4_DISABLED with servers.
   • If any IPv6 nameservers exist while IPv6 is disabled, emit CN01_IPV6_DISABLED with servers.
4. For each nameserver (parallelized):
   • If transport for this nameserver IP version is disabled:
     • Emit IPV4_DISABLED or IPV6_DISABLED for each rrtype (SOA, NS) and skip queries for that nameserver.
   • Else query SOA and NS for child zone over UDP.
   • If both responses are absent, emit CN01_NO_RESPONSE_UDP.
   • Otherwise evaluate SOA and NS responses independently:
     • No response -> CN01_NO_RESPONSE_<QTYPE>_QUERY_UDP.
     • RCODE != NOERROR -> CN01_UNEXPECTED_RCODE_<QTYPE>_QUERY_UDP.
     • No <QTYPE> record in answer -> CN01_MISSING_<QTYPE>_RECORD_UDP.
     • First answer owner name differs from child zone -> CN01_WRONG_<QTYPE>_RECORD_UDP.
     • AA flag unset -> CN01_<QTYPE>_RECORD_NOT_AA_UDP.
   • If all checks passed, record nameserver as ok.
5. If any nameservers passed all checks, emit one CN01_OK_UDP with servers listing them all.
6. Emit TEST_CASE_END.

Per-NS UDP Probe (steps 2-5)

resolve NS list with ZoneNameservers
 |
 v
summary tags (per family, once):
  any IPv4 NS exists while Net.IPv4 disabled -> CN01_IPV4_DISABLED (servers)
  any IPv6 NS exists while Net.IPv6 disabled -> CN01_IPV6_DISABLED (servers)

For each nameserver (parallel; fan-out = resolver.defaults.parallel):

   transport check for SOA+NS
    +- IPv6 + Net.IPv6 disabled  -> IPV6_DISABLED per rrtype, skip ns
    +- IPv4 + Net.IPv4 disabled  -> IPV4_DISABLED per rrtype, skip ns
    +- enabled                   -> proceed

   query SOA over UDP, query NS over UDP
    +- both resp.Msg == nil      -> CN01_NO_RESPONSE_UDP, skip ns
    +- otherwise                 -> per-qtype shape checks (see below)

After all tasks:
  any nameserver passed all per-qtype checks -> CN01_OK_UDP (servers)
emit TEST_CASE_END

Per-Query Response Shape Checks (step 4 details)

Per qtype in {SOA, NS}, checks run in this order; first failure wins:

   resp.Msg == nil                       -> CN01_NO_RESPONSE_<QTYPE>_QUERY_UDP   (ok=false)
   RCODE != NOERROR                      -> CN01_UNEXPECTED_RCODE_<QTYPE>_QUERY_UDP (rcode)
   no <QTYPE> record in answer           -> CN01_MISSING_<QTYPE>_RECORD_UDP
   first answer owner != z.Name (FQDN, case-insensitive)
                                         -> CN01_WRONG_<QTYPE>_RECORD_UDP
                                            (domain_found, domain_expected)
   !AA                                   -> CN01_<QTYPE>_RECORD_NOT_AA_UDP
   otherwise                             -> qtype ok

A nameserver counts as "ok" only if both SOA and NS qtypes pass every check.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Differences (Upstream vs Gonemaster):
  • Upstream: defines summary transport-disabled reporting (CN01_IPV4_DISABLED, CN01_IPV6_DISABLED). Gonemaster: also emits per-query transport debug tags (IPV4_DISABLED, IPV6_DISABLED).
  • Upstream: does not explicitly define first-record owner comparison mechanics. Gonemaster: validates owner name using the first answer record for the queried rrtype.
• Potential upstream report:
  • no

Edge Cases And Limitations

• If ZoneNameservers yields no nameservers, only testcase start/end tags are emitted.
• Query call errors are treated as absent response messages.
• A single nameserver can emit multiple findings in one run (for example one SOA issue and one NS issue).