Connectivity02

Status: Final

Purpose

• Verify that nameservers are reachable over TCP for SOA and NS queries at the child zone name.
• Detect TCP response-shape failures equivalent to Connectivity01 checks.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Nameserver addresses from ZoneNameservers .
  • Child zone name (z.Name).
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped.
  • resolver.defaults.parallel: per-nameserver query task parallelism.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Resolve nameserver list from ZoneNameservers .
3. For each nameserver (parallelized):
   • If transport for this nameserver IP version is disabled:
     • Emit IPV4_DISABLED or IPV6_DISABLED for each rrtype (SOA, NS) and skip queries for that nameserver.
   • Else query SOA and NS for child zone over TCP (UseVC=true).
   • If both responses are absent, emit CN02_NO_RESPONSE_TCP.
   • Otherwise evaluate SOA and NS responses independently:
     • No response -> CN02_NO_RESPONSE_<QTYPE>_QUERY_TCP.
     • RCODE != NOERROR -> CN02_UNEXPECTED_RCODE_<QTYPE>_QUERY_TCP.
     • No <QTYPE> record in answer -> CN02_MISSING_<QTYPE>_RECORD_TCP.
     • First answer owner name differs from child zone -> CN02_WRONG_<QTYPE>_RECORD_TCP.
     • AA flag unset -> CN02_<QTYPE>_RECORD_NOT_AA_TCP.
   • If all checks passed, record nameserver as ok.
4. If any nameservers passed all checks, emit one CN02_OK_TCP with servers listing them all.
5. Emit TEST_CASE_END.

Per-NS TCP Probe (steps 2-4)

resolve NS list with ZoneNameservers

For each nameserver (parallel; fan-out = resolver.defaults.parallel):

   transport check for SOA+NS
    +- IPv6 + Net.IPv6 disabled  -> IPV6_DISABLED per rrtype, skip ns
    +- IPv4 + Net.IPv4 disabled  -> IPV4_DISABLED per rrtype, skip ns
    +- enabled                   -> proceed

   query SOA over TCP (UseVC=true), query NS over TCP
    +- both resp.Msg == nil      -> CN02_NO_RESPONSE_TCP, skip ns
    +- otherwise                 -> per-qtype shape checks (see below)

After all tasks:
  any nameserver passed all per-qtype checks -> CN02_OK_TCP (servers)
emit TEST_CASE_END

Per-Query Response Shape Checks (step 3 details)

Per qtype in {SOA, NS}, checks run in this order; first failure wins:

   resp.Msg == nil                       -> CN02_NO_RESPONSE_<QTYPE>_QUERY_TCP   (ok=false)
   RCODE != NOERROR                      -> CN02_UNEXPECTED_RCODE_<QTYPE>_QUERY_TCP (rcode)
   no <QTYPE> record in answer           -> CN02_MISSING_<QTYPE>_RECORD_TCP
   first answer owner != z.Name (FQDN, case-insensitive)
                                         -> CN02_WRONG_<QTYPE>_RECORD_TCP
                                            (domain_found, domain_expected)
   !AA                                   -> CN02_<QTYPE>_RECORD_NOT_AA_TCP
   otherwise                             -> qtype ok

A nameserver counts as "ok" only if both SOA and NS qtypes pass every check.

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Differences (Upstream vs Gonemaster):
  • Upstream: does not explicitly define this detail. Gonemaster: emits additional per-query transport debug tags (IPV4_DISABLED, IPV6_DISABLED) when transport is disabled.
  • Upstream: does not explicitly define this detail. Gonemaster: Owner-name validation checks the first answer record owner for the queried rrtype.
• Potential upstream report:
  • no

Edge Cases And Limitations

• If ZoneNameservers yields no nameservers, only testcase start/end tags are emitted.
• Query call errors are treated as absent response messages.
• A single nameserver can emit multiple findings in one run (for example one SOA issue and one NS issue).