Consistency01

Status: Final

Purpose

• Check SOA serial consistency across nameservers for the tested zone.
• Report serial distribution and detect serial variation above the configured threshold.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Nameserver list from GlueNameservers and ApexNameservers .
  • SOA answers from queried nameservers.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped per nameserver.
  • resolver.defaults.parallel: per-nameserver query task parallelism.
  • constants.SerialMaxVariation: accepted numeric delta threshold (default 0).

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Build deduplicated nameserver list from the union of GlueNameservers and ApexNameservers by ns.String() (name/ip).
3. For each nameserver (parallelized):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype SOA and skip.
   • Query SOA for zone apex.
   • No response message -> emit NO_RESPONSE.
   • Response without usable SOA record for zone apex -> emit NO_RESPONSE_SOA_QUERY.
   • Otherwise store serial value for that nameserver.
4. Group successful responses by serial value.
5. Emit SOA_SERIAL once per serial (ordered numerically) with sorted servers.
6. If exactly one serial exists, emit ONE_SOA_SERIAL.
7. If multiple serials exist:
   • Emit MULTIPLE_SOA_SERIALS.
   • Select the oldest and newest serial using RFC 1982 serial arithmetic, compute the wrap-safe forward distance between them, and when it exceeds SerialMaxVariation emit SOA_SERIAL_VARIATION with the lagging nameservers in servers_behind.
8. Emit TEST_CASE_END.

Per-NS SOA Probe and Serial Aggregation (steps 2-8)

gather GlueNameservers then ApexNameservers nameservers
 +- dedupe by ns.String() ("name/ip")

For each nameserver (parallel; fan-out = resolver.defaults.parallel):

   transport check for SOA
    +- disabled                          -> IPV4_DISABLED / IPV6_DISABLED, mark skip
    +- enabled                           -> query SOA at z.Name

   resp.Msg absent                       -> NO_RESPONSE
   no SOA record for z.Name in resp      -> NO_RESPONSE_SOA_QUERY
   first record not *dns.SOA             -> NO_RESPONSE_SOA_QUERY
   otherwise                             -> serial = soa.Serial (as string)
                                            serials[serial] += "name/ip"

After all tasks (serials ordered numerically):
  emit one SOA_SERIAL per serial  (serial, servers)

  len(serials) == 1                  -> ONE_SOA_SERIAL (serial)
  len(serials) > 1                   -> MULTIPLE_SOA_SERIALS (count)
      oldest/newest via RFC 1982 (util.SerialGT); variation = newest - oldest (wrap-safe)
      if variation > SerialMaxVariation
                                        -> SOA_SERIAL_VARIATION
                                           (serial_min, serial_max, max_variation, servers_behind)

emit TEST_CASE_END

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Differences (Upstream vs Gonemaster):
  • Upstream documents MULTIPLE_SOA_SERIALS_OK; Gonemaster does not emit that tag.
  • Upstream sorts serial values lexically as strings and subtracts the first from the last, which mis-ranks differing-length serials and the 32-bit wrap boundary. Gonemaster orders serials and selects the oldest/newest using RFC 1982 serial arithmetic, and reports the lagging nameservers in servers_behind.
• Potential upstream report:
  • yes (reported upstream: the upstream string-sort plus integer-subtraction variation check is incorrect for differing-length serials and for serials near the 32-bit wrap boundary).

Implementation Notes

The following behaviors are implementation choices, not mandated by protocol:

• RFC 1982 serial ordering: Observed serials are parsed to 32-bit integers and ordered numerically; the oldest and newest are selected with RFC 1982 serial-number arithmetic (util.SerialGT), and the variation is the wrap-safe forward distance between them. With the default SerialMaxVariation of 0 any difference between serials is flagged. Serials that fail to parse as 32-bit integers are skipped from the variation check.
• Deduplication by name/ip: Nameservers are deduplicated using their full name/ip identity string. Two entries with the same IP but different names are treated as distinct sources. The protocol defines no deduplication rule for testcase purposes; this choice is implementation-defined.
• Sorted servers in SOA_SERIAL: Nameserver identities in SOA_SERIAL arguments are sorted before joining. Deterministic ordering is an implementation choice for reproducible output.

Edge Cases And Limitations

• If no usable SOA serial is obtained from any nameserver, no serial-summary tag (ONE_SOA_SERIAL/MULTIPLE_SOA_SERIALS) is emitted.
• Nameserver deduplication is by name/ip; same IP with different names is treated as separate sources.
• Serials that do not parse as 32-bit unsigned integers are skipped from the variation check.