Consistency05 (consistency05)

Status: Final

Purpose

  • Compare delegation glue addresses against child authoritative address data for in-bailiwick nameservers.
  • Compare out-of-bailiwick glue addresses against recursive public lookup results.

Preconditions And Inputs

  • Preconditions:
    • A zone.Zone object is available.
  • Required inputs:
    • Parent-side NS, A, and AAAA responses via queryParentAll.
    • Child-side nameserver names via methods.Method2and3.
    • Child-side nameserver servers via methods.Method4and5.
    • Recursive lookup results via recurse for out-of-bailiwick checks and referral fallbacks.
  • Profile/config knobs that affect behavior:
    • net.ipv4 and net.ipv6: filter which child nameserver addresses are queried.

Algorithm And Decision Flow

  1. Emit TEST_CASE_START.
  2. Query parent for child-zone NS records; collect unique child NS names.
  3. For each child NS name, query parent for A and AAAA and collect glue items owner/ip.
  4. Split parent glue into:
    • in-bailiwick strict glue (strictGlue),
    • out-of-bailiwick extended glue (extendedGlue grouped by NS name).
  5. Build in-bailiwick NS name set from Method2+Method3, and in-bailiwick child NS servers from Method4+Method5 (respecting enabled IP versions).
  6. If Method4+Method5 yields no usable in-bailiwick child NS servers:
    • Materialize child NS server endpoints from in-bailiwick strict glue, respecting enabled IP versions.
    • Query those endpoints for the child-zone NS set and merge any in-bailiwick names into the in-bailiwick NS name set.
  7. For each in-bailiwick NS name:
    • Query every in-bailiwick child NS server for A and AAAA with RD off (getAddrRRs).
    • getAddrRRs emits NO_RESPONSE on no response and CHILD_NS_FAILED on unusable non-referral/non-NXDOMAIN authoritative behavior.
    • Referral responses trigger recursive fallback lookup and use resulting answer data if available.
    • Otherwise accumulate child authoritative owner/ip pairs.
  8. If no in-bailiwick address lookup path was usable for any in-bailiwick NS name, emit CHILD_ZONE_LAME, emit TEST_CASE_END, and return.
  9. Compare in-bailiwick sets:
    • Parent-only items -> emit IN_BAILIWICK_ADDR_MISMATCH.
    • Child-only items -> emit EXTRA_ADDRESS_CHILD.
  10. For each out-of-bailiwick NS name in extended glue:
  • Recurse A and AAAA, build child/public owner/ip set.
  • If any parent glue item for that name is missing from child/public set, emit OUT_OF_BAILIWICK_ADDR_MISMATCH.
  1. If none of the three mismatch tags were emitted, emit ADDRESSES_MATCH.
  2. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

TagEmitted when
ADDRESSES_MATCHNo in-bailiwick mismatch, no extra child address, and no out-of-bailiwick mismatch were found.
CHILD_NS_FAILEDChild nameserver response for in-bailiwick address lookup was unusable (non-AA/no referral/no accepted RCODE path).
CHILD_ZONE_LAMEEvery in-bailiwick address lookup path failed for all in-bailiwick NS names.
EXTRA_ADDRESS_CHILDChild authoritative in-bailiwick address set contains addresses not present in strict glue.
IN_BAILIWICK_ADDR_MISMATCHStrict in-bailiwick glue contains addresses not found in child authoritative data.
NO_RESPONSEA child nameserver did not return a response for an in-bailiwick A/AAAA lookup.
OUT_OF_BAILIWICK_ADDR_MISMATCHOut-of-bailiwick glue contains addresses not found in recursive public A/AAAA results.
TEST_CASE_ENDTestcase completion marker is emitted.
TEST_CASE_STARTTestcase start marker is emitted.

Tag Arguments

TagArgument keyTypeMeaning
ADDRESSES_MATCH--No arguments.
CHILD_NS_FAILEDnsstringChild nameserver identity (ns name only; use address for IP) that failed authoritative child lookup requirements.
CHILD_NS_FAILEDaddressstringNameserver IP address for the same endpoint.
CHILD_ZONE_LAME--No arguments.
EXTRA_ADDRESS_CHILDaddressesarray<string>Structured owner/ip entries found only in child authoritative data.
IN_BAILIWICK_ADDR_MISMATCHparent_serversarray<object>Structured parent strict-glue endpoint list; each item is { "ns": "...", "address": "..." }.
IN_BAILIWICK_ADDR_MISMATCHzone_serversarray<object>Structured child authoritative in-bailiwick endpoint list; each item is { "ns": "...", "address": "..." }.
NO_RESPONSEnsstringChild nameserver identity (ns name only; use address for IP) with no response.
NO_RESPONSEaddressstringNameserver IP address for the same endpoint.
OUT_OF_BAILIWICK_ADDR_MISMATCHparent_serversarray<object>Structured parent out-of-bailiwick glue endpoint list for one NS name.
OUT_OF_BAILIWICK_ADDR_MISMATCHzone_serversarray<object>Structured recursively resolved endpoint list for the same NS name.
TEST_CASE_ENDtestcasestringTestcase display name (Consistency05).
TEST_CASE_STARTtestcasestringTestcase display name (Consistency05).

Severity Levels Per Tag

TagLevelNotes
ADDRESSES_MATCHINFODefault from share/profile.json (test_levels.CONSISTENCY).
CHILD_NS_FAILEDDEBUGDefault from share/profile.json (test_levels.CONSISTENCY).
CHILD_ZONE_LAMEERRORDefault from share/profile.json (test_levels.CONSISTENCY).
EXTRA_ADDRESS_CHILDNOTICEDefault from share/profile.json (test_levels.CONSISTENCY).
IN_BAILIWICK_ADDR_MISMATCHERRORDefault from share/profile.json (test_levels.CONSISTENCY).
NO_RESPONSEDEBUGDefault from share/profile.json (test_levels.CONSISTENCY).
OUT_OF_BAILIWICK_ADDR_MISMATCHERRORDefault from share/profile.json (test_levels.CONSISTENCY).
TEST_CASE_ENDDEBUGDefault from share/profile.json (test_levels.CONSISTENCY).
TEST_CASE_STARTDEBUGDefault from share/profile.json (test_levels.CONSISTENCY).

Differences From Upstream

  • Upstream reference: consistency05.md
  • Differences (Upstream vs Gonemaster):
    • Upstream: does not explicitly define this detail. Gonemaster: In-bailiwick processing queries all discovered in-bailiwick child servers and emits one NO_RESPONSE or CHILD_NS_FAILED entry per failing nameserver before final mismatch classification.
    • Upstream: does not explicitly define this detail. Gonemaster: Referral handling explicitly falls back to recursive lookup for the same qtype and owner.
    • Upstream: the short-circuit wording can be read per in-bailiwick NS name. Gonemaster: CHILD_ZONE_LAME is emitted only when all in-bailiwick address lookup paths fail, so disjoint parent/child NS sets can still be classified as address mismatches.
    • Upstream: does not explicitly define this detail. Gonemaster: If Method4+Method5 cannot produce usable in-bailiwick child NS endpoints, strict glue endpoints are used as a fallback for child-side address checks and child NS name discovery.
  • Potential upstream report:
    • no

Edge Cases And Limitations

  • CHILD_ZONE_LAME short-circuits testcase execution and suppresses later mismatch checks when no usable in-bailiwick address lookup path was found.
  • Out-of-bailiwick mismatch reporting is per NS name group; each emission includes full parent list for that group.
  • Disabled IP versions affect child authoritative probes indirectly by filtering queried child servers.