DNSSEC01

Status: Final

Purpose

• Validate DS digest algorithm usage for the child delegation and classify each observed DS digest type.
• Classify the algorithm field of each observed DS record (the DNSKEY algorithm the DS references), so every value including private-use algorithms is visible and severity-rated.

Preconditions And Inputs

• Preconditions:
  • A zone.Zone object is available.
• Required inputs:
  • Parent nameserver names/IPs from ParentNameservers .
  • Optional undelegated DS records exposed via parent nameserver FakeDSRecords.
  • DS query responses for child zone name from parent nameservers.
• Profile/config knobs that affect behavior:
  • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
  • resolver.defaults.parallel: parallel parent-query execution fanout.

Algorithm And Decision Flow

1. Emit TEST_CASE_START.
2. Initialize classification sets for DS digest classes and DS algorithm field classes, plus tracking sets for:
   • parent nameservers ignored due to invalid response shape,
   • parent nameservers responding without valid DS owner,
   • parent nameservers responding with DS,
   • keytags seen with digest algorithm 2 vs non-2.
3. Resolve parent nameserver names/IPs.
4. Check undelegated DS input path:
   • If parent fake DS records are present, classify those DS records immediately with source servers value -.
   • Mark parent-NS query list empty so external parent DS queries are skipped.
5. For each unique parent nameserver IP (parallelized):
   • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype DS and skip.
   • Send DS query with DNSSEC enabled.
   • If response is absent or fails required shape checks (NOERROR, OPT, DO, AA), mark nameserver as ignored.
   • If response has no DS record with owner matching child zone name, mark nameserver in Responds Without Valid DS.
   • Else mark nameserver in Responds With DS and classify each DS digest algorithm and each DS algorithm field value into the corresponding DS01 tag sets.
6. Emit DS classification tags (DS01_DS_ALGO_*) grouped by (digest, keytag) with merged servers, and DS algorithm field classification tags (DS01_KEY_ALGO_*) grouped by (algorithm, keytag) with merged servers. The algorithm-to-class mapping mirrors the DNSKEY algorithm classification of DNSSEC05 (dnssec01TagForKeyAlgorithm reuses the ranges of dnssec05TagForAlgorithm; 253 and 254 map to _PRIVATE).
7. Emit DS01_DS_ALGO_2_MISSING for keytags that have non-2 DS but no digest-2 DS on the same source nameservers.
8. If no valid/non-valid DS responders exist and ignored responders exist, emit DS01_NO_RESPONSE.
9. Emit informational tags based on zone type and undelegated DS status:
   • If zone is root (.), emit DS01_ROOT_N_NO_UNDEL_DS when no undelegated DS records were provided.
   • If zone is undelegated and non-root, emit DS01_UNDEL_N_NO_UNDEL_DS when no undelegated DS records were provided.
10. If Responds Without Valid DS is non-empty:
    • Emit DS01_PARENT_ZONE_NO_DS when no nameserver responded with DS.
    • Otherwise emit DS01_PARENT_SERVER_NO_DS.
11. Emit TEST_CASE_END.

Per-Parent-NS DS Query (steps 4-5)

parentNS = ParentNameservers

undelegated DS path (any parent NS has FakeDSRecords for z):
   for each DS record in fake set:
     classify by digest    -> sets[<tag>][digest][keytag] += "-"
     classify by algorithm -> keyAlgoSets[<tag>][algorithm][keytag] += "-"
     digest == 2 -> algo2DS[keytag] += "-"
     else        -> nonAlgo2DS[keytag] += "-"
   respondsWithDS += "-"
   skip live parent queries (parentNS = nil)

Otherwise, per unique parent NS IP (parallel; fan-out = resolver.defaults.parallel):

   transport disabled for DS -> IPV4_DISABLED / IPV6_DISABLED, skip
   query DS at z.Name, DNSSEC=on
    +- resp.Msg == nil / RCODE != NOERROR / no EDNS / !DO / !AA
                                         -> ignoredParentNS += matching ns/ip
    +- no DS with owner == z.Name        -> respondsWithoutValidDS += matching ns/ip
    +- DS present
                                         -> respondsWithDS += matching ns/ip
        for each DS:
          tag = dnssec01TagForDigest(digest)
            ({DEPRECATED, RESERVED, UNASSIGNED, PRIVATE, NOT_DS, OK})
          sets[tag][digest][keytag] += ns/ip
          keyTag = dnssec01TagForKeyAlgorithm(algorithm)
            ({OK, NOT_RECOMMENDED, DEPRECATED, NOT_ZONE_SIGN,
              PRIVATE, RESERVED, UNASSIGNED})
          keyAlgoSets[keyTag][algorithm][keytag] += ns/ip
          digest == 2 -> algo2DS[keytag]    += ns/ip
          else        -> nonAlgo2DS[keytag] += ns/ip

Aggregation and Summary Emission (steps 6-10)

emit per-digest classification tags:
   for each tag in sorted DS01_DS_ALGO_* keys:
     for each digest in sorted digest keys:
       for each keytag in sorted keytag keys:
         -> <tag> (keytag, ds_algo_num, ds_algo_descr, servers)

emit per-algorithm-field classification tags:
   for each tag in sorted DS01_KEY_ALGO_* keys:
     for each algorithm in sorted algorithm keys:
       for each keytag in sorted keytag keys:
         -> <tag> (keytag, ds_key_algo_num, ds_key_algo_descr, servers)

algo-2 coverage:
   for each keytag in nonAlgo2DS:
     missing = nonAlgo2DS[keytag] minus algo2DS[keytag]
     missing non-empty -> DS01_DS_ALGO_2_MISSING (keytag, servers=missing)

no usable responders:
   respondsWithoutValidDS empty AND respondsWithDS empty AND ignoredParentNS non-empty
     -> DS01_NO_RESPONSE (servers = ignoredParentNS)

zone-type info tags:
   z.Name == "." AND no undelegated DS              -> DS01_ROOT_N_NO_UNDEL_DS
   z.Name != "." AND hasFakeAddresses AND no undel DS -> DS01_UNDEL_N_NO_UNDEL_DS

without-valid-DS responders:
   respondsWithoutValidDS non-empty:
     respondsWithDS empty -> DS01_PARENT_ZONE_NO_DS  (servers)
     otherwise            -> DS01_PARENT_SERVER_NO_DS (servers)

emit TEST_CASE_END

Emitted Tags (Possible Set)

Tag Arguments

Severity Levels Per Tag

Differences From Upstream

• Differences (Upstream vs Gonemaster):
  • Upstream: does not explicitly specify testcase boundary and per-query transport debug emissions in this testcase summary. Gonemaster: emits TEST_CASE_START, TEST_CASE_END, IPV4_DISABLED, and IPV6_DISABLED.
  • Upstream: Summary argument list omits ds_algo_descr for some DS01 tags. Gonemaster: includes ds_algo_descr for all emitted DS01_DS_ALGO_* classification tags.
  • Upstream: does not classify the DS algorithm field. Gonemaster: emits DS01_KEY_ALGO_* classification tags for every observed DS algorithm field value.
• Potential upstream report:
  • no

Edge Cases And Limitations

• If no parent nameservers are available and no undelegated DS data exists, only the applicable root/undelegated informational tags and testcase boundary tags are emitted.
• For undelegated DS input, servers uses the sentinel source value -.
• DS answer processing requires at least one DS with owner matching child zone, but once accepted the testcase classifies all DS records in that answer section.