Nameserver12 (nameserver12)

Status: Final

Purpose

  • Validate behavior when querying with unknown EDNS Z flags set.

Preconditions And Inputs

  • Preconditions:
    • A zone.Zone object is available.
  • Required inputs:
    • Nameserver addresses from methods.Method4and5.
    • SOA responses to EDNS query with Z flag bits set (Z=3).
  • Profile/config knobs that affect behavior:
    • net.ipv4 and net.ipv6: disabled transports are skipped with transport debug tags.
    • resolver.defaults.parallel: parallel nameserver query fanout.

Algorithm And Decision Flow

  1. Emit TEST_CASE_START.
  2. Read nameserver list from Method4and5.
  3. For each nameserver (parallelized, input-order merged logs):
    • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED for rrtype SOA, then skip.
    • Send SOA query with EDNS version 0 and Z=3.
    • If no response, emit NO_RESPONSE (ns, domain).
    • Else if RCODE=FORMERR and EDNS extended rcode is 0, emit NO_EDNS_SUPPORT.
    • Else if response EDNS Z value is non-zero, emit Z_FLAGS_NOTCLEAR.
    • Else if response matches success shape (RCODE=NOERROR, EdnsRcode=0, EdnsVersion=0, EdnsZ=0, and SOA answer present), emit no finding.
    • Else emit NS_ERROR.
  4. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

TagEmitted when
IPV4_DISABLEDIPv4 nameserver evaluation is skipped because IPv4 is disabled.
IPV6_DISABLEDIPv6 nameserver evaluation is skipped because IPv6 is disabled.
NO_EDNS_SUPPORTResponse indicates FORMERR EDNS handling fallback path.
NO_RESPONSEQuery with Z flags set produced no DNS response.
NS_ERRORResponse did not fit expected success or explicit failure branches.
TEST_CASE_ENDTestcase completion marker is emitted.
TEST_CASE_STARTTestcase start marker is emitted.
Z_FLAGS_NOTCLEARResponse EDNS Z flags were not cleared to zero.

Tag Arguments

TagArgument keyTypeMeaning
IPV4_DISABLEDnsstringNameserver identity (ns name only; use address for IP) skipped on IPv4.
IPV4_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV4_DISABLEDrrtypestringrrtype skipped (SOA).
IPV6_DISABLEDnsstringNameserver identity (ns name only; use address for IP) skipped on IPv6.
IPV6_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV6_DISABLEDrrtypestringrrtype skipped (SOA).
NO_EDNS_SUPPORTnsstringNameserver identity (ns name only; use address for IP) treated as no-EDNS support path.
NO_EDNS_SUPPORTaddressstringNameserver IP address for the same endpoint.
NO_RESPONSEnsstringNameserver identity (ns name only; use address for IP) with no response.
NO_RESPONSEaddressstringNameserver IP address for the same endpoint.
NO_RESPONSEdomainstringTested zone name.
NS_ERRORnsstringNameserver identity (ns name only; use address for IP) with unexpected behavior.
NS_ERRORaddressstringNameserver IP address for the same endpoint.
TEST_CASE_ENDtestcasestringTestcase display name (Nameserver12).
TEST_CASE_STARTtestcasestringTestcase display name (Nameserver12).
Z_FLAGS_NOTCLEARnsstringNameserver identity (ns name only; use address for IP) returning non-zero EDNS Z flags.
Z_FLAGS_NOTCLEARaddressstringNameserver IP address for the same endpoint.

Severity Levels Per Tag

TagLevelNotes
IPV4_DISABLEDDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
IPV6_DISABLEDDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
NO_EDNS_SUPPORTWARNINGDefault from share/profile.json (test_levels.NAMESERVER).
NO_RESPONSEDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
NS_ERRORWARNINGDefault from share/profile.json (test_levels.NAMESERVER).
TEST_CASE_ENDDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
TEST_CASE_STARTDEBUGDefault from share/profile.json (test_levels.NAMESERVER).
Z_FLAGS_NOTCLEARWARNINGDefault from share/profile.json (test_levels.NAMESERVER).

Differences From Upstream

  • Upstream reference: nameserver12.md
  • Differences (Upstream vs Gonemaster):
    • Upstream: describes iterating nameserver IP set. Gonemaster: iterates raw Method4and5 output (no testcase-local deduplication).
    • Upstream: describes ignored disabled transports in prose. Gonemaster: emits explicit IPV4_DISABLED / IPV6_DISABLED tags.
    • Upstream: does not explicitly describe testcase boundary markers. Gonemaster: emits TEST_CASE_START and TEST_CASE_END.
  • Potential upstream report:
    • no

Edge Cases And Limitations

  • A nameserver can emit only one of NO_EDNS_SUPPORT, Z_FLAGS_NOTCLEAR, or NS_ERROR due branch ordering.
  • Z_FLAGS_NOTCLEAR branch is checked before full success-shape validation.
  • Query failures are reported as NO_RESPONSE; no retry path exists in this testcase.