Skip to content

iterate: accept parent-side records for nameservers

Vladimír Čunát requested to merge parent_centric_ns_resolution-v2 into master

When resolving just NS names and addresses which won't go to answers, our cache can satisfy them with just parent-side records. Now we also make iterator consistent with that, and it will cut short if a delegation satisfies what the kr_query wants.

There's a general risk that we will never get the child-side records, and in practice the parent-side ones are sometimes "less accurate". This change may increase this risk (to NS addresses in particular), but we'd better consider addressing the risk later and systematically. A suggestion is to refresh the records asynchronously: https://tools.ietf.org/html/draft-ietf-dnsop-ns-revalidation

State before this commit lead to a weird behaviour where some IPv4-only tests in Deckard (namely iter_pcdiff.rpl) were failing with IPv6 turned off.

This was due to the resolvers' internal preference towards AAAA records for NS names. With IPv6 networking on, NS name resolution was first done for AAAA record and the glue (containing A record for the NS name in question) from parent zone was put into cache. As the AAAA resolution failed (there is no AAAA for this NS name), A was queried next and was satisfied from cache.

With IPv6 off, there is no query for the AAAA record, so no A record from glue gets put in to the cache. A record is resolved first, and resolution ignores the glue in parent zone and continue to the child zone which might be broken (intentionally in the case of that iter_pcdiff.rpl test).

Merge request reports