Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable blacklisting for queries by NAMESERVER15 #1285

Merged
merged 1 commit into from
Sep 7, 2023

Conversation

marc-vanderwal
Copy link
Contributor

Purpose

Some DNS operate autoritative DNS servers in environments that drop queries performed by the NAMESERVER15 test case, i.e. version.bind/CH/TXT and version.server/CH/TXT.

In those setups, the name servers in question could be mistakenly deemed unresponsive, causing subsequent queries not to be attempted at all. This leads to false warnings in other test cases.

This commit disables the blacklisting of name servers that do not respond to our version probes, preventing false warnings from being emitted.

Context

Fixes #1281 (or at least, the situation leading to the creation of the issue).

Changes

Disable blacklisting of name servers not responding to version.{bind,server}/CH/TXT queries.

How to test this PR

Before:

$ zonemaster-cli festo.press --test basic --test nameserver/nameserver15 --test zone/zone09
Seconds Level     Message
======= ========= =======
   0.22 WARNING   No response on MX query from name servers "185.136.96.210;185.136.97.210;185.136.98.210;185.136.99.210".

After:

$ zonemaster-cli festo.press  --test basic --test nameserver/nameserver15 --test zone/zone09
Seconds Level     Message
======= ========= =======
Looks OK.

Some DNS operate autoritative DNS servers in environments that drop
queries performed by the NAMESERVER15 test case, i.e.
version.bind/CH/TXT and version.server/CH/TXT.

In those setups, the name servers in question could be mistakenly deemed
unresponsive, causing subsequent queries not to be attempted at all.
This leads to false warnings in other test cases.

This commit disables the blacklisting of name servers that do not
respond to our version probes, preventing false warnings from being
emitted.
@marc-vanderwal marc-vanderwal added the T-Bug Type: Bug in software or error in test case description label Aug 31, 2023
@marc-vanderwal marc-vanderwal added this to the v2023.2 milestone Aug 31, 2023
@marc-vanderwal marc-vanderwal linked an issue Aug 31, 2023 that may be closed by this pull request
@tgreenx
Copy link
Contributor

tgreenx commented Aug 31, 2023

@marc-vanderwal The specification of Nameserver15 is currently being updated. See zonemaster/zonemaster#1199. I propose that we wait for the implementation update and include your proposed change then.

@marc-vanderwal
Copy link
Contributor Author

It depends on whether we want to include this fix in the upcoming fix release. I think it could be nice if it were; if we can’t, I can wait.

@matsduf
Copy link
Contributor

matsduf commented Aug 31, 2023

I think we should have a broader solution instead of just fixing NAMESERVER15. If this is seen as a work-around waiting for the broader solution, it could be fine.

@tgreenx tgreenx modified the milestones: v2023.2, v2023.1.4 Sep 7, 2023
@tgreenx tgreenx changed the base branch from develop to releases/v2023.1.4 September 7, 2023 07:54
Copy link

@ghost ghost left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've done some quick tests and this looks good to me.

@tgreenx tgreenx merged commit 370a8b3 into zonemaster:releases/v2023.1.4 Sep 7, 2023
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
T-Bug Type: Bug in software or error in test case description
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Blacklisting in Zonemaster creates false WARNING
3 participants