resolver, watcher: a record type whose query fails keeps its previous records (closes #231)

The resolver lists in FailedTypes each record type whose query to a
nameserver got no usable reply: none after two tries, an error reply, a
referral, or a truncated reply whose TCP retry failed. Records holds
nothing for such a type, never none or the part that fit. A nameserver
that answered no type has failed, as before. The watcher keeps the
previous check's records for a failed type; when that check did not know
them either (first check, new or failing nameserver), the type is saved
in failedTypes and left out of record and inconsistency comparisons.
ResolveIPAddresses no longer counts a nameserver whose A, AAAA or CNAME
query failed as an answer.

Model: opus-5-5

internal/resolver/errors.go

@@ -22,6 +22,12 @@ var (
 		"reply is an error or a referral that leads no closer",
 	)
 
+	// ErrTruncated is the reason given for a reply too large for UDP
+	// whose retry over TCP failed.
+	ErrTruncated = errors.New(
+		"reply truncated and its retry over TCP failed",
+	)
+
 	// ErrIntercepted is returned when every root server refused a
 	// query. Root servers refuse no query, so the refusals came from
 	// something on the network answering in their place.

internal/resolver/export_test.go

@@ -2,10 +2,21 @@ package resolver
 
 import (
 	"context"
+	"log/slog"
+	"time"
 
 	"github.com/miekg/dns"
 )
 
+// NewWithFailingTCP returns a Resolver whose TCP client gives up before
+// it can connect, so the retry over TCP of every truncated reply fails.
+func NewWithFailingTCP(log *slog.Logger) *Resolver {
+	r := NewFromLogger(log)
+	r.tcp = &tcpClient{timeout: time.Nanosecond}
+
+	return r
+}
+
 // ExtractRecordValue exports extractRecordValue for testing.
 func ExtractRecordValue(rr dns.RR) string {
 	return extractRecordValue(rr)

internal/resolver/iterative.go

@@ -89,6 +89,9 @@ func (r *Resolver) tryExchange(
 	return resp, err
 }
 
+// retryTCP returns the reply to msg over TCP when resp, its reply over
+// UDP, is truncated. When that fails it returns resp, still truncated,
+// which holds only the records that fit.
 func (r *Resolver) retryTCP(
 	ctx context.Context,
 	msg *dns.Msg,
@@ -638,8 +641,12 @@ type queryState struct {
 	gotReferral bool
 	netErr      error
 	hasRecords  bool
+	answered    bool
 }
 
+// queryEachType asks the nameserver at nsIP about hostname once for each
+// record type in qtypes, and lists in resp.FailedTypes the types whose
+// query got no usable reply.
 func (r *Resolver) queryEachType(
 	ctx context.Context,
 	nsIP string,
@@ -654,7 +661,20 @@ func (r *Resolver) queryEachType(
 			break
 		}
 
-		r.querySingleType(ctx, nsIP, hostname, qtype, resp, &state)
+		if r.querySingleType(ctx, nsIP, hostname, qtype, resp, &state) {
+			state.answered = true
+		} else {
+			resp.FailedTypes = append(
+				resp.FailedTypes, dns.TypeToString[qtype],
+			)
+		}
+	}
+
+	// The reply about another type can carry the name's CNAME. When the
+	// query for CNAME itself failed, that is left out too, so Records
+	// holds nothing for a failed type.
+	for _, rtype := range resp.FailedTypes {
+		delete(resp.Records, rtype)
 	}
 
 	for k := range resp.Records {
@@ -664,6 +684,9 @@ func (r *Resolver) queryEachType(
 	return state
 }
 
+// querySingleType asks the nameserver at nsIP about hostname's records
+// of type qtype, and reports whether it answered: with records, with
+// none, or with NXDOMAIN.
 func (r *Resolver) querySingleType(
 	ctx context.Context,
 	nsIP string,
@@ -671,7 +694,7 @@ func (r *Resolver) querySingleType(
 	qtype uint16,
 	resp *NameserverResponse,
 	state *queryState,
-) {
+) bool {
 	msg, err := r.queryDNS(ctx, nsIP, hostname, qtype)
 	if err != nil {
 		switch {
@@ -683,19 +706,19 @@ func (r *Resolver) querySingleType(
 			state.netErr = err
 		}
 
-		return
+		return false
 	}
 
 	if msg.Rcode == dns.RcodeNameError {
 		state.gotNXDomain = true
 
-		return
+		return true
 	}
 
 	if msg.Rcode == dns.RcodeServerFailure {
 		state.gotSERVFAIL = true
 
-		return
+		return false
 	}
 
 	// A reply with no answer that lists other nameservers, from a server
@@ -708,10 +731,20 @@ func (r *Resolver) querySingleType(
 		len(extractNSSet(msg.Ns)) > 0 {
 		state.gotReferral = true
 
-		return
+		return false
+	}
+
+	// A reply still truncated is one whose TCP retry failed, and holds
+	// only the records that fit.
+	if msg.Truncated {
+		state.netErr = ErrTruncated
+
+		return false
 	}
 
 	collectAnswerRecords(msg, resp, state)
+
+	return true
 }
 
 func collectAnswerRecords(
@@ -743,23 +776,26 @@ func isTimeout(err error) bool {
 	return false
 }
 
+// classifyResponse sets the nameserver's status. One that answered no
+// record type has failed, and Error says why; one that answered some has
+// the status of those answers.
 func classifyResponse(resp *NameserverResponse, state queryState) {
 	switch {
 	case state.gotNXDomain && !state.hasRecords:
 		resp.Status = StatusNXDomain
-	case state.gotTimeout && !state.hasRecords:
+	case state.gotTimeout && !state.answered:
 		resp.Status = StatusTimeout
 		resp.Error = "all queries timed out"
-	case state.gotSERVFAIL && !state.hasRecords:
+	case state.gotSERVFAIL && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned SERVFAIL"
-	case state.gotRefused && !state.hasRecords:
+	case state.gotRefused && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned REFUSED"
-	case state.netErr != nil && !state.hasRecords:
+	case state.netErr != nil && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "network error: " + state.netErr.Error()
-	case state.gotReferral && !state.hasRecords:
+	case state.gotReferral && !state.answered:
 		resp.Status = StatusError
 		resp.Error = "server returned a referral"
 	case !state.hasRecords && !state.gotNXDomain:
@@ -920,9 +956,11 @@ func (r *Resolver) resolveIPWithCNAME(
 }
 
 // collectIPs returns the addresses in the nameservers' answers and the
-// first CNAME target among them. It returns ErrNoNameserverAnswered when
-// every nameserver timed out, failed or returned a referral: that is not
-// a name with no addresses.
+// first CNAME target among them. A nameserver whose query for one of the
+// types failed gave only part of the addresses, and is left out. It
+// returns ErrNoNameserverAnswered when every nameserver timed out,
+// failed, returned a referral or was left out: that is not a name with
+// no addresses.
 func collectIPs(
 	results map[string]*NameserverResponse,
 ) ([]string, string, error) {
@@ -935,7 +973,8 @@ func collectIPs(
 	answered := false
 
 	for _, resp := range results {
-		if resp.Status == StatusTimeout || resp.Status == StatusError {
+		if resp.Status == StatusTimeout || resp.Status == StatusError ||
+			len(resp.FailedTypes) > 0 {
 			continue
 		}
 

internal/resolver/iterative_test.go

@@ -43,6 +43,25 @@ func TestCollectIPs_FailedIsNoAnswer(t *testing.T) {
 	assert.Empty(t, ips)
 }
 
+// TestCollectIPs_FailedTypeIsNoAnswer checks that a nameserver whose
+// query for one of the types failed is no answer: its addresses are
+// only part of them.
+func TestCollectIPs_FailedTypeIsNoAnswer(t *testing.T) {
+	t.Parallel()
+
+	ips, _, err := resolver.CollectIPs(
+		map[string]*resolver.NameserverResponse{
+			nsExample1: {
+				Records:     map[string][]string{"A": {"192.0.2.1"}},
+				FailedTypes: []string{"AAAA"},
+				Status:      resolver.StatusOK,
+			},
+		},
+	)
+	require.ErrorIs(t, err, resolver.ErrNoNameserverAnswered)
+	assert.Empty(t, ips)
+}
+
 const (
 	// exampleCom is the zone most cases of TestUsableReply and
 	// TestNSSetFrom are about, and wwwExampleCom a name in it.

internal/resolver/resolver.go

@@ -31,11 +31,15 @@ type Params struct {
 }
 
 // NameserverResponse holds one nameserver's response for a query.
+// FailedTypes lists the record types whose query got no usable reply,
+// and Records holds nothing for them: their records are not known. When
+// no record type got one, Status and Error say the nameserver failed.
 type NameserverResponse struct {
-	Nameserver string
-	Records    map[string][]string
-	Status     string
-	Error      string
+	Nameserver  string
+	Records     map[string][]string
+	FailedTypes []string
+	Status      string
+	Error       string
 }
 
 // Resolver performs iterative DNS resolution from root servers.

internal/resolver/resolver_test.go

@@ -245,6 +245,23 @@ func TestQueryNameserver_TXT(t *testing.T) {
 	)
 }
 
+// TestQueryNameserver_TruncatedReplyWhoseTCPRetryFails asks a google.com
+// nameserver about google.com with a resolver whose retries over TCP
+// fail. google.com's TXT records do not fit in a reply over UDP, so TXT
+// is reported as failed, holding none of the records that fit, while
+// the nameserver, which answered the other types, is ok.
+func TestQueryNameserver_TruncatedReplyWhoseTCPRetryFails(t *testing.T) {
+	t.Parallel()
+
+	ns := findOneNSForDomain(t, newTestResolver(t), "google.com")
+	r := resolver.NewWithFailingTCP(slog.Default())
+	resp := liveQueryNameserver(t, r, ns, "google.com")
+
+	assert.Equal(t, resolver.StatusOK, resp.Status)
+	assert.Contains(t, resp.FailedTypes, "TXT")
+	assert.NotContains(t, resp.Records, "TXT")
+}
+
 func TestQueryNameserver_NXDomain(t *testing.T) {
 	t.Parallel()