watcher: a hostname whose zone's nameservers all stop answering gets NS Failure (closes #284)

When none of the nameservers of a hostname's zone answered, the walk to
them failed and the check was only logged. The walk now returns a
NoAnswerError naming the nameservers of the zone it reached through a
referral when none of them answers. When those are the nameservers the
previous check saved for the name, each is saved as failed with the
reason, so it gets an NS Failure and later an NS Recovery. A domain with
no delegation of its own, whose NS lookup is that same walk, gets the
same. A walk that fails before that zone, as when the host loses its
network, is still only logged.

Model: opus-5-5

internal/resolver/errors.go

@@ -2,6 +2,23 @@ package resolver
 
 import "errors"
 
+// NoAnswerError is returned when the walk to a name's nameservers
+// reached a zone through a referral and none of that zone's
+// nameservers, Nameservers as the referral names them, answered. Err
+// says why they did not.
+type NoAnswerError struct {
+	Nameservers []string
+	Err         error
+}
+
+func (e *NoAnswerError) Error() string {
+	return e.Err.Error()
+}
+
+func (e *NoAnswerError) Unwrap() error {
+	return e.Err
+}
+
 // Sentinel errors returned by the resolver.
 var (
 	// ErrNoNameservers is returned when no authoritative NS

internal/resolver/export_test.go

@@ -31,9 +31,11 @@ func NewWithQueryTimeout(log *slog.Logger, timeout time.Duration) *Resolver {
 func (r *Resolver) FollowDelegation(
 	ctx context.Context,
 	domain string,
+	zone string,
+	nameservers []string,
 	servers []string,
 ) ([]string, error) {
-	return r.followDelegation(ctx, domain, servers)
+	return r.followDelegation(ctx, domain, zone, nameservers, servers)
 }
 
 // FindAuthoritativeNameserversFrom exports findAuthoritativeNameservers

internal/resolver/iterative.go

@@ -204,20 +204,24 @@ func glueIPs(nsNames []string, glue map[string][]net.IP) []string {
 	return ips
 }
 
-// followDelegation follows referrals from servers, the root servers, to
-// domain and returns the NS set of domain's delegation. When the servers
-// of the zone domain is in answer that domain does not exist, the error
-// is ErrNXDomain. When they answer that it has no delegation of its own,
+// followDelegation follows referrals to domain from servers, the
+// addresses of the servers of zone, and returns the NS set of domain's
+// delegation. nameservers are the names a referral gave the servers of
+// zone; the walk to a name's nameservers starts at the root servers, the
+// servers of zone ".", which no referral names. When the servers of the
+// zone domain is in answer that domain does not exist, the error is
+// ErrNXDomain. When they answer that it has no delegation of its own,
 // because it is not the zone's apex, the set is empty and there is no
-// error. Any other error means that no such answer came.
+// error. Any other error means that no such answer came; it is a
+// *NoAnswerError when the servers that did not answer are those of a
+// zone a referral named.
 func (r *Resolver) followDelegation(
 	ctx context.Context,
 	domain string,
+	zone string,
+	nameservers []string,
 	servers []string,
 ) ([]string, error) {
-	// servers are the root servers, the servers of zone ".".
-	zone := "."
-
 	var withoutAddresses []string
 
 	for range maxDelegation {
@@ -228,6 +232,12 @@ func (r *Resolver) followDelegation(
 		resp, err := r.queryZone(
 			ctx, servers, withoutAddresses, zone, domain, dns.TypeNS, 0,
 		)
+
+		// A query that ctx cut short says nothing about the servers.
+		if err != nil && len(nameservers) > 0 && checkCtx(ctx) == nil {
+			return nil, &NoAnswerError{Nameservers: nameservers, Err: err}
+		}
+
 		if err != nil {
 			return nil, err
 		}
@@ -256,6 +266,7 @@ func (r *Resolver) followDelegation(
 			return r.resolveNSIterative(ctx, domain)
 		}
 
+		nameservers = authNS
 		servers, withoutAddresses = referralNameservers(resp)
 		zone = referralZone(resp)
 	}
@@ -626,7 +637,8 @@ func (r *Resolver) resolveARecord(
 // them. When the servers asked answer that the name has no delegation
 // of its own, or does not exist, it tries each parent name in turn, so
 // it returns the nameservers of the zone the name is in. When they do
-// not answer, it returns the error and tries no parent name.
+// not answer, it returns the error and tries no parent name; when a
+// referral named them, the error is a *NoAnswerError naming them.
 func (r *Resolver) FindAuthoritativeNameservers(
 	ctx context.Context,
 	domain string,
@@ -655,7 +667,7 @@ func (r *Resolver) findAuthoritativeNameservers(
 
 		candidate := strings.Join(labels[i:], ".") + "."
 
-		nsNames, err := r.followDelegation(ctx, candidate, servers)
+		nsNames, err := r.followDelegation(ctx, candidate, ".", nil, servers)
 		if err != nil && !errors.Is(err, ErrNXDomain) {
 			return nil, err
 		}
@@ -1067,7 +1079,7 @@ func (r *Resolver) LookupNS(
 	}
 
 	return r.followDelegation(
-		ctx, dns.Fqdn(strings.ToLower(domain)), rootServerList(),
+		ctx, dns.Fqdn(strings.ToLower(domain)), ".", nil, rootServerList(),
 	)
 }
 

internal/resolver/resolver_test.go

@@ -121,7 +121,9 @@ func TestFindAuthoritativeNameservers_DelegatedSubdomain(
 // delegation of its own, so the lookup returns that walk's error, about
 // www.google.com, and tries no parent name: trying google.com and com
 // would end in ErrNoNameservers, or in the error of a walk for one of
-// them.
+// them. The servers that did not answer are those the walk started at,
+// which no referral named, so the error is no NoAnswerError, as when
+// the host running dnswatcher has lost its network.
 func TestFindAuthoritativeNameservers_NoAnswer(t *testing.T) {
 	t.Parallel()
 
@@ -134,6 +136,9 @@ func TestFindAuthoritativeNameservers_NoAnswer(t *testing.T) {
 	require.NotErrorIs(t, err, resolver.ErrNoNameservers)
 	assert.Contains(t, err.Error(), "query www.google.com. @"+noAnswerAddress)
 	assert.Empty(t, nameservers)
+
+	var noAnswer *resolver.NoAnswerError
+	assert.NotErrorAs(t, err, &noAnswer)
 }
 
 func TestFindAuthoritativeNameservers_ReturnsSorted(
@@ -954,12 +959,34 @@ func TestFollowDelegation_NoAnswer(t *testing.T) {
 	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
 
 	nameservers, err := r.FollowDelegation(
-		t.Context(), "google.com.", []string{noAnswerAddress},
+		t.Context(), "google.com.", ".", nil, []string{noAnswerAddress},
 	)
 	require.Error(t, err)
 	assert.Empty(t, nameservers)
 }
 
+// TestFollowDelegation_NoAnswerAfterReferral starts the walk for
+// www.example.net at the servers of example.net as a referral names
+// them, ns1.example.net and ns2.example.net, at 192.0.2.1, where nothing
+// answers. The error is a NoAnswerError naming them, which the watcher
+// compares with the nameservers it saved for the name.
+func TestFollowDelegation_NoAnswerAfterReferral(t *testing.T) {
+	t.Parallel()
+
+	r := resolver.NewWithQueryTimeout(slog.Default(), 100*time.Millisecond)
+	nameservers := []string{"ns1.example.net.", "ns2.example.net."}
+
+	_, err := r.FollowDelegation(
+		t.Context(), "www.example.net.", "example.net.", nameservers,
+		[]string{noAnswerAddress},
+	)
+
+	var noAnswer *resolver.NoAnswerError
+	require.ErrorAs(t, err, &noAnswer)
+	assert.Equal(t, nameservers, noAnswer.Nameservers)
+	assert.Contains(t, err.Error(), "query www.example.net. @"+noAnswerAddress)
+}
+
 // TestResolveNSIterative_NoDelegationOfItsOwn walks to the nameservers
 // of www.google.com as the fallback walk does. As in
 // TestLookupNS_NoDelegationOfItsOwn, the set is empty, with no error.