watcher: a hostname whose zone's nameservers all stop answering gets NS Failure (closes #284)

When none of the nameservers of a hostname's zone answered, the walk to
them failed and the check was only logged. The walk now returns a
NoAnswerError naming the nameservers of the zone it reached through a
referral when none of them answers. When those are the nameservers the
previous check saved for the name, each is saved as failed with the
reason, so it gets an NS Failure and later an NS Recovery. A domain with
no delegation of its own, whose NS lookup is that same walk, gets the
same. A walk that fails before that zone, as when the host loses its
network, is still only logged.

Model: opus-5-5

internal/watcher/export_test.go

@@ -122,6 +122,34 @@ func (w *Watcher) RunTLSChecks(ctx context.Context) {
 	w.runTLSChecks(ctx)
 }
 
+// CheckHostnameResult exports checkHostnameResult for testing.
+func (w *Watcher) CheckHostnameResult(
+	ctx context.Context,
+	hostname string,
+	results map[string]*resolver.NameserverResponse,
+	err error,
+) bool {
+	return w.checkHostnameResult(ctx, hostname, results, err)
+}
+
+// CheckDomainResult exports checkDomainResult for testing.
+func (w *Watcher) CheckDomainResult(
+	ctx context.Context,
+	domain string,
+	nameservers []string,
+	err error,
+) {
+	w.checkDomainResult(ctx, domain, nameservers, err)
+}
+
+// FailedNameservers exports failedNameservers for testing.
+func FailedNameservers(
+	err error,
+	prev *state.HostnameState,
+) map[string]*resolver.NameserverResponse {
+	return failedNameservers(err, prev)
+}
+
 // BuildHostnameState exports buildHostnameState for testing.
 func BuildHostnameState(
 	results map[string]*resolver.NameserverResponse,

internal/watcher/interfaces.go

@@ -20,7 +20,10 @@ type DNSResolver interface {
 	) ([]string, error)
 
 	// LookupAllRecords queries all record types for a hostname,
-	// returning each nameserver's response keyed by nameserver.
+	// returning each nameserver's response keyed by nameserver. When
+	// the walk to the nameservers reached a zone through a referral and
+	// none of that zone's nameservers answered, the error is a
+	// *resolver.NoAnswerError naming them.
 	LookupAllRecords(
 		ctx context.Context,
 		hostname string,

internal/watcher/nsfailure_test.go

@@ -2,6 +2,7 @@ package watcher_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 	"strings"
@@ -14,6 +15,10 @@ import (
 	"sneak.berlin/go/dnswatcher/internal/watcher"
 )
 
+// errNoReply is why a walk that got no reply from a zone's servers
+// failed.
+var errNoReply = errors.New("all servers failed: i/o timeout")
+
 // answered is what a check saves for a nameserver that answered with
 // these records.
 func answered(records map[string][]string) *state.NameserverRecordState {
@@ -183,6 +188,134 @@ func TestNSFailureAlertNamesHostnameNameserverAndReason(t *testing.T) {
 	}
 }
 
+// TestZoneNameserversAllStopAnswering runs three checks of host from
+// the point where its lookup has returned. On the first, nsA and nsB,
+// the nameservers of its zone, answer. On the second, the lookup fails
+// with the error the walk to them returns when neither answers (see
+// the resolver's TestFollowDelegation_NoAnswerAfterReferral), given
+// here because no live zone has nameservers that never answer. For a
+// hostname it is the lookup of its records that fails, and for a domain
+// with no delegation of its own the lookup of its delegation. Both are
+// saved as failed, with the reason, and each gets an NS Failure. On the
+// third, both answer, and each gets an NS Recovery. A domain's records
+// are checked as a hostname's, so its first and third checks are too.
+func TestZoneNameserversAllStopAnswering(t *testing.T) {
+	t.Parallel()
+
+	records := map[string][]string{"A": {ip1}}
+	bothAnswer := map[string]*resolver.NameserverResponse{
+		nsA: response(records), nsB: response(records),
+	}
+	noAnswer := &resolver.NoAnswerError{
+		Nameservers: []string{nsA, nsB}, Err: errNoReply,
+	}
+
+	tests := []struct {
+		name     string
+		isDomain bool
+	}{
+		{"hostname", false},
+		{"domain with no delegation of its own", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := defaultTestConfig(t)
+			if tt.isDomain {
+				cfg.Domains = []string{host}
+			} else {
+				cfg.Hostnames = []string{host}
+			}
+
+			// The watcher is given each lookup's result, so it has no
+			// resolver.
+			deps := newTestDeps(t, cfg)
+			w := watcher.NewForTest(
+				cfg, deps.state, nil,
+				deps.portChecker, deps.tlsChecker, deps.notifier,
+			)
+			w.SetFirstRun(false)
+
+			w.CheckHostnameResult(t.Context(), host, bothAnswer, nil)
+
+			if tt.isDomain {
+				w.CheckDomainResult(t.Context(), host, nil, noAnswer)
+			} else {
+				w.CheckHostnameResult(t.Context(), host, nil, noAnswer)
+			}
+
+			current, _ := deps.state.GetHostnameState(host)
+
+			for _, ns := range []string{nsA, nsB} {
+				got := current.RecordsByNameserver[ns]
+				if got.Status != failed().Status || got.Error != errNoReply.Error() {
+					t.Errorf(
+						"%s saved with status %q, error %q; want %q, %q",
+						ns, got.Status, got.Error, failed().Status, errNoReply,
+					)
+				}
+			}
+
+			if n := countNotifications(deps, "NS Failure: "+host); n != 2 {
+				t.Errorf("sent %d NS Failure notifications, want 2", n)
+			}
+
+			w.CheckHostnameResult(t.Context(), host, bothAnswer, nil)
+
+			if n := countNotifications(deps, "NS Recovery: "+host); n != 2 {
+				t.Errorf("sent %d NS Recovery notifications, want 2", n)
+			}
+		})
+	}
+}
+
+// TestFailedNameserversOnlyForThoseOfThePreviousCheck gives
+// FailedNameservers lookup errors after a check in which nsA and nsB
+// answered. Only an error that names both makes them failed.
+func TestFailedNameserversOnlyForThoseOfThePreviousCheck(t *testing.T) {
+	t.Parallel()
+
+	records := map[string][]string{"A": {ip1}}
+	bothAnswered := saved(map[string]*state.NameserverRecordState{
+		nsA: answered(records), nsB: answered(records),
+	})
+	noAnswer := func(nameservers ...string) error {
+		return &resolver.NoAnswerError{Nameservers: nameservers, Err: errNoReply}
+	}
+
+	tests := []struct {
+		name       string
+		err        error
+		prev       *state.HostnameState
+		wantFailed bool
+	}{
+		{"both did not answer", noAnswer(nsA, nsB), bothAnswered, true},
+		{
+			"the servers of a parent zone did not answer",
+			noAnswer(nsC), bothAnswered, false,
+		},
+		{
+			"the zone's delegation lists only nsA now",
+			noAnswer(nsA), bothAnswered, false,
+		},
+		{"no root server answered", errNoReply, bothAnswered, false},
+		{"no previous check", noAnswer(nsA, nsB), nil, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := watcher.FailedNameservers(tt.err, tt.prev)
+			if (got != nil) != tt.wantFailed {
+				t.Errorf("returned %v, want failed: %v", got, tt.wantFailed)
+			}
+		})
+	}
+}
+
 // TestNameserverThatNeverAnswers asks a nameserver address where
 // nothing answers, 192.0.2.1, and checks what the watcher saves for it.
 // The deadline outlasts the resolver's first two-second try, as in the

internal/watcher/watcher.go

@@ -291,12 +291,25 @@ func (w *Watcher) logFailedLookup(
 	w.log.Error(msg, args...)
 }
 
+// checkDomain looks up domain's delegation and checks domain with it
+// (see checkDomainResult).
 func (w *Watcher) checkDomain(
 	ctx context.Context,
 	domain string,
 ) {
 	nameservers, err := w.resolver.LookupNS(ctx, domain)
 
+	w.checkDomainResult(ctx, domain, nameservers, err)
+}
+
+// checkDomainResult finishes a check of domain from nameservers and err,
+// what the lookup of its delegation returned.
+func (w *Watcher) checkDomainResult(
+	ctx context.Context,
+	domain string,
+	nameservers []string,
+	err error,
+) {
 	// A domain that does not exist has no nameservers.
 	nxdomain := errors.Is(err, resolver.ErrNXDomain)
 	if nxdomain {
@@ -311,6 +324,12 @@ func (w *Watcher) checkDomain(
 			"error", err,
 		)
 
+		// For a domain with no delegation of its own, the servers that
+		// did not answer can be those of the zone it is in, at which
+		// its records are asked. They are then saved as failed, as a
+		// hostname's are.
+		w.checkHostnameResult(ctx, domain, nil, err)
+
 		return
 	}
 
@@ -464,8 +483,8 @@ func (w *Watcher) detectNSAddressChanges(
 	}
 }
 
-// checkHostname checks hostname's records and reports whether it saved
-// them; it does not when their lookup fails.
+// checkHostname looks up hostname's records and checks them (see
+// checkHostnameResult). It reports whether it saved them.
 func (w *Watcher) checkHostname(
 	ctx context.Context,
 	hostname string,
@@ -478,12 +497,31 @@ func (w *Watcher) checkHostname(
 			"hostname", hostname,
 			"error", err,
 		)
-
-		return false
 	}
 
+	return w.checkHostnameResult(ctx, hostname, results, err)
+}
+
+// checkHostnameResult finishes a check of hostname from results and err,
+// what the lookup of its records returned, and reports whether it saved
+// them. When the lookup failed, it saves nothing, unless the nameservers
+// that did not answer are those of the previous check (see
+// failedNameservers).
+func (w *Watcher) checkHostnameResult(
+	ctx context.Context,
+	hostname string,
+	results map[string]*resolver.NameserverResponse,
+	err error,
+) bool {
 	prev, _ := w.state.GetHostnameState(hostname)
 
+	if err != nil {
+		results = failedNameservers(err, prev)
+		if results == nil {
+			return false
+		}
+	}
+
 	w.updateHostnameState(
 		ctx, hostname, buildHostnameState(results, prev, time.Now().UTC()),
 	)
@@ -491,6 +529,40 @@ func (w *Watcher) checkHostname(
 	return true
 }
 
+// failedNameservers returns a failed response for each nameserver in
+// prev, a name's state from the previous check, with err as the reason,
+// when err says that the walk to the name's nameservers reached their
+// zone and none of them answered. For any other error, as when the walk
+// got no answer before it reached their zone, or when prev is nil, it
+// returns nil.
+func failedNameservers(
+	err error,
+	prev *state.HostnameState,
+) map[string]*resolver.NameserverResponse {
+	var noAnswer *resolver.NoAnswerError
+	if !errors.As(err, &noAnswer) || prev == nil {
+		return nil
+	}
+
+	saved := slices.Sorted(maps.Keys(prev.RecordsByNameserver))
+	if !slices.Equal(noAnswer.Nameservers, saved) {
+		return nil
+	}
+
+	results := make(map[string]*resolver.NameserverResponse)
+
+	for _, ns := range saved {
+		results[ns] = &resolver.NameserverResponse{
+			Nameserver: ns,
+			Records:    make(map[string][]string),
+			Status:     resolver.StatusError,
+			Error:      err.Error(),
+		}
+	}
+
+	return results
+}
+
 // updateHostnameState finishes a check of hostname from newState, built
 // from its nameservers' answers: it follows the CNAME in them, notifies
 // what changed since the previous check, and saves newState.
@@ -790,7 +862,7 @@ func (w *Watcher) detectRecordChanges(
 // saved delegation, which detectNSChanges notifies when they are removed
 // from it. checkDomain saves a new delegation only after this runs, and
 // only together with the records, so the saved delegation and the
-// records in prev come from the same check.
+// nameservers in prev come from the same check.
 func (w *Watcher) detectNSDisappearances(
 	ctx context.Context,
 	hostname string,