How can template return NOERROR on CH class queries?

[matsduf]

I have created the following template to get NODATA responses (RCODE NOERROR) on CH class queries for "version.bind. TXT.

If I send the query with query class IN I get the expected response, but when I send the query with query class CH I get RCODE REFUSED. How could I create the response I am looking for?

Configuration used:

. {
    bind 127.17.15.31
    bind fda1:b2:c3:0:127:17:15:31
    log

    template ANY TXT version.bind {
         rcode NOERROR
         authority "bind. 600 {{ .Class }} SOA ns1.bind. admin.bind. 2022112300 3600 3600 3600 3600"
    }

}

Expected response, but with wrong query class (IN instead of CH):

; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> @127.17.15.31 version.bind in txt +noedns +norec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60380
;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;version.bind.			IN	TXT

;; AUTHORITY SECTION:
bind.			600	IN	SOA	ns1.bind. admin.bind. 2022112300 3600 3600 3600 3600

;; Query time: 0 msec
;; SERVER: 127.17.15.31#53(127.17.15.31) (UDP)
;; WHEN: Fri Oct 27 09:35:18 UTC 2023
;; MSG SIZE  rcvd: 88

Unexpected RCODE and missing data in authority section when query class is CH:

; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> @127.17.15.31 version.bind CH txt +noedns +norec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 19354
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;version.bind.			CH	TXT

;; Query time: 4 msec
;; SERVER: 127.17.15.31#53(127.17.15.31) (UDP)
;; WHEN: Fri Oct 27 09:35:31 UTC 2023
;; MSG SIZE  rcvd: 30

Secondly, I have tried to set RCODE to NXDOMAIN, but I still get REFUSED instead of expected NXDOMAIN and nothing in the authority section.

I want to clarify why I want the specific behavior. I work with Zonemaster, which is a test tool for DNS zones. To test the test code we need test zones that can confirm that the code does it correctly. Zonemaster checks for CH class version strings under version.bind and version.server, and we need zones matching different scenarios.

• https://zonemaster.net/ (web based service for anyone)
• https://github.com/zonemaster/zonemaster (source code and documentation)

[chrisohaver]

Have you tried using the chaos plugin instead of template?

[matsduf]

Yes, and it works for some scenarios. The chaos plugin can only return a TXT string in CH class in answer section with RCODE NOERROR. But I need to be able to create other scenarios where the chaos plugin does not work.

[rdrozhdzh]

CHAOS class is enabled only when you use any of the plugins listed here

coredns/core/dnsserver/server.go

Lines 450 to 455 in 4c60f95

	// EnableChaos is a map with plugin names for which we should open CH class queries as we block these by default.
	var EnableChaos = map[string]struct{}{
	"chaos": {},
	"forward": {},
	"proxy": {},
	}

Otherwise coredns responds with REFUSED to all CH queries

[matsduf]

Do you know if it should be possible to patch server.go by adding e.g. "template" to make it handle CH queries more or less as IN queries? What I build is for test zones only and only available on loopback.

[chrisohaver]

Yes - we should add template to this list. (And also remove proxy, since it was deprecated years ago, replaced with forward.)

[matsduf]

OK, I will try to add template and acl to the list and recompile. Thanks.

[matsduf]

After adding "template" and "acl" to the list in server.go and recompile solved my issue so far. Now it works as expected!

[matsduf]

Thanks!