domain/base/iana/exterr.rs
1//! Extended DNS Error
2
3//------------ Extended Error Code ---------------------------------------------------------
4
5int_enum! {
6 /// Extended DNS error codes.
7 ///
8 /// A complementary data can be put in EDNS opt, providing
9 /// additional information about the cause of DNS errors. Defined
10 /// in [RFC 8914]. Current registered values can be found in [IANA
11 /// registry].
12 ///
13 /// [RFC 8914]: https://tools.ietf.org/html/rfc8914
14 /// [IANA registry]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#extended-dns-error-codes
15 =>
16 ExtendedErrorCode, u16;
17
18 /// The error in question falls into a category that does not
19 /// match known extended error codes. Implementations SHOULD
20 /// include an EXTRA-TEXT value to augment this error code with
21 /// additional information.
22 (Other => 0, b"Other Error")
23
24 /// The resolver attempted to perform DNSSEC validation, but a DNSKEY
25 /// RRset contained only unsupported DNSSEC algorithms.
26 (UnsupportedDnskeyAlgorithm => 1, b"Unsupported DNSKEY Algorithm")
27
28 /// The resolver attempted to perform DNSSEC validation, but a DS
29 /// RRset contained only unsupported Digest Types.
30 (UnsupportedDsDigestType => 2, b"Unsupported DS Digest Type")
31
32 /// The resolver was unable to resolve the answer within its time
33 /// limits and decided to answer with previously cached data
34 /// instead of answering with an error. This is typically caused
35 /// by problems communicating with an authoritative server,
36 /// possibly as result of a denial of service (DoS) attack against
37 /// another network. (See also Code 19.)
38 (StaleAnswer => 3, b"Stale Answer")
39
40 /// For policy reasons (legal obligation or malware filtering, for
41 /// instance), an answer was forged. Note that this should be
42 /// used when an answer is still provided, not when failure
43 /// codes are returned instead. See Blocked (15), Censored
44 /// (16), and Filtered (17) for use when returning other
45 /// response codes.
46 (ForgedAnswer => 4, b"Forged Answer")
47
48 /// The resolver attempted to perform DNSSEC validation, but
49 /// validation ended in the Indeterminate state [RFC 4035].
50 ///
51 /// [RFC 4035]: https://tools.ietf.org/html/rfc4035
52 (DnssecIndeterminate => 5, b"DNSSEC Indeterminate")
53
54 /// The resolver attempted to perform DNSSEC validation, but
55 /// validation ended in the Bogus state.
56 (DnssecBogus => 6, b"DNSSEC Bogus")
57
58 /// The resolver attempted to perform DNSSEC validation, but no
59 /// signatures are presently valid and some (often all) are
60 /// expired.
61 (SignatureExpired => 7, b"Signature Expired")
62
63 /// The resolver attempted to perform DNSSEC validation, but no
64 /// signatures are presently valid and at least some are not yet
65 /// valid.
66 (SignatureNotYetValid => 8, b"Signature Not Yet Valid")
67
68 /// A DS record existed at a parent, but no supported matching
69 /// DNSKEY record could be found for the child.
70 (DnskeyMissing => 9, b"DNSKEY Missing")
71
72 /// The resolver attempted to perform DNSSEC validation, but no
73 /// RRSIGs could be found for at least one RRset where RRSIGs were
74 /// expected.
75 (RrsigsMissing => 10, b"RRSIGs Missing")
76
77 /// The resolver attempted to perform DNSSEC validation, but no
78 /// Zone Key Bit was set in a DNSKEY.
79 (NoZoneKeyBitSet => 11, b"No Zone Key Bit Set")
80
81 /// The resolver attempted to perform DNSSEC validation, but the
82 /// requested data was missing and a covering NSEC or NSEC3 was
83 /// not provided.
84 (NsecMissing => 12, b"NSEC Missing")
85
86 /// The resolver is returning the SERVFAIL RCODE from its cache.
87 (CachedError => 13, b"Cached Error")
88
89 /// The server is unable to answer the query, as it was not fully
90 /// functional when the query was received.
91 (NotReady => 14, b"Not Ready")
92
93 /// The server is unable to respond to the request because the
94 /// domain is on a blocklist due to an internal security policy
95 /// imposed by the operator of the server resolving or forwarding
96 /// the query.
97 (Blocked => 15, b"Blocked")
98
99 /// The server is unable to respond to the request because the
100 /// domain is on a blocklist due to an external requirement
101 /// imposed by an entity other than the operator of the server
102 /// resolving or forwarding the query. Note that how the imposed
103 /// policy is applied is irrelevant (in-band DNS filtering, court
104 /// order, etc.).
105 (Censored => 16, b"Censored")
106
107 /// The server is unable to respond to the request because the
108 /// domain is on a blocklist as requested by the client.
109 /// Functionally, this amounts to "you requested that we filter
110 /// domains like this one."
111 (Filtered => 17, b"Filtered")
112
113 /// An authoritative server or recursive resolver that receives a
114 /// query from an "unauthorized" client can annotate its REFUSED
115 /// message with this code. Examples of "unauthorized" clients are
116 /// recursive queries from IP addresses outside the network,
117 /// blocklisted IP addresses, local policy, etc.
118 (Prohibited => 18, b"Prohibited")
119
120 /// The resolver was unable to resolve an answer within its
121 /// configured time limits and decided to answer with a previously
122 /// cached NXDOMAIN answer instead of answering with an error.
123 /// This may be caused, for example, by problems communicating
124 /// with an authoritative server, possibly as result of a denial
125 /// of service (DoS) attack against another network. (See also
126 /// Code 3.)
127 (StaleNxdomainAnswer => 19, b"Stale NXDomain Answer")
128
129 /// An authoritative server that receives a query with the
130 /// Recursion Desired (RD) bit clear, or when it is not configured
131 /// for recursion for a domain for which it is not authoritative,
132 /// SHOULD include this EDE code in the REFUSED response. A
133 /// resolver that receives a query with the RD bit clear SHOULD
134 /// include this EDE code in the REFUSED response.
135 (NotAuthoritative => 20, b"Not Authoritative")
136
137 /// The requested operation or query is not supported.
138 (NotSupported => 21, b"Not Supported")
139
140 /// The resolver could not reach any of the authoritative name
141 /// servers (or they potentially refused to reply).
142 (NoReachableAuthority => 22, b"No Reachable Authority")
143
144 /// An unrecoverable error occurred while communicating with
145 /// another server.
146 (NetworkError => 23, b"Network Error")
147
148 /// The authoritative server cannot answer with data for a zone it
149 /// is otherwise configured to support. Examples of this include
150 /// its most recent zone being too old or having expired.
151 (InvalidData => 24, b"Invalid Data")
152}
153
154/// Start of the private range for EDE codes.
155///
156/// ```text
157/// Registration Procedures:
158/// o 0 - 49151: First come, first served.
159/// o 49152 - 65535: Private use.
160/// ```
161pub const EDE_PRIVATE_RANGE_BEGIN: u16 = 49152;
162
163// Only implement `Display` for `ExtendedErrorCode`, as the `FromStr`
164// bundled by the `int_enum_*` macros is not very useful.
165impl core::fmt::Display for ExtendedErrorCode {
166 fn fmt(&self, f: &mut core::fmt::Formatter) -> core::fmt::Result {
167 use core::fmt::Write;
168 match self.to_mnemonic() {
169 Some(m) => {
170 for ch in m {
171 f.write_char(*ch as char)?
172 }
173 Ok(())
174 }
175 None => write!(f, "EDE{}", self.to_int()),
176 }
177 }
178}