dnsruby 1.73.1 → 2.0.0

data/test/spec_helper.rb

@@ -5,27 +5,22 @@ if Warning.respond_to?(:[]=)
 end
 
 if ENV['RUN_EXTRA_TASK'] == 'TRUE'
-  unless "test".frozen?
-    # Coverall setup term-ansi-color which isn't yet frozen string literal compatible
-    # Ref: https://github.com/flori/term-ansicolor/pull/38
-    require 'coveralls'
-    Coveralls.wear!
-  end
-
   require 'simplecov'
 
-  # # SimpleCov.formatter = SimpleCov::Formatter::MultiFormatter.new(
-  #     # [SimpleCov::Formatter::HTMLFormatter, Coveralls::SimpleCov::Formatter])
-  # SimpleCov.formatter = Coveralls::SimpleCov::Formatter
-  # SimpleCov.start do
-  #   add_filter 'test/'
-  # end
+  # Generate reports locally; CI uploads coverage after the tests complete.
+  SimpleCov.formatter = SimpleCov::Formatter::HTMLFormatter
+  SimpleCov.start do
+    add_filter '/test/'
+  end
 end
 
 require 'minitest'
 require 'minitest/autorun'
 require 'minitest/display'
 
+# CI prints the active test and fails with thread backtraces if it stalls.
+require_relative 'ci_watchdog' if ENV.key?('DNSRUBY_TEST_TIMEOUT')
+
 Minitest::Display.options = {
   suite_names: true,
   color: true,

data/test/tc_attempt_configuration.rb

@@ -0,0 +1,137 @@
+require_relative 'tc_pipeline_send'
+require 'minitest/mock'
+
+class AttemptConfigurationTest < Minitest::Test
+  def in_memory(code)
+    out, err, status = Open3.capture3(RbConfig.ruby, '-Ilib', '-e', TestPipelineSend::FIXTURE + code,
+      chdir: File.expand_path('..', __dir__))
+    assert(status.success?, "#{out}\n#{err}")
+  end
+
+  def test_attempt_configuration_survives_tcp_connect_reconfiguration
+    in_memory(<<~'RUBY')
+      [false, true].each do |pipeline|
+        resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', port: 5301,
+          use_tcp: true, tcp_pipelining: pipeline, tcp_pipelining_max_queries: :infinite,
+          tcp_idle_timeout: 10, dnssec: false)
+        writer = resolver.single_resolvers.first
+        connections, sockets = [], []
+        writer.define_singleton_method(:connect_tcp) do |server, port, source, source_port, *_|
+          connections << [server, port, source, source_port]
+          if connections.length == 1
+            resolver.port = 5302
+            resolver.src_address = '127.0.0.2'
+            resolver.src_port = 55001
+            resolver.ignore_truncation = true
+            resolver.no_tcp = true
+            resolver.tcp_idle_timeout = 20
+            resolver.tcp_pipelining_max_queries = 3
+          end
+          FrameSocket.new.tap do |socket|
+            socket.define_singleton_method(:connect) { |_| raise Errno::EISCONN }
+            sockets << socket
+          end
+        end
+        message = query
+        writer.send_async(message, Queue.new, :first)
+        first = SELECTOR.query_settings_for_id(:first)
+        raise 'connected endpoint changed' unless connections.first[0, 3] == ['127.0.0.1', 5301, '0.0.0.0']
+        raise 'registered peer changed' unless [first.dest_server, first.dest_port] == connections.first[0, 2]
+        raise 'response policy changed' if first.ignore_truncation || first.no_tcp
+        raise 'idle policy changed' unless first.tcp_idle_timeout == 10
+        raise 'cache route changed' unless first.cache_scope[0, 3] == ['127.0.0.1', 5301, '0.0.0.0']
+        raise 'mutable attempt configuration' unless first.transport_configuration.frozen? && first.transport_configuration[:src_port].frozen?
+        if pipeline
+          raise 'pipeline capacity changed' unless first.tcp_pipelining_max_queries == :infinite
+        end
+        writer.send_async(query('next.example.'), Queue.new, :next)
+        following = SELECTOR.query_settings_for_id(:next)
+        raise 'later send missed new settings' unless connections.last == ['127.0.0.1', 5302, '127.0.0.2', 55001]
+        raise 'later policy missed new settings' unless following.ignore_truncation && following.no_tcp && following.tcp_idle_timeout == 20
+        SELECTOR.remove_id(:first)
+        SELECTOR.remove_id(:next)
+        resolver.close
+        sockets.each { |socket| assert_clean(socket) }
+      end
+    RUBY
+  end
+
+  def test_attempt_configuration_survives_udp_bind_reconfiguration
+    in_memory(<<~'RUBY')
+      writer = Dnsruby::PacketSender.new(server: '127.0.0.1', port: 5301, src_port: 55000, dnssec: false)
+      socket = FrameSocket.new
+      connected = nil
+      socket.define_singleton_method(:getsockopt) { |*| Struct.new(:data).new([Socket::SOCK_DGRAM].pack('i')) }
+      socket.define_singleton_method(:bind) do |address, port|
+        raise 'wrong source' unless [address, port] == ['0.0.0.0', 55000]
+        writer.server = '127.0.0.2'
+        writer.port = 5302
+      end
+      socket.define_singleton_method(:connect) { |*endpoint| connected = endpoint }
+      UDPSocket.define_singleton_method(:new) { |*| socket }
+      writer.send_async(query, Queue.new, :udp)
+      pending = SELECTOR.query_settings_for_id(:udp)
+      raise 'UDP connected to new endpoint' unless connected == ['127.0.0.1', 5301]
+      raise 'UDP registration changed endpoint' unless [pending.dest_server, pending.dest_port] == connected
+      SELECTOR.remove_id(:udp)
+      writer.close
+      assert_clean(socket)
+    RUBY
+  end
+
+  def test_attempt_configuration_preserves_truncation_policy_until_response
+    in_memory(<<~'RUBY')
+      writer = Dnsruby::PacketSender.new(server: '127.0.0.1', no_tcp: true, dnssec: false)
+      socket = FrameSocket.new
+      socket.define_singleton_method(:bind) { |*| }
+      socket.define_singleton_method(:connect) { |*| }
+      socket.define_singleton_method(:getsockopt) { |*| Struct.new(:data).new([Socket::SOCK_DGRAM].pack('i')) }
+      UDPSocket.define_singleton_method(:new) { |*| socket }
+      message = query
+      queue = Queue.new
+      writer.send_async(message, queue, :policy)
+      pending = SELECTOR.query_settings_for_id(:policy)
+      writer.no_tcp = false
+      writer.define_singleton_method(:send_async) { |*| raise 'response used changed no_tcp policy' }
+      response = message.clone
+      response.header.qr = response.header.tc = true
+      Thread.current[:dnsruby_response_query] = pending
+      raise 'ordinary truncated response rejected' unless writer.check_response(response, response.encode, message, queue, :policy, false)
+      Thread.current[:dnsruby_response_query] = nil
+      SELECTOR.remove_id(:policy)
+      writer.close
+      assert_clean(socket)
+    RUBY
+  end
+
+  def test_attempt_configuration_explicit_ports_replace_default_random_pool
+    [Dnsruby::Resolver, Dnsruby::SingleResolver, Dnsruby::PacketSender].each do |klass|
+      resolver = klass.new(server: '127.0.0.1')
+      resolver.add_src_port(55000)
+      assert_equal(55000, resolver.src_port, klass)
+      resolver.add_src_port(55001..55002)
+      assert_equal([55000, 55001, 55002], resolver.src_port, klass)
+      [[0, 55003], [55003, 0]].each do |ports|
+        assert_raises(ArgumentError) { resolver.src_port = ports }
+        assert_equal([55000, 55001, 55002], resolver.src_port, klass)
+      end
+      assert_raises(ArgumentError) { resolver.add_src_port(0) }
+      assert_equal([55000, 55001, 55002], resolver.src_port, klass)
+      if resolver.respond_to?(:single_resolvers)
+        assert_equal(resolver.src_port, resolver.single_resolvers.first.src_port)
+      end
+      resolver.close
+    end
+  end
+
+  def test_attempt_configuration_disabled_cache_skips_response_classification
+    request = Dnsruby::Message.new('cache.example.')
+    request.do_caching = false
+    response = request.clone
+    response.header.qr = true
+    response.add_answer(Dnsruby::RR.create('cache.example. 60 IN A 192.0.2.1'))
+    Dnsruby::Cache.stub(:negative_soa, ->(*) { raise 'disabled cache examined records' }) do
+      assert_nil(Dnsruby::PacketSender.cache(request, response))
+    end
+  end
+end

data/test/tc_caa.rb

@@ -27,6 +27,7 @@ class TestCAA < Minitest::Test
      'foo.com. IN CAA 0 issuewild "ca.example.net"' => [0, 'issuewild', 'ca.example.net'],
      'foo.com. IN CAA 0 issuemail "ca.example.net"' => [0, 'issuemail', 'ca.example.net'],
      'foo.com. IN CAA 0 issuevmc "ca.example.net"' => [0, 'issuevmc', 'ca.example.net'],
+     'foo.com. IN CAA 0 Issue "ca.example.net"' => [0, 'Issue', 'ca.example.net'],
      'foo.com. IN CAA 0 iodef "mailto:security@example.com"' => [0, 'iodef', 'mailto:security@example.com'],
      'foo.com. IN CAA 0 issue "ca.example.net; account=230123"' => [0, 'issue', 'ca.example.net; account=230123']
     }.each do |text, data|
@@ -48,8 +49,7 @@ class TestCAA < Minitest::Test
 
   def test_caa_error
     {
-      'foo.com. IN CAA 0 ca.example.net "issue"' => [0, 'ca.example.net', 'issue'],
-      'foo.com. IN CAA 0 Issue "ca.example.net"' => [0, 'Issue', 'ca.example.net']
+      'foo.com. IN CAA 0 ca.example.net "issue"' => [0, 'ca.example.net', 'issue']
     }.each do |text, data|
       assert_raises DecodeError do
         RR.create(text)

data/test/tc_cache_keys.rb

@@ -0,0 +1,36 @@
+require_relative 'spec_helper'
+
+class TestCacheKeys < Minitest::Test
+  include Dnsruby
+
+  def test_numeric_query_spellings_find_the_decoded_response
+    cache = Cache.new
+    query = Message.new('cache.example.', 'TYPE0001', 'CLASS0001')
+    response = Message.decode(query.encode)
+    response.header.qr = true
+    response.add_answer(RR.create('cache.example. 300 IN A 192.0.2.1'))
+    cache.add(response)
+
+    ['A', 'TYPE1', 'TYPE0001', Types.new('TYPE01'), 1].each do |type|
+      ['IN', 'CLASS1', 'CLASS0001', Classes.new('CLASS01'), 1].each do |klass|
+        found = cache.find('CACHE.example', type, klass)
+        refute_nil(found, "#{type}/#{klass}")
+        assert(found.cached)
+        assert_equal('192.0.2.1', found.answer.first.address.to_s)
+      end
+    end
+    assert_nil(cache.find('cache.example.', 'AAAA', 'IN'))
+    assert_nil(cache.find('cache.example.', 'A', 'CH'))
+  end
+
+  def test_unknown_numeric_aliases_share_one_cache_entry
+    cache = Cache.new
+    [['TYPE65001', 'CLASS65000'], ['TYPE065001', 'CLASS065000']].each do |type, klass|
+      response = Message.new('cache.example.', type, klass)
+      response.add_answer(RR.create('cache.example. 300 CLASS65000 TYPE65001 \\# 1 01'))
+      cache.add(response)
+    end
+    assert_equal(1, cache.length)
+    assert_equal("\x01".b, cache.find('cache.example.', 'TYPE0065001', 'CLASS0065000').answer.first.data)
+  end
+end

data/test/tc_cancelled_send_capacity.rb

@@ -0,0 +1,158 @@
+require_relative 'tc_pipeline_send'
+
+class CancelledSendCapacityTest < Minitest::Test
+  def test_cancelled_udp_writes_release_all_workers_and_unregistered_sockets
+    isolated(<<~'RUBY')
+      sockets = []
+      UDPSocket.define_singleton_method(:new) do |*|
+        socket = FrameSocket.new
+        socket.define_singleton_method(:bind) { |*| }
+        socket.define_singleton_method(:connect) { |*| }
+        socket.define_singleton_method(:write_nonblock) { |*| raise IO::EAGAINWaitWritable }
+        sockets << socket
+        socket
+      end
+      tasks, queues = [], []
+      4.times do |id|
+        writer = Dnsruby::PacketSender.new(server: '127.0.0.1', dnssec: false, packet_timeout: 60)
+        q, queue = query, Queue.new
+        queues << queue
+        tasks << writer.send_dnsruby(q.encode, q, id, queue, false)
+      end
+      4.times { WAITING.pop }
+      4.times { |id| SELECTOR.remove_id(id) }
+      healthy = Queue.new
+      next_task = SELECTOR.defer_send { healthy << true }
+      Timeout.timeout(2) do
+        healthy.pop
+        (tasks + [next_task]).each(&:value)
+      end
+      drain_errors
+      raise 'cancelled UDP socket retained' unless sockets.all?(&:closed?)
+      raise 'cancelled attempt still registered' unless K.class_variable_get(:@@query_hash).empty?
+      raise 'cancelled UDP wrote bytes' unless sockets.all? { |socket| socket.written.empty? }
+      raise 'cancelled owner received another completion' unless queues.all?(&:empty?)
+    RUBY
+  end
+
+  def test_cancelled_unwritten_tcp_frames_release_workers_without_failing_peers
+    tcp_cancellation_scenario(false)
+  end
+
+  def test_cancelled_partial_tcp_frames_release_workers_and_retire_corrupt_streams
+    tcp_cancellation_scenario(true)
+  end
+
+  def test_writable_wait_slices_retain_the_original_tcp_and_udp_deadline
+    isolated(<<~'RUBY')
+      [:tcp, :udp].each do |transport|
+        writer = Dnsruby::PacketSender.new(server: '127.0.0.1', dnssec: false)
+        socket = FrameSocket.new
+        socket.define_singleton_method(:write_nonblock) { |*| raise IO::EAGAINWaitWritable }
+        token = K::SendToken.new
+        started = Dnsruby::TransportClock.now
+        begin
+          if transport == :tcp
+            writer.write_tcp_frame(socket, query.encode, started + 0.15, token)
+          else
+            writer.write_udp_packet(socket, query.encode, started + 0.15, token, true)
+          end
+          raise 'congested write did not time out'
+        rescue Dnsruby::ResolvTimeout
+          elapsed = Dnsruby::TransportClock.now - started
+          raise 'select slice expired the entire attempt early' if elapsed < 0.14
+          raise 'wait extended the packet deadline' if elapsed > 2
+        end
+      end
+    RUBY
+  end
+
+  private
+
+  def tcp_cancellation_scenario(partial)
+    isolated("partial = #{partial}\n" + <<~'RUBY')
+      sockets, tasks, peers, queues = [], [], [], []
+      4.times do |id|
+        socket = FrameSocket.new
+        writer = sender(socket)
+        writer.packet_timeout = 60
+        peer = settings(socket, [:peer, id], query("peer-#{id}.example."), writer)
+        SELECTOR.add_to_select(peer)
+        calls = 0
+        native_write = socket.method(:write_nonblock)
+        socket.define_singleton_method(:write_nonblock) do |bytes|
+          calls += 1
+          if partial && calls == 1
+            native_write.call(bytes.byteslice(0, 2))
+          else
+            raise IO::EAGAINWaitWritable
+          end
+        end
+        q, queue = query("cancelled-#{id}.example."), Queue.new
+        sockets << socket
+        peers << peer
+        queues << queue
+        tasks << writer.send_dnsruby(q.encode, q, id, queue, true)
+      end
+      4.times { WAITING.pop }
+      4.times { |id| SELECTOR.remove_id(id) }
+      healthy = Queue.new
+      next_task = SELECTOR.defer_send { healthy << true }
+      Timeout.timeout(2) do
+        healthy.pop
+        (tasks + [next_task]).each(&:value)
+      end
+      drain_errors
+      raise 'cancelled owner received another completion' unless queues.all?(&:empty?)
+      sockets.zip(peers).each do |socket, peer|
+        raise 'canceled frame continued writing' unless socket.written.bytesize == (partial ? 2 : 0)
+        if partial
+          raise 'corrupt pipeline remained open' unless socket.closed?
+          raise 'corrupt stream peer not failed exactly once' unless peer.client_queue.length == 1 &&
+            peer.client_queue.pop(true).last.is_a?(Dnsruby::SocketEofResolvError)
+        else
+          raise 'unwritten cancellation closed peer socket' if socket.closed?
+          raise 'unwritten cancellation lost peer' unless SELECTOR.query_settings_for_id(peer.client_query_id).equal?(peer)
+          raise 'unwritten cancellation failed peer' unless peer.client_queue.empty?
+          response = peer.query.clone
+          response.header.qr = true
+          SELECTOR.process_message(response, response.encode, socket)
+          SELECTOR.send_queued_validation_responses
+          events = 2.times.map { peer.client_queue.pop(true) }
+          raise 'peer did not complete once' unless peer.client_queue.empty? && events.all? { |event| event.last.nil? }
+          raise 'retiring pipeline retained after peer finished' unless socket.closed?
+        end
+        assert_clean(socket)
+      end
+      raise 'cancelled TCP attempt retained' unless K.class_variable_get(:@@query_hash).empty?
+    RUBY
+  end
+
+  WAIT_FIXTURE = <<~'RUBY'
+    WAITING = Queue.new
+    waiters, waiter_mutex = {}, Mutex.new
+    IO.define_singleton_method(:select) do |readers, writers, _, timeout|
+      raise 'unexpected writable wait' unless readers.nil? && writers.length == 1
+      waiter_mutex.synchronize do
+        unless waiters[Thread.current]
+          waiters[Thread.current] = true
+          WAITING << Thread.current
+        end
+      end
+      # Model a socket that stays congested: honor the supplied timeout rather
+      # than artificially waking a canceled writer, which masked the leak.
+      sleep(timeout)
+      nil
+    end
+    K.class_variable_set(:@@select_thread, Thread.current)
+  RUBY
+
+  def isolated(body)
+    options = ''.frozen? ? ['--enable-frozen-string-literal'] : []
+    source = "#{TestPipelineSend::FIXTURE}\n#{WAIT_FIXTURE}\nTimeout.timeout(10) do\n#{body}\nend"
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, *options, '-I',
+      File.expand_path('../lib', __dir__), '-e', source)
+    assert(status.success?, "#{stdout}\n#{stderr}")
+    assert_empty(stderr)
+  end
+end

data/test/tc_dnssec_alias_validation.rb

@@ -0,0 +1,289 @@
+require_relative 'tc_key_cache_identity'
+
+class DnssecAliasValidationTest < Minitest::Test
+  def setup
+    @now = Time.now.to_i
+    @private_keys = KeyCacheIdentityTest::PRIVATE_KEYS.map { |pem| OpenSSL::PKey::EC.new(pem) }
+    @keys = %w[. left. right.].each_with_index.to_h do |zone, index|
+      private_key = @private_keys[index % @private_keys.length]
+      bytes = private_key.public_key.to_octet_string(:uncompressed).byteslice(1, 64)
+      [zone, [Dnsruby::RR.create("#{zone} 300 IN DNSKEY 257 3 13 #{Base64.strict_encode64(bytes)}"), private_key]]
+    end
+    @verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    @verifier.add_trust_anchor(@keys.fetch('.').first)
+  end
+
+  def test_cold_cross_zone_cname_discovers_target_signer_with_the_same_budget
+    message = cross_zone_message
+    budget = Dnsruby::ValidationBudget.new
+    with_chain_resolver do |queries, budgets|
+      Dnsruby::ValidationBudget.with(budget) do
+        assert(@verifier.validate(message, Dnsruby::Message.new('alias.left.', 'A')))
+      end
+      assert_equal(Dnsruby::Message::SecurityLevel.SECURE, message.security_level)
+      assert_equal(1, queries.count(['right.', 'DS']))
+      assert_equal(1, queries.count(['right.', 'DNSKEY']))
+      refute_includes(queries, ['target.right.', 'DS'])
+      assert(budgets.all? { |used| used.equal?(budget) })
+    end
+  end
+
+  def test_cross_zone_negative_answer_discovers_authority_signer
+    message = message_with('alias.left.', 'A', [signed('alias.left. 300 IN CNAME target.right.', 'left.')])
+    signed('right. 300 IN SOA ns.right. hostmaster.right. 1 3600 600 86400 300', 'right.').
+      each { |rr| message.add_authority(rr) }
+    signed('target.right. 300 IN NSEC z.right. TXT NSEC RRSIG', 'right.').
+      each { |rr| message.add_authority(rr) }
+    with_chain_resolver do |queries, _budgets|
+      assert(@verifier.validate(message, Dnsruby::Message.new('alias.left.', 'A')))
+      assert_equal(Dnsruby::Message::SecurityLevel.SECURE, message.security_level)
+      assert_equal(1, queries.count(['right.', 'DNSKEY']))
+    end
+  end
+
+  def test_cached_target_key_avoids_repeating_signer_discovery
+    @verifier.add_trust_anchor(@keys.fetch('right.').first)
+    message = cross_zone_message
+    with_chain_resolver do |queries, _budgets|
+      assert(@verifier.validate(message, nil))
+      assert_equal(Dnsruby::Message::SecurityLevel.SECURE, message.security_level)
+      assert_empty(queries.select { |name, _type| name == 'right.' })
+    end
+  end
+
+  def test_overlapping_rollover_refreshes_a_cached_key_with_the_same_tag
+    new_key = @keys.fetch('right.').first
+    old_private = @private_keys.fetch(1)
+    old_bytes = old_private.public_key.to_octet_string(:uncompressed).byteslice(1, 64)
+    old_key = Dnsruby::RR.create("right. 300 IN DNSKEY 257 3 13 #{Base64.strict_encode64(old_bytes)}")
+    refute_equal(old_key.key, new_key.key)
+    assert_equal(old_key.key_tag, new_key.key_tag)
+    @verifier.add_trust_anchor(old_key)
+
+    rollover = Dnsruby::RRSet.new([old_key, new_key])
+    signature = Dnsruby::RR.create(name: 'right.', type: 'RRSIG', ttl: 300,
+      type_covered: Dnsruby::Types.DNSKEY, algorithm: 13, labels: 1,
+      original_ttl: 300, expiration: @now + 3600, inception: @now - 60,
+      key_tag: old_key.key_tag, signers_name: 'right.')
+    bytes = @verifier.send(:canonical_rrset_data, rollover, signature, {})
+    der = old_private.dsa_sign_asn1(OpenSSL::Digest::SHA256.digest(signature.sig_data + bytes))
+    signature.signature = OpenSSL::ASN1.decode(der).value.map { |n| n.value.to_s(2).rjust(32, "\0") }.join
+    rollover.add(signature)
+    # Authenticate the ordinary two-key rollover independently, without
+    # teaching its new key to the verifier whose discovery is under test.
+    check = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    assert(check.verify(rollover, old_key))
+
+    responses = {['right.', 'DNSKEY'] => message_with('right.', 'DNSKEY', [rollover])}
+    message = cross_zone_message
+    with_chain_resolver(responses: responses) do |queries, _budgets|
+      assert(@verifier.validate(message, nil))
+      assert_equal(Dnsruby::Message::SecurityLevel.SECURE, message.security_level)
+      assert_equal(1, queries.count(['right.', 'DNSKEY']))
+    end
+  end
+
+  def test_signer_discovery_does_not_reset_the_shared_work_limit
+    budget = Dnsruby::ValidationBudget.new
+    before_response = lambda do |name, type|
+      if name.to_s(true) == 'right.' && type == Dnsruby::Types.DS
+        assert_same(budget, Dnsruby::ValidationBudget.current)
+        budget.check!(Dnsruby::Dnssec.validation_limits[:max_work] + 1)
+      end
+    end
+    with_chain_resolver(before_response) do |_queries, _budgets|
+      assert_raises(Dnsruby::ValidationLimitError) do
+        Dnsruby::ValidationBudget.with(budget) { @verifier.validate(cross_zone_message, nil) }
+      end
+    end
+    assert_nil(Dnsruby::ValidationBudget.current)
+  end
+
+  def test_additional_data_does_not_trigger_signer_discovery
+    message = cross_zone_message
+    signed('extra.right. 300 IN A 192.0.2.2', 'right.').each { |rr| message.add_additional(rr) }
+    requested = []
+    @verifier.stub(:find_closest_anchor_for, ->(name) { requested << name.to_s(true); false }) do
+      @verifier.send(:discover_signer_keys, message_with('left.', 'A', [], message.additional))
+    end
+    assert_empty(requested)
+  end
+
+  def test_optional_foreign_signed_data_is_removed_without_rejecting_the_answer
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    answer = signed('left. 300 IN MX 10 mail.right.', 'left.')
+    extra = signed('mail.right. 300 IN A 192.0.2.2', 'right.')
+    message = message_with('left.', 'MX', [answer], extra.rrs + extra.sigs)
+    assert(@verifier.verify(message))
+    assert_empty(message.additional)
+    assert_equal(0, message.header.arcount)
+    assert(message.answer.all? { |rr| rr.instance_variable_get(:@dnsruby_authenticated_expiration) })
+    refute(@verifier.get_keys_to_check.any? { |key| key.name == @keys.fetch('right.').first.name })
+  end
+
+  def test_optional_foreign_dnskey_and_ds_learning_is_opportunistic
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    answer = signed('left. 300 IN MX 10 mail.right.', 'left.')
+    key = @keys.fetch('right.').first
+    [signed(key, 'right.'), signed(Dnsruby::RR::DS.from_key(key, 2), 'right.')].each do |extra|
+      message = message_with('left.', 'MX', [answer], extra.rrs + extra.sigs)
+      assert(@verifier.verify(message))
+      assert_empty(message.additional)
+      refute(@verifier.get_keys_to_check.any? { |known| known.name == key.name })
+    end
+  end
+
+  def test_verified_optional_data_is_retained_and_unsigned_glue_stays_unauthenticated
+    %w[left. right.].each { |zone| @verifier.add_trust_anchor(@keys.fetch(zone).first) }
+    extra = signed('mail.right. 300 IN A 192.0.2.2', 'right.')
+    glue = Dnsruby::RR.create('ns.right. 300 IN A 192.0.2.3')
+    message = message_with('left.', 'MX', [signed('left. 300 IN MX 10 mail.right.', 'left.')],
+      extra.rrs + extra.sigs + [glue])
+    assert(@verifier.verify(message))
+    assert_equal(3, message.additional.length)
+    message.additional.each do |record|
+      if record.name == glue.name
+        assert_nil(record.instance_variable_get(:@dnsruby_authenticated_expiration))
+      else
+        refute_nil(record.instance_variable_get(:@dnsruby_authenticated_expiration))
+      end
+    end
+  end
+
+  def test_unsigned_additional_copy_does_not_inherit_answer_authentication
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    answer = signed('mail.left. 300 IN A 192.0.2.2', 'left.')
+    extra = answer.rrs.first.clone
+    message = message_with('mail.left.', 'A', [answer], [extra])
+    assert(@verifier.verify(message))
+    refute_nil(message.answer.first.instance_variable_get(:@dnsruby_authenticated_expiration))
+    assert_nil(message.additional.first.instance_variable_get(:@dnsruby_authenticated_expiration))
+  end
+
+  def test_optional_verification_preserves_the_shared_signature_limit
+    %w[left. right.].each { |zone| @verifier.add_trust_anchor(@keys.fetch(zone).first) }
+    extra = signed('mail.right. 300 IN A 192.0.2.2', 'right.')
+    message = message_with('left.', 'MX', [signed('left. 300 IN MX 10 mail.right.', 'left.')], extra.rrs + extra.sigs)
+    limits = Dnsruby::Dnssec.validation_limits.merge(max_signature_verifications: 1)
+    Dnsruby::Dnssec.stub(:validation_limits, limits) do
+      assert_raises(Dnsruby::ValidationLimitError) { @verifier.verify(message) }
+    end
+    assert_nil(Dnsruby::ValidationBudget.current)
+  end
+
+  def test_dname_authenticates_synthesized_cname_in_either_record_order
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    [false, true].each do |cname_first|
+      message = dname_message(cname_first: cname_first)
+      assert(@verifier.verify(message))
+      assert_equal('www.new.left', message.answer.find { |rr| rr.type == Dnsruby::Types.CNAME }.domainname.to_s)
+    end
+  end
+
+  def test_dname_redirects_without_a_server_synthesized_cname
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    message = dname_message
+    message.answer.delete_if { |rr| rr.type == Dnsruby::Types.CNAME }
+    assert(@verifier.verify(message))
+  end
+
+  def test_synthesized_cname_inherits_dname_expiration_and_preserves_zero_ttl
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    Time.stub(:now, Time.at(@now)) do
+      [:expiration, :signature_ttl].each do |bound|
+        [0, 300].each do |ttl|
+          message = dname_message(cname_ttl: ttl, dname_lifetime: bound == :expiration ? 7 : 3600)
+          if bound == :signature_ttl
+            message.answer.find { |rr| rr.type == Dnsruby::Types.RRSIG && rr.type_covered == Dnsruby::Types.DNAME }.ttl = 7
+          end
+          assert(@verifier.verify(message))
+          cname = message.answer.find { |rr| rr.type == Dnsruby::Types.CNAME }
+          assert_equal([ttl, 7].min, cname.ttl)
+          assert_equal(@now + [ttl, 7].min, cname.instance_variable_get(:@dnsruby_authenticated_expiration))
+        end
+      end
+    end
+  end
+
+  def test_synthesized_cname_uses_labels_and_case_insensitive_names
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    message = message_with('www\\.part.old.left.', 'A', [
+      signed('old.left. 300 IN DNAME new.left.', 'left.'),
+      Dnsruby::RRSet.new([Dnsruby::RR.create('www\\.part.OLD.LEFT. 300 IN CNAME www\\.part.NEW.LEFT.')]),
+      signed('www\\.part.new.left. 300 IN A 192.0.2.1', 'left.')])
+    assert(@verifier.verify(message))
+  end
+
+  def test_an_ordinary_unsigned_cname_still_requires_authentication
+    @verifier.add_trust_anchor(@keys.fetch('left.').first)
+    message = message_with('alias.left.', 'A', [
+      Dnsruby::RRSet.new([Dnsruby::RR.create('alias.left. 300 IN CNAME target.left.')]),
+      signed('target.left. 300 IN A 192.0.2.1', 'left.')])
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  private
+
+  def signed(record, zone, lifetime: 3600)
+    record = Dnsruby::RR.create(record) if record.is_a?(String)
+    key, private_key = @keys.fetch(zone)
+    signature = Dnsruby::RR.create(name: record.name, type: 'RRSIG', ttl: record.ttl,
+      type_covered: record.type, algorithm: 13, labels: record.name.labels.length,
+      original_ttl: record.ttl, expiration: @now + lifetime, inception: @now - 60,
+      key_tag: key.key_tag, signers_name: key.name)
+    bytes = Dnsruby::MessageEncoder.new { |encoder| encoder.put_rr(record, true) }.to_s
+    der = private_key.dsa_sign_asn1(OpenSSL::Digest::SHA256.digest(signature.sig_data + bytes))
+    signature.signature = OpenSSL::ASN1.decode(der).value.map { |n| n.value.to_s(2).rjust(32, "\0") }.join
+    Dnsruby::RRSet.new([record, signature])
+  end
+
+  def message_with(name, type, answer, additional = [])
+    Dnsruby::Message.new(name, type).tap do |message|
+      answer.each { |set| set.each { |rr| message.add_answer(rr) } }
+      additional.each { |rr| message.add_additional(rr) }
+    end
+  end
+
+  def cross_zone_message
+    message_with('alias.left.', 'A', [signed('alias.left. 300 IN CNAME target.right.', 'left.'),
+      signed('target.right. 300 IN A 192.0.2.1', 'right.')])
+  end
+
+  def dname_message(cname_first: false, cname_ttl: 300, dname_lifetime: 3600)
+    dname = signed('old.left. 300 IN DNAME new.left.', 'left.', lifetime: dname_lifetime)
+    cname = Dnsruby::RRSet.new([Dnsruby::RR.create("www.old.left. #{cname_ttl} IN CNAME www.new.left.")])
+    answer = cname_first ? [cname, dname] : [dname, cname]
+    answer << signed('www.new.left. 300 IN A 192.0.2.1', 'left.')
+    message_with('www.old.left.', 'A', answer)
+  end
+
+  def with_chain_resolver(before_response = nil, responses: {})
+    lookup = {}
+    @keys.each do |zone, (key, _)|
+      lookup[[zone, 'DNSKEY']] = message_with(zone, 'DNSKEY', [signed(key, zone)])
+    end
+    %w[left. right.].each do |zone|
+      ds = Dnsruby::RR::DS.from_key(@keys.fetch(zone).first, 2)
+      lookup[[zone, 'DS']] = message_with(zone, 'DS', [signed(ds, '.')])
+    end
+    lookup[['alias.left.', 'DS']] = message_with('alias.left.', 'DS', [
+      signed('alias.left. 300 IN CNAME target.right.', 'left.')])
+    lookup.merge!(responses)
+    queries, budgets = [], []
+    resolver = Object.new
+    resolver.define_singleton_method(:query_no_validation_or_recursion) do |name, type|
+      before_response&.call(name, type)
+      identity = [name.to_s(true), type.to_s]
+      queries << identity
+      budgets << Dnsruby::ValidationBudget.current
+      lookup.fetch(identity)
+    end
+    Dnsruby::Dnssec.stub(:do_validation_with_recursor?, false) do
+      Dnsruby::Dnssec.stub(:default_resolver, resolver) do
+        @verifier.stub(:get_nameservers_for, resolver) do
+          @verifier.stub(:get_nameservers_from_message, resolver) { yield queries, budgets }
+        end
+      end
+    end
+  end
+end