dnsruby 1.73.1 → 2.0.0

data/test/tc_dnssec_recursor_review_fixes.rb

@@ -0,0 +1,351 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+require 'openssl'
+require 'base64'
+
+# Ordinary records and local doubles keep these contracts independent of DNS.
+class DnssecRecursorReviewFixesTest < Minitest::Test
+  def test_child_budgets_share_work_and_transaction_but_cancel_independently
+    root = Dnsruby::ValidationBudget.new(limits: limits(max_work: 2))
+    first, second = root.child, root.child
+    assert_same(root.transaction, first.transaction)
+    assert_same(root.transaction, second.transaction)
+    first.check!(1)
+    first.cancel
+    assert_raises(Dnsruby::ValidationCancelled) { first.check! }
+    assert(root.check!)
+    second.check!(1)
+    assert_raises(Dnsruby::ValidationLimitError) { second.check!(1) }
+    assert_raises(Dnsruby::ValidationLimitError) { root.check! }
+  end
+
+  def test_parallel_children_share_signature_allowance
+    root = Dnsruby::ValidationBudget.new(limits: limits(max_signature_verifications: 2))
+    threads = 2.times.map { Thread.new { root.child.signature! } }
+    assert(threads.all? { |thread| thread.join(2) })
+    threads.each(&:value)
+    assert_raises(Dnsruby::ValidationLimitError) { root.signature! }
+  ensure
+    threads&.each { |thread| thread.kill if thread.alive?; thread.join }
+  end
+
+  def test_parent_cancellation_reaches_children
+    root = Dnsruby::ValidationBudget.new
+    child = root.child
+    root.cancel
+    assert_raises(Dnsruby::ValidationCancelled) { child.check! }
+  end
+
+  def test_validator_hops_use_shared_budget_without_cancelling_the_lookup
+    root = Dnsruby::ValidationBudget.new(limits: limits(max_signature_verifications: 2))
+    transmissions = Dnsruby::SelectThread::TransmissionBudget.new
+    transmissions.context(:validation) { root }
+    controls = []
+    selector = Object.new
+    selector.define_singleton_method(:register_validation) { |_, _, control| controls << control; true }
+    selector.define_singleton_method(:unregister_validation) { |_, _, control| control.cancel }
+    selector.define_singleton_method(:push_validation_response_to_select) { |*_| }
+    query = Dnsruby::Message.new('www.example.')
+    query.do_validation = true
+    resolver = Struct.new(:dnssec).new(true)
+    validation = lambda do |_, response|
+      budget = Dnsruby::ValidationBudget.current
+      assert_same(root.transaction, budget.transaction)
+      refute_same(root.control, budget.control)
+      budget.signature!
+      response.security_level = Dnsruby::Message::SecurityLevel.SECURE
+      true
+    end
+    Dnsruby::Dnssec.stub(:validate_with_query, validation) do
+      Dnsruby::PacketSender.stub(:cache, nil) do
+        2.times do
+          response = answer('www.example.', 'www.example. 60 IN A 192.0.2.1')
+          Dnsruby::ValidatorThread.new(:client, Queue.new, response, nil, query,
+            selector, resolver, transmissions).do_validate
+          assert_equal(Dnsruby::Message::SecurityLevel.SECURE, response.security_level)
+          assert(root.check!)
+        end
+      end
+    end
+    refute_same(*controls)
+    assert_raises(Dnsruby::ValidationLimitError) { root.signature! }
+  end
+
+  def test_alias_query_keeps_original_question_and_one_budget_through_final_validation
+    packets = {
+      'www.example.' => answer('www.example.', 'www.example. 60 IN CNAME target.other.'),
+      'target.other.' => answer('target.other.', 'target.other. 60 IN A 192.0.2.1')
+    }
+    with_recursor(packets) do |recursor, calls, budgets|
+      validation = lambda do |response|
+        assert_same(budgets.first, Dnsruby::ValidationBudget.current)
+        assert_equal('www.example.', response.question.first.qname.to_s(true))
+        true
+      end
+      Dnsruby::Dnssec.stub(:validate, validation) do
+        response = recursor.query('www.example')
+        assert_equal(%w[www.example. target.other.], calls)
+        assert_equal([Dnsruby::Types.CNAME, Dnsruby::Types.A], response.answer.map(&:type))
+        assert_equal(1, budgets.map(&:object_id).uniq.length)
+        refute(response.header.aa)
+      end
+    end
+    assert_nil(Dnsruby::ValidationBudget.current)
+    assert_nil(Dnsruby::QueryControl.current)
+  end
+
+  def test_complete_alias_answer_uses_one_hop
+    response = answer('www.example.', 'www.example. 60 IN CNAME target.example.',
+      'target.example. 60 IN A 192.0.2.1')
+    with_recursor('www.example.' => response) do |recursor, calls|
+      assert_same(response, recursor.query('www.example.', 'A', 'IN', true))
+      assert_equal(['www.example.'], calls)
+    end
+  end
+
+  def test_combining_alias_answers_preserves_the_earliest_authenticated_lifetime
+    first = answer('www.example.', 'www.example. 60 IN CNAME target.other.')
+    last = answer('target.other.', 'target.other. 60 IN A 192.0.2.1')
+    first.instance_variable_set(:@dnsruby_authenticated_expiration, 100)
+    last.instance_variable_set(:@dnsruby_authenticated_expiration, 200)
+    with_recursor('www.example.' => first, 'target.other.' => last) do |recursor|
+      response = recursor.query('www.example.', 'A', 'IN', true)
+      assert_equal(100, response.instance_variable_get(:@dnsruby_authenticated_expiration))
+    end
+  end
+
+  def test_independent_queries_get_independent_validation_budgets
+    with_recursor('www.example.' => answer('www.example.', 'www.example. 60 IN A 192.0.2.1')) do |recursor, _, budgets|
+      Dnsruby::Dnssec.stub(:validate, true) do
+        2.times { assert(recursor.query('www.example.')) }
+      end
+      refute_same(*budgets)
+      refute_same(budgets.first.transaction, budgets.last.transaction)
+    end
+  end
+
+  def test_dname_chase_preserves_synthesized_cname_and_original_question
+    packets = {
+      'host.branch.example.' => answer('host.branch.example.', 'branch.example. 60 IN DNAME other.'),
+      'host.other.' => answer('host.other.', 'host.other. 60 IN A 192.0.2.2')
+    }
+    with_recursor(packets) do |recursor, calls|
+      response = recursor.query('host.branch.example.', 'A', 'IN', true)
+      assert_equal(%w[host.branch.example. host.other.], calls)
+      assert_equal('host.branch.example.', response.question.first.qname.to_s(true))
+      cname = response.answer.find { |rr| rr.type == Dnsruby::Types.CNAME }
+      assert_equal('host.other.', cname.domainname.to_s(true))
+      assert_equal(60, cname.ttl)
+    end
+  end
+
+  def test_explicit_alias_queries_do_not_chase
+    ['CNAME', 'DNAME'].each do |type|
+      packet = answer('alias.example.', "alias.example. 60 IN #{type} target.other.")
+      with_recursor('alias.example.' => packet) do |recursor, calls|
+        assert_same(packet, recursor.query('alias.example.', type, 'IN', true))
+        assert_equal(['alias.example.'], calls)
+      end
+    end
+  end
+
+  def test_nonvalidating_lookup_does_not_create_a_dnssec_budget
+    with_recursor('www.example.' => answer('www.example.', 'www.example. 60 IN A 192.0.2.1')) do |recursor, _, budgets|
+      Dnsruby::ValidationBudget.stub(:new, ->(*) { flunk('Nonvalidating recursion created a DNSSEC budget') }) do
+        assert(recursor.query('www.example.', 'A', 'IN', true))
+      end
+      assert_equal([nil], budgets)
+    end
+  end
+
+  def test_alias_steps_use_the_recursion_budget
+    packets = {
+      'www.example.' => answer('www.example.', 'www.example. 60 IN CNAME target.other.'),
+      'target.other.' => answer('target.other.', 'target.other. 60 IN CNAME final.other.')
+    }
+    with_recursor(packets) do |recursor, calls|
+      recursor.recursion_limits = { max_steps: 1 }
+      assert_raises(Dnsruby::RecursionLimitError) { recursor.query('www.example.', 'A', 'IN', true) }
+      assert_equal(%w[www.example. target.other.], calls)
+    end
+  end
+
+  def test_zero_ttl_addresses_are_local_and_snapshots_are_independent
+    cache = Dnsruby::Recursor::AddressCache.new
+    cache.push(['192.0.2.1', 0])
+    cache.push(['192.0.2.2', 60])
+    assert_equal(%w[192.0.2.2 192.0.2.1], cache.current_values)
+    assert_equal(['192.0.2.2'], cache.values)
+    snapshot = cache.snapshot
+    assert_equal(['192.0.2.2'], snapshot.current_values)
+    cache.push(['192.0.2.3', 60])
+    assert_equal(['192.0.2.2'], snapshot.values)
+  end
+
+  def test_zero_ttl_referral_glue_is_used_without_entering_shared_caches
+    with_private_caches do
+      recursor = bare_recursor
+      referral = Dnsruby::Message.new('www.child.example.')
+      referral.add_authority(Dnsruby::RR.create('child.example. 60 IN NS ns.child.example.'))
+      referral.add_additional(Dnsruby::RR.create('ns.child.example. 0 IN A 192.0.2.1'))
+      zone, authorities, ttl = recursor.referral_authorities(referral, 'example.', 'www.child.example.', 'IN')
+      Dnsruby::Recursor.send(:cache_zone, zone, authorities, ttl)
+      result = answer('www.child.example.', 'www.child.example. 60 IN A 192.0.2.2')
+      sends = []
+      factory = lambda do |settings|
+        sends << settings[:nameserver]
+        fake_resolver { |_| result }
+      end
+      Dnsruby::Resolver.stub(:new, factory) do
+        assert_same(result, recursor.send(:_dorecursion, 'www.child.example.', 'A', 'IN', zone, authorities, 0, true))
+      end
+      assert_equal([['192.0.2.1']], sends)
+      assert_empty(Dnsruby::Recursor.class_variable_get(:@@authority_cache).fetch('ns.child.example.').current_values)
+      shared = Dnsruby::Recursor.class_variable_get(:@@zones_cache).fetch(zone)
+      assert_empty(shared.fetch('ns.child.example.').current_values)
+    end
+  end
+
+  def test_zero_ttl_discovered_nameserver_address_is_used_once
+    with_private_caches do
+      hints = Dnsruby::Recursor::AddressCache.new
+      hints.push(['192.0.2.53', 60])
+      Dnsruby::Recursor.class_variable_set(:@@hints, { 'root.example.' => hints })
+      recursor = bare_recursor
+      sent = []
+      factory = lambda do |settings|
+        fake_resolver do |query|
+          name = query.question.first.qname.to_s(true)
+          sent << [name, settings[:nameserver]]
+          name == 'ns.other.' ? answer(name, 'ns.other. 0 IN A 192.0.2.1') :
+            answer(name, 'www.child.example. 60 IN A 192.0.2.2')
+        end
+      end
+      authorities = { 'ns.other.' => Dnsruby::Recursor::AddressCache.new }
+      Dnsruby::Resolver.stub(:new, factory) do
+        assert(recursor.send(:_dorecursion, 'www.child.example.', 'A', 'IN', 'child.example.', authorities, 0, true))
+      end
+      assert_equal([['ns.other.', ['192.0.2.53']], ['www.child.example.', ['192.0.2.1']]], sent)
+      assert_empty(Dnsruby::Recursor.class_variable_get(:@@authority_cache).fetch('ns.other.').current_values)
+    end
+  end
+
+  def test_signature_serial_time_across_the_epoch_boundary_and_cache_expiry
+    epoch = 1 << 32
+    now = epoch + 20
+    private_key = OpenSSL::PKey::EC.generate('prime256v1')
+    public_key = private_key.public_key.to_octet_string(:uncompressed).byteslice(1, 64)
+    key = Dnsruby::RR.create("example. 300 IN DNSKEY 257 3 13 #{Base64.strict_encode64(public_key)}")
+    signature = Dnsruby::RR.create(name: key.name, type: 'RRSIG', ttl: 300,
+      type_covered: 'DNSKEY', algorithm: 13, labels: 1, original_ttl: 300,
+      inception: epoch - 60, expiration: 80, key_tag: key.key_tag, signers_name: key.name)
+    wire = Dnsruby::MessageEncoder.new { |encoder| encoder.put_rr(key, true) }.to_s
+    der = private_key.dsa_sign_asn1(OpenSSL::Digest::SHA256.digest(signature.sig_data + wire))
+    signature.signature = OpenSSL::ASN1.decode(der).value.map { |n| n.value.to_s(2).rjust(32, "\0") }.join
+    records = Dnsruby::RRSet.new([key, signature])
+    verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    cache = Dnsruby::KeyCache.new
+    Time.stub(:now, Time.at(now)) do
+      assert(verifier.verify_rrset(records, key))
+      assert_equal(60, records.ttl)
+      cache.add_rrset(records)
+      assert_equal(epoch + 80, cache.keys_and_expirations.first.first)
+    end
+    Time.stub(:now, Time.at(epoch + 79)) do
+      assert_equal([Dnsruby::KeyCache.key_identity(key)], cache.keys.map { |item| Dnsruby::KeyCache.key_identity(item) })
+    end
+    Time.stub(:now, Time.at(epoch + 80)) { assert_empty(cache.keys) }
+    refute(Dnsruby::SerialTime.valid?(epoch - 60, 80, epoch + 81))
+    refute(Dnsruby::SerialTime.valid?(epoch - 60, 80, epoch - 61))
+    assert_nil(Dnsruby::SerialTime.absolute(now + (1 << 31), now))
+  end
+
+  def test_provisional_insecure_and_missing_cached_keys_reach_full_policy
+    [:insecure, Dnsruby::VerifyError.new('Signing key not found')].each do |cached|
+      with_full_validation(cached) do |query, response, calls|
+        assert(Dnsruby::Dnssec.validate_with_query(query, response))
+        assert_equal([:full], calls)
+        assert_equal(Dnsruby::Message::SecurityLevel.SECURE, response.security_level)
+      end
+    end
+  end
+
+  def test_full_policy_bogus_is_preserved_after_provisional_insecure
+    with_full_validation(:insecure, bogus: true) do |query, response, calls|
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.validate_with_query(query, response) }
+      assert_equal([:full], calls)
+      assert_equal(Dnsruby::Message::SecurityLevel.BOGUS, response.security_level)
+    end
+  end
+
+  private
+
+  def limits(**changes)
+    Dnsruby::ValidationBudget::DEFAULT_LIMITS.merge(changes)
+  end
+
+  def answer(name, *records)
+    Dnsruby::Message.new(name).tap do |packet|
+      packet.header.qr = packet.header.aa = true
+      records.each { |record| packet.add_answer(Dnsruby::RR.create(record)) }
+    end
+  end
+
+  def bare_recursor
+    Dnsruby::Recursor.allocate.tap do |recursor|
+      recursor.instance_variable_set(:@resolver, Struct.new(:query_timeout, :recurse).new(10, false))
+      recursor.instance_variable_set(:@ipv6_ok, false)
+      recursor.instance_variable_set(:@dnssec, false)
+    end
+  end
+
+  def with_recursor(packets)
+    recursor, calls, budgets = bare_recursor, [], []
+    recursor.define_singleton_method(:recursion_cache_scope) { |_| nil }
+    recursor.define_singleton_method(:get_closest_known_zone_authorities_for) { |_| ['.', {}] }
+    recursor.define_singleton_method(:_dorecursion) do |name, *_|
+      calls << name
+      budgets << Dnsruby::ValidationBudget.current
+      packets.fetch(name)
+    end
+    Dnsruby::Recursor.stub(:ensure_hints, 0) { yield recursor, calls, budgets }
+  end
+
+  def fake_resolver(&send_message)
+    Struct.new(:dnssec, :recurse).new.tap do |resolver|
+      resolver.define_singleton_method(:send_message) { |query| send_message.call(query) }
+      resolver.define_singleton_method(:close) {}
+    end
+  end
+
+  def with_private_caches
+    fields = [:@@authority_cache, :@@zones_cache, :@@zone_expirations, :@@hints]
+    saved = fields.to_h { |field| [field, Dnsruby::Recursor.class_variable_get(field)] }
+    fields.each { |field| Dnsruby::Recursor.class_variable_set(field, {}) }
+    yield
+  ensure
+    saved.each { |field, value| Dnsruby::Recursor.class_variable_set(field, value) }
+  end
+
+  def with_full_validation(cached, bogus: false)
+    previous = Dnsruby::Dnssec.validation_policy
+    Dnsruby::Dnssec.validation_policy = Dnsruby::Dnssec::ValidationPolicy::ALWAYS_LOCAL_ANCHORS_ONLY
+    query = Dnsruby::Message.new('www.example.')
+    query.header.cd = true
+    response = answer('www.example.', 'www.example. 60 IN A 192.0.2.1')
+    response.add_answer(Dnsruby::RR.create(name: 'www.example.', type: 'RRSIG'))
+    calls = []
+    fast = ->(*) { cached.is_a?(Exception) ? raise(cached) : cached }
+    full = lambda do |message, _|
+      calls << :full
+      raise Dnsruby::VerifyError, 'Full validation failed' if bogus
+      message.security_level = Dnsruby::Message::SecurityLevel.SECURE
+      true
+    end
+    Dnsruby::Dnssec.stub(:verify_result, fast) do
+      Dnsruby::Dnssec.stub(:validate_with_anchors, full) { yield query, response, calls }
+    end
+  ensure
+    Dnsruby::Dnssec.validation_policy = previous
+  end
+end

data/test/tc_dnssec_trust_anchors.rb

@@ -0,0 +1,286 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+require 'open3'
+require 'rbconfig'
+
+class DnssecTrustAnchorsTest < Minitest::Test
+  FIXTURE_DIRECTORY = File.expand_path('fixtures', __dir__)
+  FIXTURE_TIME = Time.utc(2026, 11, 5, 12)
+  ROOT_DS = [
+    '. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D',
+    '. IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16'
+  ].freeze
+
+  def setup
+    Dnsruby::Dnssec.reset
+    @root_keys = read_fixture('root-dnskey')
+    @org_ds = read_fixture('org-ds')
+  end
+
+  def teardown
+    Dnsruby::Dnssec.reset
+  end
+
+  def test_cold_start_authenticates_ksk_2024_without_reset
+    # A new process exercises the initialization path without a reset or any
+    # previously authenticated keys, regardless of the suite's random order.
+    script = <<~'RUBY'
+      require 'dnsruby'
+      require 'minitest/mock'
+      records = File.readlines(ARGV.fetch(0)).reject { |line| line.start_with?(';') || line.strip.empty? }
+      keys = Dnsruby::RRSet.new(records.map { |line| Dnsruby::RR.create(line) })
+      Time.stub(:now, Time.utc(2026, 11, 5, 12)) do
+        verifier = Dnsruby::Dnssec.root_verifier
+        abort 'unexpected startup anchors' unless verifier.trust_anchors.map(&:key_tag).sort == [20326, 38696]
+        abort 'startup cache is warm' unless verifier.get_keys_to_check.empty?
+        abort 'fixture must have only the KSK-2024 signature' unless keys.sigs.map(&:key_tag) == [38696]
+        abort 'KSK-2024 validation failed' unless verifier.verify_key_rrset(keys)
+      end
+    RUBY
+    stdout, stderr, status = Open3.capture3(
+      RbConfig.ruby, '-I', File.expand_path('../lib', __dir__), '-e', script,
+      File.join(FIXTURE_DIRECTORY, 'root-dnskey-2026-11-05.zone')
+    )
+    assert(status.success?, "Cold-start validation failed:\n#{stdout}\n#{stderr}")
+    assert_empty(stderr)
+  end
+
+  def test_reset_restores_only_current_anchors_and_authenticates_ksk_2024
+    Time.stub(:now, FIXTURE_TIME) do
+      2.times do
+        Dnsruby::Dnssec.reset
+        verifier = Dnsruby::Dnssec.root_verifier
+        assert_equal(ROOT_DS.map { |text| Dnsruby::RR.create(text) }, verifier.trust_anchors)
+        assert_empty(verifier.get_keys_to_check)
+        assert_equal([38696], @root_keys.sigs.map(&:key_tag))
+        assert(verifier.verify_key_rrset(@root_keys))
+      end
+    end
+  end
+
+  def test_ksk_2017_alone_cannot_validate_the_fixture
+    Time.stub(:now, FIXTURE_TIME) do
+      verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ROOT)
+      verifier.add_root_ds(Dnsruby::RR.create(ROOT_DS.first))
+      error = assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(@root_keys) }
+      assert_match(/Signing key not found/, error.message)
+    end
+  end
+
+  def test_verify_rrset_accepts_a_single_ds_or_dlv_without_bypassing_authentication
+    Time.stub(:now, FIXTURE_TIME) do
+      [Dnsruby::SingleVerifier::VerifierType::ROOT, Dnsruby::SingleVerifier::VerifierType::DLV].each do |mode|
+        type = mode == Dnsruby::SingleVerifier::VerifierType::DLV ? 'DLV' : 'DS'
+        ds = Dnsruby::RR.create(ROOT_DS.last.sub(' DS ', " #{type} "))
+        [ds, Dnsruby::RRSet.new([ds])].each do |keys|
+          verifier = Dnsruby::SingleVerifier.new(mode)
+          assert(verifier.verify_rrset(@root_keys, keys), "#{mode}: #{keys.class}")
+        end
+
+        wrong_digest = Dnsruby::RR.create(ROOT_DS.last.sub(' DS ', " #{type} ").sub('683D', '0000'))
+        verifier = Dnsruby::SingleVerifier.new(mode)
+        assert_raises(Dnsruby::VerifyError) { verifier.verify_rrset(@root_keys, wrong_digest) }
+        assert_empty(verifier.get_keys_to_check)
+
+        corrupted = read_fixture('root-dnskey')
+        signature = corrupted.sigs.first.signature.dup
+        signature.setbyte(0, signature.getbyte(0) ^ 1)
+        corrupted.sigs.first.signature = signature
+        verifier = Dnsruby::SingleVerifier.new(mode)
+        assert_raises(Dnsruby::VerifyError) { verifier.verify_rrset(corrupted, ds) }
+      end
+    end
+  end
+
+  def test_corrupted_signature_is_rejected_with_cold_and_warm_caches
+    Time.stub(:now, FIXTURE_TIME) do
+      verifier = Dnsruby::Dnssec.root_verifier
+      corrupted = read_fixture('root-dnskey')
+      signature = corrupted.sigs.first.signature.dup
+      signature.setbyte(0, signature.getbyte(0) ^ 1)
+      corrupted.sigs.first.signature = signature
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(corrupted) }
+      zone_key = @root_keys.rrs.find { |key| !key.sep_key? }
+      refute_includes(verifier.get_keys_to_check.map(&:key_tag), zone_key.key_tag)
+      assert(verifier.verify_key_rrset(@root_keys))
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(corrupted) }
+      Dnsruby::Dnssec.clear_trusted_keys
+      ROOT_DS.each { |text| verifier.add_root_ds(Dnsruby::RR.create(text)) }
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(corrupted) }
+      assert(verifier.verify_key_rrset(@root_keys))
+    end
+  end
+
+  def test_cache_clear_removes_root_anchors_and_learned_dnskeys_and_ds
+    Time.stub(:now, FIXTURE_TIME) do
+      verifier = Dnsruby::Dnssec.root_verifier
+      assert(verifier.verify_key_rrset(@root_keys))
+      assert(verifier.verify_ds_rrset(@org_ds))
+      assert_includes(verifier.trusted_keys, @org_ds.rrs.first)
+      refute_empty(verifier.get_keys_to_check)
+
+      Dnsruby::Dnssec.clear_trusted_keys
+
+      assert_empty(verifier.trust_anchors)
+      assert_empty(verifier.trusted_keys)
+      assert_empty(verifier.get_keys_to_check)
+      assert(Dnsruby::Dnssec.no_keys?)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_ds_rrset(@org_ds) }
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(@root_keys) }
+    end
+  end
+
+  def test_cache_clear_retains_custom_dnskey_anchors_but_removes_ds_and_dlv_anchors
+    Time.stub(:now, FIXTURE_TIME) do
+      key = signing_key
+      ds = Dnsruby::RR.create(ROOT_DS.last)
+      dlv = Dnsruby::RR.create(ROOT_DS.last.sub(' DS ', ' DLV '))
+      Dnsruby::Dnssec.add_trust_anchor(key)
+      Dnsruby::Dnssec.add_trust_anchor(ds)
+      Dnsruby::Dnssec.dlv_verifier.add_trust_anchor(dlv)
+      assert(Dnsruby::Dnssec.anchor_verifier.verify_key_rrset(@root_keys))
+      assert(Dnsruby::Dnssec.dlv_verifier.verify_key_rrset(@root_keys))
+
+      Dnsruby::Dnssec.clear_trusted_keys
+
+      assert_equal([key], Dnsruby::Dnssec.trust_anchors)
+      assert_equal([key], Dnsruby::Dnssec.anchor_verifier.get_keys_to_check)
+      assert_empty(Dnsruby::Dnssec.dlv_verifier.trust_anchors)
+      assert_empty(Dnsruby::Dnssec.dlv_verifier.get_keys_to_check)
+      assert(Dnsruby::Dnssec.anchor_verifier.verify_key_rrset(@root_keys))
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.dlv_verifier.verify_key_rrset(@root_keys) }
+    end
+  end
+
+  def test_public_clear_sequence_removes_local_and_root_trust
+    Time.stub(:now, FIXTURE_TIME) do
+      # Existing clients use this sequence before supplying their own isolated
+      # trust anchors. Retaining root trust here would change their validation.
+      Dnsruby::Dnssec.add_trust_anchor(signing_key)
+      Dnsruby::Dnssec.add_trust_anchor(Dnsruby::RR.create(ROOT_DS.last))
+      assert(Dnsruby::Dnssec.root_verifier.verify_key_rrset(@root_keys))
+      assert(Dnsruby::Dnssec.anchor_verifier.verify_key_rrset(@root_keys))
+
+      Dnsruby::Dnssec.clear_trust_anchors
+      Dnsruby::Dnssec.clear_trusted_keys
+
+      assert_empty(Dnsruby::Dnssec.trust_anchors)
+      assert_empty(Dnsruby::Dnssec.root_verifier.trust_anchors)
+      assert(Dnsruby::Dnssec.no_keys?)
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.root_verifier.verify_key_rrset(@root_keys) }
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.anchor_verifier.verify_key_rrset(@root_keys) }
+
+      Dnsruby::Dnssec.validation_policy = Dnsruby::Dnssec::ValidationPolicy::ALWAYS_LOCAL_ANCHORS_ONLY
+      query = Dnsruby::Message.new('.', 'DNSKEY')
+      message = Dnsruby::Message.new('.', 'DNSKEY')
+      @root_keys.rrs.each { |rr| message.add_answer(rr) }
+      @root_keys.sigs.each { |rr| message.add_answer(rr) }
+      Dnsruby::Dnssec.validate_with_query(query, message)
+      assert_equal('UNCHECKED', message.security_level.to_s)
+    end
+  end
+
+  def test_explicit_clear_removes_custom_anchors_and_derived_trust
+    Time.stub(:now, FIXTURE_TIME) do
+      Dnsruby::Dnssec.add_trust_anchor(signing_key)
+      Dnsruby::Dnssec.add_trust_anchor(Dnsruby::RR.create(ROOT_DS.last))
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      assert(verifier.verify_key_rrset(@root_keys))
+      assert(verifier.verify_ds_rrset(@org_ds))
+
+      Dnsruby::Dnssec.clear_trust_anchors
+
+      assert_empty(Dnsruby::Dnssec.trust_anchors)
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(@root_keys) }
+      assert_equal([20326, 38696], Dnsruby::Dnssec.root_verifier.trust_anchors.map(&:key_tag))
+    end
+  end
+
+  def test_remove_ds_anchor_invalidates_derived_trust_and_retains_other_anchors
+    Time.stub(:now, FIXTURE_TIME) do
+      old_ds, new_ds = ROOT_DS.map { |text| Dnsruby::RR.create(text) }
+      Dnsruby::Dnssec.add_trust_anchor(old_ds)
+      Dnsruby::Dnssec.add_trust_anchor(new_ds)
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      assert(verifier.verify_key_rrset(@root_keys))
+      assert(verifier.verify_ds_rrset(@org_ds))
+
+      Dnsruby::Dnssec.remove_trust_anchor(new_ds)
+
+      assert_equal([old_ds], Dnsruby::Dnssec.trust_anchors)
+      assert_equal([old_ds], verifier.trusted_keys)
+      assert_empty(verifier.get_keys_to_check)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(@root_keys) }
+    end
+  end
+
+  def test_remove_equivalent_dnskey_anchor_invalidates_derived_trust
+    Time.stub(:now, FIXTURE_TIME) do
+      key = signing_key
+      Dnsruby::Dnssec.add_trust_anchor(key)
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      assert(verifier.verify_key_rrset(@root_keys))
+
+      equivalent_key = Dnsruby::RR.create(key.to_s)
+      equivalent_key.ttl += 1 # TTL is not part of a DNSKEY's identity.
+      refute_same(key, equivalent_key)
+      Dnsruby::Dnssec.remove_trust_anchor(equivalent_key)
+
+      assert_empty(Dnsruby::Dnssec.trust_anchors)
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(@root_keys) }
+    end
+  end
+
+  def test_removing_unconfigured_key_with_same_tag_preserves_trust
+    Time.stub(:now, FIXTURE_TIME) do
+      key = signing_key
+      Dnsruby::Dnssec.add_trust_anchor(key)
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      assert(verifier.verify_key_rrset(@root_keys))
+      cached_keys = verifier.trusted_keys
+      foreign_key = key.clone
+      foreign_key.name = 'example.' # Owner name is not included in the key tag.
+      assert_equal(key.key_tag, foreign_key.key_tag)
+
+      Dnsruby::Dnssec.remove_trust_anchor(foreign_key)
+
+      assert_equal([key], Dnsruby::Dnssec.trust_anchors)
+      assert_equal(cached_keys, verifier.trusted_keys)
+      assert(verifier.verify_key_rrset(@root_keys))
+    end
+  end
+
+  def test_explicit_remove_and_clear_work_for_dlv_anchors
+    Time.stub(:now, FIXTURE_TIME) do
+      verifier = Dnsruby::Dnssec.dlv_verifier
+      dlv = Dnsruby::RR.create(ROOT_DS.last.sub(' DS ', ' DLV '))
+      verifier.add_trust_anchor(dlv)
+      assert(verifier.verify_key_rrset(@root_keys))
+      verifier.remove_trust_anchor(dlv)
+      assert_empty(verifier.trust_anchors)
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(@root_keys) }
+
+      verifier.add_trust_anchor(dlv)
+      assert(verifier.verify_key_rrset(@root_keys))
+      verifier.clear_trust_anchors
+      assert_empty(verifier.trust_anchors)
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify_key_rrset(@root_keys) }
+    end
+  end
+
+  private
+
+  def read_fixture(name)
+    lines = File.readlines(File.join(FIXTURE_DIRECTORY, "#{name}-2026-11-05.zone"))
+    records = lines.reject { |line| line.start_with?(';') || line.strip.empty? }
+    Dnsruby::RRSet.new(records.map { |line| Dnsruby::RR.create(line) })
+  end
+
+  def signing_key
+    @root_keys.rrs.find { |key| key.key_tag == 38696 }
+  end
+end