dnsruby 1.73.1 → 2.0.0

data/test/tc_dnssec_trust_races.rb

@@ -0,0 +1,147 @@
+require_relative 'spec_helper'
+require 'openssl'
+require 'base64'
+require 'timeout'
+
+class DnssecTrustRacesTest < Minitest::Test
+  def setup
+    Dnsruby::Dnssec.reset
+    @rsa = OpenSSL::PKey::RSA.generate(2048)
+    exponent = @rsa.e.to_s(2)
+    key_data = Base64.strict_encode64([exponent.bytesize].pack('C') + exponent + @rsa.n.to_s(2))
+    @key = Dnsruby::RR.create("private.invalid. 300 IN DNSKEY 257 3 8 #{key_data}")
+    @child = Dnsruby::RR.create("child.private.invalid. 300 IN DNSKEY 257 3 8 #{key_data}")
+    @keys = signed(@key, @key)
+    @child_keys = signed(@child, @child)
+    @ds = Dnsruby::RR::DS.from_key(@child, 2)
+    @ds.ttl = 300
+    @ds_set = signed(@ds, @key)
+  end
+
+  def teardown
+    Dnsruby::Dnssec.reset
+  end
+
+  def test_public_verification_cannot_republish_dnskeys_after_remove_or_clear
+    [:remove, :clear].each do |operation|
+      Dnsruby::Dnssec.reset
+      Dnsruby::Dnssec.add_trust_anchor(@key)
+      assert(Dnsruby::Dnssec.verify(@keys))
+      revoke(operation)
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.verify(@keys) }
+      Dnsruby::Dnssec.add_trust_anchor(@key)
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      pause_after(verifier, :verify_rrset, -> { revoke(operation) }) do
+        assert(Dnsruby::Dnssec.verify(@keys))
+      end
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.verify(@keys) }
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.root_verifier.verify(@keys) }
+    end
+  end
+
+  def test_signed_ds_cannot_republish_discovered_ds_or_matched_dnskeys
+    [:remove, :clear].product([false, true]).each do |operation, include_key|
+      Dnsruby::Dnssec.reset
+      Dnsruby::Dnssec.add_trust_anchor(@key)
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      message = if include_key
+        Dnsruby::Message.new('child.private.invalid.', 'DNSKEY').tap { |m| m.add_answer(@child) }
+      end
+      pause_after(verifier, :verify_rrset, -> { revoke(operation) }) do
+        assert(verifier.verify_ds_rrset(@ds_set, nil, message))
+      end
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify(@child_keys) }
+    end
+  end
+
+  def test_configured_and_discovered_ds_cannot_publish_after_snapshot_is_revoked
+    [:remove, :clear].product([false, true]).each do |operation, discovered|
+      Dnsruby::Dnssec.reset
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      anchor = discovered ? @key : @ds
+      Dnsruby::Dnssec.add_trust_anchor(anchor)
+      assert(verifier.verify(@ds_set)) if discovered
+      # Stop after a real digest match, while check_ds_stores still owns its old
+      # snapshot; removal must not block on cryptographic or network work.
+      pause_after(discovered ? @ds_set.rrs.first : @ds, :check_key, -> { revoke(operation, anchor) }) do
+        allow_revoked_trust_rejection { verifier.check_ds_stores(@child_keys) }
+      end
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { verifier.verify(@child_keys) }
+    end
+  end
+
+  def test_validation_carries_generation_across_anchor_lookup_and_network_discovery
+    [:remove, :clear].each do |operation|
+      Dnsruby::Dnssec.reset
+      Dnsruby::Dnssec.add_trust_anchor(@key)
+      verifier = Dnsruby::Dnssec.anchor_verifier
+      message = Dnsruby::Message.new('private.invalid.', 'DNSKEY')
+      @keys.each { |rr| message.add_answer(rr) }
+      # Stand in for the network lookup: the supplied anchor is exactly the one
+      # captured by validate before removal, and the cryptographic check is real.
+      keys = @keys
+      verifier.define_singleton_method(:follow_chain) do |anchor, _name|
+        verify(keys, anchor)
+        keys
+      end
+      pause_after(verifier, :find_closest_anchor_for, -> { revoke(operation) }) do
+        allow_revoked_trust_rejection { verifier.validate(message, message) }
+      end
+      assert_empty(verifier.trusted_keys)
+      assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.verify(@keys) }
+    end
+  end
+
+  private
+
+  # The pause guarantees revocation occurs after the operation has captured
+  # trust. It may then finish or reject; neither outcome may publish trust.
+  def allow_revoked_trust_rejection
+    yield
+  rescue Dnsruby::VerifyError
+  end
+
+  def revoke(operation, key = @key)
+    operation == :remove ? Dnsruby::Dnssec.remove_trust_anchor(key) : Dnsruby::Dnssec.clear_trust_anchors
+  end
+
+  def pause_after(object, method_name, mutation)
+    arrived, resume, start = Queue.new, Queue.new, Queue.new
+    original = object.method(method_name)
+    own_method = object.singleton_class.instance_methods(false).include?(method_name)
+    object.singleton_class.remove_method(method_name) if own_method
+    thread = nil
+    object.define_singleton_method(method_name) do |*args|
+      result = original.call(*args)
+      if Thread.current.equal?(thread)
+        arrived << true
+        resume.pop
+      end
+      result
+    end
+    thread = Thread.new { start.pop; yield }
+    start << true
+    Timeout.timeout(3) { arrived.pop }
+    Timeout.timeout(3) { mutation.call }
+    resume << true
+    Timeout.timeout(3) { thread.value }
+  ensure
+    object.singleton_class.remove_method(method_name) if original
+    object.define_singleton_method(method_name, original) if own_method
+    thread.kill if thread && thread.alive?
+    thread.join if thread
+  end
+
+  def signed(record, key)
+    signature = Dnsruby::RR.create(name: record.name, type: 'RRSIG', ttl: 300,
+      type_covered: record.type, algorithm: 8, labels: record.name.labels.length,
+      original_ttl: 300, expiration: Time.now.to_i + 3600, inception: Time.now.to_i - 60,
+      key_tag: key.key_tag, signers_name: key.name)
+    data = Dnsruby::MessageEncoder.new { |encoder| encoder.put_rr(record, true) }.to_s
+    signature.signature = @rsa.sign(OpenSSL::Digest::SHA256.new, signature.sig_data + data)
+    Dnsruby::RRSet.new([record, signature])
+  end
+end

data/test/tc_dnssec_wildcard_proofs.rb

@@ -0,0 +1,249 @@
+require_relative 'tc_key_cache_identity'
+
+class DnssecWildcardProofsTest < Minitest::Test
+  def setup
+    Dnsruby::Dnssec.reset
+    @private_key = OpenSSL::PKey::EC.new(KeyCacheIdentityTest::PRIVATE_KEYS.first)
+    bytes = @private_key.public_key.to_octet_string(:uncompressed).byteslice(1, 64)
+    @zone = 'collision.invalid.'
+    @key = Dnsruby::RR.create("#{@zone} 300 IN DNSKEY 257 3 13 #{Base64.strict_encode64(bytes)}")
+    @verifier = Dnsruby::Dnssec.anchor_verifier
+    @verifier.add_trust_anchor(@key)
+  end
+
+  def teardown
+    Dnsruby::Dnssec.reset
+  end
+
+  def test_full_message_requires_proof_but_standalone_rrset_verification_remains_available
+    message = wildcard_message
+    assert(@verifier.verify_rrset(message.answer.rrset(message.question.first.qname, 'A')))
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+    add_nsec(message)
+    assert(@verifier.verify(message))
+    assert(Dnsruby::Dnssec.validate(message))
+    assert_equal(Dnsruby::Message::SecurityLevel.SECURE, message.security_level)
+  end
+
+  def test_wildcard_and_denial_can_use_different_keys_in_the_same_zone
+    proof_key = @key.clone
+    proof_key.flags = 256
+    refute_equal(@key.key_tag, proof_key.key_tag)
+    @verifier.add_trust_anchor(proof_key)
+    message = wildcard_message
+    proof = Dnsruby::RR.create('a.collision.invalid. 300 IN NSEC z.collision.invalid. TXT NSEC RRSIG')
+    signed(proof, key: proof_key).each { |rr| message.add_authority(rr) }
+    assert(@verifier.verify(message))
+  end
+
+  def test_nsec_proof_does_not_need_the_answer_type_in_its_bitmap
+    message = wildcard_message
+    add_nsec(message, types: 'TXT NSEC RRSIG')
+    assert(@verifier.verify(message))
+  end
+
+  def test_examples_from_rfc_4035_wildcard_expansion
+    # Preserve the RFC's expanded MX owner and denial interval, with fresh
+    # signatures so the complete validation path can authenticate the proof.
+    key = Dnsruby::RR.create(@key.to_s)
+    key.name = 'example.'
+    @verifier.add_trust_anchor(key)
+    message = Dnsruby::Message.new('a.z.w.example.', 'MX')
+    message.header.qr = true
+    message.header.rcode = Dnsruby::RCode::NOERROR
+    answer = signed(Dnsruby::RR.create('*.w.example. 300 IN MX 1 ai.example.'), key: key)
+    answer.each { |rr| rr.name = 'a.z.w.example.'; message.add_answer(rr) }
+    signed(Dnsruby::RR.create('x.y.w.example. 300 IN NSEC xx.example. MX RRSIG NSEC'), key: key).
+      each { |rr| message.add_authority(rr) }
+    assert(@verifier.verify(message))
+
+    signature = answer.sigs.first
+    assert_equal(2, signature.labels)
+    signature.labels = 4
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+    signature.labels = 2
+    assert(@verifier.verify(message))
+
+    # A valid signature alone cannot make an interval ending at the next closer
+    # name prove that name does not exist.
+    message.authority.clear
+    signed(Dnsruby::RR.create('x.y.w.example. 300 IN NSEC z.w.example. MX RRSIG NSEC'), key: key).
+      each { |rr| message.add_authority(rr) }
+    assert(@verifier.verify_rrset(message.authority.rrset('x.y.w.example.', 'NSEC')))
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_any_queries_and_cname_answers_require_their_own_wildcard_proof
+    message = wildcard_message(qtype: 'ANY')
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+    add_nsec(message)
+    assert(@verifier.verify(message))
+
+    cname = wildcard_message(type: 'CNAME', data: 'target.collision.invalid.')
+    signed(Dnsruby::RR.create('target.collision.invalid. 300 IN A 192.0.2.1')).each { |rr| cname.add_answer(rr) }
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(cname) }
+    add_nsec(cname)
+    assert(@verifier.verify(cname))
+  end
+
+  def test_a_literal_wildcard_owner_has_not_been_expanded
+    message = wildcard_message(name: '*.collision.invalid.')
+    assert(@verifier.verify(message))
+    # This also exercises a genuine wildcard owner in the NSEC proof itself.
+    expanded = wildcard_message
+    add_nsec(expanded, owner: '*.collision.invalid.')
+    assert(@verifier.verify(expanded))
+  end
+
+  def test_signature_selection_can_use_an_exact_signature_without_a_wildcard_proof
+    message = wildcard_message
+    exact = signed(message.answer.rrset(message.question.first.qname, 'A').rrs.first)
+    message.add_answer(exact.sigs.first)
+    assert(@verifier.verify(message))
+  end
+
+  def test_denial_must_cover_next_closer_not_just_the_longer_question
+    message = wildcard_message(name: 'x.b.collision.invalid.')
+    # This interval covers x.b, but also proves b exists as an empty nonterminal.
+    add_nsec(message, owner: 'a.collision.invalid.', following: 'z.b.collision.invalid.')
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+
+    message = wildcard_message(name: 'x.b.collision.invalid.')
+    add_nsec(message, owner: 'a.collision.invalid.', following: 'c.collision.invalid.')
+    assert(@verifier.verify(message))
+  end
+
+  def test_nsec_wraparound_and_strict_endpoints
+    message = wildcard_message(name: 'zz.collision.invalid.')
+    add_nsec(message, owner: 'z.collision.invalid.', following: @zone)
+    assert(@verifier.verify(message))
+    ['a.collision.invalid.', 'z.collision.invalid.'].each do |endpoint|
+      message = wildcard_message(name: endpoint)
+      add_nsec(message)
+      assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+    end
+  end
+
+  def test_unsigned_or_other_zone_denial_cannot_supply_the_proof
+    message = wildcard_message
+    message.add_authority(Dnsruby::RR.create('a.collision.invalid. 300 IN NSEC z.collision.invalid. TXT NSEC RRSIG'))
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+
+    foreign = Dnsruby::RR.create(@key.to_s)
+    foreign.name = 'other.invalid.'
+    @verifier.add_trust_anchor(foreign)
+    message = wildcard_message
+    record = Dnsruby::RR.create('a.collision.invalid. 300 IN NSEC z.collision.invalid. TXT NSEC RRSIG')
+    signed(record, key: foreign).each { |rr| message.add_authority(rr) }
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_nsec3_proofs_with_empty_and_binary_salts
+    ['-', 'a1b200ff'].each do |salt|
+      message = wildcard_message(name: 'x.b.collision.invalid.')
+      add_nsec3(message, salt: salt, next_closer: 'b.collision.invalid.')
+      assert(@verifier.verify(message))
+      assert(Dnsruby::Dnssec.validate(message))
+      assert_equal(Dnsruby::Message::SecurityLevel.SECURE, message.security_level)
+    end
+  end
+
+  def test_nsec3_matching_hash_is_not_a_covering_proof
+    message = wildcard_message
+    add_nsec3(message, exact: true)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_authenticated_opt_out_is_insecure_and_clears_ad
+    message = wildcard_message
+    add_nsec3(message, flags: 1)
+    assert_equal(:insecure, @verifier.verify_result(message))
+    refute(@verifier.verify(message))
+    refute(Dnsruby::Dnssec.verify(message))
+    message.security_level = Dnsruby::Message::SecurityLevel.SECURE
+    message.header.ad = true
+    # This fixture has a local trust anchor; it has no chain from the real root.
+    # An INSECURE cached result must still pass the selected validation policy.
+    Dnsruby::Dnssec.validation_policy = Dnsruby::Dnssec::ValidationPolicy::ALWAYS_LOCAL_ANCHORS_ONLY
+    @verifier.stub(:follow_chain, Dnsruby::RRSet.new([@key])) do
+      assert(Dnsruby::Dnssec.validate(message))
+    end
+    assert_equal(Dnsruby::Message::SecurityLevel.INSECURE, message.security_level)
+    refute(message.header.ad)
+
+    message.header.ad = true
+    @verifier.stub(:follow_chain, Dnsruby::RRSet.new([@key])) do
+      assert(@verifier.validate(message, message))
+    end
+    assert_equal(Dnsruby::Message::SecurityLevel.INSECURE, message.security_level)
+    refute(message.header.ad)
+  end
+
+  def test_secure_proof_is_preferred_and_stale_insecure_status_does_not_survive
+    message = wildcard_message
+    add_nsec3(message, flags: 1)
+    add_nsec(message)
+    message.security_level = Dnsruby::Message::SecurityLevel.INSECURE
+    assert(Dnsruby::Dnssec.validate(message))
+    assert_equal(Dnsruby::Message::SecurityLevel.SECURE, message.security_level)
+  end
+
+  def test_wildcard_proof_is_verified_once_and_keeps_its_authenticated_lifetime
+    now = Time.now
+    Time.stub(:now, now) do
+      [false, true].each do |nsec3|
+        message = wildcard_message
+        nsec3 ? add_nsec3(message) : add_nsec(message)
+        message.authority.find { |rr| rr.type == Dnsruby::Types.RRSIG }.ttl = 7
+        2.times do
+          budget = Dnsruby::ValidationBudget.new(limits:
+            Dnsruby::Dnssec.validation_limits.merge(max_signature_verifications: 2))
+          Dnsruby::ValidationBudget.with(budget) { assert(@verifier.verify(message)) }
+          assert_equal([7, 7], message.authority.map(&:ttl))
+          assert(message.authority.all? do |rr|
+            rr.instance_variable_get(:@dnsruby_authenticated_expiration) == now.to_i + 7
+          end)
+        end
+      end
+    end
+  end
+
+  private
+
+  def signed(record, key: @key)
+    signature = Dnsruby::RR.create(name: record.name, type: 'RRSIG', ttl: 300,
+      type_covered: record.type, algorithm: 13,
+      labels: record.name.labels.length - (record.name.wild? ? 1 : 0),
+      original_ttl: 300, expiration: Time.now.to_i + 3600, inception: Time.now.to_i - 60,
+      key_tag: key.key_tag, signers_name: key.name)
+    bytes = Dnsruby::MessageEncoder.new { |encoder| encoder.put_rr(record, true) }.to_s
+    der = @private_key.dsa_sign_asn1(OpenSSL::Digest::SHA256.digest(signature.sig_data + bytes))
+    signature.signature = OpenSSL::ASN1.decode(der).value.map { |n| n.value.to_s(2).rjust(32, "\0") }.join
+    Dnsruby::RRSet.new([record, signature])
+  end
+
+  def wildcard_message(name: 'b.collision.invalid.', type: 'A', data: '192.0.2.1', qtype: 'A')
+    records = signed(Dnsruby::RR.create("*.collision.invalid. 300 IN #{type} #{data}"))
+    Dnsruby::Message.new(name, qtype).tap do |message|
+      message.header.qr = true
+      records.each { |rr| rr.name = name; message.add_answer(rr) }
+    end
+  end
+
+  def add_nsec(message, owner: 'a.collision.invalid.', following: 'z.collision.invalid.', types: 'TXT NSEC RRSIG')
+    signed(Dnsruby::RR.create("#{owner} 300 IN NSEC #{following} #{types}")).each { |rr| message.add_authority(rr) }
+  end
+
+  def add_nsec3(message, salt: '-', flags: 0, next_closer: 'b.collision.invalid.', exact: false)
+    hash = Dnsruby::RR::NSEC3.calculate_hash(next_closer, 2,
+      Dnsruby::RR::NSEC3.decode_salt(salt), Dnsruby::Nsec3HashAlgorithms.SHA_1)
+    value = Dnsruby::RR::NSEC3.decode_next_hashed(hash).unpack1('H*').to_i(16)
+    hash_at = lambda do |offset|
+      bytes = [((value + offset) % (2 ** 160)).to_s(16).rjust(40, '0')].pack('H*')
+      Dnsruby::RR::NSEC3.encode_next_hashed(bytes)
+    end
+    owner, following = hash_at.call(exact ? 0 : -1), hash_at.call(1)
+    record = Dnsruby::RR.create("#{owner}.#{@zone} 300 IN NSEC3 1 #{flags} 2 #{salt} #{following} TXT")
+    signed(record).each { |rr| message.add_authority(rr) }
+  end
+end

data/test/tc_ds.rb

@@ -79,8 +79,8 @@ class DsTest < Minitest::Test
 
      #  and check it is the same as DS
      right_ds = Dnsruby::RR.create(DS1)
-     ds = Dnsruby::RR::DS.from_key(key, 1);
-     assert_equal(ds.to_s, right_ds.to_s)
+     assert_equal(right_ds.digestbin, right_ds.digest_key(key))
+     assert(right_ds.check_key(key))
   end
 
   def test_sha2
@@ -89,8 +89,8 @@ class DsTest < Minitest::Test
 
      #  and check it is the same as DS
      right_ds = Dnsruby::RR.create(DS2)
-     ds = Dnsruby::RR::DS.from_key(key, 2);
-     assert_equal(ds.to_s, right_ds.to_s)
+     assert_equal(right_ds.digestbin, right_ds.digest_key(key))
+     assert(right_ds.check_key(key))
   end
 
   def test_dlv_from_string
@@ -104,4 +104,4 @@ class DsTest < Minitest::Test
     assert(dlv2.to_s == dlv.to_s)
   end
 
-end
+end

data/test/tc_edns_retry_regressions.rb

@@ -0,0 +1,255 @@
+require_relative 'spec_helper'
+require_relative 'socket_helpers'
+require 'socket'
+require 'timeout'
+
+class EdnsRetryRegressionsTest < Minitest::Test
+  def test_formerr_then_truncated_udp_completes_over_tcp_without_mutating_caller
+    udp, tcp = TestSockets.udp_tcp_pair
+    requests = Queue.new
+    udp_worker = Thread.new do
+      2.times do |index|
+        bytes, peer = udp.recvfrom(65_535)
+        request = Dnsruby::Message.decode(bytes)
+        requests << [:udp, request]
+        reply = response(request)
+        reply.header.rcode = Dnsruby::RCode::FORMERR if index.zero?
+        reply.header.tc = true unless index.zero?
+        udp.send(reply.encode, 0, peer[3], peer[1])
+      end
+    end
+    tcp_worker = Thread.new do
+      client = tcp.accept
+      length = client.read(2).unpack1('n')
+      request = Dnsruby::Message.decode(client.read(length))
+      requests << [:tcp, request]
+      reply = response(request)
+      reply.add_answer(Dnsruby::RR.create('retry.example. 0 IN A 192.0.2.44'))
+      bytes = reply.encode
+      client.write([bytes.bytesize].pack('n') + bytes)
+    ensure
+      client.close if client && !client.closed?
+    end
+    [udp_worker, tcp_worker].each { |worker| worker.report_on_exception = false }
+
+    resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', port: udp.addr[1],
+      dnssec: false, do_validation: false, do_caching: false, udp_size: 4096,
+      packet_timeout: 2, query_timeout: 4, retry_times: 1)
+    query = edns_query
+    original_opt = query.get_opt
+    original_additional = query.additional.to_a.dup
+    reply = Timeout.timeout(6) { resolver.send_message(query) }
+    refute(reply.header.tc)
+    assert_equal('192.0.2.44', reply.answer.first.address.to_s)
+    refute(query.send_raw)
+    assert_same(original_opt, query.get_opt)
+    assert_equal(original_additional, query.additional)
+    Timeout.timeout(2) { udp_worker.value; tcp_worker.value }
+    observed = 3.times.map { requests.pop(true) }
+    assert_equal([:udp, :udp, :tcp], observed.map(&:first))
+    assert_equal([true, false, false], observed.map { |_, request| !!request.get_opt })
+    observed.each do |_, request|
+      assert_equal(query.header.id, request.header.id)
+      assert_equal(['keep me'], request.additional.find { |rr| rr.type == Dnsruby::Types::TXT }.strings)
+    end
+    assert(requests.empty?)
+  ensure
+    resolver.close if resolver
+    [udp_worker, tcp_worker].compact.each do |worker|
+      worker.kill if worker.alive?
+      worker.join
+    end
+    tcp.close if tcp && !tcp.closed?
+    udp.close if udp && !udp.closed?
+  end
+
+  def test_edns_retry_keeps_normal_response_question_validation
+    sender, retries = capturing_sender
+    query = edns_query
+    retry_query = request_edns_retry(sender, retries, query)
+    invalid = response(retry_query, 'unrelated.example.')
+    assert_equal(false, check(sender, invalid, retry_query))
+    assert_equal(1, retries.length, 'invalid response must not start another attempt')
+    assert_equal(true, check(sender, response(retry_query), retry_query))
+    refute(query.send_raw)
+    refute(retry_query.send_raw)
+    refute_nil(query.get_opt)
+    assert_nil(retry_query.get_opt)
+  end
+
+  def test_no_tcp_and_ignore_truncation_are_honoured_after_edns_retry
+    [{no_tcp: true}, {ignore_truncation: true}, {no_tcp: true, ignore_truncation: true}].each do |options|
+      sender, retries = capturing_sender(options)
+      retry_query = request_edns_retry(sender, retries, edns_query)
+      truncated = response(retry_query)
+      truncated.header.tc = true
+      assert_equal(true, check(sender, truncated, retry_query), options.inspect)
+      assert_equal(1, retries.length, 'transport policy must prevent a TCP retry')
+    end
+  end
+
+  def test_public_raw_mode_still_bypasses_protocol_retries
+    sender, retries = capturing_sender
+    query = edns_query
+    query.send_raw = true
+    [Dnsruby::RCode::FORMERR, Dnsruby::RCode::NOERROR].each do |rcode|
+      reply = response(query, 'raw-reply.example.')
+      reply.header.rcode = rcode
+      reply.header.tc = true
+      assert_equal(true, check(sender, reply, query))
+      assert_empty(retries)
+      assert(query.send_raw)
+      refute_nil(query.get_opt)
+    end
+  end
+
+  def test_signed_edns_retry_verifies_response_and_resigns_changed_request
+    skip('OpenSSL HMAC unavailable') unless defined?(OpenSSL::HMAC)
+    [:sender_key, :message_key].each do |mode|
+      key = Dnsruby::RR.create(name: 'retry-key.example.', type: 'TSIG', klass: 'ANY',
+        key: 'c2VjcmV0', algorithm: 'hmac-sha256')
+      sender, retries = capturing_sender
+      query = edns_query
+      if mode == :sender_key
+        sender.tsig = key
+      else
+        query.set_tsig(key)
+      end
+      original_bytes = sender.make_query_packet(query)
+      assert_equal(1, query.additional.count { |rr| rr.type == Dnsruby::Types::TSIG })
+      formerr = response(query)
+      formerr.header.rcode = Dnsruby::RCode::FORMERR
+      key.apply(formerr, query)
+      formerr = Dnsruby::Message.decode(formerr.encode)
+
+      assert_equal(false, check(sender, formerr, query))
+      assert(formerr.verified?)
+      assert_equal(1, retries.length)
+      retry_query, _, _, use_tcp, disable_edns = retries.first
+      assert_equal(false, use_tcp)
+      assert_equal(true, disable_edns)
+      bytes = sender.make_query_packet(retry_query, use_tcp, disable_edns)
+      decoded = Dnsruby::Message.decode(bytes)
+      assert_nil(decoded.get_opt)
+      assert_equal(1, decoded.additional.count { |rr| rr.type == Dnsruby::Types::TSIG })
+      expected = key.generate(decoded, nil, '', bytes, decoded.tsig)
+      assert_equal(expected.mac, decoded.tsig.mac, 'retry must be signed over the changed packet')
+      refute_equal(query.tsig.mac, decoded.tsig.mac)
+      assert_equal(original_bytes, query.encode, 'retry must not replace the caller\'s signed packet')
+      refute(retry_query.send_raw)
+
+      unsigned = response(retry_query)
+      assert_equal(false, check(sender, unsigned, retry_query), 'unsigned reply must leave the retry pending')
+      signed = response(retry_query)
+      key.apply(signed, decoded)
+      signed = Dnsruby::Message.decode(signed.encode)
+      assert_equal(true, check(sender, signed, retry_query))
+      assert(signed.verified?)
+      assert_equal(1, retries.length)
+    end
+  end
+
+  def test_failed_signing_can_be_repaired_and_retried_without_sending_unsigned
+    skip('OpenSSL HMAC unavailable') unless defined?(OpenSSL::HMAC)
+    key = Dnsruby::RR.create(name: 'retry-key.example.', type: 'TSIG', klass: 'ANY',
+      key: 'c2VjcmV0', algorithm: 'hmac-sha256')
+    sender, = capturing_sender
+    sender.tsig = key
+    query = edns_query
+    invalid = Dnsruby::RR.get_class(62001, 1).new('x'.b * 65_536)
+    invalid.name, invalid.ttl, invalid.type, invalid.klass = 'size.example.', 0, 62001, 1
+    query.add_additional(invalid)
+
+    assert_raises(Dnsruby::EncodeError) { sender.make_query_packet(query) }
+    assert_nil(query.tsig, 'failed signing must not leave a partial signature')
+    refute(query.signed?)
+    query.remove_additional
+    bytes = sender.make_query_packet(query)
+    decoded = Dnsruby::Message.decode(bytes)
+    assert_equal(1, decoded.additional.count { |rr| rr.type == Dnsruby::Types::TSIG })
+    assert(query.signed?)
+    expected = key.generate(decoded, nil, '', bytes, decoded.tsig)
+    assert_equal(expected.mac, decoded.tsig.mac, 'repaired request must be authenticated')
+    reply = response(query)
+    key.apply(reply, decoded)
+    reply = Dnsruby::Message.decode(reply.encode)
+    assert_equal(true, check(sender, reply, query))
+    assert(reply.verified?)
+  end
+
+  def test_formerr_downgrade_requires_dnssec_to_be_optional
+    [false, true].product([false, true], [false, true]).each do |dnssec, validation, signed|
+      sender, retries = capturing_sender(dnssec: dnssec)
+      query = edns_query
+      query.do_validation = validation
+      key = Dnsruby::RR.create(name: 'retry-key.example.', type: 'TSIG', klass: 'ANY',
+        key: 'c2VjcmV0', algorithm: 'hmac-sha256')
+      query.set_tsig(key) if signed
+      original_wire = sender.make_query_packet(query)
+      formerr = response(query)
+      formerr.header.rcode = Dnsruby::RCode::FORMERR
+      key.apply(formerr, query) if signed
+      wire = formerr.encode
+      result = sender.check_response(Dnsruby::Message.decode(wire), wire, query, Queue.new, :policy, false)
+      if dnssec && validation
+        assert_equal(true, result, 'required DNSSEC must report FORMERR without removing EDNS')
+        assert_empty(retries)
+      else
+        assert_equal(false, result)
+        assert_equal(1, retries.size)
+        retry_query, _, _, tcp, disable_edns = retries.first
+        assert_nil(retry_query.get_opt)
+        retry_wire = sender.make_query_packet(retry_query, tcp, disable_edns)
+        decoded = Dnsruby::Message.decode(retry_wire)
+        assert_nil(decoded.get_opt)
+        if signed
+          assert_equal(key.generate(decoded, nil, '', retry_wire, decoded.tsig).mac, decoded.tsig.mac)
+          refute_equal(query.tsig.mac, decoded.tsig.mac)
+        end
+      end
+      assert_equal(original_wire, query.encode, 'negotiation must preserve the caller request')
+    end
+  end
+
+  private
+
+  def edns_query
+    Dnsruby::Message.new('retry.example.').tap do |query|
+      query.header.rd = true
+      query.do_validation = query.do_caching = false
+      query.add_additional(Dnsruby::RR::OPT.new(4096))
+      query.add_additional(Dnsruby::RR.create('extra.example. 0 IN TXT "keep me"'))
+    end
+  end
+
+  def response(query, name = query.question.first.qname)
+    Dnsruby::Message.new(name).tap do |reply|
+      reply.header.id = query.header.id
+      reply.header.qr = true
+    end
+  end
+
+  def capturing_sender(options = {})
+    sender = Dnsruby::PacketSender.new({server: '127.0.0.1', dnssec: false,
+      udp_size: 4096}.merge(options))
+    retries = []
+    sender.define_singleton_method(:send_async) { |*arguments| retries << arguments }
+    [sender, retries]
+  end
+
+  def check(sender, reply, query)
+    sender.check_response(reply, reply.encode, query, Queue.new, :retry, false)
+  end
+
+  def request_edns_retry(sender, retries, query)
+    formerr = response(query)
+    formerr.header.rcode = Dnsruby::RCode::FORMERR
+    assert_equal(false, check(sender, formerr, query))
+    assert_equal(1, retries.length)
+    retry_query, _, id, use_tcp, disable_edns = retries.first
+    assert_equal(:retry, id)
+    assert_equal(false, use_tcp)
+    assert_equal(true, disable_edns)
+    retry_query
+  end
+end