dnsruby 1.73.1 → 2.0.0

data/test/tc_protocol_review_fixes.rb

@@ -0,0 +1,95 @@
+require_relative 'spec_helper'
+
+class ProtocolReviewFixesTest < Minitest::Test
+  def test_repeated_compressed_names_use_independent_mutable_labels
+    encoder = Dnsruby::MessageEncoder.new
+    %w[First.Example. Second.Example. First.Example.].each do |name|
+      encoder.put_name(Dnsruby::Name.create(name))
+    end
+    decoder = Dnsruby::MessageDecoder.new(encoder.to_s)
+    names = 3.times.map { decoder.get_name }
+    assert_equal(%w[first.example. second.example. first.example.], names.map { |name| name.to_s(true) })
+    names.first.labels.first.string.replace('Changed')
+    names.first.labels.last.string.replace('Changed')
+    assert_equal('first.example.', names.last.to_s(true))
+    assert_equal('second.example.', names[1].to_s(true))
+    suffixes = decoder.instance_variable_get(:@name_suffixes)
+    assert(suffixes.keys.all? { |offset| offset < 0x4000 && offset < encoder.to_s.bytesize })
+    assert(suffixes.values.all? { |value| value.frozen? && value[0].frozen? && value[0].all?(&:frozen?) })
+    assert_equal(encoder.to_s.bytesize, decoder.index)
+  end
+
+  def test_rfc_name_fields_are_uncompressed_with_existing_case_rules
+    records = [
+      ['SRV 0 5 443 Target.Example.', 6],
+      ['DNAME Target.Example.', 0],
+      ['RRSIG A 8 2 300 20300101000000 20200101000000 123 Target.Example. AQID', 18],
+      ['NSEC Target.Example. A NSEC RRSIG', 0]
+    ]
+    target = Dnsruby::Name.create('Target.Example.')
+    expected = Dnsruby::MessageEncoder.new { |msg| msg.put_name(target, true, false) }.to_s
+    records.each do |rdata, name_offset|
+      rr = Dnsruby::RR.create("owner.example. 300 IN #{rdata}")
+      encoder = Dnsruby::MessageEncoder.new
+      encoder.put_name(target)
+      encoder.put_rr(rr)
+      decoder = Dnsruby::MessageDecoder.new(encoder.to_s)
+      decoder.get_name
+      decoder.get_name
+      decoder.get_unpack('nnN')
+      wire_rdata = decoder.get_length16 { decoder.get_bytes }
+      assert_equal(expected, wire_rdata.byteslice(name_offset, expected.bytesize), rdata)
+      decoded = Dnsruby::MessageDecoder.new(encoder.to_s)
+      decoded.get_name
+      assert_equal(rr.clone, decoded.get_rr, rdata)
+    end
+  end
+
+  def test_all_known_empty_update_markers_round_trip_and_clone
+    types = %w[A AAAA AFSDB ANY APL CAA CDNSKEY CDS CERT CNAME DHCID DLV DNAME DNSKEY DS
+      GPOS HINFO HIP HTTPS IPSECKEY ISDN KX LOC MB MG MINFO MR MX NAPTR NS NSAP NSEC NSEC3
+      NSEC3PARAM NXT PTR PX RP RRSIG RT SOA SPF SRV SSHFP SVCB TLSA TXT URI WKS X25 TYPE65400]
+    types.each do |type|
+      update = Dnsruby::Update.new('example.')
+      records = [update.present('owner.example.', type), update.absent('owner.example.', type),
+        update.delete('owner.example.', type)]
+      decoded = Dnsruby::Message.decode(update.encode)
+      actual = decoded.answer.to_a + decoded.authority.to_a
+      assert_equal(3, actual.length, type)
+      records.zip(actual).each do |record, copy|
+        assert_equal(record.type, copy.type, type)
+        assert_equal(record.klass, copy.klass, type)
+        assert_equal(0, copy.rdlength, type)
+        assert_equal('', copy.rdata_to_string, type)
+        assert_equal(0, copy.clone.rdlength, type)
+        assert_equal(record.class.superclass, copy.class.superclass, type)
+      end
+      assert_equal('', Dnsruby::RR.create("owner.example. 0 ANY #{type}").rdata_to_string, type)
+    end
+  end
+
+  def test_value_dependent_update_records_keep_their_data
+    update = Dnsruby::Update.new('example.')
+    update.present('owner.example.', 'MX', '10 mail.example.')
+    update.delete('owner.example.', 'MX', '10 mail.example.')
+    decoded = Dnsruby::Message.decode(update.encode)
+    assert_equal(Dnsruby::Classes::IN, decoded.answer.first.klass)
+    assert_equal(Dnsruby::Classes::NONE, decoded.authority.first.klass)
+    assert_equal('10 mail.example.', decoded.answer.first.rdata_to_string)
+    assert_equal('10 mail.example.', decoded.authority.first.rdata_to_string)
+  end
+
+  def test_escaped_owner_tokens_survive_zone_normalization
+    reader = Dnsruby::ZoneReader.new('example.', 300)
+    { 'space\\ name' => 'space name', 'trailing\\ ' => 'trailing ', 'quote\\"name' => 'quote"name',
+      'back\\\\slash' => 'back\\slash' }.each do |owner, label|
+      rr = Dnsruby::RR.create(reader.process_line("#{owner} IN TXT \"ordinary text\""))
+      assert_equal([label, 'example'], rr.name.labels.map(&:string))
+      assert_equal(['ordinary text'], rr.strings)
+      omitted = Dnsruby::RR.create(reader.process_line('  IN A 192.0.2.1'))
+      assert_equal(rr.name, omitted.name)
+    end
+    rr = Dnsruby::RR.create('space\\ name.example. 300 IN A 192.0.2.1')
+    assert_equal(['space name', 'example'], rr.name.labels.map(&:string))
+  end
+end

data/test/tc_query_control.rb

@@ -0,0 +1,90 @@
+require_relative 'tc_pipeline_send'
+
+class QueryControlTest < Minitest::Test
+  def test_cancelled_lookup_leaves_unrelated_queries_running
+    isolated(<<~'RUBY')
+      SELECTOR.singleton_class.remove_method(:notify_queue_observers)
+      resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false,
+        do_caching: false, retry_times: 1, query_timeout: 60)
+      submitted, finished = Queue.new, Queue.new
+      resolver.single_resolvers.each do |sender|
+        sender.define_singleton_method(:send_async) { |*| }
+      end
+      send_async = resolver.method(:send_async)
+      resolver.define_singleton_method(:send_async) do |*args|
+        id = send_async.call(*args)
+        submitted << true
+        id
+      end
+      unrelated = Queue.new
+      resolver.send_async(query('unrelated.example.'), unrelated, :unrelated)
+      submitted.pop
+      control = Dnsruby::QueryControl.new(deadline: Dnsruby::TransportClock.now + 30)
+      waiter = Thread.new do
+        begin
+          Dnsruby::QueryControl.with(control) do
+            resolver.query_no_validation_or_recursion('cancelled.example.', 'A')
+          end
+          finished << :unexpected_response
+        rescue Dnsruby::QueryControl::Cancelled => error
+          finished << [error, Dnsruby::QueryControl.current]
+        end
+      end
+      Timeout.timeout(3) { submitted.pop }
+      control.cancel
+      result = Timeout.timeout(3) { finished.pop }
+      waiter.join
+      raise 'wrong cancellation result' unless result.first.instance_of?(Dnsruby::QueryControl::Cancelled)
+      raise 'query control leaked into later work' unless result.last.nil?
+      engine = resolver.instance_variable_get(:@resolver_ruby)
+      raise 'cancelled another query or retained cancelled work' unless engine.instance_variable_get(:@query_list).keys == [:unrelated]
+      raise 'unrelated query completed' unless unrelated.empty?
+      resolver.close
+      raise 'lookup observer retained after close' unless K.class_variable_get(:@@observers).empty?
+    RUBY
+  end
+
+  def test_root_hint_address_lookups_obey_deadlines_and_cancellation
+    isolated(<<~'RUBY')
+      [:cancel, :timeout].each do |reason|
+        control = Dnsruby::QueryControl.new(deadline: Dnsruby::TransportClock.now + (reason == :timeout ? 0.02 : 30))
+        packet = Dnsruby::Message.new('.', 'NS')
+        packet.add_answer(Dnsruby::RR.create('. 300 IN NS ns.example.'))
+        resolver = Object.new
+        [:nameservers=, :recurse=].each { |name| resolver.define_singleton_method(name) { |*| } }
+        resolver.define_singleton_method(:single_resolvers) { [Object.new] }
+        resolver.define_singleton_method(:query_no_validation_or_recursion) { |*| packet }
+        sent, cancelled = [], []
+        engine = Object.new
+        engine.define_singleton_method(:cancel_query) { |id, queue| cancelled << [id, queue] }
+        resolver.instance_variable_set(:@resolver_ruby, engine)
+        resolver.define_singleton_method(:send_async) do |_message, queue|
+          id = sent.length
+          sent << [id, queue]
+          control.cancel if reason == :cancel && sent.length == 2
+          id
+        end
+        expected = reason == :cancel ? Dnsruby::QueryControl::Cancelled : Dnsruby::QueryControl::DeadlineExceeded
+        begin
+          Dnsruby::QueryControl.with(control) do
+            Dnsruby::Recursor.set_hints(['127.0.0.1'], resolver)
+          end
+          raise 'unfinished hint lookups returned successfully'
+        rescue expected
+        end
+        raise 'both A and AAAA lookups should have started' unless sent.length == 2
+        raise 'hint lookups were not cancelled' unless cancelled == sent
+        raise 'query control leaked after hint lookup failure' unless Dnsruby::QueryControl.current.nil?
+      end
+    RUBY
+  end
+
+  private
+
+  def isolated(code)
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, '-I', File.expand_path('../lib', __dir__),
+      '-e', TestPipelineSend::FIXTURE + code)
+    assert(status.success?, "#{stdout}\n#{stderr}")
+    assert_empty(stderr)
+  end
+end

data/test/tc_record_codec_contracts.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require_relative 'spec_helper'
+
+class TestRecordCodecContracts < Minitest::Test
+  include Dnsruby
+
+  def copy_record(record)
+    message = Message.new
+    message.add_answer(record)
+    Message.decode(message.encode).answer.first
+  end
+
+  def test_received_ttl_normalisation_leaves_ordinary_values_and_opt_fields_intact
+    [0, 300, 0x7fffffff].each do |ttl|
+      rr = RR.create(name: 'host.example.', type: 'A', address: '192.0.2.1', ttl: ttl)
+      assert_equal(ttl, copy_record(rr).ttl)
+    end
+    [0x80000000, 0xffffffff].each do |ttl|
+      rr = RR.create(name: 'host.example.', type: 'A', address: '192.0.2.1', ttl: ttl)
+      assert_equal(0, copy_record(rr).ttl)
+    end
+    opt = RR::OPT.new(1232, 0x80008000)
+    encoder = MessageEncoder.new { |out| out.put_rr(opt) }
+    assert_equal(opt.ttl, MessageDecoder.new(encoder.to_s).get_rr.ttl)
+  end
+
+  def test_a_root_name_requires_an_encoded_root_label
+    assert_equal('.', MessageDecoder.new("\0".b).get_name.to_s(true))
+    assert_raises(DecodeError) { MessageDecoder.new(''.b).get_name }
+    %w[NS CNAME PTR].each do |type|
+      assert_equal('.', copy_record(RR.create("owner.example. IN #{type} .")).domainname.to_s(true))
+    end
+    assert_equal('.', copy_record(RR.create('owner.example. IN MX 0 .')).exchange.to_s(true))
+    assert_equal('.', copy_record(RR.create('owner.example. IN SRV 0 0 0 .')).target.to_s(true))
+    assert_equal('.', copy_record(RR.create('owner.example. IN NAPTR 1 1 "" "" "" .')).replacement.to_s(true))
+  end
+
+  def test_empty_name_only_update_markers_keep_their_type_and_roundtrip
+    update = Update.new('example.')
+    %w[NS CNAME PTR].each do |type|
+      [update.present('owner.example.', type), update.absent('owner.example.', type),
+        update.delete('owner.example.', type)].each do |rr|
+        assert_equal(rr.type, rr.clone.type)
+        assert_equal(rr.klass, rr.clone.klass)
+      end
+    end
+    copy = Message.decode(update.encode)
+    assert_equal(update.encode, copy.encode)
+    assert_equal(update.answer.map(&:type), copy.answer.map(&:type))
+    assert_equal(update.authority.map(&:type), copy.authority.map(&:type))
+    %w[ANY NONE].each do |klass|
+      rr = RR.new_from_data('owner.example.', Types::NS, klass, 0, 0, ''.b, 0)
+      assert_equal(Classes.new(klass), rr.klass)
+      assert_equal(0, rr.domainname.length)
+    end
+  end
+
+  def test_rrsig_algorithm_octets_preserve_private_values
+    [8, 253, 254].each do |algorithm|
+      rr = RR.create(name: 'example.', type: 'RRSIG', type_covered: 'A',
+        algorithm: algorithm, labels: 1, original_ttl: 300, expiration: 2_000_000_000,
+        inception: 1_900_000_000, key_tag: 1234, signers_name: 'example.', signature: 'signature')
+      copy = copy_record(rr)
+      assert_equal(algorithm, copy.algorithm.code)
+      assert_equal(rr.sig_data, copy.sig_data)
+      assert_equal(rr, copy)
+    end
+  end
+
+  def test_caa_accepts_empty_values_extension_tags_and_unquoted_values
+    ['0 issue ""', '0 custom123 "opaque value"', '128 FutureTag token',
+      '0 issue ca.example', '0 issue "ca.example; account=123"'].each do |rdata|
+      rr = RR.create("example. IN CAA #{rdata}")
+      copy = copy_record(rr)
+      assert_equal(rr, copy)
+      assert_equal(rr, RR.create(rr.to_s))
+      assert_equal(rr.property_value, copy.property_value)
+    end
+  end
+
+  def test_caa_escapes_preserve_binary_values_and_long_strings
+    rr = RR.create('example. IN CAA 0 custom "quote\"slash\\\\tab\009byte\255"')
+    assert_equal("quote\"slash\\tab\tbyte\xff".b, rr.property_value)
+    assert_equal(rr, copy_record(rr))
+    assert_equal(rr, RR.create(rr.to_s))
+    long = RR.create(name: 'example.', type: 'CAA', flag: 0,
+      property_tag: 'custom', property_value: 'a' * 300)
+    assert_equal(long, copy_record(long))
+    assert_equal(long, RR.create(long.to_s))
+    %w[bad.tag bad-tag].each do |tag|
+      assert_raises(DecodeError) { RR.create("example. IN CAA 0 #{tag} value") }
+    end
+  end
+
+  def test_ds_family_equality_and_hash_use_the_same_binary_digest
+    %w[DS CDS DLV].each do |type|
+      lower = RR.create("example. IN #{type} 1234 8 2 #{'ab' * 32}")
+      upper = RR.create("example. IN #{type} 1234 8 2 #{'AB' * 32}")
+      assert_equal(lower, upper)
+      assert_equal(lower.hash, upper.hash)
+      assert_equal(:found, { lower => :found }[upper])
+      different = RR.create("example. IN #{type} 1234 8 2 #{'cd' * 32}")
+      refute_equal(lower, different)
+    end
+  end
+end

data/test/tc_record_regressions.rb

@@ -0,0 +1,225 @@
+require_relative 'spec_helper'
+require 'stringio'
+
+class TestRecordRegressions < Minitest::Test
+  include Dnsruby
+
+  def zone(text)
+    ZoneReader.new('example.').process_io(StringIO.new(text))
+  end
+
+  def rdata(rr)
+    MessageEncoder.new { |encoder| rr.encode_rdata(encoder) }.to_s
+  end
+
+  def wire_rr(type, klass, data)
+    # Build this without the encoder under test so malformed RDATA can reach
+    # both decoding entry points, including their actual class handling.
+    "\0".b + [type, klass, 0, data.bytesize].pack('nnNn') + data
+  end
+
+  def test_txt_layout_newlines_do_not_become_data
+    ['txt 60 IN TXT', 'txt IN TXT', 'txt TXT'].each do |prefix|
+      rr = zone("#{prefix} (\"one\" ; comment\n \"two\"\n)\n").first
+      assert_equal(['one', 'two'], rr.strings, prefix)
+      assert_equal('onetwo', rr.data, prefix)
+    end
+    rr = RR.create("txt.example. 60 IN TXT (\"one\"\n \"two\")")
+    assert_equal(['one', 'two'], rr.strings)
+  end
+
+  def test_literal_multiline_txt_preserves_whitespace_and_quoted_punctuation
+    rr = zone("txt 60 IN TXT (\"one  \n two;(three)\"\n \"four\")\n").first
+    assert_equal(["one  \n two;(three)", 'four'], rr.strings)
+    copy = MessageDecoder.new(wire_rr(16, 1, rdata(rr))).get_rr
+    assert_equal(rr.strings, copy.strings)
+  end
+
+  def test_manual_continuation_lines_without_terminating_newlines
+    reader = ZoneReader.new('example.')
+    assert_nil(reader.process_line('txt 60 IN TXT ("one"'))
+    line = reader.process_line('"two")')
+    assert_equal(['one', 'two'], RR.create(line).strings)
+  end
+
+  def test_known_and_unknown_rfc3597_layout_newlines
+    {'TYPE65400' => '01020304', 'A' => 'c0000201'}.each do |type, hex|
+      record = "name 60 IN #{type} ( \\# 4 #{hex[0, 4]}\n #{hex[4, 4]} )\n"
+      assert_equal(hex, rdata(zone(record).first).unpack1('H*'), type)
+      assert_equal(hex, rdata(RR.create(record)).unpack1('H*'), type)
+    end
+  end
+
+  def test_single_quoted_txt_and_spf_keep_literal_punctuation
+    %w[TXT SPF TYPE16 TYPE99].each do |type|
+      text = "txt 60 IN #{type} ('one(two);three' 'four')"
+      assert_equal(['one(two);three', 'four'], RR.create(text).strings, type)
+      assert_equal(['one(two);three', 'four'], zone(text).first.strings, type)
+      inherited_owner = zone("txt 60 IN #{type} 'first'\n IN #{type} 'two(three)'\n")
+      assert_equal(['two(three)'], inherited_owner.last.strings, type)
+    end
+    assert_equal(["one  \n two(three)"], zone("txt IN TXT ('one  \n two(three)')\n").first.strings)
+    assert_equal(['one(two)'], zone("o'clock IN TXT 'one(two)'\n").first.strings)
+  end
+
+  def test_apostrophes_are_ordinary_characters_in_other_record_formats
+    record = zone("svc IN SVCB (1 o'clock.example. ; comment\n port=443)\n").first
+    assert_equal("o'clock.example.", record.target.to_s(true))
+    assert_equal('443', record.params_to_hash['port'])
+  end
+
+  def test_adjacent_quoted_txt_strings_keep_literal_punctuation
+    ["'one''two(three);four'", "\"one\"'two(three);four'",
+     "'one'\"two(three);four\""].each do |value|
+      %w[TXT SPF].each do |type|
+        text = "txt IN #{type} #{value}"
+        assert_equal(['one', 'two(three);four'], RR.create(text).strings, text)
+        assert_equal(['one', 'two(three);four'], zone(text).first.strings, text)
+      end
+    end
+  end
+
+  def test_grouping_parentheses_touching_the_type_and_header
+    ["txt IN TXT('one(two)')", "txt IN(TXT('one(two)'))",
+     "txt\\(name IN TXT('one(two)')", "o'clock IN TXT('one(two)')",
+     "'host.example IN TXT 'one(two)'"].each do |text|
+      assert_equal(['one(two)'], RR.create(text).strings, text)
+      assert_equal(['one(two)'], zone(text).first.strings, text)
+    end
+  end
+
+  def test_non_in_svcb_and_https_zone_records_remain_opaque
+    [64, 65].each do |type|
+      [Classes::CH, Classes::HS, 65_280].each do |klass|
+        rr = zone("name 60 CLASS#{klass} TYPE#{type} \\# 3 000100\n").first
+        assert_kind_of(RR::Generic, rr)
+        assert_equal(klass, rr.klass)
+        assert_equal('000100', rdata(rr).unpack1('H*'))
+      end
+    end
+  end
+
+  def test_svcb_target_must_be_complete_and_uncompressed
+    [64, 65].each do |type|
+      # Priority only; unterminated label list; truncated label; pointer.
+      %w[0001 00010161 00010361 0001c000].each do |hex|
+        data = [hex].pack('H*')
+        assert_raises(DecodeError, "TYPE#{type} #{hex}") do
+          RR.new_from_data('.', type, Classes::IN, 0, data.bytesize, data, 0)
+        end
+        assert_raises(DecodeError, "TYPE#{type} #{hex}") do
+          MessageDecoder.new(wire_rr(type, Classes::IN, data)).get_rr
+        end
+      end
+      data = ['000100'].pack('H*')
+      assert_equal('.', MessageDecoder.new(wire_rr(type, Classes::IN, data)).get_rr.target.to_s(true))
+    end
+  end
+
+  def test_empty_svcb_wire_data_only_decodes_for_update_classes
+    [64, 65].each do |type|
+      assert_raises(DecodeError) { RR.new_from_data('.', type, Classes::IN, 0, 0, ''.b, 0) }
+      assert_raises(DecodeError) { MessageDecoder.new(wire_rr(type, Classes::IN, ''.b)).get_rr }
+      [Classes::ANY, Classes::NONE].each do |klass|
+        rr = RR.new_from_data('.', type, klass, 0, 0, ''.b, 0)
+        assert_equal(klass, rr.klass)
+        assert_equal('', rdata(rr))
+        copy = MessageDecoder.new(wire_rr(type, klass, ''.b)).get_rr
+        assert_equal(klass, copy.klass)
+        assert_equal('', rdata(copy))
+      end
+      # Empty objects used to build UPDATE messages remain constructible.
+      assert_nil(RR.create(name: '.', type: type).priority)
+    end
+  end
+
+  def test_svcb_rejects_oversized_values_at_construction_and_after_mutation
+    [64, 65].each do |type|
+      assert_raises(DecodeError) do
+        RR.create(name: '.', type: type, priority: 1, target: '.', params: {key667: 'x' * 65_536})
+      end
+      rr = RR.create(name: '.', type: type, priority: 1, target: '.')
+      rr.params[667] = 'x' * 65_536
+      assert_raises(EncodeError) { rdata(rr) }
+    end
+  end
+
+  def test_svcb_total_rdata_length_boundary
+    rr = RR.create(name: '.', type: 64, priority: 1, target: '.')
+    rr.params[667] = 'x' * 65_528 # 2 priority + 1 root + 4 param header.
+    bytes = rdata(rr)
+    assert_equal(65_535, bytes.bytesize)
+    assert_equal(bytes, rdata(MessageDecoder.new(wire_rr(64, 1, bytes)).get_rr))
+    rr.params[667] << 'x'
+    assert_raises(EncodeError) { rdata(rr) }
+
+    rr.params = {667 => 'x' * 32_764, 668 => 'x' * 32_764}
+    assert_raises(EncodeError) { rdata(rr) }
+    rr.params = {667 => 'x' * 65_528}
+    rr.target = Name.create('a.')
+    assert_raises(EncodeError) { rdata(rr) }
+  end
+
+  def test_mutated_utf8_svcparam_is_encoded_as_octets
+    rr = RR.create(name: '.', type: 64, priority: 1, target: '.')
+    rr.params[667] = 'é'
+    encoder = MessageEncoder.new { |output| output.put_rr(rr) }
+    copy = MessageDecoder.new(encoder.to_s).get_rr
+    assert_equal('é'.b, copy.params[667])
+    assert_equal(9, rdata(copy).bytesize)
+  end
+
+  def test_generic_length16_field_does_not_wrap
+    encoder = MessageEncoder.new
+    encoder.put_length16 { encoder.put_bytes('x' * 65_535) }
+    assert_equal(65_535, encoder.to_s.unpack1('n'))
+    assert_raises(EncodeError) do
+      encoder = MessageEncoder.new
+      encoder.put_length16 { encoder.put_bytes('x' * 65_536) }
+    end
+    assert_raises(EncodeError) do
+      encoder = MessageEncoder.new
+      encoder.put_length16 { encoder.put_bytes('é' * 32_768) }
+    end
+  end
+
+  def test_length16_cannot_extend_a_physical_or_nested_buffer
+    decoder = MessageDecoder.new([5].pack('n') + 'abc')
+    assert_raises(DecodeError) { decoder.get_length16 { flunk('decoded outside physical buffer') } }
+    assert_equal('abc', decoder.get_bytes, 'failed boundary check must restore the enclosing limit')
+
+    # The inner length exceeds its containing item, but not the whole packet.
+    decoder = MessageDecoder.new([4, 5].pack('nn') + 'ab' + 'trailer')
+    decoder.get_length16 do
+      assert_raises(DecodeError) { decoder.get_length16 { flunk('decoded outside nested buffer') } }
+      assert_equal('ab', decoder.get_bytes)
+    end
+    assert_equal('trailer', decoder.get_bytes)
+  end
+
+  def test_length16_restores_enclosing_limit_when_the_parser_raises
+    decoder = MessageDecoder.new([4, 2].pack('nn') + 'ab' + 'trailer')
+    decoder.get_length16 do
+      assert_raises(DecodeError) do
+        decoder.get_length16 { raise DecodeError, 'malformed nested value' }
+      end
+      assert_equal('ab', decoder.get_bytes)
+    end
+    assert_equal('trailer', decoder.get_bytes)
+  end
+
+  def test_truncated_svcb_and_https_preserve_partial_header_at_every_byte
+    bytes = ['0001000003000201bb'].pack('H*')
+    [64, 65].each do |type|
+      header = [123, 0x8200, 0, 1, 0, 0].pack('n6')
+      complete = header + wire_rr(type, Classes::IN, bytes)
+      bytes.bytesize.times do |length|
+        truncated = complete.byteslice(0, complete.bytesize - bytes.bytesize + length)
+        error = assert_raises(DecodeError, "TYPE#{type} with #{length} RDATA bytes") { Message.decode(truncated) }
+        assert(error.partial_message.header.tc)
+        assert_equal(123, error.partial_message.header.id)
+      end
+      assert_equal(bytes, Message.decode(complete).answer.first.rdata)
+    end
+  end
+end

data/test/tc_recur.rb

@@ -22,6 +22,7 @@ class TestRecur < Minitest::Test
     r = Dnsruby::Recursor.new
     ret = with_retries(max_attempts: 10, exceptions: [Dnsruby::ResolvError]) { r.query("uk", Dnsruby::Types.DNSKEY) }
     assert ret.answer.length > 0, "Answer length should > 0, but was #{ret.answer.length}."
+    assert_equal(Dnsruby::Message::SecurityLevel.SECURE, ret.security_level)
 #    ret = r.query_dorecursion("aaa.bigzone.uk-dnssec.nic.uk", Dnsruby::Types.DNSKEY)
 #    ret = r.query_dorecursion("uk-dnssec.nic.uk", Dnsruby::Types.DNSKEY)
   end