dnsruby 1.73.1 → 2.0.0

data/test/tc_release_dnssec_fixes.rb

@@ -0,0 +1,305 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+
+# Decision-level tests use metadata doubles and mock cryptographic verification;
+# ordinary published root fixtures exercise DS identity without generating keys.
+class ReleaseDnssecFixesTest < Minitest::Test
+  def setup
+    @verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    @zone = Dnsruby::Name.create('example.')
+    @child = Dnsruby::Name.create('child.example.')
+    @anchor = metadata_double(name: @zone, klass: Dnsruby::Classes.IN, type: Dnsruby::Types.DNSKEY)
+    @saved_recursor = Dnsruby::Dnssec.do_validation_with_recursor?
+    Dnsruby::Dnssec.do_validation_with_recursor(false)
+  end
+
+  def teardown
+    Dnsruby::Dnssec.do_validation_with_recursor(@saved_recursor)
+  end
+
+  def test_signature_metadata_requires_zone_authority_and_apex_dnskeys
+    [[@child, 'A', @zone, true], [@zone, 'DNSKEY', @zone, true],
+      [@child, 'DNSKEY', @zone, false], [@child, 'DS', @zone, true],
+      [@child, 'DS', @child, false], [@zone, 'A', @child, false]].each do |owner, type, signer, valid|
+      rrset = metadata_double(name: owner, klass: Dnsruby::Classes.IN, type: Dnsruby::Types.new(type))
+      signature = metadata_double(name: owner, klass: rrset.klass, type_covered: rrset.type,
+        signers_name: signer, labels: owner.labels.length, inception: Time.now.to_i - 60,
+        expiration: Time.now.to_i + 60)
+      if valid
+        @verifier.check_rr_data(rrset, signature)
+      else
+        assert_raises(Dnsruby::VerifyError) { @verifier.check_rr_data(rrset, signature) }
+      end
+    end
+  end
+
+  def test_zone_key_flag_is_required_without_sep
+    key = Object.new
+    def key.zone_key?; false; end
+    error = assert_raises(Dnsruby::VerifyError) { @verifier.send(:verify_rrset_with_key, nil, key, nil) }
+    assert_match(/Zone Key flag/, error.message)
+  end
+
+  def test_dsa_algorithms_are_rejected_before_crypto
+    key = Object.new
+    def key.zone_key?; true; end
+    [3, 6].each do |algorithm|
+      signature = metadata_double(algorithm: Dnsruby::Algorithms.new(algorithm))
+      error = assert_raises(Dnsruby::VerifyError) do
+        @verifier.send(:verify_rrset_with_key, nil, key, signature)
+      end
+      assert_match(/prohibited/, error.message)
+    end
+  end
+
+  def test_ds_binds_owner_and_class_while_dlv_keeps_lookaside_owner_semantics
+    fixture = File.join(__dir__, 'fixtures', 'root-dnskey-2026-11-05.zone')
+    key = Dnsruby::RR.create(File.readlines(fixture).find { |line| line.include?(' IN DNSKEY ') })
+    ds = Dnsruby::RR::DS.from_key(key, 2)
+    assert(ds.check_key(key))
+    ds.name = 'example.'
+    refute(ds.check_key(key))
+    ds.name = key.name
+    ds.klass = Dnsruby::Classes.CH
+    refute(ds.check_key(key))
+    dlv = Dnsruby::RR.create(Dnsruby::RR::DS.from_key(key, 2).to_s.sub(/\bDS\b/, 'DLV'))
+    dlv.name = 'example.dlv.invalid.'
+    assert(dlv.check_key(key))
+    dlv.klass = Dnsruby::Classes.CH
+    refute(dlv.check_key(key))
+  end
+
+  def test_worker_rejects_false_or_bogus_without_an_exception
+    [[false, Dnsruby::Message::SecurityLevel.INSECURE],
+      [true, Dnsruby::Message::SecurityLevel.BOGUS]].each do |result, level|
+      worker = Dnsruby::ValidatorThread.allocate
+      worker.define_singleton_method(:should_validate) { true }
+      response = Dnsruby::Message.new('example.')
+      response.security_level = level
+      Dnsruby::Dnssec.stub(:validate_with_query, result) do
+        refute(worker.validate(Dnsruby::Message.new('example.'), response, nil))
+      end
+      assert_instance_of(Dnsruby::VerifyError, response.security_error)
+      assert_equal(Dnsruby::Message::SecurityLevel.BOGUS, response.security_level)
+    end
+  end
+
+  def test_policy_fallback_cannot_erase_failure_with_insecure_result
+    previous = Dnsruby::Dnssec.validation_policy
+    query = Dnsruby::Message.new('example.')
+    query.header.cd = true
+    insecure = ->(message, _) { message.security_level = Dnsruby::Message::SecurityLevel.INSECURE; true }
+    failure = ->(*) { raise Dnsruby::VerifyError, 'missing authenticated delegation' }
+    secure = ->(message, _) { message.security_level = Dnsruby::Message::SecurityLevel.SECURE; true }
+    [Dnsruby::Dnssec::ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT,
+      Dnsruby::Dnssec::ValidationPolicy::ROOT_THEN_LOCAL_ANCHORS].each do |policy|
+      Dnsruby::Dnssec.validation_policy = policy
+      Dnsruby::Dnssec.stub(:validate_with_anchors, insecure) do
+        Dnsruby::Dnssec.stub(:validate_with_root, failure) do
+          Dnsruby::Dnssec.stub(:validate_with_dlv, insecure) do
+            response = Dnsruby::Message.new('example.')
+            assert_raises(Dnsruby::VerifyError) { Dnsruby::Dnssec.validate_with_query(query, response) }
+            assert_equal(Dnsruby::Message::SecurityLevel.BOGUS, response.security_level)
+          end
+        end
+      end
+    end
+    Dnsruby::Dnssec.validation_policy = Dnsruby::Dnssec::ValidationPolicy::ROOT_THEN_LOCAL_ANCHORS
+    Dnsruby::Dnssec.stub(:validate_with_root, failure) do
+      Dnsruby::Dnssec.stub(:validate_with_anchors, secure) do
+        response = Dnsruby::Message.new('example.')
+        assert(Dnsruby::Dnssec.validate_with_query(query, response))
+        assert_equal(Dnsruby::Message::SecurityLevel.SECURE, response.security_level)
+        assert_equal('', response.security_error)
+      end
+    end
+  ensure
+    Dnsruby::Dnssec.validation_policy = previous
+  end
+
+  def test_ds_lookup_failure_or_unproven_absence_does_not_mean_insecure
+    response = Dnsruby::Message.new(@child, 'DS')
+    [->(*) { raise Dnsruby::ServFail, 'lookup failed' }, ->(*) { response }].each do |query|
+      resolver = Object.new
+      resolver.define_singleton_method(:query_no_validation_or_recursion, query)
+      assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@child, @zone, @anchor, resolver) }
+    end
+  end
+
+  def test_missing_or_unsigned_dnskey_is_a_verification_failure
+    response = Dnsruby::Message.new(@zone, 'DNSKEY')
+    resolver = Object.new
+    resolver.define_singleton_method(:query_no_validation_or_recursion) { |*| response }
+    @verifier.stub(:get_nameservers_for, resolver) do
+      assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@zone, @zone, @anchor, resolver) }
+      fixture = File.join(__dir__, 'fixtures', 'root-dnskey-2026-11-05.zone')
+      key = Dnsruby::RR.create(File.readlines(fixture).find { |line| line.include?(' IN DNSKEY ') })
+      key.name = @zone
+      response.add_answer(key)
+      assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@zone, @zone, @anchor, resolver) }
+    end
+  end
+
+  def test_unsigned_ds_does_not_establish_child_trust
+    response = Dnsruby::Message.new(@child, 'DS')
+    response.add_answer(Dnsruby::RR.create('child.example. 60 IN DS 1 8 2 ' + '00' * 32))
+    resolver = Object.new
+    resolver.define_singleton_method(:query_no_validation_or_recursion) { |*| response }
+    assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@child, @zone, @anchor, resolver) }
+  end
+
+  def test_only_authenticated_all_unsupported_ds_sets_are_insecure
+    [[3, 6], [17]].each do |algorithms|
+      message = Dnsruby::Message.new(@child, 'DS')
+      algorithms.each do |algorithm|
+        message.add_answer(Dnsruby::RR.create("child.example. 60 IN DS 1 #{algorithm} 2 " + '00' * 32))
+      end
+      calls = []
+      resolver = Object.new
+      resolver.define_singleton_method(:query_no_validation_or_recursion) do |name, type|
+        calls << type
+        message
+      end
+      @verifier.stub(:verify, true) do
+        key, returned_resolver = @verifier.get_anchor_for(@child, @zone, @anchor, resolver)
+        assert_equal(false, key)
+        assert_same(resolver, returned_resolver)
+        assert_equal([Dnsruby::Types.DS], calls)
+      end
+      @verifier.stub(:verify, false) do
+        assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@child, @zone, @anchor, resolver) }
+      end
+    end
+  end
+
+  def test_cached_unsupported_ds_requires_live_provenance_before_insecure_classification
+    record = Dnsruby::RR.create('child.example. 60 IN DS 1 3 2 ' + '00' * 32)
+    [record, Dnsruby::RRSet.new([record])].each do |anchor|
+      admitted = []
+      @verifier.stub(:admit_learned_rrset, ->(input) { admitted << input }) do
+        @verifier.stub(:get_nameservers_for, ->(*) { flunk('unsupported DS must not fetch DNSKEY') }) do
+          result = @verifier.get_anchor_for(@child, @child, anchor)
+          assert_equal([false, nil], result)
+          assert_equal([anchor], admitted)
+        end
+      end
+      @verifier.stub(:admit_learned_rrset, ->(*) { raise Dnsruby::VerifyError, 'expired learned trust' }) do
+        assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@child, @child, anchor) }
+      end
+    end
+  end
+
+  def test_cached_mixed_ds_still_requires_child_authentication
+    records = [3, 8].map { |algorithm| Dnsruby::RR.create("child.example. 60 IN DS 1 #{algorithm} 2 " + '00' * 32) }
+    anchor = Dnsruby::RRSet.new(records)
+    response = Dnsruby::Message.new(@child, 'DNSKEY')
+    calls = []
+    resolver = Object.new
+    resolver.define_singleton_method(:query_no_validation_or_recursion) do |name, type|
+      calls << type
+      response
+    end
+    @verifier.stub(:get_nameservers_for, resolver) do
+      assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@child, @child, anchor, resolver) }
+    end
+    assert_equal([Dnsruby::Types.DNSKEY], calls)
+  end
+
+  def test_mixed_ds_algorithms_still_require_an_authenticated_child_key
+    ds = Dnsruby::Message.new(@child, 'DS')
+    [3, 8].each do |algorithm|
+      ds.add_answer(Dnsruby::RR.create("child.example. 60 IN DS 1 #{algorithm} 2 " + '00' * 32))
+    end
+    keys = Dnsruby::Message.new(@child, 'DNSKEY')
+    calls = []
+    resolver = Object.new
+    resolver.define_singleton_method(:query_no_validation_or_recursion) do |name, type|
+      calls << type
+      type == Dnsruby::Types.DS ? ds : keys
+    end
+    @verifier.stub(:verify, true) do
+      @verifier.stub(:get_nameservers_from_message, resolver) do
+        assert_raises(Dnsruby::VerifyError) { @verifier.get_anchor_for(@child, @zone, @anchor, resolver) }
+      end
+    end
+    assert_equal([Dnsruby::Types.DS, Dnsruby::Types.DNSKEY], calls)
+  end
+
+  def test_only_authenticated_delegation_denial_returns_insecure
+    %w[NSEC NSEC3].each do |type|
+      ['A', 'NS'].each do |types|
+        record = if type == 'NSEC'
+          Dnsruby::RR.create("child.example. 60 IN NSEC z.example. #{types} RRSIG NSEC")
+        else
+          nsec3 = Dnsruby::RR.create('example. 60 IN NSEC3 1 0 0 - 00000000000000000000000000000000')
+          hashed = nsec3.hash_name(@child)
+          Dnsruby::RR.create("#{hashed}.example. 60 IN NSEC3 1 0 0 - #{hashed} #{types}")
+        end
+        signature = metadata_double(signers_name: @zone, labels: record.name.labels.length)
+        proof = metadata_double(name: record.name, klass: record.klass, type: record.type, rrs: [record], sigs: [signature])
+        authority = Object.new
+        authority.define_singleton_method(:rrsets) { |requested| requested == record.type ? [proof] : [] }
+        message = metadata_double(question: [Dnsruby::Question.new(@child, 'DS')],
+          authority: authority, rcode: Dnsruby::RCode.NOERROR)
+        # Stub construction at the crypto boundary; the denial bitmap and hash
+        # matching decisions remain real, and no signed DNS response is created.
+        Dnsruby::RRSet.stub(:new, proof) do
+          @verifier.stub(:verify_rrset, true) do
+            expected = types == 'NS' ? :insecure : :secure
+            assert_equal(expected, @verifier.send(:authenticated_ds_absence, message, @child, @anchor))
+          end
+          @verifier.stub(:verify_rrset, ->(*) { raise Dnsruby::VerifyError, 'not authenticated' }) do
+            assert_raises(Dnsruby::VerifyError) do
+              @verifier.send(:authenticated_ds_absence, message, @child, @anchor)
+            end
+          end
+        end
+      end
+    end
+  end
+
+  def test_actual_wildcard_nsec_signature_is_eligible_as_denial_evidence
+    record = Dnsruby::RR.create('*.example. 60 IN NSEC z.example. A RRSIG NSEC')
+    signature = metadata_double(signers_name: @zone, labels: 1)
+    proof = metadata_double(name: record.name, klass: record.klass, type: record.type, rrs: [record], sigs: [signature])
+    authority = Object.new
+    authority.define_singleton_method(:rrsets) { |type| type == Dnsruby::Types.NSEC ? [proof] : [] }
+    message = metadata_double(question: [Dnsruby::Question.new(@child, 'DS')],
+      authority: authority, rcode: Dnsruby::RCode.NOERROR)
+    verified = false
+    Dnsruby::RRSet.stub(:new, proof) do
+      @verifier.stub(:verify_rrset, ->(*) { verified = true }) do
+        @verifier.stub(:nsec_denial, :secure) do
+          assert_equal(:secure, @verifier.send(:authenticated_ds_absence, message, @child, @anchor))
+          assert(verified)
+        end
+      end
+    end
+  end
+
+  def test_non_delegation_keeps_parent_anchor_without_querying_child_dnskey
+    resolver = Object.new
+    response = Dnsruby::Message.new(@child, 'DS')
+    calls = []
+    resolver.define_singleton_method(:query_no_validation_or_recursion) do |name, type|
+      calls << [name, type]
+      response
+    end
+    @verifier.stub(:authenticated_ds_absence, :secure) do
+      key, returned_resolver = @verifier.get_anchor_for(@child, @zone, @anchor, resolver)
+      assert_same(@anchor, key)
+      assert_same(resolver, returned_resolver)
+      assert_equal([[@child, Dnsruby::Types.DS]], calls)
+    end
+  end
+
+  private
+
+  def metadata_double(**attributes)
+    Object.new.tap do |object|
+      attributes.each do |name, value|
+        object.define_singleton_method(name) { value }
+      end
+    end
+  end
+end

data/test/tc_release_negative_cache.rb

@@ -0,0 +1,327 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+
+class ReleaseNegativeCacheTest < Minitest::Test
+  def setup
+    @now = Time.utc(2026, 11, 14, 12)
+  end
+
+  def test_negative_lifetime_is_the_lesser_of_soa_ttl_and_minimum
+    [[:NXDOMAIN, 80, 15], [:NOERROR, 10, 80]].each do |rcode, ttl, minimum|
+      cache = Dnsruby::Cache.new
+      response = negative(rcode, ttl: ttl, minimum: minimum)
+      lifetime = [ttl, minimum].min
+      Time.stub(:now, @now) { cache.add(response) }
+      Time.stub(:now, @now + lifetime - 1) do
+        found = cache.find('missing.example.', 'A')
+        assert_equal(1, found.authority.first.ttl)
+        assert_equal(rcode.to_s, found.rcode.to_s)
+      end
+      Time.stub(:now, @now + lifetime) { assert_nil(cache.find('missing.example.', 'A')) }
+    end
+  end
+
+  def test_plain_name_error_is_shared_across_types_but_nodata_is_not
+    [:NXDOMAIN, :NOERROR].each do |rcode|
+      cache = Dnsruby::Cache.new
+      cache.add(negative(rcode))
+      found = cache.find('missing.example.', 'AAAA')
+      if rcode == :NXDOMAIN
+        assert_equal(Dnsruby::Types::AAAA, found.question.first.qtype)
+      else
+        assert_nil(found)
+      end
+      assert_nil(cache.find('missing.example.', 'A', 'CH'))
+    end
+  end
+
+  def test_alias_name_error_does_not_claim_the_alias_itself_is_absent
+    cache = Dnsruby::Cache.new
+    response = negative(:NXDOMAIN, name: 'alias.example.')
+    response.add_answer(Dnsruby::RR.create('alias.example. 90 IN CNAME missing.example.'))
+    cache.add(response)
+    refute_nil(cache.find('alias.example.', 'A'))
+    assert_nil(cache.find('alias.example.', 'CNAME'))
+  end
+
+  def test_negative_without_enclosing_soa_or_with_zero_lifetime_is_not_cached
+    cache = Dnsruby::Cache.new
+    response = Dnsruby::Message.new('missing.example.', 'A')
+    response.header.rcode = Dnsruby::RCode::NXDOMAIN
+    assert_nil(cache.add(response))
+    response.add_authority(Dnsruby::RR.create('other. 30 IN SOA ns.other. hostmaster.other. 1 60 60 60 30'))
+    assert_nil(cache.add(response))
+    assert_nil(cache.add(negative(:NOERROR, minimum: 0)))
+    assert_equal(0, cache.length)
+  end
+
+  def test_alias_nodata_never_enters_the_global_positive_cache
+    Dnsruby::PacketSender.clear_caches
+    query = Dnsruby::Message.new('alias.example.', 'A')
+    query.header.rd = true
+    response = negative(:NOERROR, name: 'alias.example.')
+    response.add_answer(Dnsruby::RR.create('alias.example. 90 IN CNAME missing.example.'))
+    Dnsruby::PacketSender.cache(query, response)
+    assert_equal(0, Dnsruby::PacketSender.recursive_cache_length)
+  ensure
+    Dnsruby::PacketSender.clear_caches
+  end
+
+  def test_resolver_caches_completed_name_errors_and_retains_client_id
+    with_resolver(lambda { |query| [negative(:NXDOMAIN, name: query.question.first.qname), Dnsruby::NXDomain.new] }) do |resolver, attempts|
+      first = ask(resolver)
+      second = ask(resolver)
+      assert_equal(1, attempts.call)
+      assert_instance_of(Dnsruby::NXDomain, first[2])
+      assert_instance_of(Dnsruby::NXDomain, second[2])
+      assert(second[1].cached)
+      refute_equal(first[0], second[0])
+      assert_equal(second[0], second[1].header.id)
+    end
+  end
+
+  def test_resolver_configuration_and_validation_policy_scope_negative_answers
+    original_policy = Dnsruby::Dnssec.validation_policy
+    with_resolver(lambda { |_query| [negative(:NOERROR), nil] }) do |resolver, attempts|
+      ask(resolver)
+      resolver.port = 1053
+      ask(resolver)
+      assert_equal(2, attempts.call)
+      Dnsruby::Dnssec.validation_policy = original_policy == 1 ? 2 : 1
+      ask(resolver)
+      assert_equal(3, attempts.call)
+    end
+  ensure
+    Dnsruby::Dnssec.validation_policy = original_policy
+  end
+
+  def test_opt_identity_is_binary_and_includes_payload_flags_and_options
+    with_resolver(lambda { |_query| [negative(:NOERROR), nil] }) do |resolver, attempts|
+      2.times do |index|
+        query = Dnsruby::Message.new('missing.example.', 'A')
+        query.add_additional(Dnsruby::RR::OPT.new(1232, 0,
+          [Dnsruby::RR::OPT::Option.new(65001, "value#{index}")]))
+        ask(resolver, query)
+      end
+      assert_equal(2, attempts.call)
+    end
+  end
+
+  def test_raw_disabled_caching_tsig_and_update_queries_bypass_completion_cache
+    with_resolver(lambda { |_query| [negative(:NOERROR), nil] }) do |resolver, attempts|
+      ask(resolver)
+      query = Dnsruby::Message.new('missing.example.', 'A')
+      query.do_caching = false
+      ask(resolver, query)
+      raw = Dnsruby::Message.new('missing.example.', 'A')
+      raw.send_raw = true
+      ask(resolver, raw)
+      assert_equal(3, attempts.call)
+      engine = resolver.instance_variable_get(:@resolver_ruby)
+      assert_nil(engine.send(:response_cache_scope, Dnsruby::Update.new('example.')))
+      resolver.tsig = ['key.example.', 'c2VjcmV0']
+      assert_nil(engine.send(:response_cache_scope, Dnsruby::Message.new('missing.example.', 'A')))
+    end
+  end
+
+  def test_failed_resolution_is_cached_for_one_second_then_retried
+    clock = 100.0
+    Dnsruby::TransportClock.stub(:now, -> { clock }) do
+      with_resolver(lambda { |_query| [nil, Dnsruby::ServFail.new('temporarily unavailable')] }) do |resolver, attempts|
+        assert_instance_of(Dnsruby::ServFail, ask(resolver)[2])
+        assert_instance_of(Dnsruby::ServFail, ask(resolver)[2])
+        assert_equal(1, attempts.call)
+        clock += 1
+        ask(resolver)
+        assert_equal(2, attempts.call)
+      end
+    end
+  end
+
+  def test_controlled_ordinary_failures_are_cached_but_cancellation_is_not
+    cache = Dnsruby::Cache::ResolutionCache.new
+    query = Dnsruby::Message.new('missing.example.', 'A')
+    control = Dnsruby::QueryControl.new
+    cache.add(query, [:scope], nil, Dnsruby::ServFail.new, control: control)
+    assert_instance_of(Dnsruby::ServFail, cache.find(query, [:scope]).last)
+    control.cancel
+    cache.add(query, [:cancelled], nil, Dnsruby::ResolvTimeout.new, control: control)
+    assert_nil(cache.find(query, [:cancelled]))
+    cache.add(query, [:budget], nil, Dnsruby::ValidationLimitError.new)
+    assert_instance_of(Dnsruby::ValidationLimitError, cache.find(query, [:budget]).last)
+    cache.add(query, [:cancelled_validation], nil, Dnsruby::ValidationCancelled.new)
+    assert_nil(cache.find(query, [:cancelled_validation]))
+    cache.add(query, [:inherited_budget], nil, Dnsruby::ValidationLimitError.new,
+      control: Dnsruby::QueryControl.new)
+    assert_nil(cache.find(query, [:inherited_budget]))
+  end
+
+  def test_cached_validation_failure_preserves_security_state_and_ages_rr_ttl
+    cache = Dnsruby::Cache::ResolutionCache.new
+    query = Dnsruby::Message.new('missing.example.', 'A')
+    response = Dnsruby::Message.new('missing.example.', 'A')
+    response.add_answer(Dnsruby::RR.create('missing.example. 90 IN A 192.0.2.1'))
+    response.security_level = Dnsruby::Message::SecurityLevel::BOGUS
+    response.security_error = 'verification failed'
+    Time.stub(:now, @now) { cache.add(query, [:scope], response, Dnsruby::VerifyError.new('verification failed')) }
+    Time.stub(:now, @now + 1) do
+      cached, error = cache.find(query, [:scope])
+      assert_equal(89, cached.answer.first.ttl)
+      assert_equal(Dnsruby::Message::SecurityLevel::BOGUS, cached.security_level)
+      assert_equal('verification failed', cached.security_error)
+      assert_instance_of(Dnsruby::VerifyError, error)
+    end
+  end
+
+  def test_insecure_negative_requires_and_preserves_authenticated_proof_lifetime
+    cache = Dnsruby::Cache::ResolutionCache.new
+    query = Dnsruby::Message.new('missing.example.', 'A')
+    query.do_validation = true
+    response = negative(:NOERROR)
+    response.security_level = Dnsruby::Message::SecurityLevel::INSECURE
+    Time.stub(:now, @now) do
+      cache.add(query, [:scope], response, nil)
+      assert_nil(cache.find(query, [:scope]))
+      response.instance_variable_set(:@dnsruby_authenticated_expiration, @now.to_i + 3)
+      cache.add(query, [:scope], response, nil)
+    end
+    Time.stub(:now, @now + 2) do
+      found, error = cache.find(query, [:scope])
+      assert_nil(error)
+      assert_equal(1, found.authority.first.ttl)
+      assert_equal(@now.to_i + 3, found.instance_variable_get(:@dnsruby_authenticated_expiration))
+    end
+    Time.stub(:now, @now + 3) { assert_nil(cache.find(query, [:scope])) }
+  end
+
+  def test_configuration_change_during_resolution_prevents_insertion
+    selected = nil
+    producer = lambda do |_query|
+      selected.query_timeout = 7
+      [negative(:NOERROR), nil]
+    end
+    with_resolver(producer) do |resolver, attempts|
+      selected = resolver
+      ask(resolver)
+      ask(resolver)
+      assert_equal(2, attempts.call)
+      ask(resolver)
+      assert_equal(2, attempts.call)
+    end
+  end
+
+  def test_explicit_clear_invalidates_resolver_completion_cache
+    with_resolver(lambda { |_query| [negative(:NOERROR), nil] }) do |resolver, attempts|
+      ask(resolver)
+      Dnsruby::PacketSender.clear_caches
+      ask(resolver)
+      assert_equal(2, attempts.call)
+    end
+  end
+
+  private
+
+  def negative(rcode, ttl: 80, minimum: 15, name: 'missing.example.')
+    response = Dnsruby::Message.new(name, 'A')
+    response.header.rcode = Dnsruby::RCode.new(rcode.to_s)
+    response.add_authority(Dnsruby::RR.create("example. #{ttl} IN SOA ns.example. hostmaster.example. 1 60 60 60 #{minimum}"))
+    response
+  end
+
+  def ask(resolver, message = Dnsruby::Message.new('missing.example.', 'A'))
+    queue = Queue.new
+    @id = (@id || 100) + 1
+    message.header.id = @id
+    resolver.send_async(message, queue, @id)
+    queue.pop
+  end
+
+  def with_resolver(producer)
+    resolver = Dnsruby::Resolver.new(nameserver: ['192.0.2.53'])
+    engine = Dnsruby::ResolverRuby.new(resolver)
+    resolver.instance_variable_set(:@resolver_ruby, engine)
+    selector = Object.new
+    selector.define_singleton_method(:add_observer) { |*_args| }
+    selector.define_singleton_method(:remove_observer) { |*_args| }
+    count = 0
+    engine.define_singleton_method(:tick) do |id = nil|
+      next if id.nil?
+      resolver.single_res_mutex.synchronize do
+        query, client_queue, select_queue = @query_list.fetch(id)
+        count += 1
+        response, error = producer.call(query)
+        send_result(client_queue, id, select_queue, response, error)
+      end
+    end
+    Dnsruby::SelectThread.stub(:instance, selector) do
+      yield resolver, -> { count }
+    end
+  ensure
+    resolver&.close
+  end
+end
+
+class ReleaseCacheCompletionFollowupsTest < Minitest::Test
+  def test_dname_only_negative_uses_target_soa_and_question_specific_cache
+    query = Dnsruby::Message.new('www.old.example.', 'AAAA')
+    message = Dnsruby::Message.new('www.old.example.', 'AAAA')
+    message.add_answer(Dnsruby::RR.create('old.example. 60 IN DNAME new.example.'))
+    soa = Dnsruby::RR.create('new.example. 60 IN SOA ns.new.example. hostmaster.new.example. 1 3600 600 86400 30')
+    message.add_authority(soa)
+    assert_same(soa, Dnsruby::Cache.negative_soa(message))
+    cache = Dnsruby::Cache::ResolutionCache.new
+    cache.add(query, [:scope], message, nil)
+    refute_nil(cache.find(query, [:scope]))
+    assert_nil(cache.find(Dnsruby::Message.new('www.old.example.', 'DNAME'), [:scope]))
+    message.add_answer(Dnsruby::RR.create('www.new.example. 60 IN AAAA 2001:db8::1'))
+    assert_nil(Dnsruby::Cache.negative_soa(message))
+  end
+
+  def test_latest_success_replaces_failure_and_negative_completions
+    query = Dnsruby::Message.new('host.example.', 'A')
+    positive = Dnsruby::Message.new('host.example.', 'A')
+    positive.add_answer(Dnsruby::RR.create('host.example. 60 IN A 192.0.2.1'))
+    negative = Dnsruby::Message.new('host.example.', 'A')
+    negative.header.rcode = Dnsruby::RCode.NXDOMAIN
+    negative.add_authority(Dnsruby::RR.create('example. 60 IN SOA ns.example. hostmaster.example. 1 3600 600 86400 30'))
+    cache = Dnsruby::Cache::ResolutionCache.new
+    cache.add(query, [:scope], nil, Dnsruby::ServFail.new('temporary failure'))
+    refute_nil(cache.find(query, [:scope]))
+    cache.add(query, [:scope], positive, nil)
+    assert_nil(cache.find(query, [:scope]))
+    cache.add(query, [:scope], negative, Dnsruby::NXDomain.new('missing'))
+    refute_nil(cache.find(query, [:scope]))
+    cache.add(query, [:scope], positive, nil)
+    assert_nil(cache.find(query, [:scope]))
+    cache.add(query, [:scope], negative, Dnsruby::NXDomain.new('missing'))
+    cache.add(query, [:scope], nil, Dnsruby::ServFail.new('later failure'))
+    _message, error = cache.find(query, [:scope])
+    assert_instance_of(Dnsruby::ServFail, error)
+  end
+
+  def test_validation_scope_includes_discovery_route_and_resolver_settings_without_lock_reentry
+    previous_resolver = Dnsruby::Dnssec.default_resolver
+    previous_mode = Dnsruby::Dnssec.do_validation_with_recursor?
+    resolver = Dnsruby::Resolver.new(nameserver: ['127.0.0.1'])
+    Dnsruby::Dnssec.default_resolver = resolver
+    before = Dnsruby::Cache.validation_scope
+    resolver.single_res_mutex.synchronize { assert_equal(before, Dnsruby::Cache.validation_scope) }
+    {port: 5353, use_tcp: true, query_timeout: 7, packet_timeout: 2,
+      retry_times: 3, retry_delay: 6, nameserver: ['127.0.0.2']}.each do |name, value|
+      before = Dnsruby::Cache.validation_scope
+      resolver.public_send("#{name}=", value)
+      refute_equal(before, Dnsruby::Cache.validation_scope, name.to_s)
+    end
+    before = Dnsruby::Cache.validation_scope
+    Dnsruby::Dnssec.do_validation_with_recursor(!previous_mode)
+    refute_equal(before, Dnsruby::Cache.validation_scope)
+    before = Dnsruby::Cache.validation_scope
+    Dnsruby::Dnssec.default_resolver = Dnsruby::Resolver.new(nameserver: ['127.0.0.2'])
+    refute_equal(before, Dnsruby::Cache.validation_scope)
+  ensure
+    Dnsruby::Dnssec.default_resolver&.close if Dnsruby::Dnssec.default_resolver != previous_resolver
+    resolver&.close
+    Dnsruby::Dnssec.default_resolver = previous_resolver
+    Dnsruby::Dnssec.do_validation_with_recursor(previous_mode)
+  end
+end