dnsruby 1.73.1 → 2.0.0

data/test/tc_review_packet_contracts.rb

@@ -0,0 +1,369 @@
+require_relative 'tc_pipeline_send'
+
+class ReviewPacketContractsTest < Minitest::Test
+  def test_both_caches_match_query_class_and_keep_ordinary_cache_hits
+    isolated(<<~'RUBY')
+      [true, false].each do |recursive|
+        Dnsruby::PacketSender.clear_caches
+        writer = Dnsruby::PacketSender.new(server: '127.0.0.1', dnssec: false, recurse: recursive)
+        sent = []
+        writer.define_singleton_method(:send_dnsruby) { |*args| sent << args }
+        internet = cache_query('IN')
+        internet.header.rd = recursive
+        writer.make_query_packet(internet)
+        Dnsruby::PacketSender.cache(internet, answer(internet, 'internet'), scope: writer.positive_cache_scope(internet))
+        chaos = cache_query('CH')
+        chaos.header.rd = recursive
+        writer.send_async(chaos, Queue.new, :miss)
+        raise 'wrong class hit cached IN answer' unless sent.length == 1
+        writer.make_query_packet(chaos)
+        Dnsruby::PacketSender.cache(chaos, answer(chaos, 'chaos'), scope: writer.positive_cache_scope(chaos))
+        [['CH', 'chaos'], ['IN', 'internet']].each do |klass, text|
+          queue = Queue.new
+          writer.send_async(cache_query(klass), queue, klass)
+          SELECTOR.send_queued_responses
+          received = queue.pop(true)
+          validated = queue.pop(true)
+          raise 'cache hit lost' unless received[2].cached && sent.length == 1
+          raise 'wrong cached class' unless received[2].question.first.qclass == Dnsruby::Classes.new(klass)
+          raise 'wrong cached answer' unless received[2].answer.first.strings == [text]
+          raise 'cache completion duplicated' unless validated[1] == Dnsruby::Resolver::EventType::VALIDATED && queue.empty?
+        end
+      end
+    RUBY
+  end
+
+  def test_tsig_transactions_bypass_both_cache_reads_and_verified_response_writes
+    skip('OpenSSL HMAC unavailable') unless defined?(OpenSSL::HMAC)
+    isolated(<<~'RUBY')
+      [true, false].each do |recursive|
+        [:sender_key, :message_key, :presigned].each do |mode|
+          Dnsruby::PacketSender.clear_caches
+          writer = Dnsruby::PacketSender.new(server: '127.0.0.1', dnssec: false, recurse: recursive)
+          sent = []
+          writer.define_singleton_method(:send_dnsruby) { |*args| sent << args }
+          plain = cache_query('IN')
+          plain.header.rd = recursive
+          writer.make_query_packet(plain)
+          Dnsruby::PacketSender.cache(plain, answer(plain, 'unsigned cache'), scope: writer.positive_cache_scope(plain))
+          key = signing_key
+          signed = cache_query('IN')
+          signed.header.rd = recursive
+          if mode == :sender_key
+            writer.tsig = key
+          elsif mode == :message_key
+            signed.set_tsig(key)
+          else
+            key.apply(signed)
+          end
+          queue = Queue.new
+          writer.send_async(signed, queue, :signed)
+          raise 'signed request read shared cache' unless sent.length == 1
+          raise 'signed query not sent on wire' unless Dnsruby::Message.decode(sent.first.first).tsig
+          raise 'cache response was queued' unless K.class_variable_get(:@@queued_responses).empty?
+          unsigned = answer(signed, 'unsigned server')
+          result = writer.check_response(unsigned, unsigned.encode, signed, queue, :signed, false)
+          raise 'unsigned server answer accepted' unless result == false
+          response = answer(signed, 'private signed answer')
+          key.apply(response, signed)
+          bytes = response.encode
+          response = Dnsruby::Message.decode(bytes)
+          raise 'signed reply not verified' unless writer.check_response(response, bytes, signed, queue, :signed, false) == true
+          raise 'fixture has not exercised TSIG stripping' unless response.verified? && response.tsig.nil?
+          Dnsruby::PacketSender.clear_caches
+          Dnsruby::PacketSender.cache(signed, response)
+          writer.tsig = nil
+          writer.send_async(cache_query('IN'), Queue.new, :plain)
+          raise 'verified private answer entered shared cache' unless sent.length == 2
+          raise 'signed reply produced a cached result' unless K.class_variable_get(:@@queued_responses).empty?
+        end
+      end
+    RUBY
+  end
+
+  def test_invalid_headers_are_rejected_before_tsig_mutation_or_retry
+    skip('OpenSSL HMAC unavailable') unless defined?(OpenSSL::HMAC)
+    isolated(<<~'RUBY')
+      [:query_packet, :wrong_opcode, :wrong_id].each do |invalid_header|
+        [:ordinary, :formerr, :truncated].each do |kind|
+          writer = Dnsruby::PacketSender.new(server: '127.0.0.1', dnssec: false)
+          retries = []
+          writer.define_singleton_method(:send_async) { |*args| retries << args }
+          q = cache_query('IN')
+          q.add_additional(Dnsruby::RR::OPT.new(4096))
+          key = signing_key
+          key.apply(q)
+          reply = answer(q, 'ignored')
+          reply.header.qr = false if invalid_header == :query_packet
+          reply.header.opcode = Dnsruby::OpCode::Update if invalid_header == :wrong_opcode
+          reply.header.rcode = Dnsruby::RCode::FORMERR if kind == :formerr
+          reply.header.tc = true if kind == :truncated
+          key.apply(reply, q)
+          reply.header.id = (q.header.id + 1) % 65_536 if invalid_header == :wrong_id
+          bytes = reply.encode
+          reply = Dnsruby::Message.decode(bytes)
+          signature = reply.tsig
+          state = reply.tsigstate
+          result = writer.check_response(reply, bytes, q, Queue.new, :ignored, false)
+          raise "invalid #{invalid_header}/#{kind} consumed request" unless result == false
+          raise 'invalid header mutated TSIG' unless reply.tsig.equal?(signature) && reply.tsigstate == state
+          raise 'invalid header caused retry' unless retries.empty?
+        end
+      end
+    RUBY
+  end
+
+  def test_invalid_then_valid_packets_preserve_query_and_pipeline_peer_ownership
+    isolated(<<~'RUBY')
+      [:query_packet, :wrong_opcode].each do |invalid_header|
+        socket = FrameSocket.new
+        writer = sender(socket)
+        q = query('target.example.')
+        q.header.id = 100
+        target = settings(socket, :target, q, writer)
+        peer = settings(socket, :peer, query('peer.example.'), writer)
+        peer.query.header.id = 100 # Exercise matching questions before response processing.
+        SELECTOR.add_to_select(target)
+        SELECTOR.add_to_select(peer)
+        invalid = answer(q, 'invalid')
+        invalid.header.qr = false if invalid_header == :query_packet
+        invalid.header.opcode = Dnsruby::OpCode::Update if invalid_header == :wrong_opcode
+        SELECTOR.process_message(invalid, invalid.encode, socket)
+        raise 'invalid reply completed target' unless SELECTOR.query_settings_for_id(:target).equal?(target)
+        raise 'invalid reply disturbed peer' unless SELECTOR.query_settings_for_id(:peer).equal?(peer)
+        raise 'invalid reply was delivered' unless target.client_queue.empty? && peer.client_queue.empty?
+        [peer, target].each do |current|
+          response = answer(current.query, 'valid')
+          SELECTOR.process_message(response, response.encode, socket)
+          SELECTOR.send_queued_validation_responses
+          events = 2.times.map { current.client_queue.pop(true) }
+          raise 'valid response not delivered exactly once' unless current.client_queue.empty? &&
+            events.map { |event| event[1] } == [Dnsruby::Resolver::EventType::RECEIVED, Dnsruby::Resolver::EventType::VALIDATED] &&
+            events.all? { |event| event.last.nil? && event[2].answer.first.strings == ['valid'] }
+        end
+        SELECTOR.retire_socket(socket)
+        assert_clean(socket)
+      end
+    RUBY
+  end
+
+  def test_edns_fallback_keeps_the_attempt_transport_and_raw_mode_stays_raw
+    isolated(<<~'RUBY')
+      [true, false].each do |tcp|
+        writer = Dnsruby::PacketSender.new(server: '127.0.0.1', dnssec: false, use_tcp: !tcp)
+        retries = []
+        writer.define_singleton_method(:send_async) { |*args| retries << args }
+        q = query
+        q.add_additional(Dnsruby::RR::OPT.new(4096))
+        original = q.encode
+        reply = answer(q, 'formerr')
+        reply.header.rcode = Dnsruby::RCode::FORMERR
+        raise 'FORMERR was delivered' unless writer.check_response(reply, reply.encode, q, Queue.new, :retry, tcp) == false
+        raise 'wrong retry transport' unless retries.length == 1 && retries.first[3] == tcp
+        raise 'EDNS not disabled for retry' unless retries.first[4] && retries.first.first.get_opt.nil?
+        raise 'caller query was mutated' unless q.encode == original
+        q.send_raw = true
+        reply.header.qr = false
+        reply.header.opcode = Dnsruby::OpCode::Update
+        raise 'raw response was filtered' unless writer.check_response(reply, reply.encode, q, Queue.new, :raw, tcp) == true
+        raise 'raw response retried' unless retries.length == 1
+      end
+    RUBY
+  end
+
+  def test_malformed_invalid_headers_leave_udp_and_tcp_owners_active_for_valid_replies
+    isolated(<<~'RUBY')
+      [false, true].each do |tcp|
+        [false, true].each do |truncated|
+          [:query_packet, :wrong_opcode].each do |invalid_header|
+            socket = FrameSocket.new
+            writer = sender(socket)
+            retries = []
+            writer.define_singleton_method(:send_async) { |*args| retries << args }
+            q = query('target.example.')
+            q.header.id = 100
+            target = settings(socket, :target, q, writer)
+            target.is_persistent_socket = tcp
+            peer_socket = tcp ? socket : FrameSocket.new
+            peer = settings(peer_socket, :peer, query('peer.example.'), writer)
+            peer.query.header.id = 101
+            SELECTOR.add_to_select(target)
+            SELECTOR.add_to_select(peer)
+            flags = invalid_header == :query_packet ? 0 : 0xa800
+            flags |= 0x0200 if truncated
+            malformed = [100, flags, 1, 0, 0, 0].pack('n6') # Question is missing.
+            inject_packet(socket, malformed, tcp)
+            raise 'malformed packet decoded' if SELECTOR.get_incoming_data(socket, 512)
+            raise 'invalid malformed header triggered fallback' unless retries.empty?
+            raise 'invalid malformed header completed target' unless SELECTOR.query_settings_for_id(:target).equal?(target)
+            raise 'invalid malformed header consumed peer' unless SELECTOR.query_settings_for_id(:peer).equal?(peer)
+            raise 'invalid malformed header delivered an error' unless target.client_queue.empty? && peer.client_queue.empty?
+            valid = answer(q, 'valid')
+            inject_packet(socket, valid.encode, tcp)
+            incoming = SELECTOR.get_incoming_data(socket, 512)
+            raise 'following valid response was lost' unless incoming
+            SELECTOR.process_message(*incoming, socket)
+            SELECTOR.send_queued_validation_responses
+            events = 2.times.map { target.client_queue.pop(true) }
+            raise 'valid response not delivered once' unless target.client_queue.empty? &&
+              events.all? { |event| event.last.nil? && event[2].answer.first.strings == ['valid'] }
+            raise 'valid target response disturbed peer' unless SELECTOR.query_settings_for_id(:peer).equal?(peer)
+            SELECTOR.remove_id(:peer)
+            assert_clean(socket)
+            assert_clean(peer_socket)
+          end
+        end
+      end
+    RUBY
+  end
+
+  def test_malformed_matching_and_raw_headers_keep_existing_fallback_and_error_behavior
+    isolated(<<~'RUBY')
+      [false, true].each do |tcp|
+        [false, true].each do |truncated|
+          [false, true].each do |raw|
+            socket = FrameSocket.new
+            writer = sender(socket)
+            retries = []
+            writer.define_singleton_method(:send_async) { |*args| retries << args }
+            q = query
+            q.header.id = 100
+            q.send_raw = raw
+            current = settings(socket, :current, q, writer)
+            current.is_persistent_socket = tcp
+            SELECTOR.add_to_select(current)
+            # Raw queries intentionally retain permissive header handling.
+            flags = raw ? 0x2800 : 0x8000
+            flags |= 0x0200 if truncated
+            malformed = q.encode
+            malformed[2, 2] = [flags].pack('n')
+            malformed[6, 2] = [1].pack('n') # Complete question, missing answer.
+            inject_packet(socket, malformed, tcp)
+            raise 'malformed packet decoded' if SELECTOR.get_incoming_data(socket, 512)
+            if truncated && !tcp
+              raise 'valid/raw truncated UDP lost TCP fallback' unless retries.length == 1 && retries.first[3] == true
+              raise 'fallback emitted a premature error' unless current.client_queue.empty?
+              SELECTOR.remove_id(:current)
+            else
+              raise 'malformed TCP/nontruncated packet unexpectedly retried' unless retries.empty?
+              raise 'malformed packet did not report one decode error' unless current.client_queue.length == 1 &&
+                current.client_queue.pop(true).last.is_a?(Dnsruby::DecodeError)
+              raise 'terminal decode error retained owner' if SELECTOR.query_settings_for_id(:current)
+            end
+            assert_clean(socket)
+          end
+        end
+      end
+    RUBY
+  end
+
+  def test_short_malformed_headers_only_end_tcp_transactions
+    isolated(<<~'RUBY')
+      [false, true].each do |tcp|
+        [2, 4, 11].each do |length|
+          socket = FrameSocket.new
+          writer = sender(socket)
+          writer.define_singleton_method(:send_async) { |*| raise 'incomplete header triggered retry' }
+          q = query
+          q.header.id = 100
+          current = settings(socket, :current, q, writer)
+          current.is_persistent_socket = tcp
+          SELECTOR.add_to_select(current)
+          inject_packet(socket, [100, 0x2800, 1, 0, 0, 0].pack('n6').byteslice(0, length), tcp)
+          raise 'incomplete header decoded' if SELECTOR.get_incoming_data(socket, 512)
+          if tcp
+            raise 'incomplete TCP header error was suppressed' unless current.client_queue.length == 1 &&
+              current.client_queue.pop(true).last.is_a?(Dnsruby::DecodeError)
+            raise 'incomplete TCP header retained owner' if SELECTOR.query_settings_for_id(:current)
+          else
+            raise 'incomplete UDP header ended transaction' unless current.client_queue.empty? &&
+              SELECTOR.query_settings_for_id(:current).equal?(current)
+            SELECTOR.remove_id(:current)
+          end
+          assert_clean(socket)
+        end
+      end
+    RUBY
+  end
+
+  def test_malformed_udp_questions_cannot_fail_or_retry_an_unrelated_query
+    isolated(<<~'RUBY')
+      [:name, :type, :klass, :missing, :partial, :second].product([false, true]).each do |mismatch, truncated|
+        socket = FrameSocket.new
+        writer = sender(socket)
+        writer.define_singleton_method(:send_async) { |*| raise 'unrelated question triggered fallback' }
+        q = query('target.example.')
+        q.add_question('second.example.', 'AAAA') if mismatch == :second
+        current = settings(socket, :current, q, writer)
+        current.is_persistent_socket = false
+        SELECTOR.add_to_select(current)
+        original_deadline = current.endtime
+        reply = q.clone
+        reply.header.qr = true
+        reply.header.tc = truncated
+        case mismatch
+        when :name then reply.question.first.qname = Dnsruby::Name.create('unrelated.example.')
+        when :type then reply.question.first.qtype = Dnsruby::Types::AAAA
+        when :klass then reply.question.first.qclass = Dnsruby::Classes::CH
+        when :second then reply.question.last.qname = Dnsruby::Name.create('unrelated.example.')
+        end
+        wire = reply.encode
+        wire[6, 2] = [1].pack('n') # Missing answer follows the question.
+        wire = wire.byteslice(0, mismatch == :missing ? 12 : 15) if [:missing, :partial].include?(mismatch)
+        inject_packet(socket, wire, false)
+        raise 'malformed packet decoded' if SELECTOR.get_incoming_data(socket, 512)
+        raise 'unrelated question consumed transaction' unless current.client_queue.empty? &&
+          SELECTOR.query_settings_for_id(:current).equal?(current)
+        raise 'unrelated question extended deadline' unless current.endtime == original_deadline
+        valid = q.clone
+        valid.header.qr = true
+        inject_packet(socket, valid.encode, false)
+        incoming = SELECTOR.get_incoming_data(socket, 512)
+        SELECTOR.process_message(*incoming, socket)
+        SELECTOR.send_queued_validation_responses
+        raise 'following valid answer lost' unless current.client_queue.size == 2 &&
+          2.times.map { current.client_queue.pop }.all? { |event| event.last.nil? }
+        assert_clean(socket)
+      end
+    RUBY
+  end
+
+  private
+
+  CONTRACT_FIXTURE = <<~'RUBY'
+    def cache_query(klass)
+      Dnsruby::Message.new('contract.example.', Dnsruby::Types::TXT, klass).tap do |message|
+        message.do_validation = false
+      end
+    end
+    def answer(query, text)
+      question = query.question.first
+      Dnsruby::Message.new(question.qname, question.qtype, question.qclass).tap do |reply|
+        reply.header.id = query.header.id
+        reply.header.qr = reply.header.aa = true
+        reply.add_answer(Dnsruby::RR.create("#{question.qname} 60 #{question.qclass} TXT \"#{text}\""))
+      end
+    end
+    def signing_key
+      Dnsruby::RR.create(name: 'contract-key.example.', type: 'TSIG', klass: 'ANY',
+        key: 'c2VjcmV0', algorithm: 'hmac-sha256')
+    end
+    def inject_packet(socket, bytes, tcp)
+      if tcp
+        socket.incoming = [bytes.bytesize].pack('n') + bytes
+      else
+        socket.define_singleton_method(:getsockopt) { |*| Struct.new(:data).new([Socket::SOCK_DGRAM].pack('i')) }
+        socket.define_singleton_method(:recvfrom_nonblock) { |*| [bytes, ['AF_INET', 53, '127.0.0.1', '127.0.0.1']] }
+      end
+    end
+  RUBY
+
+  def isolated(body)
+    options = ''.frozen? ? ['--enable-frozen-string-literal'] : []
+    source = "#{TestPipelineSend::FIXTURE}\n#{CONTRACT_FIXTURE}\nTimeout.timeout(10) do\n#{body}\nend"
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, *options, '-I',
+      File.expand_path('../lib', __dir__), '-e', source)
+    assert(status.success?, "#{stdout}\n#{stderr}")
+    assert_empty(stderr)
+  end
+end

data/test/tc_review_presentation.rb

@@ -0,0 +1,213 @@
+require_relative 'spec_helper'
+require 'stringio'
+
+class TestReviewPresentation < Minitest::Test
+  def presentation
+    Dnsruby.const_get(:Presentation)
+  end
+
+  def test_record_parsing_never_enumerates_learned_class_names
+    original = Dnsruby::Classes.method(:regexp)
+    own_method = Dnsruby::Classes.singleton_methods(false).include?(:regexp)
+    Dnsruby::Classes.define_singleton_method(:regexp) do
+      raise 'record parsing must use an indexed class lookup'
+    end
+    record = Dnsruby::RR.create('example. 300 IN A 192.0.2.1')
+    assert_equal('192.0.2.1', record.address.to_s)
+    record = Dnsruby::RR.create("example. 300 IN TXT 'one(two);three'")
+    assert_equal(['one(two);three'], record.strings)
+  ensure
+    if original
+      Dnsruby::Classes.singleton_class.remove_method(:regexp)
+      Dnsruby::Classes.define_singleton_method(:regexp, original) if own_method
+    end
+  end
+
+  def test_numeric_and_registered_class_tokens_preserve_quote_boundaries
+    arrays = Dnsruby::CodeMapper.class_variable_get(:@@arrays)
+    original = arrays.fetch(Dnsruby::Classes)
+    replacement = Dnsruby::CodeMapper::Arrays.new
+    %i[strings stringsdown values].each do |name|
+      replacement.public_send("#{name}=", original.public_send(name).dup)
+    end
+    replacement.maxcode = original.maxcode
+    arrays[Dnsruby::Classes] = replacement
+    Dnsruby::Classes.add_pair('PRIVATE', 60_000)
+    %w[IN in CLASS65000 class65000 PRIVATE private].each do |klass|
+      text = "owner 300 #{klass} TXT('one(two);three')"
+      assert_equal(text.index('TXT') + 3, presentation.single_quoted_start(text), klass)
+    end
+    assert_nil(presentation.single_quoted_start("owner 300 UNREGISTERED TXT 'value'"))
+    assert_nil(presentation.single_quoted_start("owner 300 IN A 'value'"))
+  ensure
+    arrays[Dnsruby::Classes] = original if original
+  end
+
+  def test_txt_continuation_recognizes_apostrophes_on_later_lines
+    %w[TXT SPF TYPE16 TYPE99 TYPE016 TYPE099 TYPE00016 TYPE00099].each do |type|
+      text = "owner 300 IN #{type} (\n 'one(two);three'\n 'four'\n)\n"
+      record = Dnsruby::ZoneReader.new('example.').process_io(StringIO.new(text)).first
+      assert_equal(['one(two);three', 'four'], record.strings, type)
+    end
+  end
+
+  def test_numeric_txt_and_spf_preserve_single_quoted_punctuation
+    %w[TYPE016 TYPE099 TYPE00016 TYPE00099].each do |type|
+      text = "owner 300 IN #{type} 'one(two);three'"
+      direct = Dnsruby::RR.create(text)
+      reader = Dnsruby::ZoneReader.new('example.')
+      normalized = reader.normalise_line(text)
+      record = reader.process_io(StringIO.new(text + "\n")).first
+      assert_equal(['one(two);three'], direct.strings, type)
+      assert_equal(direct.strings, Dnsruby::RR.create(normalized).strings, type)
+      assert_equal(direct.strings, record.strings, type)
+    end
+  end
+
+  def test_normalised_lines_remain_strings_accepted_by_public_rr_constructor
+    [
+      'www 300 IN A 192.0.2.1',
+      "txt 300 IN TYPE016 'one(two);three'",
+      'txt 300 IN TXT "one(two);three" \\"escaped ; ignored',
+      'https 300 IN HTTPS 1 svc alpn="h2,h3"',
+      'opaque 300 CLASS65000 TYPE65001 \\# 0'
+    ].each do |text|
+      reader = Dnsruby::ZoneReader.new('example.')
+      line = reader.process_line(text.freeze)
+      assert_instance_of(String, line)
+      expected = Dnsruby::RR.create(line)
+      record = Dnsruby::ZoneReader.new('example.').process_io(StringIO.new(text + "\n")).first
+      assert_equal(expected, record, text)
+    end
+  end
+
+  def test_process_line_preserves_subclass_normalization_hook_and_prefix_arguments
+    seen = []
+    reader_class = Class.new(Dnsruby::ZoneReader) do
+      define_method(:normalise_line) do |line, prefix = false|
+        seen << [line, prefix]
+        # Replacement strings must be scanned even though process_line has
+        # already scanned the original input passed to this hook.
+        super(line.sub('192.0.2.1', '(192.0.2.2) ; added comment ('), prefix)
+      end
+    end
+    line, type, name = reader_class.new('example.').process_line('www 300 IN A 192.0.2.1', true)
+    assert_equal(1, seen.length)
+    assert_instance_of(String, seen.first.first)
+    assert_equal(true, seen.first.last)
+    assert_equal('A', type)
+    assert_equal('www.example.', name)
+    assert_equal('192.0.2.2', Dnsruby::RR.create(line).address.to_s)
+  end
+
+  def test_prepend_hook_failure_does_not_leave_input_marked_as_scanned
+    first_line = nil
+    hook = Module.new do
+      define_method(:normalise_line) do |line, prefix = false|
+        unless first_line
+          first_line = line
+          raise ArgumentError, 'normalization hook rejected input'
+        end
+        super(line, prefix)
+      end
+    end
+    reader_class = Class.new(Dnsruby::ZoneReader) { prepend hook }
+    reader = reader_class.new('example.')
+    assert_raises(ArgumentError) { reader.process_line('www 300 IN A 192.0.2.1') }
+    # Reusing the same String after the failed call is a direct public call,
+    # so its new grouping and comments must receive the normal scanner.
+    first_line.replace('www 300 IN A (192.0.2.3) ; added comment (')
+    line = reader.normalise_line(first_line)
+    assert_equal('192.0.2.3', Dnsruby::RR.create(line).address.to_s)
+    assert_equal('192.0.2.4', Dnsruby::RR.create(reader.process_line('next 300 IN A 192.0.2.4')).address.to_s)
+  end
+
+  def test_normalization_hook_can_mutate_the_input_before_super
+    reader_class = Class.new(Dnsruby::ZoneReader) do
+      def normalise_line(line, prefix = false)
+        line.sub!('192.0.2.1', '(192.0.2.2) ; added comment (')
+        super
+      end
+    end
+    text = "www 300 IN A 192.0.2.1\n"
+    record = reader_class.new('example.').process_io(StringIO.new(text)).first
+    assert_equal('www.example.', record.name.to_s(true))
+    assert_equal('192.0.2.2', record.address.to_s)
+  end
+
+  def test_process_io_parses_presentation_returned_by_a_replacement_hook
+    reader_class = Class.new(Dnsruby::ZoneReader) do
+      def normalise_line(line, prefix = false)
+        # Applications can provide the normalization themselves and return
+        # any valid RR presentation, including grouping and comments.
+        'custom.example. 300 IN A (192.0.2.3) ; hook supplied this record'
+      end
+    end
+    record = reader_class.new('example.').process_io(StringIO.new("www 300 IN A 192.0.2.1\n")).first
+    assert_equal('custom.example.', record.name.to_s(true))
+    assert_equal('192.0.2.3', record.address.to_s)
+  end
+
+  def test_process_line_scans_unchanged_input_once
+    scanner = presentation.singleton_class
+    ['www 300 IN A 192.0.2.1', 'txt 300 IN TXT "one(two);three"'].each do |line|
+      scans = 0
+      tracer = TracePoint.new(:call) do |event|
+        scans += 1 if event.defined_class == scanner && event.method_id == :scan
+      end
+      normalized = tracer.enable do
+        Dnsruby::ZoneReader.new('example.').process_line(line + "\n")
+      end
+      assert_equal(1, scans, line)
+      assert_instance_of(String, normalized)
+      assert_instance_of(Dnsruby::Name, Dnsruby::RR.create(normalized).name)
+    end
+  end
+
+  def test_omitted_owner_and_apostrophe_in_owner_keep_legacy_behavior
+    text = "'owner 300 IN TXT ('first')\n IN TXT ('two(three);four')\n"
+    records = Dnsruby::ZoneReader.new('example.').process_io(StringIO.new(text))
+    assert_equal(['first'], records.first.strings)
+    assert_equal(['two(three);four'], records.last.strings)
+    assert_equal(records.first.name, records.last.name)
+  end
+
+  def test_plain_records_and_grouped_records_produce_identical_wire_data
+    [
+      'www.example. 60 IN A 192.0.2.1',
+      "www.example.\t60\tIN\tAAAA\t2001:db8::1",
+      'example. IN MX 10 mail.example.',
+      'example. 60 IN TXT plain',
+      'example. 60 IN HTTPS 1 . alpn=h2 port=443',
+      'é.example. 60 IN A 192.0.2.1'
+    ].each do |text|
+      plain = Dnsruby::RR.create(text.freeze)
+      grouped = Dnsruby::RR.create("(#{text})")
+      assert_equal(grouped, plain, text)
+      assert_equal(grouped.clone, plain.clone, text)
+    end
+  end
+
+  def test_runs_preserve_unicode_quotes_escapes_and_continuation_state
+    text = "é.example. TXT ('café; (value)'\"déjà\\\"vu\") ; ignored quote '\n"
+    start = presentation.single_quoted_start(text)
+    normalized, depth, quote = presentation.scan(text, single_quoted_from: start)
+    assert_equal("é.example. TXT 'café; (value)'\"déjà\\\"vu\"  ", normalized)
+    assert_equal(0, depth)
+    assert_equal(false, quote)
+    assert_equal(Encoding::UTF_8, normalized.encoding)
+
+    normalized, depth, quote = presentation.scan("début; (one)\\\nfin\" )", 1, true)
+    assert_equal("début; (one)\\\nfin\" ", normalized)
+    assert_equal(0, depth)
+    assert_equal(false, quote)
+  end
+
+  def test_runs_keep_binary_character_strings_and_trailing_escapes
+    text = "owner TXT \"\xFE\xFF (value);\" \\".b
+    normalized, depth, quote = presentation.scan(text)
+    assert_equal(text, normalized)
+    assert_equal(Encoding::BINARY, normalized.encoding)
+    assert_equal([0, false], [depth, quote])
+  end
+end

data/test/tc_review_record_compatibility.rb

@@ -0,0 +1,101 @@
+require_relative 'spec_helper'
+
+class ReviewRecordCompatibilityTest < Minitest::Test
+  def test_decoder_byte_access_keeps_direct_multibyte_and_mutation_contracts
+    text = +'AA'
+    decoder = Dnsruby::MessageDecoder.new(text)
+    assert_equal(65, decoder.get_byte_at(1))
+    text.replace('éA')
+    assert_equal(195, decoder.get_byte_at(0))
+    assert_equal(65, decoder.get_byte_at(1))
+    assert_nil(decoder.get_byte_at(2))
+    binary = Dnsruby::MessageDecoder.new(text.b)
+    assert_equal([195, 169, 65], 3.times.map { |index| binary.get_byte_at(index) })
+    assert_nil(binary.get_byte_at(3))
+  end
+
+  def test_caa_clone_preserves_string_rdata_and_comparisons
+    record = Dnsruby::RR.create('example. 300 IN CAA 128 issue "ca.example"')
+    copy = record.clone
+    assert_instance_of(String, copy.rdata)
+    assert_equal(record.rdata, copy.rdata)
+    assert_equal(0, record <=> copy)
+    assert_equal(2, [record, copy].sort.length)
+    copy.property_value = 'other.example'
+    assert_equal('128 issue "ca.example"', copy.rdata)
+    assert_equal('128 issue "other.example"', copy.rdata_to_string)
+  end
+
+  def test_caa_binary_value_round_trips_without_presentation_reparsing
+    value = "\0\"\\\xFF".b
+    record = Dnsruby::RR.create(name: 'example.', type: 'CAA', klass: 'IN', ttl: 300,
+      flag: 0, property_tag: 'issue', property_value: value)
+    copy = record.clone
+    assert_equal(value, copy.property_value)
+    assert_instance_of(String, copy.rdata)
+    assert_equal(copy.rdata_to_string, copy.rdata)
+    assert_equal(value, copy.clone.property_value)
+  end
+
+  def test_escaped_origin_and_rdata_names_remain_complete
+    reader = Dnsruby::ZoneReader.new('example.')
+    reader.process_line('$ORIGIN foo\\ bar.example.')
+    address = Dnsruby::RR.create(reader.process_line('host 60 IN A 192.0.2.1'))
+    assert_equal(['host', 'foo bar', 'example'], address.name.labels.map(&:string))
+
+    mx = Dnsruby::RR.create(reader.process_line('mail 60 IN MX 10 target\\ name'))
+    assert_equal(['target name', 'foo bar', 'example'], mx.exchange.labels.map(&:string))
+    nsec = Dnsruby::RR.create(reader.process_line('owner 60 IN NSEC next\\ name A NSEC RRSIG'))
+    assert_equal(['next name', 'foo bar', 'example'], nsec.next_domain.labels.map(&:string))
+    assert_equal(%w[A NSEC RRSIG], nsec.types.map(&:to_s))
+
+    direct_mx = Dnsruby::RR.create('mail.example. 60 IN MX 10 target\\ name.example.')
+    direct_nsec = Dnsruby::RR.create('owner.example. 60 IN NSEC next\\ name.example. A NSEC')
+    assert_equal(['target name', 'example'], direct_mx.exchange.labels.map(&:string))
+    assert_equal(['next name', 'example'], direct_nsec.next_domain.labels.map(&:string))
+  end
+
+  def test_escaped_trailing_whitespace_in_zone_names
+    reader = Dnsruby::ZoneReader.new('example.')
+    rr = Dnsruby::RR.create(reader.process_line('alias 60 IN CNAME trailing\\ '))
+    assert_equal(['trailing ', 'example'], rr.domainname.labels.map(&:string))
+  end
+
+  def test_zone_txt_uses_dns_escapes_while_direct_parser_keeps_legacy_behavior
+    reader = Dnsruby::ZoneReader.new('example.')
+    %w[TXT SPF].each do |type|
+      rr = Dnsruby::RR.create(reader.process_line("owner 60 IN #{type} \"one\\ntwo\\tthree\\032four\\010five\""))
+      assert_equal(["onentwotthree four\nfive"], rr.strings)
+      quoted = Dnsruby::RR.create(reader.process_line("owner 60 IN #{type} \"say\\\"hi\\\"\\\\end\""))
+      assert_equal(['say"hi"\\end'], quoted.strings)
+      unquoted = Dnsruby::RR.create(reader.process_line("owner 60 IN #{type} one\\ two"))
+      assert_equal(['one two'], unquoted.strings)
+    end
+    assert_equal(["one\ntwo"], Dnsruby::RR::TXT.parse('"one\\ntwo"'))
+  end
+
+  def test_canonical_sort_keeps_references_and_normalizes_mutated_ttls
+    records = [3, 1, 2].map { |last| Dnsruby::RR.create("example. 300 IN A 192.0.2.#{last}") }
+    set = Dnsruby::RRSet.new(records)
+    originals = set.rrs
+    originals[0].ttl = 100
+    sorted = set.sort_canonical
+    assert_equal(%w[192.0.2.1 192.0.2.2 192.0.2.3], sorted.rrs.map { |rr| rr.address.to_s })
+    sorted.rrs.each { |rr| assert_same(originals.find { |old| old.address == rr.address }, rr) }
+    assert_equal([100, 100, 100], originals.map(&:ttl))
+    sorted.rrs.first.address = Dnsruby::IPv4.create('192.0.2.9')
+    assert(sorted.add(Dnsruby::RR.create('example. 100 IN A 192.0.2.1'), false))
+    assert_equal(4, sorted.length)
+  end
+
+  def test_canonical_sort_deduplicates_publicly_mutated_records
+    set = Dnsruby::RRSet.new([
+      Dnsruby::RR.create('example. 300 IN A 192.0.2.1'),
+      Dnsruby::RR.create('example. 300 IN A 192.0.2.2')
+    ])
+    set.rrs.last.address = Dnsruby::IPv4.create('192.0.2.1')
+    sorted = set.sort_canonical
+    assert_equal(1, sorted.length)
+    assert_same(set.rrs.last, sorted.rrs.first)
+  end
+end