dnsruby 1.73.1 → 2.0.0

data/test/tc_review_validation_priming.rb

@@ -0,0 +1,178 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+
+# Functional policy and cache contracts; all discovery uses local doubles.
+class ReviewValidationPrimingTest < Minitest::Test
+  def setup
+    @klass = Dnsruby::Recursor
+    @saved = %i[@@hints @@stale_hints @@hints_generation @@nameservers
+      @@zones_cache @@zone_expirations @@authority_cache].to_h do |field|
+      [field, @klass.class_variable_get(field)]
+    end
+    %i[@@hints @@zones_cache @@zone_expirations @@authority_cache].each do |field|
+      @klass.class_variable_set(field, {})
+    end
+    @klass.class_variable_set(:@@stale_hints, nil)
+  end
+
+  def teardown
+    @saved.each { |field, value| @klass.class_variable_set(field, value) }
+  end
+
+  def test_required_verification_errors_survive_provisional_classification
+    verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    message = Dnsruby::Message.new('ordinary.example.')
+    expected = Dnsruby::VerifyError.new('Verification service did not complete')
+    provisional = ->(_anchor, packet, _name) { packet.security_level = Dnsruby::Message::SecurityLevel.INSECURE; nil }
+    # Model the verification service's result independently of wire records.
+    message.stub(:rrsets, [:present]) do
+      verifier.stub(:find_closest_anchor_for, nil) do
+        verifier.stub(:try_to_follow_from_anchor, provisional) do
+          verifier.stub(:verify_result, ->(*) { raise expected }) do
+            verifier.stub(:discover_signer_keys, false) do
+              actual = assert_raises(Dnsruby::VerifyError) { verifier.validate(message, nil) }
+              assert_same(expected, actual)
+            end
+          end
+        end
+      end
+    end
+  end
+
+  def test_unsigned_alias_classification_visits_each_required_name
+    verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    message = Dnsruby::Message.new('alias.example.')
+    message.add_answer(Dnsruby::RR.create('alias.example. 60 IN CNAME target.other.'))
+    message.add_answer(Dnsruby::RR.create('target.other. 60 IN A 192.0.2.1'))
+    names = []
+    verifier.stub(:discover_insecure_name, ->(name, _klass) { names << name.to_s(true); true }) do
+      assert(verifier.validate(message, nil))
+    end
+    assert_equal(%w[alias.example. target.other.], names.sort)
+    assert_equal(Dnsruby::Message::SecurityLevel.INSECURE, message.security_level)
+  end
+
+  def test_escaped_dots_are_not_ancestor_boundaries
+    @klass.class_variable_set(:@@zones_cache, {'.' => {}, 'example.' => {}, 'b.example.' => {}})
+    recursor = @klass.allocate
+    assert_equal('example.', recursor.get_closest_known_zone_for('a\\.b.example.'))
+    assert_equal('example.', recursor.get_closest_known_zone_for('a\\046b.example.'))
+    assert_equal('example.', recursor.get_closest_known_zone_for('www.example'))
+    relative = Dnsruby::Name.create('a\\.b.example')
+    assert_equal('example.', recursor.get_closest_known_zone_for(relative))
+    refute(relative.absolute?)
+    assert_equal('.', recursor.get_closest_known_zone_for('other'))
+  end
+
+  def test_descendant_deadline_survives_parent_eviction_without_extending_it
+    clock = Time.utc(2026, 11, 15)
+    Time.stub(:now, -> { clock }) do
+      root = {'ns.root.' => addresses(300)}
+      @klass.class_variable_set(:@@hints, root)
+      @klass.class_variable_set(:@@zones_cache, {'.' => root})
+      @klass.class_variable_set(:@@zone_expirations, {'.' => [root, clock + 90]})
+      @klass.cache_zone('example', {'ns.example.' => addresses(300)}, 20, parent: '.')
+      @klass.cache_zone(Dnsruby::Name.create('child.example'), {'ns.child.example.' => addresses(300)}, 60, parent: 'example')
+      @klass.class_variable_get(:@@zones_cache).delete('example.')
+      @klass.class_variable_get(:@@zone_expirations).delete('example.')
+      recursor = @klass.allocate
+      clock += 19
+      assert_equal('child.example.', recursor.get_closest_known_zone_for('www.child.example.'))
+      clock += 1
+      assert_equal('.', recursor.get_closest_known_zone_for('www.child.example.'))
+    end
+  end
+
+  def test_partial_priming_fills_missing_root_names
+    packet = root_packet(ns_ttl: 60, address_ttl: 300)
+    packet.add_answer(Dnsruby::RR.create('. 60 IN NS b.root.example.'))
+    resolver, lookups = priming_resolver(packet)
+    @klass.set_hints([], resolver)
+    assert_equal([['b.root.example.', 'A'], ['b.root.example.', 'AAAA']], lookups)
+    assert_equal(%w[a.root.example b.root.example], @klass.class_variable_get(:@@hints).keys.sort)
+  end
+
+  def test_root_ns_expiration_is_independent_of_address_expiration
+    clock = Time.utc(2026, 11, 15)
+    Time.stub(:now, -> { clock }) do
+      resolver, = priming_resolver(root_packet(ns_ttl: 5, address_ttl: 300))
+      @klass.set_hints([], resolver)
+      assert(@klass.send(:hints_ready?))
+      clock += 5
+      refute(@klass.send(:hints_ready?))
+      assert_equal(['192.0.2.53'], @klass.class_variable_get(:@@hints).values.first.values)
+    end
+  end
+
+  def test_zero_ttl_priming_addresses_belong_to_the_current_lookup
+    resolver, = priming_resolver(root_packet(ns_ttl: 0, address_ttl: 0))
+    @klass.send(:with_limits, resolver) do
+      @klass.set_hints([], resolver)
+      refute(@klass.send(:hints_ready?))
+      generation = @klass.class_variable_get(:@@hints_generation)
+      assert_equal(generation, @klass.send(:ensure_hints, resolver))
+      zone, authorities = @klass.allocate.get_closest_known_zone_authorities_for('www.example.')
+      assert_equal('.', zone)
+      assert_equal(['192.0.2.53'], authorities.values.first.current_values)
+      assert_empty(@klass.class_variable_get(:@@hints).values.first.values)
+    end
+    refute(@klass.send(:hints_ready?))
+  end
+
+  def test_supported_name_classification_is_memoized_within_one_operation
+    verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    anchor = Struct.new(:klass).new(Dnsruby::Classes.IN)
+    calls = 0
+    verifier.stub(:find_closest_anchor_for, anchor) do
+      verifier.stub(:follow_chain, ->(*) { calls += 1; anchor }) do
+        verifier.send(:with_operational_validation, Dnsruby::Message.new('example.')) do
+          2.times { refute(verifier.send(:discover_insecure_name, Dnsruby::Name.create('example.'), Dnsruby::Classes.IN)) }
+        end
+      end
+    end
+    assert_equal(1, calls)
+  end
+
+  def test_root_ns_deadline_starts_before_address_discovery
+    clock = Time.utc(2026, 11, 15)
+    Time.stub(:now, -> { clock }) do
+      packet = root_packet(ns_ttl: 5, address_ttl: 300)
+      packet.add_answer(Dnsruby::RR.create('. 5 IN NS b.root.example.'))
+      resolver, = priming_resolver(packet) { clock += 3 }
+      @klass.set_hints([], resolver)
+      refute(@klass.send(:hints_ready?))
+      assert_equal(Time.utc(2026, 11, 15) + 5, @klass.class_variable_get(:@@zone_expirations)['.'][1])
+    end
+  end
+
+  private
+
+  def addresses(ttl)
+    @klass::AddressCache.new.tap { |cache| cache.push(['192.0.2.53', ttl]) }
+  end
+
+  def root_packet(ns_ttl:, address_ttl:)
+    packet = Dnsruby::Message.new('.', 'NS')
+    packet.add_answer(Dnsruby::RR.create(". #{ns_ttl} IN NS a.root.example."))
+    packet.add_additional(Dnsruby::RR.create("a.root.example. #{address_ttl} IN A 192.0.2.53"))
+    packet
+  end
+
+  def priming_resolver(packet, &before_send)
+    lookups = []
+    resolver = Struct.new(:query_timeout, :recurse).new(2, false)
+    resolver.define_singleton_method(:single_resolvers) { [Object.new] }
+    resolver.define_singleton_method(:query_no_validation_or_recursion) { |*| packet }
+    resolver.define_singleton_method(:send_async) do |query, queue|
+      before_send&.call
+      name, type = query.question.first.qname.to_s(true), query.question.first.qtype.to_s
+      lookups << [name, type]
+      response = Dnsruby::Message.new(name, type)
+      value = type == 'A' ? '192.0.2.54' : '2001:db8::54'
+      response.add_answer(Dnsruby::RR.create("#{name} 60 IN #{type} #{value}"))
+      queue << [lookups.length, response, nil]
+      lookups.length
+    end
+    [resolver, lookups]
+  end
+end

data/test/tc_rr-opt.rb

@@ -97,7 +97,9 @@ class TestRrOpt < Minitest::Test
       received_query = s[0]
       socket.connect(s[1][2], s[1][1])
       q.push(Message.decode(received_query))
-      socket.send(received_query,0)
+      response = Message.decode(received_query)
+      response.header.qr = true
+      socket.send(response.encode,0)
     }
 
     #  Now send query
@@ -168,12 +170,13 @@ class TestRrOpt < Minitest::Test
         received_query = s[0]
         m = Message.decode(received_query)
         q.push(m)
+        m.header.qr = true
         if (m.header.arcount > 0)
           #  send back FORMERR
           m.header.rcode = RCode.FORMERR
           socket.send(m.encode,0,s[1][2], s[1][1])
         else
-          socket.send(received_query,0,s[1][2], s[1][1]) # @TODO@ FORMERR if edns
+          socket.send(m.encode,0,s[1][2], s[1][1])
         end
       }
 

data/test/tc_rr-unknown.rb

@@ -99,4 +99,23 @@ dd ee c0 11 00 02 00 01  00 00 03 84 00 05 02 6e
 	'Packet read from a packet dumped by bind...'
     )
   end
+
+  def test_empty_rdata_round_trips_through_rfc3597_presentation
+    %w[IN CH CLASS65000].each do |klass|
+      rr = RR.create("empty.example. 300 #{klass} TYPE65001 \\# 0")
+      assert_equal('', rr.data)
+      assert_equal(rr, RR.create(rr.to_s))
+      assert_equal(rr, rr.clone)
+    end
+  end
+
+  def test_malformed_generic_presentation_raises_decode_error
+    ['\\#', '\\# -1', '\\# 1', '\\# 0 ff', '\\# 1 zz', '\\# 1 f', '\\# 65536'].each do |rdata|
+      %w[TYPE65001 TYPE64 A].each do |type|
+        assert_raises(DecodeError, "#{type} #{rdata}") do
+          RR.create("example. 300 IN #{type} #{rdata}")
+        end
+      end
+    end
+  end
 end

data/test/tc_rr.rb

@@ -376,6 +376,20 @@ class TestRR < Minitest::Test
     assert_equal a1.hash, a3.hash
   end
 
+  # RR.create has long accepted incomplete grouping around otherwise complete
+  # RDATA (including the TLSA certificate fixtures). A zone file must balance
+  # its continuation lines, but this standalone constructor remains permissive.
+  def test_unbalanced_grouping_in_standalone_record_strings
+    prefix = '_443._tcp.example. 60 IN TLSA 3 0 1 '
+    digest = 'aa' * 32
+    expected = RR.create(prefix + digest)
+    ["( #{digest}", "#{digest} )", "( #{digest} )"].each do |rdata|
+      rr = RR.create(prefix + rdata)
+      assert_equal(expected, rr, rdata)
+      assert_equal([digest].pack('H*'), rr.databin, rdata)
+    end
+  end
+
   def _test_duplicate_answer(method_as_symbol)
     expected_count = case method_as_symbol
     when :add_answer

data/test/tc_rrset_grouping.rb

@@ -0,0 +1,50 @@
+require_relative 'spec_helper'
+
+class RRSetGroupingTest < Minitest::Test
+  def test_grouping_preserves_order_class_and_signature_membership
+    signature = Dnsruby::RR.create('Host.Example. 300 IN RRSIG A 8 2 300 20300101000000 20200101000000 123 example. AQID')
+    records = [signature,
+      Dnsruby::RR.create('other.example. 300 IN A 192.0.2.2'),
+      Dnsruby::RR.create('host.example. 200 IN A 192.0.2.1'),
+      Dnsruby::RR.create('host.example. 100 IN A 192.0.2.3'),
+      Dnsruby::RR.create('host.example. 300 CH TXT "other class"')]
+    section = Dnsruby::Section.new.concat(records)
+    sets = section.rrsets
+    assert_equal([Dnsruby::Types::A, Dnsruby::Types::A, Dnsruby::Types::TXT], sets.map(&:type).map(&:code))
+    assert_equal(1, sets.first.num_sigs)
+    assert_equal(2, sets.first.rrs.length)
+    assert_equal([100, 100], sets.first.rrs.map(&:ttl))
+    assert_equal([200, 100], records[2..3].map(&:ttl), 'Grouping must not mutate source records')
+    assert_equal(1, section.rrsets('RRSIG').length)
+    assert_equal(2, section.rrsets('A').length)
+    assert_equal(0, section.rrsets('AAAA').length)
+  end
+
+  def test_grouping_copies_each_record_once
+    records = Array.new(40) { |i| Dnsruby::RR.create("host#{i}.example. 300 IN A 192.0.2.1") }
+    copies = 0
+    records.each do |record|
+      original = record.method(:clone)
+      record.define_singleton_method(:clone) { copies += 1; original.call }
+    end
+    sets = Dnsruby::Section.new.concat(records).rrsets
+    assert_equal(40, sets.length)
+    assert_equal(40, copies)
+    assert_equal(records.map(&:name), sets.map(&:name))
+  end
+
+  def test_grouping_observes_validation_work_limits
+    section = Dnsruby::Section.new.concat(Array.new(3) { |i| Dnsruby::RR.create("host#{i}.example. 300 IN A 192.0.2.1") })
+    limits = Dnsruby::ValidationBudget::DEFAULT_LIMITS.merge(max_work: 2)
+    budget = Dnsruby::ValidationBudget.new(limits: limits)
+    assert_raises(Dnsruby::ValidationLimitError) { Dnsruby::ValidationBudget.with(budget) { section.rrsets } }
+  end
+
+  def test_rejected_rrset_add_does_not_clone_the_record
+    set = Dnsruby::RRSet.new(Dnsruby::RR.create('one.example. 300 IN A 192.0.2.1'))
+    other = Dnsruby::RR.create('two.example. 300 IN A 192.0.2.2')
+    other.define_singleton_method(:clone) { raise 'Unexpected clone' }
+    refute(set.add(other))
+    assert_equal(1, set.length)
+  end
+end

data/test/tc_rrset_review_fixes.rb

@@ -0,0 +1,58 @@
+require_relative 'spec_helper'
+
+class RRSetReviewFixesTest < Minitest::Test
+  def record(address = '192.0.2.1')
+    Dnsruby::RR.create("host.example. 300 IN A #{address}")
+  end
+
+  def signature
+    Dnsruby::RR.create('host.example. 300 IN RRSIG A 8 2 300 20300101000000 20200101000000 123 example. AQID')
+  end
+
+  def test_add_set_and_delete_signature_preserve_membership
+    source = Dnsruby::RRSet.new([record, signature])
+    target = Dnsruby::RRSet.new(record('192.0.2.2'))
+    assert(target.add(source))
+    assert_equal(3, target.length)
+    assert_equal(1, target.num_sigs)
+    assert_equal(2, target.rrs.length)
+    assert(target.delete(target.sigs.first))
+    assert_equal(0, target.num_sigs)
+    assert_empty(target.sigs)
+    assert_equal(2, target.rrs.length)
+    refute(target.add(Dnsruby::RRSet.new))
+  end
+
+  def test_bulk_membership_index_is_discarded_before_records_escape
+    original = record
+    set = Dnsruby::RRSet.new([original, record('192.0.2.2'), original])
+    assert_equal(2, set.length)
+    assert_nil(set.instance_variable_get(:@membership_index))
+    set[0].address = Dnsruby::IPv4.create('192.0.2.3')
+    assert(set.add(record))
+    assert_equal(3, set.length)
+    assert(set.add(record('192.0.2.3')))
+    assert_equal(3, set.length)
+    assert_equal('192.0.2.1', original.address.to_s)
+  end
+
+  def test_add_set_without_cloning_keeps_the_requested_aliasing
+    source = Dnsruby::RRSet.new(record)
+    target = Dnsruby::RRSet.new
+    target.add(source, false)
+    assert_same(source[0], target[0])
+    source[0].address = Dnsruby::IPv4.create('192.0.2.2')
+    target.add(record)
+    assert_equal(2, target.length)
+  end
+
+  def test_bulk_grouping_deduplicates_and_normalizes_ttls
+    records = [record, record('192.0.2.2'), record]
+    records.last.ttl = 100
+    sets = Dnsruby::Section.new.concat(records).rrsets
+    assert_equal(1, sets.length)
+    assert_equal(2, sets.first.length)
+    assert_equal([100, 100], sets.first.rrs.map(&:ttl))
+    assert_equal([300, 300, 100], records.map(&:ttl))
+  end
+end

data/test/tc_rrsig.rb

@@ -50,8 +50,28 @@ class RrsigTest < Minitest::Test
     assert(rr.type_covered == Dnsruby::Types.TYPE731)
   end
 
+  def test_type_covered_rejects_out_of_range_before_mapping_or_wire_truncation
+    table = Dnsruby::CodeMapper.class_variable_get(:@@arrays).fetch(Dnsruby::Types)
+    before = [table.strings.dup, table.stringsdown.dup, table.values.dup, table.maxcode]
+    [65_536, 65_538, 2**128].each do |code|
+      text = "x. 60 IN RRSIG TYPE#{code} 8 1 60 20300101000000 20200101000000 12345 x. AA=="
+      assert_raises(Dnsruby::DecodeError) { Dnsruby::RR.create(text) }
+      assert_raises(ArgumentError) { Dnsruby::ZoneReader.new('x.').process_line(text) }
+    end
+    assert_equal(before, [table.strings, table.stringsdown, table.values, table.maxcode])
+    record = Dnsruby::RR.create(INPUT)
+    [-1, 65_536].each do |code|
+      assert_raises(Dnsruby::DecodeError) { record.type_covered = code }
+      assert_equal(Dnsruby::Types.A, record.type_covered)
+    end
+    record.type_covered = 'TYPE65535'
+    message = Dnsruby::Message.new
+    message.add_answer(record)
+    assert_equal(65_535, Dnsruby::Message.decode(message.encode).answer.first.type_covered.code)
+  end
+
   def test_string_with_comments
     r = Dnsruby::RR.create("tjeb.nl.		 3600		 IN		 RRSIG		 NSEC3PARAM 7 2 3600 20090630164649 20090602164649 53177 tjeb.nl. Fw70WQMviRFGyeze3MUpfafaAcWIvHRpnq4ZK3lxexrR1p+rLxK5C4qVKU71XYrPYR7XEBxgUG1oyKNOhFOVyx31EjC462dz7Vxn6UDpD1LIwNnD28+oHfS9AFzGKcn4zUZqT+8IvOO1jiS9c3Y8WAkOloN9AwGIIKWU8zAp1n4= ;{id = 53177}")
     assert_equal("Fw70WQMviRFGyeze3MUpfafaAcWIvHRpnq4ZK3lxexrR1p+rLxK5C4qVKU71XYrPYR7XEBxgUG1oyKNOhFOVyx31EjC462dz7Vxn6UDpD1LIwNnD28+oHfS9AFzGKcn4zUZqT+8IvOO1jiS9c3Y8WAkOloN9AwGIIKWU8zAp1n4=", ([r.signature].pack("m*")).gsub(/\n/,"").chomp)
   end
-end
+end

data/test/tc_scoped_ipv6.rb

@@ -0,0 +1,153 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+require 'tempfile'
+
+class TestScopedIPv6 < Minitest::Test
+  SCOPED_SERVERS = %w[
+    fe80::feed:face:c0ff:ee00%en0
+    fe80::5054:ff:fe8b:6576%br0
+    fe80::1%3
+    FE80:0:0:0:0:0:0:ABCD%Eth0
+    fe80::1%eth0.100
+    fe80::1%veth-1
+    fe80::1%interface_1
+  ].freeze
+
+  def without_hostname_lookup
+    unexpected = ->(*) { flunk('A scoped literal must not trigger DNS resolution') }
+    Dnsruby::Resolver.stub(:new, unexpected) do
+      Dnsruby::Recursor.stub(:new, unexpected) { yield }
+    end
+  end
+
+  def test_scoped_nameservers_are_validated_without_dns_and_preserved
+    without_hostname_lookup do
+      SCOPED_SERVERS.each do |server|
+        assert_equal(server, Dnsruby::Config.resolve_server(server))
+        config = Dnsruby::Config.new
+        config.nameserver = [server]
+        assert_equal([server], config.nameserver)
+        assert_equal(Dnsruby::IPv6.create(server.split('%').first),
+                     Dnsruby::Config.ipv6_server_address(server))
+      end
+    end
+  end
+
+  def test_explicit_ipv6_endpoint_validation_rejects_malformed_literals
+    invalid = [
+      'fe80::1%', 'fe80::1%en0%en1', 'fe80::1%en 0',
+      "fe80::1%en0\n", "fe80::1%en0\0", 'fe80::1%en0/64',
+      'fe80::1/64%en0', '[fe80::1%en0]', '192.0.2.1%en0',
+      'example.test%en0', '%en0', 'fe80::gggg%en0',
+      '1:2:3:4:5:6:7::8%en0', '1:2:3:4:5:6::192.0.2.1%3',
+    ]
+    without_hostname_lookup do
+      invalid.each do |server|
+        assert_raises(ArgumentError, server) { Dnsruby::Config.ipv6_server_address(server) }
+        refute(Dnsruby::Config.scoped_ipv6_server?(server), server)
+      end
+    end
+  end
+
+  def test_percent_containing_dns_names_remain_nameserver_names
+    queried = []
+    lookup = Object.new
+    lookup.define_singleton_method(:query) do |name|
+      queried << name.to_s
+      response = Dnsruby::Message.new(name)
+      response.add_answer(Dnsruby::RR.create(name: name, type: 'A', address: '192.0.2.53'))
+      Dnsruby::Message.decode(response.encode)
+    end
+    lookup.define_singleton_method(:close) { }
+    Dnsruby::Config.stub(:nameserver_resolver, lookup) do
+      ['ns%blue.example', 'ns:blue%en0.example', 'example.test%en0', '%en0',
+       '192.0.2.1%en0', 'fe80::1%', 'fe80::1%en0/64', 'fe80::gggg%en0'].each do |name|
+        [name, Dnsruby::Name.create(name)].each do |input|
+          config = Dnsruby::Config.new
+          config.nameserver = [input]
+          assert_equal([input], config.nameserver)
+          assert_equal('192.0.2.53', Dnsruby::Config.resolve_server(input))
+          assert_equal(name, queried.last)
+          resolver = Dnsruby::Resolver.new(nameserver: [input])
+          assert_equal(['192.0.2.53'], resolver.single_resolvers.map(&:server))
+          resolver.close
+        end
+      end
+    end
+  end
+
+  def test_resolver_constructor_forms_keep_scoped_nameserver
+    server = SCOPED_SERVERS.first
+    [server, {nameserver: server}, {nameserver: [server, '192.0.2.1']}].each do |options|
+      resolver = Dnsruby::Resolver.new(options)
+      expected = options.is_a?(Hash) ? Array(options[:nameserver]) : [server]
+      assert_equal(expected, resolver.single_resolvers.map(&:server))
+    ensure
+      resolver.close if resolver
+    end
+    single = Dnsruby::SingleResolver.new(server)
+    assert_equal(server, single.server)
+  end
+
+  def test_resolv_conf_retains_scoped_server_and_ipv4_fallback
+    Tempfile.create('dnsruby-scoped-resolv') do |file|
+      file.write("nameserver #{SCOPED_SERVERS.first}\nnameserver 192.168.0.1\n")
+      file.flush
+      resolver = Dnsruby::Resolver.new(config_info: file.path)
+      expected = [SCOPED_SERVERS.first, '192.168.0.1']
+      assert_equal(expected, resolver.config.nameserver)
+      assert_equal(expected, resolver.single_resolvers.map(&:server))
+    ensure
+      resolver.close if resolver
+    end
+  end
+
+  def test_server_setter_switches_address_family
+    sender = Dnsruby::PacketSender.new('192.0.2.1')
+    refute(sender.instance_variable_get(:@ipv6))
+    SCOPED_SERVERS.each do |server|
+      sender.server = server
+      assert_equal(server, sender.server)
+      assert(sender.instance_variable_get(:@ipv6))
+    end
+    sender.server = '192.0.2.2'
+    refute(sender.instance_variable_get(:@ipv6))
+  end
+
+  def test_unscoped_addresses_remain_supported
+    ['192.0.2.1', '2001:db8::1', 'fe80::1', '::1'].each do |server|
+      assert_equal(server, Dnsruby::Config.resolve_server(server))
+    end
+    [Dnsruby::IPv4.create('192.0.2.1'), Dnsruby::IPv6.create('2001:db8::1')].each do |server|
+      assert_same(server, Dnsruby::Config.resolve_server(server))
+    end
+  end
+
+  def test_config_accepts_mixed_plain_and_scoped_literals_without_dns
+    servers = ['192.0.2.1', '2001:DB8:0:0:0:0:0:53', '::1',
+               '::ffff:192.0.2.53', SCOPED_SERVERS.first, 'fe80::1%3']
+    without_hostname_lookup do
+      config = Dnsruby::Config.new
+      config.nameserver = servers
+      assert_equal(servers, config.nameserver)
+      Tempfile.create('dnsruby-mixed-ip-resolv') do |file|
+        servers.each { |server| file.puts("nameserver #{server}") }
+        file.flush
+        assert_equal(servers, Dnsruby::Config.parse_resolv_conf(file.path)[:nameserver])
+        config = Dnsruby::Config.new
+        config.set_config_info(file.path)
+        assert_equal(servers, config.nameserver)
+      end
+    end
+  end
+
+  def test_scope_does_not_become_dns_record_data
+    assert_raises(ArgumentError) { Dnsruby::IPv6.create('fe80::1%en0') }
+    assert_raises(ArgumentError) { Dnsruby::RR.create('host.test. 60 IN AAAA fe80::1%en0') }
+    message = Dnsruby::Message.new
+    message.add_answer(Dnsruby::RR.create('host.test. 60 IN AAAA fe80::1'))
+    answer = Dnsruby::Message.decode(message.encode).answer.first
+    assert_equal('FE80::1', answer.address.to_s)
+    assert_equal(16, answer.address.address.bytesize)
+  end
+end