dnsruby 1.73.1 → 2.0.0

data/test/tc_v2_release_transport.rb

@@ -0,0 +1,304 @@
+require_relative 'tc_pipeline_send'
+require 'minitest/mock'
+
+class V2ReleaseTransportTest < Minitest::Test
+  def test_udp_readiness_without_data_keeps_the_attempt_registered
+    isolated(<<~'SCENARIO')
+      SELECTOR.define_singleton_method(:tcp?) { |_| false }
+      socket = FrameSocket.new
+      request = query
+      setting = settings(socket, :datagram, request)
+      setting.is_persistent_socket = false
+      SELECTOR.add_to_select(setting)
+      [IO::EAGAINWaitReadable, Errno::EINTR].each do |exception|
+        socket.define_singleton_method(:recvfrom_nonblock) { |_| raise exception }
+        raise 'unexpected response' unless SELECTOR.get_incoming_data(socket, 512).nil?
+        raise 'attempt lost' unless SELECTOR.query_settings_for_id(:datagram).equal?(setting)
+        raise 'socket closed' if socket.closed?
+        raise 'retryable read became an error' unless setting.client_queue.empty?
+      end
+      SELECTOR.remove_id(:datagram)
+    SCENARIO
+  end
+
+  def test_pipeline_configuration_is_snapshotted_before_worker_dispatch
+    isolated(<<~'SCENARIO')
+      [false, true].each do |initial_mode|
+        socket = FrameSocket.new
+        writer = Dnsruby::PacketSender.new(server: '127.0.0.1', tcp_pipelining: initial_mode)
+        writer.define_singleton_method(:connect_tcp) { |*| socket }
+        writer.define_singleton_method(:tcp_pipeline_socket) do |*|
+          raise 'shared writer mutex missing' unless instance_variable_get(:@pipeline_mutex).owned?
+          [socket, true]
+        end
+        K.class_variable_set(:@@select_thread, Thread.current)
+        dispatched = nil
+        SELECTOR.define_singleton_method(:defer_send) do |owner, &operation|
+          dispatched = owner
+          writer.tcp_pipelining = !initial_mode
+          operation.call
+        end
+        request = query
+        writer.send_dnsruby(request.encode, request, initial_mode, Queue.new, true)
+        registered = SELECTOR.query_settings_for_id(initial_mode)
+        raise 'configuration changed admitted socket mode' unless registered &&
+          !!registered.is_persistent_socket == initial_mode
+        raise 'worker grouping changed during admission' unless dispatched.equal?(initial_mode ? writer : nil)
+        raise 'incomplete frame' unless socket.written.bytesize == request.encode.bytesize + 2
+        SELECTOR.remove_id(initial_mode)
+        socket.close
+      end
+    SCENARIO
+  end
+
+  def test_packet_timeout_processing_visits_only_due_owners
+    isolated(<<~'SCENARIO')
+      now = Dnsruby::TransportClock.now
+      due = settings(FrameSocket.new, :due)
+      later = settings(FrameSocket.new, :later)
+      due.endtime, later.endtime = now - 1, now + 60
+      [due, later].each { |setting| SELECTOR.add_to_select(setting) }
+      table = K.class_variable_get(:@@timeouts)
+      [:each, :map, :keys].each { |method| table.define_singleton_method(method) { raise 'scanned packet table' } }
+      SELECTOR.process_timeouts
+      raise 'future attempt expired' unless SELECTOR.query_settings_for_id(:later).equal?(later)
+      raise 'due attempt retained' if SELECTOR.query_settings_for_id(:due)
+      raise 'timeout missing' unless due.client_queue.pop.last.is_a?(Dnsruby::ResolvTimeout)
+      SELECTOR.remove_id(:later)
+    SCENARIO
+  end
+
+  def test_logical_tick_visits_only_due_plans_in_admission_order
+    isolated(<<~'SCENARIO')
+      sent = []
+      writer = Object.new
+      writer.define_singleton_method(:server) { '192.0.2.53' }
+      writer.define_singleton_method(:prepare_send_async) { |_, _, id, *| -> { sent << id[2] } }
+      parent = Struct.new(:single_resolvers, :single_res_mutex).new([writer], Mutex.new)
+      engine = Dnsruby::ResolverRuby.new(parent)
+      now = Dnsruby::TransportClock.now
+      plans = engine.instance_variable_get(:@timeouts)
+      [:due, :later].each do |id|
+        engine.instance_variable_get(:@query_list)[id] = [query, Queue.new, Queue.new, [], nil]
+        plans[id] = [now + 120, {(id == :due ? now - 1 : now + 60) => [writer, 0]}, false]
+        engine.send(:update_tick_deadline, id)
+      end
+      plans.define_singleton_method(:keys) { raise 'scanned all logical queries' }
+      plans[:later][1].define_singleton_method(:each_key) { raise 'visited future retry plan' }
+      engine.tick
+      raise 'incorrect due sends' unless sent == [:due]
+      raise 'incorrect next deadline' unless engine.next_tick_at == now + 60
+    SCENARIO
+  end
+
+  def test_retries_are_bounded_per_server_and_transport
+    budget = Dnsruby::SelectThread::TransmissionBudget.new
+    3.times { assert(budget.admit('192.0.2.53', 53, false)) }
+    refute(budget.admit('192.0.2.53', 53, false))
+    assert(budget.admit('192.0.2.53', 53, true))
+    assert(budget.admit('192.0.2.54', 53, false))
+    resolver = Dnsruby::Resolver.new(nameserver: ['192.0.2.53', '192.0.2.54'], retry_times: 6)
+    counts = resolver.generate_timeouts.values.group_by(&:first).transform_values(&:length)
+    assert_equal([3, 3], counts.values.sort)
+  ensure
+    resolver&.close
+  end
+
+  def test_validation_worker_shares_the_original_transmission_limit
+    budget = Dnsruby::SelectThread::TransmissionBudget.new
+    query = Dnsruby::Message.new('example.', 'A')
+    query.do_validation = true
+    assert(budget.admit('192.0.2.53', 53, false, query.question.first))
+    response = query.clone
+    completions = []
+    selector = Object.new
+    selector.define_singleton_method(:validation_transmission_budget) { |*| budget }
+    selector.define_singleton_method(:register_validation) { |*| true }
+    selector.define_singleton_method(:unregister_validation) { |*| }
+    selector.define_singleton_method(:push_validation_response_to_select) { |*args| completions << args }
+    sender = Struct.new(:dnssec).new(true)
+    validator = Dnsruby::ValidatorThread.new(:client, Queue.new, response, nil, query, selector, sender)
+    validate = lambda do |_, answer|
+      # Separate helper send tokens must count against the original resolution.
+      2.times do
+        token = Dnsruby::SelectThread::SendToken.new
+        assert(token.transmission_budget.admit('192.0.2.53', 53, false, query.question.first))
+      end
+      token = Dnsruby::SelectThread::SendToken.new
+      refute(token.transmission_budget.admit('192.0.2.53', 53, false, query.question.first))
+      answer.security_level = Dnsruby::Message::SecurityLevel.SECURE
+      true
+    end
+    Dnsruby::Dnssec.stub(:validate_with_query, validate) do
+      Dnsruby::PacketSender.stub(:cache, ->(*) {}) do
+        assert_nil(Thread.new { validator.do_validate; Dnsruby::SelectThread::TransmissionBudget.current }.value)
+      end
+    end
+    assert_equal(1, completions.length)
+    assert_nil(completions.first[3])
+  end
+
+  class TransferSocket
+    attr_reader :written
+    def initialize(input = ''.b)
+      @input, @written, @closed = input.dup, +''.b, false
+    end
+    def write_nonblock(bytes)
+      count = [bytes.bytesize, 3].min
+      @written << bytes.byteslice(0, count)
+      count
+    end
+    def read_nonblock(length)
+      raise EOFError if @input.empty?
+      @input.slice!(0, [length, 5].min)
+    end
+    def close; @closed = true; end
+    def closed?; @closed; end
+  end
+
+  def test_zone_transfer_writes_complete_frames_and_reads_fragmented_frames
+    transfer = Dnsruby::ZoneTransfer.new
+    request = Dnsruby::Message.new('example.', 'AXFR')
+    socket = TransferSocket.new(frame(request))
+    transfer.send_message(socket, request)
+    assert_equal(frame(request), socket.written)
+    assert_equal(request.question, transfer.receive_message(socket).question)
+  end
+
+  def test_zone_transfer_accepts_multi_message_axfr_with_an_empty_later_question
+    transfer = Dnsruby::ZoneTransfer.new
+    soa = Dnsruby::RR.create('example. 300 IN SOA ns.example. hostmaster.example. 4 60 60 3600 60')
+    address = Dnsruby::RR.create('www.example. 300 IN A 192.0.2.1')
+    first = Dnsruby::Message.new('example.', 'AXFR')
+    first.add_answer(soa)
+    first.add_answer(address)
+    last = Dnsruby::Message.new
+    last.add_answer(soa.clone)
+    responses = [first, last]
+    socket = TransferSocket.new
+    transfer.define_singleton_method(:send_message) do |_, request|
+      responses.each { |response| response.header.id = request.header.id; response.header.qr = true }
+    end
+    transfer.define_singleton_method(:receive_message) { |_| responses.shift }
+    Socket.stub(:tcp, socket) do
+      assert_equal([soa, address], transfer.do_transfer('example.', '192.0.2.53'))
+    end
+    assert(socket.closed?)
+  end
+
+  def test_zone_transfer_timeout_configuration_and_interrupted_wait
+    transfer = Dnsruby::ZoneTransfer.new
+    assert_equal(30, transfer.io_timeout)
+    assert_nil(transfer.transfer_timeout)
+    transfer.io_timeout = 1
+    transfer.transfer_timeout = 2
+    assert_equal(1.0, transfer.io_timeout)
+    assert_equal(2.0, transfer.transfer_timeout)
+    transfer.transfer_timeout = nil
+    assert_raises(ArgumentError) { transfer.io_timeout = 0 }
+    assert_raises(ArgumentError) { transfer.transfer_timeout = Float::INFINITY }
+    calls = 0
+    IO.stub(:select, ->(*_) { calls += 1; raise Errno::EINTR if calls == 1; nil }) do
+      transfer.send(:wait_for_io, Object.new, Dnsruby::TransportClock.now + 1, true)
+    end
+    assert_equal(2, calls)
+    assert_raises(Dnsruby::ResolvTimeout) do
+      transfer.tcp_read(TransferSocket.new, 2, Dnsruby::TransportClock.now - 1)
+    end
+  end
+
+  def test_zone_transfer_matches_the_name_sent_in_the_question
+    zones = ['example', 'example.', 'EXAMPLE', Dnsruby::Name.create('example').freeze,
+      Dnsruby::Name.create('example.').freeze, '192.0.2.1']
+    ['AXFR', 'IXFR'].each do |type|
+      zones.each do |zone|
+        owner = zone == '192.0.2.1' ? '1.2.0.192.in-addr.arpa.' : 'example.'
+        soa = Dnsruby::RR.create("#{owner} 300 IN SOA ns.example. hostmaster.example. 4 60 60 3600 60")
+        address = Dnsruby::RR.create("www.#{owner} 300 IN A 192.0.2.1")
+        original_absolute = zone.absolute? if zone.is_a?(Dnsruby::Name)
+        answers = if type == 'AXFR'
+          [soa, address, soa.clone]
+        else
+          [soa, soa.clone.tap { |rr| rr.serial = 2 }, soa.clone, address, soa.clone]
+        end
+        result = transfer_with_answers(zone, type, owner, answers)
+        if type == 'AXFR'
+          assert_equal([soa, address], result, zone.inspect)
+        else
+          assert_equal([[2, 4]], result.map { |delta| [delta.start, delta.end] }, zone.inspect)
+          assert_equal([soa, address], result.first.adds)
+        end
+        assert_equal(original_absolute, zone.absolute?) if zone.is_a?(Dnsruby::Name)
+      end
+    end
+  end
+
+  def test_zone_transfer_still_rejects_an_initial_soa_for_another_zone_or_class
+    ['AXFR', 'IXFR'].each do |type|
+      ['example', 'example.'].each do |zone|
+        ['other. 300 IN', 'example. 300 CH'].each do |owner_and_class|
+          soa = Dnsruby::RR.create("#{owner_and_class} SOA ns.example. hostmaster.example. 4 60 60 3600 60")
+          error = assert_raises(Dnsruby::ResolvError) do
+            transfer_with_answers(zone, type, 'example.', [soa])
+          end
+          assert_equal('initial SOA does not match transfer zone', error.message)
+        end
+      end
+    end
+  end
+
+  def test_ixfr_terminal_soa_matches_the_opening_soa
+    opening = Dnsruby::RR.create('example. 300 IN SOA ns.example. hostmaster.example. 4 60 60 3600 60')
+    [opening.clone, opening.clone.tap { |rr| rr.refresh = 120 }].each do |closing|
+      transfer = Dnsruby::ZoneTransfer.new
+      transfer.instance_variable_set(:@zone_name, Dnsruby::Name.create('example.'))
+      transfer.instance_variable_set(:@transfer_type, Dnsruby::Types.IXFR)
+      transfer.instance_variable_set(:@serial, 2)
+      transfer.instance_variable_set(:@state, :InitialSoa)
+      # Two ordinary deltas, including their repeated intermediate SOA.
+      old = opening.clone.tap { |rr| rr.serial = 2 }
+      middle = opening.clone.tap { |rr| rr.serial = 3 }
+      [opening, old, middle, middle.clone, opening.clone].each { |rr| transfer.parseRR(rr) }
+      if closing.refresh == opening.refresh
+        transfer.parseRR(closing)
+        assert_equal(:End, transfer.instance_variable_get(:@state))
+        assert_equal([[2, 3], [3, 4]], transfer.instance_variable_get(:@ixfr).map { |delta| [delta.start, delta.end] })
+      else
+        assert_raises(Dnsruby::ResolvError) { transfer.parseRR(closing) }
+        assert_equal(:Ixfr_Add, transfer.instance_variable_get(:@state))
+      end
+    end
+  end
+
+  private
+
+  def transfer_with_answers(zone, type, owner, answers)
+    transfer = Dnsruby::ZoneTransfer.new
+    transfer.transfer_type = type
+    transfer.serial = 2
+    response = Dnsruby::Message.new(owner, type)
+    response.header.qr = true
+    answers.each { |rr| response.add_answer!(rr) }
+    socket = TransferSocket.new
+    transfer.define_singleton_method(:send_message) do |_, request|
+      response.header.id = request.header.id
+    end
+    transfer.define_singleton_method(:receive_message) { |_| Dnsruby::Message.decode(response.encode) }
+    Socket.stub(:tcp, socket) { transfer.do_transfer(zone, '192.0.2.53') }
+  ensure
+    assert(socket.closed?) if socket
+  end
+
+  def frame(message)
+    wire = message.encode
+    [wire.bytesize].pack('n') + wire
+  end
+
+  def isolated(script)
+    options = ''.frozen? ? ['--enable-frozen-string-literal'] : []
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, *options, '-I',
+      File.expand_path('../lib', __dir__), '-e', "#{TestPipelineSend::FIXTURE}\nTimeout.timeout(10) do\n#{script}\nend")
+    assert(status.success?, "#{stdout}\n#{stderr}")
+    assert_empty(stderr)
+  end
+end

data/test/tc_v2_zone_transfer_native.rb

@@ -0,0 +1,58 @@
+require_relative 'spec_helper'
+require 'socket'
+require 'timeout'
+
+class V2ZoneTransferNativeTest < Minitest::Test
+  def test_axfr_over_tcp_with_and_without_tsig
+    [false, true].each do |signed|
+      listener = TCPServer.new('127.0.0.1', 0)
+      transfer = Dnsruby::ZoneTransfer.new
+      transfer.server = '127.0.0.1'
+      transfer.port = listener.addr[1]
+      transfer.io_timeout = 2
+      transfer.transfer_timeout = 3
+      transfer.tsig = ['key.example.', ['local-transfer-secret'].pack('m0')] if signed
+      soa = Dnsruby::RR.create('example. 300 IN SOA ns.example. hostmaster.example. 2 60 60 3600 60')
+      address = Dnsruby::RR.create('www.example. 300 IN A 192.0.2.1')
+      server = Thread.new do
+        socket = listener.accept
+        query = Dnsruby::Message.decode(socket.read(socket.read(2).unpack1('n')))
+        response = Dnsruby::Message.new('example.', 'AXFR')
+        response.header.id = query.header.id
+        response.header.qr = response.header.aa = true
+        response.add_answer(soa)
+        response.add_answer(address)
+        if signed
+          response.add_answer!(soa.clone)
+          key = Dnsruby::RR.create(name: 'key.example.', type: 'TSIG', klass: 'ANY',
+            key: ['local-transfer-secret'].pack('m0'))
+          key.apply(response, query)
+          responses = [response]
+        else
+          closing = Dnsruby::Message.new
+          closing.header.id = query.header.id
+          closing.header.qr = closing.header.aa = true
+          closing.add_answer(soa.clone)
+          responses = [response, closing]
+        end
+        responses.each do |message|
+          wire = message.encode
+          # TCP may coalesce these writes or deliver any combination of them.
+          socket.write([wire.bytesize].pack('n').byteslice(0, 1))
+          socket.write([wire.bytesize].pack('n').byteslice(1, 1))
+          socket.write(wire)
+        end
+      ensure
+        socket&.close
+      end
+      assert_equal([soa, address], Timeout.timeout(5) { transfer.transfer('example') })
+      assert_equal(:Verified, transfer.last_tsigstate) if signed
+      assert_nil(transfer.last_tsigstate) unless signed
+      Timeout.timeout(2) { server.value }
+    ensure
+      listener&.close
+      server&.kill
+      server&.join
+    end
+  end
+end

data/test/tc_zone_reader.rb

@@ -71,5 +71,221 @@ ZONEDATA
     assert_equal(false, stringio.closed?)
     stringio.close
   end
-end
 
+  # The reader reattaches a quoted tail for every type, so a parenthesis right
+  # before a quote must separate it too: the parenthesis is stripped from the
+  # line before the quoted text goes back on.
+  PAREN_QUOTE_ZONE = <<~ZONEDATA
+    $TTL 3600
+    caa    IN CAA   0 issue("ca.example.net")
+    hinfo  IN HINFO ("cpu" "os")
+    txt    IN TXT   ("abc" "def")
+  ZONEDATA
+
+  def test_zone_parenthesis_before_quote
+    reader = Dnsruby::ZoneReader.new('example.com.')
+    caa, hinfo, txt = reader.process_file(StringIO.new(PAREN_QUOTE_ZONE))
+
+    assert_equal('issue', caa.property_tag)
+    assert_equal('ca.example.net', caa.property_value)
+
+    assert_equal('cpu', hinfo.cpu)
+    assert_equal('os', hinfo.os)
+
+    assert_equal(['abc', 'def'], txt.strings)
+  end
+
+  # A backslash escaping the quote abuts it too. RFC 1035 sec 5.1 makes \" a
+  # literal quote within an unquoted character-string, so each of these is one
+  # string, not two.
+  ESCAPED_QUOTE_ZONE = <<~'ZONEDATA'
+    $TTL 3600
+    lead   IN TXT   \"escaped
+    mid    IN TXT   abc\"def
+  ZONEDATA
+
+  def test_zone_escaped_quote_not_separated
+    reader = Dnsruby::ZoneReader.new('example.com.')
+    lead, mid = reader.process_file(StringIO.new(ESCAPED_QUOTE_ZONE))
+
+    assert_equal(['"escaped'], lead.strings)
+    assert_equal(['abc"def'], mid.strings)
+  end
+
+  # SVCB/HTTPS records carry a TargetName in the middle of the RDATA. The zone
+  # reader must resolve relative TargetNames against the origin, while leaving
+  # the root (".") and already-absolute names untouched.
+  SVCB_ZONE = <<~ZONEDATA
+    $TTL 3600
+    $ORIGIN example.com.
+    @      IN SOA  ns1.example.com. hostmaster.example.com. 1 2 3 4 5
+    @      IN HTTPS 1 . alpn=h2,h3 ipv4hint=192.0.2.1
+    alias  IN SVCB  0 svc4.example.com.
+    rel    IN SVCB  1 foo alpn=h2
+    svc    IN HTTPS 1 svc.example.net. port=8443
+  ZONEDATA
+
+  def svcb_zone_records
+    reader = Dnsruby::ZoneReader.new('example.com.')
+    records = reader.process_file(StringIO.new(SVCB_ZONE))
+    records.reject { |rr| rr.type == Types::SOA }
+  end
+
+  def test_zone_svcb_https_targets_resolved
+    https_root, svcb_alias, svcb_rel, https_svc = svcb_zone_records
+
+    # Root TargetName stays as the root.
+    assert_equal(Types::HTTPS, https_root.type)
+    assert_equal('.', https_root.target.to_s(true))
+    assert_equal('h2,h3', https_root.params_to_hash['alpn'])
+
+    # Absolute AliasMode TargetName is untouched.
+    assert_equal(0, svcb_alias.priority)
+    assert_equal('svc4.example.com.', svcb_alias.target.to_s(true))
+
+    # Relative TargetName gains the origin.
+    assert_equal('foo.example.com.', svcb_rel.target.to_s(true))
+    assert_equal('h2', svcb_rel.params_to_hash['alpn'])
+
+    # Absolute TargetName in another zone is untouched.
+    assert_equal('svc.example.net.', https_svc.target.to_s(true))
+    assert_equal('8443', https_svc.params_to_hash['port'])
+  end
+
+  def test_zone_svcb_https_escaped_final_dots_do_not_make_targets_absolute
+    %w[SVCB HTTPS].each do |type|
+      {
+        'foo\\.' => ['foo.', 'example'],
+        'foo\\046' => ['foo.', 'example'],
+        'foo\\\\.' => ['foo\\'],
+        'foo\\..' => ['foo.'],
+        '.' => [],
+        'foo.' => ['foo']
+      }.each do |target, labels|
+        text = "owner 300 IN #{type} 1 #{target}\n"
+        record = ZoneReader.new('example.').process_io(StringIO.new(text)).first
+        assert_equal(labels, record.target.labels.map(&:string), "#{type} #{target}")
+        assert(record.target.absolute?)
+        assert_equal(record, record.clone)
+      end
+    end
+  end
+
+  # A HTTPS record spread across several lines with parentheses is valid zone
+  # format and must be parsed as a single record.
+  MULTILINE_ZONE = <<~ZONEDATA
+    $TTL 3600
+    $ORIGIN example.com.
+    @   IN SOA  ns1.example.com. hostmaster.example.com. 1 2 3 4 5
+    @   IN HTTPS ( 1 .  alpn=h2,h3
+                   port=443
+                   ipv4hint=192.0.2.1 )
+  ZONEDATA
+
+  def test_zone_multiline_https
+    reader = Dnsruby::ZoneReader.new('example.com.')
+    records = reader.process_file(StringIO.new(MULTILINE_ZONE))
+    https = records.find { |rr| rr.type == Types::HTTPS }
+    refute_nil(https)
+    assert_equal(1, https.priority)
+    assert_equal('.', https.target.to_s(true))
+    assert_equal('h2,h3', https.params_to_hash['alpn'])
+    assert_equal('443', https.params_to_hash['port'])
+    assert_equal('192.0.2.1', https.params_to_hash['ipv4hint'])
+  end
+
+  # RFC 9460 Appendix A: a SvcParamValue may be quoted, and the quotes open
+  # mid-token, unlike the quoted RDATA of a TXT record. The ech value also puts
+  # base64 padding inside the quotes, and an unquoted param after them.
+  QUOTED_SVCB_ZONE = <<~ZONEDATA
+    $TTL 3600
+    alpn   IN HTTPS 1 . alpn="h2,h3"
+    ech    IN HTTPS 1 . ech="AEX+DQBBzQAgACD/AA==" port=8443
+  ZONEDATA
+
+  def test_zone_quoted_svcparam_values
+    reader = Dnsruby::ZoneReader.new('example.com.')
+    alpn, ech = reader.process_file(StringIO.new(QUOTED_SVCB_ZONE))
+
+    assert_equal('h2,h3', alpn.params_to_hash['alpn'])
+
+    assert_equal('AEX+DQBBzQAgACD/AA==', ech.params_to_hash['ech'])
+    assert_equal('8443', ech.params_to_hash['port'])
+  end
+
+  # A quoted SvcParamValue inside the parentheses that group a record across
+  # lines. The quote opens mid-token, so the closing parenthesis travels with
+  # the quoted tail rather than with the rest of the line. An ech value is what
+  # gets wrapped in practice, being long enough to want a second line.
+  PAREN_QUOTED_SVCB_ZONE = <<~ZONEDATA
+    $TTL 3600
+    one    IN HTTPS ( 1 . alpn="h2,h3" )
+    two    IN HTTPS ( 1 .  ech="AEX+DQBBzQAgACD/AA=="
+                      port=8443 )
+  ZONEDATA
+
+  def test_zone_parenthesised_quoted_svcparam_values
+    reader = Dnsruby::ZoneReader.new('example.com.')
+    one_line, wrapped = reader.process_file(StringIO.new(PAREN_QUOTED_SVCB_ZONE))
+
+    assert_equal('h2,h3', one_line.params_to_hash['alpn'])
+
+    assert_equal('AEX+DQBBzQAgACD/AA==', wrapped.params_to_hash['ech'])
+    assert_equal('8443', wrapped.params_to_hash['port'])
+  end
+
+  def test_zone_literal_parentheses_do_not_continue_a_record
+    zone = <<~'ZONE'
+      quoted IN HTTPS 1 . key667="a(b)c"
+      escaped IN SVCB 1 . key667=a\(b\)c
+      decimal IN HTTPS 1 . key667=a\040b\041c
+      open IN HTTPS 1 . key667="a\("
+      close IN SVCB 1 . key667=a\)
+      quote IN HTTPS 1 . key667="a\"(b)c"
+      following IN A 192.0.2.1
+    ZONE
+    records = @reader.process_file(StringIO.new(zone))
+    assert_equal(7, records.size)
+    assert_equal(['a(b)c', 'a(b)c', 'a(b)c', 'a(', 'a)', 'a"(b)c'],
+                 records.first(6).map { |rr| rr.params[667] })
+    assert_equal('192.0.2.1', records.last.address.to_s)
+  end
+
+  def test_zone_grouping_ignores_parentheses_in_values_and_comments
+    zone = <<~'ZONE'
+      wrapped IN HTTPS (1 . key667="a;(b)c" ; unmatched ) in comment
+        key668=a\) ; unmatched ( in comment
+        port=443) ; ignored (
+      following IN A 192.0.2.1
+    ZONE
+    wrapped, following = @reader.process_file(StringIO.new(zone))
+    assert_equal('a;(b)c', wrapped.params[667])
+    assert_equal('a)', wrapped.params[668])
+    assert_equal('443', wrapped.params_to_hash['port'])
+    assert_equal('192.0.2.1', following.address.to_s)
+  end
+
+  def test_normalise_line_handles_grouping_when_called_directly
+    line = @reader.normalise_line('svc IN HTTPS (1 . key667="a\(b\)c")')
+    rr = RR.create(line)
+    assert_equal('svc.example.com.', rr.name.to_s(true))
+    assert_equal('a(b)c', rr.params[667])
+  end
+
+  def test_normalise_line_preserves_standalone_unmatched_grouping
+    ['host IN A (192.0.2.7', 'host IN A 192.0.2.7)'].each do |input|
+      rr = RR.create(@reader.normalise_line(input))
+      assert_equal('host.example.com.', rr.name.to_s(true))
+      assert_equal('192.0.2.7', rr.address.to_s)
+    end
+  end
+
+  def test_unbalanced_grouping_is_rejected
+    assert_raises(Dnsruby::ZoneReader::ParseException) do
+      @reader.process_file(StringIO.new('bad IN HTTPS 1 .)'))
+    end
+    assert_raises(Dnsruby::ZoneReader::ParseException) do
+      @reader.process_file(StringIO.new('bad IN HTTPS (1 .'))
+    end
+  end
+end