dnsruby 1.74.0 → 2.0.0

data/lib/dnsruby/resolver.rb

@@ -35,13 +35,10 @@ module Dnsruby
   #
   #  Note also that these timeouts are distinct from the SingleResolver's packet_timeout
   #
-  #  Timeouts apply to the initial query and response. If DNSSEC validation is to
-  #  be performed, then additional queries may be required (these are performed automatically
-  #  by Dnsruby). Each additional query will be performed with its own timeouts.
-  #  So, even with a query_timeout of 5 seconds, a response which required extensive
-  #  validation may take several times that long.
-  #  (Future versions of Dnsruby may expose finer-grained events for client tracking of
-  #  responses and validation)
+  #  The total query_timeout includes local DNSSEC validation. Validation may
+  #  require additional queries, each with its own packet timeout, but the caller
+  #  still receives a timeout when the original total deadline expires. Late
+  #  validation results cannot complete the query a second time.
   #
   #  == Methods
   #
@@ -68,11 +65,35 @@ module Dnsruby
   #  *  Dnsruby::Resolver#send_async(msg, response_queue, query_id)
   #
   #  == Event Loop
-  #  Dnsruby runs a pure Ruby event loop to handle I/O in a single thread.
+  #  Dnsruby runs a shared pure Ruby select loop for responses and timeouts.
+  #  TCP sends initiated by the selector run in a shared worker pool.
   #  Support for EventMachine has been deprecated.
   class Resolver
+    CONFIGURATION_MUTEX_CREATION = Mutex.new
+    private_constant :CONFIGURATION_MUTEX_CREATION
+
+    def ensure_current_process
+      return if @process_pid == Process.pid
+      CONFIGURATION_MUTEX_CREATION.synchronize do
+        if @process_pid != Process.pid
+          @single_res_mutex = Mutex.new
+          @configuration_mutex = nil
+          @resolver_ruby.reset_attributes if @resolver_ruby
+          @process_pid = Process.pid
+        end
+      end
+    end
+    private :ensure_current_process
+
+    def configuration_mutex
+      ensure_current_process
+      CONFIGURATION_MUTEX_CREATION.synchronize { @configuration_mutex ||= Mutex.new }
+    end
+    private :configuration_mutex
+
     DefaultQueryTimeout = 0
     DefaultPacketTimeout = 5
+    DefaultTcpIdleTimeout = 10
     DefaultRetryTimes = 1
     DefaultRetryDelay = 5
     DefaultPipeLiningMaxQueries = 5
@@ -80,7 +101,7 @@ module Dnsruby
     DefaultDnssec = false
     AbsoluteMinDnssecUdpSize = 1220
     MinDnssecUdpSize = 4096
-    DefaultUDPSize = MinDnssecUdpSize
+    DefaultUDPSize = 1232
 
     class EventType
       RECEIVED = 0
@@ -102,6 +123,9 @@ module Dnsruby
     # before closing, :infinite for infinite number of requests per connection
     attr_reader :tcp_pipelining_max_queries
 
+    # Close a reusable TCP connection after this many seconds without queries.
+    attr_reader :tcp_idle_timeout
+
     #  If no_tcp==true, then ONLY UDP will be used as a transport.
     #  This should not generally be used, but is provided as a debugging aid.
     attr_reader :no_tcp
@@ -122,7 +146,9 @@ module Dnsruby
     #  Should the Recursion Desired bit be set?
     attr_reader :recurse
 
-    #  The maximum UDP size to be used
+    # The advertised UDP response size, defaulting to 1232 bytes. Larger sizes
+    # may be configured explicitly. Truncated responses are retried over TCP
+    # unless no_tcp or ignore_truncation is set.
     attr_reader :udp_size
 
     #  The current Config
@@ -136,10 +162,14 @@ module Dnsruby
     #  The array of SingleResolvers used for sending query messages
     #     attr_accessor :single_resolvers # :nodoc:
     def single_resolvers=(s) # :nodoc:
-      @configured = true
-      #       @single_res_mutex.synchronize {
-      @single_resolvers = s
-      #       }
+      configuration_mutex.synchronize do
+        @single_res_mutex.synchronize do
+          (@single_resolvers - s).compact.each(&:close)
+          @single_resolvers = s
+          @configuration_error = nil
+          @configured = true
+        end
+      end
     end
     def single_resolvers # :nodoc:
       unless @configured
@@ -161,6 +191,7 @@ module Dnsruby
     #  The query will be tried across nameservers retry_times times, with a delay of retry_delay seconds
     #  between each retry. The first time round, retry_delay will be divided by the number of nameservers
     #  being targetted, and a new nameserver will be queried with the resultant delay.
+    #  RFC 9520 caps attempts at three per server address and transport, including protocol retries.
     attr_accessor :retry_times, :retry_delay
 
     #  Use DNSSEC for this Resolver
@@ -244,10 +275,16 @@ module Dnsruby
     #    end
     def send_message(message)
       Dnsruby.log.debug{'Resolver : sending message'}
-      q = Queue.new
-      send_async(message, q)
+      control = QueryControl.current
+      q = control ? QueryControl::Queue.new : Queue.new
+      control&.check!
+      query_id = send_async(message, q)
 
-      _id, result, error = q.pop
+      begin
+        _id, result, error = control ? control.pop(q) : q.pop
+      ensure
+        @resolver_ruby.cancel_query(query_id, q) if control && @resolver_ruby
+      end
 
       if error
         error.response = result if error.is_a?(ResolvError)
@@ -389,27 +426,26 @@ module Dnsruby
     #    end
     #
     def send_async(msg, client_queue, client_query_id = nil)
-      unless @configured
+      begin
         add_config_nameservers
+      rescue ArgumentError => error
+        # Constructor options historically tolerate an unusable nameserver and
+        # queries then report an asynchronous timeout. Keep that completion path
+        # for every waiter on the same failed initialization.
+        raise unless error.equal?(@configuration_error) && @single_resolvers.empty?
       end
-      #       @single_res_mutex.synchronize {
-      unless @resolver_ruby # @TODO@ Synchronize this?
-        @resolver_ruby = ResolverRuby.new(self)
-      end
-      #       }
-      client_query_id = @resolver_ruby.send_async(msg, client_queue, client_query_id)
-      if @single_resolvers.length == 0
-        Thread.start {
-          sleep(@query_timeout == 0 ? 1 : @query_timeout)
-          client_queue.push([client_query_id, nil, ResolvTimeout.new('Query timed out - no valid nameservers configured')])
-        }
-      end
-      client_query_id
+      engine = @single_res_mutex.synchronize { @resolver_ruby ||= ResolverRuby.new(self) }
+      engine.send_async(msg, client_queue, client_query_id)
     end
 
     #  Close the Resolver. Unfinished queries are terminated with OtherResolvError.
     def close
-      @resolver_ruby.close if @resolver_ruby
+      ensure_current_process
+      if @resolver_ruby
+        @resolver_ruby.close
+      else
+        @single_res_mutex.synchronize { @single_resolvers.compact.each(&:close) }
+      end
     end
 
     #  Create a new Resolver object. If no parameters are passed in, then the default
@@ -435,12 +471,14 @@ module Dnsruby
     #  * :do_caching
     #  * :tcp_pipelining
     #  * :tcp_pipelining_max_queries - can be a number or :infinite symbol
+    #  * :tcp_idle_timeout - positive seconds, defaults to 10
     def initialize(*args)
       #  @TODO@ Should we allow :nameserver to be an RRSet of NS records? Would then need to randomly order them?
       @resolver_ruby = nil
       @src_address = nil
       @src_address6 = nil
       @single_res_mutex = Mutex.new
+      @process_pid = Process.pid
       @configured = false
       @do_caching = true
       @config = Config.new()
@@ -462,6 +500,7 @@ module Dnsruby
                 send(key.to_s + '=', args[0][key])
               end
             rescue Exception => e
+              raise if key.to_s == 'tsig' || ValidationBudget.abort?(e)
               Dnsruby.log.error{"Argument #{key} not valid : #{e}\n"}
             end
           end
@@ -478,54 +517,101 @@ module Dnsruby
     end
 
     def add_config_nameservers # :nodoc: all
-      unless @configured
+      ensure_current_process
+      # Queries can keep using the published configuration while a replacement
+      # resolves nameserver hostnames. First-use callers still share one setup.
+      return if @single_res_mutex.synchronize { @configured && !@configuration_error }
+      configuration_mutex.synchronize do
+        if @configured
+          raise @configuration_error if @configuration_error
+          return
+        end
         @config.get_ready
+        configure_nameservers
       end
-      @configured = true
-        #  Add the Config nameservers
-      threads = []
-      @config.nameserver.each do |ns|
-        threads << Thread.new do
+    end
+
+    # Serialize configuration separately from query state. Constructing a sender
+    # can resolve a hostname through this same selector, whose callbacks need
+    # @single_res_mutex. Only publishing the finished list takes that mutex.
+    def configure_nameservers(replace = false, nameservers = @config.nameserver)
+      new_resolvers = []
+      published = false
+      begin
+        build_sender = lambda do |ns|
           PacketSender.new({
-              server:             ns,
-              port:               @port,
-              dnssec:             @dnssec,
-              use_tcp:            @use_tcp,
-              no_tcp:             @no_tcp,
-              tcp_pipelining:     @tcp_pipelining,
-              tcp_pipelining_max_queries: @tcp_pipelining_max_queries,
-              packet_timeout:     @packet_timeout,
-              tsig:               @tsig,
-              ignore_truncation:  @ignore_truncation,
-              src_address:        @src_address,
-              src_address6:       @src_address6,
-              src_port:           @src_port,
-              recurse:            @recurse,
-              udp_size:           @udp_size,
-              ignore_config_resolv_errors: true})
+                server:             ns,
+                port:               @port,
+                dnssec:             @dnssec,
+                use_tcp:            @use_tcp,
+                no_tcp:             @no_tcp,
+                tcp_pipelining:     @tcp_pipelining,
+                tcp_pipelining_max_queries: @tcp_pipelining_max_queries,
+                tcp_idle_timeout:    @tcp_idle_timeout,
+                packet_timeout:     @packet_timeout,
+                tsig:               @tsig,
+                ignore_truncation:  @ignore_truncation,
+                src_address:        @src_address,
+                src_address6:       @src_address6,
+                src_port:           @src_port,
+                recurse:            @recurse,
+                udp_size:           @udp_size,
+                ignore_config_resolv_errors: true})
         end
-      end
-
-      new_resolvers = threads.map(&:value).compact
-      new_resolvers = new_resolvers.select do |resolver|
-        !resolver.nil? && !resolver.server.nil?
-      end
-      # if new_resolvers.empty?
-      #   raise ArgumentError.new("No valid nameservers found in config")
-      # end
-      @single_res_mutex.synchronize { @single_resolvers.concat(new_resolvers) }
-      if @single_resolvers.nil? || @single_resolvers.empty?
-        raise ArgumentError.new("No valid nameservers found")
+        if QueryControl.current || SelectThread::TransmissionBudget.current
+          # DNSSEC may discover NS names without glue. Resolve those names in
+          # this thread so inherited deadlines, work and transmission limits
+          # remain shared, without creating another discovery worker pool.
+          nameservers.each do |ns|
+            QueryControl.current&.check!
+            ValidationBudget.current&.check!(1)
+            new_resolvers << build_sender.call(ns)
+          end
+        else
+          threads = nameservers.map { |ns| Thread.new { build_sender.call(ns) } }
+          new_resolvers = threads.map(&:value).compact
+        end
+        new_resolvers = new_resolvers.select do |resolver|
+          !resolver.nil? && !resolver.server.nil?
+        end
+        @single_res_mutex.synchronize do
+          # Construction may resolve a hostname and run alongside setters.
+          # Publish only after applying the settings current under this lock.
+          new_resolvers.each { |resolver| update_internal_res(resolver) }
+          complete = replace ? new_resolvers : @single_resolvers + new_resolvers
+          raise ArgumentError, "No valid nameservers found" if complete.empty?
+          @config.nameserver = nameservers if replace
+          (@single_resolvers - complete).compact.each(&:close)
+          @single_resolvers = complete
+          published = true
+          @configuration_error = nil
+          @configured = true
+        end
+      rescue Exception => error
+        new_resolvers.compact.each(&:close) unless published
+        @single_res_mutex.synchronize do
+          if ValidationBudget.abort?(error)
+            # Exhaustion belongs to the enclosing lookup, not the server
+            # configuration. A later lookup must be able to configure again.
+            @configuration_error = nil
+            @configured = !@single_resolvers.empty?
+          else
+            @configuration_error = error if @single_resolvers.empty?
+            @configured = true
+          end
+        end
+        raise
       end
     end
+    private :configure_nameservers
 
     def set_config_nameserver(n)
-      #  @TODO@ Should we allow NS RRSet here? If so, then .sort_by {rand}
-      @config.get_ready unless @configured
-      @configured = true
-
-      @config.nameserver = n.kind_of?(String) ? [n] : n
-      add_config_nameservers
+      configuration_mutex.synchronize do
+        @config.get_ready unless @configured
+        nameservers = n.kind_of?(String) ? [n] : n
+        @config.check_ns(nameservers)
+        configure_nameservers(true, nameservers)
+      end
     end
 
     def reset_attributes # :nodoc: all
@@ -534,9 +620,8 @@ module Dnsruby
       #  Attributes
 
       #  do_validation tells the Resolver whether to try to validate the response
-      #  with DNSSEC. This should work for NSEC-signed domains, but NSEC3
-      #  validation is not currently supported. This attribute now defaults to
-      #  false. Please let me know if you require NSEC3 validation.
+      #  with DNSSEC, including NSEC and NSEC3 proofs. Local validation defaults
+      #  to false and is separate from requesting DNSSEC records.
       @do_validation = false
       @query_timeout = DefaultQueryTimeout
       @retry_delay = DefaultRetryDelay
@@ -550,6 +635,7 @@ module Dnsruby
       @no_tcp = false
       @tcp_pipelining = false
       @tcp_pipelining_max_queries = DefaultPipeLiningMaxQueries
+      @tcp_idle_timeout = DefaultTcpIdleTimeout
       @tsig = nil
       @ignore_truncation = false
       @config = Config.new()
@@ -561,9 +647,11 @@ module Dnsruby
         @single_resolvers=[]
       }
       @configured = false
+      @configuration_error = nil
     end
 
     def update # :nodoc: all
+      ensure_current_process
       #  Update any resolvers we have with the latest config
       @single_res_mutex.synchronize do
         @single_resolvers.delete(nil) # Just in case...
@@ -579,15 +667,20 @@ module Dnsruby
     #     end
 
     def add_server(server)# :nodoc:
-      @configured = true
-      res = PacketSender.new(server)
-      Dnsruby.log_and_raise("Can't create server #{server}", ArgumentError) unless res
-      update_internal_res(res)
-      @single_res_mutex.synchronize { @single_resolvers.push(res) }
+      configuration_mutex.synchronize do
+        res = PacketSender.new(server)
+        Dnsruby.log_and_raise("Can't create server #{server}", ArgumentError) unless res
+        @single_res_mutex.synchronize do
+          update_internal_res(res)
+          @single_resolvers.push(res)
+          @configuration_error = nil
+          @configured = true
+        end
+      end
     end
 
     def update_internal_res(res)
-      [:port, :use_tcp, :no_tcp, :tcp_pipelining, :tcp_pipelining_max_queries, :tsig, :ignore_truncation, :packet_timeout,
+      [:port, :use_tcp, :no_tcp, :tcp_pipelining, :tcp_pipelining_max_queries, :tcp_idle_timeout, :tsig, :ignore_truncation, :packet_timeout,
         :src_address, :src_address6, :src_port, :recurse,
         :udp_size, :dnssec].each do |param|
 
@@ -600,10 +693,7 @@ module Dnsruby
     end
 
     def nameserver=(n)
-      @configured = true
-      @single_res_mutex.synchronize { @single_resolvers=[] }
       set_config_nameserver(n)
-      add_config_nameservers
     end
 
     #  --
@@ -634,8 +724,10 @@ module Dnsruby
     #         res.src_port=60015..60115
     #
     def src_port=(p)
-      if Resolver.check_port(p)
-        @src_port = Resolver.get_ports_from(p)
+      ports = Resolver.get_ports_from(p)
+      raise ArgumentError, 'Source port pool must not be empty' if ports.empty?
+      if Resolver.check_port(ports)
+        @src_port = ports
         update
       end
     end
@@ -653,15 +745,10 @@ module Dnsruby
     #         res.add_src_port(60015..60115)
     #
     def add_src_port(p)
-      if Resolver.check_port(p, @src_port)
-        a = Resolver.get_ports_from(p)
-        a.each do |x|
-          if (@src_port.length > 0) && (x == 0)
-            Dnsruby.log_and_raise("src_port of 0 only allowed as only src_port value (currently #{@src_port.length} values",
-                ArgumentError)
-          end
-          @src_port.push(x)
-        end
+      additions = Resolver.get_ports_from(p)
+      ports = @src_port == [0] && !additions.empty? && !additions.include?(0) ? [] : @src_port
+      if Resolver.check_port(additions, ports)
+        @src_port = ports + additions
       end
       update
     end
@@ -678,7 +765,10 @@ module Dnsruby
         return true
       end
       if Resolver.port_in_range(p)
-        return ! ((p == 0) && (src_port.length > 0))
+        if (p == 0 && !src_port.empty?) || (p != 0 && src_port.include?(0))
+          raise ArgumentError, 'Source port 0 must be the only member of a source port pool'
+        end
+        return true
       else
         Dnsruby.log.error("Illegal port (#{p})")
         Dnsruby.log_and_raise("Illegal port #{p}", ArgumentError)
@@ -711,6 +801,14 @@ module Dnsruby
       update
     end
 
+    def tcp_idle_timeout=(seconds)
+      unless seconds.is_a?(Numeric) && seconds.finite? && seconds > 0
+        raise ArgumentError, 'TCP idle timeout must be a positive finite number'
+      end
+      @tcp_idle_timeout = seconds
+      update
+    end
+
     def use_tcp=(on)
       @use_tcp = on
       update
@@ -725,10 +823,13 @@ module Dnsruby
     #  Pass in either a Dnsruby::RR::TSIG, or a key_name and key (or just a key)
     #  Pass in nil to stop tsig signing.
     #  * res.tsig=(tsig_rr)
-    #  * res.tsig=(key_name, key) # defaults to hmac-md5
-    #  * res.tsig=(key_name, key, alg) # e.g. alg = 'hmac-sha1'
+    #  Update MD5 server keys to SHA-256 when upgrading from 1.74.0, or select
+    #  hmac-md5 explicitly for a legacy server. MD5 use logs a warning.
+    #  * res.tsig = key_name, key # defaults to hmac-sha256
+    #  * res.tsig = key_name, key, algorithm # must match the server's key
     #  * res.tsig=nil # Stop the resolver from signing
     def tsig=(t)
+      Resolver.get_tsig([t]) unless t.nil?
       @tsig = t
       update
     end
@@ -764,9 +865,11 @@ module Dnsruby
           return nil
         end
       else
-        tsig = RR.new_from_hash(create_tsig_options(args))
+        tsig = RR.new_from_hash(create_tsig_options(*args))
       end
-      Dnsruby.log.info{"TSIG signing now using #{tsig.name}, key=#{tsig.key}"}
+      raise ArgumentError, 'Expected a TSIG record or a key name, secret and optional algorithm' unless tsig
+      tsig.warn_if_legacy_algorithm
+      Dnsruby.log.info{"TSIG signing now using #{tsig.name} (#{tsig.algorithm})"}
       tsig
     end
 
@@ -815,8 +918,8 @@ module Dnsruby
       @dnssec = d
       if d
         #  Set the UDP size (RFC 4035 section 4.1)
-        if @udp_size < MinDnssecUdpSize
-          self.udp_size = MinDnssecUdpSize
+        if @udp_size < AbsoluteMinDnssecUdpSize
+          self.udp_size = AbsoluteMinDnssecUdpSize
         end
       end
       update
@@ -828,37 +931,33 @@ module Dnsruby
     end
 
     def single_res_mutex # :nodoc: all
+      ensure_current_process
       @single_res_mutex
     end
 
     def generate_timeouts(base=0) # :nodoc: all
-      #  These should be be pegged to the single_resolver they are targetting :
-      #   e.g. timeouts[timeout1]=nameserver
       timeouts = {}
       retry_delay = @retry_delay
-      #       @single_res_mutex.synchronize {
-      @retry_times.times do |retry_count|
-        if retry_count > 0
-          retry_delay *= 2
-        end
-
-        @single_resolvers.delete(nil) # Just in case...
-        @single_resolvers.each_index do |i|
-          res = @single_resolvers[i]
-          offset = (i * @retry_delay.to_f / @single_resolvers.length)
-          if retry_count == 0
-            timeouts[base + offset]=[res, retry_count]
+      @single_resolvers.delete(nil)
+      [@retry_times, 3].min.times do |retry_count|
+        retry_delay *= 2 if retry_count > 0
+        @single_resolvers.each_with_index do |res, i|
+          offset = i * @retry_delay.to_f / @single_resolvers.length
+          deadline = base + offset + (retry_count == 0 ? 0 : retry_delay)
+          attempt = [res, retry_count]
+          if (existing = timeouts[deadline])
+            # Keep the established single-attempt shape for distinct deadlines.
+            # Zero delays (or rounded floating-point deadlines) need a bucket.
+            existing = timeouts[deadline] = [existing] unless existing.first.is_a?(Array)
+            existing << attempt
           else
-            if timeouts.has_key?(base + retry_delay + offset)
-              Dnsruby.log_and_raise('Duplicate timeout key!')
-            end
-            timeouts[base + retry_delay + offset]=[res, retry_count]
+            timeouts[deadline] = attempt
           end
         end
       end
-      #       }
       timeouts
     end
+
   end
 
 
@@ -874,7 +973,49 @@ module Dnsruby
       #       @mutex=Mutex.new
       @query_list = {}
       @timeouts = {}
-    end
+      @tick_deadlines = DeadlineQueue.new
+      @validation_queries = {}
+      @transmission_budgets = {}
+      @response_cache = Cache::ResolutionCache.new
+      @query_cache_scopes = {}
+    end
+    # Completed failures belong to one resolver configuration and validation
+    # policy. Snapshot them at admission, and decline insertion if it changes.
+    def response_cache_scope(query)
+      return unless query.do_caching && @parent.do_caching && !query.send_raw &&
+        query.header.opcode == OpCode.QUERY && !query.is_a?(Update) &&
+        !query.tsig && !query.signed? && !@parent.tsig && query.question.length == 1 &&
+        query.answer.empty? && query.authority.empty? &&
+        query.additional.all? { |rr| rr.type == Types::OPT }
+      return if [Types::AXFR, Types::IXFR].include?(query.question.first.qtype)
+      senders = @parent.single_resolvers
+      return if senders.empty? || senders.any?(&:tsig)
+      settings = senders.map do |sender|
+        [sender.server.to_s.dup, sender.port, sender.use_tcp, sender.no_tcp,
+          sender.dnssec, sender.packet_timeout, sender.src_address.to_s.dup,
+          sender.instance_variable_get(:@src_address6).to_s.dup,
+          sender.src_port.dup, sender.ignore_truncation]
+      end.sort_by(&:inspect)
+      [query.do_validation, query.header.rd, query.header.cd, query.header.ad,
+        query.additional.map { |rr|
+          encoded = MessageEncoder.new { |encoder| rr.encode_rdata(encoder) }.to_s
+          [rr.payloadsize, rr.ttl, encoded]
+        }, settings, @parent.query_timeout, @parent.retry_times, @parent.retry_delay,
+        Cache.validation_scope]
+    end
+
+    def cached_completion(query, scope)
+      @response_cache.find(query, scope)
+    end
+
+    def cache_completion(client_query_id, response, error)
+      current = @query_list[client_query_id]
+      scope = @query_cache_scopes.delete(client_query_id)
+      return unless current && scope && scope == response_cache_scope(current[0])
+      @response_cache.add(current[0], scope, response, error, control: current[4])
+    end
+    private :response_cache_scope, :cached_completion, :cache_completion
+
     def send_async(msg, client_queue, client_query_id=nil)
       #  This is the whole point of the Resolver class.
       #  We want to use multiple SingleResolvers to run a query.
@@ -893,58 +1034,87 @@ module Dnsruby
       unless client_queue.kind_of?(Queue)
         Dnsruby.log_and_raise('Wrong type for client_queue in Resolver# send_async')
         #  @TODO@ Handle different queue tuples - push this to generic send_error method
-        client_queue.push([client_query_id, ArgumentError.new('Wrong type of client_queue passed to Dnsruby::Resolver# send_async - should have been Queue, was #{client_queue.class}')])
+        client_queue.push([client_query_id, nil, ArgumentError.new('Wrong type of client_queue passed to Dnsruby::Resolver# send_async - should have been Queue, was #{client_queue.class}')])
         return
       end
 
       unless msg.kind_of?Message
         Dnsruby.log.error{'Wrong type for msg in Resolver# send_async'}
         #  @TODO@ Handle different queue tuples - push this to generic send_error method
-        client_queue.push([client_query_id, ArgumentError.new("Wrong type of msg passed to Dnsruby::Resolver# send_async - should have been Message, was #{msg.class}")])
+        client_queue.push([client_query_id, nil, ArgumentError.new("Wrong type of msg passed to Dnsruby::Resolver# send_async - should have been Message, was #{msg.class}")])
         return
       end
 
       # According to RFC 6891, a UDP payload size >512 bytes requires an
       # EDNS OPT RR in the message.
-      if @parent.udp_size > 512 && !msg.get_opt
+      if @parent.udp_size > 512 && !msg.get_opt && !msg.send_raw && !msg.signed? && !msg.tsig
         TheLog.debug("Automatically adding EDNS OPT RR for udp_size=#{ @parent.udp_size }")
         msg.add_additional(Dnsruby::RR::OPT.new(@parent.udp_size))
       end
 
       begin
-        msg.encode
+        # Encoding may sign the Message, even for this size check. Set the
+        # header and EDNS options first so the signature covers the final query.
+        sender = @parent.single_resolvers.first
+        wire = sender ? sender.make_query_packet(msg) : msg.encode
+        if wire.bytesize > 65_535
+          raise EncodeError, 'DNS message exceeds the 65535-byte wire limit'
+        end
       rescue EncodeError => err
         Dnsruby.log.error { "Can't encode " + msg.to_s + " : #{err}" }
-        client_queue.push([client_query_id, err])
+        client_queue.push([client_query_id, nil, err])
         return
       end
 
-      tick_needed = false
+      st = SelectThread.instance
       #  add to our data structures
       #       @mutex.synchronize{
       @parent.single_res_mutex.synchronize {
-        tick_needed = true if @query_list.empty?
         if @query_list.has_key?(client_query_id)
           Dnsruby.log.error("Duplicate query id requested (#{client_query_id}")
           #  @TODO@ Handle different queue tuples - push this to generic send_error method
-          client_queue.push([client_query_id, ArgumentError.new('Client query ID already in use')])
+          client_queue.push([client_query_id, nil, ArgumentError.new('Client query ID already in use')])
           return
         end
+        scope = response_cache_scope(msg)
+        control = QueryControl.current
+        control&.check!
+        if (cached = cached_completion(msg, scope))
+          client_queue.push([client_query_id, *cached])
+          return client_query_id
+        end
+        @query_cache_scopes[client_query_id] = scope
         outstanding = []
-        @query_list[client_query_id]=[msg, client_queue, q, outstanding]
+        @query_list[client_query_id]=[msg, client_queue, q, outstanding, control]
+        @transmission_budgets[client_query_id] = SelectThread::TransmissionBudget.current || SelectThread::TransmissionBudget.new
 
-        query_timeout = Time.now + @parent.query_timeout
+        query_timeout = TransportClock.now + @parent.query_timeout
         if @parent.query_timeout == 0
-          query_timeout = Time.now + 31536000 # a year from now
+          query_timeout = TransportClock.now + 31536000 # a year from now
         end
-        @timeouts[client_query_id] = [query_timeout, generate_timeouts]
+        retries = generate_timeouts
+        # An explicitly empty nameserver list uses the ordinary query deadline
+        # and completion path. No independent timer can publish a second result.
+        no_nameservers = @parent.single_resolvers.empty?
+        if no_nameservers && @parent.query_timeout == 0
+          query_timeout = TransportClock.now + 1
+        elsif retries.empty? && !no_nameservers
+          # A caller may disable all attempts with retry_times=0. Complete
+          # through the normal timeout path instead of leaving an orphan.
+          query_timeout = TransportClock.now
+        end
+        query_timeout = [query_timeout, control&.deadline].compact.min
+        @timeouts[client_query_id] = [query_timeout, retries, no_nameservers]
+        update_tick_deadline(client_query_id)
+        # Publish the observer together with its logical query. close must never
+        # see a query whose selector ownership has not yet been registered.
+        st.add_observer(q, self)
       }
 
-      #  Now do querying stuff using SingleResolver
-      #  All this will be handled by the tick method (if we have 0 as the first timeout)
-      st = SelectThread.instance
-      st.add_observer(q, self)
-      tick if tick_needed
+      # Dispatch this query immediately, even while earlier queries are pending.
+      # The same locked retry bookkeeping lets a concurrent selector tick win
+      # safely, while socket I/O still happens after releasing the query lock.
+      tick(client_query_id)
       client_query_id
     end
 
@@ -953,8 +1123,8 @@ module Dnsruby
       #  These are created at the same time in case the parameters change during the life of the query.
       #
       #  These should be absolute, rather than relative
-      #  The first value should be Time.now[
-      @parent.generate_timeouts(Time.now)
+      #  All retry and query deadlines use the same monotonic clock.
+      @parent.generate_timeouts(TransportClock.now).sort.to_h
     end
 
     #  Close the Resolver. Unfinished queries are terminated with OtherResolvError.
@@ -966,15 +1136,30 @@ module Dnsruby
           send_result_and_stop_querying(client_queue, client_query_id, q, nil,
               OtherResolvError.new('Resolver closing!'))
         end
+        @parent.single_resolvers.compact.each(&:close)
       }
     end
 
+    # Cancel only the nested discovery query owned by this synchronous waiter;
+    # never close a shared resolver or disturb unrelated callers.
+    def cancel_query(client_query_id, client_queue)
+      @parent.single_res_mutex.synchronize do
+        current = @query_list[client_query_id]
+        if current && current[1].equal?(client_queue)
+          stop_querying(client_query_id)
+          @validation_queries.delete(client_query_id)
+          @query_cache_scopes.delete(client_query_id)
+          SelectThread.instance.remove_observer(current[2], self)
+          @query_list.delete(client_query_id)
+        end
+      end
+    end
+
     #  MUST BE CALLED IN A SYNCHRONIZED BLOCK!
     #
     #  Send the result back to the client, and close the socket for that query by removing
     #  the query from the select thread.
     def send_result_and_stop_querying(client_queue, client_query_id, select_queue, msg, error) # :nodoc: all
-      stop_querying(client_query_id)
       send_result(client_queue, client_query_id, select_queue, msg, error)
     end
 
@@ -983,13 +1168,51 @@ module Dnsruby
     #  Stops send any more packets for a client-level query
     def stop_querying(client_query_id) # :nodoc: all
       @timeouts.delete(client_query_id)
+      @tick_deadlines.delete(client_query_id)
+      @transmission_budgets.delete(client_query_id)
+    end
+
+    # Accept one answer for validation, without losing the total query deadline.
+    # The observer remains registered so ticks and this validator can finish the
+    # logical query. Competing attempts, including queued sends, no longer own it.
+    # MUST BE CALLED WITH THE PARENT MUTEX HELD.
+    def begin_validation(client_query_id, query_id, select_queue)
+      @validation_queries[client_query_id] = query_id
+      @timeouts[client_query_id][1].clear
+      update_tick_deadline(client_query_id)
+      SelectThread.instance.cancel_queries_for_queue(select_queue)
+      @query_list[client_query_id][3].clear
+    end
+
+    # Called outside the selector lock. A completed or replaced transaction
+    # cannot start validation, and validation keeps the original query deadline.
+    def validation_deadline(select_queue, query_id)
+      client_query_id = query_id[2]
+      @parent.single_res_mutex.synchronize do
+        current = @query_list[client_query_id]
+        if current && current[2].equal?(select_queue) && @validation_queries[client_query_id] == query_id
+          @timeouts[client_query_id][0]
+        end
+      end
+    end
+
+    def validation_transmission_budget(select_queue, query_id)
+      client_query_id = query_id[2]
+      @parent.single_res_mutex.synchronize do
+        current = @query_list[client_query_id]
+        if current && current[2].equal?(select_queue) && @validation_queries[client_query_id] == query_id
+          @transmission_budgets[client_query_id]
+        end
+      end
     end
 
     #  MUST BE CALLED IN A SYNCHRONIZED BLOCK!
     #
     #  Sends the result to the client's queue, and removes the queue observer from the select thread
     def send_result(client_queue, client_query_id, select_queue, msg, error) # :nodoc: all
-      stop_querying(client_query_id)  # @TODO@ !
+      cache_completion(client_query_id, msg, error)
+      stop_querying(client_query_id)
+      @validation_queries.delete(client_query_id)
       #  We might still get some callbacks, which we should ignore
       st = SelectThread.instance
       st.remove_observer(select_queue, self)
@@ -999,50 +1222,78 @@ module Dnsruby
       #       }
       #  Return the response to the client
       client_queue.push([client_query_id, msg, error])
+    rescue ClosedQueueError
+      # The query and its observers are already removed. A closed client queue
+      # must not stop the shared selector thread.
+      Dnsruby.log.debug { "Discarding completion for closed client queue" }
+    end
+
+    # Earliest retry or total query deadline, using the same lock as admission.
+    # The selector must call this outside its own lock.
+    def next_tick_at # :nodoc: all
+      @parent.single_res_mutex.synchronize { @tick_deadlines.first_deadline }
+    end
+
+    # Only a changed query's finite retry plan needs inspection. The selector
+    # reads the minimum in constant time, without scanning all pending queries.
+    # MUST BE CALLED WITH THE PARENT MUTEX HELD.
+    def update_tick_deadline(client_query_id)
+      if (entry = @timeouts[client_query_id])
+        @tick_deadlines[client_query_id] = [entry[0], entry[1].each_key.first].compact.min
+      end
     end
+    private :update_tick_deadline
 
-    #  This method is called twice a second from the select loop, in the select thread.
+    #  This method is called when a retry or query deadline is due.
     #  It should arguably be called from another worker thread... (which also handles the queue)
     #  Each tick, we check if any timeouts have occurred. If so, we take the appropriate action :
     #  Return a timeout to the client, or send a new query
-    def tick # :nodoc: all
+    def tick(client_query_id = nil) # :nodoc: all
       #  Handle the tick
       #  Do we have any retries due to be sent yet?
       #       @mutex.synchronize{
+      sends = []
       @parent.single_res_mutex.synchronize {
-        time_now = Time.now
-        @timeouts.keys.each do |client_query_id|
-          msg, client_queue, select_queue, outstanding = @query_list[client_query_id]
-          query_timeout, timeouts = @timeouts[client_query_id]
-          if query_timeout < Time.now
-            #  Time the query out
+        time_now = TransportClock.now
+        query_ids = client_query_id.nil? ? [] : [client_query_id]
+        if client_query_id.nil?
+          while (first = @tick_deadlines.first) && first[1] <= time_now
+            query_ids << first[0]
+            @tick_deadlines.delete(first[0])
+          end
+        end
+        query_ids.each do |client_query_id|
+          next unless @timeouts.key?(client_query_id)
+          msg, client_queue, select_queue, outstanding, control = @query_list[client_query_id]
+          query_timeout, timeouts, no_nameservers = @timeouts[client_query_id]
+          if query_timeout <= time_now
+            #  Time the query out through the same exactly-once completion path.
+            reason = no_nameservers ? 'Query timed out - no valid nameservers configured' : 'Query timed out'
             send_result_and_stop_querying(client_queue, client_query_id, select_queue, nil,
-                ResolvTimeout.new('Query timed out'))
+                ResolvTimeout.new(reason))
             next
           end
-          timeouts_done = []
-          timeouts.keys.sort.each do |timeout|
-            if timeout < time_now
-              #  Send the next query
-              res, retry_count = timeouts[timeout]
+          # The finite retry plan is ordered once when admitted. Hash deletion
+          # retains that order, so no unrelated retry plan needs to be sorted.
+          while (timeout = timeouts.each_key.first) && timeout <= time_now
+            attempts = timeouts.delete(timeout)
+            attempts = [attempts] unless attempts.first.is_a?(Array)
+            attempts.each do |res, retry_count|
               id = [res, msg, client_query_id, retry_count]
               Dnsruby.log.debug("Sending msg to #{res.server}")
-              #  We should keep a list of the queries which are outstanding
               outstanding.push(id)
-              timeouts_done.push(timeout)
-              timeouts.delete(timeout)
-
-              #  Pick a new QID here @TODO@ !!!
-              #               msg.header.id = rand(65535);
-              #               print "New query : #{new_msg}\n"
-              res.send_async(msg, select_queue, id)
-            else
-              break
+              # A query keeps its original retry plan after reconfiguration.
+              # Retired senders must not create unreachable reusable sockets.
+              retired = !@parent.single_resolvers.include?(res)
+              operation = res.prepare_send_async(msg, select_queue, id, retired, control,
+                (@transmission_budgets[client_query_id] ||= SelectThread::TransmissionBudget.new))
+              sends << operation if operation
             end
           end
-          timeouts_done.each { |t| timeouts.delete(t) }
+          update_tick_deadline(client_query_id)
         end
       }
+      sends.each(&:call)
     end
 
     #  This method is called by the SelectThread (in the select thread) when the queue has a new item on it.
@@ -1070,9 +1321,6 @@ module Dnsruby
       #  can leave handleError alone
       #  but need to change handleResponse to stop sending, rather than send_result_and_stop_querying.
       #
-      #  @TODO@ Also, we could really do with a MaxValidationTimeout - if validation not OK within
-      #  this time, then raise Timeout (and stop validation)?
-      #
       #  @TODO@ Also, should there be some facility to stop validator following same chain
       #  concurrently?
       #
@@ -1089,12 +1337,29 @@ module Dnsruby
       end
       #       @mutex.synchronize{
       @parent.single_res_mutex.synchronize {
-        if @query_list[client_query_id] == nil
-          #           print "Dead query response - ignoring\n"
-          Dnsruby.log.debug{'Ignoring response for dead query'}
+        current = @query_list[client_query_id]
+        # An observer selected before completion can arrive after the caller
+        # reuses its ID. Only the original logical query owns this queue.
+        unless current && current[2].equal?(queue)
+          Dnsruby.log.debug{'Ignoring response for completed query'}
+          return
+        end
+        deadline, _retries, no_nameservers = @timeouts[client_query_id]
+        if deadline && deadline <= TransportClock.now
+          reason = no_nameservers ? 'Query timed out - no valid nameservers configured' : 'Query timed out'
+          send_result_and_stop_querying(current[1], client_query_id, queue, nil,
+            ResolvTimeout.new(reason))
+          return
+        end
+        validation_query = @validation_queries[client_query_id]
+        if validation_query
+          # A response already accepted for validation owns completion. Errors
+          # and already-queued answers from competing attempts cannot replace it.
+          return unless event_type == Resolver::EventType::VALIDATED && validation_query == event_id
+        elsif event_type == Resolver::EventType::VALIDATED
           return
         end
-        _msg, _client_queue, _select_queue, outstanding = @query_list[client_query_id]
+        _msg, _client_queue, _select_queue, outstanding = current
         if event_type == Resolver::EventType::RECEIVED ||
               event_type == Resolver::EventType::ERROR
           unless outstanding.include?(id)
@@ -1134,7 +1399,20 @@ module Dnsruby
       #  Check what sort of error it was :
       resolver, _msg, client_query_id, _retry_count = query_id
       _msg, client_queue, select_queue, outstanding = @query_list[client_query_id]
-      if error.kind_of?(ResolvTimeout)
+      if error.kind_of?(SocketEofResolvError) && _msg.header.opcode != OpCode.QUERY
+        # An UPDATE or other operation may already have taken effect. An
+        # ambiguous EOF ends the whole logical query, including other servers'
+        # scheduled and outstanding attempts; do not replay it elsewhere.
+        send_result_and_stop_querying(client_queue, client_query_id, select_queue, response, error)
+        return
+      end
+      retryable_eof = error.kind_of?(SocketEofResolvError)
+      if error.kind_of?(ResolvTimeout) || retryable_eof
+        # A server can close a TCP connection before answering (RFC 7766
+        # section 6.2.4). Keep the finite retry plan and original total deadline,
+        # just as for a lost UDP packet; reconnecting must not add new retries.
+        # An UPDATE may already have changed the server and must not be replayed
+        # merely because its reply was lost.
         #    - if it was a timeout, then check which number it was, and how many retries are expected on that server
         #        - if it was the last retry, on the last server, then return a timeout to the client (and clean up)
         #        - otherwise, continue
@@ -1150,10 +1428,10 @@ module Dnsruby
         #    - if it was an NXDomain, then return that to the client, and stop all new queries (and clean up)
         #         send_result_and_stop_querying(client_queue, client_query_id, select_queue, response, error)
         increment_resolver_priority(resolver) unless response.cached
-        stop_querying(client_query_id)
+        begin_validation(client_query_id, query_id, select_queue)
         #  @TODO@ Does the client want notified at this point?
-      elsif error.kind_of?(EncodeError)
-        Dnsruby.log.debug{'Encode error - sending to client'}
+      elsif error.kind_of?(EncodeError) || error.kind_of?(RecursionLimitError)
+        Dnsruby.log.debug{'Query cannot continue - sending error to client'}
         send_result_and_stop_querying(client_queue, client_query_id, select_queue, response, error)
       else
         #    - if it was any other error, then remove that server from the list for that query
@@ -1163,11 +1441,14 @@ module Dnsruby
           Dnsruby.log.debug{"Removing #{resolver.server} from resolver list for this query"}
           if timeouts
             timeouts[1].each do |key, value|
-              res = value[0]
-              if res == resolver
+              if value.first.is_a?(Array)
+                value.reject! { |res, _retry| res == resolver }
+                timeouts[1].delete(key) if value.empty?
+              elsif value.first == resolver
                 timeouts[1].delete(key)
               end
             end
+            update_tick_deadline(client_query_id)
           end
           #  Also stick it to the back of the list for future queries
           demote_resolver(resolver)
@@ -1191,7 +1472,7 @@ module Dnsruby
       TheLog.debug("Incrementing resolver priority for #{res.server}\n")
       #       @parent.single_res_mutex.synchronize {
       index = @parent.single_resolvers.index(res)
-      if index > 0
+      if index && index > 0
         @parent.single_resolvers.delete(res)
         @parent.single_resolvers.insert(index-1,res)
       end
@@ -1203,7 +1484,7 @@ module Dnsruby
       TheLog.debug("Decrementing resolver priority for #{res.server}\n")
       #       @parent.single_res_mutex.synchronize {
       index = @parent.single_resolvers.index(res)
-      if index < @parent.single_resolvers.length
+      if index && index < @parent.single_resolvers.length - 1
         @parent.single_resolvers.delete(res)
         @parent.single_resolvers.insert(index+1,res)
       end
@@ -1214,8 +1495,9 @@ module Dnsruby
     def demote_resolver(res)
       TheLog.debug("Demoting resolver priority for #{res.server} to bottom\n")
       #       @parent.single_res_mutex.synchronize {
-      @parent.single_resolvers.delete(res)
-      @parent.single_resolvers.push(res)
+      if @parent.single_resolvers.delete(res)
+        @parent.single_resolvers.push(res)
+      end
       #       }
     end
 
@@ -1230,7 +1512,7 @@ module Dnsruby
       if s_queue != select_queue
         Dnsruby.log_and_raise("Serious internal error : expected select queue #{s_queue}, got #{select_queue}")
       end
-      stop_querying(client_query_id)
+      begin_validation(client_query_id, query_id, select_queue)
       #  @TODO@ Does the client want notified at this point?
       #         client_queue.push([client_query_id, Resolver::EventType::RECEIVED, msg, nil])
       #       }