dnsruby 1.74.0 → 2.0.0

data/lib/dnsruby/zone_transfer.rb

@@ -35,15 +35,31 @@ module Dnsruby
     attr_reader :last_tsigstate
     # Sets the connect timeout in seconds
     attr_accessor :connect_timeout
+    # Maximum seconds for one complete DNS frame to be read or written.
+    attr_reader :io_timeout
+    # Optional maximum seconds per server, including connect and IXFR fallback.
+    attr_reader :transfer_timeout
+
+    def io_timeout=(seconds)
+      @io_timeout = positive_timeout(seconds)
+    end
+
+    def transfer_timeout=(seconds)
+      @transfer_timeout = seconds.nil? ? nil : positive_timeout(seconds)
+    end
 
     # Sets the TSIG to sign the zone transfer with.
     # Pass in either a Dnsruby::RR::TSIG, or a key_name and key (or just a key)
     # Pass in nil to stop tsig signing.
+    # Defaults to hmac-sha256; the algorithm must match the server's key.
+    # You can select hmac-md5 for legacy servers, which logs a warning.
     # * res.tsig=(tsig_rr)
     # * res.tsig=(key_name, key)
     # * res.tsig=nil # Don't sign the transfer
     def tsig=(*args)
       @tsig = Resolver.get_tsig(args)
+      @tsig_configured_time = @tsig&.time_signed
+      @last_tsig_time = nil
     end
 
 
@@ -57,6 +73,8 @@ module Dnsruby
       @axfr = nil
       @src_address = nil
       @connect_timeout = 5
+      @io_timeout = 30
+      @transfer_timeout = nil
     end
 
     #  Perform a zone transfer (RFC1995)
@@ -110,19 +128,32 @@ module Dnsruby
     def do_transfer(zone, server) #:nodoc: all
       @transfer_type = Types.new(@transfer_type)
       @state = :InitialSoa
-      socket = Socket.tcp(server, @port, @src_address, connect_timeout: @connect_timeout)
-      # socket = TCPSocket.new(server, @port, @src_address)
+      @axfr = @ixfr = nil
+      @initialsoa = @end_serial = @current_serial = @rtype = nil
+      @last_tsigstate = nil
+      @transfer_deadline = @transfer_timeout && TransportClock.now + @transfer_timeout
+      socket = nil
       begin
+        connect_limit = [@connect_timeout, @transfer_timeout].compact.min
+        socket = Socket.tcp(server, @port, @src_address, connect_timeout: connect_limit)
         #  Send an initial query
         msg = Message.new(zone, @transfer_type, @klass)
+        # Compare SOA owners with the absolute name sent in the question.
+        @zone_name = msg.question.first.qname
         if @transfer_type == Types.IXFR
-          rr = RR.create("#{zone} 0 IN SOA" + '0 0 %u 0 0 0 0' % @serial)
+          rr = RR.create("#{zone} 0 #{@klass} SOA " + '0 0 %u 0 0 0 0' % @serial)
           msg.add_authority(rr)
         end
+        @request = msg
         send_message(socket, msg)
 
         while (@state != :End)
           response = receive_message(socket)
+          validate_response(response)
+          # An error can terminate a transfer after earlier successful frames.
+          if @state != :InitialSoa && response.rcode != RCode.NOERROR
+            raise ResolvError, response.rcode.string
+          end
 
           if (@state == :InitialSoa)
             rcode = response.rcode
@@ -135,16 +166,13 @@ module Dnsruby
                 @transfer_type=Types.AXFR
                 #  Send an initial AXFR query
                 msg = Message.new(zone, @transfer_type, @klass)
+                @request = msg
                 send_message(socket, msg)
                 next
               end
               raise ResolvError.new(rcode.string);
             end
 
-            if (response.question[0].qtype != @transfer_type)
-              raise ResolvError.new("invalid question section")
-            end
-
             if (response.header.ancount == 0 && @transfer_type == Types.IXFR)
               Dnsruby.log.debug("IXFR DID NOT WORK (ancount = 0) - TRYING AXFR!!")
               #  IXFR didn't work - let's try AXFR
@@ -152,6 +180,7 @@ module Dnsruby
               #  Send an initial AXFR query
               @state = :InitialSoa
               msg = Message.new(zone, @transfer_type, @klass)
+              @request = msg
               send_message(socket, msg)
               next
             end
@@ -185,14 +214,17 @@ module Dnsruby
         #                  serial change) consisting of deleted RRs and added RRs.  The first RR
         #                  of the deleted RRs is the older SOA RR and the first RR of the added
         #                  RRs is the newer SOA RR.
-        socket.close
         if (@axfr!=nil)
-          return @axfr
+          return @axfr.uniq
         end
         return @ixfr
-      rescue Exception => e
-        socket.close
-        raise e
+      ensure
+        begin
+          socket.close if socket && !socket.closed?
+        rescue IOError, SystemCallError
+          # Preserve the transfer's result or original failure if close races.
+        end
+        @transfer_deadline = nil
       end
     end
 
@@ -245,13 +277,15 @@ module Dnsruby
 
     def parseRR(rec) #:nodoc: all
       type = rec.type
-      delta = Delta.new
 
       case @state
       when :InitialSoa
         if (type != Types.SOA)
           raise ResolvError.new("missing initial SOA")
         end
+        unless rec.name == @zone_name && rec.klass == Classes.new(@klass)
+          raise ResolvError, "initial SOA does not match transfer zone"
+        end
         @initialsoa = rec
         #  Remember the serial number in the initial SOA; we need it
         #  to recognize the end of an IXFR.
@@ -312,6 +346,9 @@ module Dnsruby
         if (type == Types.SOA)
           soa_serial = rec.serial
           if (soa_serial == @end_serial)
+            unless same_soa?(rec, @initialsoa)
+              raise ResolvError, "closing SOA does not match initial SOA"
+            end
             @state = :End
             return
           elsif (soa_serial != @current_serial)
@@ -331,6 +368,9 @@ module Dnsruby
         if (type == Types.A && rec.klass() != @klass)
         else
           if (type == Types.SOA)
+            unless same_soa?(rec, @initialsoa)
+              raise ResolvError, "closing SOA does not match initial SOA"
+            end
             @state = :End
           else
             @axfr << rec
@@ -346,39 +386,131 @@ module Dnsruby
 
 
     def send_message(socket, msg) #:nodoc: all
+      msg.tsig.warn_if_legacy_algorithm if msg.tsig
       if (@tsig)
-        @tsig.apply(msg)
+        # Keep the last query's TSIG available to callers. Generate a fresh
+        # timestamp for each transfer or retry unless the caller set one.
+        if @last_tsig_time.nil? || @tsig.time_signed != @last_tsig_time
+          @tsig_configured_time = @tsig.time_signed
+        end
+        signing_key = @tsig.dup
+        signing_key.time_signed = @tsig_configured_time
+        signing_key.apply(msg)
         @tsig = msg.tsig
+        @last_tsig_time = @tsig.time_signed
       end
       query_packet = msg.encode
-      lenmsg = [query_packet.length].pack('n')
-      socket.send(lenmsg, 0)
-      socket.send(query_packet, 0)
+      raise EncodeError, "DNS message exceeds the 65535-byte wire limit" if query_packet.bytesize > 65_535
+      frame = [query_packet.bytesize].pack('n') + query_packet
+      deadline = io_deadline
+      offset = 0
+      while offset < frame.bytesize
+        check_deadline(deadline)
+        begin
+          written = socket.write_nonblock(frame.byteslice(offset, frame.bytesize - offset))
+          raise IOError, "zone transfer write made no progress" unless written && written > 0
+          offset += written
+        rescue IO::WaitWritable
+          wait_for_io(socket, deadline, false)
+        rescue IO::WaitReadable
+          wait_for_io(socket, deadline, true)
+        rescue Errno::EINTR
+          next
+        end
+      end
     end
 
-    def tcp_read(socket, len) #:nodoc: all
-      buf=""
-      while (buf.length < len) and not socket.eof? do
-        buf += socket.read(len-buf.length)
+    def tcp_read(socket, len, deadline = io_deadline) #:nodoc: all
+      buf = +"".b
+      while buf.bytesize < len
+        check_deadline(deadline)
+        begin
+          part = socket.read_nonblock(len - buf.bytesize)
+          raise ResolvError, "Server closed an incomplete zone transfer" if part.nil? || part.empty?
+          buf << part
+        rescue IO::WaitReadable
+          wait_for_io(socket, deadline, true)
+        rescue IO::WaitWritable
+          wait_for_io(socket, deadline, false)
+        rescue Errno::EINTR
+          next
+        rescue EOFError
+          raise ResolvError, "Server closed an incomplete zone transfer"
+        end
       end
-      return buf
+      buf
     end
 
     def receive_message(socket) #:nodoc: all
-      buf = tcp_read(socket, 2)
+      deadline = io_deadline
+      buf = tcp_read(socket, 2, deadline)
       answersize = buf.unpack('n')[0]
       #  Some servers (e.g. dnscache) apparently hang up on some connections.
       #  Thanks to Matt Palmer for the fix.
       raise ResolvError.new("Server did not send a valid answer") if answersize.nil?
-      buf = tcp_read(socket, answersize)
+      buf = tcp_read(socket, answersize, deadline)
       msg = Message.decode(buf)
       if (@tsig)
-        if !@tsig.verify_envelope(msg, buf)
+        signature = msg.tsig
+        verified = @tsig.verify_envelope(msg, buf)
+        @last_tsigstate = msg.tsigstate
+        if !verified
+          authenticated_error = RR::TSIG.authenticated_error(msg, signature)
+          raise authenticated_error if authenticated_error
           Dnsruby.log.error("Bad signature on zone transfer - closing connection")
           raise ResolvError.new("Bad signature on zone transfer")
         end
       end
       return msg
     end
+
+    private
+
+    def positive_timeout(seconds)
+      value = Float(seconds)
+      raise ArgumentError, "timeout must be a positive finite number" unless value.finite? && value > 0
+      value
+    end
+
+    def io_deadline
+      [TransportClock.now + @io_timeout, @transfer_deadline].compact.min
+    end
+
+    def check_deadline(deadline)
+      raise ResolvTimeout, "Zone transfer I/O timed out" if TransportClock.now >= deadline
+    end
+
+    def wait_for_io(socket, deadline, readable)
+      check_deadline(deadline)
+      remaining = deadline - TransportClock.now
+      IO.select(readable ? [socket] : nil, readable ? nil : [socket], nil, [remaining, 0].max)
+    rescue Errno::EINTR
+      retry
+    end
+
+    def validate_response(response)
+      unless response.header.id == @request.header.id && response.header.qr &&
+          response.header.opcode == @request.header.opcode
+        raise ResolvError, "invalid zone transfer response header"
+      end
+      required_question = @state == :InitialSoa || response.rcode != RCode.NOERROR
+      questions = response.question
+      if questions.empty? && !required_question
+        return
+      end
+      request_question = @request.question.first
+      unless questions.length == 1 && questions.first.qname == request_question.qname &&
+          questions.first.qtype == request_question.qtype && questions.first.qclass == request_question.qclass
+        raise ResolvError, "invalid question section"
+      end
+    end
+
+    def same_soa?(left, right)
+      left.name == right.name && left.klass == right.klass && left.ttl == right.ttl &&
+        [:mname, :rname, :serial, :refresh, :retry, :expire, :minimum].all? do |field|
+          left.public_send(field) == right.public_send(field)
+        end
+    end
+
   end
 end

data/lib/dnsruby.rb

@@ -102,7 +102,9 @@ require 'dnsruby/zone_transfer'
 # 
 # == DNSSEC
 # Dnsruby supports DNSSEC and NSEC(3).
-# DNSSEC support is on by default - but no trust anchors are configured by default.
+# Resolver#do_validation defaults to false; set it to true for local validation.
+# Built-in root DS trust anchors are configured. The dnssec flag controls requesting
+# DNSSEC records and is separate from validation.
 # See Dnsruby::Dnssec for more details.
 # 
 # == Codes
@@ -122,7 +124,6 @@ require 'dnsruby/zone_transfer'
 # == Bugs
 # * NIS is not supported.
 # * /etc/nsswitch.conf is not supported.
-# * NSEC3 validation still TBD
 module Dnsruby
 
   def Dnsruby.version
@@ -157,6 +158,10 @@ module Dnsruby
     attr_accessor :response
   end
 
+  # A recursive lookup exceeded its aggregate work or query limit.
+  class RecursionLimitError < ResolvError
+  end
+
   # A timeout error raised while querying for a resource
   class ResolvTimeout < Timeout::Error
   end

data/test/ci_watchdog.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module CiWatchdog
+  TIMEOUT = Float(ENV.fetch('DNSRUBY_TEST_TIMEOUT'))
+  raise ArgumentError, 'DNSRUBY_TEST_TIMEOUT must be positive and finite' unless TIMEOUT.positive? && TIMEOUT.finite?
+
+  def run
+    label = "#{self.class}##{name}"
+    started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    $stderr.puts("START #{label}")
+    $stderr.flush
+    watchdog = Thread.new do
+      sleep TIMEOUT
+      $stderr.puts("\nTIMEOUT after #{TIMEOUT}s: #{label}")
+      Thread.list.each do |thread|
+        $stderr.puts("#{thread.inspect}\n#{Array(thread.backtrace).join("\n")}")
+      end
+      $stderr.flush
+      # Raising in the test thread can get stuck again in teardown or while
+      # Open3 waits for a child. End this failed run after preserving its stacks.
+      exit! 124
+    end
+    super
+  ensure
+    watchdog&.kill
+    watchdog&.join
+    elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - started
+    $stderr.puts("DONE #{label} (#{format('%.3f', elapsed)}s)")
+    $stderr.flush
+  end
+end
+
+Minitest::Test.prepend(CiWatchdog)

data/test/fixtures/org-ds-2026-11-05.zone

@@ -0,0 +1,5 @@
+; Captured 2026-11-05 from https://dns.google/resolve?name=org&type=DS&do=true
+; Original answer RDATA and TTLs; no signatures or keys synthesized.
+; Tests use Time.utc(2026, 11, 5, 12) within both signature validity periods.
+org. 8211 IN DS 26974 8 2 4FEDE294C53F438A158C41D39489CD78A86BEB0D8A0AEAFF14745C0D16E1DE32
+org. 8211 IN RRSIG ds 8 1 86400 1794891600 1793764800 8763 . b4V+K2vEqTwsd5SLh5TOrGHF1HVKHsP292XLRV1mmufaG8JO6f6oI/leUNvOy/hm3yPPYShuJvhAQCtcnxe+q+odD6/e8PZ8bW6QlgzcltauMVrphV4rXsxI8XgxLQv/mQDHaBVY/3smBijb96QxnBNfL83MNnYg+n/BR1wckIVMz5u4EKaVTat+MYI/2iffqkKbcQX3mWo/Fm3+69bkJr7fCUxGXu7EAvjOvuAM73SQRsaDnfoaUIkfGsjPSv2YEdYg6jgoYxC8AVdtS8OW2vd/XUoeKEpjUnC/jZ0b1fZFkVT4vK+hw1bb/z0VD9bI6O7LZGgKntz6KXO57HY4Cg==

data/test/fixtures/root-dnskey-2026-11-05.zone

@@ -0,0 +1,7 @@
+; Captured 2026-11-05 from https://dns.google/resolve?name=.&type=DNSKEY&do=true
+; Original answer RDATA and TTLs; no signatures or keys synthesized.
+; Tests use Time.utc(2026, 11, 5, 12) within both signature validity periods.
+. 24999 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=
+. 24999 IN DNSKEY 256 3 8 AwEAAcorNxNc9t0ue1ZenPjVMRujlQ2YLBJ0pR/4XMjHby9vr03cRxFSKnWpxeg5PL384D9VeqdS1bjrGyTsHtoagzI3NiXFd8sjHMOnZxu5pp/+UBIg7tasYgVMMdUiM1Yu/c+t30d1Qw/v6NYLNnOnywTu6HuUh7Y1sZRq/GZcrxLENXHQoyKpOrOr8R3+qd6wK69IKB80ZBZtkX9rdEqKJk+yYXjEZzZ0zkAFthmNgCreAoU9PVlU66dyOsaLjf3wKUlUm9SNOKs+tK6LuSmRbK6+1T/tPaRaMBSEuv2G6vXfnJ1uyMbGvtpRn/YDcvTjrp6DzE6XyF44QdwJ3oKx4ek=
+. 24999 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
+. 24999 IN RRSIG dnskey 8 0 172800 1795219200 1793404800 38696 . UFkJYhexq5ZgfvP+oIz2WUJQgF8bhW8st3LnXtIBP0eRcSQXrYg7+luxwQYg+3iiZV2+BJPcNmf/pDu+uNPaplkHPJLXh9WS0oEVZKUNk/0wk3A0XL5UOSTdPWn/IoTWWxyGxun+udV7eRQqVpRvSdlBFaqPWSDIDkX0QQIfye72TB4tsPBnA2iWDye6U157EcPBdNeKv4cfh1cAOlePIaxLs1NoNHIu/ZrqEY5zM+GNJ4Z72Tba09jYjz3ayBSPVinI64OYOORqZsYtuLXUrBdD6UWfV8Ljf3b0MGfBs7BoZYAJxVyNr5CQF13CLw+4xrbMsmQWdTBqzp5iEtB9VA==

data/test/fork_test_helper.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'timeout'
+
+module ForkTestHelper
+  # A timeout started before fork cannot protect the child: its timer thread
+  # exists only in the parent. Bound both processes and always reap the child,
+  # including when an outer test timeout interrupts the parent's wait.
+  def self.run(timeout: 5)
+    pid = nil
+    Thread.handle_interrupt(Exception => :never) do
+      pid = fork do
+        Thread.handle_interrupt(Exception => :immediate) do
+          begin
+            Timeout.timeout(timeout) { yield }
+            exit! 0
+          rescue Exception => error
+            warn error.full_message
+            exit! 1
+          end
+        end
+      end
+    end
+    Timeout.timeout(timeout + 2) { Process.wait2(pid).last }
+  ensure
+    Thread.handle_interrupt(Exception => :never) do
+      begin
+        if pid && !Process.waitpid(pid, Process::WNOHANG)
+          Process.kill('KILL', pid)
+          Process.waitpid(pid)
+        end
+      rescue Errno::ECHILD, Errno::ESRCH
+        # A successful wait already reaped this child.
+      end
+    end
+  end
+end

data/test/local_dns_server.rb

@@ -0,0 +1,57 @@
+require 'socket'
+require 'timeout'
+
+# A single DNS exchange over a real socket, independent of system DNS and caches.
+module LocalDnsServer
+  def with_local_dns_server(transport, rcode: Dnsruby::RCode.NOERROR, answer: nil)
+    socket = if transport == :tcp
+      TCPServer.new('127.0.0.1', 0)
+    else
+      UDPSocket.new
+    end
+    socket.bind('127.0.0.1', 0) if transport == :udp
+
+    server = Thread.new do
+      begin
+        if transport == :tcp
+          client = socket.accept
+          length = client.read(2).unpack('n').first
+          packet = client.read(length)
+        else
+          packet, sender = socket.recvfrom(65_535)
+        end
+        response = Dnsruby::Message.decode(packet)
+        response.header.qr = true
+        response.header.ra = true
+        response.header.rcode = rcode
+        response.add_answer(Dnsruby::RR.create(answer)) if answer
+        wire = response.encode
+        if transport == :tcp
+          client.write([wire.bytesize].pack('n') + wire)
+        else
+          socket.send(wire, 0, sender[3], sender[1])
+        end
+      rescue StandardError => error
+        # Some tests enable Thread.abort_on_exception globally. Report fixture
+        # errors in the test thread instead of aborting the whole suite.
+        error
+      ensure
+        client.close if client && !client.closed?
+      end
+    end
+
+    resolver = Dnsruby::Resolver.new(
+      nameserver: '127.0.0.1', port: socket.addr[1], use_tcp: transport == :tcp,
+      do_caching: false, dnssec: false, query_timeout: 2, retry_times: 1
+    )
+    Timeout.timeout(5) do
+      yield resolver
+      result = server.value
+      raise result if result.is_a?(StandardError)
+    end
+  ensure
+    resolver.close if resolver
+    server.kill.join if server
+    socket.close if socket && !socket.closed?
+  end
+end

data/test/soak_server.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require 'socket'
+require 'resolv'
+require 'thread'
+require 'timeout'
+require_relative 'socket_helpers'
+
+# Local, independent DNS peer. No public DNS traffic, fixed port, privileged
+# service, RubyDNS API or subprocess is required.
+class SoakServer
+  IP = '127.0.0.1'
+  ADDRESS = '192.0.2.155'
+  EXCHANGE = 'mail.soak.test.'
+  ALIAS = 'alias.soak.test.'
+  TEXT = 'dnsruby-soak'
+  TYPES = %w[A MX CNAME TXT].freeze
+
+  attr_reader :port
+
+  def initialize
+    @udp, @listener = TestSockets.udp_tcp_pair(IP)
+    @port = @listener.addr[1]
+    @wake_read, @wake_write = IO.pipe
+    @clients = {}
+    ready = Queue.new
+    @worker = Thread.new do
+      Thread.current.abort_on_exception = false
+      Thread.current.report_on_exception = false
+      begin
+        ready << true
+        run
+      rescue StandardError => error
+        @error = error
+      end
+    end
+    Timeout.timeout(5) { ready.pop }
+    check!
+  rescue Exception
+    if @worker
+      @worker.kill
+      @worker.join
+    end
+    [@listener, @udp, @wake_read, @wake_write].compact.each { |io| io.close unless io.closed? }
+    raise
+  end
+
+  def check!
+    raise @error if @error
+  end
+
+  def stop
+    @wake_write.close unless @wake_write.closed?
+    unless @worker.join(5)
+      @worker.kill
+      @worker.join
+      raise 'Soak server did not stop within five seconds'
+    end
+    check!
+  end
+
+  private
+
+  def run
+    loop do
+      writers = @clients.select { |_, buffers| !buffers[:output].empty? }.keys
+      readable, writable = IO.select([@wake_read, @listener, @udp] + @clients.keys, writers)
+      break if readable.include?(@wake_read)
+      readable.each do |socket|
+        if socket == @listener
+          accept
+        elsif socket == @udp
+          receive_udp
+        else
+          receive_tcp(socket)
+        end
+      end
+      writable.each { |socket| write_tcp(socket) if @clients.key?(socket) }
+    end
+  ensure
+    @clients.keys.each { |socket| disconnect(socket) }
+    [@listener, @udp, @wake_read].each { |io| io.close unless io.closed? }
+  end
+
+  def accept
+    socket = @listener.accept_nonblock(exception: false)
+    return if socket == :wait_readable
+    socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
+    @clients[socket] = { input: ''.b, output: ''.b }
+  end
+
+  def receive_udp
+    packet = @udp.recvfrom_nonblock(65_535, exception: false)
+    return if packet == :wait_readable
+    bytes, peer = packet
+    @udp.send(answer(bytes), 0, peer[3], peer[1])
+  end
+
+  def receive_tcp(socket)
+    bytes = socket.read_nonblock(65_535, exception: false)
+    return if bytes == :wait_readable
+    return disconnect(socket) if bytes.nil?
+    buffers = @clients.fetch(socket)
+    buffers[:input] << bytes
+    while buffers[:input].bytesize >= 2
+      length = buffers[:input].unpack1('n')
+      break if buffers[:input].bytesize < length + 2
+      buffers[:input].slice!(0, 2)
+      response = answer(buffers[:input].slice!(0, length))
+      buffers[:output] << [response.bytesize].pack('n') << response
+    end
+    write_tcp(socket)
+  rescue Errno::ECONNRESET, Errno::EPIPE
+    disconnect(socket)
+  end
+
+  def write_tcp(socket)
+    output = @clients.fetch(socket)[:output]
+    return if output.empty?
+    written = socket.write_nonblock(output, exception: false)
+    output.slice!(0, written) if written.is_a?(Integer)
+  rescue Errno::ECONNRESET, Errno::EPIPE
+    disconnect(socket)
+  end
+
+  def disconnect(socket)
+    @clients.delete(socket)
+    socket.close unless socket.closed?
+  end
+
+  def answer(bytes)
+    query = ::Resolv::DNS::Message.decode(bytes)
+    response = ::Resolv::DNS::Message.new(query.id)
+    response.qr = 1
+    response.aa = 1
+    response.rd = query.rd
+    response.ra = 1
+    query.each_question do |name, type|
+      raise "Unsupported soak class: #{type}" unless type::ClassValue == 1
+      resource = case type::TypeValue
+                 when 1 then type.new(ADDRESS)
+                 when 15 then type.new(10, ::Resolv::DNS::Name.create(EXCHANGE))
+                 when 5 then type.new(::Resolv::DNS::Name.create(ALIAS))
+                 when 16 then type.new(TEXT)
+                 else raise "Unsupported soak question: #{type}"
+                 end
+      response.add_question(name, type)
+      response.add_answer(name, 60, resource)
+    end
+    response.encode
+  end
+end

data/test/socket_helpers.rb

@@ -0,0 +1,26 @@
+require 'socket'
+
+module TestSockets
+  # UDP and TCP have separate port namespaces. Keep both sockets reserved
+  # before starting a peer, and retry only collisions during allocation.
+  def self.udp_tcp_pair(host = '127.0.0.1')
+    10.times do |attempt|
+      udp = tcp = nil
+      reserved = false
+      begin
+        tcp = TCPServer.new(host, 0)
+        udp = UDPSocket.new
+        udp.bind(host, tcp.addr[1])
+        reserved = true
+        return udp, tcp
+      rescue Errno::EADDRINUSE
+        raise if attempt == 9
+      ensure
+        unless reserved
+          udp.close if udp && !udp.closed?
+          tcp.close if tcp && !tcp.closed?
+        end
+      end
+    end
+  end
+end