dnsruby 1.74.0 → 2.0.0

data/test/tc_name.rb

@@ -20,6 +20,11 @@ class TestName < Minitest::Test
 
   include Dnsruby
 
+  # Names on either side of the 255-octet wire limit: 249 octets of label text
+  # in 5 labels, plus a length octet each and the root's zero octet, is 255.
+  AT_LIMIT_NAME = "#{'a' * 63}.#{'b' * 63}.#{'c' * 63}.#{'d' * 59}.e."
+  OVER_LIMIT_NAME = "#{'a' * 63}.#{'b' * 63}.#{'c' * 63}.#{'d' * 60}.e."
+
   def test_label_length
     Name::Label.set_max_length(Name::Label::MaxLabelLength) # Other tests may have changed this
     #  Test max label length = 63
@@ -30,13 +35,102 @@ class TestName < Minitest::Test
     end
   end
 
+  def wire_length(name)
+    MessageEncoder.new { |msg| msg.put_name(name, true) }.to_s.length
+  end
+
+  # Test max name length=255. The limit is on the wire form, two octets more
+  # than the dotted presentation form without its trailing dot.
   def test_name_length
-    #  Test max name length=255
-    begin
-      Name.create("1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123.com")
-      assert(false, "Name of length > 255 allowed")
-    rescue ResolvError
+    assert_equal(255, wire_length(Name.create(AT_LIMIT_NAME)))
+
+    error = assert_raises(ResolvError) { Name.create(OVER_LIMIT_NAME) }
+    assert_match(/Name length is 256,/, error.message)
+  end
+
+  # An oversized name must not reach the wire through Message either, and a
+  # name right at the limit must still survive the round trip.
+  def test_name_length_in_message
+    assert_raises(ResolvError) { Message.new(OVER_LIMIT_NAME, "A") }
+
+    message = Message.new(AT_LIMIT_NAME, "A")
+    message.add_answer(RR.create("#{AT_LIMIT_NAME} 3600 IN NS #{AT_LIMIT_NAME}"))
+    decoded = Message.decode(message.encode)
+    assert_equal(AT_LIMIT_NAME, decoded.question[0].qname.to_s + ".")
+    assert_equal(AT_LIMIT_NAME, decoded.answer[0].domainname.to_s + ".")
+  end
+
+  def test_deep_backward_compression_chain_is_iterative_and_preserves_position
+    wire = "\x07example\x03com\0".b
+    target = 0
+    8_000.times do
+      offset = wire.bytesize
+      wire << [0xc000 | target].pack('n')
+      target = offset
     end
+    wire << "!"
+    decoder = MessageDecoder.new(wire)
+    decoder.get_bytes(target)
+    assert_equal('example.com.', decoder.get_name.to_s(true))
+    assert_equal(target + 2, decoder.index)
+    assert_equal('!', decoder.get_bytes)
+  end
+
+  def test_compressed_names_share_suffixes_and_chain_to_complete_names
+    wire = "\x07example\x03com\0".b
+    www = wire.bytesize
+    wire << "\x03www".b << [0xc000].pack('n')
+    wire << "\x04mail".b << [0xc000].pack('n')
+    wire << [0xc000 | www].pack('n')
+    decoder = MessageDecoder.new(wire)
+    assert_equal(['example.com.', 'www.example.com.', 'mail.example.com.', 'www.example.com.'],
+      Array.new(4) { decoder.get_name.to_s(true) })
+    assert_equal(wire.bytesize, decoder.index)
+  end
+
+  def test_compressed_rdata_can_reference_a_name_before_its_length_field
+    wire = "\x07example\x03com\0".b + [2, 0xc000].pack('nn') + '!'
+    decoder = MessageDecoder.new(wire)
+    expected = decoder.get_name
+    assert_equal(expected, decoder.get_length16 { decoder.get_name })
+    assert_equal('!', decoder.get_bytes)
+  end
+
+  def test_compression_rejects_loops_forward_pointers_and_reserved_labels
+    malformed = [
+      ["\xc0\x00".b, 0],                 # Self pointer.
+      ["\xc0\x02\0".b, 0],             # Forward pointer.
+      ["\xc0\x02\xc0\x00".b, 2],     # Two-pointer cycle.
+      ["\x01a\xc0\x00".b, 0],         # Label followed by a pointer into itself.
+      ["\xc0".b, 0],                     # Incomplete pointer.
+      ["\x01a".b, 0],                    # Missing root label.
+      ["\x02a".b, 0],                    # Truncated label.
+      ["\x40".b + 'a' * 64 + "\0", 0],
+      ["\x80\0".b, 0],                 # Reserved label types.
+      ["\xbf\0".b, 0]
+    ]
+    malformed.each do |wire, offset|
+      decoder = MessageDecoder.new(wire)
+      decoder.get_bytes(offset)
+      assert_raises(DecodeError, wire.unpack1('H*')) { decoder.get_name }
+    end
+  end
+
+  def test_expanded_compressed_names_obey_the_wire_length_limit
+    encoded = MessageEncoder.new { |encoder| encoder.put_name(Name.create(AT_LIMIT_NAME), true) }.to_s
+    decoder = MessageDecoder.new(encoded + [0xc000].pack('n') + "\x01x".b + [0xc000].pack('n'))
+    assert_equal(AT_LIMIT_NAME, decoder.get_name.to_s(true))
+    assert_equal(AT_LIMIT_NAME, decoder.get_name.to_s(true))
+    assert_raises(DecodeError) { decoder.get_name }
+
+    oversized = OVER_LIMIT_NAME.split('.').map { |label| [label.bytesize].pack('C') + label }.join + "\0"
+    assert_raises(DecodeError) { MessageDecoder.new(oversized).get_name }
+  end
+
+  def test_name_cannot_read_a_root_label_beyond_its_rdata_boundary
+    decoder = MessageDecoder.new([2].pack('n') + "\x01a\0".b)
+    assert_raises(DecodeError) { decoder.get_length16 { decoder.get_name } }
+    assert_equal("\0", decoder.get_bytes)
   end
 
   def test_absolute

data/test/tc_nameserver_bootstrap.rb

@@ -0,0 +1,322 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+require 'tempfile'
+
+class TestNameserverBootstrap < Minitest::Test
+  def with_resolv_conf(contents)
+    Tempfile.create('dnsruby-nameserver-bootstrap') do |file|
+      file.write(contents)
+      file.flush
+      yield file.path
+    end
+  end
+
+  def answer_for(hostname, address = nil)
+    message = Dnsruby::Message.new(hostname)
+    if address
+      type = address.include?(':') ? 'AAAA' : 'A'
+      message.add_answer(Dnsruby::RR.create("#{hostname} 60 IN #{type} #{address}"))
+    end
+    message
+  end
+
+  # Exercise real Resolver and PacketSender initialization, replacing only DNS
+  # queries. Bound configuration reads and construction so a regression cannot
+  # recreate issue #179's unbounded chain of resolver threads. Worker threads
+  # record their observations through queues instead of performing assertions.
+  def with_lookup(defaults, response, recursive_response: nil, lookup_error: nil)
+    original_new = Dnsruby::Resolver.method(:new)
+    state = { queries: Queue.new, recursors: Queue.new, closed: Queue.new,
+              resolvers: Queue.new, counts: Hash.new(0) }
+    mutex = Mutex.new
+    count = lambda do |kind|
+      mutex.synchronize do
+        state[:counts][kind] += 1
+        raise 'Nameserver bootstrap reentered too many times' if state[:counts][kind] > 12
+      end
+    end
+    default_config = lambda do
+      count.call(:config_reads)
+      config = defaults.respond_to?(:call) ? defaults.call : defaults
+      config.merge(nameserver: Array(config[:nameserver]).dup)
+    end
+    factory = lambda do |*args|
+      count.call(:resolver_constructions)
+      resolver = original_new.call(*args)
+      state[:resolvers] << resolver
+      original_close = resolver.method(:close)
+      resolver.define_singleton_method(:close) do
+        state[:closed] << self
+        original_close.call
+      end
+      resolver.define_singleton_method(:query) do |hostname, *|
+        servers = single_resolvers.map(&:server)
+        state[:queries] << [self, hostname.to_s, servers]
+        raise lookup_error if lookup_error
+        response
+      end
+      resolver
+    end
+    recursive_factory = lambda do |*args|
+      state[:recursors] << args
+      recursor = Object.new
+      recursor.define_singleton_method(:query) do |hostname, *|
+        recursive_response || Dnsruby::Message.new(hostname)
+      end
+      recursor
+    end
+    Dnsruby::Config.stub(:default_config_hash, default_config) do
+      Dnsruby::Resolver.stub(:new, factory) do
+        Dnsruby::Recursor.stub(:new, recursive_factory) do
+          yield state, original_new
+        end
+      end
+    end
+  ensure
+    unless state.nil?
+      state[:resolvers].pop(true).close until state[:resolvers].empty?
+    end
+  end
+
+  def test_resolv_conf_preserves_hostnames_literals_and_token_order
+    servers = %w[ns.example.test 192.0.2.1 localhost 2001:db8::1 fe80::1%en0 ns.example.test]
+    contents = "nameserver #{servers.first(3).join(' ')} # comment\n" \
+               "nameserver #{servers.drop(3).join(' ')} ; comment\n"
+    with_resolv_conf(contents) do |path|
+      assert_equal(servers, Dnsruby::Config.parse_resolv_conf(path)[:nameserver])
+    end
+  end
+
+  def test_overlong_nameserver_from_file_does_not_hide_a_valid_server_or_override
+    previous_limit = Dnsruby::Name::Label.class_variable_get(:@@max_length)
+    Dnsruby::Name::Label.set_max_length(Dnsruby::Name::Label::MaxLabelLength)
+    invalid = ('a' * 64) + '.example.'
+    with_resolv_conf("nameserver #{invalid}\nnameserver 127.0.0.1\n") do |path|
+      defaults = Dnsruby::Config.parse_resolv_conf(path)
+      Dnsruby::Config.stub(:default_config_hash, defaults) do
+        config = Dnsruby::Config.new
+        config.get_ready
+        assert_equal(['127.0.0.1'], config.nameserver)
+        resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.2')
+        assert_equal(['127.0.0.2'], resolver.config.nameserver)
+        assert_equal(['127.0.0.2'], resolver.single_resolvers.map(&:server))
+        assert_raises(Dnsruby::ResolvError) do
+          Dnsruby::Config.new.set_config_info(nameserver: [invalid])
+        end
+      end
+    end
+  ensure
+    Dnsruby::Name::Label.set_max_length(previous_limit)
+  end
+
+  def test_failed_nameserver_replacement_preserves_config_and_active_senders
+    resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1')
+    original = resolver.single_resolvers.first
+    assert_raises(ArgumentError) { resolver.nameserver = [] }
+    assert_equal(['127.0.0.1'], resolver.config.nameserver)
+    assert_equal([original], resolver.single_resolvers)
+    resolver.nameserver = '127.0.0.2'
+    assert_equal(['127.0.0.2'], resolver.config.nameserver)
+    assert_equal(['127.0.0.2'], resolver.single_resolvers.map(&:server))
+  end
+
+  def test_invalid_default_nameserver_fails_without_recursive_initialization
+    with_resolv_conf("nameserver 8.8.8.8,\n") do |path|
+      defaults = -> { Dnsruby::Config.parse_resolv_conf(path) }
+      with_lookup(defaults, answer_for('unused.example.test')) do |state, original_new|
+        resolver = original_new.call
+        error = assert_raises(ArgumentError) { resolver.add_config_nameservers }
+        assert_equal('No valid nameservers found', error.message)
+        assert_equal(['8.8.8.8,'], resolver.config.nameserver)
+        assert_operator(state[:counts][:config_reads], :<=, 3)
+        assert_equal(0, state[:counts][:resolver_constructions])
+        assert(state[:queries].empty?)
+        assert(state[:recursors].empty?)
+      ensure
+        resolver.close if resolver
+      end
+    end
+  end
+
+  def test_scoped_looking_dns_names_do_not_hide_valid_fallbacks
+    contents = "nameserver fe80::1%\nnameserver fe80::gggg%en0\n" \
+               "nameserver 192.0.2.1\nnameserver fe80::1%3\n"
+    with_resolv_conf(contents) do |path|
+      defaults = -> { Dnsruby::Config.parse_resolv_conf(path) }
+      [nil, {config_info: path}, {config_info: {search: ['example.test']}}].each do |options|
+        with_lookup(defaults, nil) do |state, original_new|
+          resolver = options ? original_new.call(options) : original_new.call
+          resolver.add_config_nameservers unless options
+          assert_equal(['fe80::1%', 'fe80::gggg%en0', '192.0.2.1', 'fe80::1%3'], resolver.config.nameserver)
+          assert_equal(['192.0.2.1', 'fe80::1%3'], resolver.single_resolvers.map(&:server))
+          queried = []
+          queried << state[:queries].pop(true)[1] until state[:queries].empty?
+          # PacketSender also retries with nil after a failed server setter.
+          assert_equal(['', '', 'fe80::1%', 'fe80::gggg%en0'].sort, queried.sort)
+          assert_equal(4, state[:counts][:resolver_constructions])
+        ensure
+          resolver.close if resolver
+        end
+      end
+    end
+  end
+
+  def test_invalid_scoped_defaults_do_not_block_explicit_nameserver
+    with_resolv_conf("nameserver fe80::1%\n") do |path|
+      defaults = -> { Dnsruby::Config.parse_resolv_conf(path) }
+      with_lookup(defaults, nil) do |state, original_new|
+        ['192.0.2.53', {nameserver: '2001:db8::53'}].each do |options|
+          resolver = original_new.call(options)
+          expected = options.is_a?(Hash) ? options[:nameserver] : options
+          assert_equal([expected], resolver.single_resolvers.map(&:server))
+        ensure
+          resolver.close if resolver
+        end
+        resolver = original_new.call
+        assert_raises(ArgumentError) { resolver.add_config_nameservers }
+        assert_equal(['fe80::1%'], resolver.config.nameserver)
+        assert(state[:queries].empty?)
+        assert_equal(0, state[:counts][:resolver_constructions])
+      ensure
+        resolver.close if resolver
+      end
+    end
+  end
+
+  def test_explicit_config_hash_preserves_scoped_looking_dns_names
+    config = Dnsruby::Config.new
+    servers = ['fe80::1%', '192.0.2.1']
+    config.set_config_info(nameserver: servers)
+    assert_equal(servers, config.nameserver)
+    assert_raises(ArgumentError) { Dnsruby::Config.ipv6_server_address(servers.first) }
+  end
+
+  def test_default_file_hostname_uses_literal_nameserver_without_changing_config
+    hostname = 'ns.example.test'
+    with_resolv_conf("nameserver #{hostname}\nnameserver 192.0.2.1\n") do |path|
+      defaults = -> { Dnsruby::Config.parse_resolv_conf(path) }
+      with_lookup(defaults, answer_for(hostname, '192.0.2.53')) do |state, original_new|
+        resolver = original_new.call
+        resolver.add_config_nameservers
+        assert_equal([hostname, '192.0.2.1'], resolver.config.nameserver)
+        assert_equal(['192.0.2.53', '192.0.2.1'], resolver.single_resolvers.map(&:server))
+        lookup = state[:queries].pop(true)
+        assert_equal(hostname, lookup[1])
+        assert_equal(['192.0.2.1'], lookup[2])
+        assert_same(lookup[0], state[:closed].pop(true))
+        assert(state[:queries].empty?)
+        assert_equal(1, state[:counts][:resolver_constructions])
+      ensure
+        resolver.close if resolver
+      end
+    end
+  end
+
+  def test_custom_file_hostname_uses_system_nameserver
+    hostname = 'custom-ns.example.test'
+    with_resolv_conf("nameserver #{hostname}\n") do |path|
+      with_lookup({nameserver: ['192.0.2.1']}, answer_for(hostname, '192.0.2.53')) do |state, original_new|
+        resolver = original_new.call(config_info: path)
+        assert_equal([hostname], resolver.config.nameserver)
+        assert_equal(['192.0.2.53'], resolver.single_resolvers.map(&:server))
+        assert_equal([hostname, ['192.0.2.1']], state[:queries].pop(true).drop(1))
+        assert(state[:queries].empty?)
+      ensure
+        resolver.close if resolver
+      end
+    end
+  end
+
+  def test_localhost_file_nameserver_does_not_require_dns
+    with_resolv_conf("nameserver localhost\n") do |path|
+      with_lookup(-> { Dnsruby::Config.parse_resolv_conf(path) }, nil) do |state, original_new|
+        resolver = original_new.call(config_info: path)
+        assert_equal(['localhost'], resolver.config.nameserver)
+        assert_equal(['127.0.0.1'], resolver.single_resolvers.map(&:server))
+        assert(state[:queries].empty?)
+        assert_equal(0, state[:counts][:resolver_constructions])
+      ensure
+        resolver.close if resolver
+      end
+    end
+  end
+
+  def test_explicit_hostname_and_name_object_remain_supported
+    hostname = 'explicit-ns.example.test'
+    with_lookup({nameserver: ['192.0.2.1']}, answer_for(hostname, '192.0.2.53')) do |state, original_new|
+      resolver = original_new.call(nameserver: hostname)
+      assert_equal(['192.0.2.53'], resolver.single_resolvers.map(&:server))
+      assert_equal('192.0.2.53', Dnsruby::Config.resolve_server(Dnsruby::Name.create(hostname)))
+      2.times do
+        assert_equal([hostname, ['192.0.2.1']], state[:queries].pop(true).drop(1))
+      end
+      assert(state[:queries].empty?)
+    ensure
+      resolver.close if resolver
+    end
+  end
+
+  def test_bootstrap_keeps_ipv6_scopes_and_localhost_but_excludes_hostnames
+    hostname = 'ns.example.test'
+    servers = [hostname, '192.0.2.1', '2001:db8::1', 'fe80::1%en0',
+               'fe80::1%3', 'localhost', '8.8.8.8,', 'fe80::1%']
+    with_lookup({nameserver: servers}, answer_for(hostname, '192.0.2.53')) do |state, _|
+      assert_equal('192.0.2.53', Dnsruby::Config.resolve_server(hostname))
+      assert_equal(['192.0.2.1', '2001:db8::1', 'fe80::1%en0', 'fe80::1%3', '127.0.0.1'],
+                   state[:queries].pop(true)[2])
+      assert_equal([hostname, '192.0.2.1', '2001:db8::1', 'fe80::1%en0',
+                    'fe80::1%3', 'localhost', '8.8.8.8,', 'fe80::1%'], servers)
+      assert(state[:queries].empty?)
+    end
+  end
+
+  def test_all_hostname_defaults_fail_before_creating_helper_resolver
+    hostname = 'ns.example.test'
+    with_lookup({nameserver: [hostname, 'other-ns.example.test']}, nil) do |state, _|
+      error = assert_raises(ArgumentError) { Dnsruby::Config.resolve_server(hostname) }
+      assert_match(/No nameserver addresses available/, error.message)
+      assert_equal(1, state[:counts][:config_reads])
+      assert_equal(0, state[:counts][:resolver_constructions])
+      assert(state[:queries].empty?)
+      assert(state[:recursors].empty?)
+    end
+  end
+
+  def test_recursive_fallback_accepts_addresses_and_reuses_safe_resolver
+    hostname = 'ns.example.test'
+    { '192.0.2.53' => '192.0.2.53', '2001:db8::53' => '2001:DB8::53' }.each do |address, expected|
+      with_lookup({nameserver: [hostname, '192.0.2.1']}, answer_for(hostname),
+                  recursive_response: answer_for(hostname, address)) do |state, _|
+        assert_equal(expected, Dnsruby::Config.resolve_server(hostname))
+        lookup = state[:queries].pop(true)
+        assert_equal(['192.0.2.1'], lookup[2])
+        assert_equal([lookup[0]], state[:recursors].pop(true))
+        assert_same(lookup[0], state[:closed].pop(true))
+        assert_equal(1, state[:counts][:resolver_constructions])
+        assert(state[:queries].empty?)
+        assert(state[:recursors].empty?)
+      end
+    end
+  end
+
+  def test_recursive_fallback_after_query_error_and_without_address
+    hostname = 'ns.example.test'
+    [answer_for(hostname, '192.0.2.53'), answer_for(hostname)].each do |response|
+      with_lookup({nameserver: [hostname, '192.0.2.1']}, nil,
+                  lookup_error: Dnsruby::ResolvTimeout.new('simulated timeout'),
+                  recursive_response: response) do |state, _|
+        if response.answer.empty?
+          error = assert_raises(ArgumentError) { Dnsruby::Config.resolve_server(hostname) }
+          assert_match(/Recursor can't locate/, error.message)
+        else
+          assert_equal('192.0.2.53', Dnsruby::Config.resolve_server(hostname))
+        end
+        lookup = state[:queries].pop(true)
+        assert_equal(['192.0.2.1'], lookup[2])
+        assert_equal([lookup[0]], state[:recursors].pop(true))
+        assert_same(lookup[0], state[:closed].pop(true))
+        assert_equal(1, state[:counts][:resolver_constructions])
+      end
+    end
+  end
+end

data/test/tc_nsec.rb

@@ -126,50 +126,9 @@ class NsecTest < Minitest::Test
     end
   end
 
-  def test_examples_from_rfc_4035_wildcard_expansion
-    #  Grab the example responses from RFC4035 and make sure that they pass.
-    #  Then, try changing some of the NSEC values (ignoring the RRSIGs for now)
-    #  and make sure that they fail verification for that reason
-    m = Message.new
-    m.header.rcode =
-      m.add_question(Question.new("a.z.w.example.", Types.MX))
-    m.add_answer(RR.create("a.z.w.example. 3600 IN MX  1 ai.example."))
-    m.add_answer(RR.create("a.z.w.example. 3600 RRSIG  MX 5 4 3600 20040509183619 (
-                              20040409183619 38519 example.
-                              OMK8rAZlepfzLWW75Dxd63jy2wswESzxDKG2
-                              f9AMN1CytCd10cYISAxfAdvXSZ7xujKAtPbc
-                              tvOQ2ofO7AZJ+d01EeeQTVBPq4/6KCWhqe2X
-                              TjnkVLNvvhnc0u28aoSsG0+4InvkkOHknKxw
-                              4kX18MMR34i8lC36SR5xBni8vHI= )"))
-    m.add_authority(RR.create("x.y.w.example. 3600 NSEC   xx.example. MX RRSIG NSEC"))
-    begin
-      Dnssec.anchor_verifier.verify_nsecs(m)
-      fail("Should have failed with bad number of labels in RRSIG")
-    rescue VerifyError
-    end
-    m.answer.delete(RR.create("a.z.w.example. 3600 RRSIG  MX 5 4 3600 20040509183619 (
-                              20040409183619 38519 example.
-                              OMK8rAZlepfzLWW75Dxd63jy2wswESzxDKG2
-                              f9AMN1CytCd10cYISAxfAdvXSZ7xujKAtPbc
-                              tvOQ2ofO7AZJ+d01EeeQTVBPq4/6KCWhqe2X
-                              TjnkVLNvvhnc0u28aoSsG0+4InvkkOHknKxw
-                              4kX18MMR34i8lC36SR5xBni8vHI= )"))
-    m.add_answer(RR.create("a.z.w.example. 3600 RRSIG  MX 5 2 3600 20040509183619 (
-                              20040409183619 38519 example.
-                              OMK8rAZlepfzLWW75Dxd63jy2wswESzxDKG2
-                              f9AMN1CytCd10cYISAxfAdvXSZ7xujKAtPbc
-                              tvOQ2ofO7AZJ+d01EeeQTVBPq4/6KCWhqe2X
-                              TjnkVLNvvhnc0u28aoSsG0+4InvkkOHknKxw
-                              4kX18MMR34i8lC36SR5xBni8vHI= )"))
-    Dnssec.anchor_verifier.verify_nsecs(m)
-    m.authority.delete(RR.create("x.y.w.example. 3600 NSEC   xx.example. MX RRSIG NSEC"))
-    m.add_authority(RR.create("x.y.w.example. 3600 NSEC   z.w.example. MX RRSIG NSEC"))
-    begin
-      Dnssec.anchor_verifier.verify_nsecs(m)
-      fail("Should have failed with bad NSEC")
-    rescue VerifyError
-    end
-  end
+  # Positive wildcard expansion from RFC 4035 is covered by
+  # DnssecWildcardProofsTest#test_examples_from_rfc_4035_wildcard_expansion,
+  # where both the answer and its denial proof undergo signature verification.
 
   def test_examples_from_rfc_4035_wildcard_no_data
     #  Grab the example responses from RFC4035 and make sure that they pass.
@@ -223,4 +182,4 @@ class NsecTest < Minitest::Test
   #     fail
   #   end
   # 
-end
+end

data/test/tc_nsec3.rb

@@ -69,6 +69,22 @@ class Nsec3Test < Minitest::Test
     assert_equal(nsec.to_s, nsec3.to_s)
   end
 
+  def test_future_flags_round_trip_but_are_unusable_for_denial
+    record = Dnsruby::RR.create(INPUT)
+    record.flags = 2
+    message = Dnsruby::Message.new
+    message.add_authority(record)
+    decoded = Dnsruby::Message.decode(message.encode).authority.first
+    assert_equal(2, decoded.flags)
+    assert_equal(record.to_s, decoded.to_s)
+    refute(decoded.supported_parameters?)
+    refute(decoded.usable_hash?)
+    [0, 1].each do |flags|
+      decoded.flags = flags
+      assert(decoded.usable_hash?)
+    end
+  end
+
   def test_calculate_hash
     input = [
 [   "example"       , "0p9mhaveqvm6t7vbl5lop2u3t2rp3tom"],
@@ -113,7 +129,7 @@ class Nsec3Test < Minitest::Test
 #    rescue DecodeError
 #    end
     begin
-      nsec.flags = 2
+      nsec.flags = 256
       fail
     rescue DecodeError
     end