dnsruby 1.74.0 → 2.0.0

data/test/tc_recursor_address_fallback.rb

@@ -0,0 +1,169 @@
+require_relative 'spec_helper'
+require 'timeout'
+
+class RecursorAddressFallbackTest < Minitest::Test
+  def test_failed_family_keeps_the_other_address_family
+    with_address_lookup(['ns.example.']) do |run, calls, _recursor|
+      result = run.call do |name, type|
+        raise Dnsruby::ServFail, 'AAAA unavailable' if type == 'AAAA'
+        address_answer(name, type)
+      end
+      assert_equal(['192.0.2.53'], result)
+      assert_equal(%w[A AAAA], drain(calls).map(&:last).sort)
+    end
+  end
+
+  def test_failed_nameserver_does_not_hide_another_nameserver
+    with_address_lookup(%w[bad.example. ns.example.]) do |run, calls, _recursor|
+      result = run.call do |name, type|
+        raise Dnsruby::NXDomain, 'name unavailable' if name == 'bad.example.'
+        address_answer(name, type)
+      end
+      assert_equal(['192.0.2.53', '2001:db8::53'], result)
+      assert_equal(4, drain(calls).length)
+    end
+  end
+
+  def test_ordinary_lookup_failures_return_no_authority
+    with_address_lookup(['ns.example.']) do |run, _calls, _recursor|
+      assert_nil(run.call { |_name, _type| raise Dnsruby::Refused, 'lookup refused' })
+    end
+  end
+
+  def test_validation_limit_is_preserved_and_cancels_a_waiting_sibling
+    with_address_lookup(['ns.example.']) do |run, _calls, _recursor|
+      waiting = Queue.new
+      finished = Queue.new
+      limit = Dnsruby::ValidationLimitError.new('validation budget exhausted')
+      error = assert_raises(Dnsruby::ValidationLimitError) do
+        run.call do |_name, type|
+          if type == 'A'
+            waiting.pop
+            raise limit
+          end
+          begin
+            waiting << true
+            Dnsruby::QueryControl.current.pop(Dnsruby::QueryControl::Queue.new)
+          ensure
+            finished << true
+          end
+        end
+      end
+      assert_same(limit, error)
+      assert_equal(true, finished.pop(true))
+    end
+  end
+
+  def test_parent_cancellation_stops_all_address_workers
+    with_address_lookup(['ns.example.']) do |run, _calls, _recursor|
+      parent = Dnsruby::QueryControl.new
+      started = Queue.new
+      finished = Queue.new
+      canceller = Thread.new { 2.times { started.pop }; parent.cancel }
+      assert_raises(Dnsruby::QueryControl::Cancelled) do
+        Dnsruby::QueryControl.with(parent) do
+          run.call do |_name, _type|
+            begin
+              started << true
+              Dnsruby::QueryControl.current.pop(Dnsruby::QueryControl::Queue.new)
+            ensure
+              finished << true
+            end
+          end
+        end
+      end
+      assert_equal([true, true], 2.times.map { finished.pop(true) })
+    ensure
+      canceller&.kill
+      canceller&.join
+    end
+  end
+
+  def test_one_worker_runs_the_other_family_inline_without_deadlock
+    with_address_lookup(['ns.example.']) do |run, _calls, _recursor|
+      parent_thread = Thread.current
+      family_threads = Queue.new
+      release_worker = Queue.new
+      limits = Dnsruby::Recursor::DEFAULT_RECURSION_LIMITS.merge(max_workers: 1)
+      Dnsruby::Recursor.send(:with_limits, nil, limits) do |budget|
+        result = run.call do |name, type|
+          family_threads << [type, Thread.current]
+          type == 'AAAA' ? release_worker.pop : release_worker.push(true)
+          address_answer(name, type)
+        end
+        assert_equal(['192.0.2.53', '2001:db8::53'], result)
+        threads = drain(family_threads).to_h
+        assert_same(parent_thread, threads['A'])
+        refute_same(parent_thread, threads['AAAA'])
+        assert(budget.reserve_worker, 'Completed discovery must release its worker slot')
+        budget.release_worker
+      end
+    end
+  end
+
+  def test_worker_creation_failure_releases_its_slot
+    with_address_lookup(['ns.example.']) do |run, _calls, _recursor|
+      limits = Dnsruby::Recursor::DEFAULT_RECURSION_LIMITS.merge(max_workers: 1)
+      Dnsruby::Recursor.send(:with_limits, nil, limits) do |budget|
+        Thread.stub(:new, ->(*) { raise ThreadError, 'Worker unavailable' }) do
+          assert_raises(ThreadError) { run.call { |name, type| address_answer(name, type) } }
+        end
+        assert(budget.reserve_worker)
+        budget.release_worker
+      end
+    end
+  end
+
+  def test_recursion_limit_does_not_try_another_nameserver
+    with_address_lookup(%w[first.example. second.example.]) do |run, calls, _recursor|
+      error = Dnsruby::RecursionLimitError.new('Lookup work limit reached')
+      actual = assert_raises(Dnsruby::RecursionLimitError) { run.call { |*| raise error } }
+      assert_same(error, actual)
+      assert_equal(['first.example.'], drain(calls).map(&:first).uniq)
+    end
+  end
+
+  private
+
+  def address_answer(name, type)
+    answer = Dnsruby::Message.new(name, type)
+    address = type == 'AAAA' ? '2001:db8::53' : '192.0.2.53'
+    answer.add_answer(Dnsruby::RR.create("#{name} 300 IN #{type} #{address}"))
+    answer
+  end
+
+  def drain(queue)
+    Array.new(queue.length) { queue.pop(true) }
+  end
+
+  def with_address_lookup(names)
+    klass = Dnsruby::Recursor
+    original_hints = klass.class_variable_get(:@@hints)
+    original_cache = klass.class_variable_get(:@@authority_cache)
+    klass.class_variable_set(:@@hints, {})
+    klass.class_variable_set(:@@authority_cache, {})
+    recursor = klass.allocate
+    recursor.ipv6_ok = true
+    original_recursion = recursor.method(:_dorecursion)
+    authorities = names.to_h { |name| [name, klass::AddressCache.new] }
+    calls = Queue.new
+    run = lambda do |&lookup|
+      recursor.define_singleton_method(:_dorecursion) do |name, type, *_args|
+        if name == 'www.example.'
+          authorities.values.flat_map(&:values).map(&:downcase).sort
+        else
+          calls << [name, type]
+          lookup.call(name, type)
+        end
+      end
+      Timeout.timeout(3) do
+        original_recursion.call('www.example.', 'A', Dnsruby::Classes::IN,
+          'example.', authorities, 0, true)
+      end
+    end
+    yield run, calls, recursor
+  ensure
+    klass.class_variable_set(:@@hints, original_hints)
+    klass.class_variable_set(:@@authority_cache, original_cache)
+  end
+end

data/test/tc_recursor_limits.rb

@@ -0,0 +1,139 @@
+require_relative 'spec_helper'
+
+class RecursorLimitsTest < Minitest::Test
+  def setup
+    @resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', query_timeout: 0)
+    @recursor = Dnsruby::Recursor.new(@resolver)
+  end
+
+  def teardown
+    @resolver.close
+  end
+
+  def test_defaults_are_finite_and_invalid_replacements_are_atomic
+    original = @recursor.recursion_limits
+    assert_equal(30.0, original[:timeout])
+    assert(original.frozen?)
+    [{timeout: 0}, {max_queries: -1}, {max_workers: 0}, {unknown: 1}].each do |settings|
+      assert_raises(ArgumentError) { @recursor.recursion_limits = settings }
+      assert_same(original, @recursor.recursion_limits)
+    end
+    @recursor.recursion_limits = {timeout: 10, max_queries: 20}
+    assert_equal(20, @recursor.recursion_limits[:max_queries])
+    assert_equal(8, @recursor.recursion_limits[:max_workers])
+  end
+
+  def test_default_zero_resolver_timeout_still_has_a_recursion_deadline
+    @recursor.define_singleton_method(:query_internal) do |*|
+      Dnsruby::QueryControl.current.deadline - Dnsruby::TransportClock.now
+    end
+    remaining = @recursor.query('example.', 'A', 'IN', true)
+    assert_operator(remaining, :>, 29)
+    assert_operator(remaining, :<=, 30)
+  end
+
+  def test_recursion_deadline_stops_a_wait_and_restores_thread_context
+    @recursor.recursion_limits = {timeout: 0.02}
+    @recursor.define_singleton_method(:query_internal) do |*|
+      Dnsruby::QueryControl.current.pop(Dnsruby::QueryControl::Queue.new)
+    end
+    assert_raises(Dnsruby::ResolvTimeout) { @recursor.query('example.', 'A', 'IN', true) }
+    assert_nil(Dnsruby::QueryControl.current)
+    assert_nil(Dnsruby::SelectThread::TransmissionBudget.current)
+  end
+
+  def test_shorter_parent_deadline_keeps_parent_error
+    parent = Dnsruby::QueryControl.new(deadline: Dnsruby::TransportClock.now + 0.02)
+    @recursor.define_singleton_method(:query_internal) do |*|
+      Dnsruby::QueryControl.current.pop(Dnsruby::QueryControl::Queue.new)
+    end
+    assert_raises(Dnsruby::QueryControl::DeadlineExceeded) do
+      Dnsruby::QueryControl.with(parent) { @recursor.query('example.', 'A', 'IN', true) }
+    end
+  end
+
+  def test_supporting_queries_share_transmission_and_work_limits
+    @recursor.recursion_limits = {max_queries: 2, max_steps: 2}
+    Dnsruby::Recursor.send(:with_limits, @resolver, @recursor.recursion_limits) do |budget|
+      transmissions = Dnsruby::SelectThread::TransmissionBudget.current
+      2.times do |i|
+        Dnsruby::Recursor.send(:with_limits, @resolver) do |nested|
+          assert_same(budget, nested)
+          nested.step!
+          assert(transmissions.admit('192.0.2.53', 53, false, Dnsruby::Question.new("host#{i}.example.", 'A', 'IN')))
+        end
+      end
+      assert_raises(Dnsruby::RecursionLimitError) { budget.step! }
+      assert_raises(Dnsruby::RecursionLimitError) do
+        transmissions.admit('192.0.2.54', 53, false, Dnsruby::Question.new('another.example.', 'A', 'IN'))
+      end
+    end
+  end
+
+  def test_worker_slots_are_released_and_dependency_paths_restore
+    Dnsruby::Recursor.send(:with_limits, @resolver, @recursor.recursion_limits.merge(max_workers: 1)) do |budget|
+      assert(budget.reserve_worker)
+      refute(budget.reserve_worker)
+      budget.release_worker
+      assert(budget.reserve_worker)
+      budget.release_worker
+      assert_equal(:done, budget.with_dependency('ns.example.', 'A', 'IN') { :done })
+      budget.with_dependency('ns.example.', 'A', 'IN') do
+        refute(budget.with_dependency('NS.EXAMPLE.', 'A', 'IN') { flunk 'Repeated dependency ran' })
+        assert_equal(:other_family, budget.with_dependency('ns.example.', 'AAAA', 'IN') { :other_family })
+      end
+      assert_empty(Thread.current[:dnsruby_recursion_dependencies])
+    end
+  end
+
+  def test_transmission_limit_ends_the_resolvers_remaining_retry_plan
+    engine = Dnsruby::ResolverRuby.allocate
+    message = Dnsruby::Message.new('example.')
+    client_queue, select_queue = Queue.new, Queue.new
+    sender = Object.new
+    engine.instance_variable_set(:@query_list, {request: [message, client_queue, select_queue, [:another_attempt]]})
+    completion = nil
+    engine.define_singleton_method(:send_result_and_stop_querying) { |*args| completion = args }
+    error = Dnsruby::RecursionLimitError.new('Transmission limit reached')
+    engine.handle_error_response(select_queue, [sender, message, :request, 0], error, nil)
+    assert_equal([client_queue, :request, select_queue, nil, error], completion)
+  end
+
+  def test_root_bootstrap_batches_share_the_enclosing_transmission_limit
+    klass = Dnsruby::Recursor
+    saved = %i[@@hints @@stale_hints @@hints_generation @@nameservers @@zones_cache
+      @@zone_expirations @@authority_cache].to_h { |key| [key, klass.class_variable_get(key)] }
+    root = Dnsruby::Message.new('.', 'NS')
+    root.add_answer(Dnsruby::RR.create('. 300 IN NS ns.example.'))
+    budgets, queued = [], []
+    @resolver.define_singleton_method(:query_no_validation_or_recursion) do |*|
+      transmission = Dnsruby::SelectThread::TransmissionBudget.current
+      budgets << transmission
+      transmission.admit('192.0.2.53', 53, false, root.question.first)
+      root
+    end
+    @resolver.define_singleton_method(:send_async) do |message, queue|
+      queued << queue.length
+      transmission = Dnsruby::SelectThread::TransmissionBudget.current
+      budgets << transmission
+      transmission.admit('192.0.2.53', 53, false, message.question.first)
+      answer = Dnsruby::Message.new
+      type = message.question.first.qtype.to_s
+      address = type == 'A' ? '192.0.2.53' : '2001:db8::53'
+      answer.add_answer(Dnsruby::RR.create("ns.example. 300 IN #{type} #{address}"))
+      queue << [type, answer, nil]
+      type
+    end
+    limits = @recursor.recursion_limits.merge(max_queries: 3, max_workers: 1)
+    klass.send(:with_limits, @resolver, limits) do
+      klass.set_hints([], @resolver)
+      assert_equal([0, 0], queued, 'Each address batch must finish before the next begins')
+      assert_equal(1, budgets.map(&:object_id).uniq.length)
+      assert_raises(Dnsruby::RecursionLimitError) do
+        budgets.first.admit('192.0.2.53', 53, false, Dnsruby::Question.new('example.', 'A', 'IN'))
+      end
+    end
+  ensure
+    saved&.each { |key, value| klass.class_variable_set(key, value) }
+  end
+end

data/test/tc_release_auxiliary_fixes.rb

@@ -0,0 +1,288 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+require 'timeout'
+
+class ReleaseAuxiliaryFixesTest < Minitest::Test
+  def test_controlled_queue_wakes_for_each_producer_alias_and_preserves_nil
+    [:push, :<<, :enq].each do |method|
+      queue = Dnsruby::QueryControl::Queue.new
+      control = Dnsruby::QueryControl.new
+      started = Queue.new
+      waiter = Thread.new { started << true; control.pop(queue) }
+      started.pop
+      queue.public_send(method, nil)
+      assert_nil(Timeout.timeout(2) { waiter.value })
+    ensure
+      waiter&.kill
+      waiter&.join
+    end
+  end
+
+  def test_parent_cancellation_wakes_an_event_queue_without_consuming_a_result
+    queue = Dnsruby::QueryControl::Queue.new
+    parent = Dnsruby::QueryControl.new
+    child = Dnsruby::QueryControl.new(parent: parent)
+    ready = Queue.new
+    original_pop = queue.method(:pop)
+    queue.define_singleton_method(:pop) do |*args|
+      ready << true
+      original_pop.call(*args)
+    end
+    waiter = Thread.new do
+      child.pop(queue)
+    rescue Dnsruby::QueryControl::Cancelled => error
+      error
+    end
+    ready.pop
+    parent.cancel
+    assert_instance_of(Dnsruby::QueryControl::Cancelled, Timeout.timeout(2) { waiter.value })
+    queue << :later
+    assert_equal(:later, queue.pop)
+  ensure
+    waiter&.kill
+    waiter&.join
+  end
+
+  def test_event_queue_obeys_deadlines_and_closed_queues
+    queue = Dnsruby::QueryControl::Queue.new
+    control = Dnsruby::QueryControl.new(deadline: Dnsruby::TransportClock.now + 0.01)
+    assert_raises(Dnsruby::QueryControl::DeadlineExceeded) do
+      Timeout.timeout(2) { control.pop(queue) }
+    end
+    queue.close
+    assert_nil(Dnsruby::QueryControl.new.pop(queue))
+  end
+
+  def test_compression_table_stops_recording_unrepresentable_offsets
+    name = Dnsruby::Name.create('late.example.')
+    encoder = Dnsruby::MessageEncoder.new
+    # Exercise the offset decision directly, without constructing an oversized
+    # or malformed DNS packet.
+    encoder.to_s.stub(:bytesize, 0x4000) { encoder.put_name(name) }
+    literal = encoder.to_s.dup
+    encoder.to_s.stub(:bytesize, 0x4000) { encoder.put_name(name) }
+    assert_equal(literal + literal, encoder.to_s)
+  end
+
+  def test_late_names_can_still_compress_to_an_early_suffix
+    encoder = Dnsruby::MessageEncoder.new
+    encoder.put_name(Dnsruby::Name.create('example.'))
+    offset = encoder.to_s.bytesize
+    encoder.to_s.stub(:bytesize, 0x4000) do
+      encoder.put_name(Dnsruby::Name.create('late.example.'))
+    end
+    assert_equal("\x04late\xc0\x00".b, encoder.to_s.byteslice(offset..-1))
+  end
+
+  def test_zone_transfer_reuse_returns_current_ixfr_deltas_after_axfr
+    soa1 = Dnsruby::RR.create('example. 300 IN SOA ns.example. hostmaster.example. 1 60 60 3600 60')
+    soa2 = Dnsruby::RR.create('example. 300 IN SOA ns.example. hostmaster.example. 2 60 60 3600 60')
+    old_address = Dnsruby::RR.create('www.example. 300 IN A 192.0.2.1')
+    new_address = Dnsruby::RR.create('www.example. 300 IN A 192.0.2.2')
+    responses = [Dnsruby::Message.new('example.', 'AXFR'), Dnsruby::Message.new('example.', 'IXFR')]
+    [soa1, old_address, soa1].each { |rr| responses[0].add_answer!(rr) }
+    [soa2, soa1, old_address, soa2, new_address, soa2].each { |rr| responses[1].add_answer!(rr) }
+    transfer = Dnsruby::ZoneTransfer.new
+    transfer.define_singleton_method(:send_message) do |_, request|
+      responses.first.header.id = request.header.id
+      responses.first.header.qr = true
+    end
+    transfer.define_singleton_method(:receive_message) { |*| responses.shift }
+    socket = Object.new
+    socket.define_singleton_method(:close) { }
+    socket.define_singleton_method(:closed?) { false }
+    Socket.stub(:tcp, socket) do
+      assert_equal([soa1, old_address], transfer.do_transfer('example.', '192.0.2.53'))
+      transfer.transfer_type = Dnsruby::Types::IXFR
+      transfer.serial = 1
+      deltas = transfer.do_transfer('example.', '192.0.2.53')
+      assert_equal(1, deltas.length)
+      assert_instance_of(Dnsruby::ZoneTransfer::Delta, deltas.first)
+      assert_equal([1, 2], [deltas.first.start, deltas.first.end])
+      assert_includes(deltas.first.adds, new_address)
+      assert_includes(deltas.first.deletes, old_address)
+    end
+  end
+
+  def test_tsig_stream_copies_own_their_accumulation_buffer
+    signer = Dnsruby::RR.create(name: 'key.example.', type: 'TSIG', klass: 'ANY',
+      key: ['secret'].pack('m0'))
+    query = Dnsruby::Message.new('example.', 'A')
+    signer.apply(query)
+    reply = Dnsruby::Message.new('example.', 'A')
+    reply.header.qr = true
+    signer.dup.apply(reply, query)
+    wire = reply.encode.freeze
+    assert(signer.verify_envelope(Dnsruby::Message.decode(wire), wire))
+    copied_signer = signer.dup
+    prior = signer.instance_variable_get(:@buf).dup
+    intermediate = Dnsruby::Message.new('example.', 'A').encode.freeze
+    assert(copied_signer.verify_envelope(Dnsruby::Message.decode(intermediate), intermediate))
+    assert_equal(prior, signer.instance_variable_get(:@buf))
+    assert_equal(prior + intermediate, copied_signer.instance_variable_get(:@buf))
+  end
+
+  def test_missing_nameserver_addresses_preserve_policy_and_release_cache_mutex
+    recursor_class = Dnsruby::Recursor
+    mutex = recursor_class.class_variable_get(:@@mutex)
+    original_hints = recursor_class.class_variable_get(:@@hints)
+    original_cache = recursor_class.class_variable_get(:@@authority_cache)
+    recursor_class.class_variable_set(:@@hints, {})
+    recursor_class.class_variable_set(:@@authority_cache, {})
+    recursor = recursor_class.allocate
+    recursor.ipv6_ok = true
+    original_recursion = recursor.method(:_dorecursion)
+    calls = Queue.new
+    recursor.define_singleton_method(:_dorecursion) do |name, type, klass, zone, authorities, depth, no_validation|
+      if name == 'www.example.'
+        calls << [:retry, no_validation, authorities.fetch('ns.example.').values.map(&:downcase).sort]
+        :finished
+      else
+        mutex.synchronize do
+          calls << [type, no_validation, Dnsruby::QueryControl.current.deadline]
+        end
+        answer = Dnsruby::Message.new(name, type, klass)
+        address = type == 'AAAA' ? '2001:db8::53' : '192.0.2.53'
+        answer.add_answer(Dnsruby::RR.create("#{name} 300 IN #{type} #{address}"))
+        answer
+      end
+    end
+    authorities = {'ns.example.' => recursor_class::AddressCache.new}
+    parent = Dnsruby::QueryControl.new(deadline: Dnsruby::TransportClock.now + 2)
+    result = Dnsruby::QueryControl.with(parent) do
+      Timeout.timeout(3) do
+        original_recursion.call('www.example.', 'A', Dnsruby::Classes::IN, 'example.', authorities, 0, true)
+      end
+    end
+    assert_equal(:finished, result)
+    events = 3.times.map { calls.pop }
+    assert_equal(%w[A AAAA], events.take(2).map(&:first).sort)
+    events.take(2).each do |event|
+      assert_equal(true, event[1])
+      assert_equal(parent.deadline, event[2])
+    end
+    assert_equal([:retry, true, ['192.0.2.53', '2001:db8::53']], events.last)
+  ensure
+    recursor_class.class_variable_set(:@@hints, original_hints) if recursor_class
+    recursor_class.class_variable_set(:@@authority_cache, original_cache) if recursor_class
+  end
+
+  def test_ds_queries_use_cached_parent_authorities_and_preserve_the_question
+    with_cached_recursor_authorities do |recursor, zones, calls|
+      ['child.example', 'child.example.', Dnsruby::Name.create('child.example'),
+        Dnsruby::Name.create('child.example.')].each do |name|
+        ['DS', 43, Dnsruby::Types.new('DS')].each do |type|
+          was_absolute = name.absolute? if name.is_a?(Dnsruby::Name)
+          response = recursor.query(name, type, Dnsruby::Classes::IN, true)
+          args = calls.last
+          expected_name = Dnsruby::Name.create(name)
+          expected_name.absolute = true
+          assert_equal(expected_name, response.question.first.qname)
+          assert_equal(was_absolute, name.absolute?) if name.is_a?(Dnsruby::Name)
+          assert_equal(expected_name.to_s(true), args[0])
+          assert_same(type, args[1])
+          assert_equal('example.', args[3])
+          assert_authority_snapshot(zones.fetch('example.'), args[4])
+        end
+      end
+    end
+  end
+
+  def test_ds_queries_for_top_level_names_and_root_use_root_authorities
+    with_cached_recursor_authorities do |recursor, zones, calls|
+      ['example', 'example.', '.', Dnsruby::Name.create('.')].each do |name|
+        response = recursor.query(name, 'DS', Dnsruby::Classes::IN, true)
+        args = calls.last
+        expected_name = Dnsruby::Name.create(name)
+        expected_name.absolute = true
+        assert_equal(expected_name, response.question.first.qname)
+        assert_equal(expected_name.to_s(true), args[0])
+        assert_equal('.', args[3])
+        assert_authority_snapshot(zones.fetch('.'), args[4])
+      end
+    end
+  end
+
+  def test_other_record_types_still_use_cached_child_authorities
+    with_cached_recursor_authorities do |recursor, zones, calls|
+      ['DNSKEY', 'A', Dnsruby::Types.new('NS')].each do |type|
+        response = recursor.query('child.example.', type, Dnsruby::Classes::IN, true)
+        args = calls.last
+        assert_equal(Dnsruby::Types.new(type), response.question.first.qtype)
+        assert_equal('child.example.', args[3])
+        assert_authority_snapshot(zones.fetch('child.example.'), args[4])
+      end
+    end
+  end
+
+  def test_recursion_requests_dnssec_data_whenever_it_will_validate
+    recursor_class = Dnsruby::Recursor
+    original_cache = recursor_class.class_variable_get(:@@authority_cache)
+    recursor_class.class_variable_set(:@@authority_cache, {})
+    addresses = recursor_class::AddressCache.new
+    addresses.push(['192.0.2.53', 300])
+    authorities = {'ns.example.' => addresses}
+    transport = Dnsruby::Resolver.new(nameserver: ['192.0.2.53'])
+    recursor = recursor_class.new(transport)
+    wire = nil
+    validates = nil
+    transport.define_singleton_method(:send_message) do |query|
+      validates = query.do_validation
+      wire = single_resolvers.first.make_query_packet(query)
+      response = Dnsruby::Message.new('child.example.', 'DNSKEY')
+      response.header.aa = true
+      response
+    end
+    Dnsruby::Resolver.stub(:new, transport) do
+      [nil, false, true].product([false, true]).each do |dnssec, no_validation|
+        recursor.dnssec = dnssec
+        recursor._dorecursion('child.example.', 'DNSKEY', Dnsruby::Classes::IN,
+          'child.example.', authorities, 0, no_validation)
+        query = Dnsruby::Message.decode(wire)
+        assert_equal(!!dnssec || !no_validation, query.get_opt.dnssec_ok,
+          "dnssec=#{dnssec.inspect}, no_validation=#{no_validation}")
+        assert_equal(!no_validation, validates)
+      end
+    end
+  ensure
+    transport&.close
+    recursor_class.class_variable_set(:@@authority_cache, original_cache) if recursor_class
+  end
+
+  private
+
+  def assert_authority_snapshot(original, copy)
+    assert_equal(original.keys, copy.keys)
+    refute_same(original, copy)
+    original.each do |name, addresses|
+      assert_equal(addresses.values, copy.fetch(name).values)
+      refute_same(addresses, copy.fetch(name))
+    end
+  end
+
+  def with_cached_recursor_authorities
+    recursor_class = Dnsruby::Recursor
+    original_hints = recursor_class.class_variable_get(:@@hints)
+    original_zones = recursor_class.class_variable_get(:@@zones_cache)
+    zones = ['.', 'example.', 'child.example.'].to_h do |zone|
+      [zone, { "ns.#{zone}" => recursor_class::AddressCache.new }]
+    end
+    zones.fetch('.').values.first.push(['192.0.2.53', 300])
+    recursor_class.class_variable_set(:@@hints, zones.fetch('.'))
+    recursor_class.class_variable_set(:@@zones_cache, zones)
+    recursor = recursor_class.allocate
+    recursor.instance_variable_set(:@resolver, Struct.new(:recurse).new)
+    calls = []
+    recursor.define_singleton_method(:_dorecursion) do |*args|
+      calls << args
+      Dnsruby::Message.new(*args.first(3)).tap do |response|
+        response.header.qr = response.header.aa = true
+        response.add_authority(Dnsruby::RR.create("#{args[3]} 60 IN SOA ns.example. hostmaster.example. 1 60 60 60 30"))
+      end
+    end
+    yield recursor, zones, calls
+  ensure
+    recursor_class.class_variable_set(:@@hints, original_hints) if recursor_class
+    recursor_class.class_variable_set(:@@zones_cache, original_zones) if recursor_class
+  end
+end