dnsruby 1.74.0 → 2.0.0

data/test/tc_release_transport_fixes.rb

@@ -0,0 +1,196 @@
+require_relative 'tc_pipeline_send'
+require_relative 'tc_review_transport_native'
+
+class TestReleaseTransportFixes < Minitest::Test
+  def isolated(source)
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, '-Ilib', '-e',
+      TestPipelineSend::FIXTURE + "\nTimeout.timeout(5) do\n" + source + "\nend\n",
+      chdir: File.expand_path('..', __dir__))
+    assert(status.success?, "#{stdout}\n#{stderr}")
+  end
+
+  def test_published_configuration_serves_queries_during_nameserver_construction
+    isolated(<<~'RUBY')
+      resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false)
+      sent = Queue.new
+      resolver.single_resolvers.first.define_singleton_method(:send_async) { |*| sent << true }
+      original = Dnsruby::PacketSender.method(:new)
+      entered, release = Queue.new, Queue.new
+      Dnsruby::PacketSender.define_singleton_method(:new) do |*args|
+        entered << true
+        release.pop
+        original.call(*args)
+      end
+      [:add_server, :nameserver=].each do |operation|
+        configuring = Thread.new { resolver.public_send(operation, '127.0.0.2') }
+        entered.pop
+        begin
+          caller = Thread.new { resolver.send_async(query, Queue.new) }
+          raise 'query waited for replacement configuration' unless caller.join(1)
+          caller.value
+          raise 'published sender was not used' unless sent.pop(true)
+        ensure
+          release << true
+          configuring.value
+          caller&.join
+        end
+      end
+      resolver.close
+    RUBY
+  end
+
+  def test_failed_initial_configuration_waits_for_recovery_publication
+    isolated(<<~'RUBY')
+      resolver = Dnsruby::Resolver.new(nameserver: [], dnssec: false)
+      raise 'expected failed initialization' unless resolver.instance_variable_get(:@configuration_error)
+      original = Dnsruby::PacketSender.method(:new)
+      entered, release, sent = Queue.new, Queue.new, Queue.new
+      Dnsruby::PacketSender.define_singleton_method(:new) do |*args|
+        entered << true
+        release.pop
+        writer = original.call(*args)
+        writer.define_singleton_method(:send_async) { |*| sent << true }
+        writer
+      end
+      configuring = Thread.new { resolver.nameserver = '127.0.0.1' }
+      entered.pop
+      caller = Thread.new { resolver.send_async(query, Queue.new) }
+      begin
+        raise 'query admitted before recovered senders were published' if caller.join(0.05)
+      ensure
+        release << true
+        configuring.value
+      end
+      caller.value
+      raise 'recovered sender was not used' unless sent.pop(true)
+      raise 'configuration error survived publication' if resolver.instance_variable_get(:@configuration_error)
+      resolver.close
+    RUBY
+  end
+
+  def test_single_resolver_timeout_setters_update_the_existing_sender
+    isolated(<<~'RUBY')
+      resolver = Dnsruby::SingleResolver.new(server: '127.0.0.1', packet_timeout: 2)
+      writer = resolver.single_resolvers.first
+      [:packet_timeout=, :query_timeout=].zip([3, 4]).each do |setter, timeout|
+        resolver.public_send(setter, timeout)
+        raise 'sender was replaced' unless resolver.single_resolvers.first.equal?(writer)
+        raise 'stale packet timeout' unless writer.packet_timeout == timeout &&
+          resolver.packet_timeout == timeout && resolver.query_timeout == timeout
+      end
+      resolver.close
+    RUBY
+  end
+
+  def test_selector_waits_for_an_empty_resolvers_exact_query_deadline
+    isolated(<<~'RUBY')
+      now = 100.0
+      Dnsruby::TransportClock.define_singleton_method(:now) { now }
+      SELECTOR.singleton_class.remove_method(:notify_queue_observers)
+      resolver = Dnsruby::Resolver.new
+      resolver.single_resolvers = []
+      resolver.query_timeout = 0.05
+      results = Queue.new
+      resolver.send_async(query, results, :deadline)
+      wakeup = FrameSocket.new
+      K.class_variable_set(:@@wakeup_sockets, [wakeup, wakeup])
+      K.class_variable_get(:@@sockets) << wakeup
+      waits = []
+      IO.define_singleton_method(:select) do |_read, _write, _errors, timeout|
+        waits << timeout
+        now += timeout
+        nil
+      end
+      SELECTOR.do_select
+      raise 'deadline was rounded to a polling interval' unless (waits.first - 0.05).abs < 0.000001
+      result = results.pop(true)
+      raise 'wrong completion' unless result.first == :deadline && result.last.is_a?(Dnsruby::ResolvTimeout)
+      raise 'duplicate completion' unless results.empty?
+    RUBY
+  end
+
+  def test_selector_schedules_retries_at_their_exact_deadline
+    isolated(<<~'RUBY')
+      now = 100.0
+      Dnsruby::TransportClock.define_singleton_method(:now) { now }
+      SELECTOR.singleton_class.remove_method(:notify_queue_observers)
+      resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false,
+        retry_times: 2, retry_delay: 0.025, query_timeout: 0.2)
+      sent = []
+      resolver.single_resolvers.first.define_singleton_method(:send_async) { |*| sent << now }
+      results = Queue.new
+      resolver.send_async(query, results, :retries)
+      wakeup = FrameSocket.new
+      K.class_variable_set(:@@wakeup_sockets, [wakeup, wakeup])
+      K.class_variable_get(:@@sockets) << wakeup
+      IO.define_singleton_method(:select) do |_read, _write, _errors, timeout|
+        now += timeout
+        nil
+      end
+      SELECTOR.do_select
+      raise 'missing or duplicate attempt' unless sent.length == 2
+      raise 'retry missed its deadline' unless (sent.last - 100.05).abs < 0.000001
+      raise 'query did not finish' unless results.pop(true).last.is_a?(Dnsruby::ResolvTimeout)
+      raise 'duplicate completion' unless results.empty?
+    RUBY
+  end
+
+  def test_idle_expiration_never_closes_a_pipeline_with_an_outstanding_query
+    isolated(<<~'RUBY')
+      now = 100.0
+      Dnsruby::TransportClock.define_singleton_method(:now) { now }
+      socket = FrameSocket.new
+      writer = sender(socket)
+      writer.tcp_idle_timeout = 2
+      first = settings(socket, :first, query, writer)
+      SELECTOR.add_to_select(first)
+      SELECTOR.claim_query(first, true)
+      now = 101.0
+      SELECTOR.send(:expire_idle_sockets)
+      raise 'closed before idle deadline' if socket.closed?
+      second = settings(socket, :second, query, writer)
+      SELECTOR.add_to_select(second)
+      now = 110.0
+      SELECTOR.send(:expire_idle_sockets)
+      raise 'closed an active pipeline' if socket.closed?
+      SELECTOR.claim_query(second, true)
+      now = 112.0
+      SELECTOR.send(:expire_idle_sockets)
+      raise 'idle connection retained' unless socket.closed?
+      assert_clean(socket)
+      raise 'idle timer retained' unless K.class_variable_get(:@@socket_idle_deadlines).empty?
+    RUBY
+  end
+end
+
+class ReviewTransportNativeTest < Minitest::Test
+  def test_total_query_timeout_is_not_rounded_to_half_a_second
+    port, = udp_server { |_| [] }
+    resolver = resolver_for(port, packet_timeout: 2, query_timeout: 0.05, do_caching: false)
+    started = Dnsruby::TransportClock.now
+    assert_raises(Dnsruby::ResolvTimeout) { query(resolver) }
+    assert_operator(Dnsruby::TransportClock.now - started, :<, 0.3)
+  end
+
+  def test_idle_pipeline_closes_and_the_next_query_reconnects
+    server = TCPServer.new('127.0.0.1', 0)
+    @sockets << server
+    clients = Queue.new
+    worker do
+      loop do
+        client = server.accept
+        @sockets << client
+        clients << client
+        request = read_frame(client)
+        write_frame(client, response(request, 'connected'))
+      end
+    end
+    resolver = resolver_for(server.addr[1], use_tcp: true, tcp_pipelining: true,
+      tcp_pipelining_max_queries: :infinite, tcp_idle_timeout: 0.05, do_caching: false)
+    assert_equal(['connected'], query(resolver).answer.first.strings)
+    first = clients.pop
+    assert_nil(Timeout.timeout(1) { first.read(1) }, 'client should close the idle stream')
+    assert_equal(['connected'], query(resolver).answer.first.strings)
+    refute_same(first, clients.pop)
+  end
+end

data/test/tc_release_zone_defaults.rb

@@ -0,0 +1,157 @@
+require_relative 'spec_helper'
+
+class ReleaseZoneDefaultsTest < Minitest::Test
+  def record(reader, line)
+    Dnsruby::RR.create(reader.process_line(line))
+  end
+
+  def test_ttl_directive_survives_explicit_record_ttls_and_origin_changes
+    reader = Dnsruby::ZoneReader.new('example.', 900)
+    reader.process_line('$TTL 1h')
+    assert_equal(60, record(reader, 'one 60 IN A 192.0.2.1').ttl)
+    assert_equal(3600, record(reader, 'two IN A 192.0.2.2').ttl)
+    assert_equal(120, record(reader, 'three IN 2m A 192.0.2.3').ttl)
+    reader.process_line('$ORIGIN sub')
+    assert_equal(3600, record(reader, 'four IN A 192.0.2.4').ttl)
+    reader.process_line('$TTL 0')
+    assert_equal(60, record(reader, 'five 60 IN A 192.0.2.5').ttl)
+    assert_equal(0, record(reader, 'six IN A 192.0.2.6').ttl)
+  end
+
+  def test_previous_ttl_inheritance_remains_available_without_a_directive
+    reader = Dnsruby::ZoneReader.new('example.', 900)
+    assert_equal(900, record(reader, 'one IN A 192.0.2.1').ttl)
+    record(reader, 'two 60 IN A 192.0.2.2')
+    assert_equal(60, record(reader, 'three IN A 192.0.2.3').ttl)
+  end
+
+  def test_single_quoted_text_survives_both_header_orders_and_omitted_owner
+    %w[TXT SPF TYPE16 TYPE99].each do |type|
+      reader = Dnsruby::ZoneReader.new('example.')
+      ["www IN 1h #{type} 'one  ; (two)'", "www 1h IN #{type} 'one  ; (two)'",
+       "  CLASS1 3600 #{type} 'one  ; (two)'"].each do |line|
+        rr = record(reader, line)
+        assert_equal(['one  ; (two)'], rr.strings)
+        assert_equal(3600, rr.ttl)
+      end
+    end
+  end
+
+  def test_single_quoted_continuation_and_double_quoted_text
+    reader = Dnsruby::ZoneReader.new('example.')
+    assert_nil(reader.process_line("www IN 60 TXT ( 'one ;'\n"))
+    rr = record(reader, " 'two (three)' )")
+    assert_equal(['one ;', 'two (three)'], rr.strings)
+    assert_equal(['one  ; (two)'], record(reader, 'www IN 1h TXT "one  ; (two)"').strings)
+  end
+
+  def test_rdata_domain_names_are_qualified_against_the_origin
+    reader = Dnsruby::ZoneReader.new('example.', 60)
+    examples = {
+      'KX 10 mail' => :exchange,
+      'NSEC next A NSEC RRSIG' => :next_domain,
+      'NXT next A NXT' => :next_domain,
+      'RRSIG A 8 2 60 20300101000000 20200101000000 1234 signer AQID' => :signers_name,
+      'IPSECKEY 10 3 2 gateway AQID' => :gateway
+    }
+    examples.each do |rdata, field|
+      rr = record(reader, "host IN #{rdata}")
+      assert(rr.public_send(field).absolute?, rdata)
+      assert(rr.public_send(field).subdomain_of?(Dnsruby::Name.create('example.')), rdata)
+      message = Dnsruby::Message.new
+      message.add_answer(rr)
+      decoded = Dnsruby::Message.decode(message.encode).answer.first
+      assert_equal(rr.public_send(field), decoded.public_send(field), rdata)
+    end
+    hip = record(reader, 'host IN HIP 2 00112233 AQID rendezvous other.example.net.')
+    assert_equal(['rendezvous.example.', 'other.example.net.'], hip.rsvs.map { |name| name.to_s(true) })
+    ipv4 = record(reader, 'host IN IPSECKEY 10 1 2 192.0.2.1 AQID')
+    assert_equal('192.0.2.1', ipv4.gateway.to_s)
+  end
+
+  def test_relative_rdata_names_preserve_escaped_final_dots
+    reader = Dnsruby::ZoneReader.new('example.', 60)
+    rr = record(reader, 'host IN NSEC next\\. A NSEC RRSIG')
+    assert_equal(['next.', 'example'], rr.next_domain.labels.map(&:string))
+    rr = record(reader, 'host IN KX 10 mail\\.')
+    assert_equal(['mail.', 'example'], rr.exchange.labels.map(&:string))
+  end
+
+  def test_compression_snapshots_mutable_label_strings
+    text = +'before'
+    name = Dnsruby::Name.new([Dnsruby::Name::Label.new(text), Dnsruby::Name::Label.new('example')], true)
+    encoder = Dnsruby::MessageEncoder.new
+    encoder.put_name(name)
+    text.replace('after')
+    encoder.put_name(name)
+    encoder.put_name(Dnsruby::Name.create('before.example.'))
+    decoder = Dnsruby::MessageDecoder.new(encoder.to_s)
+    assert_equal(['before.example.', 'after.example.', 'before.example.'],
+      3.times.map { decoder.get_name.to_s(true) })
+  end
+
+  def test_generic_rdata_bypasses_all_type_specific_name_and_interval_rewrites
+    examples = [
+      'MX 10 Mail.Other.', 'KX 10 Mail.Other.', 'NS Ns.Other.',
+      'AFSDB 1 Host.Other.', 'NAPTR 10 20 "s" "SIP+D2U" "" Replacement.Other.',
+      'RT 10 Host.Other.', 'SRV 0 5 5060 Service.Other.', 'CNAME Alias.Other.',
+      'MB Mail.Other.', 'MG Mail.Other.', 'MR Mail.Other.', 'PTR Pointer.Other.',
+      'DNAME Target.Other.',
+      'SOA Ns.Other. Hostmaster.Other. 1 3600 600 86400 300',
+      'MINFO One.Other. Two.Other.', 'PX 10 One.Other. Two.Other.',
+      'RP Mailbox.Other. Text.Other.', 'NSEC Next.Other. A NSEC RRSIG',
+      'NXT Next.Other. A NXT',
+      'RRSIG NSEC 8 2 60 20300101000000 20200101000000 1234 Signer.Other. AQID',
+      'IPSECKEY 10 3 2 Gateway.Other. AQID',
+      'HIP 2 00112233 AQID Rendezvous.Other.',
+      'SVCB 1 Target.Other. alpn=h2', 'HTTPS 1 Target.Other. port=443'
+    ]
+    examples.each do |presentation|
+      original = Dnsruby::RR.create("owner.origin. 60 IN #{presentation}")
+      bytes = rdata_bytes(original)
+      generic = "\\# #{bytes.bytesize} #{bytes.unpack1('H*').upcase}"
+      [original.type.to_s, "TYPE#{original.type.code}"].each do |type|
+        reader = Dnsruby::ZoneReader.new('origin.')
+        normalized = reader.process_line("owner IN 1m #{type} #{generic}")
+        assert_equal(generic, normalized.split(/\s+/, 5).last.strip, presentation)
+        parsed = Dnsruby::RR.create(normalized)
+        assert_equal('owner.origin.', parsed.name.to_s(true), presentation)
+        assert_equal(60, parsed.ttl, presentation)
+        assert_equal(bytes, rdata_bytes(parsed), presentation)
+      end
+    end
+  end
+
+  def test_generic_rdata_preserves_zone_defaults_continuations_and_prefix_contract
+    original = Dnsruby::RR.create('owner.origin. 60 IN NSEC Next.Other. A NSEC RRSIG')
+    bytes = rdata_bytes(original)
+    hex = bytes.unpack1('H*')
+    reader = Dnsruby::ZoneReader.new('origin.')
+    reader.process_line('$TTL 2h')
+    assert_nil(reader.process_line("owner IN 1m TYPE47 ( \\# #{bytes.bytesize} #{hex[0, 8]}"))
+    explicit = record(reader, "#{hex[8..]} )")
+    inherited = record(reader, "  IN TYPE47 \\# #{bytes.bytesize} #{hex}")
+    assert_equal([60, 7200], [explicit.ttl, inherited.ttl])
+    assert_equal('owner.origin.', inherited.name.to_s(true))
+    assert_equal(bytes, rdata_bytes(explicit))
+    assert_equal(bytes, rdata_bytes(inherited))
+
+    signature = Dnsruby::RR.create('owner.origin. 60 IN RRSIG NSEC 8 2 60 20300101000000 20200101000000 1234 Signer.Other. AQID')
+    signature_bytes = rdata_bytes(signature)
+    generic = "\\# #{signature_bytes.bytesize} #{signature_bytes.unpack1('H*')}"
+    line, prefix, owner = reader.normalise_line("owner 60 IN TYPE46 #{generic}", true)
+    assert_equal('ZZNSEC', prefix)
+    assert_equal('owner.origin.', owner)
+    assert_equal(generic, line.split(/\s+/, 5).last.strip)
+    assert_equal(signature_bytes, rdata_bytes(Dnsruby::RR.create(line)))
+    empty = record(reader, 'empty IN TYPE65000 \\# 0')
+    assert_equal(7200, empty.ttl)
+    assert_equal(''.b, rdata_bytes(empty))
+  end
+
+  private
+
+  def rdata_bytes(rr)
+    Dnsruby::MessageEncoder.new { |encoder| rr.encode_rdata(encoder, false) }.to_s
+  end
+end

data/test/tc_release_zone_ttls.rb

@@ -0,0 +1,39 @@
+require_relative 'spec_helper'
+
+class ReleaseZoneTtlsTest < Minitest::Test
+  def test_time_suffixes_in_directives_records_and_soa_intervals
+    reader = Dnsruby::ZoneReader.new('example.')
+    reader.process_line('$TTL 1H30m')
+    inherited = Dnsruby::RR.create(reader.process_line('www IN A 192.0.2.1'))
+    assert_equal(5400, inherited.ttl)
+    explicit = Dnsruby::RR.create(reader.process_line('mail 2h IN A 192.0.2.2'))
+    assert_equal(7200, explicit.ttl)
+    soa = Dnsruby::RR.create(reader.process_line('@ IN 1h SOA ns.example. hostmaster.example. 1 2h 10m 1w 5m'))
+    assert_equal([3600, 7200, 600, 604800, 300], [soa.ttl, soa.refresh, soa.retry, soa.expire, soa.minimum])
+    assert_equal(3630, reader.get_ttl('1h30'))
+  end
+
+  def test_class_before_ttl_and_ttl_before_class_are_equivalent
+    %w[3600 1h 1H 30m30m].each do |ttl|
+      expected = Dnsruby::RR.create(Dnsruby::ZoneReader.new('example.').process_line("www #{ttl} IN A 192.0.2.1"))
+      actual = Dnsruby::RR.create(Dnsruby::ZoneReader.new('example.').process_line("www IN #{ttl} A 192.0.2.1"))
+      assert_equal(expected, actual)
+      assert_equal(expected.ttl, actual.ttl)
+    end
+  end
+
+  def test_class_before_ttl_preserves_public_normalisation_hook_and_quoted_data
+    reader_class = Class.new(Dnsruby::ZoneReader) do
+      attr_reader :normalised
+      def normalise_line(*args)
+        @normalised = true
+        super
+      end
+    end
+    reader = reader_class.new('example.')
+    rr = Dnsruby::RR.create(reader.process_line('www IN 1h TXT "one ; two"'))
+    assert(reader.normalised)
+    assert_equal(3600, rr.ttl)
+    assert_equal(['one ; two'], rr.strings)
+  end
+end

data/test/tc_res_config.rb

@@ -15,8 +15,22 @@
 # ++
 
 require_relative 'spec_helper'
+require 'minitest/mock'
+require_relative 'local_dns_server'
 
 class TestResolverConfig < Minitest::Test
+  include LocalDnsServer
+
+  BAD_SERVER = 'invalid-nameserver.test.'.freeze
+
+  def without_external_nameserver_lookup
+    original = Dnsruby::Config.method(:resolve_server)
+    lookup = lambda do |server|
+      raise ArgumentError, 'deliberately unusable nameserver fixture' if server == BAD_SERVER
+      original.call(server)
+    end
+    Dnsruby::Config.stub(:resolve_server, lookup) { yield }
+  end
 
   GoodInput = {
     "port"		  => 54,
@@ -73,7 +87,7 @@ class TestResolverConfig < Minitest::Test
   end
 
   def test_single_resolver
-    [Dnsruby::SingleResolver.new()].each {|res|
+    [Dnsruby::SingleResolver.new('127.0.0.1')].each {|res|
     # [Dnsruby::SingleResolver.new({:nameserver => ["127.0.0.1"]}),
     #   Dnsruby::SingleResolver.new({:nameserver => ["::1"]})].each {|res|
       GoodInput.each do | param, value |
@@ -85,7 +99,7 @@ class TestResolverConfig < Minitest::Test
   end
 
   def test_dns
-    res = Dnsruby::DNS.new
+    res = Dnsruby::DNS.new(nameserver: ['127.0.0.1'])
     LookupInput.each do | param, value |
       res.config.send(param+"=", value)
       assert_equal(res.config.send(param), value,       "setting #param sticks");
@@ -93,32 +107,40 @@ class TestResolverConfig < Minitest::Test
   end
 
   def test_bad_ns
-    begin
-      res = Dnsruby::Resolver.new(:nameserver => ["ns32.domiancontrol.com."])
-      res.query("example.com")
-      assert(false, "Should not query with bad nameserver")
-    rescue Exception => e
-      # OK
+    without_external_nameserver_lookup do
+      resolver = Dnsruby::Resolver.new(nameserver: BAD_SERVER, query_timeout: 0.1, do_caching: false)
+      assert_raises(Dnsruby::ResolvTimeout) { resolver.query('example.test.') }
+    ensure
+      resolver&.close
     end
   end
 
   def test_bad_ns_post_init
-    begin
-      resolver = Dnsruby::Resolver.new(recurse: false, do_caching: false, retry_times: 2)
-      resolver.nameserver = ["ns32.domiancontrol.com."]
-      assert(false, "Should not allow bad nameserver")
-      resolver.query("example.com")
-    rescue ArgumentError
+    resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1')
+    without_external_nameserver_lookup do
+      assert_raises(ArgumentError) { resolver.nameserver = [BAD_SERVER] }
+      assert_equal(['127.0.0.1'], resolver.single_resolvers.map(&:server))
     end
+  ensure
+    resolver&.close
   end
 
   def test_one_good_ns_rest_bad
-    begin
-      resolver = Dnsruby::Resolver.new(recurse: false, do_caching: false, retry_times: 2)
-      resolver.nameserver = ["ns32.domiancontrol.com.", "1.1.1.1"]
-      resolver.query("example.com")
-    rescue ArgumentError
-      assert(false, "Should allow one good nameserver")
+    without_external_nameserver_lookup do
+      with_local_dns_server(:udp, answer: 'example.test. 60 IN A 192.0.2.42') do |resolver|
+        resolver.recurse = false
+        resolver.nameserver = [BAD_SERVER, '127.0.0.1']
+        assert_equal(['127.0.0.1'], resolver.single_resolvers.map(&:server))
+        response = resolver.query('example.test.')
+        assert_equal('192.0.2.42', response.answer.first.address.to_s)
+      end
+    end
+  end
+
+  def test_actual_servfail_is_reported
+    with_local_dns_server(:udp, rcode: Dnsruby::RCode::SERVFAIL) do |resolver|
+      error = assert_raises(Dnsruby::ServFail) { resolver.query('example.test.') }
+      assert_equal('SERVFAIL', error.response.rcode.to_s)
     end
   end
 end

data/test/tc_res_opt.rb

@@ -15,11 +15,31 @@
 # ++
 
 require_relative 'spec_helper'
+require 'minitest/mock'
 
 class TestResOpt < Minitest::Test
 
   include Dnsruby
 
+  def test_source_port_selection_uses_secure_randomness_with_existing_ranges
+    sender = PacketSender.new(server: '127.0.0.1')
+    [0, 15_535].each do |offset|
+      SecureRandom.stub(:random_number, lambda { |count| assert_equal(15_536, count); offset }) do
+        assert_equal(50_000 + offset, sender.get_next_src_port)
+      end
+    end
+    sender.src_port = [56_353, 60_001, 65_535]
+    3.times do |index|
+      SecureRandom.stub(:random_number, lambda { |count| assert_equal(3, count); index }) do
+        assert_equal(sender.src_port[index], sender.get_next_src_port)
+      end
+    end
+    sender.src_port = 56_353
+    assert_equal(56_353, sender.get_next_src_port)
+  ensure
+    sender&.close
+  end
+
   def test_dns_file
 
     #  .txt because this test will run under windows, unlike the other file
@@ -184,4 +204,4 @@ class TestResOpt < Minitest::Test
 #      Dnsruby.log.level=Logger::ERROR
     end
   end
-end
+end

data/test/tc_resolver.rb

@@ -14,17 +14,14 @@
 # limitations under the License.
 # ++
 require_relative 'spec_helper'
+require_relative 'local_dns_server'
 
 require 'socket'
 
-# @TODO@ We also need a test server so we can control behaviour of server to test
-# different aspects of retry strategy.
-# Of course, with Ruby's limit of 256 open sockets per process, we'd need to run
-# the server in a different Ruby process.
-
 class TestResolver < Minitest::Test
 
   include Dnsruby
+  include LocalDnsServer
 
   Thread::abort_on_exception = true
 
@@ -170,13 +167,19 @@ class TestResolver < Minitest::Test
 #  end
 #
   def test_nxdomain
-    resolver = Resolver.new
-    q = Queue.new
-    resolver .send_async(Message.new(BAD_DOMAIN_NAME, Types.A), q, 1)
-    id, m, error = q.pop
-    assert(id==1, "Id should have been 1 but was #{id}")
-    assert(m.rcode == RCode.NXDOMAIN, "Expected NXDOMAIN but got #{m.rcode} instead.")
-    assert_error_is_exception(error, NXDomain)
+    with_local_dns_server(:udp, rcode: RCode.NXDOMAIN) do |resolver|
+      message = Message.new(BAD_DOMAIN_NAME, Types.A)
+      message.do_caching = false
+      message.do_validation = false
+      q = Queue.new
+      resolver.send_async(message, q, 1)
+      id, response, error = q.pop
+      assert_equal(1, id)
+      assert_error_is_exception(error, NXDomain)
+      assert_valid_response(response)
+      assert_equal(RCode.NXDOMAIN, response.rcode)
+      assert_equal(message.header.id, response.header.id)
+    end
   end
 
   def test_timeouts
@@ -319,16 +322,16 @@ class TestResolver < Minitest::Test
 
   def test_custom_udp_size
     [false, true].each do |dnssec_setting|
-      [512, 513].each do |udp_size_setting|
+      [512, 513, 1220, 1232, 4096].each do |udp_size_setting|
         res = Dnsruby::Resolver.new(:udp_size => udp_size_setting, :dnssec => dnssec_setting)
         sent_msg = capture_sent_message(res, "example.com")
 
         # The OPT RR is only present if the udp_size is > 512
         opt = sent_msg.get_opt
         if dnssec_setting
-          # DNSSEC overrides udp_size to 4096
+          # The resolver's minimum UDP size with DNSSEC enabled is 1220.
           assert(opt)
-          assert_equal(4096, opt.klass.code)
+          assert_equal([1220, udp_size_setting].max, opt.klass.code)
         else
           if udp_size_setting <= 512
             assert_nil(opt)
@@ -339,7 +342,7 @@ class TestResolver < Minitest::Test
         end
         if opt
           assert_equal(0, opt.version)
-          assert_equal(0, opt.flags)
+          assert_equal(dnssec_setting ? 0x8000 : 0, opt.flags)
         end
       end
     end
@@ -358,7 +361,7 @@ class TestResolver < Minitest::Test
         assert_equal(1, sent_msg.additional.length) # No duplicate added
         assert_equal(pre_size, opt.klass.code) # Original payload size unchanged
         assert_equal(0, opt.version)
-        assert_equal(0, opt.flags) # Flags unchanged (code doesn't modify existing OPT)
+        assert_equal(dnssec_setting ? 0x8000 : 0, opt.flags)
       end
     end
   end
@@ -369,7 +372,7 @@ class TestRawQuery < Minitest::Test
 
   KEY_NAME = 'key-name'
   KEY  = '0123456789'
-  ALGO = 'hmac-md5'
+  ALGO = 'hmac-sha256'
 
   class CustomError < RuntimeError; end
 
@@ -491,4 +494,3 @@ class TestRawQuery < Minitest::Test
     res.query("a.root-servers.net.", "A")
   end
 end
-