dnsruby 1.74.0 → 2.0.0

data/test/tc_review_transport_fixes.rb

@@ -0,0 +1,195 @@
+require_relative 'tc_pipeline_send'
+
+class ReviewTransportFixesTest < Minitest::Test
+  def test_resolver_early_errors_keep_the_public_completion_protocol
+    isolated(<<~'CODE')
+      resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false)
+      invalid = query
+      rr = Dnsruby::RR.get_class(62001, 1).new('x'.b * 65_536)
+      rr.name, rr.ttl, rr.type, rr.klass = 'size.example.', 0, 62001, 1
+      invalid.add_additional(rr)
+      [invalid, sized_message(65_536)].each do |message|
+        begin
+          resolver.send_message(message)
+          raise 'encoding error returned as a successful Message'
+        rescue Dnsruby::EncodeError
+        end
+        reply, error = resolver.send_message!(message)
+        raise 'bang response tuple lost encoding error' unless reply.nil? && error.is_a?(Dnsruby::EncodeError)
+        queue = Queue.new
+        resolver.send_async(message, queue, :invalid)
+        tuple = queue.pop(true)
+        raise 'malformed async encode tuple' unless tuple.length == 3 && tuple[0] == :invalid &&
+          tuple[1].nil? && tuple[2].is_a?(Dnsruby::EncodeError)
+        raise 'duplicate early completion' unless queue.empty?
+      end
+      queue = Queue.new
+      resolver.send_async(Object.new, queue, :wrong_type)
+      tuple = queue.pop(true)
+      raise 'malformed wrong-type tuple' unless tuple.length == 3 && tuple[0] == :wrong_type &&
+        tuple[1].nil? && tuple[2].is_a?(ArgumentError)
+      raise 'early error acquired transport state' unless K.class_variable_get(:@@query_hash).empty?
+      resolver.close
+    CODE
+  end
+
+  def test_duplicate_id_error_leaves_the_original_query_owned
+    isolated(<<~'CODE')
+      SELECTOR.singleton_class.remove_method(:notify_queue_observers)
+      resolver = Dnsruby::Resolver.new(nameserver: '127.0.0.1', dnssec: false, use_tcp: true)
+      socket = FrameSocket.new
+      Dnsruby::PacketSender.define_method(:connect_tcp) { |*args, **options| socket }
+      first, duplicate = Queue.new, Queue.new
+      resolver.send_async(query('first.example.'), first, :same)
+      written = socket.written.dup
+      resolver.send_async(query('second.example.'), duplicate, :same)
+      tuple = duplicate.pop(true)
+      raise 'malformed duplicate tuple' unless tuple.length == 3 && tuple[0] == :same &&
+        tuple[1].nil? && tuple[2].is_a?(ArgumentError)
+      raise 'duplicate query wrote bytes' unless socket.written == written
+      raise 'duplicate query completed the original' unless first.empty?
+      resolver.close
+      tuple = first.pop(true)
+      raise 'original query lost after duplicate' unless tuple == [:same, nil, tuple.last] &&
+        tuple.last.is_a?(Dnsruby::OtherResolvError)
+      drain_errors
+      raise 'duplicate completion' unless first.empty? && duplicate.empty?
+      raise 'query state retained' unless K.class_variable_get(:@@query_hash).empty?
+    CODE
+  end
+
+  def test_pipeline_configuration_changes_rotate_streams_while_peers_drain
+    isolated(<<~'CODE')
+      created = []
+      Dnsruby::PacketSender.define_method(:connect_tcp) do |*args, **options|
+        socket = FrameSocket.new
+        socket.define_singleton_method(:connect) { |*| raise Errno::EISCONN }
+        created << [socket, args]
+        socket
+      end
+      writer = Dnsruby::PacketSender.new(server: '127.0.0.1', port: 5301,
+        use_tcp: true, tcp_pipelining: true, dnssec: false)
+      send_query = ->(id) do
+        q = query("configuration-#{id}.example.")
+        q.header.id = id + 100
+        writer.send_dnsruby(q.encode, q, id, Queue.new, true)
+      end
+      send_query.call(0)
+      original = created.last.first
+      send_query.call(1)
+      raise 'random source port selection rotated a reusable stream' unless created.length == 1
+      changes = [
+        -> { writer.port = 5302 },
+        -> { writer.server = '127.0.0.2' },
+        -> { writer.src_address = '127.0.0.3' },
+        -> { writer.src_port = [61_001, 61_002] },
+        -> { writer.src_port << 61_003 },
+        -> { writer.server = '::1'; writer.src_address6 = '::1' }
+      ]
+      changes.each_with_index do |change, index|
+        previous = created.last.first
+        change.call
+        send_query.call(index + 2)
+        raise 'configuration reused old endpoint or binding' unless created.length == index + 2
+        raise 'rotation closed pending peer' if previous.closed?
+        raise 'new stream was already closed' if created.last.first.closed?
+      end
+      raise 'changed port not used' unless created[1][1][1] == 5302
+      raise 'changed server not used' unless created[2][1][0] == '127.0.0.2'
+      raise 'changed source not used' unless created[3][1][2] == '127.0.0.3'
+      raise 'changed IPv6 source not used' unless created.last[1][0, 3] == ['::1', 5302, '::1']
+      SELECTOR.remove_id(0)
+      raise 'first stream closed before last peer drained' if original.closed?
+      SELECTOR.remove_id(1)
+      raise 'retired stream remained open after last peer' unless original.closed?
+      (2..7).each { |id| SELECTOR.remove_id(id) }
+      writer.close
+    CODE
+  end
+
+  def test_single_resolver_server_change_keeps_the_configured_port
+    resolver = Dnsruby::SingleResolver.new(server: '127.0.0.1', port: 5301)
+    resolver.server = '127.0.0.2'
+    assert_equal(5301, resolver.port)
+    assert_equal(5301, resolver.single_resolvers.first.port)
+  ensure
+    resolver.close if resolver
+  end
+
+  def test_total_wire_limit_rejects_before_pipeline_admission_and_preserves_peers
+    isolated(<<~'CODE')
+      socket = FrameSocket.new
+      writer = sender(socket)
+      ordinary, queue = query('peer.example.'), Queue.new
+      ordinary.header.id = 100
+      writer.send_dnsruby(ordinary.encode, ordinary, :peer, queue, true)
+      peer = SELECTOR.query_settings_for_id(:peer)
+      boundary = sized_message(65_535)
+      boundary.header.id = 101
+      writer.send_dnsruby(boundary.encode, boundary, :boundary, Queue.new, true)
+      before = socket.written.dup
+      rejected = sized_message(65_536)
+      rejected.header.id = 102
+      errors = Queue.new
+      writer.send_dnsruby(rejected.encode, rejected, :oversized, errors, true)
+      drain_errors
+      event = errors.pop(true)
+      raise 'total size did not produce EncodeError' unless event[0] == :oversized && event.last.is_a?(Dnsruby::EncodeError)
+      raise 'oversized frame wrote or closed the pipeline' unless socket.written == before && !socket.closed?
+      raise 'oversized query acquired registration' if SELECTOR.query_settings_for_id(:oversized)
+      raise 'oversized query displaced peer' unless SELECTOR.query_settings_for_id(:peer).equal?(peer)
+      last = query('last.example.')
+      last.header.id = 103
+      writer.send_dnsruby(last.encode, last, :last, Queue.new, true)
+      expected = [ordinary, boundary, last].map { |q| [q.encode.bytesize].pack('n') + q.encode }.join
+      raise 'pipeline frames corrupted at wire boundary' unless socket.written == expected
+      raise 'duplicate encode error' unless errors.empty?
+      [:peer, :boundary, :last].each { |id| SELECTOR.remove_id(id) }
+    CODE
+  end
+
+  def test_tsig_growth_is_checked_after_packet_preparation
+    skip('OpenSSL HMAC unavailable') unless defined?(OpenSSL::HMAC)
+    isolated(<<~'CODE')
+      writer = Dnsruby::PacketSender.new(server: '127.0.0.1', use_tcp: true, dnssec: false)
+      writer.tsig = ['key.example.', ['secret'].pack('m0')]
+      message = sized_message(65_520)
+      raise 'fixture must fit before signing' unless message.encode.bytesize == 65_520
+      queue = Queue.new
+      Dnsruby::PacketSender.define_method(:connect_tcp) { |*args, **options| raise 'oversized signed packet opened a socket' }
+      writer.send_async(message, queue, :signed)
+      drain_errors
+      event = queue.pop(true)
+      raise 'signed packet size error lost' unless event[0] == :signed && event.last.is_a?(Dnsruby::EncodeError)
+      raise 'oversized signed packet acquired query state' unless K.class_variable_get(:@@query_hash).empty?
+    CODE
+  end
+
+  private
+
+  SIZE_FIXTURE = <<~'CODE'
+    def sized_message(size)
+      q = query('size.example.')
+      q.send_raw = true
+      rr = Dnsruby::RR.get_class(62001, 1).new('')
+      rr.name, rr.ttl, rr.type, rr.klass = 'size.example.', 0, 62001, 1
+      q.add_additional(rr)
+      padding = size - q.encode.bytesize
+      full = Dnsruby::RR.get_class(62001, 1).new('x'.b * padding)
+      full.name, full.ttl, full.type, full.klass = 'size.example.', 0, 62001, 1
+      q.remove_additional
+      q.add_additional(full)
+      raise 'wrong fixture wire length' unless q.encode.bytesize == size
+      q
+    end
+  CODE
+
+  def isolated(body)
+    options = ''.frozen? ? ['--enable-frozen-string-literal'] : []
+    source = "#{TestPipelineSend::FIXTURE}\n#{SIZE_FIXTURE}\nTimeout.timeout(10) do\n#{body}\nend"
+    stdout, stderr, status = Open3.capture3(RbConfig.ruby, *options, '-I',
+      File.expand_path('../lib', __dir__), '-e', source)
+    assert(status.success?, "#{stdout}\n#{stderr}")
+    assert_empty(stderr)
+  end
+end

data/test/tc_review_transport_native.rb

@@ -0,0 +1,415 @@
+require_relative 'spec_helper'
+require_relative 'socket_helpers'
+require 'socket'
+require 'timeout'
+
+# Exercise cache and retry policy through the public API and real wire packets.
+class ReviewTransportNativeTest < Minitest::Test
+  def setup
+    Dnsruby::PacketSender.clear_caches
+    @workers = []
+    @sockets = []
+    @resolvers = []
+  end
+
+  def teardown
+    @resolvers.each(&:close)
+    @workers.each { |worker| worker.kill if worker.alive? }
+    @workers.each(&:value)
+    @sockets.each { |socket| socket.close unless socket.closed? }
+    Dnsruby::PacketSender.clear_caches
+  end
+
+  def test_recursive_and_authoritative_caches_keep_question_classes_separate
+    [true, false].each do |recurse|
+      Dnsruby::PacketSender.clear_caches
+      port, requests = udp_server do |request|
+        response(request, request.question.first.qclass.to_s)
+      end
+      resolver = resolver_for(port, recurse: recurse)
+      %w[IN CH IN CH].each_with_index do |klass, index|
+        reply = query(resolver, klass)
+        assert_equal(klass, reply.question.first.qclass.to_s)
+        assert_equal(klass, reply.answer.first.klass.to_s)
+        assert_equal([klass], reply.answer.first.strings)
+        assert_equal(index >= 2, !!reply.cached)
+      end
+      assert_equal(2, requests.size, 'both classes should subsequently hit their own cache')
+    end
+  end
+
+  def test_unsigned_cache_cannot_satisfy_a_tsig_query
+    skip('OpenSSL HMAC unavailable') unless defined?(OpenSSL::HMAC)
+    [true, false].each do |recurse|
+      Dnsruby::PacketSender.clear_caches
+      port, requests = udp_server { |request| response(request, 'unsigned') }
+      resolver = resolver_for(port, recurse: recurse)
+      assert_equal(['unsigned'], query(resolver).answer.first.strings)
+      resolver.tsig = tsig_key
+      assert_raises(Dnsruby::TsigNotSignedResponseError) { query(resolver) }
+      assert_equal(2, requests.size, 'authentication must require a new wire exchange')
+    end
+  end
+
+  def test_verified_tsig_reply_cannot_enter_the_shared_unsigned_cache
+    skip('OpenSSL HMAC unavailable') unless defined?(OpenSSL::HMAC)
+    [true, false].each do |recurse|
+      Dnsruby::PacketSender.clear_caches
+      key = tsig_key
+      port, requests = udp_server do |request|
+        reply = response(request, request.tsig ? 'private' : 'public')
+        key.apply(reply, request) if request.tsig
+        reply
+      end
+      resolver = resolver_for(port, recurse: recurse)
+      resolver.tsig = key
+      signed = query(resolver)
+      assert(signed.verified?)
+      assert_nil(signed.tsig, 'verification strips the wire TSIG record')
+      assert_equal(['private'], signed.answer.first.strings)
+      resolver.tsig = nil
+      unsigned = query(resolver)
+      assert_equal(['public'], unsigned.answer.first.strings)
+      refute(unsigned.cached)
+      assert(query(resolver).cached)
+      assert_equal(2, requests.size)
+    end
+  end
+
+  def test_caller_opt_receives_a_reply_larger_than_the_configured_udp_default
+    [false, true].each do |dnssec|
+      port, requests = udp_server do |request|
+        reply = response(request, 'placeholder')
+        reply.answer.first.strings = Array.new(7) { 'x' * 240 }
+        reply
+      end
+      resolver = resolver_for(port, udp_size: 1232, dnssec: dnssec, do_caching: false)
+      request = Dnsruby::Message.new('large-opt.example.', 'TXT')
+      request.do_caching = request.do_validation = false
+      option = Dnsruby::RR::OPT::Option.new(65000, 'opaque'.b)
+      request.add_additional(Dnsruby::RR::OPT.new(4096, 0, [option]))
+      reply = Timeout.timeout(6) { resolver.send_message(request) }
+      refute(reply.cached, 'each variant must receive its own UDP reply')
+      assert_equal(Array.new(7) { 'x' * 240 }, reply.answer.first.strings)
+      assert_operator(reply.answersize, :>, 1232)
+      assert_operator(reply.answersize, :<=, 4096)
+      sent = requests.pop(true)
+      assert_equal(4096, sent.get_opt.payloadsize)
+      assert_equal([[65000, 'opaque']], sent.get_opt.options(nil).map { |opt| [opt.code, opt.data] })
+      assert_equal(1232, resolver.udp_size)
+      assert_empty(requests)
+    end
+  end
+
+  def test_authenticated_badtime_and_badtrunc_errors_are_delivered_after_forged_errors
+    [18, 22].each do |error_code|
+      key = tsig_key
+      port, requests = udp_server do |request|
+        reply = response(request, 'server error')
+        reply.header.rcode = Dnsruby::RCode::NOTAUTH
+        signer = key.dup
+        signer.error = error_code
+        signer.time_signed = request.tsig.time_signed
+        if error_code == 18
+          signer.other_data = [0, Time.now.to_i + 3600].pack('nN')
+          signer.other_size = 6
+        end
+        signature = signer.generate(reply, request)
+        reply.add_additional(signature)
+        valid = reply.encode
+        forged = Dnsruby::Message.decode(valid)
+        forged.tsig.mac = forged.tsig.mac.dup
+        forged.tsig.mac.setbyte(0, forged.tsig.mac.getbyte(0) ^ 1)
+        [forged.encode, valid]
+      end
+      resolver = resolver_for(port, do_caching: false)
+      resolver.tsig = key
+      error = assert_raises(Dnsruby::TsigError) { query(resolver) }
+      assert_includes(error.message, error_code == 18 ? 'BADTIME' : 'BADTRUNC')
+      assert_equal(1, requests.size, 'authenticated error should complete the original transaction')
+    end
+  end
+
+  def test_default_udp_advertisement_retries_truncated_responses_over_tcp
+    [false, true].each do |dnssec|
+      port, udp_requests, tcp = udp_server(tcp: true) do |request|
+        reply = response(request, 'truncated')
+        reply.header.tc = true
+        reply
+      end
+      tcp_requests = Queue.new
+      worker do
+        client = tcp.accept
+        begin
+          request = read_frame(client)
+          tcp_requests << request
+          reply = response(request, 'complete')
+          reply.answer.first.strings = Array.new(7) { 'x' * 240 }
+          write_frame(client, reply)
+        ensure
+          client.close
+        end
+      end
+      resolver = resolver_for(port, dnssec: dnssec, do_caching: false)
+      request = Dnsruby::Message.new('truncated.example.', 'TXT')
+      request.do_caching = request.do_validation = false
+      reply = Timeout.timeout(6) { resolver.send_message(request) }
+      refute(reply.cached)
+      refute(reply.header.tc)
+      assert_equal(Array.new(7) { 'x' * 240 }, reply.answer.first.strings)
+      assert_operator(reply.encode.bytesize, :>, 1232)
+      assert_equal(1232, resolver.udp_size)
+      udp_request = udp_requests.pop(true)
+      tcp_request = tcp_requests.pop(true)
+      assert_equal(1232, udp_request.get_opt.payloadsize)
+      assert_equal(dnssec, udp_request.get_opt.dnssec_ok)
+      assert_equal(udp_request.header.id, tcp_request.header.id)
+      assert_equal(udp_request.question, tcp_request.question)
+      assert_empty(udp_requests)
+      assert_empty(tcp_requests)
+    end
+  end
+
+  def test_message_and_resolver_keys_authenticate_edns_and_tcp_retries
+    [false, true].product([:message, :resolver]).each do |dnssec, key_source|
+      key = tsig_key
+      received = 0
+      observed = Queue.new
+      port, _, tcp = udp_server(tcp: true) do |request, bytes|
+        signature = request.tsig
+        raise 'invalid UDP request MAC' unless signature &&
+          key.generate(request, nil, '', bytes, signature).mac == signature.mac
+        observed << [:udp, request.get_opt]
+        reply = response(request, 'retry')
+        reply.header.rcode = Dnsruby::RCode::FORMERR if received.zero?
+        reply.header.tc = true unless received.zero?
+        received += 1
+        key.apply(reply, request)
+        reply
+      end
+      worker do
+        client = tcp.accept
+        begin
+          length = client.read(2).unpack1('n')
+          bytes = client.read(length)
+          request = Dnsruby::Message.decode(bytes)
+          signature = request.tsig
+          raise 'invalid TCP request MAC' unless signature &&
+            key.generate(request, nil, '', bytes, signature).mac == signature.mac
+          observed << [:tcp, request.get_opt]
+          reply = response(request, 'authenticated')
+          key.apply(reply, request)
+          write_frame(client, reply)
+        ensure
+          client.close
+        end
+      end
+      resolver = resolver_for(port, dnssec: dnssec, do_caching: false)
+      request = Dnsruby::Message.new('signed-retry.example.', 'TXT')
+      request.header.rd = false
+      request.do_caching = request.do_validation = false
+      key_source == :message ? request.set_tsig(key) : resolver.tsig = key
+      reply = Timeout.timeout(6) { resolver.send_message(request) }
+      assert(reply.verified?)
+      assert_equal(['authenticated'], reply.answer.first.strings)
+      attempts = 3.times.map { observed.pop(true) }
+      assert_equal([:udp, :udp, :tcp], attempts.map(&:first))
+      assert_equal([true, false, false], attempts.map { |_, opt| !!opt })
+      assert_equal(1232, attempts.first.last.payloadsize)
+      assert_equal(dnssec, attempts.first.last.dnssec_ok)
+      assert_empty(observed)
+    end
+  end
+
+  def test_explicit_tcp_edns_retry_stays_on_tcp
+    server = TCPServer.new('127.0.0.1', 0)
+    @sockets << server
+    requests = Queue.new
+    worker do
+      2.times do |index|
+        client = server.accept
+        begin
+          request = read_frame(client)
+          requests << request
+          reply = response(request, 'tcp')
+          reply.header.rcode = Dnsruby::RCode::FORMERR if index.zero?
+          write_frame(client, reply)
+        ensure
+          client.close
+        end
+      end
+    end
+    resolver = resolver_for(server.addr[1], use_tcp: true, do_caching: false)
+    message = Dnsruby::Message.new('review.example.', 'TXT')
+    message.do_caching = message.do_validation = false
+    message.add_additional(Dnsruby::RR::OPT.new(4096))
+    reply = Timeout.timeout(6) { resolver.send_message(message) }
+    assert_equal(['tcp'], reply.answer.first.strings)
+    assert_equal(2, requests.size)
+    assert(requests.pop.get_opt)
+    assert_nil(requests.pop.get_opt)
+    assert(message.get_opt, 'the caller retains the original EDNS request')
+  end
+
+  def test_udp_ignores_query_packets_and_wrong_opcodes_until_valid_reply
+    port, requests = udp_server do |request|
+      invalid_responses(request) + [response(request, 'valid')]
+    end
+    reply = query(resolver_for(port, do_caching: false))
+    assert_equal(['valid'], reply.answer.first.strings)
+    assert_equal(1, requests.size)
+  end
+
+  def test_tcp_ignores_query_frames_and_wrong_opcodes_until_valid_reply
+    server = TCPServer.new('127.0.0.1', 0)
+    @sockets << server
+    worker do
+      client = server.accept
+      begin
+        request = read_frame(client)
+        (invalid_responses(request) + [response(request, 'valid')]).each do |reply|
+          write_frame(client, reply)
+        end
+      ensure
+        client.close
+      end
+    end
+    reply = query(resolver_for(server.addr[1], use_tcp: true, do_caching: false))
+    assert_equal(['valid'], reply.answer.first.strings)
+  end
+
+  def test_udp_ignores_malformed_packets_with_unrelated_headers_without_retrying
+    port, requests = udp_server do |request|
+      malformed = invalid_responses(request).flat_map do |invalid|
+        [false, true].map do |truncated|
+          invalid.header.tc = truncated
+          bytes = invalid.encode
+          # Advertise an absent additional record, forcing Message.decode to
+          # expose its partially decoded header through DecodeError.
+          bytes[10, 2] = [1].pack('n')
+          bytes
+        end
+      end
+      malformed + [response(request, 'valid')]
+    end
+    reply = query(resolver_for(port, do_caching: false))
+    assert_equal(['valid'], reply.answer.first.strings)
+    assert_equal(1, requests.size)
+  end
+
+  def test_udp_ignores_incomplete_and_unrelated_malformed_questions_before_a_valid_reply
+    port, requests = udp_server do |request|
+      unrelated = Dnsruby::Message.new('unrelated.example.', 'AAAA', 'CH')
+      unrelated.header.id = request.header.id
+      unrelated.header.qr = true
+      malformed = [false, true].map do |truncated|
+        unrelated.header.tc = truncated
+        unrelated.encode.tap { |wire| wire[6, 2] = [1].pack('n') }
+      end
+      incomplete = [2, 11, 12, 15].map { |length| malformed.first.byteslice(0, length) }
+      incomplete + malformed + [response(request, 'valid')]
+    end
+    reply = query(resolver_for(port, do_caching: false))
+    assert_equal(['valid'], reply.answer.first.strings)
+    assert_equal(1, requests.size)
+  end
+
+  def test_short_deadline_query_on_busy_resolver_is_sent_before_its_deadline
+    port, requests = udp_server do |request|
+      request.question.first.qname.to_s == 'pending.example' ? [] : response(request, 'fast')
+    end
+    resolver = resolver_for(port, do_caching: false)
+    pending = Dnsruby::Message.new('pending.example.', 'TXT')
+    pending.do_caching = pending.do_validation = false
+    pending_results = Queue.new
+    resolver.send_async(pending, pending_results, :pending)
+    Timeout.timeout(2) { requests.pop }
+    sleep 0.03 # Start just after the selector's initial tick, while the first query remains pending.
+    resolver.query_timeout = 0.2
+    assert_equal(['fast'], query(resolver).answer.first.strings)
+    assert_equal(1, requests.size, 'the new query must reach the server while the first remains pending')
+    assert(pending_results.empty?)
+  end
+
+  private
+
+  def worker(&block)
+    thread = Thread.new(&block)
+    thread.report_on_exception = false
+    @workers << thread
+    thread
+  end
+
+  def udp_server(tcp: false, &handler)
+    if tcp
+      socket, listener = TestSockets.udp_tcp_pair
+      @sockets << listener
+    else
+      socket = UDPSocket.new
+      socket.bind('127.0.0.1', 0)
+    end
+    @sockets << socket
+    requests = Queue.new
+    worker do
+      loop do
+        bytes, peer = socket.recvfrom(65_535)
+        request = Dnsruby::Message.decode(bytes)
+        requests << request
+        replies = handler.call(request, bytes)
+        replies = [replies] unless replies.is_a?(Array)
+        replies.each do |reply|
+          bytes = reply.is_a?(String) ? reply : reply.encode
+          socket.send(bytes, 0, peer[3], peer[1])
+        end
+      end
+    end
+    [socket.addr[1], requests, listener]
+  end
+
+  def resolver_for(port, options = {})
+    resolver = Dnsruby::Resolver.new({nameserver: '127.0.0.1', port: port,
+      dnssec: false, do_validation: false,
+      packet_timeout: 1, query_timeout: 3, retry_times: 1}.merge(options))
+    @resolvers << resolver
+    resolver
+  end
+
+  def query(resolver, klass = 'IN')
+    Timeout.timeout(6) { resolver.query('review.example.', 'TXT', klass) }
+  end
+
+  def response(request, text)
+    question = request.question.first
+    reply = Dnsruby::Message.new
+    reply.header.id = request.header.id
+    reply.header.qr = reply.header.aa = reply.header.ra = true
+    reply.header.rd = request.header.rd
+    reply.header.opcode = request.header.opcode
+    reply.add_question(question.qname, question.qtype, question.qclass)
+    reply.add_answer(Dnsruby::RR.create("#{question.qname} 60 #{question.qclass} TXT \"#{text}\""))
+    reply
+  end
+
+  def invalid_responses(request)
+    query_packet = response(request, 'invalid-query')
+    query_packet.header.qr = false
+    wrong_opcode = response(request, 'invalid-opcode')
+    wrong_opcode.header.opcode = 2 # STATUS
+    [query_packet, wrong_opcode]
+  end
+
+  def tsig_key
+    Dnsruby::RR.create(name: 'review-key.example.', type: 'TSIG', klass: 'ANY',
+      key: 'c2VjcmV0', algorithm: 'hmac-sha256')
+  end
+
+  def read_frame(socket)
+    length = socket.read(2).unpack1('n')
+    Dnsruby::Message.decode(socket.read(length))
+  end
+
+  def write_frame(socket, reply)
+    bytes = reply.encode
+    socket.write([bytes.bytesize].pack('n') + bytes)
+  end
+end