@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/dnssec.test.js

@@ -518,6 +518,316 @@ function testRrsigSerialArithmetic() {
     code(function () { verifyAt(0x00020000); }) === "dnssec/expired");
 }
 
+// ---------------------------------------------------------------------------
+// Adversarial + error-path coverage: real RRSIG/DNSKEY fixtures across every
+// supported DNSSEC algorithm (RSA/SHA-256, ECDSA P-256/P-384, Ed25519), the
+// parse/validation refusals, and the denial-of-existence covering-range and
+// closest-encloser branches. Signature-PASSING adversarial shapes (wrong
+// owner, wrong type, tampered RRset) MUST fail closed on every algorithm.
+// ---------------------------------------------------------------------------
+
+var B32H_ENC = "0123456789ABCDEFGHIJKLMNOPQRSTUV";
+function _b32hEnc(buf) {
+  var bits = 0, val = 0, out = "";
+  for (var i = 0; i < buf.length; i++) {
+    val = (val << 8) | buf[i]; bits += 8;
+    while (bits >= 5) { bits -= 5; out += B32H_ENC[(val >> bits) & 31]; }
+  }
+  if (bits > 0) out += B32H_ENC[(val << (5 - bits)) & 31];
+  return out;
+}
+
+function _ecPub(publicKey) {
+  var jwk = publicKey.export({ format: "jwk" });
+  return Buffer.concat([Buffer.from(jwk.x, "base64url"), Buffer.from(jwk.y, "base64url")]);
+}
+// Generate a keypair for a DNSSEC algorithm number → { priv, pub, hash, dsa }.
+// `pub` is the DNSKEY publicKey field (the bytes AFTER flags/proto/alg).
+function _genAlgKey(alg) {
+  if (alg === 13) { var k13 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" }); return { priv: k13.privateKey, pub: _ecPub(k13.publicKey), hash: "sha256", dsa: "ieee-p1363" }; }
+  if (alg === 14) { var k14 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp384r1" }); return { priv: k14.privateKey, pub: _ecPub(k14.publicKey), hash: "sha384", dsa: "ieee-p1363" }; }
+  if (alg === 15) { var k15 = nodeCrypto.generateKeyPairSync("ed25519"); return { priv: k15.privateKey, pub: Buffer.from(k15.publicKey.export({ format: "jwk" }).x, "base64url"), hash: null, dsa: null }; }
+  var k8 = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  var jwk = k8.publicKey.export({ format: "jwk" });
+  var e = Buffer.from(jwk.e, "base64url"), n = Buffer.from(jwk.n, "base64url");
+  return { priv: k8.privateKey, pub: Buffer.concat([Buffer.from([e.length]), e, n]), hash: "sha256", dsa: null, rsaE: e, rsaN: n };
+}
+function _dnskeyRd(flags, alg, pub) { return Buffer.concat([_u16b(flags), Buffer.from([3, alg]), pub]); }
+// Sign an RRset of `type` under `zone` with key `g`, mirroring the RFC 4034
+// §3.1.8.1 signed-data verifyRrset reconstructs. Returns the rrsig object.
+function _signRrsetAlg(g, alg, zone, type, rdatas, signerRd, inc, exp) {
+  var owner = _canonName(zone), ttl = _u32b(3600);
+  var labels = zone.replace(/\.$/, "") === "" ? 0 : zone.replace(/\.$/, "").split(".").length;
+  var tag = b.network.dns.dnssec.keyTag(signerRd);
+  var sorted = rdatas.slice().sort(Buffer.compare), rrs = [];
+  sorted.forEach(function (rd) { rrs.push(owner, _u16b(type), _u16b(1), ttl, _u16b(rd.length), rd); });
+  var prefix = Buffer.concat([_u16b(type), Buffer.from([alg, labels]), ttl, _u32b(exp), _u32b(inc), _u16b(tag), _canonName(zone)]);
+  var signed = Buffer.concat([prefix].concat(rrs));
+  var sig;
+  if (alg === 15) sig = nodeCrypto.sign(null, signed, g.priv);
+  else if (g.dsa) sig = nodeCrypto.sign(g.hash, signed, { key: g.priv, dsaEncoding: g.dsa });
+  else sig = nodeCrypto.sign(g.hash, signed, g.priv);
+  return { algorithm: alg, labels: labels, originalTtl: 3600, expiration: exp, inception: inc, keyTag: tag, signerName: zone, signature: sig };
+}
+
+// Every supported algorithm self-signs a DNSKEY RRset and verifies; every
+// signature-passing adversarial shape (tamper / wrong owner name) fails closed.
+function testAlgorithmRoundTrips() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var now = Math.floor(Date.now() / 1000), inc = now - 60, exp = now + 86400;
+  [{ alg: 14, name: "ECDSAP384SHA384" }, { alg: 15, name: "ED25519" }, { alg: 8, name: "RSASHA256" }].forEach(function (spec) {
+    var g = _genAlgKey(spec.alg);
+    var rd = _dnskeyRd(257, spec.alg, g.pub);
+    var rrsig = _signRrsetAlg(g, spec.alg, "example.test.", 48, [rd], rd, inc, exp);
+    var out = b.network.dns.dnssec.verifyRrset({ name: "example.test.", type: "DNSKEY", rdatas: [rd], rrsig: rrsig, dnskey: { algorithm: spec.alg, publicKey: g.pub } });
+    check("verifyRrset: real " + spec.name + " self-sig verifies", out.ok === true && out.algorithm === spec.name);
+    var tampered = Buffer.from(rd); tampered[tampered.length - 1] ^= 0xff;
+    check("verifyRrset: tampered " + spec.name + " RRset fails closed", code(function () { b.network.dns.dnssec.verifyRrset({ name: "example.test.", type: "DNSKEY", rdatas: [tampered], rrsig: rrsig, dnskey: { algorithm: spec.alg, publicKey: g.pub } }); }) === "dnssec/bad-signature");
+    check("verifyRrset: " + spec.name + " sig fails closed under a different owner name", code(function () { b.network.dns.dnssec.verifyRrset({ name: "other.test.", type: "DNSKEY", rdatas: [rd], rrsig: rrsig, dnskey: { algorithm: spec.alg, publicKey: g.pub } }); }) === "dnssec/bad-signature");
+  });
+  // ECDSA P-384 declared but given a P-256-sized key → refused before verify.
+  var g14 = _genAlgKey(13);
+  var rd14 = _dnskeyRd(257, 14, g14.pub);
+  var rrsig14 = { algorithm: 14, labels: 2, originalTtl: 3600, expiration: exp, inception: inc, keyTag: b.network.dns.dnssec.keyTag(rd14), signerName: "example.test.", signature: Buffer.alloc(96) };
+  check("verifyRrset: P-384 alg with a P-256-sized key refused", code(function () { b.network.dns.dnssec.verifyRrset({ name: "example.test.", type: "DNSKEY", rdatas: [rd14], rrsig: rrsig14, dnskey: { algorithm: 14, publicKey: g14.pub }, at: new Date(now * 1000) }); }) === "dnssec/bad-key");
+}
+
+// Numeric RR type + non-canonical RR ordering + omitted opts.at (current-clock
+// window check). A signature over type A must not verify when re-presented as
+// another name-free type (the covered type is folded into the signed data).
+function testNameFreeTypesAndNumericType() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var now = Math.floor(Date.now() / 1000), inc = now - 60, exp = now + 86400;
+  var g = _genAlgKey(13), kskRd = _dnskeyRd(257, 13, g.pub);
+  var a1 = Buffer.from([192, 0, 2, 1]), a2 = Buffer.from([192, 0, 2, 2]);
+  var rrsig = _signRrsetAlg(g, 13, "www.example.test.", 1, [a2, a1], kskRd, inc, exp);
+  var out = b.network.dns.dnssec.verifyRrset({ name: "www.example.test.", type: 1, class: 1, rdatas: [a2, a1], rrsig: rrsig, dnskey: { algorithm: 13, publicKey: g.pub }, at: new Date(now * 1000) });
+  check("verifyRrset: numeric type + non-canonical RR order verifies (A/1)", out.ok === true);
+  var outNow = b.network.dns.dnssec.verifyRrset({ name: "www.example.test.", type: 1, rdatas: [a1, a2], rrsig: rrsig, dnskey: { algorithm: 13, publicKey: g.pub } });
+  check("verifyRrset: omitted opts.at falls back to the current clock", outNow.ok === true);
+  check("verifyRrset: A-record sig fails closed when re-presented as TXT", code(function () { b.network.dns.dnssec.verifyRrset({ name: "www.example.test.", type: 16, rdatas: [a1, a2], rrsig: rrsig, dnskey: { algorithm: 13, publicKey: g.pub }, at: new Date(now * 1000) }); }) === "dnssec/bad-signature");
+}
+
+// RFC 3110 allows two encodings of the RSA exponent length (1-byte, or a
+// leading 0 flagging a 2-byte length). The same key encoded with the 3-byte
+// form must still verify a real signature.
+function testRsaThreeByteExponentForm() {
+  var now = Math.floor(Date.now() / 1000), inc = now - 60, exp = now + 86400;
+  var g = _genAlgKey(8);
+  var e = g.rsaE, n = g.rsaN;
+  var pub3 = Buffer.concat([Buffer.from([0, (e.length >> 8) & 0xff, e.length & 0xff]), e, n]);
+  var rd = _dnskeyRd(257, 8, pub3);
+  var rrsig = _signRrsetAlg(g, 8, "rsa.test.", 48, [rd], rd, inc, exp);
+  var out = b.network.dns.dnssec.verifyRrset({ name: "rsa.test.", type: "DNSKEY", rdatas: [rd], rrsig: rrsig, dnskey: { algorithm: 8, publicKey: pub3 }, at: new Date(now * 1000) });
+  check("verifyRrset: RSA DNSKEY 3-byte exponent-length form verifies (RFC 3110)", out.ok === true);
+}
+
+// verifyRrset input-shape refusals (missing rrsig/dnskey, empty rrset,
+// unsupported algorithm, unknown/bad type, malformed owner name, wrong-size
+// / malformed public keys).
+function testVerifyRrsetRefusalsExtra() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var now = Math.floor(Date.now() / 1000);
+  var g = _genAlgKey(13), rd = _dnskeyRd(257, 13, g.pub);
+  var goodRrsig = { algorithm: 13, labels: 1, originalTtl: 3600, expiration: now + 86400, inception: now - 60, keyTag: b.network.dns.dnssec.keyTag(rd), signerName: "test.", signature: Buffer.alloc(64) };
+  var base = { name: "test.", type: "DNSKEY", rdatas: [rd], rrsig: goodRrsig, dnskey: { algorithm: 13, publicKey: g.pub }, at: new Date(now * 1000) };
+  check("verifyRrset: null rrsig refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { rrsig: null })); }) === "dnssec/bad-rrsig");
+  check("verifyRrset: null dnskey refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { dnskey: null })); }) === "dnssec/bad-key");
+  check("verifyRrset: empty rdatas refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { rdatas: [] })); }) === "dnssec/empty-rrset");
+  check("verifyRrset: non-array rdatas refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { rdatas: "nope" })); }) === "dnssec/empty-rrset");
+  check("verifyRrset: unsupported RRSIG algorithm refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { rrsig: Object.assign({}, goodRrsig, { algorithm: 5 }), dnskey: { algorithm: 5, publicKey: g.pub } })); }) === "dnssec/unsupported-alg");
+  check("verifyRrset: unknown RR type string refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { type: "BOGUS" })); }) === "dnssec/unknown-type");
+  check("verifyRrset: non-string owner name refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { name: 12345 })); }) === "dnssec/bad-name");
+  check("verifyRrset: empty label in owner name refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { name: "a..b" })); }) === "dnssec/bad-name");
+  check("verifyRrset: over-long label in owner name refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { name: new Array(66).join("a") + ".test" })); }) === "dnssec/bad-name");
+  check("verifyRrset: EC key wrong size refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { dnskey: { algorithm: 13, publicKey: Buffer.alloc(10) } })); }) === "dnssec/bad-key");
+  check("verifyRrset: malformed RSA public key refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { rrsig: Object.assign({}, goodRrsig, { algorithm: 8 }), dnskey: { algorithm: 8, publicKey: Buffer.from([5, 1, 2]) } })); }) === "dnssec/bad-key");
+  check("verifyRrset: Ed25519 key wrong size refused", code(function () { b.network.dns.dnssec.verifyRrset(Object.assign({}, base, { rrsig: Object.assign({}, goodRrsig, { algorithm: 15 }), dnskey: { algorithm: 15, publicKey: Buffer.alloc(10) } })); }) === "dnssec/bad-key");
+}
+
+function testVerifyDsRefusalsExtra() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var g = _genAlgKey(13), rd = _dnskeyRd(257, 13, g.pub);
+  check("verifyDs: null ds refused", code(function () { b.network.dns.dnssec.verifyDs({ ownerName: "test.", dnskeyRdata: rd, ds: null }); }) === "dnssec/bad-ds");
+  check("verifyDs: unsupported DS digest type refused", code(function () { b.network.dns.dnssec.verifyDs({ ownerName: "test.", dnskeyRdata: rd, ds: { keyTag: b.network.dns.dnssec.keyTag(rd), algorithm: 13, digestType: 99, digest: Buffer.alloc(32) } }); }) === "dnssec/unsupported-digest");
+}
+
+// nsec3Hash: iterated SHA-1 (iterations > 0) and non-negative-integer guard.
+function testNsec3HashEdge() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var salt = Buffer.from([1, 2, 3]);
+  var h0 = b.network.dns.dnssec.nsec3Hash("x.test", { salt: salt, iterations: 0 });
+  var h3 = b.network.dns.dnssec.nsec3Hash("x.test", { salt: salt, iterations: 3 });
+  check("nsec3Hash: iterations>0 yields a distinct 20-byte hash", Buffer.isBuffer(h3) && h3.length === 20 && Buffer.compare(h0, h3) !== 0);
+  check("nsec3Hash: negative iterations refused", code(function () { b.network.dns.dnssec.nsec3Hash("x.test", { salt: Buffer.alloc(0), iterations: -1 }); }) === "dnssec/bad-iterations");
+  check("nsec3Hash: non-integer iterations refused", code(function () { b.network.dns.dnssec.nsec3Hash("x.test", { salt: Buffer.alloc(0), iterations: 1.5 }); }) === "dnssec/bad-iterations");
+}
+
+// NSEC3 RDATA / owner-label parse refusals + salt/iteration agreement.
+function testNsec3ParseRefusals() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  function denial(nsec3, extra) { return b.network.dns.dnssec.verifyDenial(Object.assign({ qname: "x.test", proof: "nxdomain", zone: "test", nsec3: nsec3 }, extra || {})); }
+  var goodNext = b32hDecode("BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB");
+  check("verifyDenial: invalid base32hex NSEC3 owner refused", code(function () { denial([{ owner: "wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.test", rdata: nsec3Rdata({ iterations: 0, next: goodNext }) }]); }) === "dnssec/bad-nsec3");
+  check("verifyDenial: truncated NSEC3 RDATA refused", code(function () { denial([{ owner: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test", rdata: Buffer.from([1, 0, 0]) }]); }) === "dnssec/bad-nsec3");
+  check("verifyDenial: NSEC3 salt overrun refused", code(function () { denial([{ owner: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test", rdata: Buffer.from([1, 0, 0, 0, 40, 0]) }]); }) === "dnssec/bad-nsec3");
+  check("verifyDenial: NSEC3 next-hash overrun refused", code(function () { denial([{ owner: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test", rdata: Buffer.from([1, 0, 0, 0, 0, 40]) }]); }) === "dnssec/bad-nsec3");
+  check("verifyDenial: non-string NSEC3 owner refused", code(function () { denial([{ owner: 123, rdata: nsec3Rdata({ iterations: 0, next: goodNext }) }]); }) === "dnssec/bad-nsec3");
+  check("verifyDenial: NSEC3 owner with no hash label refused", code(function () { denial([{ owner: "", rdata: nsec3Rdata({ iterations: 0, next: goodNext }) }]); }) === "dnssec/bad-nsec3");
+  check("verifyDenial: negative maxIterations refused", code(function () { denial([{ owner: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test", rdata: nsec3Rdata({ iterations: 0, next: goodNext }) }], { maxIterations: -1 }); }) === "dnssec/bad-arg");
+  var r1 = { owner: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test", rdata: nsec3Rdata({ iterations: 0, salt: Buffer.from([1]), next: goodNext }) };
+  var r2 = { owner: "cccccccccccccccccccccccccccccccc.test", rdata: nsec3Rdata({ iterations: 0, salt: Buffer.from([2]), next: b32hDecode("DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD") }) };
+  check("verifyDenial: NSEC3 records disagreeing on salt refused", code(function () { denial([r1, r2]); }) === "dnssec/nsec3-param-mismatch");
+}
+
+// NSEC3 denial mechanisms: DS NODATA (§8.5), CNAME redirect refusal, a
+// wrapping cover (owner == next — the minimal single-NSEC3 zone), the
+// no-closest-encloser refusal, Opt-Out DS NODATA (§8.6), and wildcard
+// NODATA (§8.7).
+function testNsec3DenialBranches() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var salt = Buffer.alloc(0);
+  function H(n) { return b.network.dns.dnssec.nsec3Hash(n, { salt: salt, iterations: 0 }); }
+  var qHash = H("q.test");
+  var dsAbsent = { owner: _b32hEnc(qHash) + ".test", rdata: nsec3Rdata({ iterations: 0, next: bufInc(qHash, 1), types: ["A", "RRSIG"] }) };
+  var okDs = b.network.dns.dnssec.verifyDenial({ qname: "q.test", qtype: "DS", proof: "nodata", zone: "test", nsec3: [dsAbsent] });
+  check("verifyDenial: NSEC3 DS NODATA proven when DS absent (matching)", okDs.ok && okDs.proof === "nodata" && okDs.matched === true);
+  var dsPresent = { owner: _b32hEnc(qHash) + ".test", rdata: nsec3Rdata({ iterations: 0, next: bufInc(qHash, 1), types: ["DS", "RRSIG"] }) };
+  check("verifyDenial: NSEC3 DS NODATA refused when DS present", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "q.test", qtype: "DS", proof: "nodata", zone: "test", nsec3: [dsPresent] }); }) === "dnssec/denial-not-proven");
+  var cnameRec = { owner: _b32hEnc(qHash) + ".test", rdata: nsec3Rdata({ iterations: 0, next: bufInc(qHash, 1), types: ["CNAME", "RRSIG"] }) };
+  check("verifyDenial: NSEC3 NODATA refused when name is a CNAME", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "q.test", qtype: "A", proof: "nodata", zone: "test", nsec3: [cnameRec] }); }) === "dnssec/denial-not-proven");
+
+  var ceHash = H("test");
+  var ceMatch = { owner: _b32hEnc(ceHash) + ".test", rdata: nsec3Rdata({ iterations: 0, next: bufInc(ceHash, 1), types: ["NS", "SOA"] }) };
+  var wrapAll = { owner: _b32hEnc(Buffer.alloc(20, 0xff)) + ".test", rdata: nsec3Rdata({ iterations: 0, next: Buffer.alloc(20, 0xff), types: [] }) };
+  var nxWrap = b.network.dns.dnssec.verifyDenial({ qname: "q.test", proof: "nxdomain", zone: "test", nsec3: [ceMatch, wrapAll] });
+  check("verifyDenial: NSEC3 NXDOMAIN proven via a wrapping cover (owner==next)", nxWrap.ok && nxWrap.proof === "nxdomain" && nxWrap.closestEncloser === "test.");
+  check("verifyDenial: NSEC3 NXDOMAIN with no closest-encloser refused", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "q.test", proof: "nxdomain", zone: "test", nsec3: [wrapAll] }); }) === "dnssec/denial-not-proven");
+
+  var ceOnly = { owner: _b32hEnc(ceHash) + ".test", rdata: nsec3Rdata({ iterations: 0, next: bufInc(ceHash, 1), types: ["NS", "SOA"] }) };
+  var optOutCover = { owner: _b32hEnc(Buffer.alloc(20, 0)) + ".test", rdata: nsec3Rdata({ flags: 1, iterations: 0, next: Buffer.alloc(20, 0xff) }) };
+  var ddsOut = b.network.dns.dnssec.verifyDenial({ qname: "q.test", qtype: "DS", proof: "nodata", zone: "test", nsec3: [ceOnly, optOutCover] });
+  check("verifyDenial: NSEC3 Opt-Out DS NODATA proven (§8.6)", ddsOut.ok && ddsOut.optOut === true && ddsOut.matched === false);
+
+  var wcMatch = { owner: _b32hEnc(H("*.test")) + ".test", rdata: nsec3Rdata({ iterations: 0, next: bufInc(H("*.test"), 1), types: ["A", "RRSIG"] }) };
+  var wcOut = b.network.dns.dnssec.verifyDenial({ qname: "q.test", qtype: "MX", proof: "nodata", zone: "test", nsec3: [ceOnly, wcMatch] });
+  check("verifyDenial: NSEC3 wildcard NODATA proven (§8.7)", wcOut.ok && wcOut.wildcard === true && wcOut.closestEncloser === "test.");
+
+  // NODATA with no matching record, no closest encloser, and no wildcard →
+  // the queried type is not proven absent (fail closed).
+  var unrelated = { owner: _b32hEnc(H("zzz.other")) + ".test", rdata: nsec3Rdata({ iterations: 0, next: bufInc(H("zzz.other"), 1), types: ["A"] }) };
+  check("verifyDenial: NSEC3 NODATA refused with no matching / CE / wildcard NSEC3", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "q.test", qtype: "A", proof: "nodata", zone: "test", nsec3: [unrelated] }); }) === "dnssec/denial-not-proven");
+
+  check("verifyDenial: empty qname refused", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "", proof: "nxdomain", zone: "test", nsec3: [unrelated] }); }) === "dnssec/bad-arg");
+  check("verifyDenial: empty zone refused", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "q.test", proof: "nxdomain", zone: "", nsec3: [unrelated] }); }) === "dnssec/bad-arg");
+}
+
+// NSEC RDATA parse refusals (bad bitmap, compression pointer, truncated name,
+// root next-name) + NODATA/NXDOMAIN no-match refusals + CNAME redirect refusal.
+function testNsecParseRefusals() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  function nx(nsec) { return b.network.dns.dnssec.verifyDenial({ qname: "x.example.com", proof: "nxdomain", zone: "example.com", nsec: nsec }); }
+  var badBitmap = Buffer.concat([nsecRdata("a.example.com", []), Buffer.from([0, 40])]);
+  check("verifyDenial: malformed NSEC type bitmap refused", code(function () { nx([{ owner: "example.com", rdata: badBitmap }]); }) === "dnssec/bad-bitmap");
+  check("verifyDenial: NSEC compression pointer in RDATA refused", code(function () { nx([{ owner: "example.com", rdata: Buffer.from([0xc0, 0x0c]) }]); }) === "dnssec/bad-name");
+  check("verifyDenial: truncated NSEC name refused", code(function () { nx([{ owner: "example.com", rdata: Buffer.from([5, 0x61, 0x62]) }]); }) === "dnssec/bad-name");
+  check("verifyDenial: non-string NSEC owner refused", code(function () { nx([{ owner: 123, rdata: nsecRdata("a.example.com", []) }]); }) === "dnssec/bad-nsec");
+  check("verifyDenial: NSEC with a root next-name parsed (no crash)", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "x.example.com", qtype: "A", proof: "nodata", zone: "example.com", nsec: [{ owner: "example.com", rdata: nsecRdata(".", []) }] }); }) === "dnssec/denial-not-proven");
+  check("verifyDenial: NSEC owner canonicalising to root handled", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "x.example.com", qtype: "A", proof: "nodata", zone: "example.com", nsec: [{ owner: "", rdata: nsecRdata("a.example.com", ["A"]) }] }); }) === "dnssec/denial-not-proven");
+  check("verifyDenial: NSEC NODATA with no matching owner refused", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "nomatch.example.com", qtype: "A", proof: "nodata", zone: "example.com", nsec: [{ owner: "example.com", rdata: nsecRdata("a.example.com", ["A"]) }] }); }) === "dnssec/denial-not-proven");
+  check("verifyDenial: NSEC NODATA refused when the name is a CNAME", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "example.com", qtype: "A", proof: "nodata", zone: "example.com", nsec: [{ owner: "example.com", rdata: nsecRdata("a.example.com", ["CNAME", "RRSIG"]) }] }); }) === "dnssec/denial-not-proven");
+  check("verifyDenial: NSEC NXDOMAIN with no covering owner refused", code(function () { b.network.dns.dnssec.verifyDenial({ qname: "aaa.example.com", proof: "nxdomain", zone: "example.com", nsec: [{ owner: "z.example.com", rdata: nsecRdata("z.example.com", ["A"]) }] }); }) === "dnssec/denial-not-proven");
+}
+
+// verifyChain input-shape refusals + amplification caps that fire on COUNT
+// checks (before any signature verification).
+function testVerifyChainRefusals() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var now = Math.floor(Date.now() / 1000);
+  var g = _genAlgKey(13), rd = _dnskeyRd(257, 13, g.pub);
+  var tag = b.network.dns.dnssec.keyTag(rd);
+  var rrsig = _signRrsetAlg(g, 13, "test.", 48, [rd], rd, now - 60, now + 86400);
+  var digest = nodeCrypto.createHash("sha256").update(Buffer.concat([_canonName("test."), rd])).digest();
+  var anchor = [{ keyTag: tag, algorithm: 13, digestType: 2, digest: digest }];
+  var at = new Date(now * 1000);
+  var many = []; for (var i = 0; i < 129; i++) many.push({ zone: "z.", dnskeys: [rd], dnskeyRrsig: rrsig });
+  check("verifyChain: > 128 chain links refused", code(function () { b.network.dns.dnssec.verifyChain({ links: many, trustAnchors: anchor, at: at }); }) === "dnssec/too-many-links");
+  check("verifyChain: empty trustAnchors refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [{ zone: "test.", dnskeys: [rd], dnskeyRrsig: rrsig }], trustAnchors: [], at: at }); }) === "dnssec/bad-arg");
+  check("verifyChain: link without zone refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [{ dnskeys: [rd], dnskeyRrsig: rrsig }], trustAnchors: anchor, at: at }); }) === "dnssec/bad-link");
+  check("verifyChain: link without dnskeys refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [{ zone: "test.", dnskeys: [] }], trustAnchors: anchor, at: at }); }) === "dnssec/bad-link");
+  check("verifyChain: link without dnskeyRrsig refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [{ zone: "test.", dnskeys: [rd] }], trustAnchors: anchor, at: at }); }) === "dnssec/bad-link");
+  var shortRd = Buffer.from([0, 1, 2]);
+  var shortRrsig = Object.assign({}, rrsig, { keyTag: b.network.dns.dnssec.keyTag(shortRd) });
+  check("verifyChain: candidate DNSKEY RDATA too short refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [{ zone: "test.", dnskeys: [shortRd], dnskeyRrsig: shortRrsig }], trustAnchors: anchor, at: at }); }) === "dnssec/bad-key");
+  check("verifyChain: no DNSKEY matching the RRSIG key tag refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [{ zone: "test.", dnskeys: [rd], dnskeyRrsig: Object.assign({}, rrsig, { keyTag: (tag + 1) & 0xffff }) }], trustAnchors: anchor, at: at }); }) === "dnssec/chain-no-signing-key");
+}
+
+// verifyChain delegation branches on a real 2-link EC chain: anchor tag-skip +
+// wrong-digest fallthrough, missing DS, DS RRset caps, DS-match loop skips, and
+// the chain-ds-mismatch / short-DS refusals.
+function testVerifyChainDelegationBranches() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  var now = Math.floor(Date.now() / 1000), inc = now - 60, exp = now + 86400, at = new Date(now * 1000);
+  var root = _genAlgKey(13), rootRd = _dnskeyRd(257, 13, root.pub);
+  var child = _genAlgKey(13), childRd = _dnskeyRd(257, 13, child.pub);
+  var rootRrsig = _signRrsetAlg(root, 13, ".", 48, [rootRd], rootRd, inc, exp);
+  var childRrsig = _signRrsetAlg(child, 13, "org.", 48, [childRd], childRd, inc, exp);
+  var rootDigest = nodeCrypto.createHash("sha256").update(Buffer.concat([_canonName("."), rootRd])).digest();
+  var rootTag = b.network.dns.dnssec.keyTag(rootRd);
+  var anchors = [
+    { keyTag: (rootTag + 1) & 0xffff, algorithm: 13, digestType: 2, digest: rootDigest },
+    { keyTag: rootTag, algorithm: 13, digestType: 2, digest: Buffer.alloc(32, 0xab) },
+    { keyTag: rootTag, algorithm: 13, digestType: 2, digest: rootDigest },
+  ];
+  function rootLink() { return { zone: ".", dnskeys: [rootRd], dnskeyRrsig: rootRrsig }; }
+  var childTag = b.network.dns.dnssec.keyTag(childRd);
+  var childDigest = nodeCrypto.createHash("sha256").update(Buffer.concat([_canonName("org."), childRd])).digest();
+  var childDs = _dsRdata(childTag, 13, childDigest);
+  var dsRrsig = _signDsRrset("org.", [childDs], root.priv, rootRd, inc, exp);
+  var good = b.network.dns.dnssec.verifyChain({ links: [rootLink(), { zone: "org.", dnskeys: [childRd], dnskeyRrsig: childRrsig, dsRdatas: [childDs], dsRrsig: dsRrsig }], trustAnchors: anchors, at: at });
+  check("verifyChain: multi-anchor tag-skip + wrong-digest fallthrough validates", good.ok === true && good.zone === "org.");
+  check("verifyChain: delegation link missing DS refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [rootLink(), { zone: "org.", dnskeys: [childRd], dnskeyRrsig: childRrsig }], trustAnchors: anchors, at: at }); }) === "dnssec/bad-link");
+  var bigDs = []; for (var i = 0; i < 17; i++) bigDs.push(childDs);
+  check("verifyChain: > 16 DS records refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [rootLink(), { zone: "org.", dnskeys: [childRd], dnskeyRrsig: childRrsig, dsRdatas: bigDs, dsRrsig: dsRrsig }], trustAnchors: anchors, at: at }); }) === "dnssec/too-many-ds");
+  var bogusDs = _dsRdata((childTag + 1) & 0xffff, 13, childDigest);
+  var bogusDsRrsig = _signDsRrset("org.", [bogusDs], root.priv, rootRd, inc, exp);
+  check("verifyChain: DS matching no child KSK refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [rootLink(), { zone: "org.", dnskeys: [childRd], dnskeyRrsig: childRrsig, dsRdatas: [bogusDs], dsRrsig: bogusDsRrsig }], trustAnchors: anchors, at: at }); }) === "dnssec/chain-ds-mismatch");
+  var wrongTagDs = _dsRdata((childTag + 7) & 0xffff, 13, childDigest);
+  var wrongDigestDs = _dsRdata(childTag, 13, Buffer.alloc(32, 0x11));
+  var multiDs = [wrongTagDs, wrongDigestDs, childDs];
+  var multiDsRrsig = _signDsRrset("org.", multiDs, root.priv, rootRd, inc, exp);
+  var okMulti = b.network.dns.dnssec.verifyChain({ links: [rootLink(), { zone: "org.", dnskeys: [childRd], dnskeyRrsig: childRrsig, dsRdatas: multiDs, dsRrsig: multiDsRrsig }], trustAnchors: anchors, at: at });
+  check("verifyChain: DS set with wrong-tag + wrong-digest entries still matches the correct DS", okMulti.ok === true);
+  var shortDs = Buffer.from([0, 1, 2]);
+  var shortDsRrsig = _signDsRrset("org.", [shortDs], root.priv, rootRd, inc, exp);
+  check("verifyChain: short DS RDATA refused", code(function () { b.network.dns.dnssec.verifyChain({ links: [rootLink(), { zone: "org.", dnskeys: [childRd], dnskeyRrsig: childRrsig, dsRdatas: [shortDs], dsRrsig: shortDsRrsig }], trustAnchors: anchors, at: at }); }) === "dnssec/bad-ds");
+}
+
+// A DNSKEY sharing the signer's key tag but carrying a different algorithm is
+// a colliding candidate the chain walk must SKIP (RFC 4035 §5.3.1) before it
+// reaches the real signer — not a terminal alg-mismatch.
+function testVerifyChainCollidingAlgKey() {
+  var now = Math.floor(Date.now() / 1000), inc = now - 60, exp = now + 86400, at = new Date(now * 1000);
+  var g = _genAlgKey(13), keyA = _dnskeyRd(257, 13, g.pub);
+  var keyB = Buffer.from(keyA);
+  keyB[3] = 14;   // algorithm 13 → 14 (odd index: +1 to the key-tag accumulator)
+  var adjusted = false;
+  for (var j = 5; j < keyB.length; j += 2) { if (keyB[j] >= 1) { keyB[j] -= 1; adjusted = true; break; } }
+  check("test crafted a same-tag different-algorithm DNSKEY", adjusted && b.network.dns.dnssec.keyTag(keyA) === b.network.dns.dnssec.keyTag(keyB));
+  var rdatas = [keyB, keyA];
+  var rrsig = _signRrsetAlg(g, 13, "test.", 48, rdatas, keyA, inc, exp);
+  var digest = nodeCrypto.createHash("sha256").update(Buffer.concat([_canonName("test."), keyA])).digest();
+  var anchor = [{ keyTag: b.network.dns.dnssec.keyTag(keyA), algorithm: 13, digestType: 2, digest: digest }];
+  var out = b.network.dns.dnssec.verifyChain({ links: [{ zone: "test.", dnskeys: rdatas, dnskeyRrsig: rrsig }], trustAnchors: anchor, at: at });
+  check("verifyChain: skips a same-tag different-algorithm key and validates with the real signer", out.ok === true);
+}
+
+// NXDOMAIN accepts an (optional) qtype alongside the real NSEC3 proof.
+function testDenialExtra() {
+  var out = b.network.dns.dnssec.verifyDenial({ qname: "nonexistent-blamejs-test-xyz.iana.org", qtype: "A", proof: "nxdomain", zone: "iana.org", nsec3: ianaRecords() });
+  check("verifyDenial: NXDOMAIN with an explicit qtype still proven", out.ok && out.proof === "nxdomain");
+}
+
 async function run() {
   testSurface();
   testRealVectors();
@@ -533,6 +843,19 @@ async function run() {
   testWildcardMatchRejected();
   testNsec();
   testDenialArgs();
+  testAlgorithmRoundTrips();
+  testNameFreeTypesAndNumericType();
+  testRsaThreeByteExponentForm();
+  testVerifyRrsetRefusalsExtra();
+  testVerifyDsRefusalsExtra();
+  testNsec3HashEdge();
+  testNsec3ParseRefusals();
+  testNsec3DenialBranches();
+  testNsecParseRefusals();
+  testVerifyChainRefusals();
+  testVerifyChainDelegationBranches();
+  testVerifyChainCollidingAlgKey();
+  testDenialExtra();
 }
 
 module.exports = { run: run };