test: DNSNsec at-cap eviction + unbounded benchmark pool

bdraco · bdraco · commit e5b509a93107 · 2026-05-17T21:21:07.000-07:00
**Cross-type NSec spot-test (Kōan).** Add
``test_cache_dnsnsec_at_cap_evicts_prior_record``: fill the cache to
``_MAX_CACHE_RECORDS`` with ``DNSAddress`` records, add a single
``DNSNsec``, assert the counter stays at cap (NSEC routed through
eviction), the NSEC is reachable via ``cache.cache[nsec.key]``
(orphan fix covers NSEC's key-collision path), and the earliest
fill record was the eviction victim. Complements the existing flood
test — together they pin NSEC against both ``new``-flag drift and
cross-type ``_async_add`` regressions. Uses direct cache lookup
instead of ``async_get_unique`` because the latter's type stub
excludes ``DNSNsec``.

**Unbounded benchmark generator (Copilot inline at
test_cache_bound.py:53).** The previous bench used
``iter(_make_records(100_000, ...))`` which raises ``StopIteration``
once exhausted — fast operations under pytest-codspeed can exceed
that count. Replace with ``_unbounded_records`` (``itertools.count``
+ lazy ``DNSAddress`` construction) so the iterator survives any
iteration count CodSpeed chooses. The construction work moves into
the timed body but is a constant per-iteration overhead and doesn't
distort relative measurements across runs.
diff --git a/tests/benchmarks/test_cache_bound.py b/tests/benchmarks/test_cache_bound.py
@@ -2,13 +2,16 @@
 
 from __future__ import annotations
 
+from collections.abc import Iterator
+from itertools import count
+
 from pytest_codspeed import BenchmarkFixture
 
 from zeroconf import DNSAddress, DNSCache, current_time_millis
 from zeroconf.const import _CLASS_IN, _MAX_CACHE_RECORDS, _TYPE_A
 
 
-def _make_records(count: int, now: float, prefix: str = "bench") -> list[DNSAddress]:
+def _make_records(count_: int, now: float, prefix: str = "bench") -> list[DNSAddress]:
     return [
         DNSAddress(
             f"{prefix}-{i}.local.",
@@ -18,10 +21,23 @@ def _make_records(count: int, now: float, prefix: str = "bench") -> list[DNSAddr
             bytes(((i >> 24) & 0xFF, (i >> 16) & 0xFF, (i >> 8) & 0xFF, i & 0xFF)),
             created=now + i,
         )
-        for i in range(count)
+        for i in range(count_)
     ]
 
 
+def _unbounded_records(now: float, prefix: str = "evict") -> Iterator[DNSAddress]:
+    """Unbounded generator of unique-name DNSAddress records."""
+    for i in count():
+        yield DNSAddress(
+            f"{prefix}-{i}.local.",
+            _TYPE_A,
+            _CLASS_IN,
+            120,
+            bytes(((i >> 24) & 0xFF, (i >> 16) & 0xFF, (i >> 8) & 0xFF, i & 0xFF)),
+            created=now + i,
+        )
+
+
 def test_cache_add_below_cap(benchmark: BenchmarkFixture) -> None:
     """Adding records while the cache is well below the cap (no eviction)."""
     now = current_time_millis()
@@ -38,15 +54,14 @@ def test_cache_add_at_cap_evicts(benchmark: BenchmarkFixture) -> None:
 
     Pre-fills the cache to ``_MAX_CACHE_RECORDS`` outside the timed body so
     only the eviction-path adds are measured. Each benchmark iteration
-    consumes one fresh unique record from a pre-built pool, keeping the
-    cache permanently at the cap and the work per iteration to a single
-    ``_async_add`` + ``_async_evict_oldest`` cycle.
+    pulls one fresh unique record from an unbounded generator, keeping the
+    cache permanently at the cap. The generator avoids the iteration-count
+    cap that a pre-built pool would impose for very fast operations.
     """
     now = current_time_millis()
     cache = DNSCache()
     cache.async_add_records(_make_records(_MAX_CACHE_RECORDS, now, prefix="fill"))
-    # Large pool so the iterator outlives any reasonable codspeed run count.
-    pool = iter(_make_records(100_000, now + _MAX_CACHE_RECORDS, prefix="evict"))
+    pool = _unbounded_records(now + _MAX_CACHE_RECORDS)
 
     @benchmark
     def _evict_one() -> None:
diff --git a/tests/test_cache.py b/tests/test_cache.py
@@ -583,6 +583,31 @@ def test_cache_eviction_victim_shares_key_with_new_record() -> None:
     assert total == cache._total_records
 
 
+def test_cache_dnsnsec_at_cap_evicts_prior_record() -> None:
+    """A single DNSNsec arriving at the cap evicts one prior record and stays reachable."""
+    cache = r.DNSCache()
+    now = r.current_time_millis()
+    cache.async_add_records(
+        _addr(f"fill-{i}.local.", i, created=now + i) for i in range(const._MAX_CACHE_RECORDS)
+    )
+    assert cache._total_records == const._MAX_CACHE_RECORDS
+
+    nsec = r.DNSNsec(
+        "nsec-arrival.local.",
+        const._TYPE_NSEC,
+        const._CLASS_IN,
+        120,
+        "nsec-arrival.local.",
+        [const._TYPE_A],
+    )
+    cache.async_add_records([nsec])
+
+    assert cache._total_records == const._MAX_CACHE_RECORDS
+    assert nsec in cache.cache[nsec.key]
+    # The earliest-created fill record is gone (FIFO-ish eviction).
+    assert "fill-0.local." not in cache.cache
+
+
 def test_cache_dnsnsec_flood_is_bounded() -> None:
     """DNSNsec records honour ``_MAX_CACHE_RECORDS`` (no bypass via the ``new`` flag)."""
     cache = r.DNSCache()
