Fix enum inversion.

A change in Python 3.11's enum module caused IntEnum inversion to only
invert the bits associated with the (inferred) range of the flag,
meaning that ~dns.flags.DO only inverted 16 bits.  This meant that
calling want_dnssec(False) on a message would unconditionally set the
EDNS version field to 0.

diff --git a/dns/message.py b/dns/message.py
index daae6363a9bd042db2c13609b02894e0e6f7b3c4..70049efd3320cd73b40859bfb2ae85c40038dc9e 100644 (file)
--- a/dns/message.py
+++ b/dns/message.py
@@ -826,7 +826,7 @@ class Message:
         if wanted:
             self.ednsflags |= dns.flags.DO
         elif self.opt:
-            self.ednsflags &= ~dns.flags.DO
+            self.ednsflags &= ~int(dns.flags.DO)
 
     def rcode(self) -> dns.rcode.Rcode:
         """Return the rcode.

diff --git a/tests/test_message.py b/tests/test_message.py
index 0eb34d7cf33c49c21bcf30eb70e43827fa06a6c7..59ca507b0306edaf1bac3e5c3830b7b90adbdcf6 100644 (file)
--- a/tests/test_message.py
+++ b/tests/test_message.py
@@ -233,6 +233,18 @@ class MessageTestCase(unittest.TestCase):
         m.use_edns(1)
         self.assertEqual((m.ednsflags >> 16) & 0xFF, 1)
 
+    def test_EDNSVersionCoherenceWithDNSSEC(self):
+        m = dns.message.make_query("foo", "A")
+        m.use_edns(1)
+        m.want_dnssec(True)
+        self.assertEqual((m.ednsflags >> 16) & 0xFF, 1)
+
+    def test_EDNSVersionCoherenceWithoutDNSSEC(self):
+        m = dns.message.make_query("foo", "A")
+        m.use_edns(1)
+        m.want_dnssec(False)
+        self.assertEqual((m.ednsflags >> 16) & 0xFF, 1)
+
     def test_SettingNoEDNSOptionsImpliesNoEDNS(self):
         m = dns.message.make_query("foo", "A")
         self.assertEqual(m.edns, -1)