X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=blobdiff_plain;f=src%2Fquery.rs;h=1e02e2b1dfd14e742e9d470f8b67e388500b0feb;hb=ed3b8f57238092b32c9988316320d4d0ed046422;hp=4fca659cfb7ae8fb84da12ab60b76c1d5257ff5d;hpb=8b7a06506752a2456e7ce513db49058a6deaad0c;p=dnssec-prover

diff --git a/src/query.rs b/src/query.rs
index 4fca659..1e02e2b 100644
--- a/src/query.rs
+++ b/src/query.rs
@@ -138,7 +138,7 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
 	if questions != 1 { return Err(()); }
 	let answers = read_u16(&mut read)?;
 	if answers == 0 { return Err(()); }
-	let _authorities = read_u16(&mut read)?;
+	let authorities = read_u16(&mut read)?;
 	let _additional = read_u16(&mut read)?;
 
 	for _ in 0..questions {
@@ -147,7 +147,7 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
 		read_u16(&mut read)?; // class
 	}
 
-	// Only read the answers (skip authorities and additional) as that's all we care about.
+	// Only read the answers and NSEC records in authorities, skipping additional entirely.
 	let mut min_ttl = u32::MAX;
 	for _ in 0..answers {
 		let (rr, ttl) = parse_wire_packet_rr(&mut read, &resp)?;
@@ -155,6 +155,25 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
 		min_ttl = cmp::min(min_ttl, ttl);
 		if let RR::RRSig(rrsig) = rr { rrsig_key_names.push(rrsig.key_name); }
 	}
+
+	for _ in 0..authorities {
+		// Only include records from the authority section if they are NSEC/3 (or signatures
+		// thereover). We don't care about NS records here.
+		let (rr, ttl) = parse_wire_packet_rr(&mut read, &resp)?;
+		match &rr {
+			RR::RRSig(rrsig) => {
+				if rrsig.ty != NSec::TYPE && rrsig.ty != NSec3::TYPE {
+					continue;
+				}
+			},
+			RR::NSec(_)|RR::NSec3(_) => {},
+			_ => continue,
+		}
+		write_rr(&rr, ttl, proof);
+		min_ttl = cmp::min(min_ttl, ttl);
+		if let RR::RRSig(rrsig) = rr { rrsig_key_names.push(rrsig.key_name); }
+	}
+
 	Ok(min_ttl)
 }