X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=blobdiff_plain;f=src%2Fquery.rs;h=bb724020ea98f792f1631ca20d89616415d9aa75;hb=1d725ca4a022415c85072bc763d50738df863d6d;hp=4fca659cfb7ae8fb84da12ab60b76c1d5257ff5d;hpb=8b7a06506752a2456e7ce513db49058a6deaad0c;p=dnssec-prover

diff --git a/src/query.rs b/src/query.rs
index 4fca659..bb72402 100644
--- a/src/query.rs
+++ b/src/query.rs
@@ -138,7 +138,7 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
 	if questions != 1 { return Err(()); }
 	let answers = read_u16(&mut read)?;
 	if answers == 0 { return Err(()); }
-	let _authorities = read_u16(&mut read)?;
+	let authorities = read_u16(&mut read)?;
 	let _additional = read_u16(&mut read)?;
 
 	for _ in 0..questions {
@@ -147,7 +147,7 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
 		read_u16(&mut read)?; // class
 	}
 
-	// Only read the answers (skip authorities and additional) as that's all we care about.
+	// Only read the answers and NSEC records in authorities, skipping additional entirely.
 	let mut min_ttl = u32::MAX;
 	for _ in 0..answers {
 		let (rr, ttl) = parse_wire_packet_rr(&mut read, &resp)?;
@@ -155,6 +155,25 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
 		min_ttl = cmp::min(min_ttl, ttl);
 		if let RR::RRSig(rrsig) = rr { rrsig_key_names.push(rrsig.key_name); }
 	}
+
+	for _ in 0..authorities {
+		// Only include records from the authority section if they are NSEC/3 (or signatures
+		// thereover). We don't care about NS records here.
+		let (rr, ttl) = parse_wire_packet_rr(&mut read, &resp)?;
+		match &rr {
+			RR::RRSig(rrsig) => {
+				if rrsig.ty != NSec::TYPE && rrsig.ty != NSec3::TYPE {
+					continue;
+				}
+			},
+			RR::NSec(_)|RR::NSec3(_) => {},
+			_ => continue,
+		}
+		write_rr(&rr, ttl, proof);
+		min_ttl = cmp::min(min_ttl, ttl);
+		if let RR::RRSig(rrsig) = rr { rrsig_key_names.push(rrsig.key_name); }
+	}
+
 	Ok(min_ttl)
 }
 
@@ -188,6 +207,7 @@ const MAX_REQUESTS: usize = 10;
 /// make a query to `https://doh-server/endpoint?dns=base64url_encoded_query` with an `Accept`
 /// header of `application/dns-message`. Each response, in raw binary, can be fed directly into
 /// [`ProofBuilder::process_response`].
+#[derive(Clone)]
 pub struct ProofBuilder {
 	proof: Vec<u8>,
 	min_ttl: u32,