ns/resource: fix NSEC handling for _synth

handshake-org · Dec 22, 2021 · 3a4a227 · 3a4a227
1 parent de6ced8
commit 3a4a227
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/src/ns.c b/src/ns.c
@@ -332,7 +332,6 @@ hsk_ns_onrecv(
 
     hsk_dns_rrs_t *an = &msg->an;
     hsk_dns_rrs_t *rrns = &msg->ns;
-    hsk_dns_rrs_t *ar = &msg->ar;
 
     uint8_t ip[16];
     uint16_t family;
@@ -344,6 +343,15 @@ hsk_ns_onrecv(
       // so recursive asks again with complete synth record.
       hsk_resource_root_to_soa(rrns);
       hsk_dnssec_sign_zsk(rrns, HSK_DNS_SOA);
+      // Empty non-terminal proof:
+      hsk_resource_to_nsec(
+        "_synth.",
+        "\\000._synth.",
+        hsk_type_map_empty,
+        sizeof(hsk_type_map_empty),
+        rrns
+      );
+      hsk_dnssec_sign_zsk(rrns, HSK_DNS_NSEC);
     }
 
     if (pointer_to_ip(synth, ip, &family)) {
@@ -409,7 +417,7 @@ hsk_ns_onrecv(
 
         hsk_dns_rrs_push(an, rr);
 
-        hsk_dnssec_sign_zsk(ar, rrtype);
+        hsk_dnssec_sign_zsk(an, rrtype);
       }
     }
 

diff --git a/src/resource.h b/src/resource.h
@@ -23,7 +23,7 @@ static const uint8_t hsk_type_map_a[] = {
 
 // AAAA RRSIG NSEC
 static const uint8_t hsk_type_map_aaaa[] = {
-  0x00, 0x06, 0x00, 0x00, 0x00, 0x80, 0x00, 0x03
+  0x00, 0x06, 0x00, 0x00, 0x00, 0x08, 0x00, 0x03
 };
 
 // NS SOA RRSIG NSEC DNSKEY