RRSIG headers fix

README.md

@@ -48,7 +48,7 @@ $ go build
 * Query based ratelimit
 * Black-hole internet advertisements and malware servers
 * HTTP API support 
-* Outbount IP selection
+* Outbound IP selection
 
 ## TODO
 

resolver.go

@@ -117,6 +117,9 @@ func (r *Resolver) Resolve(Net string, req *dns.Msg, servers []string, root bool
 		var signerFound bool
 
 		for _, rr := range resp.Answer {
+			if rr.Header().Name != req.Question[0].Name {
+				continue
+			}
 			if sigrec, ok := rr.(*dns.RRSIG); ok {
 				signer = sigrec.SignerName
 				signerFound = true
@@ -277,6 +280,9 @@ func (r *Resolver) Resolve(Net string, req *dns.Msg, servers []string, root bool
 				var signerFound bool
 
 				for _, rr := range resp.Ns {
+					if rr.Header().Name != nsrec.Header().Name {
+						continue
+					}
 					if sigrec, ok := rr.(*dns.RRSIG); ok {
 						signer = sigrec.SignerName
 						signerFound = true

utils.go

@@ -227,8 +227,14 @@ func verifyRRSIG(keys map[uint16]*dns.DNSKEY, msg *dns.Msg) error {
 		return errNoSignatures
 	}
 
+main:
 	for _, sigRR := range sigs {
 		sig := sigRR.(*dns.RRSIG)
+		for _, k := range keys {
+			if !strings.HasPrefix(sig.Header().Name, k.Header().Name) {
+				continue main
+			}
+		}
 		rest := extractRRSet(rr, sig.Header().Name, sig.TypeCovered)
 		if len(rest) == 0 {
 			return errMissingSigned