dnsruby 1.26 → 1.30

data/lib/Dnsruby/Recursor.rb

@@ -15,35 +15,69 @@
 #++
 module Dnsruby
   class Recursor
-    #= NAME
-    #
+    class AddressCache # :nodoc: all
+      # Like an array, but stores the expiration of each record.
+      def initialize(*args)
+        @hash = Hash.new # stores addresses against their expiration
+        @mutex = Mutex.new # This class is thread-safe
+      end
+      def push(item)
+        address, ttl = item
+        expiration = Time.now + ttl
+        @mutex.synchronize {
+          @hash[address] = expiration
+        }
+      end
+      def values
+        ret =[]
+        keys_to_delete = []
+        @mutex.synchronize {
+          @hash.keys.each {|address|
+            if (@hash[address] > Time.now)
+              ret.push(address)
+            else
+              keys_to_delete.push(address)
+            end
+          }
+          keys_to_delete.each {|key|
+            @hash.delete(key)
+          }
+        }
+        return ret
+      end
+      def length
+        @mutex.synchronize {
+          return @hash.length
+        }
+      end
+      def each()
+        values.each {|v|
+          yield v
+        }
+      end
+    end
     #Dnsruby::Recursor - Perform recursive dns lookups
     #
-    #= SYNOPSIS
-    #
     #  require 'Dnsruby'
     #  rec = Dnsruby::Recursor.new()
     #  answer = rec.recurse("rob.com.au")
     #
-    #= DESCRIPTION
-    #
-    #This module uses a Dnsruby::Resolver or Dnsruby::SingleResolver to
-    #perform recursive queries.
+      #This module uses a Dnsruby::Resolver to perform recursive queries.
     #
-    #=head1 AUTHOR
+    #=== AUTHOR
     #
     #Rob Brown, bbb@cpan.org
     #Alex Dalitz, alexd@nominet.org.uk
     #
-    #=head1 SEE ALSO
+    #=== SEE ALSO
     #
-    #L<Dnsruby::Resolver>,
+    #Dnsruby::Resolver,
     #
-    #=head1 COPYRIGHT
+    #=== COPYRIGHT
     #
     #Copyright (c) 2002, Rob Brown.  All rights reserved.
     #Portions Copyright (c) 2005, Olaf M Kolkman.
-    #Ruby version Copyright (c) 2008, AlexD (Nominet UK)
+    #Ruby version with caching and validation Copyright (c) 2008, AlexD (Nominet UK)
     #
     #Example lookup process:
     #
@@ -117,10 +151,17 @@ module Dnsruby
     #rob.com.au.             7200    IN      NS      sy-dns02.tmns.net.au.
     #;; Received 135 bytes from 139.134.2.18#53(sy-dns02.tmns.net.au) in 525 ms
     #  ;;; FINALLY, THE ANSWER!
+    # Now,DNSSEC validation is performed (unless disabled).
     attr_accessor :nameservers, :callback, :recurse, :ipv6_ok
     attr_reader :hints
     # The resolver to use for the queries
     attr_accessor :resolver
+
+    # For guarding access to shared caches.
+    @@mutex = Mutex.new # :nodoc: all
+    @@hints = nil
+    @@authority_cache = Hash.new
+    @@zones_cache = nil
         
     def initialize(res = Resolver.new)
       @resolver = res
@@ -137,13 +178,16 @@ module Dnsruby
     #Normally these IPs can be obtained from the following location:
     #
     #  ftp://ftp.internic.net/domain/named.root
-    #  
+    #
     def hints=(hints)
+      Recursor.set_hints(hints, @resolver)
+    end
+    def Recursor.set_hints(hints, resolver)
       TheLog.debug(";; hints(#{hints.inspect})\n")
-      if (!hints && @nameservers)
-        @hints=(@nameservers)
+      if (!hints && @@nameservers)
+        @@hints=(@@nameservers)
       else
-        @nameservers=(hints)
+        @@nameservers=(hints)
       end
       TheLog.debug(";; verifying (root) zone...\n")
       # bind always asks one of the hint servers
@@ -151,8 +195,8 @@ module Dnsruby
       # the (root) zone as a sanity check.
       # Nice idea.
           
-      @resolver.recurse=(1)
-      packet=@resolver.query(".", "NS", "IN")
+      resolver.recurse=(1)
+      packet=resolver.query(".", "NS", "IN")
       hints = Hash.new
       if (packet)
         if (ans = packet.answer)
@@ -163,7 +207,7 @@ module Dnsruby
               server = rr.nsdname.to_s.downcase
               server.sub!(/\.$/,"")
               TheLog.debug(";; FOUND HINT: #{server}\n")
-              hints[server] = []
+              hints[server] = AddressCache.new
             end
           end
           packet.additional.each do |rr|
@@ -175,14 +219,14 @@ module Dnsruby
                 #print ";; ADDITIONAL HELP: $server -> [".$rr->rdatastr."]\n" if $self->{'debug'};
                 if (hints[server]!=nil)
                   TheLog.debug(";; STORING IP: #{server} IN A "+rr.address.to_s+"\n")
-                  hints[server]=[rr.address.to_s]
+                  hints[server].push([rr.address.to_s, rr.ttl])
                 end
               end
               if ( rr.type == Types.AAAA)
                 #print ";; ADDITIONAL HELP: $server -> [".$rr->rdatastr."]\n" if $self->{'debug'};
                 if (hints[server])
                   TheLog.debug(";; STORING IP6: #{server} IN AAAA "+rr.address.to_s+"\n")
-                  hints[server]=[rr.address.to_s]
+                  hints[server].push([rr.address.to_s, rr.ttl])
                 end
               end
                   
@@ -191,38 +235,38 @@ module Dnsruby
         end
         #                      foreach my $server (keys %hints) {
         hints.keys.each do |server|
-          if (!hints[server] || hints[server]==[])
+          if (!hints[server] || hints[server].length == 0)
             # Wipe the servers without lookups
             hints.delete(server)
           end
         end
-        @hints = hints
+        @@hints = hints
       else
-        @hints = []
+        @@hints = {}
       end
-      if (@hints.size > 0)
+      if (@@hints.size > 0)
         if (@debug)
           TheLog.info(";; USING THE FOLLOWING HINT IPS:\n")
-          @hints.values.each do |ips|
+          @@hints.values.each do |ips|
             ips.each do |server|
               TheLog.info(";;  #{server}\n")
             end
           end
         end
       else
-        warn "Server ["+(@nameservers)[0].to_s+"] did not give answers"
+        warn "Server ["+(@@nameservers)[0].to_s+"] did not give answers"
       end
           
       # Disable recursion flag.
-      @resolver.recurse=(0)
+      resolver.recurse=(0)
           
       #  return $self->nameservers( map { @{ $_ } } values %{ $self->{'hints'} } );
-      @nameservers = @hints.values
-      return @nameservers
+      @@nameservers = @@hints.values
+      return @@nameservers
     end
         
         
-    #This method is takes a code reference, which is then invoked each time a
+    #This method takes a code reference, which is then invoked each time a
     #packet is received during the recursive lookup.  For example to emulate
     #dig's C<+trace> function:
     #
@@ -243,33 +287,119 @@ module Dnsruby
     def recursion_callback
       return @callback
     end
-        
+
+    def Recursor.clear_caches(resolver = Resolver.new)
+          Recursor.set_hints(Hash.new, resolver)
+          @@zones_cache = Hash.new # key zone_name, values Hash of servers and AddressCaches
+          @@zones_cache["."] = @@hints
+    end
+
+    def query_no_validation_or_recursion(name, type=Types.A, klass=Classes.IN) # :nodoc: all
+      return query(name, type, klass, true)
+    end
+
     #This method is much like the normal query() method except it disables
     #the recurse flag in the packet and explicitly performs the recursion.
     #
     #  packet = res.query_dorecursion( "www.netscape.com.", "A")
+    #  packet = res.query_dorecursion( "www.netscape.com.", "A", "IN", true) # no validation
     #
-    #
-    def query_dorecursion(name, type=Types.A, klass=Classes.IN)
+    #The Recursor maintains a cache of known nameservers.
+    #DNSSEC validation is performed unless true is passed as the fourth parameter.
+    def query(name, type=Types.A, klass=Classes.IN, no_validation = false)
+      # @TODO@ PROVIDE AN ASYNCHRONOUS SEND WHICH RETURNS MESSAGE WITH ERROR!!!
           
       # Make sure the hint servers are initialized.
-      #      @hints=Hash.new unless @hints
-      self.hints=(Hash.new) unless @hints
+      @@mutex.synchronize {
+        self.hints=(Hash.new) unless @@hints
+      }
       @resolver.recurse=(0)
       # Make sure the authority cache is clean.
       # It is only used to store A and AAAA records of
       # the suposedly authoritative name servers.
-      # @TODO@ Use a proper cache, which respects TTL!!!
-      # @TODO@ Also, keep cache across queries
-      @authority_cache = Hash.new
-                    
-      # Seed name servers with hints
-      return _dorecursion( name, type, klass, ".", @hints, 0)
+      # TTLs are respected
+      @@mutex.synchronize {
+        if (!@@zones_cache)
+          Recursor.clear_caches(@resolver)
+        end
+      }
+
+      # So we have normal hashes, but the array of addresses at the end is now an AddressCache
+      # which respects the ttls of the A/AAAA records
+
+      # Now see if we already know the zone in question
+      # Otherwise, see if we know any of its parents (will know at least ".")
+      known_zone, known_authorities = get_closest_known_zone_authorities_for(name) # ".", @hints if nothing else
+
+      # Seed name servers with the closest known authority
+      #      ret =  _dorecursion( name, type, klass, ".", @hints, 0)
+      ret =  _dorecursion( name, type, klass, known_zone, known_authorities, 0, no_validation)
+      Dnssec.validate(ret) if !no_validation
+      #      print "\n\nRESPONSE:\n#{ret}\n"
+      return ret
+    end
+
+    def get_closest_known_zone_for(n) # :nodoc:
+      # Find the closest parent of name that we know
+      # e.g. for nominet.org.uk, try nominet.org.uk., org.uk., uk., .
+      # does @zones_cache contain the name we're after
+      if (Name === n)
+        n = n.to_s # @TODO@ This is a bit crap!
+      end
+      name = n.tr("","")
+      if (name[name.length-1] != ".")
+        name = name + "."
+      end
+
+      while (true)
+        #        print "Checking for known zone : #{name}\n"
+        zone = nil
+        @@mutex.synchronize{
+          zone = @@zones_cache[name]
+        }
+        if (zone != nil)
+          return name
+        end
+        return false if name=="." 
+        # strip the name up to the first dot
+        first_dot = name.index(".")
+        if (first_dot == (name.length-1))
+          name = "."
+        else
+          name = name[first_dot+1, name.length]
+        end
+      end
+    end
+
+    def get_closest_known_zone_authorities_for(name) # :nodoc:
+      done = false
+      known_authorities, known_zone = nil
+      while (!done)
+        known_zone = get_closest_known_zone_for(name)
+        #        print "GOT KNOWN ZONE : #{known_zone}\n"
+        @@mutex.synchronize {
+          known_authorities = @@zones_cache[known_zone] # ".", @hints if nothing else
+        }
+        #        print "Known authorities : #{known_authorities}\n"
+
+        # Make sure that known_authorities still contains some authorities!
+        # If not, remove the zone from zones_cache, and start again
+        if (known_authorities.values.length > 0)
+          done = true
+        else
+          @@mutex.synchronize{
+            @@zones_cache.delete(known_zone)
+          }
+        end
+      end
+      return known_zone, known_authorities # @TODO@ Need to synchronize access to these!
     end
         
-    def _dorecursion(name, type, klass, known_zone, known_authorities, depth)
-      # @TODO@ cache and known_authorities need to have ttls in place - use a proper cache!
-      cache = @authority_cache
+    def _dorecursion(name, type, klass, known_zone, known_authorities, depth, no_validation) # :nodoc:
+      cache = nil
+      @@mutex.synchronize{
+        cache = @@authority_cache # this acts as a store of known server_names - NOT zones
+      }
           
       if ( depth > 255 )
         TheLog.debug(";; _dorecursion() Recursion too deep, aborting...\n")
@@ -280,10 +410,9 @@ module Dnsruby
       known_zone.sub!(/\.*$/, ".")
           
       # Get IPs from authorities
-      ns = []
+      ns = [] # Array of AddressCaches (was array of array of addresses)
       known_authorities.keys.each do |ns_rec|
         if (known_authorities[ns_rec] != nil  && known_authorities[ns_rec] != [] )
-          # @TODO@ Deal with TTLs here! Use a proper cache...
           cache[ns_rec] = known_authorities[ns_rec]
           ns.push(cache[ns_rec])
         elsif (cache[ns_rec]!=nil && cache[ns_rec]!=[])
@@ -294,37 +423,38 @@ module Dnsruby
           
       if (ns.length == 0)
         found_auth = 0
-        TheLog.debug(";; _dorecursion() Failed to extract nameserver IPs:\n")
-        TheLog.debug(known_authorities.inspect + cache.inspect + "\n")
+#        @@mutex.synchronize { # @TODO@ Lock access to @@known_authorities
+        TheLog.debug(";; _dorecursion() Failed to extract nameserver IPs:")
+        TheLog.debug(known_authorities.inspect + cache.inspect)
         known_authorities.keys.each do |ns_rec|
           if (known_authorities[ns_rec]==nil || known_authorities[ns_rec]==[])
-            TheLog.debug(";; _dorecursion() Manual lookup for authority [#{ns_rec}]\n")
+            TheLog.debug(";; _dorecursion() Manual lookup for authority [#{ns_rec}]")
                 
             auth_packet=nil
             ans=[]
                 
             # Don't query for V6 if its not there.
             if ( @ipv6_ok)
-            auth_packet = _dorecursion(ns_rec,"AAAA", klass,  # packet
-              ".",               # known_zone
-              @hints,  # known_authorities
-              depth+1);         # depth
-            ans = auth_packet.answer if auth_packet
+              auth_packet = _dorecursion(ns_rec,"AAAA", klass,  # packet
+                ".",               # known_zone
+                @@hints,  # known_authorities
+                depth+1);         # depth
+              ans = auth_packet.answer if auth_packet
             end
                 
             auth_packet = _dorecursion(ns_rec,"A",klass,  # packet
               ".",               # known_zone
-              @hints,  # known_authorities
+              @@hints,  # known_authorities
               depth+1);         # depth
                 
             ans.push(auth_packet.answer ) if auth_packet
                 
             if ( ans.length > 0 )
-              TheLog.debug(";; _dorecursion() Answers found for [#{ns_rec}]\n")
+              TheLog.debug(";; _dorecursion() Answers found for [#{ns_rec}]")
               #          foreach my $rr (@ans) {
               ans.each do |rr_arr|
                 rr_arr.each do |rr|
-                  TheLog.debug(";; RR:" + rr.inspect + "\n")
+                  TheLog.debug(";; RR:" + rr.inspect + "")
                   if (rr.type == Types.CNAME)
                     # Follow CNAME
                     server = rr.name.to_s.downcase
@@ -333,9 +463,9 @@ module Dnsruby
                       if (server == ns_rec)
                         cname = rr.cname.downcase
                         cname.sub!(/\.*$/, ".")
-                        TheLog.debug(";; _dorecursion() Following CNAME ns [#{ns_rec}] -> [#{cname}]\n")
+                        TheLog.debug(";; _dorecursion() Following CNAME ns [#{ns_rec}] -> [#{cname}]")
                         if (!(known_authorities[cname]))
-                          known_authorities[cname] = []
+                          known_authorities[cname] = AddressCache.new
                         end
                         known_authorities.delete(ns_rec)
                         next
@@ -347,135 +477,156 @@ module Dnsruby
                       server.sub!(/\.*$/, ".")
                       if (known_authorities[server]!=nil)
                         ip = rr.address.to_s
-                        TheLog.debug(";; _dorecursion() Found ns: #{server} IN A #{ip}\n")
-                        # @TODO@ Worry about TTLs here - use a proper cache!
+                        TheLog.debug(";; _dorecursion() Found ns: #{server} IN A #{ip}")
                         cache[server] = known_authorities[server]
-                        cache[ns_rec].push(ip)
+                        cache[ns_rec].push([ip, rr.ttl])
                         found_auth+=1
                         next
                       end
                     end
                   end
-                  TheLog.debug(";; _dorecursion() Ignoring useless answer: " + rr.inspect + "\n")
+                  TheLog.debug(";; _dorecursion() Ignoring useless answer: " + rr.inspect + "")
                 end
               end
             else
-              TheLog.debug(";; _dorecursion() Could not find A records for [#{ns_rec}]\n")
+              TheLog.debug(";; _dorecursion() Could not find A records for [#{ns_rec}]")
             end
           end
         end
         if (found_auth > 0)
-          TheLog.debug(";; _dorecursion() Found #{found_auth} new NS authorities...\n")
+          TheLog.debug(";; _dorecursion() Found #{found_auth} new NS authorities...")
           return _dorecursion( name, type, klass, known_zone, known_authorities, depth+1)
         end
-        TheLog.debug(";; _dorecursion() No authority information could be obtained.\n")
+        TheLog.debug(";; _dorecursion() No authority information could be obtained.")
         return nil
+#        }
       end
           
       # Cut the deck of IPs in a random place.
-      TheLog.debug(";; _dorecursion() cutting deck of (" + ns.length.to_s + ") authorities...\n")
+      TheLog.debug(";; _dorecursion() cutting deck of (" + ns.length.to_s + ") authorities...")
       splitpos = rand(ns.length)
       start = ns[0, splitpos]
       endarr = ns[splitpos, ns.length - splitpos]
       ns = endarr + start
           
-          
+      nameservers = []
       ns.each do |nss|
-        nss.each do |levelns|
-          TheLog.debug(";; _dorecursion() Trying nameserver [#{levelns}]\n")
-          #        @nameservers=(levelns)
-          #            
-          #        packet = @resolver.query( name, type, klass )
-          resolver = SingleResolver.new(levelns.to_s)
-          begin
-            packet = resolver.query(name, type, klass)
-          rescue ResolvTimeout=> e
-            TheLog.debug(";; nameserver #{levelns.to_s} didn't respond\n")
-            next
-          end
-          if (packet)
-              
-            if (@callback)
-              @callback.call(packet)
-            end
+        nss.each {|n| nameservers.push(n)}
+      end
+      resolver = Resolver.new() # {:nameserver=>"127.0.0.1"})
+      resolver.nameserver = nameservers
+      servers = []
+      resolver.single_resolvers.each {|s|
+        servers.push(s.server)
+      }
+      resolver.retry_delay = nameservers.length
+      begin
+        # Should construct packet ourselves and clear RD bit
+        query = Message.new(name, type, klass)
+        query.header.rd = false
+        query.do_validation = true
+        query.do_validation = false if no_validation
+        #            print "Sending msg from resolver, dnssec = #{resolver.dnssec}, do_validation = #{query.do_validation}\n"
+        packet = resolver.send_message(query)
+        # @TODO@ Now prune unrelated RRSets (RFC 5452 section 6)
+        prune_rrsets_to_rfc5452(packet, known_zone)
+      rescue ResolvTimeout, IOError => e
+        #            TheLog.debug(";; nameserver #{levelns.to_s} didn't respond")
+        #            next
+        TheLog.debug("No response!")
+        return nil
+      end
+      if (packet) # @TODO@ Check that the packet *is* actually authoritative!!
+        if (@callback)
+          @callback.call(packet)
+        end
               
-            of = nil
-            TheLog.debug(";; _dorecursion() Response received from [" + @answerfrom.to_s + "]\n")
-            status = packet.rcode
-            authority = packet.authority
-            if (status)
-              if (status == "NXDOMAIN")
-                # I guess NXDOMAIN is the best we'll ever get
-                TheLog.debug(";; _dorecursion() returning NXDOMAIN\n")
-                return packet
-              elsif (packet.answer.length > 0)
-                TheLog.debug(";; _dorecursion() Answers were found.\n")
-                return packet
-              elsif (authority.length > 0)
-                auth = Hash.new
-                #	 foreach my $rr (@authority) {
-                authority.each do |rr|
-                  if (rr.type.to_s =~ /^(NS|SOA)$/)
-                    server = (rr.type == Types.NS ? rr.nsdname : rr.mname).to_s.downcase
-                    server.sub!(/\.*$/, ".")
-                    of = rr.name.to_s.downcase
-                    of.sub!(/\.*$/, ".")
-                    TheLog.debug(";; _dorecursion() Received authority [#{of}] [" + rr.type().to_s + "] [#{server}]\n")
-                    if (of.length <= known_zone.length)
-                      TheLog.debug(";; _dorecursion() Deadbeat name server did not provide new information.\n")
-                      next
-                    elsif (of =~ /#{known_zone}/)
-                      TheLog.debug(";; _dorecursion() FOUND closer authority for [#{of}] at [#{server}].\n")
-                      auth[server] ||= []
-                    else
-                      TheLog.debug(";; _dorecursion() Confused name server [" + @answerfrom + "] thinks [#{of}] is closer than [#{known_zone}]?\n")
-                      last
-                    end
-                  else
-                    TheLog.debug(";; _dorecursion() Ignoring NON NS entry found in authority section: " + rr.inspect + "\n")
+        of = nil
+        TheLog.debug(";; _dorecursion() Response received from [" + @answerfrom.to_s + "]")
+        status = packet.rcode
+        authority = packet.authority
+        if (status)
+          if (status == "NXDOMAIN")
+            # I guess NXDOMAIN is the best we'll ever get
+            TheLog.debug(";; _dorecursion() returning NXDOMAIN")
+            return packet
+          elsif (packet.answer.length > 0)
+            TheLog.debug(";; _dorecursion() Answers were found.")
+            return packet
+          elsif (packet.header.aa)
+            TheLog.debug(";; _dorecursion() Authoritative answer found")
+            return packet
+          elsif (authority.length > 0)
+            auth = Hash.new
+            #	 foreach my $rr (@authority) {
+            authority.each do |rr|
+              if (rr.type.to_s =~ /^(NS|SOA)$/)
+                server = (rr.type == Types.NS ? rr.nsdname : rr.mname).to_s.downcase
+                server.sub!(/\.*$/, ".")
+                of = rr.name.to_s.downcase
+                of.sub!(/\.*$/, ".")
+                TheLog.debug(";; _dorecursion() Received authority [#{of}] [" + rr.type().to_s + "] [#{server}]")
+                if (of.length <= known_zone.length)
+                  TheLog.debug(";; _dorecursion() Deadbeat name server did not provide new information.")
+                  next
+                elsif (of =~ /#{known_zone}/)
+                  TheLog.debug(";; _dorecursion() FOUND closer authority for [#{of}] at [#{server}].")
+                  auth[server] ||= AddressCache.new #[] @TODO@ If there is no additional record for this, then we want to use the authority!
+                  if ((packet.additional.rrset(rr.nsdname, Types.A).length == 0) &&
+                      (packet.additional.rrset(rr.nsdname, Types.AAAA).length == 0))
+                    auth[server].push([rr.nsdname, rr.ttl])
                   end
+                else
+                  TheLog.debug(";; _dorecursion() Confused name server [" + @answerfrom + "] thinks [#{of}] is closer than [#{known_zone}]?")
+                  return nil
                 end
-                #	 foreach my $rr ($packet->additional)
-                packet.additional.each do |rr|
-                  if (rr.type == Types.CNAME)
-                    # Store this CNAME into %auth too
-                    server = rr.name.to_s.downcase
-                    if (server)
-                      server.sub!(/\.*$/, ".")
-                      if (auth[server]!=nil && auth[server]!=[])
-                        cname = rr.cname.to_s.downcase
-                        cname.sub!(/\.*$/, ".")
-                        TheLog.debug(";; _dorecursion() FOUND CNAME authority: " + rr.string + "\n")
-                        auth[cname] ||= []
-                        auth[server] = auth[cname]
-                        next
-                      end
+              else
+                TheLog.debug(";; _dorecursion() Ignoring NON NS entry found in authority section: " + rr.inspect)
+              end
+            end
+            #	 foreach my $rr ($packet->additional)
+            packet.additional.each do |rr|
+              if (rr.type == Types.CNAME)
+                # Store this CNAME into %auth too
+                server = rr.name.to_s.downcase
+                if (server)
+                  server.sub!(/\.*$/, ".")
+                  if (auth[server]!=nil && auth[server].length > 0)
+                    cname = rr.cname.to_s.downcase
+                    cname.sub!(/\.*$/, ".")
+                    TheLog.debug(";; _dorecursion() FOUND CNAME authority: " + rr.string)
+                    auth[cname] ||= AddressCache.new # []
+                    auth[server] = auth[cname]
+                    next
+                  end
                         
+                end
+              elsif (rr.type == Types.A || rr.type == Types.AAAA)
+                server = rr.name.to_s.downcase
+                if (server)
+                  server.sub!(/\.*$/, ".")
+                  if (auth[server]!=nil)
+                    if (rr.type == Types.A)
+                      TheLog.debug(";; _dorecursion() STORING: #{server} IN A    " + rr.address.to_s)
                     end
-                  elsif (rr.type == Types.A || rr.type == Types.AAAA)
-                    server = rr.name.to_s.downcase
-                    if (server)
-                      server.sub!(/\.*$/, ".")
-                      if (auth[server]!=nil)
-                        if (rr.type = Types.A)
-                          TheLog.debug(";; _dorecursion() STORING: #{server} IN A    " + rr.address.to_s + "\n")
-                        end
-                        if (rr.type = Types.AAAA)
-                          TheLog.debug(";; _dorecursion() STORING: #{server} IN AAAA " + rr.address.to_s + "\n")
-                        end
-                        auth[server].push(rr.address.to_s)
-                        next
-                      end
+                    if (rr.type == Types.AAAA)
+                      TheLog.debug(";; _dorecursion() STORING: #{server} IN AAAA " + rr.address.to_s)
                     end
+                    auth[server].push([rr.address.to_s, rr.ttl])
+                    next
                   end
-                  TheLog.debug(";; _dorecursion() Ignoring useless: " + rr.inspect + "\n")
-                end
-                if (of =~ /#{known_zone}/)
-                  return _dorecursion( name, type, klass, of, auth, depth+1 )
-                else
-                  return _dorecursion( name, type, klass, known_zone, known_authorities, depth+1 )
                 end
               end
+              TheLog.debug(";; _dorecursion() Ignoring useless: " + rr.inspect)
+            end
+            if (of =~ /#{known_zone}/)
+              #                  print "Adding #{of} with :\n#{auth}\nto zones_cache\n"
+              @@mutex.synchronize{
+                @@zones_cache[of]=auth
+              }
+              return _dorecursion( name, type, klass, of, auth, depth+1, no_validation)
+            else
+              return _dorecursion( name, type, klass, known_zone, known_authorities, depth+1, no_validation )
             end
           end
         end
@@ -483,5 +634,35 @@ module Dnsruby
           
       return nil
     end
+
+    def prune_rrsets_to_rfc5452(packet, zone)
+      # Now prune the response of any unrelated rrsets (RFC5452 section6)
+      # "One very simple way to achieve this is to only accept data if it is
+      # part of the domain for which the query was intended."
+      if (!packet.header.aa)
+        return
+      end
+      if (!packet.question()[0])
+        return
+      end
+
+      section_rrsets = packet.section_rrsets
+      section_rrsets.keys.each {|section|
+        section_rrsets[section].each {|rrset|
+          n = Name.create(rrset.name)
+          n.absolute = true
+          if ((n.to_s == zone) || (n.to_s == Name.create(zone).to_s) ||
+                (n.subdomain_of?(Name.create(zone))) ||
+                (rrset.type == Types.OPT))
+#            # @TODO@ Leave in the response if it is an SOA, NSEC or RRSIGfor the parent zone
+##          elsif ((query_name.subdomain_of?rrset.name) &&
+#          elsif  ((rrset.type == Types.SOA) || (rrset.type == Types.NSEC) || (rrset.type == Types.NSEC3)) #)
+          else
+            TheLog.debug"Removing #{rrset.name}, #{rrset.type} from response from server for #{zone}"
+            packet.send(section).remove_rrset(rrset.name, rrset.type)
+          end
+        }
+      }
+    end
   end
 end