dns/resource: NS DNSSEC

Sign the additional fields for a NS query.

lib/dns/resource.js

@@ -1228,13 +1228,27 @@ class Resource extends Struct {
         key.signZSK(res.additional, types.A);
         key.signZSK(res.additional, types.AAAA);
         break;
-      case types.NS:
+      case types.NS: {
         res.authority = this.toNS(name);
         res.additional = this.toNSIP(name);
         for (const rr of this.toGlue(types.NS))
           res.additional.push(rr);
         key.signZSK(res.authority, types.NS);
+
+        const names = new Set();
+        for (const rr of res.additional)
+          names.add(rr.name);
+
+        const additional = res.additional;
+        for (const name of names) {
+          for (const type of [types.A, types.AAAA]) {
+            const rrset = util.extractSet(additional, name, type);
+            const sig = key.signZSK(rrset, type);
+            additional.push(...sig);
+          }
+        }
         break;
+      }
       case types.MX:
         res.answer = this.toMX(name);
         res.additional = this.toMXIP(name);