Draft support DNSSEC + DANE #16
Conversation
That adds the ARES_FLAG_DNSSEC flag, which enables the extensions needed for the server to send a DNSSEC reply.
That flag ensures that if DNSSEC is not used in the reply, and the AD bit is not set, then the query will fail with ARES_ENODNSSEC.
This adds ares_parse_tlsa_reply().
…tagged as trusted. The trusted nameservers are read from PATH_RESOLV_SEC_CONF which is /etc/resolv-sec.conf in Linux. That file is assumed to have the same format as /etc/resolv.conf and contain all the trusted for DNSSEC nameservers.
|
Please note that this approach is being discussed on libc-alpha list: https://sourceware.org/ml/libc-alpha/2014-06/msg00512.html Currently there is no definitive decision about configuration file format so there is some risk of creating incompatibilties between various resolver libraries. |
|
Indeed there was some discussion in libc-alpha, but it was never concluded. To be honest the libc API is unsuitable for DNSSEC as it has too much of global state that would require an application to either use DNSSEC or not. That is unsuitable for libraries, so I question how much relevant is libc for a dnssec API. Indeed they are the primary user of resolv.conf but I don't believe that the deployment of DNSSEC in unrelated libraries should be blocked indefinetely until libc-alpha makes a decision. |
This series of patches adds support for DNSSEC + parsing of DANE structures.
Changes: