Re: [PATCH] Add support for ldns

Simon Vallet wrote:
> nobody on this one ?

Sorry for the delay. I started looking at this and then got sidetracked
(as usual).

> I really think autonomous signature validation capabilities are a useful
> feature in an ssh client. In a mobile scenario, simply trusting the next
> DNS hop seems only marginally better as having no signed records at all.
>
> I'm willing to spend more time on this patch if necessary, so any
> feedback is welcome

I have no objection to this in principle. LDNS seems to be under a
3-clause BSD style license so there's no potential license hassles.

About the patch itself, I would probably wait until the required
features make it into a released version of the software so there's more
likelihood of the interface being stable. I would also like someone
more familiar with DNSSEC than me to sanity check it.

You added the additional functionality to one of the files that we try
to keep in sync with its OpenBSD counterpart, so that's a potential
maintenance hassle. I think it would be better in its own file, which
according to the existing convention would be bsd-getrrsetbyname.c.

Also, I'm not wild about the use of debug() calls in the compat library
but I can see why you've used them. We try to avoid them in code that
replaces library functions so the code is usable in other things.

There's also a few style nits (lines >80 chars, indentation, spaces
instead of tabs). Nothing major, but if you haven't already then please
read http://www.openbsd.org/cgi-bin/man.cgi?query=style .

> Simon
>
> On Mon, 21 May 2007 15:55:07 +0200
> Simon Vallet <svallet@genoscope.cns.fr> wrote:
>
>> Hi,
>>
>> as discussed before, we're trying to make use of SSHFP records (RFC
>> 4255) to publish host key fingerprints in the DNS.
>>
>> However, some non-OpenBSD platforms don't support DNSSEC in the native
>> resolver (e.g. glibc), which renders the whole thing quite useless,
>> since openssh correctly requires the RRs to be signed and validated.
>>
>> The following patch adds support for ldns, an external resolver
>> library, with the following functionality:
>> - Set DO on the SSHFP query
>> - Support AD if the answer comes from a validating resolver
>> - Support autonomous validation using a configured trust anchor in case
>> the answer is not marked as authentic.

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://lists.mindrot.org/mailman/lis...enssh-unix-dev