[Bug network/20358] New: RES_USE_DNSSEC sets DO; should also have a way to set AD

[peter.van.dijk at powerdns dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=20358

            Bug ID: 20358
           Summary: RES_USE_DNSSEC sets DO; should also have a way to set
                    AD
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: peter.van.dijk at powerdns dot com
  Target Milestone: ---

Today, applications that want to be sure DNS responses have been
DNSSEC-validated can use RES_USE_DNSSEC to set +DO on the query, and check the
response for a set +AD flag. However, this relies on badly specified behaviour
(RFC 6840, 5.7/5.8). Given that such applications are not actually processing
the signatures themselves, setting +AD on the query would be more efficient, as
this signals a resolver to do validation but to not pass the signatures on.
Incidentally, using +AD instead of +DO might improve interoperability with
implementations that have differing readings of the relevant sections of RFC
6840 (like PowerDNS Recursor 4.0.0, although it is likely we will change this
to accomodate glibc users).

In short: please allow setting of +AD like you allow setting +DO (via
RES_USE_DNSSEC) today, for improved performance and interoperability.

-- 
You are receiving this mail because:
You are on the CC list for the bug.