Subject: [dane] OpenSSL DANE support added to Net::SSLeay

From: Mike McCauley <[email-masked]>
Date: Wed, 22 May 2013 16:16:49 +1000

Hi All,

I have now added support for SSL_get_tlsa_record_byname() to Net::SSLeay. It 
is available in SVN.

Cheers.

-- 
Mike McCauley                                     [email-masked]
Airspayce Pty Ltd
9 Bulbul Place Currumbin Waters QLD 4223 Australia   http://www.airspayce.com
Phone +61 7 5598-7474                       Fax   +61 7 5598-7070

---

From: Viktor Dukhovni <[email-masked]>
Date: Wed, 22 May 2013 13:20:37 +0000

On Wed, May 22, 2013 at 04:16:49PM +1000, Mike McCauley wrote:

> I have now added support for SSL_get_tlsa_record_byname() to
> Net::SSLeay. It is available in SVN.

The DANE support in OpenSSL has not stabilized yet, it may be
premature to add features to other products that depend on it.

For example, I think it that the OpenSSL library should NOT be
dynamically loading libunbound for DNSSEC TLSA lookups.  Rather,
it should be using the platform resolver with the "DO" bit set
to get validated responses ("DO" bit set) from the local cache.

Only applications that want to do their own validation should use
libunbound or similar, and should do so by using their own choice
DNSSEC client library.

The control interface for passing this data back to OpenSSL may
also change, at least in so far as I believe it should return
errors when all TLSA RRs are malformed or unusable, ...

I think you should wait until there is an OpenSSL release with
documented interfaces for DANE before adding support for said
interfaces.

-- 
	Viktor.