Subject: DNSSEC Validator API Draft - 06

From: Suresh Krishnaswamy <[email-masked]>
Date: Wed, 28 May 2008 12:04:45 -0400

Folks,

A revised version of the DNSSEC validator API is posted at:
http://tools.ietf.org/id/draft-hayatnagarkar-dnsext-validator-api-06.txt

The functions in this API are broadly structured into three  
categories -- the first set contains replacement functions for  
currently used DNS resolver functions; the second set contains  
functions that allows applications to inspect detailed results of  
DNSSEC validation (if they require this information); the third set  
contains functions that enable a user to control validator behavior  
through local policy.

There's a broad list of error codes that are defined, and these are  
mostly extracted from the list that was generated during various  
brainstorming sessions at previous IETF meetings. However, instead of  
directly using these error codes applications can also use a set of  
wrapper functions to easily determine if a particular response is  
valid or no.

I believe that there are applications that will benefit from being  
able to view the results of DNSSEC validation. The sooner we have a  
standardized way of expressing the API between the application and a  
stub resolver, the easier it will be for application developers who  
want to quickly add DNSSEC support to their applications. I'd  
encourage folks to take a moment to review this API and provide  
comments if any.

Regards,
Suresh

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Wed, 28 May 2008 17:56:07 +0100

> http://tools.ietf.org/id/draft-hayatnagarkar-dnsext-validator-api-06.txt

A quick search on google suggests
  #include <validator.h>
might not be a good idea. How about
  #include <dnssec-val.h>

You might want to consider whether there is any potential for namespace
collisions for some of the other things that file defines. I realise
there are ways around collisions but there seems little reason to
create problems for existing applications.

Alex

---

From: Joe Abley <[email-masked]>
Date: Wed, 28 May 2008 17:22:57 +0000

On 28 May 2008, at 16:56, Alex Bligh wrote:

> --On 28 May 2008 12:04:45 -0400 Suresh Krishnaswamy  
> <[email-masked]> wrote:
>

or even

   #include <dnssec/validator.h>

> create problems for existing applications.

Joe