
# Copyright 2004-2008 SPARTA, Inc.  All rights reserved.
# See the COPYING file included with the dnssec-tools package for details.


                       Validator Shim Library


The validator shim library ('libval_shim.so') is a shared library
designed to be dynamically loaded using the 'LD_PRELOAD' mechanism
supported on linux and various other unix-like platforms. The shim
library implements wrappers for a number of DNS related functions and
in turn calls equivalent DNSSEC-aware validating functions from
'libval', mapping the results to return codes recognized by the
original functions. In this way a wide variety of applications can be
made DNSSEC aware without code changes and recompilation.

The method of mapping return codes assumes that any 'untrusted' or
failure result from the 'libval' function is reflected as a failure to
the original calling function.

Usage:

   To load the library set LD_PRELOAD variable within the environment
   of the the target application prior to execution:

   	export LD_PRELOAD=libval_shim.so

Validation Policy:

   The validator shim library will create a policy context and cache
   it for all subsequent 'libval' calls. A "NULL" policy label will be
   passed to create the context. The policy is chosen according to
   rules defined for 'libval'.

   See 'man dnsval.conf' for information on policy labels and definition.

Logging:

   Logging for the 'libval' functions may be enabled in the shim
   library by setting an environment variable

   See 'man validate' for specifics.


Notes:

1) setuid and setgid root programs (e.g., ping) do not honor the
LD_PRELOAD setting. These application may still use the LD_PRELOAD
mechanism when run directly from a root shell.